aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2013-01-31[analyzer] Fix a bug in region store that lead to undefined value falseAnna Zaks
positives. The includeSuffix was only set on the first iteration through the function, resulting in invalid regions being produced by getLazyBinding (ex: zoomRegion.y). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174016 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Make shallow mode more shallow.Anna Zaks
Redefine the shallow mode to inline all functions for which we have a definite definition (ipa=inlining). However, only inline functions that are up to 4 basic blocks large and cut the max exploded nodes generated per top level function in half. This makes shallow faster and allows us to keep inlining small functions. For example, we would keep inlining wrapper functions and constructors/destructors. With the new shallow, it takes 104s to analyze sqlite3, whereas the deep mode is 658s and previous shallow is 209s. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173958 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Use analyzer config for max-inlinable-size option.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173957 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Move report false positive suppression to report visitors.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173956 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Remove further references to analyzer-ipa.Anna Zaks
Thanks Jordan! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173955 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Model trivial copy/move ctors with an aggregate bind.Jordan Rose
This is faster for the analyzer to process than inlining the constructor and performing a member-wise copy, and it also solves the problem of warning when a partially-initialized POD struct is copied. Before: CGPoint p; p.x = 0; CGPoint p2 = p; <-- assigned value is garbage or undefined After: CGPoint p; p.x = 0; CGPoint p2 = p; // no-warning This matches our behavior in C, where we don't see a field-by-field copy. <rdar://problem/12305288> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173951 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] C++ initializers may require cleanups; look through these.Jordan Rose
When the analyzer sees an initializer, it checks if the initializer contains a CXXConstructExpr. If so, it trusts that the CXXConstructExpr does the necessary work to initialize the object, and performs no further initialization. This patch looks through any implicit wrapping expressions like ExprWithCleanups to find the CXXConstructExpr inside. Fixes PR15070. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173557 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] bugreporter::getDerefExpr now takes a Stmt, not an ExplodedNode.Jordan Rose
This allows it to be used in places where the interesting statement doesn't match up with the current node. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173546 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] Add 'prune-paths' config option to disable path pruning.Jordan Rose
This should be used for testing only. Path pruning is still on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173545 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] Rename PruneNullReturnPaths to SuppressNullReturnPaths.Jordan Rose
"Prune" is the term for eliminating pieces of a path that are not relevant to the user. "Suppress" means don't show that path at all. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173544 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] Add "-analyzer-config mode=[deep|shallow] ".Anna Zaks
The idea is to introduce a higher level "user mode" option for different use scenarios. For example, if one wants to run the analyzer for a small project each time the code is built, they would use the "shallow" mode. The user mode option will influence the default settings for the lower-level analyzer options. For now, this just influences the ipa modes, but we plan to find more optimal settings for them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173386 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] Replace "-analyzer-ipa" with "-analyzer-config ipa".Anna Zaks
The idea is to eventually place all analyzer options under "analyzer-config". In addition, this lays the ground for introduction of a high-level analyzer mode option, which will influence the default setting for IPAMode. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173385 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] refactor: access IPAMode through the accessor.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173384 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-21[analyzer] Show notes inside implicit calls at the last explicit call site.Jordan Rose
Before: struct Wrapper { <-- 2. Calling default constructor for 'NonTrivial'. NonTrivial m; }; Wrapper w; <-- 1. Calling implicit default constructor for 'Wrapper'. After: struct Wrapper { NonTrivial m; }; Wrapper w; <-- 1. Calling implicit default constructor for 'Wrapper'. ^-- 2. Calling default constructor for 'NonTrivial'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173067 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-20Implement OpenCL event_t as Clang builtin type, including event_t related ↵Guy Benyei
OpenCL restrictions (OpenCL 1.2 spec 6.9) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172973 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-19[analyzer] Don't show "Entered 'foo'" if 'foo' is implicit.Jordan Rose
Before: Calling implicit default constructor for 'Foo' (where Foo is constructed) Entered call from 'test' (at "=default" or 'Foo' declaration) Calling default constructor for 'Bar' (at "=default" or 'Foo' declaration) After: Calling implicit default constructor for 'Foo' (where Foo is constructed) Calling default constructor for 'Bar' (at "=default" or 'Foo' declaration) This only affects the plist diagnostics; this note is never shown in the other diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172915 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-19[analyzer] Suppress warnings coming out of macros defined in sys/queue.hAnna Zaks
Suppress the warning by just not emitting the report. The sink node would get generated, which is fine since we did reach a bad state. Motivation Due to the way code is structured in some of these macros, we do not reason correctly about it and report false positives. Specifically, the following loop reports a use-after-free. Because of the way the code is structured inside of the macro, the analyzer assumes that the list can have cycles, so you end up with use-after-free in the loop, that is safely deleting elements of the list. (The user does not have a way to teach the analyzer about shape of data structures.) SLIST_FOREACH_SAFE(item, &ctx->example_list, example_le, tmpitem) { if (item->index == 3) { // if you remove each time, no complaints assert((&ctx->example_list)->slh_first == item); SLIST_REMOVE(&ctx->example_list, item, example_s, example_le); free(item); } } git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172883 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-18[analyzer] Special path notes for C++ special member functions.Jordan Rose
Examples: Calling implicit default constructor for Foo Calling defaulted move constructor for Foo Calling copy constructor for Foo Calling implicit destructor for Foo Calling defaulted move assignment operator for Foo Calling copy assignment operator for Foo git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172833 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-18[analyzer] Do a better job describing C++ member functions in the call stack.Jordan Rose
Examples: Calling constructor for 'Foo' Entered call from 'Foo::create' git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172832 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-15Fix CastDavid Greene
Properly use const_cast to fix a cast-away-const error. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172561 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-14[analyzer] Add ProgramStatePartialTrait<const void *>.Jordan Rose
This should fix cast-away-const warnings reported by David Greene. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172446 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-12Remove useless 'llvm::' qualifier from names like StringRef and others that areDmitri Gribenko
brought into 'clang' namespace by clang/Basic/LLVM.h git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172323 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Refine analyzer's handling of unary '!' and floating types to not assert.Ted Kremenek
Fixes PR 14634 and <rdar://problem/12903080>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172274 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Correctly propagate uninitialized values within logical expressions.Ted Kremenek
Fixes assertion failure reported in PR 14635 and <rdar://problem/12902945> respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172263 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-09Do not model loads from complex types, since we don't accurately model the ↵Ted Kremenek
imaginary and real parts yet. Fixes false positive reported in <rdar://problem/12964481>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171987 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Only include uniqueling location as issue_hash when availableAnna Zaks
This makes us more optimistic when matching reports in a changing code base. Addresses Jordan's feedback for r171825. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171884 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Include the bug uniqueing location in the issue_hash.Anna Zaks
The issue here is that if we have 2 leaks reported at the same line for which we cannot print the corresponding region info, they will get treated as the same by issue_hash+description. We need to AUGMENT the issue_hash with the allocation info to differentiate the two issues. Add the "hash" (offset from the beginning of a function) representing allocation site to solve the issue. We might want to generalize solution in the future when we decide to track more than just the 2 locations from the diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171825 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Plist: change the type of issue_hash from int to string.Anna Zaks
This gives more flexibility to what could be stored as issue_hash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171824 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-03[analyzer] Rename callback EndPath -> EndFunctionAnna Zaks
This better reflects when callback is called and what the checkers are relying on. (Both names meant the same pre-IPA.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171432 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-02Re-sort #include lines using the llvm/utils/sort_includes.py script.Chandler Carruth
Removes a duplicate #include as well as cleaning up some sort order regressions since I last ran the script over Clang. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171364 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-21Remove duplicate includes.Roman Divacky
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170903 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-21[analyzer] Address Jordan's nitpicks as per code review of r170625.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170832 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-20[analyzer] Add the pointer escaped callback.Anna Zaks
Instead of using several callbacks to identify the pointer escape event, checkers now can register for the checkPointerEscape. Converted the Malloc checker to use the new callback. SimpleStreamChecker will be converted next. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170625 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-19Pass AnalyzerOptions to PathDiagnosticConsumer to make analyzer options ↵Ted Kremenek
accessible there. This is plumbing needed for later functionality changes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170488 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-17[analyzer] Implement "do not inline large functions many times"Anna Zaks
performance heuristic After inlining a function with more than 13 basic blocks 32 times, we are not going to inline it anymore. The idea is that inlining large functions leads to drastic performance implications. Since the function has already been inlined, we know that we've analyzed it in many contexts. The following metrics are used: - Large function is a function with more than 13 basic blocks (we should switch to another metric, like cyclomatic complexity) - We consider that we've inlined a function many times if it's been inlined 32 times. This number is configurable with -analyzer-config max-times-inline-large=xx This heuristic addresses a performance regression introduced with inlining on one benchmark. The analyzer on this benchmark became 60 times slower with inlining turned on. The heuristic allows us to analyze it in 24% of the time. The performance improvements on the other benchmarks I've tested with are much lower - under 10%, which is expected. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-14fixed line endingsAnton Yartsev
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170238 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-14added post-statement callback to CXXNewExpr and pre-statement callback to ↵Anton Yartsev
CXXDeleteExpr git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170234 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-14[analyzer] Propagate the checker's state from checkBranchConditionAnna Zaks
Fixes a bug, where we were dropping the state modifications from the checkBranchCondition checker callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170232 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-14Refactor dump methods to make RegionBindingsRef printable in the debugger.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170170 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-12[analyzer] Don't crash running destructors for multidimensional arrays.Jordan Rose
We don't handle array destructors correctly yet, but we now apply the same hack (explicitly destroy the first element, implicitly invalidate the rest) for multidimensional arrays that we already use for linear arrays. <rdar://problem/12858542> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170000 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07[analyzer] Optimization heuristic: do not reanalyze every ObjC method asAnna Zaks
top level. This heuristic is already turned on for non-ObjC methods (inlining-mode=noredundancy). If a method has been previously analyzed, while being inlined inside of another method, do not reanalyze it as top level. This commit applies it to ObjCMethods as well. The main caveat here is that to catch the retain release errors, we are still going to reanalyze all the ObjC methods but without inlining turned on. Gives 21% performance increase on one heavy ObjC benchmark, which suffered large performance regressions due to ObjC inlining. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169639 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07[analyzer] Fix r168019 to work with unpruned paths as well.Jordan Rose
This is the case where the analyzer tries to print out source locations for code within a synthesized function body, which of course does not have a valid source location. The previous fix attempted to do this during diagnostic path pruning, but some diagnostics have pruning disabled, and so any diagnostic with a path that goes through a synthesized body will either hit an assertion or emit invalid output. <rdar://problem/12657843> (again) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169631 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Reduce conversions between Store <-> ImmutableMapRef in RegionStore.Ted Kremenek
This reduces canonicalization of ImmutableMaps. This reduces analysis time of one heavy Objective-C file by another 1%. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169630 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Add helper method to convert from a RegionStoreRefBindings to a Store.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169622 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Cache queries to lookupPrivateMethod() within ↵Ted Kremenek
ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169589 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Further reduce analysis time by 0.2% on a heavy Objective-C example by ↵Ted Kremenek
avoiding over-eager canonicalization of clusters. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169586 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Unbreak the GCC (4.4 & other bot) builds from r169571.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169581 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-07Change RegionStore to always use ImmutableMapRef for processing cluster ↵Ted Kremenek
bindings. This reduces analysis time by 1.2% on one test case (Objective-C), but also cleans up some of the code conceptually as well. We can possible just make RegionBindingsRef -> RegionBindings, but I wanted to stage things. After this, we should revisit Jordan's optimization of not canonicalizing the immutable AVL trees for the cluster bindings as well. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169571 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-06Revert "[analyzer] Aggressively cut back on the canonicalization in ↵Ted Kremenek
RegionStore." Jordan and I discussed this, and we are going to do this another way. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169538 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-06[analyzer] Remove isa<> followed by dyn_cast<>.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169530 91177308-0d34-0410-b5e6-96231b3b80d8