aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers
AgeCommit message (Collapse)Author
2012-06-22[analyzer] Fixup to r158958.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159037 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-22[analyzer] Malloc: Warn about use-after-free when memory ownership wasAnna Zaks
transfered with dataWithBytesNoCopy. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158958 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-21Remove a goofy CMake hack and use the standard CMake facilities toChandler Carruth
express library-level dependencies within Clang. This is no more verbose really, and plays nicer with the rest of the CMake facilities. It should also have no change in functionality. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158888 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-20[analyzer] Malloc leak false positive: Allow xpc context to escape.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158875 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-20[analyzer] Malloc: cleanup, disallow free on relinquished memory.Anna Zaks
This commits sets the grounds for more aggressive use after free checking. We will use the Relinquished sate to denote that someone else is now responsible for releasing the memory. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158850 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-19[analyzer] Allow pointers to escape into NSPointerArray.Anna Zaks
(Fixes radar://11691035 PR13140) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158703 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-16[analyzer] Buffers passed to CGBitmapContextCreate can escape.Jordan Rose
Specifically, although the bitmap context does not take ownership of the buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted out of the created CGContextRef. Thus the buffer is not leaked even if its original pointer goes out of scope, as long as - the context escapes, or - it is retrieved via CGBitmapContextGetData and freed. Actually implementing that logic is beyond the current scope of MallocChecker, so for now CGBitmapContextCreate goes on our system function exception list. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158579 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-15[analyzer] RetainCount: don't track objects init'd with a delegateJordan Rose
We already didn't track objects that have delegates or callbacks or objects that are passed through void * "context pointers". It's a not-uncommon pattern to release the object in its callback, and so the leak message we give is not very helpful. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158532 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-15Documentation cleanup:James Dennett
* Add \brief to produce a summary in the Doxygen output; * Add missing parameter names to \param commands; * Fix mismatched parameter names for \param commands; * Add a parameter name so that the \param has a target. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158503 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-11[analyzer] Add ObjCLoopChecker: objects from NSArray et al are non-nil.Jordan Rose
While collections containing nil elements can still be iterated over in an Objective-C for-in loop, the most common Cocoa collections -- NSArray, NSDictionary, and NSSet -- cannot contain nil elements. This checker adds that assumption to the analyzer state. This was the cause of some minor false positives concerning CFRelease calls on objects in an NSArray. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158319 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-11[analyzer] When looking for a known class, only traverse the hierarchy once.Jordan Rose
This has a small hit in the case where only one class is interesting (NilArgChecker) but is a big improvement when looking for one of several interesting classes (VariadicMethodTypeChecker), in which the most common case is that there is no match. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158318 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-08[analyzer] MallocSizeofChecker false positive: when sizeof is argumentAnna Zaks
to addition. We should not to warn in case the malloc size argument is an addition containing 'sizeof' operator - it is common to use the pattern to pack values of different sizes into a buffer. Ex: uint8_t *buffer = (uint8_t*)malloc(dataSize + sizeof(length)); git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158219 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-07[analyzer] Anti-aliasing: different heap allocations do not aliasAnna Zaks
Add a concept of symbolic memory region belonging to heap memory space. When comparing symbolic regions allocated on the heap, assume that they do not alias. Use symbolic heap region to suppress a common false positive pattern in the malloc checker, in code that relies on malloc not returning the memory aliased to other malloc allocations, stack. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158136 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06Revert Decl's iterators back to pointer value_type rather than reference ↵David Blaikie
value_type In addition, I've made the pointer and reference typedef 'void' rather than T* just so they can't get misused. I would've omitted them entirely but std::distance likes them to be there even if it doesn't use them. This rolls back r155808 and r155869. Review by Doug Gregor incorporating feedback from Chandler Carruth. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158104 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06Remove unused private member variables found by clang's new ↵Benjamin Kramer
-Wunused-private-field. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158086 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06Disable path pruning for UndefResultChecker. It turns out we usually want ↵Ted Kremenek
to see more of the path to discover how a value was used uninitialized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158048 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-02Fix typos found by http://github.com/lyda/misspell-checkBenjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157886 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01Disable diagnosic path pruning for ReturnUndefChecker.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157851 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31[analyzer] Fix BugType memory leak in IdempotentOperationChecker.Tom Care
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157772 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31Allow some BugReports to opt-out of PathDiagnostic callstack pruning until ↵Ted Kremenek
we have significantly improved the pruning heuristics. The current heuristics are pretty good, but they make diagnostics for uninitialized variables warnings particularly useless in some cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-27Replace some custom hash combines with the standard stuff from DenseMapInfo.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-24[analyzer] Minor cleanup to checkers' help text.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157402 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer] Malloc checker: remove unnecessary comparisons.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer]Malloc: refactor and report use after free by memoryAnna Zaks
allocating functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157037 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-16[analyzer] Introduce clang_analyzer_eval for regression test constraint checks.Jordy Rose
The new debug.ExprInspection checker looks for calls to clang_analyzer_eval, and emits a warning of TRUE, FALSE, or UNKNOWN (or UNDEFINED) based on the constrained value of its (boolean) argument. It does not modify the analysis state though the conditions tested can result in branches (e.g. through the use of short-circuit operators). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156919 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-15[analyzer] Fix a regression in ObjCUnusedIVars checker.Anna Zaks
We can no longer rely on children iterator to visit all the AST tree children of an expression (OpaqueValueExpr has no children). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156870 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-14[analyzer] strncpy: Special-case a length of 0 to avoid an incorrect warning.Jordy Rose
We check the address of the last element accessed, but with 0 calculating that address results in element -1. This patch bails out early (and avoids a bunch of other work at that). Fixes PR12807. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156769 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-12[analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Do not highlight the range of the statement in case of leak.Anna Zaks
We report a leak at a point a leaked variable is no longer accessible. The statement that happens to be at that point is not relevant to the leak diagnostic and, thus, should not be highlighted. radar://11178519 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156530 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] SelfInit: Stop tracking self if it's assigned a value weAnna Zaks
don't reason about. Self is just like a local variable in init methods, so it can be assigned anything like result of static functions, other methods ... So to suppress false positives that result in such cases, stop tracking the checker-specific state after self is being assigned to (unless the value is't being assigned to is either self or conforms to our rules). This change does not invalidate any existing regression tests. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156420 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the static analyzer that NSLog() and friends do not hold on to object ↵Ted Kremenek
references (thus extending their lifetime). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Turn on MallocSizeOfChecker by default; shorten the diagnosticAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156341 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Fixup r156215: use StopTracking summary instead of ScratchArgsAnna Zaks
As per Jordy's and Ted's comment, use the default StopTracking summary instead of adding all arguments to ScratchArs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156310 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer] RetainCountChecker: Allow objects to escape through callbacksAnna Zaks
Fixes radar://10973977. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156215 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Allow pointers escape through calls containing callback args.Anna Zaks
(Since we don't have a generic pointer escape callback, modify ExprEngineCallAndReturn as well as the malloc checker.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156134 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] CString Checker: Do not split the path unless the userAnna Zaks
specifically checks for equality to null. Enforcing this general practice, which keeps the analyzer less noisy, in the CString Checker. This change suppresses "Assigned value is garbage or undefined" warning in the added test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156085 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] RetainRelease: Self assignment should not suppress a leakAnna Zaks
warning. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155966 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155963 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01Teach RetainCountchecker about IORegistryEntrySearchCFProperty returning ↵Ted Kremenek
retained objects. I know there is an SDK enhancement request for this to have the cf_returns_retained annotation, so this is just a stop gap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155887 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01malloc size checker: Ignore const'ness of pointer types when determining of ↵Ted Kremenek
a sizeof() type is compatible with a pointed type. Fixes <rdar://problem/11292586>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155864 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-30Remove the ref/value inconsistency in filter_decl_iterator.David Blaikie
filter_decl_iterator had a weird mismatch where both op* and op-> returned T* making it difficult to generalize this filtering behavior into a reusable library of any kind. This change errs on the side of value, making op-> return T* and op* return T&. (reviewed by Richard Smith) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155808 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26Teach RetainCountChecker that it doesn't quite understand ↵Ted Kremenek
pthread_setspecific and it should just give up when it sees it. Fixes <rdar://problem/11282706>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155613 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-16[analyzer] Fix a false alarm in SelfInitChecker (radar://11235991).Anna Zaks
Along with it, fix a couple of other corner cases and add more tests. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154866 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Don't crash even when the system functions are redefined.Anna Zaks
(Applied changes to CStringAPI, Malloc, and Taint.) This might almost never happen, but we should not crash even if it does. This fixes a crash on the internal analyzer buildbot, where postgresql's configure was redefining memmove (radar://11219852). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154451 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-06Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that ↵Ted Kremenek
when we generate a new ExplodedNode we use the same Expr* as the one being currently visited. This is preparation for transitioning to having ProgramPoints refer to CFGStmts. This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact, as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but it will look a lot cleaner when were start using CFGStmt* in the appropriate places. As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed. I have audited these, and they look reasonable. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154214 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-06[analyzer] Check that the arguments to NSOrderedSet creation methods are ↵Jordy Rose
valid ObjC objects. Patch by Sean McBride! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154194 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Require that all static analyzer issues have a category. As part of this ↵Ted Kremenek
change, consolidate some commonly used category strings into global references (more of this can be done, I just did a few). Fixes <rdar://problem/11191537>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154121 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Teach ObjCContainersChecker that the array passed to CFArrayGetValueAtIndex ↵Ted Kremenek
might not be a symbolic value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154083 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Look through chains of 'x = y = z' when employing silencing heuristics in ↵Ted Kremenek
the DeadStoresChecker. Fixes <rdar://problem/11185138>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154040 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Include the "issue context" (e.g. function or method) where a static ↵Ted Kremenek
analyzer issue occurred in the plist output. Fixes <rdar://problem/11004527> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154030 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-09-20 12:44:55 +0000