aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-02-18Adopt ExprEngine and checkers to ObjC property refactoring. Everything was ↵Ted Kremenek
working, but now diagnostics are aware of message expressions implied by uses of properties. Fixes <rdar://problem/9241180>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150888 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-17Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek
for functions called more than once. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150849 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-17[analyzer] Fix another false positive in the Malloc Checker, by makingAnna Zaks
it aware of CString APIs that return the input parameter. Malloc Checker needs to know how the 'strcpy' function is evaluated. Introduce the dependency on CStringChecker for that. CStringChecker knows all about these APIs. Addresses radar://10864450 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150846 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-17[analyzer] Generalize function name checking in CString checker.Anna Zaks
(Ex: It was not treating __inline_strcpy as strcpy. Will add tests that rely on this later on.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150845 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16[analyzer] Malloc Checker: Clean up bug naming:Anna Zaks
- Rename the category "Logic Error" -> "Memory Error". - Shorten all the messages. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150733 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16[analyzer] Malloc Checker: Make the diagnostic visitor handle the caseAnna Zaks
of failing realloc. + Minor cleanups. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150732 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Add checker visitation hooks in ExprEngine::Visit() for common no-op ↵Ted Kremenek
expressions. To be used later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150723 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Revert "Move ExplodedNode reclaimation out of ExprEngine and into ↵Ted Kremenek
CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150722 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also ↵Ted Kremenek
have it based on adding predecessors/successors, not node allocation. No measurable performance change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150720 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Minor cleanup to node data structures in ExplodedGraph. No functionality ↵Ted Kremenek
change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150719 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Revert "Revert "Make CXXNewExpr contain only a single initialier, and not ↵Sebastian Redl
hold the used constructor itself."" This reintroduces commit r150682 with a fix for the Bullet benchmark crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150685 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Revert "Make CXXNewExpr contain only a single initialier, and not hold the ↵Sebastian Redl
used constructor itself." It leads to a compiler crash in the Bullet benchmark. This reverts commit r12014. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150684 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16Make CXXNewExpr contain only a single initialier, and not hold the used ↵Sebastian Redl
constructor itself. Holding the constructor directly makes no sense when list-initialized arrays come into play. The constructor is now held in a CXXConstructExpr, if construction is what is done. The new design can also distinguish properly between list-initialization and direct-initialization, as well as implicit default-initialization constructors and explicit value-initialization constructors. Finally, doing it this way removes redundance from the AST because CXXNewExpr doesn't try to handle both the allocation and the initialization responsibilities. This breaks the static analysis of new expressions. I've filed PR12014 to track this. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150682 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16[analyzer] Diagnostics: Ensure that the default end of diagnostic pathAnna Zaks
piece can always be generated. The default end of diagnostic path piece was failing to generate on a BlockEdge that was outgoing from a basic block without a terminator, resulting in a very simple diagnostic being rendered (ex: no path highlighting or custom visitors). Reuse another function, which is essentially doing the same thing and correct it not to fail when a block has no terminator. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150659 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-16[analyzer] Malloc Checker: Give up when a pointer escapes into a struct.Anna Zaks
We are not properly handling the memory regions that escape into struct fields, which led to a bunch of false positives. Be conservative here and give up when a pointer escapes into a struct. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150658 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-15[analyzer] Malloc checker: make a bit safer.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150556 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-15Split reinterpret_casts of member pointers out from CK_BitCast; thisJohn McCall
is general goodness because representations of member pointers are not always equivalent across member pointer types on all ABIs (even though this isn't really standard-endorsed). Take advantage of the new information to teach IR-generation how to do these reinterprets in constant initializers. Make sure this works when intermingled with hierarchy conversions (although this is not part of our motivating use case). Doing this in the constant-evaluator would probably have been better, but that would require a *lot* of extra structure in the representation of constant member pointers: you'd really have to track an arbitrary chain of hierarchy conversions and reinterpretations in order to get this right. Ultimately, this seems less complex. I also wasn't quite sure how to extend the constant evaluator to handle foldings that we don't actually want to treat as extended constant expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150551 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-15[analyzer] Malloc Checker: add support for reallocf, which always freesAnna Zaks
the passed in pointer on failure. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150533 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-15[analyzer] Malloc Checker: add support for valloc + minor codeAnna Zaks
hardening. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150532 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14[analyzer] Make Malloc Checker optimistic in presence of inlining.Anna Zaks
(In response of Ted's review of r150112.) This moves the logic which checked if a symbol escapes through a parameter to invalidateRegionCallback (instead of post CallExpr visit.) To accommodate the change, added a CallOrObjCMessage parameter to checkRegionChanges callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150513 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14Remove recusive expression visitation in ↵Ted Kremenek
ExprEngine::VisitIncrementDecrementOperator(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150511 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14Remove recursive visitation in ExprEngine for UO_Not, UO_Minus, UO_LNot.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150509 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14Remove recursive visitation in ExprEngine for UO_Deref, UO_AddrOf, and ↵Ted Kremenek
UO_Extension. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150506 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14Remove ExprEngine recursive visitation of unary UO_Imag operation.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150505 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14Further remove some recursive visitiation in ExprEngine that is no longer ↵Ted Kremenek
needed because the CFG is fully linearized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150504 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-14[analyzer] Malloc Checker: realloc: add dependency between the symbolsAnna Zaks
in realloc map. If there is no dependency, the reallocated ptr will get garbage collected before we know that realloc failed, which would lead us to missing a memory leak warning. Also added new test cases, which we can handle now. Plus minor cleanups. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-13[analyzer] Malloc Checker: realloc: correct the way we are handing theAnna Zaks
case when size is 0. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150412 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-13[analyzer] Malloc checker: rework realloc handling:Anna Zaks
1) Support the case when realloc fails to reduce False Positives. (We essentially need to restore the state of the pointer being reallocated.) 2) Realloc behaves differently under special conditions (from pointer is null, size is 0). When detecting these cases, we should consider under-constrained states (size might or might not be 0). The old version handled this in a very hacky way. The code did not differentiate between definite and possible (no consideration for under-constrained states). Further, after processing each special case, the realloc processing function did not return but chained to the next special case processing. So you could end up in an execution in which you first see the states in which size is 0 and realloc ~ free(), followed by the states corresponding to size is not 0 followed by the evaluation of the regular realloc behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150402 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-11[analyzer] Malloc Checker: reduce false negatives rate by assuming thatAnna Zaks
a pointer cannot escape through calls to system functions. Also, stop after reporting the first use-after-free. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150315 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-11[analyzer] Malloc Checker: Report a leak when we are returning freedAnna Zaks
memory. (As per one test case, the existing checker thought that this could cause a lot of false positives - not sure if that's valid, to be verified.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150313 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-11[analyzer] Malloc checker: Leak bugs should be suppressed by sinks.Anna Zaks
Resolves a common false positive, where we were reporting a leak inside asserts git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150312 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-11[analyzer] MallocChecker: refactor/improve the symbol escape logic.Anna Zaks
We use the same logic here as the RetainRelease checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150311 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-11[analyzer] New checker for assignment of non-0/1 values to Boolean variables.Ryan Govostes
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150306 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-10[analyzer] MallocChecker Cleanup - harden against crashes, fix an errorAnna Zaks
(use of return instead of continue), wording. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150215 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-09[analyzer] Proactively avoid inlining vararg functions and blocks until we ↵Ted Kremenek
properly support them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150207 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-09Remove unused fun.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150172 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-09[analyzer] MallocChecker: address a diagnostic "fixme".Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150158 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-09[analyzer] Add custom path diagnostic to the Malloc Checker.Anna Zaks
Very simple so far - we just highlight every allocation and release site. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150156 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-09[analyzer] MallocChecker cleanup, more tests.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150155 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08[analyzer] MallocChecker: implement pessimistic version of the checker,Anna Zaks
which allows values to escape through unknown calls. Assumes all calls but the malloc family are unknown. Also, catch a use-after-free when a pointer is passed to a function after a call to free (previously, you had to explicitly dereference the pointer value). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150112 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08[analyzer] Split the MallocChecker into two versions - pessimistic andAnna Zaks
optimistic. TODO: actually implement the pessimistic version of the checker. Ex: it needs to assume that any function that takes a pointer might free it. The optimistic version relies on annotations to tell us which functions can free the pointer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150111 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08Remove explicit delete of PathDiagnosticMacroPiece, as it is now reference ↵Ted Kremenek
counted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150110 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08[analyzer] MallocChecker: convert from using evalCall toAnna Zaks
post visit of CallExpr. In general, we should avoid using evalCall as it leads to interference with other checkers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150086 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08Change PathDiagnosticPieces to be reference counted (simplifying their ↵Ted Kremenek
management), and introduce 'PathPieces' as a common container for PathDiagnosticPieces. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150054 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-08Refactor pieces of PathDiagnostic into its own data structure. No ↵Ted Kremenek
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150053 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-07Revert my patches which removed Diagnostic.h includes by moving some ↵Benjamin Kramer
operator overloads out of line. This seems to negatively affect compile time onsome ObjC tests (which use a lot of partial diagnostics I assume). I have to come up with a way to keep them inline without including Diagnostic.h everywhere. Now adding a new diagnostic requires a full rebuild of e.g. the static analyzer which doesn't even use those diagnostics. This reverts commit 6496bd10dc3a6d5e3266348f08b6e35f8184bc99. This reverts commit 7af19b817ba964ac560b50c1ed6183235f699789. This reverts commit fdd15602a42bbe26185978ef1e17019f6d969aa7. This reverts commit 00bd44d5677783527d7517c1ffe45e4d75a0f56f. This reverts commit ef9b60ffed980864a8db26ad30344be429e58ff5. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150006 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-07Print NamedDecls directly to a raw_ostream where possible.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149982 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-07Switch the ObjC*Decl raw_stream overloads to take a reference, for ↵Benjamin Kramer
consistency with NamedDecls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149981 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-07Introduce basic ASTs for lambda expressions. This covers:Douglas Gregor
- Capturing variables by-reference and by-copy within a lambda - The representation of lambda captures - The creation of the non-static data members in the lambda class that store the captured variables - The initialization of the non-static data members from the captured variables - Pretty-printing lambda expressions There are a number of FIXMEs, both explicit and implied, including: - Creating a field for a capture of 'this' - Improved diagnostics for initialization failures when capturing variables by copy - Dealing with temporaries created during said initialization - Template instantiation - AST (de-)serialization - Binding and returning the lambda expression; turning it into a proper temporary - Lots and lots of semantic constraints - Parameter pack captures git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149977 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-07Create PathDiagnosticCallEnter and PathDiagnosticCallExit, to remark calls ↵Ted Kremenek
in PathDiagnostics from other events. This will have potential uses later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149960 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-17 11:59:39 +0000