aboutsummaryrefslogtreecommitdiff
path: root/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h
AgeCommit message (Collapse)Author
2013-04-20[analyzer] Ensure BugReporterTracking works on regions with pointer arithmeticAnna Zaks
Introduce a new helper function, which computes the first symbolic region in the base region chain. The corresponding symbol has been used for assuming that a pointer is null. Now, it will also be used for checking if it is null. This ensures that we are tracking a null pointer correctly in the BugReporter. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179916 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-20[analyzer] Flip printPretty and printPrettyAsExpr as per suggestion from ↵Anna Zaks
Jordan (r179572) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179915 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-15[analyzer] Add pretty printing to CXXBaseObjectRegion.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179573 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-15[analyzer] Address code review for r179395Anna Zaks
Mostly refactoring + handle the nested fields by printing the innermost field only. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179572 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-12[analyzer]Print field region even when the base region is not printableAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179395 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-05Silence a number of static analyzer warnings with assertions and such.Jordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176469 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-24[analyzer] tracking stores/constraints now works for ObjC ivars or struct ↵Ted Kremenek
fields. This required more changes than I originally expected: - ObjCIvarRegion implements "canPrintPretty" et al - DereferenceChecker indicates the null pointer source is an ivar - bugreporter::trackNullOrUndefValue() uses an alternate algorithm to compute the location region to track by scouring the ExplodedGraph. This allows us to get the actual MemRegion for variables, ivars, fields, etc. We only hand construct a VarRegion for C++ references. - ExplodedGraph no longer drops nodes for expressions that are marked 'lvalue'. This is to facilitate the logic in the previous bullet. This may lead to a slight increase in size in the ExplodedGraph, which I have not measured, but it is likely not to be a big deal. I have validated each of the changed plist output. Fixes <rdar://problem/12114812> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175988 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-21[analyzer] Record whether a base object region represents a virtual base.Jordan Rose
This allows MemRegion and MemRegionManager to avoid asking over and over again whether an class is a virtual base or a non-virtual base. Minor optimization/cleanup; no functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175716 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-20Replace SVal llvm::cast support to be well-defined.David Blaikie
See r175462 for another example/more details. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175594 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-05Change subexpressions to be visited in the CFG from left-to-right.Ted Kremenek
This is a more natural order of evaluation, and it is very important for visualization in the static analyzer. Within Xcode, the arrows will not jump from right to left, which looks very visually jarring. It also provides a more natural location for dataflow-based diagnostics. Along the way, we found a case in the analyzer diagnostics where we needed to indicate that a variable was "captured" by a block. -fsyntax-only timings on sqlite3.c show no visible performance change, although this is just one test case. Fixes <rdar://problem/13016513> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174447 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-06Only provide explicit getCapturedRegion() and getOriginalRegion() from ↵Ted Kremenek
referenced_vars_iterator. This is a nice conceptual cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169480 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-06Pull logic to map from VarDecl* to captured region using a helper function. ↵Ted Kremenek
WIP. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169479 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-04Sort #include lines for all files under include/...Chandler Carruth
This is a simpler sort, entirely automatic with the help of llvm/utils/sort_includes.py -- no manual edits here. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169238 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-11Remove pointless classof()'s.Sean Silva
Updates to llvm/Support/Casting.h have rendered these classof()'s irrelevant. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165770 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-17[analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks
in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164046 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13[analyzer] Don't reimplement an existing function.Anna Zaks
Thanks Jordan. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163762 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163748 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-17[analyzer] Make BlockDataRegions typed, so that they have DynamicTypeInfo.Jordan Rose
Fixes <rdar://problem/12119814> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162123 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-14Changing an enumeration to a const int to fix MSVC compiler warnings.Aaron Ballman
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161877 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-13[analyzer] Don't strip CXXBaseObjectRegions when checking dynamic_casts.Jordan Rose
...and /do/ strip CXXBaseObjectRegions when casting to a virtual base class. This allows us to enforce the invariant that a CXXBaseObjectRegion can always provide an offset for its base region if its base region has a known class type, by only allowing virtual bases and direct non-virtual bases to form CXXBaseObjectRegions. This does mean some slight problems for our modeling of dynamic_cast, which needs to be resolved by finding a path from the current region to the class we're trying to cast to. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161797 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-09[analyzer] Cache the "concrete offset base" for regions with symbolic offsets.Jordan Rose
This makes it faster to access and invalidate bindings with symbolic offsets by only computing this information once. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161635 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-08[analyzer] Clean up the printing of FieldRegions for leaks.Jordan Rose
Unfortunately, generalized region printing is very difficult: - ElementRegions are used both for casting and as actual elements. - Accessing values through a pointer means going through an intermediate SymbolRegionValue; symbolic regions are untyped. - Referring to implicitly-defined variables like 'this' and 'self' could be very confusing if they come from another stack frame. We fall back to simply not printing the region name if we can't be sure it will print well. This will allow us to improve in the future. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161512 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-08[analyzer] Revamp RegionStore to distinguish regions with symbolic offsets.Jordan Rose
RegionStore currently uses a (Region, Offset) pair to describe the locations of memory bindings. However, this representation breaks down when we have regions like 'array[index]', where 'index' is unknown. We used to store this as (SubRegion, 0); now we mark them specially as (SubRegion, SYMBOLIC). Furthermore, ProgramState::scanReachableSymbols depended on the existence of a sub-region map, but RegionStore's implementation doesn't provide for such a thing. Moving the store-traversing logic of scanReachableSymbols into the StoreManager allows us to eliminate the notion of SubRegionMap altogether. This fixes some particularly awkward broken test cases, now in array-struct-region.c. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161510 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-04Drop the ASTContext.h include from Stmt.h and fix up transitive users.Benjamin Kramer
This required moving the ctors for IntegerLiteral and FloatingLiteral out of line which shouldn't change anything as they are usually called through Create methods that are already out of line. ASTContext::Deallocate has been a nop for a long time, drop it from ASTVector and make it independent from ASTContext.h Pass the StorageAllocator directly to AccessedEntity so it doesn't need to have a definition of ASTContext around. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159718 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-07[analyzer] Anti-aliasing: different heap allocations do not aliasAnna Zaks
Add a concept of symbolic memory region belonging to heap memory space. When comparing symbolic regions allocated on the heap, assume that they do not alias. Use symbolic heap region to suppress a common false positive pattern in the malloc checker, in code that relies on malloc not returning the memory aliased to other malloc allocations, stack. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158136 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06[analyzer] Provide debug descriptions for all memory space regions.Jordan Rose
Patch by Guillem Marpons! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158106 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02Fix some doxycomments using \class instead of \brief.David Blaikie
Patches by Csaba Raduly (rcsaba@gmail.com) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156027 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks
Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-28[analyzer] teach analyzer about ObjC literals, thus trimming out a false ↵Ted Kremenek
positive with the malloc() checker involving comparing literal addresses to nil. Fixes <rdar://problem/10579586> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151602 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-28StaticAnalyzer: Move ObjC- and CXX-specific methods out of line so checkers ↵Benjamin Kramer
that don't care about the language don't have to pull in all the headers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149178 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Unweaken vtables as per ↵David Blaikie
http://llvm.org/docs/CodingStandards.html#ll_virtual_anch git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146959 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24Rename AnalysisContext to AnalysisDeclContext. Not only is this name more ↵Ted Kremenek
accurate, but it frees up the name AnalysisContext for other uses. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142782 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-26Handle CXXTempObjectRegion in StackAddrEscapeChecker.Jeffrey Yasskin
Also convert stack-addr-ps.cpp to use the analyzer instead of just Sema, now that it doesn't crash, and extract the stack-block test into another file since it errors, and that prevents the analyzer from running. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138613 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek
and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12[analyzer] Nitpicks on Olaf's patch, which I meant to e-mail but then didn't inJordy Rose
time. One is cleanup, the other is me being OCD about enum group nesting. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137517 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12[analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can ↵Ted Kremenek
separate TypedRegions that implement getValueType() from those that don't. Patch by Olaf Krzikalla! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137498 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-23clean up forward declarations of raw_ostream to use the new LLVM.hChris Lattner
patch by Jon Mulder! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135851 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-20add raw_ostream and Twine to LLVM.h, eliminating a ton of llvm:: qualifications.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135577 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-15fix a bunch of comment typos found by codespell. Patch byChris Lattner
Luis Felipe Strano Moraes! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129559 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-10Split 'include/clang/StaticAnalyzer' into ↵Ted Kremenek
'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'. This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125251 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-09-02 23:36:21 +0000