aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-11-05[analyzer] Move convenience REGISTER_*_WITH_PROGRAMSTATE to CheckerContext.hJordan Rose
As Anna pointed out, ProgramStateTrait.h is a relatively obscure header, and checker writers may not know to look there to add their own custom state. The base macro that specializes the template remains in ProgramStateTrait.h (REGISTER_TRAIT_WITH_PROGRAMSTATE), which allows the analyzer core to keep using it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167385 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-03StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp: Appease msvc.NAKAMURA Takumi
0 (as nullptr) is incompatible to pointer in type matching on msvc. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167355 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-03[analyzer] Run remove dead on end of path.Anna Zaks
This will simplify checkers that need to register for leaks. Currently, they have to register for both: check dead and check end of path. I've modified the SymbolReaper to consider everything on the stack dead if the input StackLocationContext is 0. (This is a bit disruptive, so I'd like to flash out all the issues asap.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167352 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-03[analyzer] add LocationContext::inTopFrame() helper.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167351 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-03[analyzer] Refactor: Remove Pred from NodeBuilderContext.Anna Zaks
Node builders should manage the nodes, not the context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167350 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Convert SimpleStreamChecker over to CallEvent.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167340 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] CheckerDocumentation: Change examples for PreStmt and PostStmt.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167339 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Add some convenience accessors to CallEvent, and use them.Jordan Rose
These are CallEvent-equivalents of helpers already accessible in CheckerContext, as part of making it easier for new checkers to be written using CallEvent rather than raw CallExprs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167338 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] isCLibraryFunction: check that the function is at TU-scope.Jordan Rose
Also, Decls already carry a pointer to the ASTContext, so there's no need to pass an extra argument to the predicate. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167337 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Factor SimpleStreamChecker pulling out isLeaked().Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167316 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Convert some of the harder cases over to ProgramStateTrait macros.Jordan Rose
Add FIXMEs for the traits visible from multiple translation units. Currently the macros hide their key types in an anonymous namespace. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167277 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose
Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167276 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-02[analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167275 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-01[analyzer] Fix typo in r167186.Jordan Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167189 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-01[analyzer] Minor cleanup in SimpleStreamChecker's class definition.Jordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167187 91177308-0d34-0410-b5e6-96231b3b80d8
2012-11-01[analyzer] Rename ConditionTruthVal::isTrue to isConstrainedTrue.Jordan Rose
(and the same for isFalse) No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167186 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-31[analyzer] Fix a bug in SimpleStreamChecker - return after sink.Anna Zaks
Thanks Ted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167176 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-31[analyzer] Let ConstraintManager subclasses provide a more efficient checkNull.Jordan Rose
Previously, every call to a ConstraintManager's isNull would do a full assumeDual to test feasibility. Now, ConstraintManagers can override checkNull if they have a cheaper way to do the same thing. RangeConstraintManager can do this in less than half the work. <rdar://problem/12608209> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167138 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-31[analyzer] SimpleStreamChecker - remove evalAssume and other refinementsAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167099 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-31[analyzer]Don't invalidate const arguments when there is noAnna Zaks
IdentifierInfo. Ee: C++ copy constructors. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167092 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30Trim #includes.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167002 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30[analyzer]SimpleStreamChecker: add a TODO for better leak report.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167001 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30[analyzer] Fix a bug in REGISTER_MAP_WITH_PROGRAMSTATEAnna Zaks
The ImmutableMap should not be the key into the GDM map as there could be several entries with the same map type. Thanks, Jordan. This complicates the usage of the macro a bit. When we want to retrieve the whole map, we need to use another name. Currently, I set it to be Name ## Ty as in "type of the map we are storing in the ProgramState". git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167000 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30[analyzer] Rename REGISTER_MAP_WITH_GDM ->REGISTER_MAP_WITH_PROGRAMSTATEAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166999 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30[analyzer] Warn about reallocf with an allocation size of 0, like realloc.Jordan Rose
Patch by Sean McBride! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166995 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-30[analyzer] New checker for missing super calls in UIViewController subclasses.Jordan Rose
This is a syntactic checker aimed at helping iOS programmers correctly subclass and override the methods of UIViewController. While this should eventually be covered by the 'objc_requires_super' attribute, this checker can be used with the existing iOS SDKs without any header changes. This new checker is currently named 'alpha.osx.cocoa.MissingSuperCall'. Patch by Julian Mayer! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166993 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-29[analyzer] Malloc checker cleanup/refactorAnna Zaks
No need for the auxiliary flag. No need to generate a leak node when there is no error. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166977 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-29[analyzer] Add SimpleStreamChecker.Anna Zaks
This is an example checker for catching fopen fclose API misuses. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166976 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-29[analyzer] Add checker helpers to CheckerContext.Anna Zaks
- Adding Immutable Map to GDM and getIdentifierInfo helper method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166975 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-29[analyzer] New option to not suppress null return paths if an argument is null.Jordan Rose
Our one basic suppression heuristic is to assume that functions do not usually return NULL. However, when one of the arguments is NULL it is suddenly much more likely that NULL is a valid return value. In this case, we don't suppress the report here, but we do attach /another/ visitor to go find out if this NULL argument also comes from an inlined function's error path. This new behavior, controlled by the 'avoid-suppressing-null-argument-paths' analyzer-config option, is turned off by default. Turning it on produced two false positives and no new true positives when running over LLVM/Clang. This is one of the possible refinements to our suppression heuristics. <rdar://problem/12350829> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166941 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-29[analyzer] Use the CallEnter node to get a value for tracked null arguments.Jordan Rose
Additionally, don't collect PostStore nodes -- they are often used in path diagnostics. Previously, we tried to track null arguments in the same way as any other null values, but in many cases the necessary nodes had already been collected (a memory optimization in ExplodedGraph). Now, we fall back to using the value of the argument at the time of the call, which may not always match the actual contents of the region, but often will. This is a precursor to improving our suppression heuristic. <rdar://problem/12350829> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166940 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-26Add comments for RemoveRedundantMsgs, rename it to removeRedundantMsgs() per ↵Ted Kremenek
Jordan's feedback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166778 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-25TrackConstraintBRVisitor and ConditionBRVisitor can emit similarTed Kremenek
path notes for cases where a value may be assumed to be null, etc. Instead of having redundant diagnostics, do a pass over the generated PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor that are already covered by ConditionBRVisitor, whose notes tend to be better. Fixes <rdar://problem/12252783> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166728 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-23[analyzer] Handle 'SomeVar.SomeEnumConstant', which is legal in C++.Jordan Rose
This caused assertion failures analyzing LLVM. <rdar://problem/12560282> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166529 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-23[analyzer] Replace -analyzer-no-eagerly-trim-egraph with graph-trim-interval.Jordan Rose
After every 1000 CFGElements processed, the ExplodedGraph trims out nodes that satisfy a number of criteria for being "boring" (single predecessor, single successor, and more). Rather than controlling this with a cc1 option, which can only disable this behavior, we now have an analyzer-config option, 'graph-trim-interval', which can change this interval from 1000 to something else. Setting the value to 0 disables reclamation. The next commit relies on this behavior to actually test anything. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166528 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-20[analyzer] Assume 'new' never returns NULL if it could throw an exception.Jordan Rose
This is actually required by the C++ standard in [basic.stc.dynamic.allocation]p3: If an allocation function declared with a non-throwing exception-specification fails to allocate storage, it shall return a null pointer. Any other allocation function that fails to allocate storage shall indicate failure only by throwing an exception of a type that would match a handler of type std::bad_alloc. We don't bother checking for the specific exception type, but just go off the operator new prototype. This should help with a certain class of lazy initalization false positives. <rdar://problem/12115221> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166363 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-18[analyzer] Ivar invalidation: identify properties declared in protocols.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-17[analyzer] When binding to a ParenExpr, bind to its inner expression instead.Jordan Rose
This actually looks through several kinds of expression, such as OpaqueValueExpr and ExprWithCleanups. The idea is that binding and lookup should be consistent, and so if the environment needs to be modified later, the code doing the modification will not have to manually look through these "transparent" expressions to find the real binding to change. This is necessary for proper updating of struct rvalues as described in the previous commit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166121 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-17[analyzer] Create a temporary region when accessing a struct rvalue.Jordan Rose
In C++, rvalues that need to have their address taken (for example, to be passed to a function by const reference) will be wrapped in a MaterializeTemporaryExpr, which lets CodeGen know to create a temporary region to store this value. However, MaterializeTemporaryExprs are /not/ created when a method is called on an rvalue struct, even though the 'this' pointer needs a valid value. CodeGen works around this by creating a temporary region anyway; now, so does the analyzer. The analyzer also does this when accessing a field of a struct rvalue. This is a little unfortunate, since the rest of the struct will soon be thrown away, but it does make things consistent with the rest of the analyzer. This allows us to bring back the assumption that all known 'this' values are Locs. This is a revised version of r164828-9, reverted in r164876-7. <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166120 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-16[analyzer] Ivar Invalidation: track ivars in continuations andAnna Zaks
@implementation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166047 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-16[analyzer] ObjCContainersASTChecker: minor cleanup and an extra test case.Jordan Rose
Follow-up to r165838, which fixed a potential crash. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166002 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-15[analyzer] Embed the analyzer version into the plist output.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165994 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-15[analyzer] Enhance the error message.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165993 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-15[analyzer] Do not warn on direct ivar assignments within copy methods.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165992 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-13[analyzer] Remove the "direct bindings only" Environment lookup.Jordan Rose
This was only used by OSAtomicChecker and makes it more difficult to update values for expressions that the environment may look through instead (it's not the same as IgnoreParens). With this gone, we can have bindExpr bind to the inner expression that getSVal will find. Groundwork for <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165866 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-13[analyzer] Remove unneeded 'inlineCall' checker callback.Jordan Rose
I believe the removed assert in CheckerManager says it best: InlineCall is a special hacky callback to allow intrusive evaluation of the call (which simulates inlining). It is currently only used by OSAtomicChecker and should go away at some point. OSAtomicChecker has gone away; inlineCall can now go away as well! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165865 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-12Move assertion to not crash tests.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165842 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-12Silence static analyzer issue by documenting that in this contextTed Kremenek
that a DeclRefExpr can never return a null decl. We possibly should hoist this into getDecl() itself. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165841 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-12Silence null dereference warnings by documenting context-specificTed Kremenek
invariants using assertions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165840 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-12Fix potential crash in ObjCContainersChecker by properly validatingTed Kremenek
the number of arguments. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165838 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-06-24 03:23:30 +0000