aboutsummaryrefslogtreecommitdiff
path: root/lib/Analysis
AgeCommit message (Collapse)Author
2011-08-25Teach -Wunreachable-code about dead code caused by macro expansions. This ↵Ted Kremenek
should suppress false positives resulting from 'assert' and friends. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138576 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-23Start reworking -Wunreachable-code. The original analysis had serious flaws ↵Ted Kremenek
with how it handled SCC's of dead code, or simply having false negatives by overly suppressing warnings. WIP. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138410 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-23CFG: record set of C++ 'try' dispatch blocks, which could be of interest to ↵Ted Kremenek
various analyses (e.g., reachability). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138409 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-23Constify the result of CFGStmt::getStmt().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138408 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-23Fix regression in -Wuninitialized involving VLAs. It turns out that we were ↵Ted Kremenek
modeling sizeof(VLAs) incorrectly in the CFG, and also the static analyzer. This patch regresses the analyzer a bit, but that needs to be followed up with a better solution. Fixes <rdar://problem/10008112>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138372 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-20Remove dead code.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138183 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-17Fix else style. No functionality change intended.Chad Rosier
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137896 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-17Fix a handful of dead stores found by Clang's static analyzer. There's a ↵Ted Kremenek
bunch of others I haven't touched. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137867 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek
and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12[analyzer] change "tag" in ProgramPoint from "void*" to a ProgramPointTag*.Ted Kremenek
Having a notion of an actual ProgramPointTag will aid in introspection of the analyzer's behavior. For example, the GraphViz output of the analyzer will pretty-print the tags in a useful manner. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137529 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Revert "Fix crash in CFGBuilder involving implicit destructor calls and ↵Ted Kremenek
gotos jumping after an object was declared. Fixes PR 10620." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137459 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Fix crash in CFGBuilder involving implicit destructor calls and gotos ↵Ted Kremenek
jumping after an object was declared. Fixes PR 10620. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137426 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-08Fix another -Wuninitialized assertion failure (this one involving bit casts) ↵Ted Kremenek
resulting from the recent -Wuninitialized changes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137068 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-06[analyzer] Simplify logic for ExprEngine::VisitUnaryExprOrTypeTraitExpr to ↵Ted Kremenek
avoid recursion to subexpression. This exposed bugs in the live variables analysis, and a latent analyzer bug in the SymbolReaper. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137006 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-04Fix assertion failure in -Wuninitialized involving no-op casts. Fixes PR 10577.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136939 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-02Make helper functions static.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136679 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-28[analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to ↵Ted Kremenek
be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs. The motivation of this large change is to drastically simplify the logic in ExprEngine going forward. Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will need to be fixed over time. There is also some possible performance regression as RemoveDeadBindings will be called frequently; this can also be improved over time. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136419 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-23remove unneeded llvm:: namespace qualifiers on some core types now that ↵Chris Lattner
LLVM.h imports them into the clang namespace. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135852 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-22Move duplicate uninitialized warning suppression into theChandler Carruth
AnalysisBasedWarnings Sema layer and out of the Analysis library itself. This returns the uninitialized values analysis to a more pure form, allowing its original logic to correctly detect some categories of definitely uninitialized values. Fixes PR10358 (again). Thanks to Ted for reviewing and updating this patch after his rewrite of several portions of this analysis. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135748 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-21Simplify passing of CFGBuildOptions around for AnalysisContext. No ↵Ted Kremenek
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135666 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-20Fix -Wuninitialized regression involving functions invalidating parameters ↵Ted Kremenek
passed by reference. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135610 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-19Fix false negative in -Wuninitialized involving a () wrapping an ↵Ted Kremenek
lvalue-to-rvalue conversion in a DeclStmt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135525 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-19Fix assertion failure in UninitializedValues.cpp where an lvalue to rvalue ↵Ted Kremenek
conversion is wrapped in a parenthesis. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135519 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-19Reduce -Wuninitialized time by 22% (on sqlite) by removing the recursive AST ↵Ted Kremenek
crawl. This is accomplished by forcing the needed expressions for -Wuninitialized to always be CFGElements in the CFG. This allows us to remove a fair amount of the code for -Wuninitialized. Some fallout: - AnalysisBasedWarnings.cpp now specifically toggles the CFGBuilder to create a CFG that is suitable for -Wuninitialized. This is a layering violation, since the logic for -Wuninitialized is in libAnalysis. This can be fixed with the proper refactoring. - Some of the source locations for -Wunreachable-code warnings have shifted. While not ideal, this is okay because that analysis already needs some serious reworking. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135480 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-19Add hooks into the CFG builder to force that specific expressions are always ↵Ted Kremenek
CFGElements. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135479 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-16Revert r135217, which wasn't the correct fix for PR10358. With thisChandler Carruth
patch, we actually move the state-machine for the value set backwards one step. This can pretty easily lead to infinite loops where we continually try to propagate a bit, succeed for one iteration, but then back up because we find an uninitialized use. A reduced test case from PR10379 is included. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135359 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-16[analyzer] Per discussions with the Cocoa team, extend CF naming conventions ↵Ted Kremenek
to extend to camel case functions instead of just title case functions. Fixes <rdar://problem/9732321>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135350 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-16[analyzer] Place checking for Core Foundation "Create" rule into a proper ↵Ted Kremenek
API. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135349 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-14Fix false negative reported in PR 10358 by using 'Unknown' in ↵Ted Kremenek
-Wuninitialized to avoid cascading warnings. Patch by Kaelyn Uhrain. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135217 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-14Revert r135147 and r135075. The consensus was that this wasn't the right ↵Ted Kremenek
thing to do. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135152 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-14Add extra sanity checking in FormatString::matchesType() that we are ↵Ted Kremenek
comparing integers to integers. This happens not to be an issue now, but the extra check helps future proof in case of future refactorings. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135147 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-14Reapply r135075, but modify format-strings.c and format-strings-fixit.c test ↵Ted Kremenek
cases to be more portable with an explicit target triple. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135134 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-14Revert r135075, "format string checking: long and int have the same widths ↵NAKAMURA Takumi
on 32-bit, so we shouldn't warn about using" It fails on freebsd, mingw and msvc10. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135129 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-13format string checking: long and int have the same widths on 32-bit, so we ↵Ted Kremenek
shouldn't warn about using an "int" format specifier with a "long" type in 32-bit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135075 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-13Re-relax conversion specifier checking for printf format strings and ↵Ted Kremenek
conversion specifiers. My recent change was a mistake. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135048 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-13Fix inversion in argument type checking for format strings with conversion ↵Ted Kremenek
specifiers for character types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135046 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-08Make the worklist in the uninitialized values checker actually a queue.Chandler Carruth
Previously, despite the names 'enqueue' and 'dequeue', it behaved as a stack and visited blocks in a LIFO fashion. This interacts badly with extremely broad CFGs *inside* of a loop (such as a large switch inside a state machine) where every block updates a different variable. When encountering such a CFG, the checker visited blocks in essentially a "depth first" order due to the stack-like behavior of the work list. Combined with each block updating a different variable, the saturation logic of the checker caused it to re-traverse blocks [1,N-1] of the broad CFG inside the loop after traversing block N. These re-traversals were to propagate the variable values derived from block N. Assuming approximately the same number of variables as inner blocks exist, the end result is O(N^2) updates. By making this a queue, we also make the traversal essentially "breadth-first" across each of the N inner blocks of the loop. Then all of this state is propagated around to all N inner blocks of the loop. The result is O(N) updates. The truth is in the numbers: Before, gcc.c: 96409 block visits (max: 61546, avg: 591) After, gcc.c: 69958 block visits (max: 33090, avg: 429) Before, PR10183: 2540494 block vists (max: 2536495, avg: 37360) After, PR10183: 137803 block visits (max: 134406, avg: 2026) The nearly 20x reduction in work for PR10183 corresponds to a roughly 100x speedup in compile time. I've tested it on all the code I can get my hands on, and I've seen no slowdowns due to this change. Where I've collected stats, the ammount of work done is on average less. I'll also commit shortly some synthetic test cases useful in analyzing the performance of CFG-based warnings. Submitting this based on Doug's feedback that post-commit review should be good. Ted, please review! Hopefully this helps compile times until then. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134697 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-06Build up statistics about the work done for analysis based warnings.Chandler Carruth
Special detail is added for uninitialized variable analysis as this has serious performance problems than need to be tracked. Computing some of this data is expensive, for example walking the CFG to determine its size. To avoid doing that unless the stats data is going to be used, we thread a bit into the Sema object to track whether detailed stats should be collected or not. This bit is used to avoid computations whereever the computations are likely to be more expensive than checking the state of the flag. Thus, counters are in some cases unconditionally updated, but the more expensive (and less frequent) aggregation steps are skipped. With this patch, we're able to see that for 'gcc.c': *** Analysis Based Warnings Stats: 232 functions analyzed (0 w/o CFGs). 7151 CFG blocks built. 30 average CFG blocks per function. 1167 max CFG blocks per function. 163 functions analyzed for uninitialiazed variables 640 variables analyzed. 3 average variables per function. 94 max variables per function. 96409 block visits. 591 average block visits per function. 61546 max block visits per function. And for the reduced testcase in PR10183: *** Analysis Based Warnings Stats: 98 functions analyzed (0 w/o CFGs). 8526 CFG blocks built. 87 average CFG blocks per function. 7277 max CFG blocks per function. 68 functions analyzed for uninitialiazed variables 1359 variables analyzed. 19 average variables per function. 1196 max variables per function. 2540494 block visits. 37360 average block visits per function. 2536495 max block visits per function. That last number is the somewhat scary one that indicates the problem in PR10183. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134494 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-06Teach the static analyzer's interpretation of Cocoa conventions toDouglas Gregor
obey the objc_method_family attribute when provided. Fixes <rdar://problem/9726279>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134493 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-06Added a missing case label.Fariborz Jahanian
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134454 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-28Revert r133024, "[format strings] correctly suggest correct type for '%@'Daniel Dunbar
specifiers. Fixes <rdar://problem/9607158>." because it causes false positives on some code that uses CF toll free bridging. - I'll let Doug or Ted figure out the right fix here, possibly just to accept any pointer type. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134041 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-21Introduce a new AST node describing reference binding to temporaries.Douglas Gregor
MaterializeTemporaryExpr captures a reference binding to a temporary value, making explicit that the temporary value (a prvalue) needs to be materialized into memory so that its address can be used. The intended AST invariant here is that a reference will always bind to a glvalue, and MaterializeTemporaryExpr will be used to convert prvalues into glvalues for that binding to happen. For example, given const int& r = 1.0; The initializer of "r" will be a MaterializeTemporaryExpr whose subexpression is an implicit conversion from the double literal "1.0" to an integer value. IR generation benefits most from this new node, since it was previously guessing (badly) when to materialize temporaries for the purposes of reference binding. There are likely more refactoring and cleanups we could perform there, but the introduction of MaterializeTemporaryExpr fixes PR9565, a case where IR generation would effectively bind a const reference directly to a bitfield in a struct. Addresses <rdar://problem/9552231>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133521 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-16Finish 2 sentences.Francois Pichet
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133214 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-15Automatic Reference Counting.John McCall
Language-design credit goes to a lot of people, but I particularly want to single out Blaine Garst and Patrick Beard for their contributions. Compiler implementation credit goes to Argyrios, Doug, Fariborz, and myself, in no particular order. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133103 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-14[format strings] correctly suggest correct type for '%@' specifiers. Fixes ↵Ted Kremenek
<rdar://problem/9607158>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133024 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-11Implement Objective-C Related Result Type semantics.Douglas Gregor
Related result types apply Cocoa conventions to the type of message sends and property accesses to Objective-C methods that are known to always return objects whose type is the same as the type of the receiving class (or a subclass thereof), such as +alloc and -init. This tightens up static type safety for Objective-C, so that we now diagnose mistakes like this: t.m:4:10: warning: incompatible pointer types initializing 'NSSet *' with an expression of type 'NSArray *' [-Wincompatible-pointer-types] NSSet *array = [[NSArray alloc] init]; ^ ~~~~~~~~~~~~~~~~~~~~~~ /System/Library/Frameworks/Foundation.framework/Headers/NSObject.h:72:1: note: instance method 'init' is assumed to return an instance of its receiver type ('NSArray *') - (id)init; ^ It also means that we get decent type inference when writing code in Objective-C++0x: auto array = [[NSMutableArray alloc] initWithObjects:@"one", @"two",nil]; // ^ now infers NSMutableArray* rather than id git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132868 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-10[analyzer] PR8962 again. Ban ParenExprs (and friends) from block-level ↵Jordy Rose
expressions (by calling IgnoreParens before adding expressions to blocks). Undo 132769 (LiveVariables' local IgnoreParens), since it's no longer necessary. Also, have Environment stop looking through NoOp casts; it didn't match the behavior of LiveVariables. And once that's gone, the whole cast block of that switch is unnecessary. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132840 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-09[analyzer] Ignore parentheses around block-level expressions when computing ↵Jordy Rose
liveness. Fixes the other half of PR8962. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132769 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-31Utilize PackedVector, introduced with llvm commit r132325.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132326 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-24Add explicit CFG support for ignoring static_asserts.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132001 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-01 09:07:55 +0000