aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core/ExprEngineC.cpp
AgeCommit message (Collapse)Author
2013-04-15[analyzer] Do not crash when processing binary "?:" in C++Anna Zaks
When computing the value of ?: expression, we rely on the last expression in the previous basic block to be the resulting value of the expression. This is not the case for binary "?:" operator (GNU extension) in C++. As the last basic block has the expression for the condition subexpression, which is an R-value, whereas the true subexpression is the L-value. Note the operator evaluation just happens to work in C since the true subexpression is an R-value (like the condition subexpression). CFG is the same in C and C++ case, but the AST nodes are different, which the LValue to Rvalue conversion happening after the BinaryConditionalOperator evaluation. Changed the logic to only use the last expression from the predecessor only if it matches either true or false subexpression. Note, the logic needed fortification anyway: L and R were passed but not even used by the function. Also, change the conjureSymbolVal to correctly compute the type, when the expression is an LG-value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179574 91177308-0d34-0410-b5e6-96231b3b80d8
2013-04-09[analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().Jordan Rose
Previously, the analyzer used isIntegerType() everywhere, which uses the C definition of "integer". The C++ predicate with the same behavior is isIntegerOrUnscopedEnumerationType(). However, the analyzer is /really/ using this to ask if it's some sort of "integrally representable" type, i.e. it should include C++11 scoped enumerations as well. hasIntegerRepresentation() sounds like the right predicate, but that includes vectors, which the analyzer represents by its elements. This commit audits all uses of isIntegerType() and replaces them with the general isIntegerOrEnumerationType(), except in some specific cases where it makes sense to exclude scoped enumerations, or any enumerations. These cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>() plus BuiltinType::isInteger(). isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and include/clang/StaticAnalysis. :-) Fixes real assertion failures. PR15703 / <rdar://problem/12350701> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179081 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-29Add static analyzer support for conditionally executing static initializers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178318 91177308-0d34-0410-b5e6-96231b3b80d8
2013-03-05Silence a number of static analyzer warnings with assertions and such.Jordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176469 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-23Remove the CFGElement "Invalid" state.David Blaikie
Use Optional<CFG*> where invalid states were needed previously. In the one case where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy CFGAutomaticObjDtor. Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek and Doug Gregor. Post commit code review feedback on r175796 by Ted Kremenek. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175938 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-22Fix regression in modeling assignments of an address of a variable to ↵Ted Kremenek
itself. Fixes <rdar://problem/13226577>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175852 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-21Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie
See r175462 for another example/more details. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175812 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-21Replace CFGElement llvm::cast support to be well-defined.David Blaikie
See r175462 for another example/more details. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175796 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-20Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie
Post-commit CR feedback from Jordan Rose regarding r175594. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175679 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-20Replace SVal llvm::cast support to be well-defined.David Blaikie
See r175462 for another example/more details. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175594 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-07[analyzer] Remove redundant check as per Jordan's feedback.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174680 91177308-0d34-0410-b5e6-96231b3b80d8
2013-02-07[analyzer] Don't reinitialize static globals more than once along a pathAnna Zaks
This patch makes sure that we do not reinitialize static globals when the function is called more than once along a path. The motivation is code with initialization patterns that rely on 2 static variables, where one of them has an initializer while the other does not. Currently, we reset the static variables with initializers on every visit to the function along a path. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174676 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-20Implement OpenCL event_t as Clang builtin type, including event_t related ↵Guy Benyei
OpenCL restrictions (OpenCL 1.2 spec 6.9) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172973 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Refine analyzer's handling of unary '!' and floating types to not assert.Ted Kremenek
Fixes PR 14634 and <rdar://problem/12903080>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172274 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Correctly propagate uninitialized values within logical expressions.Ted Kremenek
Fixes assertion failure reported in PR 14635 and <rdar://problem/12902945> respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172263 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-01Don't include Type.h in DeclarationName.h.Benjamin Kramer
Recursively prune some includes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169094 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-28Fix another false positive due to a CXX temporary object appearing in a C ↵Ted Kremenek
initializer. The stop-gap here is to just drop such objects when processing the InitListExpr. We still need a better solution. Fixes <rdar://problem/12755044>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168757 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-05[analyzer] Fix a crash PR13762.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163262 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-01[analyzer] Don't attempt to create a floating-point value of "1" for ++/--.Jordan Rose
The current logic would actually create a float- or double-sized signed integer value of 1, which is not at all the same. No test because the value would be swallowed by an Unknown as soon as it gets added or subtracted to the original value, but it enables the cleanup in the next patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163068 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-31Change the representation of builtin functions in the ASTEli Friedman
(__builtin_* etc.) so that it isn't possible to take their address. Specifically, introduce a new type to represent a reference to a builtin function, and a new cast kind to convert it to a function pointer in the operand of a call. Fixes PR13195. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162962 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-27[analyzer] Inline constructors for any object with a trivial destructor.Jordan Rose
This allows us to better reason about status objects, like Clang's own llvm::Optional (when its contents are trivially destructible), which are often intended to be passed around by value. We still don't inline constructors for temporaries in the general case. <rdar://problem/11986434> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162681 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-23[analyzer] For now, treat pointers-to-members as non-null void * symbols.Jordan Rose
Until we have full support for pointers-to-members, we can at least approximate some of their use by tracking null and non-null values. We thus treat &A::m_ptr as a non-null void * symbol, and MemberPointer(0) as a pointer-sized null constant. This enables support for what is sometimes called the "safe bool" idiom, demonstrated in the test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162495 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-23[analyzer] Handle UserDefinedConversion casts in C++.Jordan Rose
This is trivial; the UserDefinedConversion always wraps a CXXMemberCallExpr for the appropriate conversion function, so it's just a matter of propagating that value to the CastExpr itself. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162494 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.Ted Kremenek
Also rename 'getCurrentBlockCounter()' to 'blockCount()'. This ripples a bunch of code simplifications; mostly aesthetic, but makes the code a bit tighter. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162349 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'getConjuredSymbol*' to 'conjureSymbol*'.Ted Kremenek
No need to have the "get", the word "conjure" is a verb too! Getting a conjured symbol is the same as conjuring one up. This shortening is largely cosmetic, but just this simple changed cleaned up a handful of lines, making them less verbose. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162348 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Remove Store::bindDecl() and Store::bindDeclWithNoInit(), andTed Kremenek
all forwarding methods. This functionality is already covered by bindLoc(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-20[analyzer] Replace boolean IsSink parameters with 'generateSink' methods.Jordan Rose
Generating a sink is significantly different behavior from generating a normal node, and a simple boolean parameter can be rather opaque. Per offline discussion with Anna, adding new generation methods is the clearest way to communicate intent. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162215 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-20[analyzer] The result of && or || is always a 1 or 0.Jordan Rose
Forgetting to at least cast the result was giving us Loc/NonLoc problems in SValBuilder (hitting an assertion). But the standard (both C and C++) does actually guarantee that && and || will result in the actual values 1 and 0, typed as 'int' in C and 'bool' in C++, and we can easily model that. PR13461 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162209 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-09[analyzer] A CXXBaseObjectRegion should correspond to a DIRECT base.Jordan Rose
An ASTContext's RecordLayoutInfo can only be used to look up offsets of direct base classes, and we need the offset to make non-symbolic bindings in RegionStore. This change makes sure that we have one layer of CXXBaseObjectRegion for each base we are casting through. This was causing crashes on an internal buildbot. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161621 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-06[analyzer] Add a checker to manage dynamic type propagation.Anna Zaks
Instead of sprinkling dynamic type info propagation throughout ExprEngine, the added checker would add the more precise type information on known APIs (Ex: ObjC alloc, new) and propagate the type info in other cases (ex: ObjC init method, casts (the second is not implemented yet)). Add handling of ObjC alloc, new and init to the checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161357 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-03[analyzer] ObjC Inlining: Start tracking dynamic type info in the GDMAnna Zaks
In the following code, find the type of the symbolic receiver by following it and updating the dynamic type info in the state when we cast the symbol from id to MyClass *. MyClass *a = [[self alloc] init]; return 5/[a testSelf]; git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161264 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-26Look at the preceding CFGBlock for the expression to load from in ↵Ted Kremenek
ExprEngine::VisitGuardedExpr instead of walking to the preceding PostStmt node. There are cases where the last evaluated expression does not appear in the ExplodedGraph. Fixes PR 13466. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160819 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-26[analyzer] Don't crash on array constructors and destructors.Jordan Rose
This workaround is fairly lame: we simulate the first element's constructor and destructor and rely on the region invalidation to "initialize" the rest of the elements. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160809 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-25Update ExprEngine's handling of ternary operators to find the ternary expressionTed Kremenek
value by scanning the path, rather than assuming we have visited the '?:' operator as a terminator (which sets a value indicating which expression to grab the final ternary expression value from). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160760 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-16[analyzer] Handle new-expressions with initializers for scalars.Jordan Rose
<rdar://problem/11818967> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160328 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-16Prevent unused-variable warning in optimized builds.Daniel Jasper
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160257 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-14Refine CFG so that '&&' and '||' don't lead to extra confluence points when ↵Ted Kremenek
used in a branch, but instead push the terminator for the branch down into the basic blocks of the subexpressions of '&&' and '||' respectively. This eliminates some artifical control-flow from the CFG and results in a more compact CFG. Note that this patch only alters the branches 'while', 'if' and 'for'. This was complex enough for one patch. The remaining branches (e.g., do...while) can be handled in a separate patch, but they weren't immediately tackled because they were less important. It is possible that this patch introduces some subtle bugs, particularly w.r.t. to destructor placement. I've tried to audit these changes, but it is also known that the destructor logic needs some refinement in the area of '||' and '&&' regardless (i.e., their are known bugs). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160218 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-10[analyzer] Construct stack variables directly in their VarDecl.Jordan Rose
Also contains a number of tweaks to inlining that are necessary for constructors and destructors. (I have this enabled on a private branch, but it is very much unstable.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160023 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-18[analyzer] Add a comment: why we treat array compound literals as lvalues.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158681 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-16[analyzer] Array CompoundLiteralExprs need to be treated like lvalues.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158588 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-12Revert "[analyzer] Treat LValueBitCasts like regular pointer bit casts."Jordan Rose
This does not actually give us the right behavior for reinterpret_cast of references. Reverting so I can think about it some more. This reverts commit 50a75a6e26a49011150067adac556ef978639fe6. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158341 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-11[analyzer] Treat LValueBitCasts like regular pointer bit casts.Jordan Rose
These casts only appear in very well-defined circumstances, in which the target of a reinterpret_cast or a function formal parameter is an lvalue reference. According to the C++ standard, the following are equivalent: reinterpret_cast<T&>( x) *reinterpret_cast<T*>(&x) [expr.reinterpret.cast]p11 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158338 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-25[analyzer] Don't crash on LValBitCastAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157478 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-21[analyzer] Bind UnknownVal to InitListExpr for unsupported typesAnna Zaks
(ex: float). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-19[analyzer] For locations, use isGLValue() instead of isLValue().Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157088 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Conjure a symbol to ensure we can identify pointer arithmeticAnna Zaks
We need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156052 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-11[analyzer] dynamic_cast Simplify null value generation.Anna Zaks
As per Jordy's review. Creating a symbol here is more flexible; however I could not come up with an example where it was needed. (What constrains can be added on of the symbol constrained to 0?) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154542 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] dynamic_cast: Better model cast from a reference.Anna Zaks
Generate a sink when the dynamic_cast from a reference fails to represent a thrown exception. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Add support for C++ dynamic_cast.Anna Zaks
Simulate the C++ dynamic_cast in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154434 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-05 03:56:48 +0000