aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/BasicStore.cpp
AgeCommit message (Collapse)Author
2009-05-05Remove possibly incorrect assertion that doesn't matter.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70943 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04Add array index assertion: BasicStore should not expect any fancyTed Kremenek
ElementRegions that have non-zero array indices. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70867 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04array indexes are unsigned integers of the same width as pointer.Zhongxing Xu
no-outofbounds.c still fails. Previously it passed because the array index is mistakenly a loc::ConcreteInt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70844 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04BasicStore: 'ElementRegion' is the new 'TypedViewRegion'.Ted Kremenek
StoreManager: Handle casts from one element region to another. Update test cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70836 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04Per conversations with Zhongxing, add an 'element type' toTed Kremenek
ElementRegion. I also removed 'ElementRegion::getArrayRegion', although we may need to add this back. This breaks a few test cases with RegionStore: - 'array-struct.c' triggers an infinite recursion in RegionStoreManager. Need to investigate. - misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic: 'Line 159: Uninitialized or undefined return value returned to caller.' There were a bunch of places that needed to be edit RegionStoreManager, and we may not be passing all the correct 'element types' down from GRExprEngine. Zhongxing: When you get a chance, could you review this? I could have easily screwed up something basic in RegionStoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70830 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-01Basic Store: Always convert a non::LocAsInteger to a Loc when storing to a ↵Ted Kremenek
pointer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70564 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-29Add corner case logic to BasicStoreManager and GRSimpleVals::EvalBinOp to enableTed Kremenek
reasoning about OSCompareAndSwap32Barrier/OSCompareAndSwap64Barrier. Essentially the address of reference to a region (pointer-to-pointer) can be casted to (int32_t*), and we need to handle the logic to convert the involved locations back and forth from nonloc::LocAsInteger, nonloc::ConcreteInt, to Loc and loc::ConcreteInt respectively. This adds some potentially suspect logic to BasicStoreManager that allows the analyzer to reason about abuses of the C type system. This should probably be refined, be ported over to RegionStoreManager, and extended with "path-sensitive type checking" to flag bugs in clearly incoherent code. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70382 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-21Refactor 'BasicStoreManager::CastRegion' and 'RegionStoreManager::CastRegion'Ted Kremenek
into StoreManager::CastRegion. Both methods were practically identical, and this is core logic that is common to all StoreManagers since it defines the basic invariants of the abstract memory model. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@69730 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-20Remove loc::FuncVal.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@69577 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-18FunctionDecl::getBody() is getting an ASTContext argument for use inDouglas Gregor
lazy PCH deserialization. Propagate that argument wherever it needs to be. No functionality change, except that I've tightened up a few PCH tests in preparation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@69406 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-11Implement analyzer support for OSCompareAndSwap. This required pushing "tagged"Ted Kremenek
ProgramPoints all the way through to GRCoreEngine. NSString.m now fails with RegionStoreManager because of the void** cast. Disabling use of region store for that test for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68845 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-10Finally nuke loc::SymbolVal.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68771 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09- Move ownership of MemRegionManager into ValueManager.Ted Kremenek
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly simplifies the calling interface to clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-03This is the first step to gradually remove the use of loc::SymbolVal. NowZhongxing Xu
when creating symbolic values, we distinguish between location and non-location values. For location values, we create a symbolic region instead of a loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68373 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Simplify more code by using SVal::getAsSymbol().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68052 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-26analyzer infrastructure: make a bunch of changes to symbolic expressions thatTed Kremenek
Zhongxing and I discussed by email. Main changes: - Removed SymIntConstraintVal and SymIntConstraint - Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr - Added nonloc::SymExprVal to wrap SymExpr - SymbolRef is now just a typedef of 'const SymbolData*' - Bunch of minor code cleanups in how some methods were invoked (no functionality change) This changes are part of a long-term plan to have full symbolic expression trees. This will be useful for lazily evaluating complicated expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-23analyzer: Fix embarrassing regression in BasicStore when invalidating structTed Kremenek
values passed-by-reference to unknown functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67519 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-18Fix crash reported in <rdar://problem/6695527>. We now haveTed Kremenek
SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of having BasicStoreManager do it (which wasn't always doing the check consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in one centralized place. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67245 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Retrofit some basic tracking of ivars (for the current object) into BasicStore.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66166 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Minor code compaction. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66165 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Rename VarBindings -> Bindings.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66164 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05BasicStore:Ted Kremenek
- Store bindings using a MemRegion -> SVal binding instead of VarDecl -> SVal binding. This mirrors some of the idea of RegionStore, but is far simpler and not nearly as functional. This leads to some code simplification and some potential for some minor precision hacks. Along the way... - constify the use of MemRegion* in a few places - add operator<<(llvm::raw_ostream, const MemRegion*) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66163 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Don't use std::auto_ptr with getSubRegionMap().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65957 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning ↵Ted Kremenek
MemRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65919 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Add StoreManager::getSubRegionMap(). This method returns an opaque mapping ↵Ted Kremenek
for clients of StoreManagers from MemRegions to their subregions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65914 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-01Rename AnonTypedRegion to TypedViewRegion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65764 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so Zhongxing Xu
do the symblic regions associated with them and we need them to be typed. Current SymbolicRegion::getRValueType() method is very restricting. It may be modified when we are more clear about what could be the types of symblic regions. BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a subclass of SubRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63844 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-27Fix bug in BasicStore::getLValueElement where if the base of an array ↵Ted Kremenek
subscript expression was an ElementRegion we stacked another ElementRegion on top of that. This fixes PR 3422. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63110 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-22Static analyzer: Remove a bunch of outdated SymbolData objects andTed Kremenek
their associated APIs. We no longer need separate SymbolData objects for fields, variables, etc. Instead, we now associated symbols with the "rvalue" of a MemRegion (i.e., the value stored at that region). Now we only have two kinds of SymbolData objects: SymbolRegionRValue and SymbolConjured. This cleanup also makes the distinction between a SymbolicRegion and a symbolic value that is a location much clearer. A SymbolicRegion represents a chunk of symbolic memory, while a symbolic location is just a "pointer" with different possible values. Without any specific knowledge, a symbolic location resolves (i.e., via a dereference) to a SymbolicRegion. In the future, when we do better alias reasoning, a symbolic location can become an alias for another location, thus merging the constraints on the referred SymbolicRegion with the other region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62769 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Update some doxygen comments to be more rich. Remove ↵Ted Kremenek
StoreManager::GetRegionSVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61894 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Refactor MemRegionManager instance variable into parent class. No ↵Ted Kremenek
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61888 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61304 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility methods. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61300 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Remove unused function.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61299 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek
GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60990 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fix to BasicStoreManager::getElementLValue: If the base region is a symbol, ↵Ted Kremenek
layer an AnonTypedRegion on top of it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60808 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Have BasicStoreManager::getLValueElement() have logic similar to ↵Ted Kremenek
BasicStoreManager::getLValueField() (i.e., don't just return the 'base' as the SVal) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60795 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek
GRState* argument instead of a Store. This allows them to use the GDM for storing other data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60570 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Update comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60520 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Use std::make_pair instead of std::pair's ctor.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60205 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Migrate some stuff from NamedDecl::getName() to Chris Lattner
NamedDecl::getNameAsString() to make it more explicit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59937 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhance modularization: return a <state,loc> pair to let GRExprEngine modify theZhongxing Xu
environment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59407 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhances SCA to process untyped region to typed region conversion.Zhongxing Xu
- RegionView and RegionViewMap is introduced to assist back-mapping from super region to subregions. - GDM is used to carry RegionView information. - AnonTypedRegion is added to represent a typed region introduced by pointer casting. Later AnonTypedRegion can be used in other similar cases, e.g., malloc()'ed region. - The specific conversion is delegated to store manager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59382 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Use the allocator of ExplodedGraph. The whole static analysis module uses it.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59359 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12StoreManager::BindDecl now takes an SVal* for the initialization value ↵Ted Kremenek
instead of an Expr* (which can be null). Lazy symbolication of conjured symbols is now the sole responsibility of GRExprEngine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59151 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-07Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is Zhongxing Xu
available, things get much simplified. One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58837 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-04 18:00:59 +0000