aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp
AgeCommit message (Collapse)Author
2012-08-14[analyzer] Disable autorelease pool tracking.Anna Zaks
The autorelease pool has not been implemented completely: we were adding the autoreleased symbols to the state, but never looking at them. Until we have a complete implementation, remove the overhead and comment out the unused code. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161821 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-14[analyzer] Refactor RetainReleaseChecker to go through a function callAnna Zaks
to set/get/remove the RefBinding. No functional change here. Having these setter and getter methods will make it much easier when replacing the underlining representation of RefBindings (I just went through the exercise). It makes the code more readable as well. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161820 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-06[analyzer] Ignore OS X 10.8's annotations for NSMakeCollectable.Jordan Rose
The frameworks correctly use the 'cf_consumed' and 'ns_returns_retained' attributes for NSMakeCollectable, but we can model the behavior under garbage collection more precisely than that. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161349 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-30[analyzer] Only allow CallEvents to be created by CallEventManager.Jordan Rose
This ensures that it is valid to reference-count any CallEvents, and we won't accidentally try to reclaim a CallEvent that lives on the stack. It also hides an ugly switch statement for handling CallExprs! There should be no functionality change here. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160986 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-26[analyzer] Rename Calls.{h,cpp} to CallEvent.{h,cpp}. No functionality change.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160815 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-23Fix a typo (the the => the)Sylvestre Ledru
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160622 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-18[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall.Jordan Rose
As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160461 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-18Remove trivial destructor from SVal.Benjamin Kramer
This enables the faster SmallVector in clang and also allows clang's unused variable warnings to be more effective. Fix the two instances that popped up. The RetainCountChecker change actually changes functionality, it would be nice if someone from the StaticAnalyzer folks could look at it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160444 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-10[analyzer] Make CallEnter, CallExitBegin, and CallExitEnd not be StmtPointsJordan Rose
These ProgramPoints are used in inlining calls, and not all calls have associated statements anymore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160021 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-10[analyzer] Add a CXXDestructorCall CallEvent.Jordan Rose
While this work is still fairly tentative (destructors are still left out of the CFG by default), we now handle destructors in the same way as any other calls, instead of just automatically trying to inline them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160020 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-10[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints.Jordan Rose
These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160019 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-03[analyzer] For now, don't inline non-static member overloaded operators.Jordan Rose
Our current inlining support (specifically RegionStore::enterStackFrame) doesn't know that calls to overloaded operators may be calls to non-static member functions, and that in these cases the first argument should be treated as 'this'. This caused incorrect results and sometimes crashes. The long-term fix will be to rewrite RegionStore::enterStackFrame to use CallEvent and its subclasses, but for now we can just disable these problematic calls by classifying them under a new CallEvent, CXXMemberOperatorCall. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159692 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Introduce CXXAllocatorCall to handle placement arg invalidation.Jordan Rose
This is NOT full-blown support for operator new, but removes some nasty duplicated code introduced in r158784. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159608 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Convert existing checkers to use check::preCall and check::postCall.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159563 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Finish replacing ObjCMessage with ObjCMethodDecl and friends.Jordan Rose
The preObjCMessage and postObjCMessage callbacks now take an ObjCMethodCall argument, which can represent an explicit message send (ObjCMessageSend) or an implicit message generated by a property access (ObjCPropertyAccess). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159559 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends.Jordan Rose
Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper around the existing ObjCMessage abstraction (over message sends and property accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses ObjCMessageSend and ObjCPropertyAccess. In addition to removing yet another wrapper object, this should make it easy to add a ObjCSubscriptAccess call event soon. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159558 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Convert RetainCountChecker to use CallEvent as much as possible.Jordan Rose
This ended allowing quite a bit of cleanup, and some minor changes. - CallEvent makes it easy to use hasNonZeroCallbackArg more aggressively, which we check in order to avoid false positives with callbacks that might release the object. - In order to support this for functions which consume their arguments, there are two new ArgEffects: DecRefAndStopTracking and DecRefMsgAndStopTracking. These act just like StopTracking, except that if the object only had a return count of +1 it's now considered released instead (so we still get use-after-free messages). - On the plus side, we no longer have to special-case +[NSObject performSelector:withObject:afterDelay:] and friends. - The use of IdentifierInfos in the method summary cache is now hidden; only the ObjCInterfaceDecl gets passed around most of the time. - Since we cache all "simple" summaries and check every function call, there is no real benefit to having NULL stand in for default summaries anymore. - Whitespace, unused methods, etc. Even more simplification to come when we get check::postCall and can unify all these other post* checks. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159555 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Add a new abstraction over all types of calls: CallEventJordan Rose
This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159554 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-27[analyzer] RetainCountChecker: remove unused SelfOwn ArgEffect kind.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159245 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-15[analyzer] RetainCount: don't track objects init'd with a delegateJordan Rose
We already didn't track objects that have delegates or callbacks or objects that are passed through void * "context pointers". It's a not-uncommon pattern to release the object in its callback, and so the leak message we give is not very helpful. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158532 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06Remove unused private member variables found by clang's new ↵Benjamin Kramer
-Wunused-private-field. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158086 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-27Replace some custom hash combines with the standard stuff from DenseMapInfo.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-12[analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the static analyzer that NSLog() and friends do not hold on to object ↵Ted Kremenek
references (thus extending their lifetime). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Fixup r156215: use StopTracking summary instead of ScratchArgsAnna Zaks
As per Jordy's and Ted's comment, use the default StopTracking summary instead of adding all arguments to ScratchArs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156310 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer] RetainCountChecker: Allow objects to escape through callbacksAnna Zaks
Fixes radar://10973977. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156215 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] RetainRelease: Self assignment should not suppress a leakAnna Zaks
warning. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155966 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01Teach RetainCountchecker about IORegistryEntrySearchCFProperty returning ↵Ted Kremenek
retained objects. I know there is an SDK enhancement request for this to have the cf_returns_retained annotation, so this is just a stop gap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155887 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26Teach RetainCountChecker that it doesn't quite understand ↵Ted Kremenek
pthread_setspecific and it should just give up when it sees it. Fixes <rdar://problem/11282706>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155613 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Require that all static analyzer issues have a category. As part of this ↵Ted Kremenek
change, consolidate some commonly used category strings into global references (more of this can be done, I just did a few). Fixes <rdar://problem/11191537>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154121 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.Anna Zaks
Fixes a false positive (radar://11152419). The current solution of adding the info into 3 places is quite ugly. Pending a generic pointer escapes callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153731 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27Change RetainCountChecker to eagerly "escape" retained objects when they areTed Kremenek
assigned to a struct. This is fallout from inlining results, which expose far more patterns where people stuff CF objects into structs and pass them around (and we can reason about it). The problem is that we don't have a general way to detect when values have escaped, so as an intermediate step we need to eagerly prune out such tracking. Fixes <rdar://problem/11104566>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153489 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able ↵Jordy Rose
to reset diagnostic generation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153368 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23Avoid applying retain/release effects twice in RetainCountChecker when a ↵Ted Kremenek
function call was inlined (i.e., we do not need to apply summaries in such cases). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153309 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22"Teach" RetainCountChecker about dispatch_set_context, which can indirectly ↵Ted Kremenek
free its argument later. Fixes <rdar://problem/11059275>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyser] Factor out FindUniqueBinding from RetainCount checker.Anna Zaks
So that others could use it as well. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-18[analyzer] Use a FoldingSet to cache simple RetainSummary instances, rather ↵Jordy Rose
than explicitly keeping DoNothing and StopTracking summaries and nothing else. I tried to test the effects of this change on memory usage and run time, but what I saw on retain-release.m was indistinguishable from noise (debug and release builds). Even so, some caveman profiling showed 101 cache hits that we would have generated new summaries for before (i.e. not default or stop summaries), and the more code we analyze, the more memory we should save. Maybe we should have a standard project for benchmarking the retain count checker's memory and time? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153007 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Unify retain-count summary generation for class and instance ↵Jordy Rose
methods. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153001 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Remove duplicate work on deriving method behavior. No ↵Jordy Rose
functionality change. The cocoa::deriveNamingConventions helper is just using method families anyway now, and the way RetainSummaryTemplate works means we're allocating an extra summary for every method with a relevant family. Also, fix RetainSummaryTemplate to do the right thing w/r/t annotating an /existing/ summary. This was probably the real cause of <rdar://problem/10824732> and the fix in r152448. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152998 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Don't claim an object was returned with +1 retain count before ↵Jordy Rose
counting autoreleases. Fixes PR10376. (Also, 80-column violations.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152976 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-11Unify naming of LangOptions variable/get function across the Clang stack ↵David Blaikie
(Lex to AST). The member variable is always "LangOpts" and the member function is always "getLangOpts". Reviewed by Chris Lattner git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152536 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09Teach RetainCountChecker about mixing method families with explicit ↵Ted Kremenek
annotations. Fixes <rdar://problem/10824732>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152448 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek
symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152139 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-28[analyzer] Leaks should be uniqued by the allocation point in theAnna Zaks
closest function context (RetainCountChecker). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-28[analyzer] Retain release: drop the line number info from the leakAnna Zaks
message. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151657 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-25RetainCountChecker: don't adjust the retain count when analyzing a ↵Ted Kremenek
ReturnStmt unless we are in the top-level call frame. We can do more later, but this makes the checker self-consistent (and fixes a crash). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-18Teach analyzer about NSAutoreleasePool -allocWithZone:. Fixes ↵Ted Kremenek
<rdar://problem/10640253>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150892 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-17Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek
for functions called more than once. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150849 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14[analyzer] Make Malloc Checker optimistic in presence of inlining.Anna Zaks
(In response of Ted's review of r150112.) This moves the logic which checked if a symbol escapes through a parameter to invalidateRegionCallback (instead of post CallExpr visit.) To accommodate the change, added a CallOrObjCMessage parameter to checkRegionChanges callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150513 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-06-23 06:36:45 +0000