aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-05-12[analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-11[analyzer] Do not walk the types for call graph construction.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-11The Lexer constructor expects a source location at the start of theArgyrios Kyrtzidis
file buffer, not at the start of lexing. Fixes assertion hit in format diagnostics. rdar://11418366 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156647 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Include line that was meant to be in my last commit.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156582 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Fix insidious RegionStore bug where we (a) didn't handle vector types and ↵Ted Kremenek
(b) had a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more layers of lazy bindings. I don't have a reduced test case yet; but I have added the original source to an internal regression test suite. I'll see about coming up with a reduced test case. Fixes <rdar://problem/11405978> (for real). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Exit early if constraint solver is given a non-integer symbolAnna Zaks
to reason about. As part of taint propagation, we now allow creation of non-integer symbolic expressions like a cast from int to float. Addresses PR12511 (radar://11215362). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156578 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Do not highlight the range of the statement in case of leak.Anna Zaks
We report a leak at a point a leaked variable is no longer accessible. The statement that happens to be at that point is not relevant to the leak diagnostic and, thus, should not be highlighted. radar://11178519 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156530 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Simplify r156446, as per Ted's review.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156482 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Allow pointers to escape through selector callbacks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156481 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] We currently do not fully support CompoundLiterals inAnna Zaks
RegionStore, so be explicit about it and generate UnknownVal(). This is a hack to ensure we never produce undefined values for a value coming from a compound value. (The undefined values can lead to false positives.) radar://10127782 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Having RegionStore lower field bindings to raw offsets, just like ↵Ted Kremenek
ElementRegions. This is a bit disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values as structs. Fixes <rdar://problem/11405978>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08When creating lazy bindings in RegionStore, propagate existing lazy bindings ↵Ted Kremenek
instead of creating new ones. This is a functionality optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Include address of Store in graphviz output of ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] SelfInit: Stop tracking self if it's assigned a value weAnna Zaks
don't reason about. Self is just like a local variable in init methods, so it can be assigned anything like result of static functions, other methods ... So to suppress false positives that result in such cases, stop tracking the checker-specific state after self is being assigned to (unless the value is't being assigned to is either self or conforms to our rules). This change does not invalidate any existing regression tests. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156420 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the analyzer about CXXScaleValueInitExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] BasicConstraintManager: drop NE-constraints once we have a value.Jordy Rose
This could conceivably cut down on state proliferation, although we don't use BasicConstraintManager by default anymore. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156362 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Rework both constraint managers to handle mixed-type comparisons.Jordy Rose
This involves keeping track of three separate types: the symbol type, the adjustment type, and the comparison type. For example, in "$x + 5 > 0ULL", if the type of $x is 'signed char', the adjustment type is 'int' and the comparison type is 'unsigned long long'. Most of the time these three types will be the same, but we should still do the right thing when the comparison value is out of range, and wraparound should be calculated in the adjustment type. This also re-disables an out-of-bounds test; we were extracting the symbol from non-additive SymIntExprs, but then throwing away the integer. Sorry for the large patch; both the basic and range constraint managers needed to be updated together, since they share code in SimpleConstraintManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Add an abstraction for the bit width and signedness of an APSInt. ↵Jordy Rose
No functionality change. There are more parts of the analyzer that could use the convenience of APSIntType, particularly the constraint engine, but that needs a fair amount of rewriting to handle mixed-type constraints anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156360 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the static analyzer that NSLog() and friends do not hold on to object ↵Ted Kremenek
references (thus extending their lifetime). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Turn on MallocSizeOfChecker by default; shorten the diagnosticAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156341 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer] Fix a crash in triggered by OSAtomicChecker.Anna Zaks
SValBuilder should return an UnknownVal() when comparison of int and ptr fails. Previous to this commit, it went on assuming that we are dealing with pointer arithmetic. PR12509, radar://11390991 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156320 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Fixup r156215: use StopTracking summary instead of ScratchArgsAnna Zaks
As per Jordy's and Ted's comment, use the default StopTracking summary instead of adding all arguments to ScratchArs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156310 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07Remove variable made unused by r156270.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156273 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-06[analyzer] Reduce parallel code paths in SimpleSValBuilder::evalBinOpNN, and ↵Jordy Rose
handle mixed-type operations more generally. The logical change is that the integers in SymIntExprs may not have the same type as the symbols they are paired with. This was already the case with taint-propagation expressions created by SValBuilder::makeSymExprValNN, but I think those integers may never have been used. SimpleSValBuilder should be able to handle mixed-integer-type SymIntExprs fine now, though, and the constraint managers were already being defensive (though not entirely correct). All existing tests pass. The logic in evalBinOpNN has been simplified so that conversion is done as late as possible. As a result, most of the switch cases have been reduced to do the minimal amount of work, delegating to another case when they can by substituting ConcreteInts and (as before) reversing the left and right arguments when useful. Comparisons require special handling in two places (building SymIntExprs and evaluating constant-constant operations) because we don't /know/ the best type for comparing the two values. I've approximated the rules in Sema [C99 6.3.1.8] but it'd be nice to refactor Sema's actual algorithm into ASTContext. This is also groundwork for handling mixed-type constraints better than we do now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156270 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer] RetainCountChecker: Allow objects to escape through callbacksAnna Zaks
Fixes radar://10973977. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156215 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04Explicitly model capturing variables for blocks in the static analyzer. ↵Ted Kremenek
Fixes <rdar://problem/11125868>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer]Fixup r156134: Handle the case when FunctionDecl isn't avail.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156183 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Assume pointer escapes when a callback is passed insideAnna Zaks
a struct. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156135 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Allow pointers escape through calls containing callback args.Anna Zaks
(Since we don't have a generic pointer escape callback, modify ExprEngineCallAndReturn as well as the malloc checker.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156134 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] When promoting constant integers in a comparison, use the larger ↵Jordy Rose
width of the two to avoid truncation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156089 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] CString Checker: Do not split the path unless the userAnna Zaks
specifically checks for equality to null. Enforcing this general practice, which keeps the analyzer less noisy, in the CString Checker. This change suppresses "Assigned value is garbage or undefined" warning in the added test case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156085 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Equality ops are like relational ops in that the arguments ↵Jordy Rose
shouldn't be converted to the result type. Fixes PR12206 and dupe PR12510. This was probably the original intent of r133041 (also me, a year ago). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156062 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Conjure a symbol to ensure we can identify pointer arithmeticAnna Zaks
We need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156052 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Do not assert on constructing SymSymExpr with diff types.Anna Zaks
The resulting type info is stored in the SymSymExpr, so no reason not to support construction of expression with different subexpression types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156051 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Add a complexity bound on history tracking.Anna Zaks
(Currently, this is only relevant for tainted data.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156050 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-03[analyzer] Revert the functional part of r155944. Anna Zaks
The change resulted in multiple issues on the buildbot, so it's not ready for prime time. Only enable history tracking for tainted data(which is experimental) for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156049 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02Refine analyzer diagnostics by adding an expression "cone-of-influence" to ↵Ted Kremenek
reverse track interesting values through interesting expressions. This allows us to map from interesting values in a caller to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA. Fixes <rdar://problem/11327497> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155971 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] RetainRelease: Self assignment should not suppress a leakAnna Zaks
warning. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155966 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] Fix an assertion failure triggered by the analyzer buildbot.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155964 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-02[analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155963 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01Teach SValBuilder to handle casts of symbolic pointer values to an integer ↵Ted Kremenek
twice. Fixes <rdar://problem/11212866>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155950 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01[analyzer] Construct a SymExpr even when the constraint solver cannotAnna Zaks
reason about the expression. This essentially keeps more history about how symbolic values were constructed. As an optimization, previous to this commit, we only kept the history if one of the symbols was tainted, but it's valuable keep the history around for other purposes as well: it allows us to avoid constructing conjured symbols. Specifically, we need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); This change brings 2% slowdown on sqlite. Fixes radar://11329382. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155944 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01Teach RetainCountchecker about IORegistryEntrySearchCFProperty returning ↵Ted Kremenek
retained objects. I know there is an SDK enhancement request for this to have the cf_returns_retained annotation, so this is just a stop gap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155887 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-01malloc size checker: Ignore const'ness of pointer types when determining of ↵Ted Kremenek
a sizeof() type is compatible with a pointed type. Fixes <rdar://problem/11292586>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155864 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-30Remove the ref/value inconsistency in filter_decl_iterator.David Blaikie
filter_decl_iterator had a weird mismatch where both op* and op-> returned T* making it difficult to generalize this filtering behavior into a reusable library of any kind. This change errs on the side of value, making op-> return T* and op* return T&. (reviewed by Richard Smith) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155808 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-28[analyzer] Remove references to idx::TranslationUnit. Index is dead, ↵Jordy Rose
cross-TU inlining never panned out. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155751 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-27Use a deque instead of an ImmutableList in AnalysisConsumer to preserve the ↵Ted Kremenek
file order that functions are visited. Should fix the buildbots. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155693 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-27Change FunctionSummary.h's definition of SetOfDecls to be an ImmutableList ↵Ted Kremenek
instead of a mutable SmallPtrSet. While iterating over LocalTUDecls, there were cases where we could modify LocalTUDecls, which could result in invalidating an iterator and an analyzer crash. Along the way, switch some uses of std::queue to std::dequeue, which should be slightly more efficient. Unfortunately, this is a difficult case to create a test case for. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155680 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26[analyzer] check lazy bindings in RegionStore first before looking for ↵Ted Kremenek
default values. Fixes <rdar://problem/11269741>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155615 91177308-0d34-0410-b5e6-96231b3b80d8
2012-04-26Teach RetainCountChecker that it doesn't quite understand ↵Ted Kremenek
pthread_setspecific and it should just give up when it sees it. Fixes <rdar://problem/11282706>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155613 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-07 01:57:49 +0000