aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2013-01-30[analyzer] Move report false positive suppression to report visitors.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173956 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Remove further references to analyzer-ipa.Anna Zaks
Thanks Jordan! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173955 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-30[analyzer] Model trivial copy/move ctors with an aggregate bind.Jordan Rose
This is faster for the analyzer to process than inlining the constructor and performing a member-wise copy, and it also solves the problem of warning when a partially-initialized POD struct is copied. Before: CGPoint p; p.x = 0; CGPoint p2 = p; <-- assigned value is garbage or undefined After: CGPoint p; p.x = 0; CGPoint p2 = p; // no-warning This matches our behavior in C, where we don't see a field-by-field copy. <rdar://problem/12305288> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173951 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] C++ initializers may require cleanups; look through these.Jordan Rose
When the analyzer sees an initializer, it checks if the initializer contains a CXXConstructExpr. If so, it trusts that the CXXConstructExpr does the necessary work to initialize the object, and performs no further initialization. This patch looks through any implicit wrapping expressions like ExprWithCleanups to find the CXXConstructExpr inside. Fixes PR15070. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173557 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] Track null object lvalues back through C++ method calls.Jordan Rose
The expression 'a->b.c()' contains a call to the 'c' method of 'a->b'. We emit an error if 'a' is NULL, but previously didn't actually track the null value back through the 'a->b' expression, which caused us to miss important false-positive-suppression cases, including <rdar://problem/12676053>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173547 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] bugreporter::getDerefExpr now takes a Stmt, not an ExplodedNode.Jordan Rose
This allows it to be used in places where the interesting statement doesn't match up with the current node. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173546 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] Add 'prune-paths' config option to disable path pruning.Jordan Rose
This should be used for testing only. Path pruning is still on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173545 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-26[analyzer] Rename PruneNullReturnPaths to SuppressNullReturnPaths.Jordan Rose
"Prune" is the term for eliminating pieces of a path that are not relevant to the user. "Suppress" means don't show that path at all. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173544 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] Add "-analyzer-config mode=[deep|shallow] ".Anna Zaks
The idea is to introduce a higher level "user mode" option for different use scenarios. For example, if one wants to run the analyzer for a small project each time the code is built, they would use the "shallow" mode. The user mode option will influence the default settings for the lower-level analyzer options. For now, this just influences the ipa modes, but we plan to find more optimal settings for them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173386 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] Replace "-analyzer-ipa" with "-analyzer-config ipa".Anna Zaks
The idea is to eventually place all analyzer options under "analyzer-config". In addition, this lays the ground for introduction of a high-level analyzer mode option, which will influence the default setting for IPAMode. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173385 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-24[analyzer] refactor: access IPAMode through the accessor.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173384 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-23Add missing null check. Not sure why my tests passed before.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173292 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-23Honor attribute 'analyzer_noreturn' on Objective-C methods.Ted Kremenek
This isn't likely a full solution, but it catches the common cases and can be refined over time. Fixes <rdar://problem/11634353>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173291 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-21[analyzer] Show notes inside implicit calls at the last explicit call site.Jordan Rose
Before: struct Wrapper { <-- 2. Calling default constructor for 'NonTrivial'. NonTrivial m; }; Wrapper w; <-- 1. Calling implicit default constructor for 'Wrapper'. After: struct Wrapper { NonTrivial m; }; Wrapper w; <-- 1. Calling implicit default constructor for 'Wrapper'. ^-- 2. Calling default constructor for 'NonTrivial'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173067 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-20Implement OpenCL event_t as Clang builtin type, including event_t related ↵Guy Benyei
OpenCL restrictions (OpenCL 1.2 spec 6.9) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172973 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-19[analyzer] Don't show "Entered 'foo'" if 'foo' is implicit.Jordan Rose
Before: Calling implicit default constructor for 'Foo' (where Foo is constructed) Entered call from 'test' (at "=default" or 'Foo' declaration) Calling default constructor for 'Bar' (at "=default" or 'Foo' declaration) After: Calling implicit default constructor for 'Foo' (where Foo is constructed) Calling default constructor for 'Bar' (at "=default" or 'Foo' declaration) This only affects the plist diagnostics; this note is never shown in the other diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172915 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-19[analyzer] Suppress warnings coming out of macros defined in sys/queue.hAnna Zaks
Suppress the warning by just not emitting the report. The sink node would get generated, which is fine since we did reach a bad state. Motivation Due to the way code is structured in some of these macros, we do not reason correctly about it and report false positives. Specifically, the following loop reports a use-after-free. Because of the way the code is structured inside of the macro, the analyzer assumes that the list can have cycles, so you end up with use-after-free in the loop, that is safely deleting elements of the list. (The user does not have a way to teach the analyzer about shape of data structures.) SLIST_FOREACH_SAFE(item, &ctx->example_list, example_le, tmpitem) { if (item->index == 3) { // if you remove each time, no complaints assert((&ctx->example_list)->slh_first == item); SLIST_REMOVE(&ctx->example_list, item, example_s, example_le); free(item); } } git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172883 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-18[analyzer] Special path notes for C++ special member functions.Jordan Rose
Examples: Calling implicit default constructor for Foo Calling defaulted move constructor for Foo Calling copy constructor for Foo Calling implicit destructor for Foo Calling defaulted move assignment operator for Foo Calling copy assignment operator for Foo git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172833 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-18[analyzer] Do a better job describing C++ member functions in the call stack.Jordan Rose
Examples: Calling constructor for 'Foo' Entered call from 'Foo::create' git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172832 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-17[analyzer] DirectIvarAssignment: allow suppression annotation on Ivars.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172766 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-17Implement C++11 semantics for [[noreturn]] attribute. This required splittingRichard Smith
it apart from [[gnu::noreturn]] / __attribute__((noreturn)), since their semantics are not equivalent (for instance, we treat [[gnu::noreturn]] as affecting the function type, whereas [[noreturn]] does not). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172691 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-16Rework the traversal of Objective-C categories and extensions toDouglas Gregor
consider (sub)module visibility. The bulk of this change replaces myriad hand-rolled loops over the linked list of Objective-C categories/extensions attached to an interface declaration with loops using one of the four new category iterator kinds: visible_categories_iterator: Iterates over all visible categories and extensions, hiding any that have their "hidden" bit set. This is by far the most commonly used iterator. known_categories_iterator: Iterates over all categories and extensions, ignoring the "hidden" bit. This tends to be used for redeclaration-like traversals. visible_extensions_iterator: Iterates over all visible extensions, hiding any that have their "hidden" bit set. known_extensions_iterator: Iterates over all extensions, whether they are visible to normal name lookup or not. The effect of this change is that any uses of the visible_ iterators will respect module-import visibility. See the new tests for examples. Note that the old accessors for categories and extensions are gone; there are *Raw() forms for some of them, for those (few) areas of the compiler that have to manipulate the linked list of categories directly. This is generally discouraged. Part two of <rdar://problem/10634711>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172665 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-16[analyzer] Add an annotation to allow suppression of direct ivarAnna Zaks
assignment git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172597 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-16[analyzer] Fix warning typo.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172596 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-16[analyzer] Refactor: parameter rename.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172595 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-15Fix CastDavid Greene
Properly use const_cast to fix a cast-away-const error. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172561 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-14[analyzer] Add ProgramStatePartialTrait<const void *>.Jordan Rose
This should fix cast-away-const warnings reported by David Greene. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172446 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-14[analyzer] -drain is not an alias for -release.Jordan Rose
This was previously added to support -[NSAutoreleasePool drain], which behaves like -release under non-GC and "please collect" under GC. We're not currently modeling the autorelease pool stack, though, so we can just take this out entirely. Fixes PR14927. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172444 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-12Remove useless 'llvm::' qualifier from names like StringRef and others that areDmitri Gribenko
brought into 'clang' namespace by clang/Basic/LLVM.h git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172323 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Refine analyzer's handling of unary '!' and floating types to not assert.Ted Kremenek
Fixes PR 14634 and <rdar://problem/12903080>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172274 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11Correctly propagate uninitialized values within logical expressions.Ted Kremenek
Fixes assertion failure reported in PR 14635 and <rdar://problem/12902945> respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172263 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11[analyzer] Rename the warning: state the issue before the hint of how itAnna Zaks
can be fixed git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172170 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11[analyzer]Recognize ivar invalidation protocol even if it was redeclaredAnna Zaks
This will get rid of some false positives as well as false negatives. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172169 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-11[analyzer] Ivar invalidation: track ivars declared in categories.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172168 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-10[analyzer] Allow IvarInvalidation checker to suppress warnings viaAnna Zaks
assertions. To ensure that custom assertions/conditional would also be supported, just check if the ivar that needs to be invalidated or set to nil is compared against 0. Unfortunately, this will not work for code containing 'assert(IvarName)' git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172147 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-10[analyzer] Fix non-determinizm introduced in r172104.Anna Zaks
In some cases, we just pick any ivar that needs invalidation and attach the warning to it. Picking the first from DenseMap of pointer keys was triggering non-deterministic output. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172134 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-10[analyzer] Add more checks to the ObjC Ivar Invalidation checker.Anna Zaks
Restructured the checker so that it could easily find two new classes of issues: - when a class contains an invalidatable ivar, but no declaration of an invalidation method - when a class contains an invalidatable ivar, but no definition of an invalidation method in the @implementation. The second case might trigger some false positives, for example, when the method is defined in a category. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172104 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-09Do not model loads from complex types, since we don't accurately model the ↵Ted Kremenek
imaginary and real parts yet. Fixes false positive reported in <rdar://problem/12964481>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171987 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Only include uniqueling location as issue_hash when availableAnna Zaks
This makes us more optimistic when matching reports in a changing code base. Addresses Jordan's feedback for r171825. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171884 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Include the bug uniqueing location in the issue_hash.Anna Zaks
The issue here is that if we have 2 leaks reported at the same line for which we cannot print the corresponding region info, they will get treated as the same by issue_hash+description. We need to AUGMENT the issue_hash with the allocation info to differentiate the two issues. Add the "hash" (offset from the beginning of a function) representing allocation site to solve the issue. We might want to generalize solution in the future when we decide to track more than just the 2 locations from the diagnostics. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171825 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-08[analyzer] Plist: change the type of issue_hash from int to string.Anna Zaks
This gives more flexibility to what could be stored as issue_hash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171824 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-07[analyzer] Fix a false positive in Secure Keychain API checker.Anna Zaks
Better handle the blacklisting of known bad deallocators when symbol escapes through a call to CFStringCreateWithBytesNoCopy. Addresses radar://12702952. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171770 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-07[analyzer] Fix a false positive in the ivar invalidation checker.Anna Zaks
When a property is "inherited" through both a parent class and directly through a protocol, we should not require the child to invalidate it since the backing ivar belongs to the parent class. (Fixes radar://12913734) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171769 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-04NSErrorChecker: remove quoting the parameter name in the diagnostic until we ↵Ted Kremenek
actually include it's name. This is a possible regression of moving to using ImplicitNullDerefEvent. Fixing this for real (including the parameter name) requires more plumbing in ImplicitNullDerefEvent. This is just a stop gap fix. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171502 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-04Tighten code. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171501 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-03Make MallocChecker debug output useful.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171439 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-03[analyzer] Rename callback EndPath -> EndFunctionAnna Zaks
This better reflects when callback is called and what the checkers are relying on. (Both names meant the same pre-IPA.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171432 91177308-0d34-0410-b5e6-96231b3b80d8
2013-01-02Re-sort #include lines using the llvm/utils/sort_includes.py script.Chandler Carruth
Removes a duplicate #include as well as cleaning up some sort order regressions since I last ran the script over Clang. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171364 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-22Fix typo: objc_no_direct_instance_variable_assignmemt => ↵Ted Kremenek
objc_no_direct_instance_variable_assignment. Fixes <rdar://problem/12927551>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170971 91177308-0d34-0410-b5e6-96231b3b80d8
2012-12-22[analyzer] Convert SimpleStreamChecker to use the PointerEscape callbackAnna Zaks
The new callback greatly simplifies the checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170969 91177308-0d34-0410-b5e6-96231b3b80d8