aboutsummaryrefslogtreecommitdiff
path: root/include/clang/StaticAnalyzer/Core/PathSensitive
AgeCommit message (Collapse)Author
2012-10-11Remove pointless classof()'s.Sean Silva
Updates to llvm/Support/Casting.h have rendered these classof()'s irrelevant. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165770 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03[analyzer] Push evalDynamicCast and evalDerivedToBase up to Store.Jordan Rose
These functions are store-agnostic, and would benefit from information in DynamicTypeInfo but gain nothing from the store type. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Have AnalyzerOptions::getBooleanOption() stick the matching configTed Kremenek
string in the config table so that it can be dumped as part of the config dumper. Add a test to show that these options are sticking and can be cross-checked using FileCheck. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164954 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01[analyzer] Make ProgramStateManager's SubEngine parameter optional.Jordan Rose
It is possible and valid to have a state manager and associated objects without having a SubEngine or checkers. Patch by Olaf Krzikalla! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164947 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29Whitespace.Bob Wilson
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25Remove 'const' version of getBasicVals(), which is useless.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164643 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-24[analyzer] Remove unused.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164542 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Simplify getRuntimeDefinition() back to taking no arguments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164363 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Implement faux-body-synthesis of well-known functions in the static analyzer ↵Ted Kremenek
when their implementations are unavailable. Start by simulating dispatch_sync(). This change is largely a bunch of plumbing around something very simple. We use AnalysisDeclContext to conjure up a fake function body (using the current ASTContext) when one does not exist. This is controlled under the analyzer-config option "faux-bodies", which is off by default. The plumbing in this patch is largely to pass the necessary machinery around. CallEvent needs the AnalysisDeclContextManager to get the function definition, as one may get conjured up lazily. BugReporter and PathDiagnosticLocation needed to be relaxed to handle invalid locations, as the conjured body has no real source locations. We do some primitive recovery in diagnostic generation to generate some reasonable locations (for arrows and events), but it can be improved. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164339 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-18Mark unimplemented copy constructors and copy assignment operators with ↵Craig Topper
LLVM_DELETED_FUNCTION. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164102 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-17[analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks
in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164046 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-15Use LLVM_DELETED_FUNCTION in place of 'DO NOT IMPLEMENT' comments.Dmitri Gribenko
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163983 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13[analyzer] Don't reimplement an existing function.Anna Zaks
Thanks Jordan. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163762 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13Refactor logic in ExprEngine for detecting 'noreturn' methodsTed Kremenek
in NSException to a helper object in libAnalysis that can also be used by Sema. Not sure if the predicate name 'isImplicitNoReturn' is the best one, but we can massage that later. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163759 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Do not report use of undef on "return foo();" when the return ↵Anna Zaks
type is void. Fixes a false positive found by analyzing LLVM code base. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163750 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163748 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11[analyzer] Member function calls that use qualified names are non-virtual.Jordan Rose
C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163577 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Do not count calls to small functions when computing stackAnna Zaks
depth. We only want to count how many substantial functions we inlined. This is an improvement to r163558. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163571 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-09Remove dead method ProgramState::MarshalState().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163479 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-07Remove ProgramState::getSymVal(). It was being misused by Checkers,Ted Kremenek
with at least one subtle bug in MacOSXKeyChainAPIChecker where the calling the method was a substitute for assuming a symbolic value was null (which is not the case). We still keep ConstraintManager::getSymVal(), but we use that as an optimization in SValBuilder and ProgramState::getSVal() to constant-fold SVals. This is only if the ConstraintManager can provide us with that information, which is no longer a requirement. As part of this, introduce a default implementation of ConstraintManager::getSymVal() which returns null. For Checkers, introduce ConstraintManager::isNull(), which queries the state to see if the symbolic value is constrained to be a null value. It does this without assuming it has been implicitly constant folded. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-07Add default implementation of ConstraintManager::getSymVal() and a doxygen ↵Ted Kremenek
comment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-07Remove ConstraintManager:isEqual(). It is no longer used.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163425 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-06[analyzer] Don't attempt to devirtualize calls to base class destructors.Jordan Rose
CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163348 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-05[analyzer] Be more forgiving about calling methods on struct rvalues.Jordan Rose
The problem is that the value of 'this' in a C++ member function call should always be a region (or NULL). However, if the object is an rvalue, it has no associated region (only a conjured symbol or LazyCompoundVal). For now, we handle this in two ways: 1) Actually respect MaterializeTemporaryExpr. Before, it was relying on CXXConstructExpr to create temporary regions for all struct values. Now it just does the right thing: if the value is not in a temporary region, create one. 2) Have CallEvent recognize the case where its 'this' pointer is a non-region, and just return UnknownVal to keep from confusing clients. The long-term problem is being tracked internally in <rdar://problem/12137950>, but this makes many test cases pass. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163220 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-05Revert "[analyzer] Treat all struct values as regions (even rvalues)."Jordan Rose
This turned out to have many implications, but what eventually seemed to make it unworkable was the fact that we can get struct values (as LazyCompoundVals) from other places besides return-by-value function calls; that is, we weren't actually able to "treat all struct values as regions" consistently across the entire analyzer core. Hopefully we'll be able to come up with an alternate solution soon. This reverts r163066 / 02df4f0aef142f00d4637cd851e54da2a123ca8e. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163218 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-01[analyzer] Disallow creation of int vals with explicit bit width / signedness.Jordan Rose
All clients of BasicValueFactory should be using QualTypes instead, and indeed it seems they are. This caught the (fortunately harmless) bug fixed in the previous commit. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163069 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-01[analyzer] Treat all struct values as regions (even rvalues).Jordan Rose
This allows us to correctly symbolicate the fields of structs returned by value, as well as get the proper 'this' value for when methods are called on structs returned by value. This does require a moderately ugly hack in the StoreManager: if we assign a "struct value" to a struct region, that now appears as a Loc value being bound to a region of struct type. We handle this by simply "dereferencing" the struct value region, which should create a LazyCompoundVal. This should fix recent crashes analyzing LLVM and on our internal buildbot. <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163066 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-01[analyzer] Always derive a CallEvent's return type from its origin expr.Jordan Rose
Previously, we preferred to get a result type by looking at the callee's declared result type. This allowed us to handlereferences, which are represented in the AST as lvalues of their pointee type. (That is, a call to a function returning 'int &' has type 'int' and value kind 'lvalue'.) However, this results in us preferring the original type of a function over a casted type. This is a problem when a function pointer is casted to another type, because the conjured result value will have the wrong type. AdjustedReturnValueChecker is supposed to handle this, but still doesn't handle the case where there is no "original function" at all, i.e. where the callee is unknown. Now, we instead look at the call expression's value kind (lvalue, xvalue, or prvalue), and adjust the expr's type accordingly. This will have no effect when the function is inlined, and will conjure the value that will actually be used when it is not. This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately, the cases where it would still be useful are where we need to cast the result of an inlined function or a checker-evaluated function, and in these cases we don't know what we're casting /from/ by the time we can do post- call checks. In light of that, remove AdjustedReturnValueChecker, which was already not checking quite a few calls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163065 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-31Move AnalyzerOptions.h into 'Core' StaticAnalyzer sub-library.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162977 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30[analyzer] Refactor the logic that determines if a functions should beAnna Zaks
reanalyzed. The policy on what to reanalyze should be in AnalysisConsumer with the rest of visitation order logic. There is no reason why ExprEngine needs to pass the Visited set to CoreEngine, it can populate it itself. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162957 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30[analyzer] Fixup for r162935 as per Jordan's review.Anna Zaks
Thanks for catching this! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162949 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30[analyzer] Do not propagate the [super init] could be nil assumptionAnna Zaks
from callee to caller. radar://12109638 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162935 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30Rename 'VisualizeEGUbi' and 'VisualizeEGDot' to ↵Ted Kremenek
'visualizeExplodedGraphWithUbigGraph' and 'visualizeExplodedGraphWithGraphViz' respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162931 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30Rename AnalyzerOptions 'EagerlyAssume' to 'eagerlyAssumeBinOpBifurcation'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162930 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30Store const& to AnalyzerOptions in AnalysisManager instead of copyingTed Kremenek
individual flags. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162929 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-30Move AnalyzerOptions.h to include/clang/StaticAnalyzer.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162928 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-29Add new -cc1 driver option -analyzer-config, which allows one to specifyTed Kremenek
a comma separated collection of key:value pairs (which are strings). This allows a general way to provide analyzer configuration data from the command line. No clients yet. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162827 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-28[analyzer] Rename CallEvent::mayBeInlined to CallEvent::isCallStmt.Jordan Rose
The two callers are using this in order to be conservative, so let's just clarify the information that's actually being provided here. This is not related to inlining decisions in any way. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162717 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-25[analyzer] Use the common evalBind infrastructure for initializers.Jordan Rose
This allows checkers (like the MallocChecker) to process the effects of the bind. Previously, using a memory-allocating function (like strdup()) in an initializer would result in a leak warning. This does bend the expectations of checkBind a bit; since there is no assignment expression, the statement being used is the initializer value. In most cases this shouldn't matter because we'll use a PostInitializer program point (rather than PostStmt) for any checker-generated nodes, though we /will/ generate a PostStore node referencing the internal statement. (In theory this could have funny effects if someone actually does an assignment within an initializer; in practice, that seems like it would be very rare.) <rdar://problem/12171711> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162637 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-25[ms-inline asm] As part of a larger refactoring, rename AsmStmt to GCCAsmStmt.Chad Rosier
No functional change intended. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162632 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-24[analyzer] More fixups/rewording based on Jordan's feedback.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162597 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-24[analyzer] Address Jordan's review comments.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162579 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-24[analyzer] Move DynamicTypeInfo out of the ProgramState.hAnna Zaks
(I am not sure if we should move the setters and getters as well and make them into static methods..) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162528 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-24[analyzer] Make analyzer less aggressive when dealing with [self init].Anna Zaks
With inlining, retain count checker starts tracking 'self' through the init methods. The analyser results were too noisy if the developer did not follow 'self = [super init]' pattern (which is common especially in older code bases) - we reported self init anti-pattern AND possible use-after-free. This patch teaches the retain count checker to assume that [super init] does not fail when it's not consumed by another expression. This silences the retain count warning that warns about possibility of use-after-free when init fails, while preserving all the other checking on 'self'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162508 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-23Fix a bunch of -Wdocumentation warnings.Dmitri Gribenko
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162452 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Fix an assortment of doxygen comment issues found by -Wdocumentation.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162412 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22[analyzer] Add more comments to CallEvent and RuntimeDefinition.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162399 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Remove BasicConstraintManager. It hasn't been in active service for a while.Ted Kremenek
As part of this change, I discovered that a few of our tests were not testing the RangeConstraintManager. Luckily all of those passed when I moved them over to use that constraint manager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162384 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'unbindLoc()' (in ProgramState) and 'Remove()' toTed Kremenek
'killBinding()'. The name is more specific, and one just forwarded to the other. Add some doxygen comments along the way. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162350 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-02 06:14:39 +0000