aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-06-05PlistDiagnostics: force the ranges for control-flow edges to be single ↵Ted Kremenek
locations, forcing adjacent edges to have compatible ranges. This simplifies the layout logic for some clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158028 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-04[analyzer] Fix a diagnostics bug which lead to a crash on the buildbot.Anna Zaks
This bug was triggered by r157851. It only happens in the case where we don't perform optimal diagnostic pruning. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157950 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-02Fix typos found by http://github.com/lyda/misspell-checkBenjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157886 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-02[analyzer] Rely on canBeInlined utility instead of checking CallExprAnna Zaks
explicitly. This will make it easier to add inlining support to more expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157870 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01[analyzer] Fix a spurious undef value warning.Anna Zaks
When we timeout or exceed a max number of blocks within an inlined function, we retry with no inlining starting from a node right before the CallEnter node. We assume the state of that node is the state of the program before we start evaluating the call. However, the node pruning removes this node as unimportant. Teach the node pruning to keep the predecessors of the call enter nodes. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157860 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01[analyzer] Fix lack of coverage after empty inlined function.Anna Zaks
We should not stop exploring the path after we return from an empty function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157859 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01Disable diagnosic path pruning for ReturnUndefChecker.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157851 91177308-0d34-0410-b5e6-96231b3b80d8
2012-06-01static analyzer: add inlining support for directly called blocks.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157833 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31[analyzer] Fix BugType memory leak in IdempotentOperationChecker.Tom Care
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157772 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31[analyzer] Cleanup for r157721.Anna Zaks
We should lock the number of elements after the initial parsing is complete. Recursive AST visitors in AnalyzesConsumer and CallGarph can trigger lazy pch deserialization resulting in more calls to HandleTopLevelDecl and appending to the LocalTUDecls list. We should ignore those. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157762 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-31Allow some BugReports to opt-out of PathDiagnostic callstack pruning until ↵Ted Kremenek
we have significantly improved the pruning heuristics. The current heuristics are pretty good, but they make diagnostics for uninitialized variables warnings particularly useless in some cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-30[analyzer]Fix another occurrence of iterator invalidation (LocalTUDecls)Anna Zaks
Follow up in r155693, r155680. Prevents a hard to reproduce crash with the following stack trace: 3 libsystem_c.dylib 0x00007ff55a835050 _sigtramp + 18446744029881443184 4 clang 0x0000000106218e97 (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) + 519 5 clang 0x0000000105cf3002 clang::ParseAST(clang::Sema&, bool, bool) + 690 6 clang 0x00000001059a41d8 clang::ASTFrontendAction::ExecuteAction() + 312 7 clang 0x00000001059a3df7 clang::FrontendAction::Execute() + 231 8 clang 0x00000001059b0ecc clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 860 9 clang 0x000000010595e451 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 961 10 clang 0x0000000105947f29 cc1_main(char const**, char const**, char const*, void*) + 969 11 clang 0x0000000105958259 main + 473 12 clang 0x0000000105947b34 start + 52 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157721 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-27Replace some custom hash combines with the standard stuff from DenseMapInfo.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-25[analyzer] Don't crash on LValBitCastAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157478 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-24[analyzer] Minor cleanup to checkers' help text.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157402 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-24[analyzer] Treat cast of array to reference in the same way as array toAnna Zaks
pointer. Fixes one of the crashes reported in PR12874. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157401 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-21[analyzer] Bind UnknownVal to InitListExpr for unsupported typesAnna Zaks
(ex: float). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-21Analyzer: Fix PR12905, a crash when encountering a call to a function named "C".Benjamin Kramer
While there clean up indentation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157204 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-19[analyzer] For locations, use isGLValue() instead of isLValue().Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157088 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer] Fix a c++11 crash: xvalues can be locations (VisitMemberExpr)Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157082 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer] Malloc checker: remove unnecessary comparisons.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-18[analyzer]Malloc: refactor and report use after free by memoryAnna Zaks
allocating functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157037 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-16[analyzer] Introduce clang_analyzer_eval for regression test constraint checks.Jordy Rose
The new debug.ExprInspection checker looks for calls to clang_analyzer_eval, and emits a warning of TRUE, FALSE, or UNKNOWN (or UNDEFINED) based on the constrained value of its (boolean) argument. It does not modify the analysis state though the conditions tested can result in branches (e.g. through the use of short-circuit operators). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156919 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-15[analyzer] Fix a regression in ObjCUnusedIVars checker.Anna Zaks
We can no longer rely on children iterator to visit all the AST tree children of an expression (OpaqueValueExpr has no children). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156870 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-14[analyzer] strncpy: Special-case a length of 0 to avoid an incorrect warning.Jordy Rose
We check the address of the last element accessed, but with 0 calculating that address results in element -1. This patch bails out early (and avoids a bunch of other work at that). Fixes PR12807. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156769 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-12[analyzer] RetainCountChecker: track ObjC boxed expression objects.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-11[analyzer] Do not walk the types for call graph construction.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156661 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-11The Lexer constructor expects a source location at the start of theArgyrios Kyrtzidis
file buffer, not at the start of lexing. Fixes assertion hit in format diagnostics. rdar://11418366 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156647 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Include line that was meant to be in my last commit.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156582 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10Fix insidious RegionStore bug where we (a) didn't handle vector types and ↵Ted Kremenek
(b) had a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more layers of lazy bindings. I don't have a reduced test case yet; but I have added the original source to an internal regression test suite. I'll see about coming up with a reduced test case. Fixes <rdar://problem/11405978> (for real). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Exit early if constraint solver is given a non-integer symbolAnna Zaks
to reason about. As part of taint propagation, we now allow creation of non-integer symbolic expressions like a cast from int to float. Addresses PR12511 (radar://11215362). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156578 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-10[analyzer] Do not highlight the range of the statement in case of leak.Anna Zaks
We report a leak at a point a leaked variable is no longer accessible. The statement that happens to be at that point is not relevant to the leak diagnostic and, thus, should not be highlighted. radar://11178519 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156530 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Simplify r156446, as per Ted's review.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156482 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-09[analyzer] Allow pointers to escape through selector callbacks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156481 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] We currently do not fully support CompoundLiterals inAnna Zaks
RegionStore, so be explicit about it and generate UnknownVal(). This is a hack to ensure we never produce undefined values for a value coming from a compound value. (The undefined values can lead to false positives.) radar://10127782 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156446 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Having RegionStore lower field bindings to raw offsets, just like ↵Ted Kremenek
ElementRegions. This is a bit disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values as structs. Fixes <rdar://problem/11405978>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156428 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08When creating lazy bindings in RegionStore, propagate existing lazy bindings ↵Ted Kremenek
instead of creating new ones. This is a functionality optimization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156427 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Include address of Store in graphviz output of ExplodedGraph.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156426 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] SelfInit: Stop tracking self if it's assigned a value weAnna Zaks
don't reason about. Self is just like a local variable in init methods, so it can be assigned anything like result of static functions, other methods ... So to suppress false positives that result in such cases, stop tracking the checker-specific state after self is being assigned to (unless the value is't being assigned to is either self or conforms to our rules). This change does not invalidate any existing regression tests. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156420 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the analyzer about CXXScaleValueInitExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] BasicConstraintManager: drop NE-constraints once we have a value.Jordy Rose
This could conceivably cut down on state proliferation, although we don't use BasicConstraintManager by default anymore. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156362 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Rework both constraint managers to handle mixed-type comparisons.Jordy Rose
This involves keeping track of three separate types: the symbol type, the adjustment type, and the comparison type. For example, in "$x + 5 > 0ULL", if the type of $x is 'signed char', the adjustment type is 'int' and the comparison type is 'unsigned long long'. Most of the time these three types will be the same, but we should still do the right thing when the comparison value is out of range, and wraparound should be calculated in the adjustment type. This also re-disables an out-of-bounds test; we were extracting the symbol from non-additive SymIntExprs, but then throwing away the integer. Sorry for the large patch; both the basic and range constraint managers needed to be updated together, since they share code in SimpleConstraintManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156361 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08[analyzer] Add an abstraction for the bit width and signedness of an APSInt. ↵Jordy Rose
No functionality change. There are more parts of the analyzer that could use the convenience of APSIntType, particularly the constraint engine, but that needs a fair amount of rewriting to handle mixed-type constraints anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156360 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-08Teach the static analyzer that NSLog() and friends do not hold on to object ↵Ted Kremenek
references (thus extending their lifetime). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156346 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Turn on MallocSizeOfChecker by default; shorten the diagnosticAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156341 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer] Fix a crash in triggered by OSAtomicChecker.Anna Zaks
SValBuilder should return an UnknownVal() when comparison of int and ptr fails. Previous to this commit, it went on assuming that we are dealing with pointer arithmetic. PR12509, radar://11390991 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156320 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07[analyzer]Fixup r156215: use StopTracking summary instead of ScratchArgsAnna Zaks
As per Jordy's and Ted's comment, use the default StopTracking summary instead of adding all arguments to ScratchArs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156310 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-07Remove variable made unused by r156270.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156273 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-06[analyzer] Reduce parallel code paths in SimpleSValBuilder::evalBinOpNN, and ↵Jordy Rose
handle mixed-type operations more generally. The logical change is that the integers in SymIntExprs may not have the same type as the symbols they are paired with. This was already the case with taint-propagation expressions created by SValBuilder::makeSymExprValNN, but I think those integers may never have been used. SimpleSValBuilder should be able to handle mixed-integer-type SymIntExprs fine now, though, and the constraint managers were already being defensive (though not entirely correct). All existing tests pass. The logic in evalBinOpNN has been simplified so that conversion is done as late as possible. As a result, most of the switch cases have been reduced to do the minimal amount of work, delegating to another case when they can by substituting ConcreteInts and (as before) reversing the left and right arguments when useful. Comparisons require special handling in two places (building SymIntExprs and evaluating constant-constant operations) because we don't /know/ the best type for comparing the two values. I've approximated the rules in Sema [C99 6.3.1.8] but it'd be nice to refactor Sema's actual algorithm into ASTContext. This is also groundwork for handling mixed-type constraints better than we do now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156270 91177308-0d34-0410-b5e6-96231b3b80d8
2012-05-04[analyzer] RetainCountChecker: Allow objects to escape through callbacksAnna Zaks
Fixes radar://10973977. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156215 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-04 13:32:57 +0000