aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2011-04-08Start overhauling static analyzer support for C++ constructors. The ↵Ted Kremenek
inlining support isn't complete, and needs to be reworked to model CallEnter/CallExit (just like all other calls). For now, treat constructors mostly like other function calls, making the analysis of C++ code just a little more useful. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129166 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-07Basic, untested implementation for an "unknown any" type requested by LLDB.John McCall
The idea is that you can create a VarDecl with an unknown type, or a FunctionDecl with an unknown return type, and it will still be valid to access that object as long as you explicitly cast it at every use. I'm still going back and forth about how I want to test this effectively, but I wanted to go ahead and provide a skeletal implementation for the LLDB folks' benefit and because it also improves some diagnostic goodness for placeholder expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129065 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-06When updating the retain summary based on {cf,ns}_consumed attributes,John McCall
be sure to consume the argument index that actually had the attribute rather than always the first. rdar://problem/9234108 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128998 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-04Fix PR 9626 (duplicated self-init warnings under -Wuninitialized) with ↵Ted Kremenek
numerous CFG and UninitializedValues analysis changes: 1) Change the CFG to include the DeclStmt for conditional variables, instead of using the condition itself as a faux DeclStmt. 2) Update ExprEngine (the static analyzer) to understand (1), so not to regress. 3) Update UninitializedValues.cpp to initialize all tracked variables to Uninitialized at the start of the function/method. 4) Only use the SelfReferenceChecker (SemaDecl.cpp) on global variables, leaving the dataflow analysis to handle other cases. The combination of (1) and (3) allows the dataflow-based -Wuninitialized to find self-init problems when the initializer contained control-flow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128858 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-03static analyzer: Add a new ProgramPoint PostCondition to represent the post ↵Ted Kremenek
position of a branch condition, and a new generateNode method to BranchNodeBuilder using PostCondition ProgramPoint. This method generates a new ExplodedNode but not a new block edge. Patch by Lei Zhang! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128784 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-03Fix RegionStore bug when doing a field load whose parent is also a field ↵Ted Kremenek
assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128783 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-02Teach IdempotentOperationsChecker about paths aborted because ExprEngine ↵Ted Kremenek
didn't know how to handle a specific Expr type. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128761 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-02static analyzer: Rename 'BlocksAborted' to 'BlocksExhausted' to reflect that ↵Ted Kremenek
a given CFGBlock was analyzed too many times. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128760 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-31Static analyzer: fix bug in handling of dynamic_cast<>. The sink node ↵Ted Kremenek
wouldn't always be the final node, thus causing the state to continue propagating. Instead, recover some path-sensitivity by conjuring a symbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128612 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-31Teach static analyzer about the basics of handling new[]. We still don't ↵Ted Kremenek
simulate constructors, but at least the analyzer doesn't think the return value is uninitialized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128611 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-30Begin reworking static analyzer support for C++ method calls. The current ↵Ted Kremenek
logic was divorced from how we process ordinary function calls, had a tremendous about of redundancy, and relied strictly on inlining behavior (which was incomplete) to provide semantics instead of falling back to the conservative analysis we use for C functions. This is a significant step into making C++ analyzer support more useful. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128557 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-26Don't add a symbolic region for 'this' if the member function is static.Anders Carlsson
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128340 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-17Tweak RegionStore's handling of lazy compound values to use the 'Default' ↵Ted Kremenek
versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without invalidating the entire binding. Fixes PR 9455. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127796 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-14SortJoerg Sonnenberger
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127624 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-12Fix comments, and force auto progagation in VisitAggExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127524 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-12static analyzer: Handle 'ExprWithCleanups' in ExprEngine by essentially ↵Ted Kremenek
ignoring them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127523 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-11Add support for the OpenCL vec_step operator, by generalising andPeter Collingbourne
extending the existing support for sizeof and alignof. Original patch by Guy Benyei. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127475 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-08#include Store.h into BasicValueFactory.cpp to provide definitions of ↵Ted Kremenek
StoreRef constructor. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127291 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-08static analyzer: Fix use-after-free bug in RegionStore involving ↵Ted Kremenek
LazyCompoundValueData not reference counting Store objects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127288 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-02Move some of the logic about classifying Objective-C methods intoJohn McCall
conventional categories into Basic and AST. Update the self-init checker to use this logic; CFRefCountChecker is complicated enough that I didn't want to touch it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126817 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01Teach CFGBuilder to prune trivially unreachable case statements.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126797 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01In preparation for fixing PR 6884, rework CFGElement to have getAs<> return ↵Ted Kremenek
pointers instead of fresh CFGElements. - Also, consoldiate getDtorKind() and getKind() into one "kind". - Add empty getDestructorDecl() method to CFGImplicitDtor. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126738 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01[analyzer] Remove SVal::getAsVarDecl() and reason about MemRegions, not ↵Argyrios Kyrtzidis
Decls. Suggestion by Ted! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126734 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01[analyzer] Move lib/StaticAnalyzer/Checkers/ExprEngine.cpp -> ↵Argyrios Kyrtzidis
lib/StaticAnalyzer/Core and hope the wrath of the buildbots will not descend upon me. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126728 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01[analyzer] Rename CheckerV2 -> Checker.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126726 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01[analyzer] Remove Checker V1.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126725 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01[analyzer] Remove checker V1 registration and running from ExprEngine.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126724 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-01Improves the coding style in SValBuilder. This patch:Zhanyong Wan
- renames evalCastNL and evalCastL to evalCastFromNonLoc and evalCastFromLoc (avoid abbreviations that aren't well known). - makes all function parameter names start with a lower case letter for consistency and distinction from member variables. - avoids abbreviations in function parameter names. Reviewed by kremenek@apple.com. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126722 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] Run the ExprEngine depending on the CheckerManager having ↵Argyrios Kyrtzidis
path-sensitive checkers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126674 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] Introduce "event" mechanism in CheckerManager.Argyrios Kyrtzidis
A checker can register as receiver/listener of "events" (basically it registers a callback with a function getting called with an argument of the event type) and other checkers can register as "dispatchers" and can pass an event object to all the listeners. This allows cooperation amongst checkers but with very loose coupling. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126658 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] Introduce SVal::getAsVarDecl().Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126627 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] ExprEngine should not depend on checkers for not crashing.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126622 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] Migrate UndefBranchChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126616 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-28[analyzer] Migrate MallocChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126606 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-24[analyzer] Don't pass a GRState to CheckerManager::runCheckersForLocation, ↵Argyrios Kyrtzidis
terrible mistake. If the state is new, make sure an ExplodedNode is associated with it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126370 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-24Fix tiny error in CFG construction for BinaryConditionalOperators, making ↵Ted Kremenek
sure the branch always has two successors. Also teach Environment::getSVal() about OpaqueValueExprs. This fixes a crash reported in PR9287, and also fixes a false positive involving the value of such ternary expressions not properly getting propagated. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126362 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-24[analyzer] Remove unused functions from CheckerManager.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126352 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-24[analyzer] Migrate CStringChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126350 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Migrate StackAddrLeakChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126333 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Refactor EndOfFunctionNodeBuilder.Argyrios Kyrtzidis
-Introduce EndOfFunctionNodeBuilder::withCheckerTag to allow it be "specialized" with a checker tag and not require the checkers to pass a tag. -For EndOfFunctionNodeBuilder::generateNode, reverse the order of tag/P parameters since there are actual calls that assume the second parameter is ExplodedNode. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126332 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] const goodness.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126326 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Rename runPathSensitiveCheckers -> expandGraphWithCheckers.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126325 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Migrate ChrootChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126324 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Migrate UnreachableCodeChecker to CheckerV2.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126308 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Fix CheckerManager::runCheckersForObjCMessage.Argyrios Kyrtzidis
It would run PostObjCMessage checkers even for PreObjCMessage checking. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126274 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-23[analyzer] Refactor BugTypes and their ownership model.Argyrios Kyrtzidis
-In general, don't have the BugReporter deleting BugTypes, BugTypes will eventually become owned by checkers and outlive the BugReporter. In the meantime, there will be some leaks since some checkers assume that the BugTypes they create will be destroyed by the BugReporter. -Have BugReporter::EmitBasicReport create BugTypes that are reused if the same name & category strings are passed to EmitBasicReport. These BugTypes are owned and destroyed by the BugReporter. This allows bugs reported through EmitBasicReport to be coalesced. -Remove the llvm::FoldingSet<BugReportEquivClass> from BugType and move it into the BugReporter. For uniquing BugReportEquivClass also use the BugType* so that we can iterate over all of them using only one set. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126272 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-22[analyzer] Start moving the path-sensitive checkers to CheckerV2.Argyrios Kyrtzidis
-Migrate ObjCSelfInitChecker to CheckerV2. In the process remove the 'preCallSelfFlags' field from the checker class and use GRState for storing that info. -Get ExprEngine to start delegating checker running to CheckerManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126229 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-19[analyzer] Fix crash when analyzing C++ code.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126025 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-19Change 'StoreRef' back to 'Store' in GRState, shrinking the size of GRState ↵Ted Kremenek
back by one pointer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126020 91177308-0d34-0410-b5e6-96231b3b80d8
2011-02-19[analyzer] Fix crash when analyzing C++ code.Argyrios Kyrtzidis
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126013 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-13 01:55:37 +0000