aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis
AgeCommit message (Collapse)Author
2008-12-21Use utility method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61304 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility methods. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61300 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Remove unused function.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61299 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Add support for member references (E1.E2, E1->E2) with C++ semantics,Douglas Gregor
which can refer to static data members, enumerators, and member functions as well as to non-static data members. Implement correct lvalue computation for member references in C++. Compute the result type of non-static data members of reference type properly. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61294 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Fix <rdar://problem/6454568>: BugReporter should correctly handle switch ↵Ted Kremenek
statements with no default case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61270 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-18Fix regression when invalidating reference-counts for objects ↵Ted Kremenek
passed-by-reference to a function/method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61224 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17CF-retain/release checker:Ted Kremenek
- Fix regression reported in <rdar://problem/6452745>. After a null check, null references to resources should not have a retain count. This regression was caused by removing the call to "GRTransferFuncs::EvalAssume" in BasicConstraintManager. - Added a test case to test this behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61155 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17Fix <rdar://problem/6451816>:Ted Kremenek
- Because of the introduction of AnonTypedRegions when reasoning about casts, we had a regression in the "symbolication" of variable values passed-by-reference to a function. This is now fixed in CFRefCount.cpp (-checker-cfref) by blasting through the layer of AnonTypedRegions when symbolicating the value of the variable. This logic may get moved elsewhere. Note that this change affects only -checker-cfref and not -checker-simple; eventually this logic should get pulled out of CFRefCount.cpp into a more common place. All users use -checker-cfref by default, and -checker-simple should probably just be removed. - Updated test 'Analysis/uninit-vals-ps.c' to only use -checker-cfref and added a test case for this regression. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61147 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17Add pretty-printing for AnonTypedRegion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61146 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16Add new GRWorkList class that uses two queues:Ted Kremenek
- one queue (FIFO) to queue up nodes at block entrances - another queue (LIFO) to queue up other nodes - The idea is to explore basic blocks to completion, but to do a BFS exploration of blocks. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61106 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16ProgramPoint:Ted Kremenek
- Added four new ProgramPoint types that subclass PostStmt for use in GRExprEngine::EvalLocation: - PostOutOfBoundsCheckFailed - PostUndefLocationCheckFailed - PostNullCheckFailed - PostLocationChecksSucceed These were created because of a horribly subtle caching bug in EvalLocation where a node representing an "bug condition" in EvalLocation (e.g. a null dereference) could be re-used as the "non-bug condition" because the Store did not contain any information to differentiate between the two. The extra program points just disables any accidental caching between EvalLocation and its callers. GRExprEngine: - EvalLocation now returns a NodeTy* instead of GRState*. This should be used as the "vetted" predecessor for EvalLoad/EvalStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61105 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16Implement RegionStoreManager::Remove().Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61069 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-15Fix regression in handling sizeof(void) in the static analyzer.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61039 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-14I think we should getRValueType here. The lvaluetype of an array region is ↵Zhongxing Xu
'pointer to array'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61003 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek
GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60990 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Address some comments on the name lookup/DeclContext patch from ChrisDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60897 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Unifies the name-lookup mechanisms used in various parts of the ASTDouglas Gregor
and separates lexical name lookup from qualified name lookup. In particular: * Make DeclContext the central data structure for storing and looking up declarations within existing declarations, e.g., members of structs/unions/classes, enumerators in C++0x enums, members of C++ namespaces, and (later) members of Objective-C interfaces/implementations. DeclContext uses a lazily-constructed data structure optimized for fast lookup (array for small contexts, hash table for larger contexts). * Implement C++ qualified name lookup in terms of lookup into DeclContext. * Implement C++ unqualified name lookup in terms of qualified+unqualified name lookup (since unqualified lookup is not purely lexical in C++!) * Limit the use of the chains of declarations stored in IdentifierInfo to those names declared lexically. * Eliminate CXXFieldDecl, collapsing its behavior into FieldDecl. (FieldDecl is now a ScopedDecl). * Make RecordDecl into a DeclContext and eliminates its Members/NumMembers fields (since one can just iterate through the DeclContext to get the fields). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60878 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Identify AnonPointeeRegion by the symbol that is concretized.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60870 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11AnonPointeeRegions are now identified by the MemRegion of the pointer pointingZhongxing Xu
to them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60868 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fix to BasicStoreManager::getElementLValue: If the base region is a symbol, ↵Ted Kremenek
layer an AnonTypedRegion on top of it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60808 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Have BasicStoreManager::getLValueElement() have logic similar to ↵Ted Kremenek
BasicStoreManager::getLValueField() (i.e., don't just return the 'base' as the SVal) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60795 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09In GRExprEngine treat @throw as an 'abort' that ends the current path. This ↵Ted Kremenek
is a temporary solution. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60789 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Add utility method. Remove an unused method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60758 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09[static analyzer] Extend VLA size checking to look for undefined sizes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60734 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fixed LiveVariables bug where we didn't consider block-level expressions ↵Ted Kremenek
that functioned as the size of a VLA to be live. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60730 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-08Add checking for zero-sized VLAs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60726 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-08'self.myIvar = nil' (properties) only releases myIvar when the property has ↵Ted Kremenek
kind 'assign'. This fixes <rdar://problem/6380411>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60717 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-06Add bandaid transfer function support for assignments involving ObjCKVCRefExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60622 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Add SymbolRef::print() and have SymbolicRegion::print() use this method ↵Ted Kremenek
instead of calling SymbolRef::getNumber(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60578 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Use trait-based profiling of SymbolRefs, avoiding calling getNumber() (which ↵Ted Kremenek
will soon be removed). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60577 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Rename SymbolID to SymbolRef. This is a precursor to some overhauling of ↵Ted Kremenek
the representation of symbolic values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60575 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Remove SymbolDataContentsOf (unused).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60572 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek
GRState* argument instead of a Store. This allows them to use the GDM for storing other data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60570 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Revamp RegionStoreManager::RemoveDeadBindings. This method now does a ↵Ted Kremenek
complete mark-and-sweep of the store, removing dead regions and recording the set of live and dead symbols appropriately. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60523 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Update comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60520 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Add comments.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60516 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-03BasicConstraintManager:Ted Kremenek
- Fix nonsensical logic in AssumeSymGE. When comparing 'sym >= constant' and the constant is the maximum integer value, add the constraint that 'sym == constant' when the path is deemed feasible. All other cases are feasible. - Improve AssumeSymGT. When comparing 'sym > constant' and constant is the maximum integer value we know the path is infeasible. - Add test case for this enhancement to AssumeSymGT. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60490 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-03BasicConstraintManager:Ted Kremenek
- Fix nonsensical logic in AssumeSymLE. When comparing 'sym <= constant' and the constant is the minimum integer value, add the constraint that 'sym == constant' when the path is deemed feasible. All other cases are feasible. - Improve AssumeSymLT to address <rdar://problem/6407949>. When comparing 'sym < constant' and constant is the minimum integer value we know the path is infeasible. - Add test case for <rdar://problem/6407949>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60489 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-02Make RegionStoreManager::InitializeArray safe against array sizes that don't ↵Sebastian Redl
have pointer width. This may be the case on 64-bit systems. Whether that fact is a bug is a different question, but it's easy to cure the symptom. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60422 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-02Add FIXME.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60390 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-30Add support for initializing array with string literal.Zhongxing Xu
This fixes PR3127 http://llvm.org/bugs/show_bug.cgi?id=3127 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60280 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-29To be consistent, make the index of the ElementRegion always signed.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60248 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Fix a serious bug.Zhongxing Xu
When initialized, the index of the ElementRegion was unsigned. But the index value of the ArraySubscriptExpr is signed. This inconsistency caused the value of the array element retrieved to be UnknownVal despite it was initialized to symbolic. This is only a hack. Real fix of this problem is required. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60207 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Code cleanup. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60206 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Use std::make_pair instead of std::pair's ctor.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60205 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-27Factory objects should not be temporary. It caches all objects in the set.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60151 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-27RegionViewMap factory is actually not used. All GDMs should use factories fromZhongxing Xu
GDMContext. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60150 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-27Add comments.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60146 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-30 14:47:39 +0000