aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2012-06-02[analyzer] Rely on canBeInlined utility instead of checking CallExprAnna Zaks
explicitly. This will make it easier to add inlining support to more expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157870 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01[analyzer] Fix a spurious undef value warning.Anna Zaks
When we timeout or exceed a max number of blocks within an inlined function, we retry with no inlining starting from a node right before the CallEnter node. We assume the state of that node is the state of the program before we start evaluating the call. However, the node pruning removes this node as unimportant. Teach the node pruning to keep the predecessors of the call enter nodes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157860 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01[analyzer] Fix lack of coverage after empty inlined function.Anna Zaks
We should not stop exploring the path after we return from an empty function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157859 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01static analyzer: add inlining support for directly called blocks.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157833 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31Allow some BugReports to opt-out of PathDiagnostic callstack pruning until ↵Ted Kremenek
we have significantly improved the pruning heuristics. The current heuristics are pretty good, but they make diagnostics for uninitialized variables warnings particularly useless in some cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-25[analyzer] Don't crash on LValBitCastAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157478 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-24[analyzer] Treat cast of array to reference in the same way as array toAnna Zaks
pointer. Fixes one of the crashes reported in PR12874. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157401 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-21[analyzer] Bind UnknownVal to InitListExpr for unsupported typesAnna Zaks
(ex: float). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-21Analyzer: Fix PR12905, a crash when encountering a call to a function named "C".Benjamin Kramer
While there clean up indentation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157204 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-19[analyzer] For locations, use isGLValue() instead of isLValue().Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157088 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer] Fix a c++11 crash: xvalues can be locations (VisitMemberExpr)Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157082 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-12[analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-11The Lexer constructor expects a source location at the start of theArgyrios Kyrtzidis
file buffer, not at the start of lexing. Fixes assertion hit in format diagnostics. rdar://11418366 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156647 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Include line that was meant to be in my last commit.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156582 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Fix insidious RegionStore bug where we (a) didn't handle vector types and ↵Ted Kremenek
(b) had a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more layers of lazy bindings. I don't have a reduced test case yet; but I have added the original source to an internal regression test suite. I'll see about coming up with a reduced test case. Fixes <rdar://problem/11405978> (for real). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Exit early if constraint solver is given a non-integer symbolAnna Zaks
to reason about. As part of taint propagation, we now allow creation of non-integer symbolic expressions like a cast from int to float. Addresses PR12511 (radar://11215362). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156578 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Simplify r156446, as per Ted's review.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156482 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Allow pointers to escape through selector callbacks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156481 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] We currently do not fully support CompoundLiterals inAnna Zaks
RegionStore, so be explicit about it and generate UnknownVal(). This is a hack to ensure we never produce undefined values for a value coming from a compound value. (The undefined values can lead to false positives.) radar://10127782 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Having RegionStore lower field bindings to raw offsets, just like ↵Ted Kremenek
ElementRegions. This is a bit disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values as structs. Fixes <rdar://problem/11405978>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08When creating lazy bindings in RegionStore, propagate existing lazy bindings ↵Ted Kremenek
instead of creating new ones. This is a functionality optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Include address of Store in graphviz output of ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the analyzer about CXXScaleValueInitExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] BasicConstraintManager: drop NE-constraints once we have a value.Jordy Rose
This could conceivably cut down on state proliferation, although we don't use BasicConstraintManager by default anymore. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156362 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Rework both constraint managers to handle mixed-type comparisons.Jordy Rose
This involves keeping track of three separate types: the symbol type, the adjustment type, and the comparison type. For example, in "$x + 5 > 0ULL", if the type of $x is 'signed char', the adjustment type is 'int' and the comparison type is 'unsigned long long'. Most of the time these three types will be the same, but we should still do the right thing when the comparison value is out of range, and wraparound should be calculated in the adjustment type. This also re-disables an out-of-bounds test; we were extracting the symbol from non-additive SymIntExprs, but then throwing away the integer. Sorry for the large patch; both the basic and range constraint managers needed to be updated together, since they share code in SimpleConstraintManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Add an abstraction for the bit width and signedness of an APSInt. ↵Jordy Rose
No functionality change. There are more parts of the analyzer that could use the convenience of APSIntType, particularly the constraint engine, but that needs a fair amount of rewriting to handle mixed-type constraints anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156360 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer] Fix a crash in triggered by OSAtomicChecker.Anna Zaks
SValBuilder should return an UnknownVal() when comparison of int and ptr fails. Previous to this commit, it went on assuming that we are dealing with pointer arithmetic. PR12509, radar://11390991 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156320 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07Remove variable made unused by r156270.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156273 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-06[analyzer] Reduce parallel code paths in SimpleSValBuilder::evalBinOpNN, and ↵Jordy Rose
handle mixed-type operations more generally. The logical change is that the integers in SymIntExprs may not have the same type as the symbols they are paired with. This was already the case with taint-propagation expressions created by SValBuilder::makeSymExprValNN, but I think those integers may never have been used. SimpleSValBuilder should be able to handle mixed-integer-type SymIntExprs fine now, though, and the constraint managers were already being defensive (though not entirely correct). All existing tests pass. The logic in evalBinOpNN has been simplified so that conversion is done as late as possible. As a result, most of the switch cases have been reduced to do the minimal amount of work, delegating to another case when they can by substituting ConcreteInts and (as before) reversing the left and right arguments when useful. Comparisons require special handling in two places (building SymIntExprs and evaluating constant-constant operations) because we don't /know/ the best type for comparing the two values. I've approximated the rules in Sema [C99 6.3.1.8] but it'd be nice to refactor Sema's actual algorithm into ASTContext. This is also groundwork for handling mixed-type constraints better than we do now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156270 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer]Fixup r156134: Handle the case when FunctionDecl isn't avail.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156183 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Assume pointer escapes when a callback is passed insideAnna Zaks
a struct. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156135 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Allow pointers escape through calls containing callback args.Anna Zaks
(Since we don't have a generic pointer escape callback, modify ExprEngineCallAndReturn as well as the malloc checker.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156134 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] When promoting constant integers in a comparison, use the larger ↵Jordy Rose
width of the two to avoid truncation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156089 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Equality ops are like relational ops in that the arguments ↵Jordy Rose
shouldn't be converted to the result type. Fixes PR12206 and dupe PR12510. This was probably the original intent of r133041 (also me, a year ago). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156062 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Conjure a symbol to ensure we can identify pointer arithmeticAnna Zaks
We need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156052 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Do not assert on constructing SymSymExpr with diff types.Anna Zaks
The resulting type info is stored in the SymSymExpr, so no reason not to support construction of expression with different subexpression types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156051 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Add a complexity bound on history tracking.Anna Zaks
(Currently, this is only relevant for tainted data.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156050 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Revert the functional part of r155944. Anna Zaks
The change resulted in multiple issues on the buildbot, so it's not ready for prime time. Only enable history tracking for tainted data(which is experimental) for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156049 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02Refine analyzer diagnostics by adding an expression "cone-of-influence" to ↵Ted Kremenek
reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155971 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] Fix an assertion failure triggered by the analyzer buildbot.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155964 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01Teach SValBuilder to handle casts of symbolic pointer values to an integer ↵Ted Kremenek
twice. Fixes <rdar://problem/11212866>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155950 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01[analyzer] Construct a SymExpr even when the constraint solver cannotAnna Zaks
reason about the expression. This essentially keeps more history about how symbolic values were constructed. As an optimization, previous to this commit, we only kept the history if one of the symbols was tainted, but it's valuable keep the history around for other purposes as well: it allows us to avoid constructing conjured symbols. Specifically, we need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); This change brings 2% slowdown on sqlite. Fixes radar://11329382. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155944 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-30Remove the ref/value inconsistency in filter_decl_iterator.David Blaikie
filter_decl_iterator had a weird mismatch where both op* and op-> returned T* making it difficult to generalize this filtering behavior into a reusable library of any kind. This change errs on the side of value, making op-> return T* and op* return T&. (reviewed by Richard Smith) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155808 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26[analyzer] check lazy bindings in RegionStore first before looking for ↵Ted Kremenek
default values. Fixes <rdar://problem/11269741>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155615 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-20[analyzer] Run remove dead bindings right before leaving a function.Anna Zaks
This is needed to ensure that we always report issues in the correct function. For example, leaks are identified when we call remove dead bindings. In order to make sure we report a callee's leak in the callee, we have to run the operation in the callee's context. This change required quite a bit of infrastructure work since: - We used to only run remove dead bindings before a given statement; here we need to run it after the last statement in the function. For this, we added additional Program Point and special mode in the SymbolReaper to remove all symbols in context lower than the current one. - The call exit operation turned into a sequence of nodes, which are now guarded by CallExitBegin and CallExitEnd nodes for clarity and convenience. (Sorry for the long diff.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-19Implements boxed expressions for Objective-C. <rdar://problem/10194391>Patrick Beard
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155082 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-17Change ExprEngine::shouldInlineDecl() to be defensive in checking if the CFG ↵Ted Kremenek
of the callee is valid. Fixes <rdar://problem/11257631>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154896 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-14Add an AttributedStmt type to represent a statement with C++11 attributesRichard Smith
attached. Since we do not support any attributes which appertain to a statement (yet), testing of this is necessarily quite minimal. Patch by Alexander Kornienko! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154723 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-13Remove the unused, unmaintained, incomplete 'Index' library.Douglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154672 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-11 18:20:52 +0000