aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/GRExprEngine.cpp
AgeCommit message (Collapse)Author
2009-01-30Move method out-of-line.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63412 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-30Switch Type::isAggregateType to use the C++ definition of "aggregateDouglas Gregor
type" rather than the C definition. We do this because both C99 and Clang always use "aggregate type" as "aggregate or union type", and the C++ definition includes union types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63395 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-20Remove ScopedDecl, collapsing all of its functionality into Decl, soDouglas Gregor
that every declaration lives inside a DeclContext. Moved several things that don't have names but were ScopedDecls (and, therefore, NamedDecls) to inherit from Decl rather than NamedDecl, including ObjCImplementationDecl and LinkageSpecDecl. Now, we don't store empty DeclarationNames for these things, nor do we try to insert them into DeclContext's lookup structure. The serialization tests are temporarily disabled. We'll re-enable them once we've sorted out the remaining ownership/serialiazation issues between DeclContexts and TranslationUnion, DeclGroups, etc. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62562 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-17Fix analyzer crash found when scanning Wine sources where the analyzer used ↵Ted Kremenek
old logic to determine the value of a switch 'case' label. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62395 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-13static analyzer: Handle casts from arrays to integers. This fixes PR 3297.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62130 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-06Add QualifiedDeclRefExpr, which retains additional source-locationDouglas Gregor
information for declarations that were referenced via a qualified-id, e.g., N::C::value. We keep track of the location of the start of the nested-name-specifier. Note that the difference between QualifiedDeclRefExpr and DeclRefExpr does have an effect on the semantics of function calls in two ways: 1) The use of a qualified-id instead of an unqualified-id suppresses argument-dependent lookup 2) If the name refers to a virtual function, the qualified-id version will call the function determined statically while the unqualified-id version will call the function determined dynamically (by looking up the appropriate function in the vtable). Neither of these features is implemented yet, but we do print out qualified names for QualifiedDeclRefExprs as part of the AST printing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61789 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-22Fix initialization order.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61333 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-22Add an option to make 'RemoveDeadBindings' a configurable behavior. This enablesZhongxing Xu
us to measure the effect of this optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61319 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Add support for member references (E1.E2, E1->E2) with C++ semantics,Douglas Gregor
which can refer to static data members, enumerators, and member functions as well as to non-static data members. Implement correct lvalue computation for member references in C++. Compute the result type of non-static data members of reference type properly. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61294 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16ProgramPoint:Ted Kremenek
- Added four new ProgramPoint types that subclass PostStmt for use in GRExprEngine::EvalLocation: - PostOutOfBoundsCheckFailed - PostUndefLocationCheckFailed - PostNullCheckFailed - PostLocationChecksSucceed These were created because of a horribly subtle caching bug in EvalLocation where a node representing an "bug condition" in EvalLocation (e.g. a null dereference) could be re-used as the "non-bug condition" because the Store did not contain any information to differentiate between the two. The extra program points just disables any accidental caching between EvalLocation and its callers. GRExprEngine: - EvalLocation now returns a NodeTy* instead of GRState*. This should be used as the "vetted" predecessor for EvalLoad/EvalStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61105 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-15Fix regression in handling sizeof(void) in the static analyzer.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61039 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek
GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60990 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09In GRExprEngine treat @throw as an 'abort' that ends the current path. This ↵Ted Kremenek
is a temporary solution. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60789 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09[static analyzer] Extend VLA size checking to look for undefined sizes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60734 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-08Add checking for zero-sized VLAs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60726 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-06Add bandaid transfer function support for assignments involving ObjCKVCRefExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60622 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Rename SymbolID to SymbolRef. This is a precursor to some overhauling of ↵Ted Kremenek
the representation of symbolic values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60575 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-30Add support for initializing array with string literal.Zhongxing Xu
This fixes PR3127 http://llvm.org/bugs/show_bug.cgi?id=3127 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60280 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Code cleanup. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60206 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-27Add support for pluggable components of static analyzer.Zhongxing Xu
- Creator function pointers are saved in ManagerRegistry. - The Register* class is used to notify ManagerRegistry new module is available. - AnalysisManager queries ManagerRegistry for configurable module. Then it passes them to GRExprEngine, in turn to GRStateManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60143 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Remove FIXME comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59973 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Add support for AllocaRegion extent with GDM.Zhongxing Xu
One design problem that is emerging is the signed-ness problem during static analysis. Many unsigned value have to be converted into signed value because it partipates in operations with signed values. On the other hand, we cannot blindly make all values occuring in static analysis signed, because we do have cases where unsignedness is required, for example, integer overflow detection. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59957 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-24Cleanup code with utility method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59951 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-23Add out-of-bound memory access warning report code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59903 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-22Initial support for checking out of bound memory access. Only support Zhongxing Xu
ConcreteInt index for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59869 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-21- Clean up transfer function logic for 'return' statements.Ted Kremenek
- Add check for returning an undefined value to a caller. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59764 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhance modularization: return a <state,loc> pair to let GRExprEngine modify theZhongxing Xu
environment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59407 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-16Enhances SCA to process untyped region to typed region conversion.Zhongxing Xu
- RegionView and RegionViewMap is introduced to assist back-mapping from super region to subregions. - GDM is used to carry RegionView information. - AnonTypedRegion is added to represent a typed region introduced by pointer casting. Later AnonTypedRegion can be used in other similar cases, e.g., malloc()'ed region. - The specific conversion is delegated to store manager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59382 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Reduce permissiveness of assertion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59354 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Reverted part of r59335: ↵Ted Kremenek
http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20081110/009243.html In that patch I added a bogus type promotion for unary '!'. The real bug was more fallout from edges cases with compound assignments and conjured symbolic values. Now the conjured value has the type of the LHS expression, and we do a promotion to the computation type. We also now correctly do a conversion from the computation type back to the LHS type. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59349 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Re-enable an assertion that I mistakenly removed.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59348 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Use the correct QualType when creating the '0' constant.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59343 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-15Implement FIXME in GRExprEngine::VisitUnaryOperator() to handle implicit ↵Ted Kremenek
conversions caused by the '!' operator. This required adding some logic to GRSimpleVals to reason about nonloc::LocAsInteger SVals. This code appears to work fine, but it should eventually be cleaned up. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59335 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-14Second attempt at implementation transfer function support for ↵Ted Kremenek
ObjCForCollectionStmt. We now assume that the 'element' expression can be any lvalue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59313 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-14Add a new expression node, CXXOperatorCallExpr, which expresses aDouglas Gregor
function call created in response to the use of operator syntax that resolves to an overloaded operator in C++, e.g., "str1 + str2" that resolves to std::operator+(str1, str2)". We now build a CXXOperatorCallExpr in C++ when we pick an overloaded operator. (But only for binary operators, where we actually implement overloading) I decided *not* to refactor the current CallExpr to make it abstract (with FunctionCallExpr and CXXOperatorCallExpr as derived classes). Doing so would allow us to make CXXOperatorCallExpr a little bit smaller, at the cost of making the argument and callee accessors virtual. We won't know if this is going to be a win until we can parse lots of C++ code to determine how much memory we'll save by making this change vs. the performance penalty due to the extra virtual calls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59306 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-14Improve comments.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59294 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-13- Revert r59229 and r59232: AllocRegion should be immutable.Ted Kremenek
- Temporarily disabled test Analysis/array-struct.c for region store. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59245 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-13Lift the pointer to alloca'ed region to the pointer to its first element.Zhongxing Xu
This is required by some operations, e.g., *p = 1; p[0] = 1;. Also set the AllocaRegion's type during the cast. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59232 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-13GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) ↵Ted Kremenek
of vector types. Add explicit checks that when we process integers that they really are scalars. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59225 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-13GRExprEngine::VisitInitListExpr:Ted Kremenek
- Don't crash on vector types. - Handle typedefs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59220 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12Shore up transfer function for ObjCForCollectionStmt.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59162 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12Add (preliminary) transfer function support for ObjCForCollectionStmt. ↵Ted Kremenek
Still need to flesh out some logic. When processing DeclStmt, use the new interface to StateManager::BindDecl. Conjuring of symbols is now done in VisitDeclStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59155 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-11Introduce a single AST node SizeOfAlignOfExpr for all sizeof and alignof ↵Sebastian Redl
expressions, both of values and types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59057 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-10silence a warning from gcc.Chris Lattner
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58956 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-08Add a boilerplate for out-of-bound array checking. This has no real function ↵Zhongxing Xu
currently. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58886 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-07Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is Zhongxing Xu
available, things get much simplified. One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58837 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-02Add transfer function logic for alloca().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58552 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-01 08:08:45 +0000