aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis
AgeCommit message (Collapse)Author
2010-01-09Fix overzealous assertion in GRExprEngine::VisitLValue(). ATed Kremenek
CallExpr/ObjCMessageExpr can be visited in an "lvalue" context if it returns a struct temporary. Currently the analyzer doesn't reason about struct temporary returned by function calls, but we shouldn't crash here either. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93081 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09Fix broken diagnostic when returning the address of a stack-allocated array.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93071 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-09When binding an rvalue to a reference, create a temporary object. Use Zhongxing Xu
CXXObjectRegion to represent it. In Environment, lookup a literal expression before make up a value for it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93047 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-08Fix handling in GRExprEngine of 'default' branch in switch statementsTed Kremenek
when the default case is winnowed down to be infeasible. When all cases were ruled out (and the analysis state for the default case would be infeasible) we would still consider the default case possible. This fixes PR 5969. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93017 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Revert r92318. Instead fix the analyzer: do not call Zhongxing Xu
ASTContext::hasSameUnqualifiedType() when one of the type is VariableArrayType. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92723 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Make static analysis support for C++ 'this' expression context-sensitive. ↵Ted Kremenek
Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92675 91177308-0d34-0410-b5e6-96231b3b80d8
2010-01-05Remove references to 'Checker' and 'GRTransferFuncs' fromTed Kremenek
GRStateManager. Having these references was an abstraction violation, as they really should only be known about GRExprEngine. This change required adding a new 'ProcessAssume' callback in GRSubEngine. GRExprEngine implements this callback by calling 'EvalAssume' on all registered Checker objects as well as the registered GRTransferFunc object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92549 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-31Let constraint manager inform checkers that some assumption logic has happend.Zhongxing Xu
Add new states for symbolic regions tracked by malloc checker. This enables us to do malloc checking more accurately. See test case. Based on Lei Zhang's patch and discussion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-30Simplify code by using an equivalent template class.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92305 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-25Remove some dead variables clang-analyzer found.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92162 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-25Fix typo spotted by MSVC.Benjamin Kramer
GRExprEngine.cpp(1348) : warning C4305: 'argument' : truncation from 'clang::ProgramPoint::Kind' to 'bool' git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92154 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24As Ted suggested, record the callsite information with the StackFrameContext.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92121 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Enhance dataflow analyses to recognize branch statements in the CFG used as ↵Ted Kremenek
hooks for the initialization of condition variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92119 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Inter-procedural analysis: now we can return from the callee.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92116 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a ForStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92114 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Add CFG support for the initializer of the condition variable of a ForStmt.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92113 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24CFG tweak: in a WhileStmt, the condition variable initializer is evaluated ↵Ted Kremenek
every time the condition is checked. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92111 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a WhileStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92106 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Add CFG support for the initializer of the condition variable of a WhileStmt.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92105 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Teach GRExprEngine to handle the initialization of the condition variable of ↵Ted Kremenek
a SwitchStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92102 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-24Add CFG support for the initializer of the condition variable of a SwitchStmt.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92101 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Tidy up FindSubExprAssignments to not deference the child_iterator multiple ↵Ted Kremenek
times. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92087 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23move a few more symbols to .rodata/.data.rel.roNuno Lopes
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92012 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Migrate the call inliner to the Checker interface.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91991 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23For inter-procedural analysis, predecessor node may be in another function.Zhongxing Xu
So we should use the current program point. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91989 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add CFG support for the condition variable that can appear in IfStmts in C++ ↵Ted Kremenek
mode. Add transfer function support in GRExprEngine for IfStmts with initialized condition variables. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91987 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Suppress dead store warnings involving objects initialized with ↵Ted Kremenek
CXXExprTemporaries. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91986 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add stack trace pretty printing in GRExprEngine::VisitLValue().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91985 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Teach GRExprEngine::VisitLValue to ignore CXXExprWithTempories (for now).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91982 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Fix PR 5857. When casting from a symbolic region to an integer back to a ↵Ted Kremenek
pointer value, we were not correctly layering the correct ElementRegion on the original SymbolicRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91981 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Teach GRExprEngine::VisitLValue that we don't handle CXXZeroInitValueExprs yet.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91970 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Also treat the type of the subexpression as a pointer in ↵Ted Kremenek
GRExprEngine::VisitCast when the expression is handled as an lvalue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91969 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-23Add basic support for analyzing CastExprs as lvalues.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91952 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-22Add transfer functions support for visiting an Objective-C message ↵Ted Kremenek
expression as an lvalue when the return type is a C++ reference. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91926 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-21Add comments.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91818 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-19Use the FunctionDecl's result type to know exactly if it returns a reference.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91751 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-18Enhance GRExprEngine::VisitCallExpr() to be used in an lvalue context. ↵Ted Kremenek
Uncovered a new failing test case along the way, but we're making progress on handling C++ references in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91710 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Tweak formatting and comments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91615 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Convert GRExprEngine::VisitCallExpr() to use a worklist instead of recursion ↵Ted Kremenek
to evaluate the arguments of a CallExpr. This simplifies the logic and makes it easier to read. (it also avoids any issues with blowing out the stack if the CallExpr had a ridiculous number of arguments) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91613 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Reduce nesting by using early exits. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91610 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Sort switch statement. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91591 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-17Fix check in GRExprEngine for the 'main' function to handle NULL ↵Ted Kremenek
IdentifierInfo*'s. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91577 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Completely remove ObjCObjectRegion (tests pass this time).Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91572 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Temporarily revert 91553.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91557 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Remove use of ObjCObjectRegion from BasicStoreManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91553 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add a new kind of region: CXXObjectRegion. Currently it has only one Zhongxing Xu
attribute: the object type. Add initial support for visiting CXXThisExpr. Fix a bunch of 80-col violations. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91535 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Teach RetainSummaryManager::getSummary(FunctionDecl* FD) that ↵Ted Kremenek
'FD->getIdentifier()' will not always return a non-null IdentifierInfo*. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91512 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Teach OSAtomicChecker that a FunctionDecl's name isn't always a simple ↵Ted Kremenek
IdentifierInfo*. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91511 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Teach NoReturnFunctionChecker that FunctionDecl::getIdentifier() is not ↵Ted Kremenek
guaranteed to return a non-null IdentifierInfo*. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91510 91177308-0d34-0410-b5e6-96231b3b80d8
2009-12-16Add (initial?) static analyzer support for handling C++ references.Ted Kremenek
This change was a lot bigger than I originally anticipated; among other things it requires us storing more information in the CFG to record what block-level expressions need to be evaluated as lvalues. The big change is that CFGBlocks no longer contain Stmt*'s by CFGElements. Currently CFGElements just wrap Stmt*, but they also store a bit indicating whether the block-level expression should be evalauted as an lvalue. DeclStmts involving the initialization of a reference require us treating the initialization expression as an lvalue, even though that information isn't recorded in the AST. Conceptually this change isn't that complicated, but it required bubbling up the data through the CFGBuilder, to GRCoreEngine, and eventually to GRExprEngine. The addition of CFGElement is also useful for when we want to handle more control-flow constructs or other data we want to keep in the CFG that isn't represented well with just a block of statements. In GRExprEngine, this patch introduces logic for evaluating the lvalues of references, which currently retrieves the internal "pointer value" that the reference represents. EvalLoad does a two stage load to catch null dereferences involving an invalid reference (although this could possibly be caught earlier during the initialization of a reference). Symbols are currently symbolicated using the reference type, instead of a pointer type, and special handling is required creating ElementRegions that layer on SymbolicRegions (see the changes to RegionStoreManager). Along the way, the DeadStoresChecker also silences warnings involving dead stores to references. This was the original change I introduced (which I wrote test cases for) that I realized caused GRExprEngine to crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91501 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-24 01:23:45 +0000