aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core/RegionStore.cpp
AgeCommit message (Collapse)Author
2012-05-10Include line that was meant to be in my last commit.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156582 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Fix insidious RegionStore bug where we (a) didn't handle vector types and ↵Ted Kremenek
(b) had a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more layers of lazy bindings. I don't have a reduced test case yet; but I have added the original source to an internal regression test suite. I'll see about coming up with a reduced test case. Fixes <rdar://problem/11405978> (for real). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Simplify r156446, as per Ted's review.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156482 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] We currently do not fully support CompoundLiterals inAnna Zaks
RegionStore, so be explicit about it and generate UnknownVal(). This is a hack to ensure we never produce undefined values for a value coming from a compound value. (The undefined values can lead to false positives.) radar://10127782 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Having RegionStore lower field bindings to raw offsets, just like ↵Ted Kremenek
ElementRegions. This is a bit disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values as structs. Fixes <rdar://problem/11405978>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08When creating lazy bindings in RegionStore, propagate existing lazy bindings ↵Ted Kremenek
instead of creating new ones. This is a functionality optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Include address of Store in graphviz output of ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-30Remove the ref/value inconsistency in filter_decl_iterator.David Blaikie
filter_decl_iterator had a weird mismatch where both op* and op-> returned T* making it difficult to generalize this filtering behavior into a reusable library of any kind. This change errs on the side of value, making op-> return T* and op* return T&. (reviewed by Richard Smith) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155808 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26[analyzer] check lazy bindings in RegionStore first before looking for ↵Ted Kremenek
default values. Fixes <rdar://problem/11269741>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155615 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] dynamic_cast: Better model cast from a reference.Anna Zaks
Generate a sink when the dynamic_cast from a reference fails to represent a thrown exception. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Add support for C++ dynamic_cast.Anna Zaks
Simulate the C++ dynamic_cast in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154434 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03Fix another false positive in RegionStore involving doing loads from ↵Ted Kremenek
symbolic offsets. We still don't properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings either. Fixes <rdar://problem/11127008>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153913 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-17Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek
for functions called more than once. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150849 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-05Basic: import OwningPtr<> into clang namespaceDylan Noblesmith
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149798 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-26Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.Ted Kremenek
At this point this is largely cosmetic, but it opens the door to replace ProgramStateRef with a smart pointer that more eagerly acts in the role of reclaiming unused ProgramState objects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-16Refactor variables unused under non-assert builds.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148229 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] RegionStoreManager::getBinding() should not crash whenAnna Zaks
looking up value at a CodeTextRegion even when the type is not provided. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148079 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] fix inlining's handling of mapping actual to formal arguments and ↵Ted Kremenek
limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148036 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-06[analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek
entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks
for finding dependent symbols for taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145986 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Propagate taint through NonLoc to NonLoc casts.Anna Zaks
- Created a new SymExpr type - SymbolCast. - SymbolCast is created when we don't know how to simplify a NonLoc to NonLoc casts. - A bit of code refactoring: introduced dispatchCast to have better code reuse, remove a goto. - Updated the test case to showcase the new taint flow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145985 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-29Relax RegionStore to allow loads from CodeTextRegions. Apparently you can ↵Ted Kremenek
actually write code that does this. This seems worthy of a checker, but the StoreManager should handle the memory abstraction without crashing. Fixes PR 11450. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145424 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16Fixed crash with initializer lists and unnamed bitfields in the RegionStoreJim Goodnow II
Manager. Added test to ensure proper binding of initialized values. This patch fixes PR11249. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144831 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-14[analyzer;Regionstore] handle loads from StringLiteral elements for ↵Ted Kremenek
StringLiterals representing wide strings. Fixes PR 11294. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144563 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-07Rename TagDecl::isDefinition -> isCompleteDefinitionJohn McCall
for better self-documenting code, since the semantics are subtly different from getDefinition(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141355 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-23Removing a bunch of dead returns/breaks after llvm_unreachables.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140407 91177308-0d34-0410-b5e6-96231b3b80d8
2011-09-23Switch assert(0/false) llvm_unreachable.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140367 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-27[analyzer] Change the check::RegionChanges callback to include the regions ↵Jordy Rose
explicitly requested for invalidation. Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well. Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138716 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-15Rename GRState to ProgramState, and cleanup some code formatting along the way.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137665 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek
and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-12[analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can ↵Ted Kremenek
separate TypedRegions that implement getValueType() from those that don't. Patch by Olaf Krzikalla! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137498 91177308-0d34-0410-b5e6-96231b3b80d8
2011-08-06[analyzer] Change SymbolReaper to store region roots implied by the ↵Ted Kremenek
Environment, allowing it be queried when determining if symbols derived from regions are still live. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137005 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-28[analyzer] Add StoreManager::includedInBindings() to to query whether a ↵Ted Kremenek
region is used in any bindings. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136416 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-28[analyzer] Add safety checking in RegionStoreManager for string literal ↵Ted Kremenek
underruns. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136415 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-23remove unneeded llvm:: namespace qualifiers on some core types now that ↵Chris Lattner
LLVM.h imports them into the clang namespace. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135852 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-27[analyzer] Use UnknownVal when default-initializing arrays whose element ↵Jordy Rose
types we don't model, to distinguish them from uninitialized arrays (PR10163). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133937 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-19Teach RegionStore not to symbolic array values whose indices it cannot ↵Ted Kremenek
reason about. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@131702 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-02Augment retain/release checker to not warn about tracked objects passed as ↵Ted Kremenek
arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130711 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-12RegionStoreManager::invalidateRegions: treat classes the same as structs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129333 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-03Fix RegionStore bug when doing a field load whose parent is also a field ↵Ted Kremenek
assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128783 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-17Tweak RegionStore's handling of lazy compound values to use the 'Default' ↵Ted Kremenek
versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without invalidating the entire binding. Fixes PR 9455. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127796 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-08static analyzer: Fix use-after-free bug in RegionStore involving ↵Ted Kremenek
LazyCompoundValueData not reference counting Store objects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127288 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-19Add 'StoreRef' smart pointer to allow more fine-grain memory lifetime ↵Ted Kremenek
control of Store objects. This yields a minor memory reduction (for larger functions) on Sqlite at the cost of slightly higher memory usage on some functions because of the increased size of GRState (which can be optimized). I expect the real memory savings from this enhancement will come when we aggressively canabilize more of the ExplodedGraph. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126012 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-16Makes most methods in SVals.h conform to the naming guide. ReviewedZhanyong Wan
by kremenek. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125687 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-11Remove RegionStoreManager::evalBinOp(), which is now handled by the SValBuilder.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125396 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-11Rename 'InvalidateRegions()' to 'invalidateRegions()'.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125395 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-10Split 'include/clang/StaticAnalyzer' into ↵Ted Kremenek
'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'. This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125251 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-07 00:14:14 +0000