aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/BasicStore.cpp
AgeCommit message (Collapse)Author
2009-04-09- Move ownership of MemRegionManager into ValueManager.Ted Kremenek
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly simplifies the calling interface to clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-03This is the first step to gradually remove the use of loc::SymbolVal. NowZhongxing Xu
when creating symbolic values, we distinguish between location and non-location values. For location values, we create a symbolic region instead of a loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68373 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Simplify more code by using SVal::getAsSymbol().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68052 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-26analyzer infrastructure: make a bunch of changes to symbolic expressions thatTed Kremenek
Zhongxing and I discussed by email. Main changes: - Removed SymIntConstraintVal and SymIntConstraint - Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr - Added nonloc::SymExprVal to wrap SymExpr - SymbolRef is now just a typedef of 'const SymbolData*' - Bunch of minor code cleanups in how some methods were invoked (no functionality change) This changes are part of a long-term plan to have full symbolic expression trees. This will be useful for lazily evaluating complicated expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-23analyzer: Fix embarrassing regression in BasicStore when invalidating structTed Kremenek
values passed-by-reference to unknown functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67519 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-18Fix crash reported in <rdar://problem/6695527>. We now haveTed Kremenek
SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of having BasicStoreManager do it (which wasn't always doing the check consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in one centralized place. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67245 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Retrofit some basic tracking of ivars (for the current object) into BasicStore.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66166 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Minor code compaction. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66165 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Rename VarBindings -> Bindings.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66164 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05BasicStore:Ted Kremenek
- Store bindings using a MemRegion -> SVal binding instead of VarDecl -> SVal binding. This mirrors some of the idea of RegionStore, but is far simpler and not nearly as functional. This leads to some code simplification and some potential for some minor precision hacks. Along the way... - constify the use of MemRegion* in a few places - add operator<<(llvm::raw_ostream, const MemRegion*) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66163 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Don't use std::auto_ptr with getSubRegionMap().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65957 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning ↵Ted Kremenek
MemRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65919 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Add StoreManager::getSubRegionMap(). This method returns an opaque mapping ↵Ted Kremenek
for clients of StoreManagers from MemRegions to their subregions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65914 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-01Rename AnonTypedRegion to TypedViewRegion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65764 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so Zhongxing Xu
do the symblic regions associated with them and we need them to be typed. Current SymbolicRegion::getRValueType() method is very restricting. It may be modified when we are more clear about what could be the types of symblic regions. BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a subclass of SubRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63844 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-27Fix bug in BasicStore::getLValueElement where if the base of an array ↵Ted Kremenek
subscript expression was an ElementRegion we stacked another ElementRegion on top of that. This fixes PR 3422. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63110 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-22Static analyzer: Remove a bunch of outdated SymbolData objects andTed Kremenek
their associated APIs. We no longer need separate SymbolData objects for fields, variables, etc. Instead, we now associated symbols with the "rvalue" of a MemRegion (i.e., the value stored at that region). Now we only have two kinds of SymbolData objects: SymbolRegionRValue and SymbolConjured. This cleanup also makes the distinction between a SymbolicRegion and a symbolic value that is a location much clearer. A SymbolicRegion represents a chunk of symbolic memory, while a symbolic location is just a "pointer" with different possible values. Without any specific knowledge, a symbolic location resolves (i.e., via a dereference) to a SymbolicRegion. In the future, when we do better alias reasoning, a symbolic location can become an alias for another location, thus merging the constraints on the referred SymbolicRegion with the other region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62769 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Update some doxygen comments to be more rich. Remove ↵Ted Kremenek
StoreManager::GetRegionSVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61894 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Refactor MemRegionManager instance variable into parent class. No ↵Ted Kremenek
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61888 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61304 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility methods. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61300 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Remove unused function.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61299 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek
GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60990 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fix to BasicStoreManager::getElementLValue: If the base region is a symbol, ↵Ted Kremenek
layer an AnonTypedRegion on top of it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60808 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Have BasicStoreManager::getLValueElement() have logic similar to ↵Ted Kremenek
BasicStoreManager::getLValueField() (i.e., don't just return the 'base' as the SVal) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60795 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek
GRState* argument instead of a Store. This allows them to use the GDM for storing other data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60570 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Update comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60520 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Use std::make_pair instead of std::pair's ctor.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60205 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Migrate some stuff from NamedDecl::getName() to Chris Lattner
NamedDecl::getNameAsString() to make it more explicit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59937 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhance modularization: return a <state,loc> pair to let GRExprEngine modify theZhongxing Xu
environment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59407 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhances SCA to process untyped region to typed region conversion.Zhongxing Xu
- RegionView and RegionViewMap is introduced to assist back-mapping from super region to subregions. - GDM is used to carry RegionView information. - AnonTypedRegion is added to represent a typed region introduced by pointer casting. Later AnonTypedRegion can be used in other similar cases, e.g., malloc()'ed region. - The specific conversion is delegated to store manager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59382 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Use the allocator of ExplodedGraph. The whole static analysis module uses it.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59359 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12StoreManager::BindDecl now takes an SVal* for the initialization value ↵Ted Kremenek
instead of an Expr* (which can be null). Lazy symbolication of conjured symbols is now the sole responsibility of GRExprEngine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59151 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-07Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is Zhongxing Xu
available, things get much simplified. One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58837 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-29Rename: AddDecl => BindDeclZhongxing Xu
BindDecl better describes what the function does: - Bind the VarDecl to its memory region - Bind the memory region to some initial value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58359 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-27Added preliminary support for CompoundLiterals in the static analyzer:Ted Kremenek
- GRExprEngine::VisitCompoundLiteral... (1) visits the initializer list (generating ExplodedNodes) (2) creates a CompoundMemRegion for the literal (3) creates a new state with the bound literal values using GRStateManager::BindCompoundLiteral - GRStateManager::BindCompoundLiteral simply calls StoreManager::BindCompoundLiteral to get a new store and returns a persistent GRState with that store. - BasicStore::BindCompoundLiteral simply returns the same store, as it doesn't handle field sensitivity - RegionStore::BindCompoundLiteral currently fires an assert (pending discussion of how to best implement mappings for CompoundLiteralRegion). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58277 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-26Remove loc::StringLiteralVal. Now we allocate regions for string literals in ↵Zhongxing Xu
the Store. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58182 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-25Add code for get the lvalue for string literals. Now we return a StringRegionZhongxing Xu
for StringLiteral lvalue evaluation, instead of directly returning a loc::StringLiteralVal by the Environment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58138 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-24Added method "getSelfRegion" to Store. This method returns the region ↵Ted Kremenek
associated with the "this" or "self" object (C++ and Objective-C respectively). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58107 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-23Let StoreManager do different cast on arrays. BasicStore will just keep it ↵Zhongxing Xu
intact. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58028 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-22Adjust parameter order to more natural one.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57964 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Preliminary support for function overloadingDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57909 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Localize the special processing of array variable inside Zhongxing Xu
GRExprEngine::VisitCast() so that other parts of the analyzer can be ignorant. When we cast "array of type T" to "pointer to T", we get the loc::MemRegionVal corresponding to the array variable. This is sufficient for BasicStore, but not for RegionStore. RegionStore should get the element region for the first array element in the cast. So next comes to the revamping of transfer functions for different store model. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57897 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Modify Store interface: GetSVal/SetSVal => Retrieve/Bind.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57896 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17Hack: have BasicStore::getLValueElement return the "Base" lvalue. This ↵Ted Kremenek
restores null dereference checking with array accesses. BasicStore::RemoveDeadBindings: handle regions besides VarRegions (we now have FieldRegions). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57741 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17- constify some uses of MemRegion* (MemRegion should be immutable).Ted Kremenek
- Added new region "SymbolicRegion", which maps symbol values to the region domain. - Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion) - Added some utility methods to GRState for fetch svals from the store. - Fixed regression in CheckNSError (we weren't getting the value bound to the parameter) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57717 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-03 16:18:43 +0000