aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core/CoreEngine.cpp
AgeCommit message (Collapse)Author
2012-04-20[analyzer] Run remove dead bindings right before leaving a function.Anna Zaks
This is needed to ensure that we always report issues in the correct function. For example, leaks are identified when we call remove dead bindings. In order to make sure we report a callee's leak in the callee, we have to run the operation in the callee's context. This change required quite a bit of infrastructure work since: - We used to only run remove dead bindings before a given statement; here we need to run it after the last statement in the function. For this, we added additional Program Point and special mode in the SymbolReaper to remove all symbols in context lower than the current one. - The call exit operation turned into a sequence of nodes, which are now guarded by CallExitBegin and CallExitEnd nodes for clarity and convenience. (Sorry for the long diff.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-13Remove the unused, unmaintained, incomplete 'Index' library.Douglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154672 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03[analyzer] Record the basic blocks covered by the analyzes run.Anna Zaks
Store this info inside the function summary generated for all analyzed functions. This is useful for coverage stats and can be helpful for analyzer state space search strategies. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153923 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyser] Stats checker: do not mark a node as exhausted if we willAnna Zaks
retry without inlining. (+ other minor cleanups) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Add an option to re-analyze a dead-end path without inlining.Anna Zaks
The analyzer gives up path exploration under certain conditions. For example, when the same basic block has been visited more than 4 times. With inlining turned on, this could lead to decrease in code coverage. Specifically, if we give up inside the inlined function, the rest of parent's basic blocks will not get analyzed. This commit introduces an option to enable re-run along the failed path, in which we do not inline the last inlined call site. This is done by enqueueing the node before the processing of the inlined call site with a special policy encoded in the state. The policy tells us not to inline the call site along the path. This lead to ~10% increase in the number of paths analyzed. Even though we expected a much greater coverage improvement. The option is turned off by default for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add the stat for the number of successfully explored paths.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153281 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Add a statistic for the number of times we reach the maxAnna Zaks
number of steps in the work list. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152960 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-10[analyzer] fix regression in analyzer of NOT actually aborting on Stmts it ↵Ted Kremenek
doesn't understand. We registered as aborted, but didn't treat such cases as sinks in the ExplodedGraph. Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly). Fixes: <rdar://problem/10892489> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152468 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Add support for NoRedundancy inlining mode.Anna Zaks
We do not reanalyze a function, which has already been analyzed as an inlined callee. As per PRELIMINARY testing, this gives over 50% run time reduction on some benchmarks without decreasing of the number of bugs found. Turning the mode on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152440 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Revert "Move ExplodedNode reclaimation out of ExprEngine and into ↵Ted Kremenek
CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150722 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also ↵Ted Kremenek
have it based on adding predecessors/successors, not node allocation. No measurable performance change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150720 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Minor cleanup to node data structures in ExplodedGraph. No functionality ↵Ted Kremenek
change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150719 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-26Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.Ted Kremenek
At this point this is largely cosmetic, but it opens the door to replace ProgramStateRef with a smart pointer that more eagerly acts in the role of reclaiming unused ProgramState objects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallEnterNodeBuilder and simplify ↵Ted Kremenek
ExprEngine::processCallEnter(). This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147705 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallExitNodeBuilder, and have ↵Ted Kremenek
ExprEngine::processCallExit() do the work manually. This is a nice simplification. Along the way, fix Exprengine::processCallExit() to also perform the postStmt callback for checkers for CallExprs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147697 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Unweaken vtables as per ↵David Blaikie
http://llvm.org/docs/CodingStandards.html#ll_virtual_anch git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146959 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Make sink attribute part of the node profile.Anna Zaks
This prevents caching out on nodes with different sink flag. (This is a cleaner fix for radar://10376675). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143517 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Fix PR11282 - an assert in markAsSinkAnna Zaks
This is another fallout from the refactoring. We were calling MarkAsSink on a cached out node. (Fixes radar://10376675) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143516 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] BranchNodeBuilder should not generate autotransitions.Anna Zaks
This fixes radar://10367606 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143514 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Move enqueueEndOfFunction into CoreEngine.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143090 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Make CoreEngine responsible for enqueueing Stmt Nodes.Anna Zaks
Enqueue the nodes generated as the result of processing a statement inside the Core Engine. This makes sure ExpEngine does not access CoreEngine's private members and is more concise. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143089 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-26[analyzer] GenericNodeBuilder -> NodeBuilder.Anna Zaks
Remove GenericNodeBuilder and use a class inherited from NodeBuilder instead. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143057 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-25[analyze] Convert EndOfPath callback to use CheckerContextAnna Zaks
Get rid of the EndOfPathBuilder completely. Use the generic NodeBuilder to generate nodes. Enqueue the end of path frontier explicitly. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142943 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24[analyzer] Node builders cleanup + commentsAnna Zaks
Renamed PureNodeBuilder->StmtNodeBuilder. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142849 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24[analyzer] Remove the old StmtNodeBuilder.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142848 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24[analyzer] Convert ExprEngine::visit() to use short lived builders.Anna Zaks
This commit removes the major functional dependency on the ExprEngine::Builder member variable. In some cases the code became more verbose. Particularly, we call takeNodes() and addNodes() to move responsibility for the nodes from one builder to another. This will get simplified later on. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142831 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24[analyzer] Use a temporary builder in CheckerContext.Anna Zaks
First step toward removing the global Stmt builder. Added several transitional methods (like takeNodes/addNodes). + Stop early if the set of exploded nodes for the next iteration is empty. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142827 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24[analyzer] Pass external Dst set to NodeBuilderAnna Zaks
This moves the responsibility for storing the output node set from the builder to the clients. The builder is just responsible for transforming an input set into the output set: {SrcSet/SrcNode} -> {Frontier}. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142826 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-24Rename AnalysisContext to AnalysisDeclContext. Not only is this name more ↵Ted Kremenek
accurate, but it frees up the name AnalysisContext for other uses. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142782 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-23[analyzer] Remove LocationContext creation methods from AnalysisManager, and ↵Ted Kremenek
change clients to use AnalysisContext instead. WIP to remove/reduce ExprEngine's usage of AnalysisManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142739 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Move predecessor into the NodeBuilder context.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142454 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Make NodeBuilder and Pred node loosely coupledAnna Zaks
NodeBuilder should not assume it's dealing with a single predecessor. Remove predecessor getters. Modify the BranchNodeBuilder to not be responsible for doing auto-transitions (which depend on a predecessor). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142453 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Remove StmtNodeBuilder from CheckerContextAnna Zaks
It now only depends on a generic NodeBuilder instead. As part of this change, make the generic node builder results finalized by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142452 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Subclassing StmtBuilder from the NodeBuilderAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142451 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Modularize builder use in processBranch.Anna Zaks
Take advantage of the new builders for branch processing. As part of this change pass generic NodeBuilder (instead of BranchNodeBuilder) to the BranchCondition callback and remove the unused methods form BranchBuilder. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142448 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Pull Pred out of NodeBuilderContext.Anna Zaks
Each builder will have a different one, so it doesn't make sense to keep it in the context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142447 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] NodeBuilder Refactoring: Subclass BranchNodeBuilder from NodeBuilder.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142444 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-18[analyzer] Node Builder refactoring: Introduce a simple Node Builder ↵Anna Zaks
responsible for generating the node frontier. Currently we have a bunch of different node builders which provide some common functionality but are difficult to refactor. Each builder generates nodes of different kinds and calculates the frontier nodes, which should be propagated to the next step (after the builder dies). Introduce a new NodeBuilder which provides very basic node generation facilities but takes care of the second problem. The idea is that all the other builders will eventually use it. Use this builder in CheckerContext instead of StmtNodeBuilder (the way the frontier is propagated to the StmtBuilder is a hack and will be removed later on). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142443 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-11[analyzer] Remove an unused member variable.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141690 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-10[analyzer] Teach the static analyzer about CXXForRangeStmt. Patch by Jim ↵Ted Kremenek
Goodnow II! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141587 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-07ProgramPoint cleanup after the previous commit r141408 (remove the copy ↵Anna Zaks
constructor, mark withTag const). Move getProgramPoint() utility from CoreEngine.cpp into ProgramPoint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141414 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-30Fix crash when analyzing C++ code involving constant enums and switch ↵Ted Kremenek
statements (<rdar://problem/10202899>). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140844 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-30[analyzer] Add -analyzer-purge option which can take on multiple values, ↵Anna Zaks
remove -analyzer-purge=none. (Small refactor as well: move the work of constructing AnalysisManager from the callers to the class itself.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140838 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-26Rename PathDiagnosticClient to PathDiagnosticConsumer as per issue 5397David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140492 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-23Removing a bunch of dead returns/breaks after llvm_unreachables.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140407 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-23Switch assert(0/false) llvm_unreachable.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140367 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-02[analyzer] Remove lingering CFRefCount creation, which would have resulted ↵Jordy Rose
in a leak. There's room for improvement here... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139000 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-15Rename GRState to ProgramState, and cleanup some code formatting along the way.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137665 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek
and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12[analyzer] change "tag" in ProgramPoint from "void*" to a ProgramPointTag*.Ted Kremenek
Having a notion of an actual ProgramPointTag will aid in introspection of the analyzer's behavior. For example, the GraphViz output of the analyzer will pretty-print the tags in a useful manner. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137529 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-06 20:40:42 +0000