aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis
AgeCommit message (Collapse)Author
2009-10-12Use a BumpPtrAllocator to allocate all aspects of CFG, including CFGBlocks, ↵Ted Kremenek
successor and predecessor vectors, etc. Speedup: when doing 'clang-cc -analyze -dump-cfg' (without actual printing, just CFG building) on the amalgamated SQLite source (all of SQLite in one source file), runtime reduced by 9%. This fixes: <rdar://problem/7250745> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83899 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-11Introduces a new BindingVal which combines direct andZhongxing Xu
default binding for regions. This allows us to simply a lot of code. A further simplification could be done is that many methods of regionstore can only work on Store instead of GRState. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83762 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-09Make the behavior explicit by not using the method call.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83611 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-09Remove unused code.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83610 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-08Installation of Clang libraries and headers, from Axel Naumann!Douglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83582 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-07Change ExplodedNode to have its NodeGroups all BumpPtrAllocated, avoiding ↵Ted Kremenek
malloc() traffic when adding successors/predecessors to a node. This was done by introducing BumpVector, which is essentially SmallVector with all memory being BumpPtrAllocated (this can certainly be cleaned up or moved into llvm/ADT). This change yields a 1.8% speed increase when running the analyzer (with -analyzer-store=region) on a small benchmark file. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83439 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-06Fix 'clang-cc -analyzer-display-progress' by flushing standard error after ↵Ted Kremenek
printing the name of the analyzed function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83369 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-06Fix crash introduced by r83358 where a symbol could be eagerlyTed Kremenek
evaluated to an APSInt with a different bitwidth than the other operand in a binary expression. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83368 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-06Fix: <rdar://problem/7275774> Static analyzer warns about NULL pointer whenTed Kremenek
adding assert This fix required a few changes: SimpleSValuator: - Eagerly replace a symbolic value with its constant value in EvalBinOpNN when it is constrained to a constant. This allows us to better constant fold values along a path. - Handle trivial case of '<', '>' comparison of pointers when the two pointers are exactly the same. RegionStoreManager: git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83358 91177308-0d34-0410-b5e6-96231b3b80d8
2009-10-01Fix bad grammar in static analyzer diagnostic. Reported by Robert Purves!Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83204 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Desugaring optimizations. Add single-step desugaring methods to allJohn McCall
concrete types. Use unqualified desugaring for getAs<> and sundry. Fix a few users to either not desugar or use qualified desugar, as seemed appropriate. Removed Type's qualified desugar method, as it was easy to accidentally use instead of QualType's. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83116 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Modify ASTLocation and apart from being a Decl or Stmt, allow it to also be:Argyrios Kyrtzidis
-A NamedDecl reference -A TypeLoc git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83095 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Add more const-goodness to ASTLocation.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83087 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Fix: <rdar://problem/7261075> [RegionStore] crash when handling load: ↵Ted Kremenek
'*((unsigned int *)"????")' This issue was originally reported via personal email by Thomas Clement! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83069 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Fix really insidious bug in RegionStoreManager::RemoveDeadBindings()Ted Kremenek
identified with a false positive reported by Thomas Clement. This involved doing another rewrite of RegionStoreManager::RemoveDeadBindings(), which phrases the entire problem of scanning for dead regions as a graph exploration problem. It is more methodic than the previous implementation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83053 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Reapply most of r82939, but add a guard that FieldRegions and friendsTed Kremenek
are only specially treated by RegionStore::InvalidateRegion() when their super region is also invalidated. When this isn't the case, conjure a new symbol for a FieldRegion. Thanks to Zhongxing Xu and Daniel Dunbar for pointing out this issue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83043 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-29Revert r82939. We can only not special case FieldRegions when the super ↵Ted Kremenek
region has also been invalidated. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@83040 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-27Specially handle fields, elements, and ivars inTed Kremenek
RegionStoreManager::InvalidateRegion() by only removing their old binding, not conjuring a new symbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82939 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-27Add FIXME comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82924 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-27Fix:Ted Kremenek
<rdar://problem/6914474> checker doesn't realize that variable might have been assigned if a pointer to that variable was passed to another function via a structure The problem here was the RegionStoreManager::InvalidateRegion didn't invalidate the bindings of invalidated regions. This required a rewrite of this method using a worklist. As part of this fix, changed ValueManager::getConjuredSymbolVal() to require a 'void*' SymbolTag argument. This tag is used to differentiate two different symbols created at the same location. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82920 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-25Fix checking for a null pointer constant when the expression itself isDouglas Gregor
value-dependent. Audit (and fixed) all calls to Expr::isNullPointerConstant() to provide the correct behavior with value-dependent expressions. Fixes PR5041 and a crash in libstdc++ <locale>. In the same vein, properly compute value- and type-dependence for ChooseExpr. Fixes PR4996. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82748 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-25Fix <rdar://problem/7249327> by allowing silent conversions between signed ↵Ted Kremenek
and unsigned integer values for symbolic values. This is an intermediate solution (i.e. hack) until we support extension/truncation of symbolic integers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82737 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-24When building CFGs, no longer reverse the statements in the CFGBlock. InsteadTed Kremenek
have the iterators and operator[] handle the traversal of statements, as they are stored in reverse order. Tests show this has no real performance impact, but it does simply the CFG construction logic and will make it slightly easier to change the allocation strategy for CFGBlocks (as we have fewer copies). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82702 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-24Fix crash in RegionStoreManager::Bind() by using 'getAs<PointerType>()' ↵Ted Kremenek
instead of 'cast<PointerType>()' (to handle pointer typedefs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82686 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-24Fix: <rdar://problem/7249340> [RegionStore] model stores to symbolic ↵Ted Kremenek
parameter regions The issue was a discrepancy between how RegionStoreManager::Bind() and RegionStoreManager::Retrieve() derived the "key" for the first element of a symbolic region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82680 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-24Shorten the static analyzer diagnostic for 'use of garbage value'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82672 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-23Fix PR 4988 by removing an invalid assertion (a function can be referenced inTed Kremenek
GRExprEngine::VisitDeclRefExpr without 'asLValue' being true). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82598 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-22Fix: <rdar://problem/7242006> [RegionStore] compound literal assignment with ↵Ted Kremenek
floats not honored git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82575 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-22Fix: <rdar://problem/7242015> [RegionStore] variable passed-by-reference ↵Ted Kremenek
(via integer) to function call not invalidated git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82523 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-21Change all the Type::getAsFoo() methods to specializations of Type::getAs().John McCall
Several of the existing methods were identical to their respective specializations, and so have been removed entirely. Several more 'leaf' optimizations were introduced. The getAsFoo() methods which imposed extra conditions, like getAsObjCInterfacePointerType(), have been left in place. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82501 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-21Provide intermediate solution to handling assignments to structs via anTed Kremenek
integer pointer. For now just invalidate the fields of the struct. This addresses: <rdar://problem/7185607> [RegionStore] support invalidation of bit fields using integer assignment git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82492 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-18Re-introduce diagnostic caching in BugReporter that was originally added inTed Kremenek
r82198 and then reverted. This is an intermediate solution, as diagnostic caching should not rely on static variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82301 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-18Reintroduce FoldingSet profiling for PathDiagnostics.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82299 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-18Revert most of r82198, which was causing a large number of crashesTed Kremenek
when running the analyzer on real projects. We'll keep the change to AnalysisManager.cpp in r82198 so that -fobjc-gc analyzes code correctly in both GC and non-GC modes, although this may emit two diagnostics for each bug in some cases (a better solution will come later). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82201 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-18Introduce caching of diagnostics in BugReporter. This provides extraTed Kremenek
pruning of diagnostics that may be emitted multiple times. This is accomplished by adding FoldingSet profiling support to PathDiagnostic, and then having BugReporter record what diagnostics have been issued. This was motived to a serious bug introduced by moving the 'divide-by-zero' checking outside of GRExprEngine into a separate 'Checker' class. When analyzing code using the '-fobjc-gc' option, a given function would be analyzed twice, but the second time various "internal checks" would be disabled to avoid emitting multiple diagnostics (e.g., "null dereference") for the same issue. The problem is that such checks also effect path pruning and don't just emit diagnostics. This resulted in an assertion failure involving a real divide-by-zero in some analyzed code where we would get an assertion failure in APInt because the 'DivZero' check was disabled and didn't prune the logic that resulted in the divide-by-zero in the analyzer. The implemented solution is somewhat of a hack, and may not perform extremely well. This will need to be cleaned up over time. As a regression test, 'misc-ps.m' has been modified so that its tests are run using -fobjc-gc to test this diagnostic pruning behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82198 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-16Have divide-by-zero checker not handled undefined denominators. This is ↵Ted Kremenek
handled by the generic checking for undefined operands for BinaryOperators. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82019 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-16Remove ImplicitBadDivides/ExplicitBadDivides node sets. This checking is ↵Ted Kremenek
now down by a 'Checker' and not build into GRExprEngine. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@82017 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-15Fix static analyzer regression when emitting undefined value warningsTed Kremenek
with binary operators. The result of a binary operator may be undefined even if its operands are well-defined. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81874 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-15Per feedback from Eli, recognize in the transfer function logic forTed Kremenek
__builtin_offsetof in the static analyzer that __builtin_offsetof is not guaranteed to return an integer constant. We will need to shore this up later, but now at least we have correct support for when this *is* an integer constant. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81830 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-15Fix typo in comment.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81825 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-15Add static analyzer transfer function support for __builtin_offsetof.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81820 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-14Fix: <rdar://problem/5905851> do not report a leak when post-dominated by a callTed Kremenek
to a noreturn or panic function git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81803 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-14Implement FIXME: free up BugReportEquivClass objects when deleting BugTypes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81783 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-12Remove unnecessary ASTContext parameter from FunctionDecl::isBuiltinIDDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81590 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-12Eliminate FunctionDecl::getBodyIfAvailableDouglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81588 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-11Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a wayTed Kremenek
to statically type various methods in SValuator/GRState as required either a defined value or a defined-but-possibly-unknown value. This leads to various logic cleanups in GRExprEngine, and lets the compiler enforce via type checking our assumptions about what symbolic values are possibly undefined and what are not. Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81579 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-11Update CMakeLists.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81519 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-11Start to add a new transfer function that inlines callee. To be continued.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81501 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-10Make AnalysisManager stateless. Now other analyzer components only depends onZhongxing Xu
local node information. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81433 91177308-0d34-0410-b5e6-96231b3b80d8
2009-09-09Implement: <rdar://problem/7185647> [RegionStore] 'self' cannot be NULL ↵Ted Kremenek
upon entry to a method Here we implement this as a precondition within GRExprEngine, even though it is related to how BasicStoreManager and RegionStoreManager model 'self' differently. Putting this as a high-level precondition is more general, which is why it isn't in RegionStore.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@81378 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-03 17:30:28 +0000