aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-10-11Remove OSAtomicChecker.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-11Switch over to BodyFarm implementation of OSAtomicCompareAndSwap andTed Kremenek
objc_atomicCompareAndSwap. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165743 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-10Reapply "[analyzer] Treat fields of unions as having symbolic offsets."Jordan Rose
This time, actually uncomment the code that's supposed to fix the problem. This reverts r165671 / 8ceb837585ed973dc36fba8dfc57ef60fc8f2735. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165676 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-10Temporarily Revert "[analyzer] Treat fields of unions as having symbolic ↵Eric Christopher
offsets." Author: Jordan Rose <jordan_rose@apple.com> Date: Wed Oct 10 21:31:21 2012 +0000 [analyzer] Treat fields of unions as having symbolic offsets. This allows only one field to be active at a time in RegionStore. This isn't quite the correct behavior for unions, but it at least would handle the case of "value goes in, value comes out" from the same field. RegionStore currently has a number of places where any access to a union results in UnknownVal being returned. However, it is clearly missing some cases, or the original issue wouldn't have occurred. It is probably now safe to remove those changes, but that's a potentially destabilizing change that should wait for more thorough testing. Fixes PR14054. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165660 91177308-0d34-0410-b5e6-96231b3b80d8 This reverts commit cf9030e480f77ab349672f00ad302e216c26c92c. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165671 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-10[analyzer] Treat fields of unions as having symbolic offsets.Jordan Rose
This allows only one field to be active at a time in RegionStore. This isn't quite the correct behavior for unions, but it at least would handle the case of "value goes in, value comes out" from the same field. RegionStore currently has a number of places where any access to a union results in UnknownVal being returned. However, it is clearly missing some cases, or the original issue wouldn't have occurred. It is probably now safe to remove those changes, but that's a potentially destabilizing change that should wait for more thorough testing. Fixes PR14054. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165660 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-10[analyzer] Don't run non-path-sensitive checks on system headers...Jordan Rose
...but do run them on user headers. Previously, we were inconsistent here: non-path-sensitive checks on code /bodies/ were only run in the main source file, but checks on /declarations/ were run in /all/ headers. Neither of those is the behavior we want. Thanks to Sujit for pointing this out! <rdar://problem/12454226> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165635 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-10[analyzer] Fix typo: s/HandleDeclsGallGraph/HandleDeclsCallGraph/gJordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165634 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-06[analyzer] Handle implicit statements used for end-of-path nodes' source locs.Jordan Rose
Some implicit statements, such as the implicit 'self' inserted for "free" Objective-C ivar access, have invalid source locations. If one of these statements is the location where an issue is reported, we'll now look at the enclosing statements for a valid source location. <rdar://problem/12446776> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165354 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03[analyzer] Adjust the return type of an inlined devirtualized method call.Jordan Rose
In C++, overriding virtual methods are allowed to specify a covariant return type -- that is, if the return type of the base method is an object pointer type (or reference type), the overriding method's return type can be a pointer to a subclass of the original type. The analyzer was failing to take this into account when devirtualizing a method call, and anything that relied on the return value having the proper type later would crash. In Objective-C, overriding methods are allowed to specify ANY return type, meaning we can NEVER be sure that devirtualizing will give us a "safe" return value. Of course, a program that does this will most likely crash at runtime, but the analyzer at least shouldn't crash. The solution is to check and see if the function/method being inlined is the function that static binding would have picked. If not, check that the return value has the same type. If the types don't match, see if we can fix it with a derived-to-base cast (the C++ case). If we can't, return UnknownVal to avoid crashing later. <rdar://problem/12409977> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165079 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03[analyzer] Push evalDynamicCast and evalDerivedToBase up to Store.Jordan Rose
These functions are store-agnostic, and would benefit from information in DynamicTypeInfo but gain nothing from the store type. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-03Teach getCXXRecordDeclForPointerType about references.Jordan Rose
Then, rename it getPointeeCXXRecordDecl and give it a nice doc comment, and actually use it. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165077 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-02Silence -Wunused-value warning.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165059 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-02Refactor clients of AnalyzerOptions::getBooleanOption() to haveTed Kremenek
an intermediate helper method to query and populate the Optional value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165043 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-02Tweak AnalyzerOptions::getOptionAsInteger() to populate the stringTed Kremenek
table, making it printable with the ConfigDump checker. Along the way, fix a really serious bug where the value was getting parsed from the string in code that was in an assert() call. This means in a Release-Asserts build this code wouldn't work as expected. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165041 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-02Change AnalyzerOptions::mayInlineCXXMemberFunction to default populateTed Kremenek
the config string table. Also setup a test for dumping the analyzer configuration for C++. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165040 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Move isObjCSelf into Expr.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164966 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01[analyzer] Address Jordan's review for r164868.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164965 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01[analyzer] Allow ObjC ivar lvalues where the base is nil.Jordan Rose
By analogy with C structs, this seems to be legal, if probably discouraged. It's only if the ivar is read from or written to that there's a problem. Running a program that gets the "address" of an instance variable does in fact return the offset when the base "object" is nil. This isn't a full revert because r164442 includes some diagnostic tweaks as well; those have been kept. This partially reverts r164442 / 08965091770c9b276c238bac2f716eaa4da2dca4. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164960 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Revert "[analyzer] Check that a member expr is valid even when the result is ↵Jordan Rose
an lvalue." The original intent of this commit was to catch potential null dereferences early, but it breaks the common "home-grown offsetof" idiom (PR13927): (((struct Foo *)0)->member - ((struct foo *)0)) As it turns out, this appears to be legal in C, per a footnote in C11 6.5.3.2: "Thus, &*E is equivalent to E (even if E is a null pointer)". In C++ this issue is still open: http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_active.html#232 We'll just have to make sure we have good path notes in the future. This reverts r164441 / 9be016dcd1ca3986873a7b66bd4bc027309ceb59. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164958 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Have AnalyzerOptions::getBooleanOption() stick the matching configTed Kremenek
string in the config table so that it can be dumped as part of the config dumper. Add a test to show that these options are sticking and can be cross-checked using FileCheck. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164954 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Add checker debug.ConfigDumper to dump the contents of the configuration table.Ted Kremenek
The format of this output is a WIP; largely I'm bringing it up now for regression testing. We can evolve the output format over time. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164953 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01Reapply "[analyzer] Handle inlined constructors for rvalue temporaries ↵Jordan Rose
correctly." This is related to but not blocked by <rdar://problem/12137950> ("Return-by-value structs do not have associated regions") This reverts r164875 / 3278d41e17749dbedb204a81ef373499f10251d7. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164952 91177308-0d34-0410-b5e6-96231b3b80d8
2012-10-01[analyzer] Make ProgramStateManager's SubEngine parameter optional.Jordan Rose
It is possible and valid to have a state manager and associated objects without having a SubEngine or checkers. Patch by Olaf Krzikalla! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164947 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29Revert "[analyzer] Create a temporary region for rvalue structs when ↵Jordan Rose
accessing fields" This reverts commit 6f61df3e7256413dcb99afb9673f4206e3c4992c. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164877 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29Revert "[analyzer] Create a temp region when a method is called on a struct ↵Jordan Rose
rvalue." This reverts commit 0006ba445962621ed82ec84400a6b978205a3fbc. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164876 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29Revert "[analyzer] Handle inlined constructors for rvalue temporaries ↵Jordan Rose
correctly." This reverts commit 580cd17f256259f39a382e967173f34d68e73859. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164875 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29[analyzer] Do not visit ObjCMethodDecl twice in the AST checkers.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164869 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-29[analyzer] Re-implement IvarInvalidationChecker so that it verifies thatAnna Zaks
the validation occurred. The original implementation was pessimistic - we assumed that ivars which escape are invalidated. This version is optimistic, it assumes that the ivars will always be explicitly invalidated: either set to nil or sent an invalidation message. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164868 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Handle inlined constructors for rvalue temporaries correctly.Jordan Rose
Previously the analyzer treated all inlined constructors like lvalues, setting the value of the CXXConstructExpr to the newly-constructed region. However, some CXXConstructExprs behave like rvalues -- in particular, the implicit copy constructor into a pass-by-value argument. In this case, we want only the /contents/ of a temporary object to be passed, so that we can use the same "copy each argument into the parameter region" algorithm that we use for scalar arguments. This may change when we start modeling destructors of temporaries, but for now this is the last part of <rdar://problem/12137950>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164830 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Create a temp region when a method is called on a struct rvalue.Jordan Rose
An rvalue has no address, but calling a C++ member function requires a 'this' pointer. This commit makes the analyzer create a temporary region in which to store the struct rvalue and use as a 'this' pointer whenever a member function is called on an rvalue, which is essentially what CodeGen does. More of <rdar://problem/12137950>. The last part is tracking down the C++ FIXME in array-struct-region.cpp. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164829 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-28[analyzer] Create a temporary region for rvalue structs when accessing fieldsJordan Rose
Struct rvalues are represented in the analyzer by CompoundVals, LazyCompoundVals, or plain ConjuredSymbols -- none of which have associated regions. If the entire structure is going to persist, this is not a problem -- either the rvalue will be assigned to an existing region, or a MaterializeTemporaryExpr will be present to create a temporary region. However, if we just need a field from the struct, we need to create the temporary region ourselves. This is inspired by the way CodeGen handles calls to temporaries; support for that in the analyzer is coming next. Part of <rdar://problem/12137950> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164828 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Address Jordan's code review for r164790.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164803 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] IvarInvalidation: track synthesized ivars and allow escapeAnna Zaks
through property getters. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164802 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Unbreak cmake buildAnna Zaks
(fixup for r164790) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164791 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Add an experimental ObjC direct ivar assignment checker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164790 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27[analyzer] Address Jordan's code review comments for r164716.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164788 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Revert 'Fix a typo 'iff' => 'if''. iff is an abreviation of if and only if. ↵Sylvestre Ledru
See: http://en.wikipedia.org/wiki/If_and_only_if Commit 164766 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164769 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27Fix a typo 'iff' => 'if'Sylvestre Ledru
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164766 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-27IvarInvalidationChecker.cpp: Remove an unused member, InterfD. ↵NAKAMURA Takumi
[-Wunused-private-field] git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164745 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26[analyzer] Add experimental ObjC invalidation method checker.Anna Zaks
This checker is annotation driven. It checks that the annotated invalidation method accesses all ivars of the enclosing objects that are objects of type, which in turn contains an invalidation method. This is driven by __attribute((annotation("objc_instance_variable_invalidator")). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164716 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Revert "Use sep instead of ' '."Ted Kremenek
This isn't correct, as Jordan correctly points out. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164711 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Use sep instead of ' '.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164709 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-26Remove unnecessary ASTContext& parameter from SymExpr::getType().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25Reapply "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose
removeDeadBindings." Previously, we'd just keep constraints around forever, which means we'd never be able to merge paths that differed only in constraints on dead symbols. Because we now allow constraints on symbolic expressions, not just single symbols, this requires changing SymExpr::symbol_iterator to include intermediate symbol nodes in its traversal, not just the SymbolData leaf nodes. This depends on the previous commit to be correct. Originally applied in r163444, reverted in r164275, now being re-applied. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164622 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25[analyzer] Calculate liveness for symbolic exprs as well as atomic symbols.Jordan Rose
No tests, but this allows the optimization of removing dead constraints. We can then add tests that we don't do this prematurely. <rdar://problem/12333297> Note: the added FIXME to investigate SymbolRegionValue liveness is tracked by <rdar://problem/12368183>. This patch does not change the existing behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164621 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-25[analyzer] Fix a buildbot crash triggered by turning on dynamicAnna Zaks
dispatch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164579 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-24[analyzer]Prevent infinite recursion(assume->checker:evalAssume->assume)Anna Zaks
(Unfortunately, I do not have a good reduced test case for this.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164541 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Suppress bugs whose paths go through the return of a null pointer.Jordan Rose
This is a heuristic intended to greatly reduce the number of false positives resulting from inlining, particularly inlining of generic, defensive C++ methods that live in header files. The suppression is triggered in the cases where we ask to track where a null pointer came from, and it turns out that the source of the null pointer was an inlined function call. This change brings the number of bug reports in LLVM from ~1500 down to around ~300, a much more manageable number. Yes, some true positives may be hidden as well, but from what I looked at the vast majority of silenced reports are false positives, and many of the true issues found by the analyzer are still reported. I'm hoping to improve this heuristic further by adding some exceptions next week (cases in which a bug should still be reported). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164449 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Track a null value back through FindLastStoreBRVisitor.Jordan Rose
Also, tidy up the other tracking visitors so that they mark the right things as interesting and don't do extra work. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164448 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Always allow BugReporterVisitors to see the bug path.Jordan Rose
Before, PathDiagnosticConsumers that did not support actual path output would (sensibly) cause the generation of the full path to be skipped. However, BugReporterVisitors may want to see the path in order to mark a BugReport as invalid. Now, even for a path generation scheme of 'None' we will still create a trimmed graph and walk backwards through the bug path, doing no work other than passing the nodes to the BugReporterVisitors. This isn't cheap, but it's necessary to properly do suppression when the first path consumer does not support path notes. In the future, we should try only generating the path and visitor-provided path notes once, or at least only creating the trimmed graph once. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164447 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-07 14:28:27 +0000