aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis
AgeCommit message (Collapse)Author
2009-01-12retain/release checker:Ted Kremenek
- Refactor a bunch of logic in the retain/release checker, making it more condense and easier to read. - Add support for "Create" methods in the DiskArbitration framework retain/release tests: - Rename CFDate.m to retain-release.m, and move test from CFString.c to retain-release.m - Add DiskArbitration framework tests cases. - Add/refine and few more retain/release GC test cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62106 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-09Dead stores checker: Don't flag dead stores for self-assignments (common ↵Ted Kremenek
escape hatch for 'unused variable' warnings). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62010 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-08Add isSubRegionOf() method to SubRegion.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61924 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Update some doxygen comments to be more rich. Remove ↵Ted Kremenek
StoreManager::GetRegionSVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61894 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Refactor MemRegionManager instance variable into parent class. No ↵Ted Kremenek
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61888 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07This commit reflects changes to the retain/release checker motivated by myTed Kremenek
recent discussions with Thomas Clement and Ken Ferry concerning the "fundamental rule" for Cocoa memory management (http://developer.apple.com/documentation/Cocoa/Conceptual/MemoryMgmt/Tasks/MemoryManagementRules.html). Here is the revised behavior of the checker concerning tracking retain/release counts for objects returned from message expressions involving instance methods: 1) Track the returned object if the return type of the message expression is id<..>, id, or a pointer to *any* object that subclasses NSObject. Such objects are assumed to have a retain count. Previously the checker only tracked objects when the receiver of the message expression was part of the standard Cocoa API (i.e., had class names prefixed with 'NS'). This should significantly expand the amount of checking performed. 2) Consider the object owned if the selector of the message expression contains "alloc", "new", or "copy". Previously we also considered "create", but this doesn't follow from the fundamental rule (discussions with the Cocoa folks confirms this). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61837 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-06Return UnknownVal in RegionStoreManager::getSizeInElements() for unsupported ↵Ted Kremenek
regions. This silences a warning when compiling Release-Asserts builds. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61818 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-06Add QualifiedDeclRefExpr, which retains additional source-locationDouglas Gregor
information for declarations that were referenced via a qualified-id, e.g., N::C::value. We keep track of the location of the start of the nested-name-specifier. Note that the difference between QualifiedDeclRefExpr and DeclRefExpr does have an effect on the semantics of function calls in two ways: 1) The use of a qualified-id instead of an unqualified-id suppresses argument-dependent lookup 2) If the name refers to a virtual function, the qualified-id version will call the function determined statically while the unqualified-id version will call the function determined dynamically (by looking up the appropriate function in the vtable). Neither of these features is implemented yet, but we do print out qualified names for QualifiedDeclRefExprs as part of the AST printing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61789 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-24Add a bunch of comments and FIXMEs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61419 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-24set region default value if there are not enough init values for array and ↵Zhongxing Xu
struct. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61418 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-24Comment and fixup GDM entries for RegionStore to use unique 'tag classes' to ↵Ted Kremenek
identify GDM entries. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61409 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-22Fix initialization order.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61333 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-22Add an option to make 'RemoveDeadBindings' a configurable behavior. This enablesZhongxing Xu
us to measure the effect of this optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61319 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61304 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Use utility methods. No functional change.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61300 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-21Remove unused function.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61299 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Add support for member references (E1.E2, E1->E2) with C++ semantics,Douglas Gregor
which can refer to static data members, enumerators, and member functions as well as to non-static data members. Implement correct lvalue computation for member references in C++. Compute the result type of non-static data members of reference type properly. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61294 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Fix <rdar://problem/6454568>: BugReporter should correctly handle switch ↵Ted Kremenek
statements with no default case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61270 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-18Fix regression when invalidating reference-counts for objects ↵Ted Kremenek
passed-by-reference to a function/method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61224 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17CF-retain/release checker:Ted Kremenek
- Fix regression reported in <rdar://problem/6452745>. After a null check, null references to resources should not have a retain count. This regression was caused by removing the call to "GRTransferFuncs::EvalAssume" in BasicConstraintManager. - Added a test case to test this behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61155 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17Fix <rdar://problem/6451816>:Ted Kremenek
- Because of the introduction of AnonTypedRegions when reasoning about casts, we had a regression in the "symbolication" of variable values passed-by-reference to a function. This is now fixed in CFRefCount.cpp (-checker-cfref) by blasting through the layer of AnonTypedRegions when symbolicating the value of the variable. This logic may get moved elsewhere. Note that this change affects only -checker-cfref and not -checker-simple; eventually this logic should get pulled out of CFRefCount.cpp into a more common place. All users use -checker-cfref by default, and -checker-simple should probably just be removed. - Updated test 'Analysis/uninit-vals-ps.c' to only use -checker-cfref and added a test case for this regression. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61147 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17Add pretty-printing for AnonTypedRegion.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61146 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16Add new GRWorkList class that uses two queues:Ted Kremenek
- one queue (FIFO) to queue up nodes at block entrances - another queue (LIFO) to queue up other nodes - The idea is to explore basic blocks to completion, but to do a BFS exploration of blocks. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61106 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16ProgramPoint:Ted Kremenek
- Added four new ProgramPoint types that subclass PostStmt for use in GRExprEngine::EvalLocation: - PostOutOfBoundsCheckFailed - PostUndefLocationCheckFailed - PostNullCheckFailed - PostLocationChecksSucceed These were created because of a horribly subtle caching bug in EvalLocation where a node representing an "bug condition" in EvalLocation (e.g. a null dereference) could be re-used as the "non-bug condition" because the Store did not contain any information to differentiate between the two. The extra program points just disables any accidental caching between EvalLocation and its callers. GRExprEngine: - EvalLocation now returns a NodeTy* instead of GRState*. This should be used as the "vetted" predecessor for EvalLoad/EvalStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61105 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-16Implement RegionStoreManager::Remove().Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61069 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-15Fix regression in handling sizeof(void) in the static analyzer.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61039 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-14I think we should getRValueType here. The lvaluetype of an array region is ↵Zhongxing Xu
'pointer to array'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61003 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13MemRegion:Ted Kremenek
- Overhauled the notion of "types" for TypedRegions. We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()). Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs. - Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type. We can add it back once there is a need for it and we can resolve its role with these concepts. StoreManager: - Overhauled StoreManager::CastRegion. It expects an *lvalue* type for a region. This is actually what motivated the overhaul to the MemRegion type mechanism. It also no longer returns an SVal; we can just return a MemRegion*. - BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts. This matches with the MemRegion changes. - Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion(). AuditCFNumberCreate check: - Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type. This change was needed to work with the changes to StoreManager::CastRegion. GRExprEngine::VisitCast: - Conform to the new interface of StoreManager::CastRegion. Tests: - None of the analysis tests fail now for using the "basic store". - Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60995 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-13A series of cleanups/fixes motivated by <rdar://problem/6442306>:Ted Kremenek
GRExprEngine (VisitCast): - When using StoreManager::CastRegion, always use the state and value it returns to generate the next node. Failure to do so means that region values returned that don't require the state to be modified will get ignored. MemRegion: - Tighten the interface for ElementRegion. Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion. Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions. - Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region. - Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion. All that matters is that it is a TypedRegion, which is now true all the time by design. BasicStore: - Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion. This conforms to the updated interface for ElementRegion. RegionStore: - In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60990 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Address some comments on the name lookup/DeclContext patch from ChrisDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60897 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Unifies the name-lookup mechanisms used in various parts of the ASTDouglas Gregor
and separates lexical name lookup from qualified name lookup. In particular: * Make DeclContext the central data structure for storing and looking up declarations within existing declarations, e.g., members of structs/unions/classes, enumerators in C++0x enums, members of C++ namespaces, and (later) members of Objective-C interfaces/implementations. DeclContext uses a lazily-constructed data structure optimized for fast lookup (array for small contexts, hash table for larger contexts). * Implement C++ qualified name lookup in terms of lookup into DeclContext. * Implement C++ unqualified name lookup in terms of qualified+unqualified name lookup (since unqualified lookup is not purely lexical in C++!) * Limit the use of the chains of declarations stored in IdentifierInfo to those names declared lexically. * Eliminate CXXFieldDecl, collapsing its behavior into FieldDecl. (FieldDecl is now a ScopedDecl). * Make RecordDecl into a DeclContext and eliminates its Members/NumMembers fields (since one can just iterate through the DeclContext to get the fields). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60878 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11Identify AnonPointeeRegion by the symbol that is concretized.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60870 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-11AnonPointeeRegions are now identified by the MemRegion of the pointer pointingZhongxing Xu
to them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60868 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fix to BasicStoreManager::getElementLValue: If the base region is a symbol, ↵Ted Kremenek
layer an AnonTypedRegion on top of it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60808 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Have BasicStoreManager::getLValueElement() have logic similar to ↵Ted Kremenek
BasicStoreManager::getLValueField() (i.e., don't just return the 'base' as the SVal) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60795 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09In GRExprEngine treat @throw as an 'abort' that ends the current path. This ↵Ted Kremenek
is a temporary solution. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60789 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Add utility method. Remove an unused method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60758 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09[static analyzer] Extend VLA size checking to look for undefined sizes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60734 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-09Fixed LiveVariables bug where we didn't consider block-level expressions ↵Ted Kremenek
that functioned as the size of a VLA to be live. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60730 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-08Add checking for zero-sized VLAs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60726 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-08'self.myIvar = nil' (properties) only releases myIvar when the property has ↵Ted Kremenek
kind 'assign'. This fixes <rdar://problem/6380411>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60717 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-06Add bandaid transfer function support for assignments involving ObjCKVCRefExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60622 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Add SymbolRef::print() and have SymbolicRegion::print() use this method ↵Ted Kremenek
instead of calling SymbolRef::getNumber(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60578 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Use trait-based profiling of SymbolRefs, avoiding calling getNumber() (which ↵Ted Kremenek
will soon be removed). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60577 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Rename SymbolID to SymbolRef. This is a precursor to some overhauling of ↵Ted Kremenek
the representation of symbolic values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60575 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Remove SymbolDataContentsOf (unused).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60572 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek
GRState* argument instead of a Store. This allows them to use the GDM for storing other data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60570 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Revamp RegionStoreManager::RemoveDeadBindings. This method now does a ↵Ted Kremenek
complete mark-and-sweep of the store, removing dead regions and recording the set of live and dead symbols appropriately. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60523 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-04Update comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60520 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-06 05:02:15 +0000