aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-04-20[analyzer] Run remove dead bindings right before leaving a function.Anna Zaks
This is needed to ensure that we always report issues in the correct function. For example, leaks are identified when we call remove dead bindings. In order to make sure we report a callee's leak in the callee, we have to run the operation in the callee's context. This change required quite a bit of infrastructure work since: - We used to only run remove dead bindings before a given statement; here we need to run it after the last statement in the function. For this, we added additional Program Point and special mode in the SymbolReaper to remove all symbols in context lower than the current one. - The call exit operation turned into a sequence of nodes, which are now guarded by CallExitBegin and CallExitEnd nodes for clarity and convenience. (Sorry for the long diff.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-19Implements boxed expressions for Objective-C. <rdar://problem/10194391>Patrick Beard
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155082 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-17Change ExprEngine::shouldInlineDecl() to be defensive in checking if the CFG ↵Ted Kremenek
of the callee is valid. Fixes <rdar://problem/11257631>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154896 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-16[analyzer] Fix a false alarm in SelfInitChecker (radar://11235991).Anna Zaks
Along with it, fix a couple of other corner cases and add more tests. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154866 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-14Add an AttributedStmt type to represent a statement with C++11 attributesRichard Smith
attached. Since we do not support any attributes which appertain to a statement (yet), testing of this is necessarily quite minimal. Patch by Alexander Kornienko! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154723 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-13Remove the unused, unmaintained, incomplete 'Index' library.Douglas Gregor
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154672 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-12[analyzer] PCH deserialization optimization.Anna Zaks
We should not deserialize unused declarations from the PCH file. Achieve this by storing the top level declarations during parsing (HandleTopLevelDecl ASTConsumer callback) and analyzing/building a call graph only for those. Tested the patch on a sample ObjC file that uses PCH. With the patch, the analyzes is 17.5% faster and clang consumes 40% less memory. Got about 10% overall build/analyzes time decrease on a large Objective C project. A bit of CallGraph refactoring/cleanup as well.. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154625 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-11[analyzer] dynamic_cast Simplify null value generation.Anna Zaks
As per Jordy's review. Creating a symbol here is more flexible; however I could not come up with an example where it was needed. (What constrains can be added on of the symbol constrained to 0?) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154542 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Don't crash even when the system functions are redefined.Anna Zaks
(Applied changes to CStringAPI, Malloc, and Taint.) This might almost never happen, but we should not crash even if it does. This fixes a crash on the internal analyzer buildbot, where postgresql's configure was redefining memmove (radar://11219852). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154451 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] dynamic_cast: Better model cast from a reference.Anna Zaks
Generate a sink when the dynamic_cast from a reference fails to represent a thrown exception. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154438 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-10[analyzer] Add support for C++ dynamic_cast.Anna Zaks
Simulate the C++ dynamic_cast in the analyzer. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154434 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-06Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that ↵Ted Kremenek
when we generate a new ExplodedNode we use the same Expr* as the one being currently visited. This is preparation for transitioning to having ProgramPoints refer to CFGStmts. This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact, as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but it will look a lot cleaner when were start using CFGStmt* in the appropriate places. As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed. I have audited these, and they look reasonable. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154214 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-06[analyzer] Check that the arguments to NSOrderedSet creation methods are ↵Jordy Rose
valid ObjC objects. Patch by Sean McBride! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154194 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Require that all static analyzer issues have a category. As part of this ↵Ted Kremenek
change, consolidate some commonly used category strings into global references (more of this can be done, I just did a few). Fixes <rdar://problem/11191537>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154121 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Handle symbolicating a reference in an initializer expression that we don't ↵Ted Kremenek
understand. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154084 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05Teach ObjCContainersChecker that the array passed to CFArrayGetValueAtIndex ↵Ted Kremenek
might not be a symbolic value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154083 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05[analyzer] Move stats calculation out of AnalysisConsumer destructor.Anna Zaks
The ASTConsumer does not get deleted with clang --analyze (for performance reasons), we still want the diagnostics to work. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05[analyzer] Change warding in a path diagnostic:Anna Zaks
"No method actually called because receiver is nil" -> "No method is called because receiver is nil" git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154077 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-05[analyzer] Remove redundant if statement (pointed out by Ted).Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154075 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Look through chains of 'x = y = z' when employing silencing heuristics in ↵Ted Kremenek
the DeadStoresChecker. Fixes <rdar://problem/11185138>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154040 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Include the "issue context" (e.g. function or method) where a static ↵Ted Kremenek
analyzer issue occurred in the plist output. Fixes <rdar://problem/11004527> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154030 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-04Change BugReporter's usage of IsCachedDiagnostic to only impact pruning ↵Ted Kremenek
diagnostics emitted to the console, and leave it up to PathDiagnosticConsumer to unique reports with the shortest path. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153987 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03[analyzer] Record the basic blocks covered by the analyzes run.Anna Zaks
Store this info inside the function summary generated for all analyzed functions. This is useful for coverage stats and can be helpful for analyzer state space search strategies. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153923 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-03Fix another false positive in RegionStore involving doing loads from ↵Ted Kremenek
symbolic offsets. We still don't properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings either. Fixes <rdar://problem/11127008>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153913 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-02Fix potential null dereference in the static analyzer when inlining a call ↵Ted Kremenek
that has already been inlined. Unfortunately I have no test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-01Analyzer: Store BugReports directly in a ilist instead of adding another ↵Benjamin Kramer
layer of inderection with std::list git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153847 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.Anna Zaks
Fixes a false positive (radar://11152419). The current solution of adding the info into 3 places is quite ugly. Pending a generic pointer escapes callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153731 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer] Do not inline functions which previously reached max blockAnna Zaks
count. This is an optimization for "retry without inlining" option. Here, if we failed to inline a function due to reaching the basic block max count, we are going to store this information and not try to inline it again in the translation unit. This can be viewed as a function summary. On sqlite, with this optimization, we are 30% faster then before and cover 10% more basic blocks (partially because the number of times we reach timeout is decreased by 20%). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyzer] Enable retry exhausted without inlining by default.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153591 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyser] Stats checker: do not mark a node as exhausted if we willAnna Zaks
retry without inlining. (+ other minor cleanups) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyzer] Refactor: Use Decl when determining if the Block belongs toAnna Zaks
the root function. (This is a bit cleaner then using the StackFrame.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28Fix suspicious comparison reported by PVS-Studio!Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153568 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Add an option to re-analyze a dead-end path without inlining.Anna Zaks
The analyzer gives up path exploration under certain conditions. For example, when the same basic block has been visited more than 4 times. With inlining turned on, this could lead to decrease in code coverage. Specifically, if we give up inside the inlined function, the rest of parent's basic blocks will not get analyzed. This commit introduces an option to enable re-run along the failed path, in which we do not inline the last inlined call site. This is done by enqueueing the node before the processing of the inlined call site with a special policy encoded in the state. The policy tells us not to inline the call site along the path. This lead to ~10% increase in the number of paths analyzed. Even though we expected a much greater coverage improvement. The option is turned off by default for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Stats checker: minor interprocedural tweaks.Anna Zaks
Report root function name with exhausted block diagnostic. Also, use stack frames, not just any location context when checking if the basic block is in the same context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153532 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Stats: Only count the number of times we run path sensitiveAnna Zaks
analyzes. (This method can be called twice on the same function.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27Change RetainCountChecker to eagerly "escape" retained objects when they areTed Kremenek
assigned to a struct. This is fallout from inlining results, which expose far more patterns where people stuff CF objects into structs and pass them around (and we can reason about it). The problem is that we don't have a general way to detect when values have escaped, so as an intermediate step we need to eagerly prune out such tracking. Fixes <rdar://problem/11104566>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153489 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-26[analyzer] Malloc: Allow a pointer to escape through OSAtomicEnqueue.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153453 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Tighten up the realloc() failure path note generation...make sure ↵Jordy Rose
we get the right realloc()! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153370 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Restart path diagnostic generation if any of the visitors change ↵Jordy Rose
the report configuration while walking the path. This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type. Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able ↵Jordy Rose
to reset diagnostic generation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153368 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23Avoid applying retain/release effects twice in RetainCountChecker when a ↵Ted Kremenek
function call was inlined (i.e., we do not need to apply summaries in such cases). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153309 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23corrected check::EndOfTranslationUnit checker name and added 'const' to ↵Anton Yartsev
declaration git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153302 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22Fix static analyzer crash on code taking the address of a field. Fixes PR ↵Ted Kremenek
11146. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153283 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add the stat for the number of successfully explored paths.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153281 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add stats useful for coverage investigations.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153280 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add inlining awareness to the block coverage computationAnna Zaks
(Stats Checker). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153279 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22"Teach" RetainCountChecker about dispatch_set_context, which can indirectly ↵Ted Kremenek
free its argument later. Fixes <rdar://problem/11059275>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Malloc: drop symbols captured by blocks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153232 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21Remove unused variable, fix indentation.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153220 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks
Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-08 10:28:56 +0000