aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2011-12-15[analyzer] Address Jordy's comments for r145985.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146683 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-15[analyzer] Ensure that the order in which checker callbacks are calledAnna Zaks
is deterministic. Non-determinism was the reason for the test which caused the earlier buildbot failures, so re-enable the test. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146628 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Minor refactor to addTaint.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146535 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark getenv output as tainted.Anna Zaks
Also, allow adding taint to a region (not only a symbolic value). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146532 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-11[analyzer] CStringChecker should not rely on the analyzer generating ↵Anna Zaks
UndefOrUnknown value when it cannot reason about the expression. We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.) This patch also contains 2 small bug fixes: - swap the order of operators inside SValBuilder::makeGenericVal. - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146343 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-10[analyzer]Fixup r146336.Anna Zaks
Forgot to commit the Header files. Rename generateUnknownVal -> makeGenericVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146337 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-10[analyzer] Introduce IntSymExpr, where the integer is on the lhs.Anna Zaks
Fix a bug in SimpleSValBuilder, where we should swap lhs and rhs when calling generateUnknownVal(), - the function which creates symbolic expressions when data is tainted. The issue is not visible when we only create the expressions for taint since all expressions are commutative from taint perspective. Refactor SymExpr::symbol_iterator::expand() to use a switch instead of a chain of ifs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146336 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-09[analyzer] Fix inconsistency on when SValBuilder assumes that 2Anna Zaks
types are equivalent. + A taint test which tests bitwise operations and which was triggering an assertion due to presence of the integer to integer cast. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146240 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08[analyzer] If memory region is tainted mark data as tainted.Anna Zaks
+ random comments git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146199 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-07[analyzer] Cleanup: use the variable.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146056 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-07[analyzer] Propagate taint through MemRegions.Anna Zaks
SVal can be not only a symbol, but a MemRegion. Add support for such cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146006 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Add comments related to symbol_iteratorAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145987 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks
for finding dependent symbols for taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145986 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Propagate taint through NonLoc to NonLoc casts.Anna Zaks
- Created a new SymExpr type - SymbolCast. - SymbolCast is created when we don't know how to simplify a NonLoc to NonLoc casts. - A bit of code refactoring: introduced dispatchCast to have better code reuse, remove a goto. - Updated the test case to showcase the new taint flow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145985 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Mark ConstraintManager::canReasonAbout as protected.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145857 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Simplify the condition.Anna Zaks
This is a fixup for r145832. The extra clauses do not matter after we remove the dependency on canReasonAbout(InitVal) in r145832. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145856 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Unify SymbolVal and SymExprVal under a single SymbolValAnna Zaks
class. We are going into the direction of handling SymbolData and other SymExpr uniformly, so it makes less sense to keep two different SVal classes. For example, the checkers would have to take an extra step to reason about each type separately. The classes have the same members, we were just using the SVal kind field for easy differentiation in 3 switch statements. The switch statements look more ugly now, but we can make the code more readable in other ways, for example, moving some code into separate functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145833 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Remove all uses of ConstraintManager::canResonAbout() fromAnna Zaks
ExprEngine. Teach SimpleConstraintManager::assumeSymRel() to propagate constraints to symbolic expressions. + One extra warning (real bug) is now generated due to enhanced assumeSymRel(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145832 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] First step toward removingAnna Zaks
ConstraintManager::canReasonAbout() from the ExprEngine. ExprEngine should not care if the constraint solver can reason about something or not. The solver should be able to handle all the SymExprs. To do this, the solver should be able to keep track of not only the SymbolData but of all SymExprs. This is why we change SymbolRef to be an alias of SymExpr*. When encountering an expression it cannot simplify, the solver should just add the constraints to it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145831 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Minor improvements on RangeConstraint pretty-printing.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145830 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Add ability to do a simple ProgramState dump() withoutAnna Zaks
requiring CFG. Adding more ugly code; the evnvironment printing should be moved to envirnment at some point. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145828 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01[analyzer] Refactor checkers to use helper function for getting callee Decl ↵Anna Zaks
and name. We are getting name of the called function or it's declaration in a few checkers. Refactor them to use the helper function in the CheckerContext. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145576 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01When analyzing a C++ method (without a specific caller), assume 'this' is ↵Ted Kremenek
non-null. Fixes <rdar://problem/10508787>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145575 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-29Relax RegionStore to allow loads from CodeTextRegions. Apparently you can ↵Ted Kremenek
actually write code that does this. This seems worthy of a checker, but the StoreManager should handle the memory abstraction without crashing. Fixes PR 11450. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145424 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-28[analyzer] Minor cleanup of SValBuilder: Comments + code reuse.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145274 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-18[analyzer] Warn when non pointer arguments are passed to scanf (only when ↵Anna Zaks
running taint checker). There is an open radar to implement better scanf checking as a Sema warning. However, a bit of redundancy is fine in this case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144964 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Do not conjure a symbol when we need to propagate taint.Anna Zaks
When the solver and SValBuilder cannot reason about symbolic expressions (ex: (x+1)*y ), the analyzer conjures a new symbol with no ties to the past. This helps it to recover some path-sensitivity. However, this breaks the taint propagation. With this commit, we are going to construct the expression even if we cannot reason about it later on if an operand is tainted. Also added some comments and asserts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144932 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Minor tweaks to the ProgramState::isTainted().Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144928 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Add a helper method.Anna Zaks
Naming could be improved.. But we should first rename the classes in the SVal hierarchy. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144927 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analysis] Constify CheckerContext.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144871 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Put CheckerConext::getCalleeName out of line.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144870 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16Fixed crash with initializer lists and unnamed bitfields in the RegionStoreJim Goodnow II
Manager. Added test to ensure proper binding of initialized values. This patch fixes PR11249. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144831 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Adding basic building blocks for taint propagation.Anna Zaks
TaintTag.h will contain definitions of different taint kinds and their properties. TaintManager will be responsible for implementing taint specific operations, storing taint. ProgramState will provide API to add/remove taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144824 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Cleanup: Null->0, comments.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144823 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-14[analyzer;Regionstore] handle loads from StringLiteral elements for ↵Ted Kremenek
StringLiterals representing wide strings. Fixes PR 11294. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144563 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-11[static analyzer] be more specific when running removeDeadBindings. Instead ↵Ted Kremenek
of seeing if the predecessor node was a non-StmtPoint, check if it is specifically a BlockEntrance node. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144340 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-10[static analyzer]: only call RemoveDeadBindings() when analyzing non-Expr ↵Ted Kremenek
stmts, entering a basic block, or analyzing non-consumed expressions. This sigificantly speeds up analysis time, and reduces analysis time down to 27% less than before we linearized the CFG. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144332 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-07Rip out CK_GetObjCProperty.John McCall
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143910 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-06Change the AST representation of operations on Objective-CJohn McCall
property references to use a new PseudoObjectExpr expression which pairs a syntactic form of the expression with a set of semantic expressions implementing it. This should significantly reduce the complexity required elsewhere in the compiler to deal with these kinds of expressions (e.g. IR generation's special l-value kind, the static analyzer's Message abstraction), at the lower cost of specifically dealing with the odd AST structure of these expressions. It should also greatly simplify efforts to implement similar language features in the future, most notably Managed C++'s properties and indexed properties. Most of the effort here is in dealing with the various clients of the AST. I've gone ahead and simplified the ObjC rewriter's use of properties; other clients, like IR-gen and the static analyzer, have all the old complexity *and* all the new complexity, at least temporarily. Many thanks to Ted for writing and advising on the necessary changes to the static analyzer. I've xfailed a small diagnostics regression in the static analyzer at Ted's request. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143867 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-04Remove unused variables.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143696 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-02Fix various minor issues find via unreachable code warnings, fromDouglas Gregor
Ahmed Charles! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143569 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-02Remove virtually empty file.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143538 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Make sink attribute part of the node profile.Anna Zaks
This prevents caching out on nodes with different sink flag. (This is a cleaner fix for radar://10376675). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143517 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Fix PR11282 - an assert in markAsSinkAnna Zaks
This is another fallout from the refactoring. We were calling MarkAsSink on a cached out node. (Fixes radar://10376675) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143516 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Make sure the child builder use temporary destination setsAnna Zaks
The parent and child builders should not share node sets. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143515 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] BranchNodeBuilder should not generate autotransitions.Anna Zaks
This fixes radar://10367606 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143514 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Remove the CheckerContext's destructor.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143512 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-29Rename Expr::Evaluate to Expr::EvaluateAsRValue to make it clear that it willRichard Smith
implicitly perform an lvalue-to-rvalue conversion if used on an lvalue expression. Also improve the documentation of Expr::Evaluate* to indicate which of them will accept expressions with side-effects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143263 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Move enqueueEndOfFunction into CoreEngine.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143090 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Make CoreEngine responsible for enqueueing Stmt Nodes.Anna Zaks
Enqueue the nodes generated as the result of processing a statement inside the Core Engine. This makes sure ExpEngine does not access CoreEngine's private members and is more concise. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143089 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-16 21:53:06 +0000