aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-09-22[analyzer] Allow a BugReport to be marked "invalid" during path generation.Jordan Rose
This is intended to allow visitors to make decisions about whether a BugReport is likely a false positive. Currently there are no visitors making use of this feature, so there are no tests. When a BugReport is marked invalid, the invalidator must provide a key that identifies the invaliation (intended to be the visitor type and a context pointer of some kind). This allows us to reverse the decision later on. Being able to reverse a decision about invalidation gives us more flexibility, and allows us to formulate conditions like "this report is invalid UNLESS the original argument is 'foo'". We can use this to fine-tune our false-positive suppression (coming soon). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Look through OpaqueValueExprs when tracking a nil value.Jordan Rose
This allows us to show /why/ a particular object is nil, even when it is wrapped in an OpaqueValueExpr. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164445 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Better path notes for null pointers passed as arguments.Jordan Rose
Rather than saying "Null pointer value stored to 'foo'", we now say "Passing null pointer value via Nth parameter 'foo'", which is much better. The note is also now on the argument expression as well, rather than the entire call. This paves the way for continuing to track arguments back to their sources. <rdar://problem/12211490> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164444 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22Use llvm::getOrdinalSuffix to print ordinal numbers in diagnostics.Jordan Rose
Just a refactoring of common infrastructure. No intended functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164443 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Check that an ObjCIvarRefExpr's base is non-null even as an lvalue.Jordan Rose
Like with struct fields, we want to catch cases like this early, so that we can produce better diagnostics and path notes: PointObj *p = nil; int *px = &p->_x; // should warn here *px = 1; git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164442 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-22[analyzer] Check that a member expr is valid even when the result is an lvalue.Jordan Rose
We want to catch cases like this early, so that we can produce better diagnostics and path notes: Point *p = 0; int *px = &p->x; // should warn here *px = 1; git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164441 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Re-enable faux-bodies by default.Ted Kremenek
Try this again, now that r164392 is in place. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164393 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Revert r164364, "Flip "faux-bodies" in the analyzer on by default to flush ↵NAKAMURA Takumi
out bugs." It crashed test/Analysis/Output/blocks.m on some hosts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164368 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Flip "faux-bodies" in the analyzer on by default to flush out bugs.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164364 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Simplify getRuntimeDefinition() back to taking no arguments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164363 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-21Implement faux-body-synthesis of well-known functions in the static analyzer ↵Ted Kremenek
when their implementations are unavailable. Start by simulating dispatch_sync(). This change is largely a bunch of plumbing around something very simple. We use AnalysisDeclContext to conjure up a fake function body (using the current ASTContext) when one does not exist. This is controlled under the analyzer-config option "faux-bodies", which is off by default. The plumbing in this patch is largely to pass the necessary machinery around. CallEvent needs the AnalysisDeclContextManager to get the function definition, as one may get conjured up lazily. BugReporter and PathDiagnosticLocation needed to be relaxed to handle invalid locations, as the conjured body has no real source locations. We do some primitive recovery in diagnostic generation to generate some reasonable locations (for arrows and events), but it can be improved. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164339 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-20[analyzer] MallocChecker should not do post-call checks on inlined functions.Jordan Rose
If someone provides their own function called 'strdup', or 'reallocf', or even 'malloc', and we inlined it, the inlining should have given us all the malloc-related information we need. If we then try to attach new information to the return value, we could end up with spurious warnings. <rdar://problem/12317671> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164276 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-20Revert "[analyzer] Remove constraints on dead symbols as part of ↵Jordan Rose
removeDeadBindings." While we definitely want this optimization in the future, we're not currently handling constraints on symbolic /expressions/ correctly. These should stay live even if the SymExpr itself is no longer referenced because could recreate an identical SymExpr later. Only once the SymExpr can no longer be recreated -- i.e. a component symbol is dead -- can we safely remove the constraints on it. This liveness issue is tracked by <rdar://problem/12333297>. This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164275 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-17[analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks
in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164046 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13Fix grammar.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163828 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13When warning about unsafe uses of dispatch_once, specially handle theTed Kremenek
crazy case where dispatch_once gets redefined as a macro that calls _dispatch_once (which calls the real dispatch_once). Users want to see the warning in their own code. Fixes <rdar://problem/11617767> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163816 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13[analyzer] Don't reimplement an existing function.Anna Zaks
Thanks Jordan. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163762 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-13Refactor logic in ExprEngine for detecting 'noreturn' methodsTed Kremenek
in NSException to a helper object in libAnalysis that can also be used by Sema. Not sure if the predicate name 'isImplicitNoReturn' is the best one, but we can massage that later. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163759 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Do not report use of undef on "return foo();" when the return ↵Anna Zaks
type is void. Fixes a false positive found by analyzing LLVM code base. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163750 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Fix another false positive in malloc realloc logic.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163749 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Teach UndefOrNullArgVisitor to track parent regions.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163748 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Fix another use of the address of a temporary, like r163402.Jordan Rose
Again, GCC is more aggressive about reusing temporary space than we are, leading to Release build crashes for this undefined behavior. PR13710 (though it may not be the only problem there) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163747 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12[analyzer] Handle when the dynamic type is worse than the static type.Jordan Rose
Currently we don't update the dynamic type of a C++ object when it is cast. This can cause the situation above, where the static type of the region is now known to be a subclass of the dynamic type. Once we start updating DynamicTypeInfo in response to the various kinds of casts in C++, we can re-add this assert to make sure we don't miss any cases. This work is tracked by <rdar://problem/12287087>. In -Asserts builds, we will simply not return any runtime definition when our DynamicTypeInfo is known to be incorrect like this. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163745 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12Revert "[analyzer] Use the static type for a virtual call if the dynamic ↵Jordan Rose
type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12Fix regression where "looping back to the head of" PathDiagnosticEventsTed Kremenek
were not emitted. Fixes <rdar://problem/12280665>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163683 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-12PR13811: Add a FunctionParmPackExpr node to handle references to functionRichard Smith
parameter packs where the reference is not being expanded but the pack has been. Previously, Clang would segfault in such cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163672 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11Revert "[analyzer] Disable STL inlining. Blocked by PR13724."Jordan Rose
While PR13724 is still an issue, it's not actually an issue in the STL. We can keep this option around in case there turn out to be widespread false positives due to poor modeling of the C++ standard library functions, but for now we'd like to get more data. This reverts r163633 / c6baadceec1d5148c20ee6c902a102233c547f62. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163647 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11[analyzer] Use the static type for a virtual call if the dynamic type is worse.Jordan Rose
reinterpret_cast does not provide any of the usual type information that static_cast or dynamic_cast provide -- only the new type. This can get us in a situation where the dynamic type info for an object is actually a superclass of the static type, which does not match what CodeGen does at all. In these cases, just fall back to the static type as the best possible type for devirtualization. Should fix the crashes on our internal buildbot. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163644 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11[analyzer] Disable STL inlining. Blocked by PR13724.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163633 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-11[analyzer] Member function calls that use qualified names are non-virtual.Jordan Rose
C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163577 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Turn stl inlining back on.Anna Zaks
The one reported bug, which was exposed by stl inlining, is addressed in r163558. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163574 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Do not count calls to small functions when computing stackAnna Zaks
depth. We only want to count how many substantial functions we inlined. This is an improvement to r163558. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163571 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Add an option to enable/disable objc inlining.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163562 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Add ipa-always-inline-size option (with 3 as the default).Anna Zaks
The option allows to always inline very small functions, whose size (in number of basic blocks) is set using -analyzer-config ipa-always-inline-size option. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163558 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] Make the defaults explicit for each of the new config options.Jordan Rose
Also, document both new inlining options in IPA.txt. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163551 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10[analyzer] For now, don't inline C++ standard library functions.Jordan Rose
This is a (heavy-handed) solution to PR13724 -- until we know we can do a good job inlining the STL, it's best to be consistent and not generate more false positives than we did before. We can selectively whitelist certain parts of the 'std' namespace that are known to be safe. This is controlled by analyzer config option 'c++-stdlib-inlining', which can be set to "true" or "false". This commit also adds control for whether or not to inline any templated functions (member or non-member), under the config option 'c++-template-inlining'. This option is currently on by default. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163548 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Remove redundant semicolons which are null statements.Dmitri Gribenko
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163546 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Fix another case where we should be using isBeforeInTranslationUnit().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163533 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Add a few more cases where we should be using isBeforeInTranslationUnit().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Revert "Revert Ted's r163489 and r163490, due to breakage."Ted Kremenek
I need to see how this breaks on other platforms when I fix the issue that Benjamin Kramer pointed out. This includes r163489 and r163490, plus a two line change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163512 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Make helper functions static.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163505 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Revert Ted's r163489 and r163490, due to breakage.NAKAMURA Takumi
r163489, "Take another crack at stabilizing the emission order of analyzer" r163490, "Use isBeforeInTranslationUnitThan() instead of operator<." git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163497 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Use isBeforeInTranslationUnitThan() instead of operator<.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163490 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Take another crack at stabilizing the emission order of analyzerTed Kremenek
diagnostics without using FoldingSetNodeIDs. This is done by doing a complete recursive comparison of the PathDiagnostics. Note that the previous method of comparing FoldingSetNodeIDs did not end up relying on unstable things such as pointer addresses, so I suspect this may still have some issues on various buildbots because I'm not sure if the true source of non-determinism has been eliminated. The tests pass for me, so the only way to know is to commit this change and see what happens. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163489 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-10Indent the "message" key in analyzer plist output.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163487 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-09Remove dead method ProgramState::MarshalState().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163479 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-08Fix bug in BugReporter::RemoveUneededCalls() where "prunable"Ted Kremenek
PathDiagnosticEventPieces were *always* pruned. Instead, they are suppose to only be pruned if the entire call gets pruned. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163460 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-08Attempt (again) to stabilize the order of the emission of diagnosticsTed Kremenek
of the analyzer by using the FullProfile() of a PathDiagnostic for ordering them. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163455 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-08[analyzer] ObjCSelfInitChecker should always clean up in postCall checks.Jordan Rose
ObjCSelfInitChecker stashes information in the GDM to persist it across function calls; it is stored in pre-call checks and retrieved post-call. The post-call check is supposed to clear out the stored state, but was failing to do so in cases where the call did not have a symbolic return value. This was actually causing the inappropriate cache-out from r163361. Per discussion with Anna, we should never actually cache out when assuming the receiver of an Objective-C message is non-nil, because we guarded that node generation by checking that the state has changed. Therefore, the only states that could reach this exact ExplodedNode are ones that should have merged /before/ making this assumption. r163361 has been reverted and the test case removed, since it won't actually test anything interesting now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163449 91177308-0d34-0410-b5e6-96231b3b80d8
2012-09-08[analyzer] Add debug output for ObjCSelfInitChecker's state.Jordan Rose
No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163448 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-08 06:16:21 +0000