aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis/GRExprEngine.cpp
AgeCommit message (Collapse)Author
2010-01-25Split libAnalysis into two libraries: libAnalysis and libChecker.Ted Kremenek
(1) libAnalysis is a generic analysis library that can be used by Sema. It defines the CFG, basic dataflow analysis primitives, and inexpensive flow-sensitive analyses (e.g. LiveVariables). (2) libChecker contains the guts of the static analyzer, incuding the path-sensitive analysis engine and domain-specific checks. Now any clients that want to use the frontend to build their own tools don't need to link in the entire static analyzer. This change exposes various obvious cleanups that can be made to the layout of files and headers in libChecker. More changes pending. :) This change also exposed a layering violation between AnalysisContext and MemRegion. BlockInvocationContext shouldn't explicitly know about BlockDataRegions. For now I've removed the BlockDataRegion* from BlockInvocationContext (removing context-sensitivity; although this wasn't used yet). We need to have a better way to extend BlockInvocationContext (and any LocationContext) to add context-sensitivty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94406 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-22Process cast according to the cast kind. Prepare for more specific cast Zhongxing Xu
handling (for C++). No functionality change for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@94153 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-19Fix a serious bug: Tmp3 is the wrong destination set. We should create a newZhongxing Xu
intermediate destination set Tmp4. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93873 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-11Roll out ASTContext::getTypeSizeInChars(), replacing instances ofKen Dyck
"ASTContext::getTypeSize() / 8". Replace [u]int64_t variables with CharUnits ones as appropriate. Also rename RawType, fromRaw(), and getRaw() in CharUnits to QuantityType, fromQuantity(), and getQuantity() for clarity. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93153 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09Fix overzealous assertion in GRExprEngine::VisitLValue(). ATed Kremenek
CallExpr/ObjCMessageExpr can be visited in an "lvalue" context if it returns a struct temporary. Currently the analyzer doesn't reason about struct temporary returned by function calls, but we shouldn't crash here either. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93081 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09When binding an rvalue to a reference, create a temporary object. Use Zhongxing Xu
CXXObjectRegion to represent it. In Environment, lookup a literal expression before make up a value for it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93047 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-08Fix handling in GRExprEngine of 'default' branch in switch statementsTed Kremenek
when the default case is winnowed down to be infeasible. When all cases were ruled out (and the analysis state for the default case would be infeasible) we would still consider the default case possible. This fixes PR 5969. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93017 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Make static analysis support for C++ 'this' expression context-sensitive. ↵Ted Kremenek
Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92675 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Remove references to 'Checker' and 'GRTransferFuncs' fromTed Kremenek
GRStateManager. Having these references was an abstraction violation, as they really should only be known about GRExprEngine. This change required adding a new 'ProcessAssume' callback in GRSubEngine. GRExprEngine implements this callback by calling 'EvalAssume' on all registered Checker objects as well as the registered GRTransferFunc object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92549 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-31Let constraint manager inform checkers that some assumption logic has happend.Zhongxing Xu
Add new states for symbolic regions tracked by malloc checker. This enables us to do malloc checking more accurately. See test case. Based on Lei Zhang's patch and discussion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-25Remove some dead variables clang-analyzer found.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92162 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-25Fix typo spotted by MSVC.Benjamin Kramer
GRExprEngine.cpp(1348) : warning C4305: 'argument' : truncation from 'clang::ProgramPoint::Kind' to 'bool' git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92154 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a ForStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92114 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a WhileStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92106 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a SwitchStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92102 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add CFG support for the condition variable that can appear in IfStmts in C++ ↵Ted Kremenek
mode. Add transfer function support in GRExprEngine for IfStmts with initialized condition variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91987 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add stack trace pretty printing in GRExprEngine::VisitLValue().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91985 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Teach GRExprEngine::VisitLValue to ignore CXXExprWithTempories (for now).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91982 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Teach GRExprEngine::VisitLValue that we don't handle CXXZeroInitValueExprs yet.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91970 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Also treat the type of the subexpression as a pointer in ↵Ted Kremenek
GRExprEngine::VisitCast when the expression is handled as an lvalue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91969 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add basic support for analyzing CastExprs as lvalues.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91952 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-22Add transfer functions support for visiting an Objective-C message ↵Ted Kremenek
expression as an lvalue when the return type is a C++ reference. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91926 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-18Enhance GRExprEngine::VisitCallExpr() to be used in an lvalue context. ↵Ted Kremenek
Uncovered a new failing test case along the way, but we're making progress on handling C++ references in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91710 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Tweak formatting and comments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91615 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Convert GRExprEngine::VisitCallExpr() to use a worklist instead of recursion ↵Ted Kremenek
to evaluate the arguments of a CallExpr. This simplifies the logic and makes it easier to read. (it also avoids any issues with blowing out the stack if the CallExpr had a ridiculous number of arguments) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91613 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Reduce nesting by using early exits. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91610 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Sort switch statement. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91591 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Fix check in GRExprEngine for the 'main' function to handle NULL ↵Ted Kremenek
IdentifierInfo*'s. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91577 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu
attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91535 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add (initial?) static analyzer support for handling C++ references.Ted Kremenek
This change was a lot bigger than I originally anticipated; among other things it requires us storing more information in the CFG to record what block-level expressions need to be evaluated as lvalues. The big change is that CFGBlocks no longer contain Stmt*'s by CFGElements. Currently CFGElements just wrap Stmt*, but they also store a bit indicating whether the block-level expression should be evalauted as an lvalue. DeclStmts involving the initialization of a reference require us treating the initialization expression as an lvalue, even though that information isn't recorded in the AST. Conceptually this change isn't that complicated, but it required bubbling up the data through the CFGBuilder, to GRCoreEngine, and eventually to GRExprEngine. The addition of CFGElement is also useful for when we want to handle more control-flow constructs or other data we want to keep in the CFG that isn't represented well with just a block of statements. In GRExprEngine, this patch introduces logic for evaluating the lvalues of references, which currently retrieves the internal "pointer value" that the reference represents. EvalLoad does a two stage load to catch null dereferences involving an invalid reference (although this could possibly be caught earlier during the initialization of a reference). Symbols are currently symbolicated using the reference type, instead of a pointer type, and special handling is required creating ElementRegions that layer on SymbolicRegions (see the changes to RegionStoreManager). Along the way, the DeadStoresChecker also silences warnings involving dead stores to references. This was the original change I introduced (which I wrote test cases for) that I realized caused GRExprEngine to crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91501 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-15Start the ball rolling on C++ support in the static analyzer. ForTed Kremenek
now, don't construct CFGs that contain C++ try/catch statements, and have GRExprEngine abort a path if it encounters a C++ construct it doesn't understand (which is mostly everything at this point). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91389 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-14Fix: <rdar://problem/7468209> SymbolManager::isLive() should not crash on ↵Ted Kremenek
captured block variables that are passed by reference git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91348 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-14Use insert to avoid destroying existing nodes.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91258 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Refactor OSAtomic evaluation logic into OSAtomicChecker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90968 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Use a temporary destination set such that we can clear fake auto transitions.Zhongxing Xu
Otherwise, even when real evaluation occurs, the previous fake auto transitions would still be in the destination set, causing fake state bifurcation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90967 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09OSAtomic simulation: use the original region as the location to load from,Zhongxing Xu
instead of the ElementRegion obtained from casts. Test cast: the leak cannot occur bacause the true branch cannot be taken. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90964 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09remove dead code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90953 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Insert instead of assign to the dest node set, since we use the dest node setZhongxing Xu
repeatedly. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90952 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-09Fix a horrid bug in GRExprEngine::CheckerVisit() that was identifiedTed Kremenek
by the test case in PR 5627. Essentially we shouldn't clear the ExplodedNodeSet where we deposit newly constructed nodes if that set is the 'Dst' set passed in. It is not okay to clear that set because it may already contain nodes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90931 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-08Refactor builtin function evaluation into a checker.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90847 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add analysis support for blocks. This includes a few key changes:Ted Kremenek
- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters. - VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference) - Add transfer function support to GRExprEngine for BlockDeclRefExprs. This change also supports analyzing blocks as an analysis entry point (top-of-the-stack), which required pushing more context-sensitivity around in the MemRegion hierarchy via the use of LocationContext objects. Functionally almost everything is the same, except we track LocationContexts in a few more areas and StackSpaceRegions now refer to a StackFrameContext object. In the future we will need to modify MemRegionManager to allow multiple StackSpaceRegions in flight at once (for the analysis of multiple stack frames). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90809 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-07Add EvalCallExpr interface to checker, and migrate the no-return functionZhongxing Xu
handler to this interface. GRExprEngine::CheckerEvalCall() will return true if one of the checkers has processed the node. In the future this might return void when we have some default checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90755 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-02Hard bifurcate the state into nil receiver and non-nil receiver, so thatZhongxing Xu
we don't need to use the DoneEvaluation hack when check for ObjCMessageExpr. PreVisitObjCMessageExpr() only checks for undefined receiver or arguments. Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90296 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-30Eliminate another VISIBILITY_HIDDENDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90139 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-30Adapt to the DOTGraphTraits changes in LLVM.Tobias Grosser
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90137 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-28lib/Analysis: Remove VISIBILITY_HIDDEN from definitions in anonymous namespaceKovarththanan Rajaratnam
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@90028 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Refine MemRegions for blocks. Add a new region calledTed Kremenek
'BlockDataRegion' to distinguish between the code associated with a block (which is represented by 'BlockTextRegion') and an instance of a block, which includes both code and data. 'BlockDataRegion' has an associated LocationContext, which can be used to eventually model the lifetime of a block object once LocationContexts can represent scopes (and iterations around a loop, etc.). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89900 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Add post-visit Checker support in GRExprEngine for BlockExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89890 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Make RegisterInternalChecks() part of GRExprEngine's private implementation ↵Ted Kremenek
by making it a static function within GRExprEngine.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89884 91177308-0d34-0410-b5e6-96231b3b80d8
2009-11-25Register internal checks with GRExprEngine when it is constructed, not ↵Ted Kremenek
manually in AnalysisConsumer.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89883 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-04-29 03:39:43 +0000