aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/CFRefCount.cpp
AgeCommit message (Collapse)Author
2009-02-07Split logic for 'getEndPath()' for CFRefReport and CFRefLeakReport.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64034 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-07Convert a use of 'std::ostringstream' to 'llvm::raw_string_ostream'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64033 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Add 'AppendValue' to the list of magic CF function names that cause a ↵Ted Kremenek
tracked object to escape. Fixes <rdar://problem/6560661>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63891 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Remove a bunch of obscene double-buffering of BugReports in the retain/releaseTed Kremenek
checker. This was previously needed because BugReport objects were previously allocated on the stack and not owned by BugReporter. Now we can just issue them on the fly. This change was motivated because we were seeing some weird cases where some really long paths would get issued for bugs (particularly leaks) because of some double-caching. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63840 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-05Fix regression: Leak (BugType) object should have 'isLeak()' return true.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63803 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Overhaul BugReporter interface and implementation. The new interface cleans upTed Kremenek
the ownership of BugTypes and BugReports. Now BugReports are owned by BugTypes, and BugTypes are owned by the BugReporter object. The major functionality change in this patch is that reports are not immediately emitted by a call to BugReporter::EmitWarning (now called EmitReport), but instead of queued up in report "equivalence classes". When BugReporter::FlushReports() is called, it emits one diagnostic per report equivalence class. This provides a nice cleanup with the caching of reports as well as enables the BugReporter engine to select the "best" path for reporting a path-sensitive bug based on all the locations in the ExplodedGraph that the same bug could occur. Along with this patch, Leaks are now coalesced into a common equivalence class by their allocation site, and the "summary" diagnostic for leaks now reports the allocation site as the location of the bug (this may later be augmented to also provide an example location where the leak occurs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63796 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-29retain/release checker: When generating summaries for CF/CG functions, allow ↵Ted Kremenek
arguments to "escape" if they are passed to a function containing the terms "InsertValue", "SetValue", or "AddValue". This fixes <rdar://problem/6539791>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63341 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Remove '#if 0' code.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63250 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Remove method 'AddNE' from the public interface of ConstraintManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63249 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: Always generate an "autorelease" summary for an ↵Ted Kremenek
"autorelease" message, and have the summary processing logic treat it as a no-op in GC mode. This change is motivated to encode more of the semantics in the summaries themselves for eventual better diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63241 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: Improve diagnostics to indicate that CF objects are ↵Ted Kremenek
not automatically garbage collected. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63187 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: Indicate whether a tracked object is a Core ↵Ted Kremenek
Foundation or Objective-C object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63186 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: More diagnostic refactoring.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63184 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: Embed an "object type" into the RetEffect/RetVal ↵Ted Kremenek
objects to help distinguish between Objective-C and Core Foundation objects (for better diagnostics). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63183 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: More cleanups (no real functionality change).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63181 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Fix diagnostic truncated by my last patch.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63180 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: More diagnostic refactoring.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63179 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28retain/release checker: Output the name of the function that allocates an ↵Ted Kremenek
object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63178 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Refactor some diagnostic code to use raw_string_ostream. No functionality ↵Ted Kremenek
change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63177 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Remove '#if 0' code.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63176 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-24More hacking on static analyzer diagnostics. When emitting summary ↵Ted Kremenek
diagnostics the code paths for diagnostics involving paths or single locations are now unified. This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62903 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-16Fix PR 3337 [retain/release checker]: Handle FunctionDecl's declared using ↵Ted Kremenek
typedefs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62331 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-16more SourceLocation lexicon change: instead of referring to theChris Lattner
"logical" location, refer to the "instantiation" location. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62316 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-12retain/release checker:Ted Kremenek
- Refactor a bunch of logic in the retain/release checker, making it more condense and easier to read. - Add support for "Create" methods in the DiskArbitration framework retain/release tests: - Rename CFDate.m to retain-release.m, and move test from CFString.c to retain-release.m - Add DiskArbitration framework tests cases. - Add/refine and few more retain/release GC test cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62106 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07This commit reflects changes to the retain/release checker motivated by myTed Kremenek
recent discussions with Thomas Clement and Ken Ferry concerning the "fundamental rule" for Cocoa memory management (http://developer.apple.com/documentation/Cocoa/Conceptual/MemoryMgmt/Tasks/MemoryManagementRules.html). Here is the revised behavior of the checker concerning tracking retain/release counts for objects returned from message expressions involving instance methods: 1) Track the returned object if the return type of the message expression is id<..>, id, or a pointer to *any* object that subclasses NSObject. Such objects are assumed to have a retain count. Previously the checker only tracked objects when the receiver of the message expression was part of the standard Cocoa API (i.e., had class names prefixed with 'NS'). This should significantly expand the amount of checking performed. 2) Consider the object owned if the selector of the message expression contains "alloc", "new", or "copy". Previously we also considered "create", but this doesn't follow from the fundamental rule (discussions with the Cocoa folks confirms this). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61837 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-18Fix regression when invalidating reference-counts for objects ↵Ted Kremenek
passed-by-reference to a function/method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61224 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17Fix <rdar://problem/6451816>:Ted Kremenek
- Because of the introduction of AnonTypedRegions when reasoning about casts, we had a regression in the "symbolication" of variable values passed-by-reference to a function. This is now fixed in CFRefCount.cpp (-checker-cfref) by blasting through the layer of AnonTypedRegions when symbolicating the value of the variable. This logic may get moved elsewhere. Note that this change affects only -checker-cfref and not -checker-simple; eventually this logic should get pulled out of CFRefCount.cpp into a more common place. All users use -checker-cfref by default, and -checker-simple should probably just be removed. - Updated test 'Analysis/uninit-vals-ps.c' to only use -checker-cfref and added a test case for this regression. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61147 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Rename SymbolID to SymbolRef. This is a precursor to some overhauling of ↵Ted Kremenek
the representation of symbolic values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60575 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-02Add FIXME.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60390 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Rename Selector::getName() to Selector::getAsString(), and addChris Lattner
a new NamedDecl::getAsString() method. Change uses of Selector::getName() to just pass in a Selector where possible (e.g. to diagnostics) instead of going through an std::string. This also adds new formatters for objcinstance and objcclass as described in the dox. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59933 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-13GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) ↵Ted Kremenek
of vector types. Add explicit checks that when we process integers that they really are scalars. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59225 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12Update method names involving GRStateRef. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59153 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-05Fix regression with handling of CFMakeCollectable.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58771 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-05initXXX methods can return owned objectsTed Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58758 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-04Handle prefix '_' that may appear in front of the name of 'Release' functionsTed Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58666 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-31Made the mechanism of defining preprocessor defs for maxint, ptrdiff_t, wcharSanjiv Gupta
etc more generic. For some targets, long may not be equal to pointer size. For example: PIC16 has int as i16, ptr as i16 but long as i32. Also fixed a few build warnings in assert() functions in CFRefCount.cpp, CGDecl.cpp, SemaDeclCXX.cpp and ParseDeclCXX.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58501 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-30Extend "followsFundamentalRule" to ignore prefix '_' characters.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58469 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-29IOServiceGetMatchingServices is a release function.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58362 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-24Use "followsFundamentalRule" to determine if an instance method allocates ↵Ted Kremenek
memory. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58114 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-24followsFundamentalRule() returns true if "alloc" or "new" appear at the ↵Ted Kremenek
beginning of the string, not anywhere within it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58112 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-24Issue warnings about owned objects returned from a method that does not ↵Ted Kremenek
match the established Cocoa naming conventions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58108 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-23Disable warning about potential leaks of returned values until we test it a ↵Ted Kremenek
little more (lots of noise). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58021 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-22Warn about potentially leaked objects that are returned from methods whose ↵Ted Kremenek
names do not follow the Cocoa Memory Management guidelines. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58012 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-22Enhance reference-count checker to correctly identify CG "release" ↵Ted Kremenek
functions. This fixes <rdar://problem/6303488>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57997 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Handle [NSAutoreleasePool addObject:] (an alternative way to add objects to ↵Ted Kremenek
the current autorelease pool). Added initial code for tracking stack of autorelease pools. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57908 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-18retain/release checker: Check if a tracked value escapes if we also try ↵Ted Kremenek
binding it to the store and the store doesn't support that binding (i.e., it cannot track it). This has the nice feature that the checker will automatically get more powerful if we use a more powerful store model. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57755 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17When conjuring symbols to recover path-sensitivity, don't conjure symbols ↵Ted Kremenek
that represent an entire struct. We need to implement struct temporaries as an actual "region", and then bind symbols to the FieldRegion of those temporaries. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57739 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17- constify some uses of MemRegion* (MemRegion should be immutable).Ted Kremenek
- Added new region "SymbolicRegion", which maps symbol values to the region domain. - Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion) - Added some utility methods to GRState for fetch svals from the store. - Fixed regression in CheckNSError (we weren't getting the value bound to the parameter) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57717 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-22 22:30:11 +0000