aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-03-21[analyser] Factor out FindUniqueBinding from RetainCount checker.Anna Zaks
So that others could use it as well. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-18[analyzer] Mark a failed-realloc's result as an interesting symbol between ↵Jordy Rose
the realloc call and the null check, so we get nicer path notes. Fixes a regression introduced by the diagnostic pruning added in r152361. This is accomplished by calling markInteresting /during/ path diagnostic generation, and as such relies on deterministic ordering of BugReporterVisitors -- namely, that BugReporterVisitors are run in /reverse/ order from how they are added. (Right now that's a consequence of storing visitors in an ImmutableList, where new items are added to the front.) It's a little hacky, but it works for now. I think this is the best we can do without storing the relation between the old and new symbols, and that would be a hit whether or not there ends up being an error. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153010 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-18[analyzer] Use a FoldingSet to cache simple RetainSummary instances, rather ↵Jordy Rose
than explicitly keeping DoNothing and StopTracking summaries and nothing else. I tried to test the effects of this change on memory usage and run time, but what I saw on retain-release.m was indistinguishable from noise (debug and release builds). Even so, some caveman profiling showed 101 cache hits that we would have generated new summaries for before (i.e. not default or stop summaries), and the more code we analyze, the more memory we should save. Maybe we should have a standard project for benchmarking the retain count checker's memory and time? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153007 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Unify retain-count summary generation for class and instance ↵Jordy Rose
methods. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153001 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Remove duplicate work on deriving method behavior. No ↵Jordy Rose
functionality change. The cocoa::deriveNamingConventions helper is just using method families anyway now, and the way RetainSummaryTemplate works means we're allocating an extra summary for every method with a relevant family. Also, fix RetainSummaryTemplate to do the right thing w/r/t annotating an /existing/ summary. This was probably the real cause of <rdar://problem/10824732> and the fix in r152448. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152998 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17StaticAnalyzer: Fix abuse of StringRef in r152962.NAKAMURA Takumi
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152982 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Don't claim an object was returned with +1 retain count before ↵Jordy Rose
counting autoreleases. Fixes PR10376. (Also, 80-column violations.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152976 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Shorten the stack hint diagnostic.Anna Zaks
Do not display the standard "Returning from 'foo'", when a stack hint is available. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152964 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Create symbol-aware stack hints (building upon r152837).Anna Zaks
The symbol-aware stack hint combines the checker-provided message with the information about how the symbol was passed to the callee: as a parameter or a return value. For malloc, the generated messages look like this : "Returning from 'foo'; released memory via 1st parameter" "Returning from 'foo'; allocated memory via 1st parameter" "Returning from 'foo'; allocated memory returned" "Returning from 'foo'; reallocation of 1st parameter failed" (We are yet to handle cases when the symbol is a field in a struct or an array element.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152962 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] +CommentsAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152961 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Add a statistic for the number of times we reach the maxAnna Zaks
number of steps in the work list. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152960 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16Fix analyzer crash on analyzing 'catch' with no condition variable.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] If a metadata symbol is interesting, its region is interesting as ↵Jordy Rose
well. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152868 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ ↵Jordy Rose
expressions with a "base object", because the CFG is now linearized. The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152856 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Allow checkers to supply call stack diagnostic hints for theAnna Zaks
BugVisitor DiagnosticPieces. When checkers create a DiagnosticPieceEvent, they can supply an extra string, which will be concatenated with the call exit message for every call on the stack between the diagnostic event and the final bug report. (This is a simple version, which could be/will be further enhanced.) For example, this is used in Malloc checker to produce the ", which allocated memory" in the following example: static char *malloc_wrapper() { // 2. Entered call from 'use' return malloc(12); // 3. Memory is allocated } void use() { char *v; v = malloc_wrapper(); // 1. Calling 'malloc_wrappers' // 4. Returning from 'malloc_wrapper', which allocated memory } // 5. Memory is never released; potential memory leak git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152837 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14'#if 0' out a variable that's only used in other preprocessor-disabled code.Matt Beaumont-Gay
(Why are we keeping all of this code around anyway? Say the word and I'll start swinging the delete hammer.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152749 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[analyzer] Diagnostics: Supply Caller information even if the bug occursAnna Zaks
in the callee. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Remove unnecessary recursive visits for ExprWithCleanups andErik Verbruggen
MaterializeTemporaryExpr. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Removes more recursive visitations in ExprEngine that are noErik Verbruggen
longer needed as the CFG is fully linearized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152720 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyser] Refactor shouldInline logic into a helper.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152677 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Call enter/exit diagnostic should refer to caller/callee,Anna Zaks
respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152676 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Change the order in which we analyze the functions underAnna Zaks
inlining to be the reverse of their declaration. This optimizes running time under inlining up to 20% since we do not re-analyze the utility functions which are usually defined first in the translation unit if they have already been analyzed while inlined into the root functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152653 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Use BFS over call graph when analysing functions.Anna Zaks
BFS should give slightly better performance. Ex: Suppose, we have two roots R1 and R2. A callee function C is reachable through both. However, C is not inlined when analyzing R1 due to inline stack depth limit. With DFS, C will be analyzed as top level even though it would be analyzed as inlined through R2. On the other hand, BFS could avoid analyzing C as top level. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152652 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Refactor CallGraph to use Recursive AST visitor whenAnna Zaks
collecting function Decls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152651 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Use recursive AST visitor to drive simple visitation order inAnna Zaks
AnalysisConsumer. As a result: - We now analyze the C++ methods which are defined within the class body. These were completely skipped before. - Ensure that AST checkers are called on functions in the order they are defined in the Translation unit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152650 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Minor: factor out logic for determining if we should skip aAnna Zaks
function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152649 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Move the check for parser errors out of the loop over Decls.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152648 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-12Add new analyzer diagnostic mode where plists can have bugs that span ↵Ted Kremenek
multiple files. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152586 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-12[analyzer] Include inlining call stack depth in plist output.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152584 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-11Unify naming of LangOptions variable/get function across the Clang stack ↵David Blaikie
(Lex to AST). The member variable is always "LangOpts" and the member function is always "getLangOpts". Reviewed by Chris Lattner git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152536 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-11[analyzer] Replace a static helper with existing logic. No functionality change.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152521 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-10Remove BlockDeclRefExpr and introduce a bit on DeclRefExpr toJohn McCall
track whether the referenced declaration comes from an enclosing local context. I'm amenable to suggestions about the exact meaning of this bit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152491 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-10[analyzer] fix regression in analyzer of NOT actually aborting on Stmts it ↵Ted Kremenek
doesn't understand. We registered as aborted, but didn't treat such cases as sinks in the ExplodedGraph. Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly). Fixes: <rdar://problem/10892489> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152468 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09Teach RetainCountChecker about mixing method families with explicit ↵Ted Kremenek
annotations. Fixes <rdar://problem/10824732>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152448 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Add support for NoRedundancy inlining mode.Anna Zaks
We do not reanalyze a function, which has already been analyzed as an inlined callee. As per PRELIMINARY testing, this gives over 50% run time reduction on some benchmarks without decreasing of the number of bugs found. Turning the mode on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152440 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-09[analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek
symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-08[analyzer] Use call graph to determine order in which functions areAnna Zaks
analyzed. The CallGraph is used when inlining is on, which is the current default. This alone does not bring any performance improvement. It's a stepping stone for the upcoming optimization in which we do not re-analyze a function that has already been analyzed while inlined in other functions. Using the call graph makes it easier to play with the order of functions to minimize redundant analyzes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152352 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-08[analyzer] Rework inlining related command line options.Anna Zaks
- Remove -analyzer-inline-call. - Add -analyzer-ipa=[none|inlining] - Add -analyzer-inlining-mode to allow experimentation for different performance tuning methods. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152351 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-08Add a basic CallGraph to Analysis.Anna Zaks
The final graph contains a single root node, which is a parent of all externally available functions(and 'main'). As well as a list of Parentless/Unreachable functions, which are either truly unreachable or are unreachable due to our analyses imprecision. The analyzer checkers debug.DumpCallGraph or debug.ViewGraph can be used to look at the produced graph. Currently, the graph is not very precise, for example, it entirely skips edges resulted from ObjC method calls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152272 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-07AST representation for user-defined literals, plus just enough of semanticRichard Smith
analysis to make the AST representation testable. They are represented by a new UserDefinedLiteral AST node, which is a sugared CallExpr. All semantic properties, including full CodeGen support, are achieved for free by this representation. UserDefinedLiterals can never be dependent, so no custom instantiation behavior is required. They are mangled as if they were direct calls to the underlying literal operator. This matches g++'s apparent behavior (but not its actual mangling, which is broken for literal-operator-ids). User-defined *string* literals are now fully-operational, but the semantic analysis is quite hacky and needs more work. No other forms of user-defined literal are created yet, but the AST support for them is present. This patch committed after midnight because we had already hit the quota for new kinds of literal yesterday. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152139 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06[analyzer] add a diagnostic event when entering a call via inlining, within ↵Ted Kremenek
the callee, and add an edge. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152086 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06[analyzer] 'Looping back to the head of the loop' diagnostics are prunable.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152083 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06[analyzer] Remove now-unused constant. No functionality change.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152080 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-06[analyzer] Fix unnecessary dyn_cast_or_null. No functionality change.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-05Teak CallAndMessageChecker to only warn about uninitialized struct fields in ↵Ted Kremenek
call arguments when the called function is never inlined. Fixes <rdar://problem/10977037>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152073 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-05Teach SimpleSValBuilder that (in the absence of more information) stack ↵Ted Kremenek
memory doesn't alias symbolic memory. This is a heuristic/hack, but works well in practice. Fixes <rdar://problem/10978247>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152065 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-05[analyzer] Time the execution (per each TU) with -analyzer-stats.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152059 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-05[analyzer] False positive in SelfInit - teach the checker about methodAnna Zaks
calls with self as a parameter. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152039 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-05[analyzer] Malloc should assume that ownership is transfered whenAnna Zaks
calling an ObjC method ending with 'NoCopy'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152037 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-16 21:48:15 +0000