aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/GRExprEngine.cpp
AgeCommit message (Collapse)Author
2009-04-09Fix a null pointer dereference error due to state caching in a loop involvingTed Kremenek
sending a message to a nil receiver. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68686 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Create a symbolic region instead of a loc::SymbolVal. This is a continued stepZhongxing Xu
to eliminate the use of loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68685 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09GRExprEngine: Don't try to reason about the size of 'void' for the return typeTed Kremenek
of messages sent to nil. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68683 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Fix another regression introduced by changes to the analyzer's reasoning aboutTed Kremenek
nil receivers in message expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68672 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09Refactor/cleanup reasoning of nil receivers in message expressions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68661 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-08Enhance analyzer reasoning about sending messages to nil. A nil receiver ↵Ted Kremenek
returns 0 for scalars of size <= sizeof(void*). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68629 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-08New static analyzer check by Nikita Zhuk!Ted Kremenek
"The attached patch generates warnings of cases where an ObjC message is sent to a nil object and the size of return type of that message is larger than the size of void pointer. This may result in undefined return values as described in PR 2718. The patch also includes test cases." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68585 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-03This is the first step to gradually remove the use of loc::SymbolVal. NowZhongxing Xu
when creating symbolic values, we distinguish between location and non-location values. For location values, we create a symbolic region instead of a loc::SymbolVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68373 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-01Fix: <rdar://problem/6740387>. Sending nil to an object that returns a structTed Kremenek
should only be an error if that value is consumed. This fix was largely accomplished by moving 'isConsumedExpr' back to ParentMap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68195 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Add version of GRExprEngine::AddCheck that registered a GRSimpleAPICheck thatTed Kremenek
will be called for every expression in a basic block. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68041 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-28rename some methods.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67923 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-28Change compound assignment operators to keep track of both the promoted Eli Friedman
LHS type and the computation result type; this encodes information into the AST which is otherwise non-obvious. Fix Sema to always come up with the right answer for both of these types. Fix IRGen and the analyzer to account for these changes. This fixes PR2601. The approach is inspired by PR2601 comment 2. Note that this changes real *= complex in CodeGen from a silent miscompilation to an explicit error. I'm not really sure that the analyzer changes are correct, or how to test them... someone more familiar with the analyzer should check those changes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67889 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-26analyzer infrastructure: make a bunch of changes to symbolic expressions thatTed Kremenek
Zhongxing and I discussed by email. Main changes: - Removed SymIntConstraintVal and SymIntConstraint - Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr - Added nonloc::SymExprVal to wrap SymExpr - SymbolRef is now just a typedef of 'const SymbolData*' - Bunch of minor code cleanups in how some methods were invoked (no functionality change) This changes are part of a long-term plan to have full symbolic expression trees. This will be useful for lazily evaluating complicated expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-20GRExprEngine:Ted Kremenek
- Conjure symbols at '--' and '++' unary operations - Add utility method SVal::GetConjuredSymbolVal() and constify some arguments along the way. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67395 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-18Fix PR 3836 by eagerly assuming symbolic constraints returned by unary '!'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67260 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-13Add a hack in the analyzer to recover some path-sensitivity at branchTed Kremenek
conditions. Currently the analyzer does not reason well about promotions/truncations of symbolic values, so at branch conditions when we see: if (condition) and condition is something like a 'short' or 'char', essentially ignore the promotion to 'int' so that we track constraints on the original symbolic value. We only ignore the casts if the underlying type has the same or fewer bits as the converted type. This fixes: <rdar://problem/6619921> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66899 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine::ProcessBranch: Don't register a "pretty-stack printer" when ↵Ted Kremenek
the Condition is null. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66636 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine: Add pretty-stack trace printing for crashes and assertion ↵Ted Kremenek
failures. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66629 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11GRExprEngine: For places we might conjure up a new symbol to recoverTed Kremenek
path-sensitivity, beyond checking to see if the value is "unknown" also check if the ConstraintManager can handle the SVal. This allows us to recover some path-sensitivity by actually discarding some information. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66627 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Use the BugReports in BugReporter to determine the root nodes for "trim-egraph".Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66622 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-09Remove some dead spacing. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66437 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix another GRExprEngine::VisitCast regression: handle casts of void* to ↵Ted Kremenek
function pointers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66211 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix regression in GRExprEngine::VisitCast: Do not wrap symbolic function ↵Ted Kremenek
pointers with TypedViewRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66187 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Add 'cast<>' to remove an extra function call and dynamic cast.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66131 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05More fixes in cast logic.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66130 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05GRExprEngine: Polish up handling of casting integer constants to pointers ↵Ted Kremenek
and back. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66127 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-05Fix regression in transparent translation of nonloc::ConcreteInto to ↵Ted Kremenek
loc::ConcreteInt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66125 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04GRExprEngine::VisitCast: Just pass through function and block pointers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66036 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Create "TypedViewRegions" that layer on top of SymbolicRegions when handlingTed Kremenek
pointer-to-pointer casts involving symbolic locations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65984 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28Revert 65707 (causes stack memory to be referenced after it is released).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65717 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28remove static ctor.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65707 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-28improve compatibility with the VC++'08 C++ compiler. Patch byChris Lattner
Niklas Larsson! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65706 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-26Create a new TypeNodes.def file that enumerates all of the types,Douglas Gregor
giving them rough classifications (normal types, never-canonical types, always-dependent types, abstract type representations) and making it far easier to make sure that we've hit all of the cases when decoding types. Switched some switch() statements on the type class over to using this mechanism, and filtering out those things we don't care about. For example, CodeGen should never see always-dependent or non-canonical types, while debug info generation should never see always-dependent types. More switch() statements on the type class need to be moved over to using this approach, so that we'll get warnings when we add a new type then fail to account for it somewhere in the compiler. As part of this, some types have been renamed: TypeOfExpr -> TypeOfExprType FunctionTypeProto -> FunctionProtoType FunctionTypeNoProto -> FunctionNoProtoType There shouldn't be any functionality change... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65591 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Fix subtle bug in EvalEagerlyAssume: Check if the previous node was at the ↵Ted Kremenek
same statement. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65486 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-25Add experimental logic in GRExprEngine::EvalEagerlyAssume() to handleTed Kremenek
expressions of the form: 'short x = (y != 10);' While we handle 'int x = (y != 10)' lazily, the cast to another integer type currently loses the symbolic constraint. Eager evaluation of the constraint causes the paths to bifurcate and eagerly evaluate 'y != 10' to a constant of 1 or 0. This should address <rdar://problem/6619921> until we have a better (more lazy approach) for handling promotions/truncations of symbolic integer values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65480 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-24Fix <rdar://problem/6611677>: Add basic transfer function support in the staticTed Kremenek
analyzer for array subscript expressions involving bases that are vectors. This solution is probably a hack: it gets the lvalue of the vector instead of an rvalue like all other types. This should be reviewed (big FIXME in GRExprEngine). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65366 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-19Implemented simple check in <rdar://problem/6600344>: When the receiver of aTed Kremenek
message expression is nil and the return type is struct then the returned value is undefined or potentially garbage. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65003 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17Add panic function.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64852 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-17Add '_assert' to list of known panic functions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64772 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Add hook to add attributes to function declarations that we knowDouglas Gregor
about, whether they are builtins or not. Use this to add the appropriate "format" attribute to NSLog, NSLogv, asprintf, and vasprintf, and to translate builtin attributes (from Builtins.def) into actual attributes on the function declaration. Use the "printf" format attribute on function declarations to determine whether we should do format string checking, rather than looking at an ad hoc list of builtins and "known" function names. Be a bit more careful about when we consider a function a "builtin" in C++. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64561 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14GRExprEngine: Handle empty statement expressions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64541 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Use GRTransferFuncs::EvalBind when processing variable initializations.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64527 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Static analyzer:Ted Kremenek
- Added a new 'node builder' class called GRStmtNodeBuilderRef (name may change). This is essentially a smart reference to a GRStmtNodeBuilder object that keeps track of the current context (predecessor node, GRExprEngine object, etc.) The idea is to gradually simplify the interface between GRExprEngine and GRTransferFuncs using this new builder (i.e., passing 1 argument instead of 5). It also handles some of the "auto-transition" for node creation, simplifying some of the logic in GRExprEngine itself. - Used GRStmtBuilderRef to replace GRTransferFuncs::EvalStore with GRTransferFuncs::EvalBind. The new EvalBind method will be used at any arbitrary places where a binding between a location and value takes place. Moreover, GRTransferFuncs no longer has the responsibility to request StoreManager to do the binding; this is now in GRExprEngine::EvalBind. All GRTransferFuncs::EvalBind does is checker-specific logic (which can be a no-op). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64525 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-13Implicitly declare certain C library functions (malloc, strcpy, memmove,Douglas Gregor
etc.) when we perform name lookup on them. This ensures that we produce the correct signature for these functions, which has two practical impacts: 1) When we're supporting the "implicit function declaration" feature of C99, these functions will be implicitly declared with the right signature rather than as a function returning "int" with no prototype. See PR3541 for the reason why this is important (hint: GCC always predeclares these functions). 2) If users attempt to redeclare one of these library functions with an incompatible signature, we produce a hard error. This patch does a little bit of work to give reasonable error messages. For example, when we hit case #1 we complain that we're implicitly declaring this function with a specific signature, and then we give a note that asks the user to include the appropriate header (e.g., "please include <stdlib.h> or explicitly declare 'malloc'"). In case #2, we show the type of the implicit builtin that was incorrectly declared, so the user can see the problem. We could do better here: for example, when displaying this latter error message we say something like: 'strcpy' was implicitly declared here with type 'char *(char *, char const *)' but we should really print out a fake code line showing the declaration, like this: 'strcpy' was implicitly declared here as: char *strcpy(char *, char const *) This would also be good for printing built-in candidates with C++ operator overloading. The set of C library functions supported by this patch includes all functions from the C99 specification's <stdlib.h> and <string.h> that (a) are predefined by GCC and (b) have signatures that could cause codegen issues if they are treated as functions with no prototype returning and int. Future work could extend this set of functions to other C library functions that we know about. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64504 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-13GRExprEngine:Ted Kremenek
- Add 'EvalBind', which will be used by 'EvalStore' to pull much of the value binding logic out of GRTransferFuncs. - Rename many cases of 'St' to 'state'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64426 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-07GRExprEngine: When processing compound assignments, do a switch table lookup ↵Ted Kremenek
to get the non-compound opcode from the compound opcode instead of relying on the order of BinaryOperator::opcode values. This unbreaks the misc-ps.c test. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63991 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Overhaul BugReporter interface and implementation. The new interface cleans upTed Kremenek
the ownership of BugTypes and BugReports. Now BugReports are owned by BugTypes, and BugTypes are owned by the BugReporter object. The major functionality change in this patch is that reports are not immediately emitted by a call to BugReporter::EmitWarning (now called EmitReport), but instead of queued up in report "equivalence classes". When BugReporter::FlushReports() is called, it emits one diagnostic per report equivalence class. This provides a nice cleanup with the caching of reports as well as enables the BugReporter engine to select the "best" path for reporting a path-sensitive bug based on all the locations in the ExplodedGraph that the same bug could occur. Along with this patch, Leaks are now coalesced into a common equivalence class by their allocation site, and the "summary" diagnostic for leaks now reports the allocation site as the location of the bug (this may later be augmented to also provide an example location where the leak occurs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63796 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04Remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63715 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-04make SM::getColumnNumber take a predecomposed FileID/offset, whichChris Lattner
makes it clear to clients that they have to pick an instantiation or spelling location before calling it and allows optimization based on that. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63698 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-01 02:11:35 +0000