Commit Graph

394 Commits

Author SHA1 Message Date
Ted Kremenek 8cf2021012 Remove GRStateManager::getRegion/getSelfRegion().
llvm-svn: 74006
2009-06-23 21:37:46 +00:00
Ted Kremenek 404b132dc0 Move 'hasStackStorage()' and 'hasHeapStorage()' from MemRegionManager to MemRegion.
llvm-svn: 73973
2009-06-23 18:05:21 +00:00
Zhongxing Xu 7718ae4701 Move all factory methods from SVal to ValueManager. API cleanup!
llvm-svn: 73954
2009-06-23 09:02:15 +00:00
Ted Kremenek fb87e30815 MemRegions:
- Embed a reference to MemRegionManager objects in MemSpaceRegion objects
- Use this embedded reference for MemRegion objects to access ASTContext objects without external help
- Use this access to ASTContext to simplify 'isBoundable' (no ASTContext& argument required)

llvm-svn: 73935
2009-06-23 00:46:41 +00:00
Ted Kremenek 095f1a9848 Move clients over from using GRStateManager::BindXXX and friends to
GRState->bindXXX and friends (and constify some arguments along the way).

llvm-svn: 73740
2009-06-18 23:58:37 +00:00
Ted Kremenek f9906843b7 libAnalysis:
- Remove the 'isFeasible' flag from all uses of 'Assume'.
- Remove the 'Assume' methods from GRStateManager.  Now the only way to
  create a new GRState with an assumption is to use the new 'assume' methods
  in GRState.

llvm-svn: 73731
2009-06-18 22:57:13 +00:00
Douglas Gregor 78bd61f661 Move the static DeclAttrs map into ASTContext. Fixes <rdar://problem/6983177>.
llvm-svn: 73702
2009-06-18 16:11:24 +00:00
Ted Kremenek d93c6e3fd6 Remove more dependencies on GRStateRef. As a consequence, we can now
pretty-print a GRState object anywhere it is referenced (instead of
needing a GRStateRef of a GRStateManager handy).

llvm-svn: 73669
2009-06-18 01:23:53 +00:00
Ted Kremenek 89a303caac Remove another dependency on GRStateRef.
llvm-svn: 73667
2009-06-18 00:49:02 +00:00
Ted Kremenek 96aa146d90 Fix: <rdar://problem/6945561> -[CIContext createCGLayerWithSize:info:] misinterpreted by clang scan-build
llvm-svn: 73415
2009-06-15 20:58:58 +00:00
Ted Kremenek 3092e9c5c2 Fix: <rdar://problem/6961230> add knowledge of IOKit functions to retain/release checker
llvm-svn: 73411
2009-06-15 20:36:07 +00:00
Ted Kremenek ea675cf6a3 Add summary lookup for IOServiceGetMatchingService.
Convert tabs to spaces.

llvm-svn: 73198
2009-06-11 18:17:24 +00:00
Ted Kremenek a74ead4103 Refactor some function name -> summary lookup using a switch statement.
llvm-svn: 73197
2009-06-11 18:10:48 +00:00
Ted Kremenek a03705c82d Fix:
<rdar://problem/6948053> False positive: object substitution during -init* methods warns about returning +0 when using -fobjc-gc-only

llvm-svn: 72971
2009-06-05 23:18:01 +00:00
Ted Kremenek ea1c221334 Enhance attribute cf_returns_retained to also work (in the analyzer)
for non-Objctive-C pointer types.  This implicitly documents that the
return type is a CF object reference.

llvm-svn: 72968
2009-06-05 23:00:33 +00:00
Ted Kremenek 1036912118 Add special cases to retain checker for 'create' methods in QCView, QCRenderer, and CIContext (Apple APIs).
This fixes:

<rdar://problem/6902710> clang: false positives w/QC and CoreImage methods.

llvm-svn: 72187
2009-05-20 22:39:57 +00:00
Ted Kremenek 501ba0365a Fix PR 4230: Don't flag leaks of NSAutoreleasePools until we know that we aren' at the top-most scope of autorelease pools.
llvm-svn: 72065
2009-05-18 23:14:34 +00:00
Ted Kremenek e4302ee3bb Fix: <rdar://problem/6893565> False positive: don't flag leaks for return types that cannot be determined to be CF types
llvm-svn: 71921
2009-05-16 01:38:01 +00:00
Ted Kremenek 3281977dbb Fix crash when deriving the enclosing summary of a method whose first selector slot has a null IdentifierInfo*. This happens when analyzing Growl.
llvm-svn: 71857
2009-05-15 15:49:00 +00:00
Ted Kremenek 4785e41c12 Remove extra whitespace character in string literal. Purely cosmetic.
llvm-svn: 71847
2009-05-15 06:02:08 +00:00
Ted Kremenek f9fa3cb78a Fix <rdar://problem/6859457> [NSData dataWithBytesNoCopy] does not return a retained object.
llvm-svn: 71797
2009-05-14 21:29:16 +00:00
Ted Kremenek 5801f65a52 Fix crasher reported in PR 4209 caused by an invalid summary
generation when EvalObjCMessageExpr() did not resolve the
ObjCInterfaceDecl* for a receiver when the receiver's symbolic value
wasn't being explicitly tracked.

llvm-svn: 71685
2009-05-13 18:16:01 +00:00
Ted Kremenek 051a03d698 Fix crasher in CFRefCount.cpp reported by Nikita Zhuk due to recently added autorelease tracking.
llvm-svn: 71647
2009-05-13 07:12:33 +00:00
Ted Kremenek 1272f706ca Fix: <rdar://problem/6320065> false positive - init method returns an object owned by caller
Now 'init' methods are treated by the retain/release checker as
claiming their receiver and allocating a new object.

llvm-svn: 71579
2009-05-12 20:06:54 +00:00
Zhongxing Xu 08a2ede018 Add logic for invalidating array region to CFRefCount.cpp. When invalidating
array region, set its default value to conjured symbol. When retrieving its
element, create new region value symbol for the element.

Also fix some 80 columns violations.

llvm-svn: 71548
2009-05-12 10:10:00 +00:00
Ted Kremenek 95d181936a Fix <rdar://problem/6877235> Classes typedef-ed to CF objects should get the same treatment as CF objects
This was accomplished by having	'isTypeRef' recursively walk the typedef stack.

llvm-svn: 71538
2009-05-12 04:53:03 +00:00
Ted Kremenek 97f75f8bda When stripping element regions for invalidating region values, treat FieldRegions and ObjCIvarRegions as "base" regions in addition to VarRegions.
llvm-svn: 71488
2009-05-11 22:55:17 +00:00
Ted Kremenek d0e3ab2196 Fix regression reported in <rdar://problem/6866843>. The analyzer should extend the lifetime of an object stored to a container.
llvm-svn: 71452
2009-05-11 18:30:24 +00:00
Ted Kremenek dc7853cd98 Fix a bug found by Thomas Clement where 'return [[[NSString alloc] init] autorelease]' would emit a false 'too many overreleases' error.
llvm-svn: 71432
2009-05-11 15:26:06 +00:00
Zhongxing Xu 52091db11f TypedRegion is a too general assumption. Usually we only want to invalidate
the VarRegion as a super region of an ElementRegion.

llvm-svn: 71431
2009-05-11 14:28:14 +00:00
Ted Kremenek 1f8e4346fa Add special warning about returning a retained object where a GC'ed object is expected.
llvm-svn: 71397
2009-05-10 16:52:15 +00:00
Ted Kremenek dee56e37fc retain/release checker: Flag a warning for non-owned objects returned
where an owned one is expected.  Also add preliminary checking for
returning a positive retain count object in GC mode where an owned GC
object is expected.

llvm-svn: 71388
2009-05-10 06:25:57 +00:00
Ted Kremenek 3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Zhongxing Xu 34d04b3ca9 As discussed with Ted, rename TypedRegion::getObjectType() to
TypedRegion::getValueType().

llvm-svn: 71321
2009-05-09 03:57:34 +00:00
Ted Kremenek c2de72776c Add back analyzer support for ns_returns_retained and cf_returns_retained.
llvm-svn: 71309
2009-05-09 02:58:13 +00:00
Ted Kremenek 2d0ff62a0d It lives! The retain/release checker now tracks objects that are sent
'autorelease'.

llvm-svn: 71307
2009-05-09 01:50:57 +00:00
Zhongxing Xu 8038f7b30f rename: MemRegion:
RValueType => ObjectType
 LValueType => LocationType

No functionality change.

llvm-svn: 71304
2009-05-09 00:50:33 +00:00
Ted Kremenek 9ec08aa3f7 More hacking on autorelease errors. We now can emit basic errors (disabled for
now until ready).

llvm-svn: 71303
2009-05-09 00:44:07 +00:00
Ted Kremenek d35272f96b Put most of the boilerplate logic in place for reporting autorelease errors.
llvm-svn: 71301
2009-05-09 00:10:05 +00:00
Ted Kremenek 8c8fb488e6 retain/release checker: Add stub for HandleAutoreleaseCounts.
llvm-svn: 71290
2009-05-08 23:32:51 +00:00
Ted Kremenek 884a8996c5 retain/release checker: Refactor error-reporting code in EvalDeadSymbols and
EvalEndPath. This sets the stage for handling autorelease counts.

llvm-svn: 71283
2009-05-08 23:09:42 +00:00
Ted Kremenek 3a0516b25a retain checker: Track the number of times a tracked object is sent
'autorelease'. This isn't used yet to flag errors.

llvm-svn: 71244
2009-05-08 20:01:42 +00:00
Ted Kremenek 062c14ba24 Remove experimental ownership attributes from Clang.
llvm-svn: 71216
2009-05-08 15:19:25 +00:00
Ted Kremenek 9157fbb6a6 Minor code cleanup in retain/release checker in preparation for some
other changes.  Instead of repeatedly checking for GC mode when
getting the return effect, just do this computation once.

llvm-svn: 71193
2009-05-07 23:40:42 +00:00
Ted Kremenek bb8d546208 Refactor BugReporter interface to have a new 'BugReporterContext' and
'BugReporterVisitor'. This simplifies callbacks from BugReporter to BugReports
(via VisitNode). It also lays the foundation for arbitrary visitor "call backs"
that can be registered to a BugReporterContext as a PathDiagnostic is
constructed. These call backs can help operate as separate "experts" that can
work on constructed pieces of a PathDiagnostic for which they possess special
knowledge.

llvm-svn: 71121
2009-05-06 21:39:49 +00:00
Ted Kremenek 0626df4eeb Fix analyzer regression reported in PR 4164:
- Update the old StoreManager::CastRegion to strip off 'ElementRegions' when
  casting to void* (Zhongxing: please validate)
- Pass-by-reference argument invalidation logic in CFRefCount.cpp:
  - Strip ElementRegions when the ElementRegion is just a 'raw data' view
    on top of the underlying typed region.

llvm-svn: 71094
2009-05-06 18:19:24 +00:00
Ted Kremenek 213ff5a98e Implement attribute 'ns_autorelease'.
llvm-svn: 70990
2009-05-05 18:44:20 +00:00
Ted Kremenek 94c464ef22 Implement attribute 'cf_returns_owned' (mirrors 'ns_returns_owned').
llvm-svn: 70952
2009-05-05 00:46:09 +00:00
Ted Kremenek 6bdfcf47ad Remove experimental attribute 'ns_ownership_make_collectable.'
llvm-svn: 70940
2009-05-04 23:46:06 +00:00
Ted Kremenek 0836a19931 Rename attributes 'objc_ownership...' to 'ns_ownership...'.
llvm-svn: 70897
2009-05-04 19:10:19 +00:00
Ted Kremenek 5dbfa3fadd Rename attributes:
'objc_ownership_cfretain' -> 'cf_ownership_retain'
'objc_ownership_cfrelease' -> 'cf_ownership_release'

Motivation: Core Foundation objects can be used in isolation from Objective-C,
and this forces users to reason about the separate semantics of CF objects. More
Sema support pending.

llvm-svn: 70884
2009-05-04 17:29:57 +00:00
Ted Kremenek 49a844e1a6 retain checker: Add checker support for FunctionDecl ownership annotations. Need to add Sema support.
llvm-svn: 70873
2009-05-04 16:43:50 +00:00
Ted Kremenek 863f68aa06 retain checker: Pull out logic for parameter annotations into a
separate method.

llvm-svn: 70870
2009-05-04 15:40:58 +00:00
Ted Kremenek df76e6d09d retain checker: Don't treat function's declared in macros differently.
llvm-svn: 70869
2009-05-04 15:34:07 +00:00
Ted Kremenek 1d9a267b2e retain checker:
- Fix retain checker test failures.
- Update retain checker to have annotations override default summary effects, not completely redefine them.

llvm-svn: 70828
2009-05-04 05:31:22 +00:00
Ted Kremenek ff606a1259 retain checker: RetainSummaryManager now has a 'DefaultSummary' object
which is returned instead of a null pointer.  This helps centralize
the logic concerning "default effects".

llvm-svn: 70826
2009-05-04 04:57:00 +00:00
Ted Kremenek 1bff64e309 retain checker: Don't bother using a FoldingSet to unique summaries.
We never compare summaries by their pointers, and we create only a
handful of them when analyzing a given function.

llvm-svn: 70824
2009-05-04 04:30:18 +00:00
Ted Kremenek 4b59ccb563 Fix: <rdar://problem/6850275> CF objects returned from methods with "new" or "copy" in their name should be treated as owned
For methods that follow the "fundamental rule" and return Core
Foundation objects, treat those objects as owned by the caller.

llvm-svn: 70665
2009-05-03 06:08:32 +00:00
Ted Kremenek 7d79a5f87d Convert ArgEffects from an std::vector to an ImmutableMap. This will make it much easier to clean up the summary generation logic with annotations.
llvm-svn: 70660
2009-05-03 05:20:50 +00:00
Ted Kremenek b4cf4a52ab Rename isTrackedObjectType() -> isTrackedObjCObjectType().
llvm-svn: 70657
2009-05-03 04:42:10 +00:00
Ted Kremenek f1e7667099 retain/release checker: Enhance leak description to say that the bug
occurs in GC mode.

llvm-svn: 70638
2009-05-02 19:05:19 +00:00
Ted Kremenek 2ff8a79d27 retain/release checker: Hook up attributes 'objc_ownership_retain' and
'objc_ownership_release' to the effects on receivers.

llvm-svn: 70507
2009-04-30 20:00:31 +00:00
Ted Kremenek b4e27a1838 Handle case in EvalReturn where we cache out in the ExplodedGraph.
llvm-svn: 70475
2009-04-30 05:51:50 +00:00
Ted Kremenek 497df9126f retain/release checker: Use the ObjCMethodDecl in the @implementation if no
matching ObjCMethodDecl exists in the @interface.

llvm-svn: 70474
2009-04-30 05:47:23 +00:00
Ted Kremenek b2a143fad6 retain/release checker: Resolve method decl in @interface after getting the
ObjCInterfaceDecl, not before.

llvm-svn: 70473
2009-04-30 05:41:14 +00:00
Ted Kremenek 223a7d5445 retain/release checker: When determining whether an analyzed method can return
an owned object, consult its summary instead of inspecting the selector. This
picks up annotations, and is just more general.

llvm-svn: 70429
2009-04-29 23:03:22 +00:00
Ted Kremenek d6bef2edab Format cleanup. No functionality change.
llvm-svn: 70420
2009-04-29 22:25:52 +00:00
Ted Kremenek 53cce5c195 Reformat long line. No functionality change.
llvm-svn: 70412
2009-04-29 21:31:59 +00:00
Ted Kremenek 6bd78709f2 retain/release checker: Hoist code for bug reports above transfer function logic
(those diffs are just code moving) and move the logic for "return of owned
object" leak reporting to EvalReturnStmt.

llvm-svn: 70399
2009-04-29 18:50:19 +00:00
Ted Kremenek 99fe1695c7 Add version of getMethodSummary() that can be used to query the summary for the
method currently being analyzed.

llvm-svn: 70388
2009-04-29 17:17:48 +00:00
Ted Kremenek 387243067a Rename getMethodSummary() -> getInstanceMethodSummary().
llvm-svn: 70387
2009-04-29 17:09:14 +00:00
Ted Kremenek 0b50fb1de1 retain/release checker: Refactor getMethodSummary() to not depend on ObjCMessageExpr.
llvm-svn: 70369
2009-04-29 05:04:30 +00:00
Zhongxing Xu 3ee3044bd7 As discussed with Ted offline, re-apply r70293.
llvm-svn: 70358
2009-04-29 02:30:09 +00:00
Ted Kremenek 7686ffaf07 retain/release checker: Refactor the guts of getClassMethodSummary to not depend
on ObjCMessageExpr. This will enable us to use it elsewhere. This should not
change any functionality.

llvm-svn: 70352
2009-04-29 00:42:39 +00:00
Ted Kremenek 869292d5b6 Implement ownership attribute 'objc_ownership_make_collectable'. This allows one
to add 'CFMakeCollectable' semantics to a method.

llvm-svn: 70336
2009-04-28 22:32:26 +00:00
Ted Kremenek ea62bf4e58 Revert 70293.
llvm-svn: 70313
2009-04-28 18:48:13 +00:00
Zhongxing Xu 6e304e6323 Now we can remove the 'blast-through' code.
llvm-svn: 70293
2009-04-28 13:49:42 +00:00
Ted Kremenek 84bfa2c2dc Add two new checker-specific attributes: 'objc_ownership_release' and
'objc_ownership_cfrelease'. These are the 'release' equivalents of
'objc_ownership_retain' and 'objc_ownership_cfretain' respectively.

llvm-svn: 70235
2009-04-27 19:36:56 +00:00
Ted Kremenek e6633567e0 Track objects in GC mode returned by 'alloc', 'new', etc. methods. These are
treated as "not owned" objects.

llvm-svn: 70232
2009-04-27 19:14:45 +00:00
Ted Kremenek ebbef7d0d3 Add new checker-specific attribute 'objc_ownership_cfretain'. This is the same
as 'objc_ownership_cfretain' except that the method acts like a CFRetain instead
of a [... retain] (important in GC modes). Checker support is wired up, but
currently only for Objective-C message expressions (not function calls).

llvm-svn: 70218
2009-04-27 18:27:22 +00:00
Sebastian Redl a7b98a772c Implement function-try-blocks. However, there's a very subtle bug that I can't track down.
llvm-svn: 70155
2009-04-26 20:35:05 +00:00
Ted Kremenek e75de95408 Hook up attribute 'objc_ownership_retain' to the analyzer. This attribute allows
users to specify that a method's argument is visibly retained (reference count
incremented).

llvm-svn: 70008
2009-04-25 01:21:50 +00:00
Ted Kremenek b97d093e16 Hook up __attribute__((objc_ownership_returns)) to the retain/release checker.
llvm-svn: 70002
2009-04-24 23:32:32 +00:00
Ted Kremenek 6a966b2486 Fix the same false positive reported in PR 2542 and <rdar://problem/6793409>
involving an NSAnimation object delegating its release to a delegate method.

llvm-svn: 69992
2009-04-24 21:56:17 +00:00
Ted Kremenek 53c5b7e0bd Minor refactoring: pass selector to getCommonMethodSummary(). No functionality
change.

llvm-svn: 69985
2009-04-24 18:19:07 +00:00
Ted Kremenek 6e86cafca3 retain/release checker: more hacks to workaround false positives cause by
delegates. When a reference counted object is passed as to a 'void*' argument to
a method stop tracking the reference count.

llvm-svn: 69984
2009-04-24 18:00:17 +00:00
Ted Kremenek 21895e0b89 Sentence case bug name.
llvm-svn: 69983
2009-04-24 17:51:19 +00:00
Ted Kremenek 8a5ad39a46 retain/release checker:
- Fix summary lookup for class methods to now use the (optional)
  ObjCInterfaceDecl associated with a message expression. This removes a
  long-standing FIXME.
- Partial fix for <rdar://problem/6062730> by stop tracking objects that
  are passed to [NSObject performSelector].  These methods are often used
  for delegates, which the analyzer doesn't reason about well yet.

llvm-svn: 69982
2009-04-24 17:50:11 +00:00
Ted Kremenek 60746a0a83 Refactor common logic in getMethodSummary() and getClassMethodSummary(). No
functionality change.

llvm-svn: 69936
2009-04-23 23:08:22 +00:00
Ted Kremenek 37467813c5 Further cleanups to isTrackedObjectType().
llvm-svn: 69929
2009-04-23 22:11:07 +00:00
Ted Kremenek 0a1f9c423f retain/release checker: Don't call isTrackedObject() with the canonical type.
This was preventing the checker from tracking return objects referenced by 'id'.

llvm-svn: 69922
2009-04-23 21:25:57 +00:00
Ted Kremenek b2f419dc88 retain/release checker: For class methods, only treat return values that are
object references as tracked objects.

llvm-svn: 69915
2009-04-23 20:02:30 +00:00
Ted Kremenek f27110fc27 Per discussions with Ken Ferry and Paul Marks (<rdar://problem/6815234>) greatly
extend the number of objects tracked by the retain/release checker by assuming
that all class and instance methods should follow Cocoa object "getter" and
"alloc/new" conventions.

llvm-svn: 69908
2009-04-23 19:11:35 +00:00
Zhongxing Xu ac1294318d get a CodeTextRegion when visiting FunctionDecl reference.
get FunctionDecl with more general utility method.

llvm-svn: 69570
2009-04-20 05:24:46 +00:00
Douglas Gregor e3dcb2ddd1 FunctionDecl::getBody() is getting an ASTContext argument for use in
lazy PCH deserialization. Propagate that argument wherever it needs to
be. No functionality change, except that I've tightened up a few PCH
tests in preparation.

llvm-svn: 69406
2009-04-18 00:02:19 +00:00
Ted Kremenek f2489ea043 - Move ownership of MemRegionManager into ValueManager.
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly
simplifies the calling interface to clients.

llvm-svn: 68731
2009-04-09 22:22:44 +00:00
Douglas Gregor bcced4ec31 Propagate the ASTContext to various AST traversal and lookup functions.
No functionality change (really).

llvm-svn: 68726
2009-04-09 21:40:53 +00:00
Ted Kremenek aa4cfc2604 analyzer: Introduce a new class, ValueManager, that serves as an aggregate
"manager of symbolic values", wrapping BasicValueFactory, SymbolManager, and
MemRegionManager. While these individual managers nicely separate functionality
in the analyzer, constructing symbolic values can sometimes be cumbersome
because it requires using multiple managers at once. The goal of this class is
to create some factory methods to create SVals that require the use of these
different managers, thus (hopefully) simplifying the analyzer API for clients.

llvm-svn: 68709
2009-04-09 16:13:17 +00:00
Zhongxing Xu 22f72485ed stop using loc::SymbolVal.
llvm-svn: 68696
2009-04-09 06:43:44 +00:00
Zhongxing Xu 0c87a4e79b stop using loc::SymbolVal.
llvm-svn: 68695
2009-04-09 06:41:51 +00:00