aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/GRExprEngine.cpp
AgeCommit message (Collapse)Author
2009-04-09- Move ownership of MemRegionManager into ValueManager.Ted Kremenek
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly simplifies the calling interface to clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Remove SVal::MakeZero and replace it with ValueManager::makeZeroVal.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68711 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09clean up code with new API.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68700 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09clean up code with new API.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68699 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09clean up code with new API.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68698 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09stop using loc::SymbolVal.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68697 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Fix a null pointer dereference error due to state caching in a loop involvingTed Kremenek
sending a message to a nil receiver. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68686 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Create a symbolic region instead of a loc::SymbolVal. This is a continued stepZhongxing Xu
to eliminate the use of loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68685 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09GRExprEngine: Don't try to reason about the size of 'void' for the return typeTed Kremenek
of messages sent to nil. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68683 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Fix another regression introduced by changes to the analyzer's reasoning aboutTed Kremenek
nil receivers in message expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68672 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Refactor/cleanup reasoning of nil receivers in message expressions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68661 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-08Enhance analyzer reasoning about sending messages to nil. A nil receiver ↵Ted Kremenek
returns 0 for scalars of size <= sizeof(void*). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68629 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-08New static analyzer check by Nikita Zhuk!Ted Kremenek
"The attached patch generates warnings of cases where an ObjC message is sent to a nil object and the size of return type of that message is larger than the size of void pointer. This may result in undefined return values as described in PR 2718. The patch also includes test cases." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68585 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-03This is the first step to gradually remove the use of loc::SymbolVal. NowZhongxing Xu
when creating symbolic values, we distinguish between location and non-location values. For location values, we create a symbolic region instead of a loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68373 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-01Fix: <rdar://problem/6740387>. Sending nil to an object that returns a structTed Kremenek
should only be an error if that value is consumed. This fix was largely accomplished by moving 'isConsumedExpr' back to ParentMap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68195 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Add version of GRExprEngine::AddCheck that registered a GRSimpleAPICheck thatTed Kremenek
will be called for every expression in a basic block. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68041 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-28rename some methods.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67923 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-28Change compound assignment operators to keep track of both the promoted Eli Friedman
LHS type and the computation result type; this encodes information into the AST which is otherwise non-obvious. Fix Sema to always come up with the right answer for both of these types. Fix IRGen and the analyzer to account for these changes. This fixes PR2601. The approach is inspired by PR2601 comment 2. Note that this changes real *= complex in CodeGen from a silent miscompilation to an explicit error. I'm not really sure that the analyzer changes are correct, or how to test them... someone more familiar with the analyzer should check those changes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67889 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-26analyzer infrastructure: make a bunch of changes to symbolic expressions thatTed Kremenek
Zhongxing and I discussed by email. Main changes: - Removed SymIntConstraintVal and SymIntConstraint - Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr - Added nonloc::SymExprVal to wrap SymExpr - SymbolRef is now just a typedef of 'const SymbolData*' - Bunch of minor code cleanups in how some methods were invoked (no functionality change) This changes are part of a long-term plan to have full symbolic expression trees. This will be useful for lazily evaluating complicated expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-20GRExprEngine:Ted Kremenek
- Conjure symbols at '--' and '++' unary operations - Add utility method SVal::GetConjuredSymbolVal() and constify some arguments along the way. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67395 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-18Fix PR 3836 by eagerly assuming symbolic constraints returned by unary '!'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67260 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-13Add a hack in the analyzer to recover some path-sensitivity at branchTed Kremenek
conditions. Currently the analyzer does not reason well about promotions/truncations of symbolic values, so at branch conditions when we see: if (condition) and condition is something like a 'short' or 'char', essentially ignore the promotion to 'int' so that we track constraints on the original symbolic value. We only ignore the casts if the underlying type has the same or fewer bits as the converted type. This fixes: <rdar://problem/6619921> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66899 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine::ProcessBranch: Don't register a "pretty-stack printer" when ↵Ted Kremenek
the Condition is null. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66636 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine: Add pretty-stack trace printing for crashes and assertion ↵Ted Kremenek
failures. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66629 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine: For places we might conjure up a new symbol to recoverTed Kremenek
path-sensitivity, beyond checking to see if the value is "unknown" also check if the ConstraintManager can handle the SVal. This allows us to recover some path-sensitivity by actually discarding some information. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66627 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Use the BugReports in BugReporter to determine the root nodes for "trim-egraph".Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66622 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-09Remove some dead spacing. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66437 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix another GRExprEngine::VisitCast regression: handle casts of void* to ↵Ted Kremenek
function pointers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66211 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix regression in GRExprEngine::VisitCast: Do not wrap symbolic function ↵Ted Kremenek
pointers with TypedViewRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66187 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Add 'cast<>' to remove an extra function call and dynamic cast.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66131 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05More fixes in cast logic.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66130 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05GRExprEngine: Polish up handling of casting integer constants to pointers ↵Ted Kremenek
and back. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66127 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix regression in transparent translation of nonloc::ConcreteInto to ↵Ted Kremenek
loc::ConcreteInt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66125 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04GRExprEngine::VisitCast: Just pass through function and block pointers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66036 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Create "TypedViewRegions" that layer on top of SymbolicRegions when handlingTed Kremenek
pointer-to-pointer casts involving symbolic locations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65984 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28Revert 65707 (causes stack memory to be referenced after it is released).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65717 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28remove static ctor.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65707 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28improve compatibility with the VC++'08 C++ compiler. Patch byChris Lattner
Niklas Larsson! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65706 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-26Create a new TypeNodes.def file that enumerates all of the types,Douglas Gregor
giving them rough classifications (normal types, never-canonical types, always-dependent types, abstract type representations) and making it far easier to make sure that we've hit all of the cases when decoding types. Switched some switch() statements on the type class over to using this mechanism, and filtering out those things we don't care about. For example, CodeGen should never see always-dependent or non-canonical types, while debug info generation should never see always-dependent types. More switch() statements on the type class need to be moved over to using this approach, so that we'll get warnings when we add a new type then fail to account for it somewhere in the compiler. As part of this, some types have been renamed: TypeOfExpr -> TypeOfExprType FunctionTypeProto -> FunctionProtoType FunctionTypeNoProto -> FunctionNoProtoType There shouldn't be any functionality change... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65591 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Fix subtle bug in EvalEagerlyAssume: Check if the previous node was at the ↵Ted Kremenek
same statement. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65486 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Add experimental logic in GRExprEngine::EvalEagerlyAssume() to handleTed Kremenek
expressions of the form: 'short x = (y != 10);' While we handle 'int x = (y != 10)' lazily, the cast to another integer type currently loses the symbolic constraint. Eager evaluation of the constraint causes the paths to bifurcate and eagerly evaluate 'y != 10' to a constant of 1 or 0. This should address <rdar://problem/6619921> until we have a better (more lazy approach) for handling promotions/truncations of symbolic integer values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65480 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-24Fix <rdar://problem/6611677>: Add basic transfer function support in the staticTed Kremenek
analyzer for array subscript expressions involving bases that are vectors. This solution is probably a hack: it gets the lvalue of the vector instead of an rvalue like all other types. This should be reviewed (big FIXME in GRExprEngine). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65366 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-19Implemented simple check in <rdar://problem/6600344>: When the receiver of aTed Kremenek
message expression is nil and the return type is struct then the returned value is undefined or potentially garbage. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65003 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17Add panic function.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64852 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17Add '_assert' to list of known panic functions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64772 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Add hook to add attributes to function declarations that we knowDouglas Gregor
about, whether they are builtins or not. Use this to add the appropriate "format" attribute to NSLog, NSLogv, asprintf, and vasprintf, and to translate builtin attributes (from Builtins.def) into actual attributes on the function declaration. Use the "printf" format attribute on function declarations to determine whether we should do format string checking, rather than looking at an ad hoc list of builtins and "known" function names. Be a bit more careful about when we consider a function a "builtin" in C++. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64561 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14GRExprEngine: Handle empty statement expressions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64541 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Use GRTransferFuncs::EvalBind when processing variable initializations.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64527 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Static analyzer:Ted Kremenek
- Added a new 'node builder' class called GRStmtNodeBuilderRef (name may change). This is essentially a smart reference to a GRStmtNodeBuilder object that keeps track of the current context (predecessor node, GRExprEngine object, etc.) The idea is to gradually simplify the interface between GRExprEngine and GRTransferFuncs using this new builder (i.e., passing 1 argument instead of 5). It also handles some of the "auto-transition" for node creation, simplifying some of the logic in GRExprEngine itself. - Used GRStmtBuilderRef to replace GRTransferFuncs::EvalStore with GRTransferFuncs::EvalBind. The new EvalBind method will be used at any arbitrary places where a binding between a location and value takes place. Moreover, GRTransferFuncs no longer has the responsibility to request StoreManager to do the binding; this is now in GRExprEngine::EvalBind. All GRTransferFuncs::EvalBind does is checker-specific logic (which can be a no-op). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64525 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-06 03:30:34 +0000