Commit Graph

2848 Commits

Author SHA1 Message Date
Anna Zaks bbec97ca2c [analyzer] Teach the MallocChecker about about Glib API
A patch by Leslie Zhai!

Differential Revision: https://reviews.llvm.org/D28348

llvm-svn: 297323
2017-03-09 00:01:01 +00:00
Daniel Marjamaki 3d8d6ed01f [analyzer] Clarify 'uninitialized function argument' messages
Differential Revision: https://reviews.llvm.org/D30341

llvm-svn: 297283
2017-03-08 15:22:24 +00:00
Daniel Marjamaki cf715bd330 [analyzer] Fix crashes in CastToStruct checker for undefined structs
This crash was reported in https://bugs.llvm.org//show_bug.cgi?id=31173

Differential Revision: https://reviews.llvm.org/D28297

llvm-svn: 297187
2017-03-07 19:20:48 +00:00
Gabor Horvath dbf2790a1f [analyzer] Improve valist checks and move it out from alpha state.
This patch makes the valist check more robust to the different AST variants on
different platforms and also fixes a FIXME.

Differential Revision: https://reviews.llvm.org/D30157

llvm-svn: 297153
2017-03-07 16:04:23 +00:00
Argyrios Kyrtzidis a166a2b633 [AST/ObjC] Make ObjCCategoryImplDecl consistent with ObjCCategoryDecl and use the category name as its DeclName
This also addresses the badness in ObjCCategoryImplDecl's API, which was hiding NamedDecl's APIs with different meaning.

llvm-svn: 297131
2017-03-07 09:26:07 +00:00
Eric Fiselier 20f25cb6df [coroutines] Add DependentCoawaitExpr and fix re-building CoroutineBodyStmt.
Summary:
The changes contained in this patch are:

1. Defines a new AST node `CoawaitDependentExpr` for representing co_await expressions while the promise type is still dependent.
2. Correctly detect and transform the 'co_await' operand to  `p.await_transform(<expr>)`  when possible.
3. Change the initial/final suspend points to build during the initial parse, so they have the correct operator co_await lookup results.
4.  Fix transformation of the CoroutineBodyStmt so that it doesn't re-build the final/initial suspends.


@rsmith: This change is a little big, but it's not trivial for me to split it up. Please let me know if you would prefer this submitted as multiple patches.



Reviewers: rsmith, GorNishanov

Reviewed By: rsmith

Subscribers: ABataev, rsmith, mehdi_amini, cfe-commits

Differential Revision: https://reviews.llvm.org/D26057

llvm-svn: 297093
2017-03-06 23:38:15 +00:00
Aleksei Sidorin f82a63277a [Analyzer] Terminate analysis on OpenMP code instead of assertion crash
* ExprEngine assumes that OpenMP statements should never appear in CFG.
  However, current CFG doesn't know anything about OpenMP and passes
  such statements as CFG nodes causing "UNREACHABLE executed!" crashes.
  Since there is no OpenMP implementation in ExprEngine or CFG,
  we stop the analysis on OpenMP statements to avoid crashes.

This fixes PR31835.

Differential Revision: https://reviews.llvm.org/D30565

llvm-svn: 296884
2017-03-03 16:58:53 +00:00
Devin Coughlin bfa8e28dbb [analyzer] pr32088: Don't destroy the temporary if its initializer causes return.
In the following code involving GNU statement-expression extension:
  struct S {
    ~S();
  };

  void foo() {
    const S &x = ({ return; S(); });
  }
function 'foo()' returns before reference x is initialized. We shouldn't call
the destructor for the temporary object lifetime-extended by 'x' in this case,
because the object never gets constructed in the first place.

The real problem is probably in the CFG somewhere, so this is a quick-and-dirty
hotfix rather than the perfect solution.

A patch by Artem Dergachev!

rdar://problem/30759076

Differential Revision: https://reviews.llvm.org/D30499

llvm-svn: 296646
2017-03-01 17:48:39 +00:00
Devin Coughlin 1bf65c8c0d [Analyzer] Fix crash in ObjCPropertyChecker on protocol property
Fix a crash in the ObjCPropertyChecker when analyzing a 'copy' property of an
NSMutable* type in a protocol.

rdar://problem/30766684

Differential Revision: https://reviews.llvm.org/D30482

llvm-svn: 296562
2017-03-01 01:47:37 +00:00
Daniel Marjamaki e97838f49e [analyzer] clarify 'result is garbage value' when it is out of bounds
Differential Revision: https://reviews.llvm.org/D28278

llvm-svn: 296326
2017-02-27 10:44:24 +00:00
Dominic Chen 9bc02cee8d [analyzer] Refactor and simplify SimpleConstraintManager
Summary: SimpleConstraintManager is difficult to use, and makes assumptions about capabilities of the constraint manager. This patch refactors out those portions into a new RangedConstraintManager, and also fixes some issues with camel case, formatting, and confusing naming.

Reviewers: zaks.anna, dcoughlin

Subscribers: mgorny, xazax.hun, NoQ, rgov, cfe-commits

Differential Revision: https://reviews.llvm.org/D26061

llvm-svn: 296242
2017-02-25 04:51:31 +00:00
Daniel Marjamaki dc53b680cb [analyzer] Revert 295545. There are buildbot failures.
llvm-svn: 295548
2017-02-18 16:31:35 +00:00
Daniel Marjamaki 1149166bb9 [analyzer] Fix crash in CastToStruct when there is no record definition
This crash was reported in https://bugs.llvm.org//show_bug.cgi?id=31173

Differential Revision: https://reviews.llvm.org/D28297

llvm-svn: 295545
2017-02-18 11:18:57 +00:00
Gabor Horvath 562f3ccf3e [analyzer] Proper caching in CallDescription objects.
During the review of D29567 it turned out the caching in CallDescription is not implemented properly. In case an identifier does not exist in a translation unit, repeated identifier lookups will be done which might have bad impact on the performance. This patch guarantees that the lookup is only executed once. Moreover this patch fixes a corner case when the identifier of CallDescription does not exist in the translation unit and the called function does not have an identifier (e.g.: overloaded operator in C++).

Differential Revision: https://reviews.llvm.org/D29884

llvm-svn: 295186
2017-02-15 15:35:56 +00:00
Gabor Horvath 3b008536f3 [analyzer] Fix an assertion fail in CStringSyntaxChecker.
Differential Revision: https://reviews.llvm.org/D29384

llvm-svn: 293874
2017-02-02 08:20:54 +00:00
Sam McCall 93590e09d5 In VirtualCallChecker, handle indirect calls
Summary:
In VirtualCallChecker, handle indirect calls.

getDirectCallee() can be nullptr, and dyn_cast(nullptr) is UB

Reviewers: bkramer

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D29303

llvm-svn: 293604
2017-01-31 05:23:20 +00:00
Artem Dergachev 55705955ce [analyzer] Fix MacOSXAPIChecker fp with static locals seen from nested blocks.
This is an attempt to avoid new false positives caused by the reverted r292800,
however the scope of the fix is significantly reduced - some variables are still
in incorrect memory spaces.

Relevant test cases added.

rdar://problem/30105546
rdar://problem/30156693
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 293043
2017-01-25 10:21:45 +00:00
Devin Coughlin e1a5630213 Revert "[analyzer] Fix memory space of static locals seen from nested blocks."
This reverts commit r292800.

It is causing null pointer dereference false positives when a block that
captures a static local is evaluated at the top level.

llvm-svn: 292874
2017-01-24 02:10:59 +00:00
Artem Dergachev 01728fbbc0 [analyzer] Fix memory space of static locals seen from nested blocks.
When a block within a function accesses a function's static local variable,
this local is captured by reference rather than copied to the heap.

Therefore this variable's memory space is known: StaticGlobalSpaceRegion.
Used to be UnknownSpaceRegion, same as for stack locals.

Fixes a false positive in MacOSXAPIChecker.

rdar://problem/30105546
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 292800
2017-01-23 16:57:11 +00:00
Pavel Labath d570a61a6c [StaticAnalyzer] Fix android build
std::to_string is not available in the android NDK. Use llvm::to_string instead.

Committing as obvious.

llvm-svn: 292141
2017-01-16 15:57:07 +00:00
Anna Zaks b570195c3a [analyzer] Add LocationContext as a parameter to checkRegionChanges
This patch adds LocationContext to checkRegionChanges and removes
wantsRegionChangeUpdate as it was unused.

A patch by Krzysztof Wiśniewski!

Differential Revision: https://reviews.llvm.org/D27090

llvm-svn: 291869
2017-01-13 00:50:57 +00:00
Anna Zaks dcfc191404 [analyzer] Support inlining of '[self classMethod]' and '[[self class] classMethod]'
Differential Revision: https://reviews.llvm.org/D28495

llvm-svn: 291867
2017-01-13 00:50:47 +00:00
Anna Zaks 14b1af5dcd [analyzer] Fix false positives in Keychain API checker
The checker has several false positives that this patch addresses:
- Do not check if the return status has been compared to error (or no error) at the time when leaks are reported since the status symbol might no longer be alive. Instead, pattern match on the assume and stop tracking allocated symbols on error paths.
- The checker used to report error when an unknown symbol was freed. This could lead to false positives, let's not repot those. This leads to loss of coverage in double frees.
- Do not enforce that we should only call free if we are sure that error was not returned and the pointer is not null. That warning is too noisy and we received several false positive reports about it. (I removed: "Only call free if a valid (non-NULL) buffer was returned")
- Use !isDead instead of isLive in leak reporting. Otherwise, we report leaks for objects we loose track of. This change triggered change #1.

This also adds checker specific dump to the state.

Differential Revision: https://reviews.llvm.org/D28330

llvm-svn: 291866
2017-01-13 00:50:41 +00:00
Artem Dergachev 1d4fb84d82 [analyzer] Don't dereference the array value when binding it to a reference.
This replaces the hack in r291754, which was fixing pr31592, which was
caused by r291754, with a more appropriate solution.

rdar://problem/28832541
Differential revision: https://reviews.llvm.org/D28602

llvm-svn: 291781
2017-01-12 18:00:03 +00:00
Artem Dergachev c9affb0dbd [analyzer] Avoid a crash in DereferenceChecker on string literal initializers.
A hotfix for pr31592 that fixes the crash but not the root cause of the problem.
We need to update the analyzer engine further to account for AST changes
introduced in r289618. At the moment we're erroneously performing a redundant
lvalue-to-rvalue cast in this scenario, and squashing the rvalue of the object
bound to the reference into the reference itself.

rdar://problem/28832541

llvm-svn: 291754
2017-01-12 09:46:16 +00:00
Devin Coughlin dc9834f912 [analyzer] Treat pointers to static member functions as function pointers
Sema treats pointers to static member functions as having function pointer
type, so treat treat them as function pointer values in the analyzer as well.
This prevents an assertion failure in SValBuilder::evalBinOp caused by code
that expects function pointers to be Locs (in contrast, PointerToMember values
are nonlocs).

Differential Revision: https://reviews.llvm.org/D28033

llvm-svn: 291581
2017-01-10 18:49:27 +00:00
Kelvin Li da68118729 [OpenMP] Sema and parsing for 'target teams distribute simd’ pragma
This patch is to implement sema and parsing for 'target teams distribute simd’ pragma.
    
Differential Revision: https://reviews.llvm.org/D28252

llvm-svn: 291579
2017-01-10 18:08:18 +00:00
Gabor Horvath 3d57457298 [analyzer] Add checker for iterators dereferenced beyond their range.
Patch by: Adam Balogh!

Differential Revision: https://reviews.llvm.org/D25660

llvm-svn: 291430
2017-01-09 09:52:32 +00:00
David Blaikie ea4395ebcd Reapply "IntrusiveRefCntPtr -> std::shared_ptr for CompilerInvocationBase and CodeCompleteConsumer"
Aleksey Shlypanikov pointed out my mistake in migrating an explicit
unique_ptr to auto - I was expecting the function returned a unique_ptr,
but instead it returned a raw pointer - introducing a leak.

Thanks Aleksey!

This reapplies r291184, reverted in r291249.

llvm-svn: 291270
2017-01-06 19:49:01 +00:00
David Blaikie 81d0829438 Revert "IntrusiveRefCntPtr -> std::shared_ptr for CompilerInvocationBase and CodeCompleteConsumer"
Caused a memory leak reported by asan. Reverting while I investigate.

This reverts commit r291184.

llvm-svn: 291249
2017-01-06 17:47:10 +00:00
David Blaikie 9280a857bc IntrusiveRefCntPtr -> std::shared_ptr for CompilerInvocationBase and CodeCompleteConsumer
llvm-svn: 291184
2017-01-05 22:19:11 +00:00
David Blaikie 41565463bd Move Preprocessor over to std::shared_ptr rather than IntrusiveRefCntPtr
llvm-svn: 291166
2017-01-05 19:48:07 +00:00
David Blaikie 0a0c275ffd Migrate PathDiagnosticPiece to std::shared_ptr
Simplifies and makes explicit the memory ownership model rather than
implicitly passing/acquiring ownership.

llvm-svn: 291143
2017-01-05 17:26:53 +00:00
David Blaikie 43a38450a9 Remove use of intrusive ref count ownership acquisition
The one use of CheckerManager (AnalysisConsumer, calling
createCheckerManager) keeps a strong reference to the AnalysisOptions
anyway, so this ownership wasn't necessary.

(I'm not even sure AnalysisOptions needs ref counting at all - but
that's more involved)

llvm-svn: 291017
2017-01-04 22:36:39 +00:00
Kelvin Li 1851df563d [OpenMP] Sema and parsing for 'target teams distribute parallel for simd’ pragma
This patch is to implement sema and parsing for 'target teams distribute parallel for simd’ pragma.

Differential Revision: https://reviews.llvm.org/D28202

llvm-svn: 290862
2017-01-03 05:23:48 +00:00
Kelvin Li 80e8f56284 [OpenMP] Sema and parsing for 'target teams distribute parallel for’ pragma
This patch is to implement sema and parsing for 'target teams distribute parallel for’ pragma.

Differential Revision: https://reviews.llvm.org/D28160

llvm-svn: 290725
2016-12-29 22:16:30 +00:00
Kelvin Li 83c451e998 [OpenMP] Sema and parsing for 'target teams distribute' pragma
This patch is to implement sema and parsing for 'target teams distribute' pragma.

Differential Revision: https://reviews.llvm.org/D28015

llvm-svn: 290508
2016-12-25 04:52:54 +00:00
Anton Yartsev 5ac3720620 Fix for PR15623 (corrected r290413 reverted at 290415). The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290505
2016-12-25 00:57:51 +00:00
Egor Churaev 89831421af Fix problems in "[OpenCL] Enabling the usage of CLK_NULL_QUEUE as compare operand."
Summary: Fixed warnings in commit: https://reviews.llvm.org/rL290171

Reviewers: djasper, Anastasia

Subscribers: yaxunl, cfe-commits, bader

Differential Revision: https://reviews.llvm.org/D27981

llvm-svn: 290431
2016-12-23 14:55:49 +00:00
Anton Yartsev b2a5eb87f8 Revert changes made by r290413 until regression is fixed.
llvm-svn: 290415
2016-12-23 04:09:18 +00:00
Anton Yartsev 1a2a9e3087 Fix for PR15623. The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290413
2016-12-23 03:31:00 +00:00
Devin Coughlin e17f621529 [analyzer] Update GTestChecker to tighten API detection
Update the GTestChecker to tighten up the API detection and make it
cleaner in response to post-commit feedback. Also add tests for when
temporary destructors are enabled to make sure we get the expected behavior
when inlining constructors for temporaries.

llvm-svn: 290352
2016-12-22 17:52:57 +00:00
Artem Dergachev 0e0a8b4d85 [analyzer] Improve suppress-on-sink behavior in incomplete analyses.
Warnings with suppress-on-sink are discarded during FlushReports when
BugReporter notices that all paths in ExplodedGraph that pass through the
warning eventually run into a sink node.

However, suppress-on-sink fails to filter out false positives when the analysis
terminates too early - by running into analyzer limits, such as block count
limits or graph size limits - and the interruption hits the narrow window
between throwing the leak report and reaching the no-return function call. In
such case the report is there, however suppression-on-sink doesn't work, because
the sink node was never constructed in the incomplete ExplodedGraph.

This patch implements a very partial solution: also suppress reports thrown
against a statement-node that corresponds to a statement that belongs to a
no-return block of the CFG.

rdar://problem/28832541

Differential Revision: https://reviews.llvm.org/D28023

llvm-svn: 290341
2016-12-22 14:48:52 +00:00
Devin Coughlin 8beac28564 [analyzer] Add checker modeling gtest APIs.
gtest is a widely-used unit-testing API. It provides macros for unit test
assertions:

  ASSERT_TRUE(p != nullptr);

that expand into an if statement that constructs an object representing
the result of the assertion and returns when the assertion is false:

  if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr))
      ;
  else
    return ...;

Unfortunately, the analyzer does not model the effect of the constructor
precisely because (1) the copy constructor implementation is missing from the
the header (so it can't be inlined) and (2) the boolean-argument constructor
is constructed into a temporary (so the analyzer decides not to inline it since
it doesn't reliably call temporary destructors right now).

This results in false positives because the analyzer does not realize that the
the assertion must hold along the non-return path.

This commit addresses the false positives by explicitly modeling the effects
of the two un-inlined constructors on the AssertionResult state.

I've added a new package, "apiModeling", for these kinds of checkers that
model APIs but don't emit any diagnostics. I envision all the checkers in
this package always being on by default.

This addresses the false positives reported in PR30936.

Differential Revision: https://reviews.llvm.org/D27773

rdar://problem/22705813

llvm-svn: 290143
2016-12-19 22:50:31 +00:00
Devin Coughlin 5b1ee2fad9 [analyzer] Add sink after construction of temporary with no-return destructor.
The analyzer's CFG currently doesn't have nodes for calls to temporary
destructors. This causes the analyzer to explore infeasible paths in which
a no-return destructor would have stopped exploration and so results in false
positives when no-return destructors are used to implement assertions.

To mitigate these false positives, this patch stops generates a sink after
evaluating a constructor on a temporary object that has a no-return destructor.
This results in a loss of coverage because the time at which the destructor is
called may be after the time of construction (especially for lifetime-extended
temporaries).

This addresses PR15599.

rdar://problem/29131566

llvm-svn: 290140
2016-12-19 22:23:22 +00:00
Kelvin Li bf594a5600 [OpenMP] Sema and parsing for 'target teams' pragma
This patch is to implement sema and parsing for 'target teams' pragma.

Differential Revision: https://reviews.llvm.org/D27818

llvm-svn: 290038
2016-12-17 05:48:59 +00:00
Devin Coughlin aa0fd76be3 [analyzer] UnixAPIChecker: Don't diagnose for functions in C++ namespaces
Update the UnixAPIChecker to not diagnose for calls to functions that
are declared in C++ namespaces. This avoids false positives when a
namespaced function has the same name as a Unix API.

This address PR28331.

llvm-svn: 290023
2016-12-17 01:08:17 +00:00
Devin Coughlin 74810145b0 [analyzer] Extend UnixAPIChecker open() checks to handle openat().
The openat() API has similar constraints to the open() API -- it just takes
an extra parameter.

rdar://problem/29526458

llvm-svn: 290005
2016-12-16 23:31:56 +00:00
Devin Coughlin e3b75ded98 [analyzer] Fix crash in MallocChecker.
Fix a crash in the MallocChecker when the extent size for the argument
to new[] is not known.

A patch by Abramo Bagnara and Dániel Krupp!

https://reviews.llvm.org/D27849

Differential Revision: https://reviews.llvm.org/D27849

llvm-svn: 289970
2016-12-16 18:41:40 +00:00
Artem Dergachev 85c9211043 [analyzer] Add another exception for Qt in MallocChecker
Treat pointers passed to QObject::connectImpl() as escaping.

rdar://problem/29550440

Differential Revision: https://reviews.llvm.org/D27717

llvm-svn: 289939
2016-12-16 12:21:55 +00:00
Anna Zaks 44cdeb1da2 [analyzer] Teach the analyzer that pointers can escape into __cxa_demangle
This fixes a reported false positive in the malloc checker.

Differential Revision: https://reviews.llvm.org/D27599

llvm-svn: 289886
2016-12-15 22:55:18 +00:00
Anna Zaks 6d4e76b988 [analyzer] Refine the diagnostics in the nullability checker to differentiate between nil and null
This is a big deal for ObjC, where nullability annotations are extensively
used. I've also changed "Null" -> "null" and removed "is" as this is the
pattern that Sema is using.

Differential Revision: https://reviews.llvm.org/D27600

llvm-svn: 289885
2016-12-15 22:55:15 +00:00
Anna Zaks 40c74c6d22 [analyzer] Refer to macro names in diagnostics for macros representing a literal
When a macro expending to a literal is used in a comparison, use the macro name
in the diagnostic rather than the literal. This improves readability of path
notes.

Added tests for various macro literals that could occur. Only BOOl, Int, and
NULL tests have changed behavior with this patch.

Differential Revision: https://reviews.llvm.org/D27726

llvm-svn: 289884
2016-12-15 22:55:11 +00:00
Anna Zaks 232ecfdf9c [analyzer] Include type name in Retain Count Checker diagnostics
The more detailed diagnostic will make identifying which object the
diagnostics refer to easier.

Differential Revision: https://reviews.llvm.org/D27740

llvm-svn: 289883
2016-12-15 22:55:03 +00:00
Devin Coughlin 64c01f7bef [analyzer] Add a new SVal to support pointer-to-member operations.
Add a new type of NonLoc SVal for C++ pointer-to-member operations. This SVal
supports both pointers to member functions and pointers to member data.

A patch by Kirill Romanenkov!

Differential Revision: https://reviews.llvm.org/D25475

llvm-svn: 289873
2016-12-15 21:27:06 +00:00
Richard Smith 30e304e2a6 Remove custom handling of array copies in lambda by-value array capture and
copy constructors of classes with array members, instead using
ArrayInitLoopExpr to represent the initialization loop.

This exposed a bug in the static analyzer where it was unable to differentiate
between zero-initialized and unknown array values, which has also been fixed
here.

llvm-svn: 289618
2016-12-14 00:03:17 +00:00
Artem Dergachev e69d2e47e5 [analyzer] Detect ObjC properties that are both (copy) and Mutable.
When an Objective-C property has a (copy) attribute, the default setter
for this property performs a -copy on the object assigned.

Calling -copy on a mutable NS object such as NSMutableString etc.
produces an immutable object, NSString in our example.
Hence the getter becomes type-incorrect.

rdar://problem/21022397

Differential Revision: https://reviews.llvm.org/D27535

llvm-svn: 289554
2016-12-13 17:19:18 +00:00
Dominic Chen c7772add11 [analyzer] Run clang-format and fix style
Summary: Split out formatting and style changes from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26691

llvm-svn: 289511
2016-12-13 01:40:41 +00:00
Richard Smith 410306bf6e Add two new AST nodes to represent initialization of an array in terms of
initialization of each array element:

 * ArrayInitLoopExpr is a prvalue of array type with two subexpressions:
   a common expression (an OpaqueValueExpr) that represents the up-front
   computation of the source of the initialization, and a subexpression
   representing a per-element initializer
 * ArrayInitIndexExpr is a prvalue of type size_t representing the current
   position in the loop

This will be used to replace the creation of explicit index variables in lambda
capture of arrays and copy/move construction of classes with array elements,
and also C++17 structured bindings of arrays by value (which inexplicably allow
copying an array by value, unlike all of C++'s other array declarations).

No uses of these nodes are introduced by this change, however.

llvm-svn: 289413
2016-12-12 02:53:20 +00:00
Devin Coughlin 3e5f0474ca [analyzer] Improve VirtualCallChecker diagnostics and move into optin package.
The VirtualCallChecker is in alpha because its interprocedural diagnostics
represent the call path textually in the diagnostic message rather than with a
path sensitive diagnostic.

This patch turns off the AST-based interprocedural analysis in the checker so
that no call path is needed and improves with diagnostic text. With these
changes, the checker is ready to be moved into the optin package.

Ultimately the right fix is to rewrite this checker to be path sensitive -- but
there is still value in enabling the checker for intraprocedural analysis only
The interprocedural mode can be re-enabled with an -analyzer-config flag.

Differential Revision: https://reviews.llvm.org/D26768

llvm-svn: 289309
2016-12-10 01:16:09 +00:00
Kelvin Li 7ade93f5e2 [OpenMP] Sema and parsing for 'teams distribute parallel for' pragma
This patch is to implement sema and parsing for 'teams distribute parallel for' pragma.
    
Differential Revision: https://reviews.llvm.org/D27345

llvm-svn: 289179
2016-12-09 03:24:30 +00:00
Artem Dergachev a4e2541a70 [analyzer] Add dispatch_data_create as a special case in RetainCountChecker.
This function receives a callback block. The analyzer suspects that this block
may be used to take care of releasing the libdispatch object returned from
the function. In fact, it doesn't - it only releases the raw data buffer.
Inform the analyzer about that. Fixes the resulting false negatives.

rdar://problem/22280098

Differential Revision: https://reviews.llvm.org/D27409

llvm-svn: 289047
2016-12-08 14:05:48 +00:00
Devin Coughlin c894ac8163 [analyzer] Fix typo in nullability checker diagnostic
'infered' --> 'inferred'

llvm-svn: 288922
2016-12-07 17:36:27 +00:00
Artem Dergachev 5b6ff3f43a [analyzer] Remove an unused enum value in RetainCountChecker.
No functional change intended.

Differential Revision: https://reviews.llvm.org/D27408

llvm-svn: 288917
2016-12-07 16:51:54 +00:00
Artem Dergachev d69e01297f [analyzer] pr31226: Disable CastSizeChecker in C++ because it's not quite ready.
Avoids a crash and a related false positive.

Investigation by Daniel Krupp!

llvm-svn: 288914
2016-12-07 16:12:26 +00:00
Dominic Chen 0dd2306538 [analyzer] Print type for SymbolRegionValues when dumping to stream
Reviewers: NoQ, dcoughlin, zaks.anna

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D27365

llvm-svn: 288696
2016-12-05 20:30:11 +00:00
Devin Coughlin ab139a9e79 [analyzer] ObjCGenerics: Warn only on mismatch for invariant type parameters
On a method call, the ObjCGenerics checker uses the type tracked by
DynamicTypePropagation for the receiver to to infer substituted parmeter types
for the called methods and warns when the argument type does not match the
parameter.

Unfortunately, using the tracked type can result in false positives when the
receiver has a non-invariant type parameter and has been intentionally upcast.
For example, becaue NSArray's type parameter is covaraint, the following code
is perfectly safe:

NSArray<NSString *> *allStrings = ...
NSDate *date = ...;
NSArray<NSObject *> *allObjects = allStrings;
NSArray<NSObject *> *moreObjects = [allObjects arrayByAddingObject:date];

but the checker currently warns that the date parameter is not an NSString *.

To avoid this kind of false positive, the checker will now only warn when
the class defining the called method has only invariant type parameters.

rdar://problem/28803951

llvm-svn: 288677
2016-12-05 16:28:47 +00:00
Richard Smith b3189a1802 DR1213: element access on an array xvalue or prvalue produces an xvalue. In the
latter case, a temporary array object is materialized, and can be
lifetime-extended by binding a reference to the member access. Likewise, in an
array-to-pointer decay, an rvalue array is materialized before being converted
into a pointer.

This caused IR generation to stop treating file-scope array compound literals
as having static storage duration in some cases in C++; that has been rectified
by modeling such a compound literal as an lvalue. This also improves clang's
compatibility with GCC for those cases.

llvm-svn: 288654
2016-12-05 07:49:14 +00:00
Kelvin Li 579e41ced2 [OpenMP] Sema and parsing for 'teams distribute parallel for simd' pragma
This patch is to implement sema and parsing for 'teams distribute parallel for simd' pragma.

Differential Revision: https://reviews.llvm.org/D27084

llvm-svn: 288294
2016-11-30 23:51:03 +00:00
Artem Dergachev 28ee2d1b09 [analyzer] Construct temporary objects of correct types, destroy them properly.
When constructing a temporary object region, which represents the result of
MaterializeTemporaryExpr, track down the sub-expression for which the temporary
is necessary with a trick similar to the approach used in CodeGen, namely
by using Expr::skipRValueSubobjectAdjustments().

Then, create the temporary object region with type of that sub-expression.
That type would propagate further in a path-sensitive manner.

During destruction of lifetime-extened temporaries, consult the type of
the temporary object region, rather than the type of the lifetime-extending
variable, in order to call the correct destructor (fixes pr17001) and,
at least, not to crash by trying to call a destructor of a plain type
(fixes pr19539).

rdar://problem/29131302
rdar://problem/29131576

Differential Revision: https://reviews.llvm.org/D26839

llvm-svn: 288263
2016-11-30 19:02:44 +00:00
Artem Dergachev 30ed5467a4 [analyzer] Minor fixes and improvements to debug.ExprInspection
- Fix the bug with transition handling in ExprInspectionChecker's
  checkDeadSymbols implementation.

- Test this bug by adding a new function clang_analyzer_numTimesReached() to
  catch number of passes through the code, which should be handy for testing
  against unintended state splits.

- Add two more functions should help debugging issues quickly without running
  the debugger or dumping exploded graphs - clang_analyzer_dump() which dump()s
  an SVal argument to a warning message, and clang_analyzer_printState(), which
  dump()s the current program state to stderr.

Differential Revision: https://reviews.llvm.org/D26835

llvm-svn: 288257
2016-11-30 17:57:18 +00:00
Artem Dergachev 22e28f4078 [analyzer] Fix a crash on accessing a field within a literal-initialized union.
Because in case of unions we currently default-bind compound values in the
store, this quick fix avoids the crash for this case.

Patch by Ilya Palachev and independently by Alexander Shaposhnikov!

Differential Revision: https://reviews.llvm.org/D26442

llvm-svn: 287618
2016-11-22 04:29:23 +00:00
Dominic Chen c8629bd35a [analyzer] Refactor recursive symbol reachability check to use symbol_iterator
Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26773

llvm-svn: 287380
2016-11-18 21:07:03 +00:00
Matthias Braun ae032b6cf5 Adapt to llvm NamedRegionTimer changes
We have to specify a name and description for the timers and groups now.

llvm-svn: 287371
2016-11-18 19:43:25 +00:00
Anna Zaks 1485992eb3 [analyzer] Remove unused check::RegionChanges::wantsRegionChangeUpdate callback
Remove the check::RegionChanges::wantsRegionChangeUpdate callback as it is no
longer used (since checkPointerEscape has been added).

A patch by Krzysztof Wiśniewski!

Differential Revision: https://reviews.llvm.org/D26759

llvm-svn: 287175
2016-11-16 22:59:01 +00:00
Artem Dergachev 93fd165bfb [analyzer] NumberObjectConversion: Workaround for a linker error with modules.
A combination of C++ modules, variadic functions with more than one argument,
and const globals in headers (all three being necessary) causes some releases
of clang to misplace the matcher objects, which causes the linker to fail.

No functional change - the extra allOf() matcher is no-op here.

llvm-svn: 287045
2016-11-15 22:22:57 +00:00
Devin Coughlin 8693adfd46 [analyzer] Add check for when block is called with too few arguments.
The CallAndMessageChecker has an existing check for when a function pointer
is called with too few arguments. Extend this logic to handle the block
case, as well. While we're at it, do a drive-by grammar correction
("less" --> "fewer") on the diagnostic text.

llvm-svn: 287001
2016-11-15 18:40:46 +00:00
Dominic Chen 3f8c3fa72f [analyzer] Rename assumeWithinInclusiveRange*()
Summary: The name is slightly confusing, since the constraint is not necessarily within the range unless `Assumption` is true. Split out renaming for ConstraintManager.h from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26644

llvm-svn: 286927
2016-11-15 01:54:41 +00:00
Dominic Chen e3733bc53e [analyzer] Minor optimization: avoid setting state if unchanged
Summary: Split out optimization from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26642

llvm-svn: 286925
2016-11-15 01:40:58 +00:00
Devin Coughlin e4224cc9f7 [analyzer] Fix crash in NullabilityChecker calling block with too few arguments
Fix a crash when checking parameter nullability on a block invocation
with fewer arguments than the block declaration requires.

rdar://problem/29237566

llvm-svn: 286901
2016-11-14 22:46:02 +00:00
Devin Coughlin 8fa568d761 [analyzer] Update 'Automated' to 'Automatic' from r286694.
ARC is 'Automatic Reference Counting' and not 'Automated Reference Counting'.

llvm-svn: 286700
2016-11-12 01:50:04 +00:00
Devin Coughlin d1fe08b8a9 [analyzer] Improve misleading RetainCountChcker diagnostic under ARC
Under automated reference counting the analyzer treats a methods -- even those
starting with  'copy' and friends -- as returning an unowned value. This is
because ownership of CoreFoundation objects must be transferred to ARC
with __bridge_transfer or CFBridgingRelease() before being returned as
ARC-managed bridged objects.

Unfortunately this could lead to a poor diagnostic inside copy methods under
ARC where the analyzer would complain about a leak of a returned CF value inside
a method "whose name does not start with 'copy'" -- even though the name did
start with 'copy'.

This commit improves the diagnostic under ARC to say inside a method "returned
from a method managed by Automated Reference Counting".

rdar://problem/28849667

llvm-svn: 286694
2016-11-12 01:03:06 +00:00
Devin Coughlin e477a0e5ec [analyzer] Teach RetainCountChecker about VTCompressionSessionEncodeFrame()
The context argument passed to VideoToolbox's
VTCompressionSessionEncodeFrame() function is ultimately passed to a callback
supplied when creating the compression session and so may be freed by that
callback.  To suppress false positives in this case, teach the retain count
checker to stop tracking that argument.

This isn't suppressed by the usual callback context mechanism because the call
to VTCompressionSessionEncodeFrame() doesn't include the callback itself.

rdar://problem/27685213

llvm-svn: 286633
2016-11-11 21:31:38 +00:00
Alexander Kornienko 8df2a62ae6 Add a method to get the list of registered static analyzer checkers.
Summary:
This provides a better interface for clang-tidy and encapsulates the knowledge
about experimental checkers instead of leaving this to the clients.

Reviewers: zaks.anna

Subscribers: a.sidorin, NoQ, dcoughlin, cfe-commits

Differential Revision: https://reviews.llvm.org/D26310

llvm-svn: 286218
2016-11-08 07:23:32 +00:00
Artem Dergachev 47fec16cd1 [analyzer] StdLibraryFunctions: provide platform-specific function summaries.
Because standard functions can be defined differently on different platforms,
this commit introduces a method for constructing summaries with multiple
variants, whichever matches better. It is also useful for supporting overloads.

Differential Revision: https://reviews.llvm.org/D25940

llvm-svn: 285852
2016-11-02 19:35:20 +00:00
Malcolm Parsons f76f6507c2 Fix Clang-tidy readability-redundant-string-cstr warnings
Reviewers: aaron.ballman, mehdi_amini, dblaikie

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26206

llvm-svn: 285799
2016-11-02 10:39:27 +00:00
Devin Coughlin 05c03845e7 [analyzer] Fix capitalization in ObjCSuperDealloc checker diagnostic.
Change "use of 'self'..." to "Use of 'self'...". The convention is to
start diagnostics with a capital letter.

rdar://problem/28322494

llvm-svn: 285759
2016-11-01 22:16:39 +00:00
Artem Dergachev 75f9d3ac7e [analyzer] Allow undefined values in performTrivialCopy.
Reading from a garbage pointer should be modeled as garbage,
and performTrivialCopy should be able to deal with any SVal input.

Patch by Ilya Palachev!

Differential Revision: https://reviews.llvm.org/D25727

llvm-svn: 285640
2016-10-31 21:11:20 +00:00
Artem Dergachev a21df23fd8 [analyzer] MacOSXAPIChecker: Improve warnings for __block vars in dispatch_once.
The checker already warns for __block-storage variables being used as a
dispatch_once() predicate, however it refers to them as local which is not quite
accurate, so we fix that.

Differential Revision: https://reviews.llvm.org/D26159

llvm-svn: 285637
2016-10-31 21:04:54 +00:00
Artem Dergachev aacc03c918 [analyzer] MacOSXAPIChecker: Disallow dispatch_once_t in ivars and heap.
Unlike global/static variables, calloc etc. functions that allocate ObjC
objects behave differently in terms of memory barriers, and hacks that make
dispatch_once as fast as it possibly could be start failing.

Differential Revision: https://reviews.llvm.org/D25909

llvm-svn: 285605
2016-10-31 17:27:26 +00:00
David Majnemer 5116993f8e Add support for __builtin_alloca_with_align
__builtin_alloca always uses __BIGGEST_ALIGNMENT__ for the alignment of
the allocation.  __builtin_alloca_with_align allows the programmer to
specify the alignment of the allocation.

This fixes PR30658.

llvm-svn: 285544
2016-10-31 05:37:48 +00:00
Artem Dergachev e14d881808 [analyzer] NumberObjectConversion: support more types, misc updates.
Support CFNumberRef and OSNumber objects, which may also be accidentally
converted to plain integers or booleans.

Enable explicit boolean casts by default in non-pedantic mode.

Improve handling for warnings inside macros.

Improve error messages.

Differential Revision: https://reviews.llvm.org/D25731

llvm-svn: 285533
2016-10-31 03:08:48 +00:00
Anna Zaks 5b2b39065c [analyzer] Report CFNumberGetValue API misuse
This patch contains 2 improvements to the CFNumber checker:
 - Checking of CFNumberGetValue misuse.
 - Treating all CFNumber API misuse errors as non-fatal. (Previously we treated errors that could cause uninitialized memory as syncs and the truncation errors as non-fatal.)

This implements a subset of functionality from https://reviews.llvm.org/D17954.

Differential Revision: https://reviews.llvm.org/D25876

llvm-svn: 285253
2016-10-26 22:51:47 +00:00
Simon Pilgrim be1d49a508 Fix MSVC unused variable warning.
LLVM_ATTRIBUTE_UNUSED doesn't work for non-gcc style compilers.

llvm-svn: 285067
2016-10-25 12:59:15 +00:00
Kelvin Li 4e325f77a9 Re-apply patch r279045.
llvm-svn: 285066
2016-10-25 12:50:55 +00:00
Artem Dergachev 26b0a9d8ac [analyzer] Use unsigned integers to rely on well-defined overflow semantics.
Found by the UBSan buildbot.

llvm-svn: 285000
2016-10-24 18:49:04 +00:00
Artem Dergachev bba497fb65 [analyzer] Add StdLibraryFunctions checker.
This checker does not emit reports, however it influences the analysis
by providing complete summaries for, or otherwise improving modeling of,
various standard library functions.

This should reduce the number of infeasible paths explored during analysis.
The custom function summary format used in this checker is superior to
body farms by causing less unnecessary state splits,
which would result in better analysis performance.

Differential Revision: https://reviews.llvm.org/D20811

llvm-svn: 284960
2016-10-24 09:41:38 +00:00
Daniel Marjamaki fa1bf447d9 alpha.core.UnreachableCode - don't warn about unreachable code inside macro
In macros, 'do {...} while (0)' is often used. Don't warn about the condition 0 when it is unreachable.

Differential Revision: https://reviews.llvm.org/D25606

llvm-svn: 284477
2016-10-18 13:16:53 +00:00
Artem Dergachev 940c770d27 [analyzer] Add NumberObjectConversion checker.
When dealing with objects that represent numbers, such as Objective-C NSNumber,
the language provides little protection from accidentally interpreting
the value of a pointer to such object as the value of the number represented
by the object. Results of such mis-interpretation may be unexpected.

The checker attempts to fill this gap in cases when the code is obviously
incorrect.

With "Pedantic" option enabled, this checker enforces a coding style to
completely prevent errors of this kind (off by default).

Differential Revision: https://reviews.llvm.org/D22968

llvm-svn: 284473
2016-10-18 11:06:28 +00:00
Devin Coughlin 684d19d879 Revert "Revert "[analyzer] Make MallocChecker more robust against custom redeclarations""
This reverts commit r284340 to reapply r284335. The bot breakage was due to
an unrelated change in the polybench test suite.

llvm-svn: 284351
2016-10-16 22:19:03 +00:00