aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core/RegionStore.cpp
AgeCommit message (Collapse)Author
2012-12-06[analyzer] Aggressively cut back on the canonicalization in RegionStore.Jordan Rose
Whenever we touch a single bindings cluster multiple times, we can delay canonicalizing it until the final access. This has some interesting implications, in particular that we shouldn't remove an /empty/ cluster from the top-level map until canonicalization. This is good for a 2% speedup or so on the test case in <rdar://problem/12810842> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169523 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-06Only provide explicit getCapturedRegion() and getOriginalRegion() from ↵Ted Kremenek
referenced_vars_iterator. This is a nice conceptual cleanup. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169480 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-01Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't ↵Benjamin Kramer
pull in all the generated Attr code. Required to pull some functions out of line, but this shouldn't have a perf impact. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169092 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-28Remove workaround in RegionStore in r168741 since it is handled more ↵Ted Kremenek
generally by r168757. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168774 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-27Provide stop-gap solution to crash reported in PR 14436.Ted Kremenek
This was also covered by <rdar://problem/12753384>. The static analyzer evaluates a CXXConstructExpr within an initializer expression and RegionStore doesn't know how to handle the resulting CXXTempObjectRegion that gets created. We need a better solution than just dropping the value, but we need to better understand how to implement the right semantics here. Thanks to Jordan for his help diagnosing the behavior here. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168741 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-10[analyzer] When invalidating symbolic offset regions, take fields into account.Jordan Rose
Previously, RegionStore was being VERY conservative in saying that because p[i].x and p[i].y have a concrete base region of 'p', they might overlap. Now, we check the chain of fields back up to the base object and check if they match. This only kicks in when dealing with symbolic offset regions because RegionStore's "base+offset" representation of concrete offset regions loses all information about fields. In cases where all offsets are concrete (s.x and s.y), RegionStore will already do the right thing, but mixing concrete and symbolic offsets can cause bindings to be invalidated that are known to not overlap (e.g. p[0].x and p[i].y). This additional refinement is tracked by <rdar://problem/12676180>. <rdar://problem/12530149> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167654 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-03[analyzer] Run remove dead on end of path.Anna Zaks
This will simplify checkers that need to register for leaks. Currently, they have to register for both: check dead and check end of path. I've modified the SymbolReaper to consider everything on the stack dead if the input StackLocationContext is 0. (This is a bit disruptive, so I'd like to flash out all the issues asap.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167352 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03[analyzer] Push evalDynamicCast and evalDerivedToBase up to Store.Jordan Rose
These functions are store-agnostic, and would benefit from information in DynamicTypeInfo but gain nothing from the store type. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03Teach getCXXRecordDeclForPointerType about references.Jordan Rose
Then, rename it getPointeeCXXRecordDecl and give it a nice doc comment, and actually use it. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165077 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-08[analyzer] Symbolic regions are live if any subregions are live.Jordan Rose
RegionStoreManager was only treating a SymbolicRegion's symbel as live if there was a binding referring to the region itself. No test case because constraints are currently not being cleaned out of the constraint manager at all (even if the symbol is legitimately dead). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163443 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-06Dont cast away const needlessly. Found by gcc48 -Wcast-qual.Roman Divacky
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163325 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-05[analyzer] Clean up a couple uses of getPointeeType().Jordan Rose
No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163219 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-05Revert "[analyzer] Treat all struct values as regions (even rvalues)."Jordan Rose
This turned out to have many implications, but what eventually seemed to make it unworkable was the fact that we can get struct values (as LazyCompoundVals) from other places besides return-by-value function calls; that is, we weren't actually able to "treat all struct values as regions" consistently across the entire analyzer core. Hopefully we'll be able to come up with an alternate solution soon. This reverts r163066 / 02df4f0aef142f00d4637cd851e54da2a123ca8e. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163218 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-01[analyzer] Treat all struct values as regions (even rvalues).Jordan Rose
This allows us to correctly symbolicate the fields of structs returned by value, as well as get the proper 'this' value for when methods are called on structs returned by value. This does require a moderately ugly hack in the StoreManager: if we assign a "struct value" to a struct region, that now appears as a Loc value being bound to a region of struct type. We handle this by simply "dereferencing" the struct value region, which should create a LazyCompoundVal. This should fix recent crashes analyzing LLVM and on our internal buildbot. <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163066 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Fix an assortment of doxygen comment issues found by -Wdocumentation.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162412 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'unbindLoc()' (in ProgramState) and 'Remove()' toTed Kremenek
'killBinding()'. The name is more specific, and one just forwarded to the other. Add some doxygen comments along the way. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162350 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'getConjuredSymbol*' to 'conjureSymbol*'.Ted Kremenek
No need to have the "get", the word "conjure" is a verb too! Getting a conjured symbol is the same as conjuring one up. This shortening is largely cosmetic, but just this simple changed cleaned up a handful of lines, making them less verbose. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162348 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Remove Store::bindDecl() and Store::bindDeclWithNoInit(), andTed Kremenek
all forwarding methods. This functionality is already covered by bindLoc(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Rename 'BindCompoundLiteral' to 'bindCompoundLiteral' andTed Kremenek
add doxygen comments. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162345 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-22Consilidate SmallPtrSet count() followed by insert() into a single insert().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162330 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-13[analyzer] Handle dynamic_casts that turn out to be upcasts.Jordan Rose
This can occur with multiple inheritance, which jumps from one parent to the other, and with virtual inheritance, since virtual base regions always wrap the actual object and can't be nested within other base regions. This also exposed some incorrect logic for multiple inheritance: even if B is known not to derive from C, D might still derive from both of them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161798 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-13[analyzer] Don't strip CXXBaseObjectRegions when checking dynamic_casts.Jordan Rose
...and /do/ strip CXXBaseObjectRegions when casting to a virtual base class. This allows us to enforce the invariant that a CXXBaseObjectRegion can always provide an offset for its base region if its base region has a known class type, by only allowing virtual bases and direct non-virtual bases to form CXXBaseObjectRegions. This does mean some slight problems for our modeling of dynamic_cast, which needs to be resolved by finding a path from the current region to the class we're trying to cast to. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161797 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-10Fix a couple of pedantic gcc warnings.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161656 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-09[analyzer] Merge RegionStore's KillStruct and CopyLazyBindings: BindAggregate.Jordan Rose
Both methods need to clear out existing bindings and provide a new default binding. Originally KillStruct always provided UnknownVal as the default, but it's allowed symbolic values for quite some time (for handling returned structs in C). No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161637 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-09[analyzer] Cluster bindings in RegionStore by base region.Jordan Rose
This should speed up activities that need to access bindings by cluster, such as invalidation and dead-bindings cleaning. In some cases all we save is the cost of building the region cluster map, but other times we can actually avoid traversing the rest of the store. In casual testing, this produced a speedup of nearly 10% analyzing SQLite, with /less/ memory used. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161636 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-09[analyzer] Cache the "concrete offset base" for regions with symbolic offsets.Jordan Rose
This makes it faster to access and invalidate bindings with symbolic offsets by only computing this information once. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161635 91177308-0d34-0410-b5e6-96231b3b80d8
2012-08-08[analyzer] Revamp RegionStore to distinguish regions with symbolic offsets.Jordan Rose
RegionStore currently uses a (Region, Offset) pair to describe the locations of memory bindings. However, this representation breaks down when we have regions like 'array[index]', where 'index' is unknown. We used to store this as (SubRegion, 0); now we mark them specially as (SubRegion, SYMBOLIC). Furthermore, ProgramState::scanReachableSymbols depended on the existence of a sub-region map, but RegionStore's implementation doesn't provide for such a thing. Moving the store-traversing logic of scanReachableSymbols into the StoreManager allows us to eliminate the notion of SubRegionMap altogether. This fixes some particularly awkward broken test cases, now in array-struct-region.c. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161510 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-26[analyzer] Rename Calls.{h,cpp} to CallEvent.{h,cpp}. No functionality change.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160815 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-18Fix crash in RegionStoreManager::evalDerivedToBase() due to not handling ↵Ted Kremenek
references (in uses of dynamic_cast<>). Fixes <rdar://problem/11817693>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-10[analyzer] Use CallEvent for building inlined stack frames.Jordan Rose
In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160022 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-06[analyzer] Be careful about LazyCompoundVals, which may be for the first field.Jordan Rose
We use LazyCompoundVals to avoid copying the contents of structs and arrays around in the store, and when we need to pass a struct around that already has a LazyCompoundVal we just use the original one. However, it's possible that the first field of a struct may have a LazyCompoundVal of its own, and we currently can't distinguish a LazyCompoundVal for the first element of a struct from a LazyCompoundVal for the entire struct. In this case we should just drop the optimization and make a new LazyCompoundVal that encompasses the old one. PR13264 / <rdar://problem/11802440> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159866 91177308-0d34-0410-b5e6-96231b3b80d8
2012-07-02[analyzer] Add a new abstraction over all types of calls: CallEventJordan Rose
This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159554 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-22Implement initial static analysis inlining support for C++ methods.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159047 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-16[analyzer] Return an UnknownVal when we try to get the binding for a VLA.Jordan Rose
This happens in C++ mode right at the declaration of a struct VLA; MallocChecker sees a bind and tries to get see if it's an escaping bind. It's likely that our handling of this is still incomplete, but it fixes a crash on valid without disturbing anything else for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158587 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-12Revert "[analyzer] Treat LValueBitCasts like regular pointer bit casts."Jordan Rose
This does not actually give us the right behavior for reinterpret_cast of references. Reverting so I can think about it some more. This reverts commit 50a75a6e26a49011150067adac556ef978639fe6. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158341 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-11[analyzer] Treat LValueBitCasts like regular pointer bit casts.Jordan Rose
These casts only appear in very well-defined circumstances, in which the target of a reinterpret_cast or a function formal parameter is an lvalue reference. According to the C++ standard, the following are equivalent: reinterpret_cast<T&>( x) *reinterpret_cast<T*>(&x) [expr.reinterpret.cast]p11 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158338 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-06Revert Decl's iterators back to pointer value_type rather than reference ↵David Blaikie
value_type In addition, I've made the pointer and reference typedef 'void' rather than T* just so they can't get misused. I would've omitted them entirely but std::distance likes them to be there even if it doesn't use them. This rolls back r155808 and r155869. Review by Doug Gregor incorporating feedback from Chandler Carruth. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158104 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01static analyzer: add inlining support for directly called blocks.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157833 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Include line that was meant to be in my last commit.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156582 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Fix insidious RegionStore bug where we (a) didn't handle vector types and ↵Ted Kremenek
(b) had a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more layers of lazy bindings. I don't have a reduced test case yet; but I have added the original source to an internal regression test suite. I'll see about coming up with a reduced test case. Fixes <rdar://problem/11405978> (for real). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Simplify r156446, as per Ted's review.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156482 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] We currently do not fully support CompoundLiterals inAnna Zaks
RegionStore, so be explicit about it and generate UnknownVal(). This is a hack to ensure we never produce undefined values for a value coming from a compound value. (The undefined values can lead to false positives.) radar://10127782 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Having RegionStore lower field bindings to raw offsets, just like ↵Ted Kremenek
ElementRegions. This is a bit disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values as structs. Fixes <rdar://problem/11405978>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08When creating lazy bindings in RegionStore, propagate existing lazy bindings ↵Ted Kremenek
instead of creating new ones. This is a functionality optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Include address of Store in graphviz output of ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-30Remove the ref/value inconsistency in filter_decl_iterator.David Blaikie
filter_decl_iterator had a weird mismatch where both op* and op-> returned T* making it difficult to generalize this filtering behavior into a reusable library of any kind. This change errs on the side of value, making op-> return T* and op* return T&. (reviewed by Richard Smith) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155808 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26[analyzer] check lazy bindings in RegionStore first before looking for ↵Ted Kremenek
default values. Fixes <rdar://problem/11269741>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155615 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] dynamic_cast: Better model cast from a reference.Anna Zaks
Generate a sink when the dynamic_cast from a reference fails to represent a thrown exception. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-05 13:57:36 +0000