aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2012-04-12[analyzer] PCH deserialization optimization.Anna Zaks
We should not deserialize unused declarations from the PCH file. Achieve this by storing the top level declarations during parsing (HandleTopLevelDecl ASTConsumer callback) and analyzing/building a call graph only for those. Tested the patch on a sample ObjC file that uses PCH. With the patch, the analyzes is 17.5% faster and clang consumes 40% less memory. Got about 10% overall build/analyzes time decrease on a large Objective C project. A bit of CallGraph refactoring/cleanup as well.. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154625 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-11[analyzer] dynamic_cast Simplify null value generation.Anna Zaks
As per Jordy's review. Creating a symbol here is more flexible; however I could not come up with an example where it was needed. (What constrains can be added on of the symbol constrained to 0?) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154542 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] dynamic_cast: Better model cast from a reference.Anna Zaks
Generate a sink when the dynamic_cast from a reference fails to represent a thrown exception. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Add support for C++ dynamic_cast.Anna Zaks
Simulate the C++ dynamic_cast in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154434 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-06Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that ↵Ted Kremenek
when we generate a new ExplodedNode we use the same Expr* as the one being currently visited. This is preparation for transitioning to having ProgramPoints refer to CFGStmts. This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact, as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but it will look a lot cleaner when were start using CFGStmt* in the appropriate places. As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed. I have audited these, and they look reasonable. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154214 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Require that all static analyzer issues have a category. As part of this ↵Ted Kremenek
change, consolidate some commonly used category strings into global references (more of this can be done, I just did a few). Fixes <rdar://problem/11191537>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154121 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Handle symbolicating a reference in an initializer expression that we don't ↵Ted Kremenek
understand. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154084 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05[analyzer] Change warding in a path diagnostic:Anna Zaks
"No method actually called because receiver is nil" -> "No method is called because receiver is nil" git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154077 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05[analyzer] Remove redundant if statement (pointed out by Ted).Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154075 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Include the "issue context" (e.g. function or method) where a static ↵Ted Kremenek
analyzer issue occurred in the plist output. Fixes <rdar://problem/11004527> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154030 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Change BugReporter's usage of IsCachedDiagnostic to only impact pruning ↵Ted Kremenek
diagnostics emitted to the console, and leave it up to PathDiagnosticConsumer to unique reports with the shortest path. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153987 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03[analyzer] Record the basic blocks covered by the analyzes run.Anna Zaks
Store this info inside the function summary generated for all analyzed functions. This is useful for coverage stats and can be helpful for analyzer state space search strategies. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153923 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03Fix another false positive in RegionStore involving doing loads from ↵Ted Kremenek
symbolic offsets. We still don't properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings either. Fixes <rdar://problem/11127008>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153913 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-02Fix potential null dereference in the static analyzer when inlining a call ↵Ted Kremenek
that has already been inlined. Unfortunately I have no test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-01Analyzer: Store BugReports directly in a ilist instead of adding another ↵Benjamin Kramer
layer of inderection with std::list git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153847 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.Anna Zaks
Fixes a false positive (radar://11152419). The current solution of adding the info into 3 places is quite ugly. Pending a generic pointer escapes callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153731 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer] Do not inline functions which previously reached max blockAnna Zaks
count. This is an optimization for "retry without inlining" option. Here, if we failed to inline a function due to reaching the basic block max count, we are going to store this information and not try to inline it again in the translation unit. This can be viewed as a function summary. On sqlite, with this optimization, we are 30% faster then before and cover 10% more basic blocks (partially because the number of times we reach timeout is decreased by 20%). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyzer] Enable retry exhausted without inlining by default.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153591 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyser] Stats checker: do not mark a node as exhausted if we willAnna Zaks
retry without inlining. (+ other minor cleanups) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28Fix suspicious comparison reported by PVS-Studio!Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153568 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Add an option to re-analyze a dead-end path without inlining.Anna Zaks
The analyzer gives up path exploration under certain conditions. For example, when the same basic block has been visited more than 4 times. With inlining turned on, this could lead to decrease in code coverage. Specifically, if we give up inside the inlined function, the rest of parent's basic blocks will not get analyzed. This commit introduces an option to enable re-run along the failed path, in which we do not inline the last inlined call site. This is done by enqueueing the node before the processing of the inlined call site with a special policy encoded in the state. The policy tells us not to inline the call site along the path. This lead to ~10% increase in the number of paths analyzed. Even though we expected a much greater coverage improvement. The option is turned off by default for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Restart path diagnostic generation if any of the visitors change ↵Jordy Rose
the report configuration while walking the path. This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type. Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23Avoid applying retain/release effects twice in RetainCountChecker when a ↵Ted Kremenek
function call was inlined (i.e., we do not need to apply summaries in such cases). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153309 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22Fix static analyzer crash on code taking the address of a field. Fixes PR ↵Ted Kremenek
11146. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153283 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add the stat for the number of successfully explored paths.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153281 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add stats useful for coverage investigations.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153280 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks
Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyser] Factor out FindUniqueBinding from RetainCount checker.Anna Zaks
So that others could use it as well. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17StaticAnalyzer: Fix abuse of StringRef in r152962.NAKAMURA Takumi
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152982 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Shorten the stack hint diagnostic.Anna Zaks
Do not display the standard "Returning from 'foo'", when a stack hint is available. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152964 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Create symbol-aware stack hints (building upon r152837).Anna Zaks
The symbol-aware stack hint combines the checker-provided message with the information about how the symbol was passed to the callee: as a parameter or a return value. For malloc, the generated messages look like this : "Returning from 'foo'; released memory via 1st parameter" "Returning from 'foo'; allocated memory via 1st parameter" "Returning from 'foo'; allocated memory returned" "Returning from 'foo'; reallocation of 1st parameter failed" (We are yet to handle cases when the symbol is a field in a struct or an array element.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152962 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] +CommentsAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152961 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Add a statistic for the number of times we reach the maxAnna Zaks
number of steps in the work list. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152960 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16Fix analyzer crash on analyzing 'catch' with no condition variable.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] If a metadata symbol is interesting, its region is interesting as ↵Jordy Rose
well. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152868 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ ↵Jordy Rose
expressions with a "base object", because the CFG is now linearized. The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152856 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Allow checkers to supply call stack diagnostic hints for theAnna Zaks
BugVisitor DiagnosticPieces. When checkers create a DiagnosticPieceEvent, they can supply an extra string, which will be concatenated with the call exit message for every call on the stack between the diagnostic event and the final bug report. (This is a simple version, which could be/will be further enhanced.) For example, this is used in Malloc checker to produce the ", which allocated memory" in the following example: static char *malloc_wrapper() { // 2. Entered call from 'use' return malloc(12); // 3. Memory is allocated } void use() { char *v; v = malloc_wrapper(); // 1. Calling 'malloc_wrappers' // 4. Returning from 'malloc_wrapper', which allocated memory } // 5. Memory is never released; potential memory leak git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152837 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14'#if 0' out a variable that's only used in other preprocessor-disabled code.Matt Beaumont-Gay
(Why are we keeping all of this code around anyway? Say the word and I'll start swinging the delete hammer.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152749 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[analyzer] Diagnostics: Supply Caller information even if the bug occursAnna Zaks
in the callee. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Remove unnecessary recursive visits for ExprWithCleanups andErik Verbruggen
MaterializeTemporaryExpr. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Removes more recursive visitations in ExprEngine that are noErik Verbruggen
longer needed as the CFG is fully linearized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152720 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyser] Refactor shouldInline logic into a helper.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152677 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Call enter/exit diagnostic should refer to caller/callee,Anna Zaks
respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152676 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-12Add new analyzer diagnostic mode where plists can have bugs that span ↵Ted Kremenek
multiple files. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152586 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-12[analyzer] Include inlining call stack depth in plist output.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152584 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-11Unify naming of LangOptions variable/get function across the Clang stack ↵David Blaikie
(Lex to AST). The member variable is always "LangOpts" and the member function is always "getLangOpts". Reviewed by Chris Lattner git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152536 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-10Remove BlockDeclRefExpr and introduce a bit on DeclRefExpr toJohn McCall
track whether the referenced declaration comes from an enclosing local context. I'm amenable to suggestions about the exact meaning of this bit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152491 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-10[analyzer] fix regression in analyzer of NOT actually aborting on Stmts it ↵Ted Kremenek
doesn't understand. We registered as aborted, but didn't treat such cases as sinks in the ExplodedGraph. Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly). Fixes: <rdar://problem/10892489> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152468 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Add support for NoRedundancy inlining mode.Anna Zaks
We do not reanalyze a function, which has already been analyzed as an inlined callee. As per PRELIMINARY testing, this gives over 50% run time reduction on some benchmarks without decreasing of the number of bugs found. Turning the mode on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152440 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek
symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152361 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-12 21:48:30 +0000