aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-09-29[analyzer] Re-implement IvarInvalidationChecker so that it verifies thatAnna Zaks
the validation occurred. The original implementation was pessimistic - we assumed that ivars which escape are invalidated. This version is optimistic, it assumes that the ivars will always be explicitly invalidated: either set to nil or sent an invalidation message. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164868 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Handle inlined constructors for rvalue temporaries correctly.Jordan Rose
Previously the analyzer treated all inlined constructors like lvalues, setting the value of the CXXConstructExpr to the newly-constructed region. However, some CXXConstructExprs behave like rvalues -- in particular, the implicit copy constructor into a pass-by-value argument. In this case, we want only the /contents/ of a temporary object to be passed, so that we can use the same "copy each argument into the parameter region" algorithm that we use for scalar arguments. This may change when we start modeling destructors of temporaries, but for now this is the last part of <rdar://problem/12137950>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164830 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Create a temp region when a method is called on a struct rvalue.Jordan Rose
An rvalue has no address, but calling a C++ member function requires a 'this' pointer. This commit makes the analyzer create a temporary region in which to store the struct rvalue and use as a 'this' pointer whenever a member function is called on an rvalue, which is essentially what CodeGen does. More of <rdar://problem/12137950>. The last part is tracking down the C++ FIXME in array-struct-region.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164829 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Create a temporary region for rvalue structs when accessing fieldsJordan Rose
Struct rvalues are represented in the analyzer by CompoundVals, LazyCompoundVals, or plain ConjuredSymbols -- none of which have associated regions. If the entire structure is going to persist, this is not a problem -- either the rvalue will be assigned to an existing region, or a MaterializeTemporaryExpr will be present to create a temporary region. However, if we just need a field from the struct, we need to create the temporary region ourselves. This is inspired by the way CodeGen handles calls to temporaries; support for that in the analyzer is coming next. Part of <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164828 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Address Jordan's code review for r164790.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164803 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] IvarInvalidation: track synthesized ivars and allow escapeAnna Zaks
through property getters. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164802 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Unbreak cmake buildAnna Zaks
(fixup for r164790) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164791 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Add an experimental ObjC direct ivar assignment checker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164790 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Address Jordan's code review comments for r164716.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164788 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Revert 'Fix a typo 'iff' => 'if''. iff is an abreviation of if and only if. ↵Sylvestre Ledru
See: http://en.wikipedia.org/wiki/If_and_only_if Commit 164766 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164769 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Fix a typo 'iff' => 'if'Sylvestre Ledru
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164766 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27IvarInvalidationChecker.cpp: Remove an unused member, InterfD. ↵NAKAMURA Takumi
[-Wunused-private-field] git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164745 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26[analyzer] Add experimental ObjC invalidation method checker.Anna Zaks
This checker is annotation driven. It checks that the annotated invalidation method accesses all ivars of the enclosing objects that are objects of type, which in turn contains an invalidation method. This is driven by __attribute((annotation("objc_instance_variable_invalidator")). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164716 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Revert "Use sep instead of ' '."Ted Kremenek
This isn't correct, as Jordan correctly points out. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164711 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Use sep instead of ' '.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164709 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25Reapply "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose
removeDeadBindings." Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. This depends on the previous commit to be correct. Originally applied in r163444, reverted in r164275, now being re-applied. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164622 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25[analyzer] Calculate liveness for symbolic exprs as well as atomic symbols.Jordan Rose
No tests, but this allows the optimization of removing dead constraints. We can then add tests that we don't do this prematurely. <rdar://problem/12333297> Note: the added FIXME to investigate SymbolRegionValue liveness is tracked by <rdar://problem/12368183>. This patch does not change the existing behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164621 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25[analyzer] Fix a buildbot crash triggered by turning on dynamicAnna Zaks
dispatch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164579 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-24[analyzer]Prevent infinite recursion(assume->checker:evalAssume->assume)Anna Zaks
(Unfortunately, I do not have a good reduced test case for this.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164541 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Suppress bugs whose paths go through the return of a null pointer.Jordan Rose
This is a heuristic intended to greatly reduce the number of false positives resulting from inlining, particularly inlining of generic, defensive C++ methods that live in header files. The suppression is triggered in the cases where we ask to track where a null pointer came from, and it turns out that the source of the null pointer was an inlined function call. This change brings the number of bug reports in LLVM from ~1500 down to around ~300, a much more manageable number. Yes, some true positives may be hidden as well, but from what I looked at the vast majority of silenced reports are false positives, and many of the true issues found by the analyzer are still reported. I'm hoping to improve this heuristic further by adding some exceptions next week (cases in which a bug should still be reported). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164449 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Track a null value back through FindLastStoreBRVisitor.Jordan Rose
Also, tidy up the other tracking visitors so that they mark the right things as interesting and don't do extra work. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164448 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Always allow BugReporterVisitors to see the bug path.Jordan Rose
Before, PathDiagnosticConsumers that did not support actual path output would (sensibly) cause the generation of the full path to be skipped. However, BugReporterVisitors may want to see the path in order to mark a BugReport as invalid. Now, even for a path generation scheme of 'None' we will still create a trimmed graph and walk backwards through the bug path, doing no work other than passing the nodes to the BugReporterVisitors. This isn't cheap, but it's necessary to properly do suppression when the first path consumer does not support path notes. In the future, we should try only generating the path and visitor-provided path notes once, or at least only creating the trimmed graph once. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164447 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Allow a BugReport to be marked "invalid" during path generation.Jordan Rose
This is intended to allow visitors to make decisions about whether a BugReport is likely a false positive. Currently there are no visitors making use of this feature, so there are no tests. When a BugReport is marked invalid, the invalidator must provide a key that identifies the invaliation (intended to be the visitor type and a context pointer of some kind). This allows us to reverse the decision later on. Being able to reverse a decision about invalidation gives us more flexibility, and allows us to formulate conditions like "this report is invalid UNLESS the original argument is 'foo'". We can use this to fine-tune our false-positive suppression (coming soon). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Look through OpaqueValueExprs when tracking a nil value.Jordan Rose
This allows us to show /why/ a particular object is nil, even when it is wrapped in an OpaqueValueExpr. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164445 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Better path notes for null pointers passed as arguments.Jordan Rose
Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164444 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22Use llvm::getOrdinalSuffix to print ordinal numbers in diagnostics.Jordan Rose
Just a refactoring of common infrastructure. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164443 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Check that an ObjCIvarRefExpr's base is non-null even as an lvalue.Jordan Rose
Like with struct fields, we want to catch cases like this early, so that we can produce better diagnostics and path notes: PointObj *p = nil; int *px = &p->_x; // should warn here *px = 1; git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164442 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Check that a member expr is valid even when the result is an lvalue.Jordan Rose
We want to catch cases like this early, so that we can produce better diagnostics and path notes: Point *p = 0; int *px = &p->x; // should warn here *px = 1; git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164441 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Re-enable faux-bodies by default.Ted Kremenek
Try this again, now that r164392 is in place. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164393 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Revert r164364, "Flip "faux-bodies" in the analyzer on by default to flush ↵NAKAMURA Takumi
out bugs." It crashed test/Analysis/Output/blocks.m on some hosts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164368 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Flip "faux-bodies" in the analyzer on by default to flush out bugs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164364 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Simplify getRuntimeDefinition() back to taking no arguments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164363 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Implement faux-body-synthesis of well-known functions in the static analyzer ↵Ted Kremenek
when their implementations are unavailable. Start by simulating dispatch_sync(). This change is largely a bunch of plumbing around something very simple. We use AnalysisDeclContext to conjure up a fake function body (using the current ASTContext) when one does not exist. This is controlled under the analyzer-config option "faux-bodies", which is off by default. The plumbing in this patch is largely to pass the necessary machinery around. CallEvent needs the AnalysisDeclContextManager to get the function definition, as one may get conjured up lazily. BugReporter and PathDiagnosticLocation needed to be relaxed to handle invalid locations, as the conjured body has no real source locations. We do some primitive recovery in diagnostic generation to generate some reasonable locations (for arrows and events), but it can be improved. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164339 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-20[analyzer] MallocChecker should not do post-call checks on inlined functions.Jordan Rose
If someone provides their own function called 'strdup', or 'reallocf', or even 'malloc', and we inlined it, the inlining should have given us all the malloc-related information we need. If we then try to attach new information to the return value, we could end up with spurious warnings. <rdar://problem/12317671> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164276 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-20Revert "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose
removeDeadBindings." While we definitely want this optimization in the future, we're not currently handling constraints on symbolic /expressions/ correctly. These should stay live even if the SymExpr itself is no longer referenced because could recreate an identical SymExpr later. Only once the SymExpr can no longer be recreated -- i.e. a component symbol is dead -- can we safely remove the constraints on it. This liveness issue is tracked by <rdar://problem/12333297>. This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164275 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-17[analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks
in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164046 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13Fix grammar.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163828 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13When warning about unsafe uses of dispatch_once, specially handle theTed Kremenek
crazy case where dispatch_once gets redefined as a macro that calls _dispatch_once (which calls the real dispatch_once). Users want to see the warning in their own code. Fixes <rdar://problem/11617767> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163816 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13[analyzer] Don't reimplement an existing function.Anna Zaks
Thanks Jordan. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163762 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13Refactor logic in ExprEngine for detecting 'noreturn' methodsTed Kremenek
in NSException to a helper object in libAnalysis that can also be used by Sema. Not sure if the predicate name 'isImplicitNoReturn' is the best one, but we can massage that later. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163759 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Do not report use of undef on "return foo();" when the return ↵Anna Zaks
type is void. Fixes a false positive found by analyzing LLVM code base. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163750 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Fix another false positive in malloc realloc logic.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163749 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163748 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Fix another use of the address of a temporary, like r163402.Jordan Rose
Again, GCC is more aggressive about reusing temporary space than we are, leading to Release build crashes for this undefined behavior. PR13710 (though it may not be the only problem there) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163747 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Handle when the dynamic type is worse than the static type.Jordan Rose
Currently we don't update the dynamic type of a C++ object when it is cast. This can cause the situation above, where the static type of the region is now known to be a subclass of the dynamic type. Once we start updating DynamicTypeInfo in response to the various kinds of casts in C++, we can re-add this assert to make sure we don't miss any cases. This work is tracked by <rdar://problem/12287087>. In -Asserts builds, we will simply not return any runtime definition when our DynamicTypeInfo is known to be incorrect like this. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163745 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12Revert "[analyzer] Use the static type for a virtual call if the dynamic ↵Jordan Rose
type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12Fix regression where "looping back to the head of" PathDiagnosticEventsTed Kremenek
were not emitted. Fixes <rdar://problem/12280665>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163683 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12PR13811: Add a FunctionParmPackExpr node to handle references to functionRichard Smith
parameter packs where the reference is not being expanded but the pack has been. Previously, Clang would segfault in such cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163672 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11Revert "[analyzer] Disable STL inlining. Blocked by PR13724."Jordan Rose
While PR13724 is still an issue, it's not actually an issue in the STL. We can keep this option around in case there turn out to be widespread false positives due to poor modeling of the C++ standard library functions, but for now we'd like to get more data. This reverts r163633 / c6baadceec1d5148c20ee6c902a102233c547f62. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163647 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-23 16:59:00 +0000