aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers
AgeCommit message (Collapse)Author
2013-05-02[analyzer] RetainCountChecker: don't track through xpc_connection_set_context.Jordan Rose
It is unfortunate that we have to mark these exceptions in multiple places. This was already in CallEvent. I suppose it does let us be more precise about saying /which/ arguments have their retain counts invalidated -- the connection's is still valid even though the context object's isn't -- but we're not tracking the retain count of XPC objects anyway. <rdar://problem/13783514> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180904 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-26[analyzer] An ObjC for-in loop runs 0 times if the collection is nil.Jordan Rose
In an Objective-C for-in loop "for (id element in collection) {}", the loop will run 0 times if the collection is nil. This is because the for-in loop is implemented using a protocol method that returns 0 when there are no elements to iterate, and messages to nil will result in a 0 return value. At some point we may want to actually model this message send, but for now we may as well get the nil case correct, and avoid the false positives that would come with this case. <rdar://problem/13744632> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180639 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-25[analyzer] Teach DeadStoreChecker to look though BO_Comma and disregard the LHS.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180579 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-25[analyzer] Fix a crash in RetainCountChecker - we should not rely on ↵Anna Zaks
CallEnter::getCallExpr to return non-NULL We get a CallEnter with a null expression, when processing a destructor. All other users of CallEnter::getCallExpr work fine with null as return value. (Addresses PR15832, Thanks to Jordan for reducing the test case!) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180234 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-24[analyzer] IvarInvalidation: correctly handle cases where only partial ↵Anna Zaks
invalidators exist - If only partial invalidators exist and there are no full invalidators in @implementation, report every ivar that has not been invalidated. (Previously, we reported the first Ivar in the list, which could actually have been invalidated by a partial invalidator. The code assumed you cannot have only partial invalidators.) - Do not report missing invalidation method declaration if a partial invalidation method declaration exists. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180170 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-23[analyzer] Set the allocation site to be the uniqueing location for retain ↵Anna Zaks
count checker leaks. The uniqueing location is the location which is part of the hash used to determine if two reports are the same. This is used by the CmpRuns.py script to compare two analyzer runs and determine which warnings are new. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180166 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-23[analyzer] RetainCountChecker: Clean up path notes for autorelease.Jordan Rose
No functionality change. <rdar://problem/13710586> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180075 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-22[analyzer] Model strsep(), particularly that it returns its input.Jordan Rose
This handles the false positive leak warning in PR15374, and also serves as a basic model for the strsep() function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180069 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-22[analyzer] Type information from C++ new expressions is perfect.Jordan Rose
This improves our handling of dynamic_cast and devirtualization for objects allocated by 'new'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180051 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-17[analyzer] Don't warn for returning void expressions in void blocks.Jordan Rose
This was slightly tricky because BlockDecls don't currently store an inferred return type. However, we can rely on the fact that blocks with inferred return types will have return statements that match the inferred type. <rdar://problem/13665798> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179699 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-16[analyzer] Add experimental option "leak-diagnostics-reference-allocation".Ted Kremenek
This is an opt-in tweak for leak diagnostics to reference the allocation site if the diagnostic consumer only wants a pithy amount of information, and not the entire path. This is a strawman enhancement that I expect to see some experimentation with over the next week, and can go away if we don't want it. Currently it is only used by RetainCountChecker, but could be used by MallocChecker if and when we decide this should stay in. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179634 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-16Properly sort list.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179627 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-16[analyzer] Improve the malloc checker stack hint messageAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179580 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-12[analyzer] Enable NewDelete checker if NewDeleteLeaks checker is enabled.Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179428 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-12[analyzer] Makes NewDeleteLeaks checker work independently from NewDelete.Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179410 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-12[analyzer]Print field region even when the base region is not printableAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179395 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-12[analyzer] Fix grammar in comment.Jordan Rose
By Adam Schnitzer! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179352 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-11[analyzer] Refactoring: better doxygen comment; renaming isTrackedFamily to ↵Anton Yartsev
isTrackedByCurrentChecker git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179242 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] Address Jordan’s review of r179219Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179235 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] Address Jordan’s code review of r 179221Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179234 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] Switched to checkPreCall interface for detecting usage after free.Anton Yartsev
Now the check is also applied to arguments for Objective-C method calls and to 'this' pointer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179230 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] Fix a crash in SyntaxCString checker when given a custom strncat.Anna Zaks
Fixes PR13476 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179228 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] When reporting a leak in RetainCount checker due to an early exit ↵Anna Zaks
from init, step into init. The heuristic here (proposed by Jordan) is that, usually, if a leak is due to an early exit from init, the allocation site will be a call to alloc. Note that in other cases init resets self to [super init], which becomes the allocation site of the object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179221 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-10[analyzer] Cleanup leak warnings: do not print the names of variables from ↵Anna Zaks
other functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179219 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-09[analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().Jordan Rose
Previously, the analyzer used isIntegerType() everywhere, which uses the C definition of "integer". The C++ predicate with the same behavior is isIntegerOrUnscopedEnumerationType(). However, the analyzer is /really/ using this to ask if it's some sort of "integrally representable" type, i.e. it should include C++11 scoped enumerations as well. hasIntegerRepresentation() sounds like the right predicate, but that includes vectors, which the analyzer represents by its elements. This commit audits all uses of isIntegerType() and replaces them with the general isIntegerOrEnumerationType(), except in some specific cases where it makes sense to exclude scoped enumerations, or any enumerations. These cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>() plus BuiltinType::isInteger(). isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and include/clang/StaticAnalysis. :-) Fixes real assertion failures. PR15703 / <rdar://problem/12350701> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179081 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-09[analyzer] Keep tracking the pointer after the escape to more aggressively ↵Anna Zaks
report mismatched deallocator Test that the path notes do not change. I don’t think we should print a note on escape. Also, I’ve removed a check that assumed that the family stored in the RefStete could be AF_None and added an assert in the constructor. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179075 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-08Tweak warning text for nil value in ObjC container warning.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179034 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-06[analyzer] Shorten the malloc checker’s leak messageAnna Zaks
As per Ted’s suggestion! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178938 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Reword error messages for nil keys and values of NSMutableDictionary.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178935 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Eliminates all the cases with unknown family.Anton Yartsev
Now treat AF_None family as impossible in isTrackedFamily() git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178899 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Re-enable cplusplus.NewDelete (but not NewDeleteLeaks).Jordan Rose
As mentioned in the previous commit message, the use-after-free and double-free warnings for 'delete' are worth enabling even while the leak warnings still have false positives. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178891 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Split new/delete checker into use-after-free and leaks parts.Jordan Rose
This splits the leak-checking part of alpha.cplusplus.NewDelete into a separate user-level checker, alpha.cplusplus.NewDeleteLeaks. All the difficult false positives we've seen with the new/delete checker have been spurious leak warnings; the use-after-free warnings and mismatched deallocator warnings, while rare, have always been valid. <rdar://problem/6194569> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178890 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Path notes for the MismatchedDeallocator checker.Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178862 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Check allocation family more precise.Anton Yartsev
The statement passed to isTrackedFamily() might be a user defined function calling malloc; in this case we got AF_NONE family for this function. Now the allocation family is derived from Sym, that holds a family of a real allocator. This commit is also a movement towards getting rid of tracking memory allocating by unknown means. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178834 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Corrected the switch statement.Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178831 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-05[analyzer] Fully-covered switch for families in isTrackedFamily()Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178820 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-04[analyzer] Reduced the unwanted correlations between checkers living inside ↵Anton Yartsev
MallocChecker.cpp This fixes an issue pointed to by Jordan: if unix.Malloc and unix.MismatchedDeallocator are both on, then we end up still tracking leaks of memory allocated by new. Moved the guards right before emitting the bug reports to unify and simplify the logic of handling of multiple checkers. Now all the checkers perform their checks regardless of if they were enabled, or not, and it is decided just before the emitting of the report, if it should be emitted. (idea from Anna). Additional changes: improved test coverage for checker correlations; refactoring: BadDealloc -> MismatchedDealloc git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178814 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-04[analyzer] RetainCountChecker: refactor annotation handling.Jordan Rose
...and add a new test case. I thought this was broken, but it isn't; refactoring and reformatting anyway so that I don't make the same mistake again. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178799 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-03[analyzer] Rename “Mac OS X API”, “Mac OS API” -> “API Misuse ↵Anna Zaks
(Apple)” As they are relevant on both Mac and iOS. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178687 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-03[analyzer] Warn when nil receiver results in forming null referenceAnna Zaks
This also allows us to ensure IDC/return null suppression gets triggered in such cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178686 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-03[analyzer] Better model for copying of array fields in implicit copy ctors.Jordan Rose
- Find the correct region to represent the first array element when constructing a CXXConstructorCall. - If the array is trivial, model the copy with a primitive load/store. - Don't warn about the "uninitialized" subscript in the AST -- we don't use the helper variable that Sema provides. <rdar://problem/13091608> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178602 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-02[analyzer] Moving cplusplus.NewDelete to alpha.* for now.Anton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178529 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28[analyzer] Document existence of ConstPointerEscape.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178311 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28[analyzer] Add support for escape of const pointers and use it to allow ↵Anna Zaks
“newed” pointers to escape Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works for const pointers passed as a top level parameter into a function. We need to differentiate the const pointers escape from regular escape since the content pointed by const pointer will not change; if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers. This should suppress several false positives reported by the NewDelete checker on llvm codebase. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178310 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28[analyzer] Apply the suppression rules to the nil receiver only if the value ↵Anna Zaks
participates in the computation of the nil we warn about. We should only suppress a bug report if the IDCed or null returned nil value is directly related to the value we are warning about. This was not the case for nil receivers - we would suppress a bug report that had an IDCed nil receiver on the path regardless of how it’s related to the warning. 1) Thread EnableNullFPSuppression parameter through the visitors to differentiate between tracking the value which is directly responsible for the bug and other values that visitors are tracking (ex: general tracking of nil receivers). 2) in trackNullOrUndef specifically address the case when a value of the message send is nil due to the receiver being nil. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178309 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28Use early return in printing logic. Minor cleanup.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178264 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28Fix order of initialization warning.Eric Christopher
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178255 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28[analyzer] These implements unix.MismatchedDeallocatorChecker checker.Anton Yartsev
+ Improved display names for allocators and deallocators The checker checks if a deallocation function matches allocation one. ('free' for 'malloc', 'delete' for 'new' etc.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178250 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-28[analyzer] For now assume all standard global 'operator new' functions ↵Anton Yartsev
allocate memory in heap. + Improved test coverage for cplusplus.NewDelete checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178244 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-27[analyzer] Ensure that the node NilReceiverBRVisitor is looking for is not ↵Anna Zaks
reclaimed The visitor should look for the PreStmt node as the receiver is nil in the PreStmt and this is the node. Also, tag the nil receiver nodes with a special tag for consistency. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178152 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-04-28 16:50:31 +0000