Commit Graph

814 Commits

Author SHA1 Message Date
Ted Kremenek 6ee8f8bcb5 Add an optional "tag" to conjured symbols that allows us to distinguish between
multiple symbols conjured at the same location. All that is required of the tag
is that it is a fixed void* value that points to an memory address that remains
valid throughout the remainder of the lifetime of the SymbolManager.

llvm-svn: 66092
2009-03-04 22:53:46 +00:00
Ted Kremenek 79fa6a24b7 GRExprEngine::VisitCast: Just pass through function and block pointers.
llvm-svn: 66036
2009-03-04 16:52:57 +00:00
Zhongxing Xu 7d41c616f1 Adjust indentation.
llvm-svn: 66022
2009-03-04 06:33:38 +00:00
Ted Kremenek d275bf3c54 Added the notion of a "boundable region", which is a region that can have a direct binding in the StoreManager.
llvm-svn: 66005
2009-03-04 02:43:08 +00:00
Ted Kremenek 52170722ec RegionStore: Handle implicit parameters.
llvm-svn: 65987
2009-03-04 00:23:05 +00:00
Ted Kremenek 74a2d0f8ca Create "TypedViewRegions" that layer on top of SymbolicRegions when handling
pointer-to-pointer casts involving symbolic locations.

llvm-svn: 65984
2009-03-04 00:14:35 +00:00
Ted Kremenek 804fc236a7 Use GetSValAsScalarOrLoc instead of GetSVal to prevent unintended structure or array "loads".
llvm-svn: 65983
2009-03-04 00:13:50 +00:00
Ted Kremenek 19df925f6b Add "GetSValAsScalarOrLoc" methods to GRState/GRStateRef that only perform a
retrieval from the store/environment for locations or scalar types.

llvm-svn: 65982
2009-03-04 00:13:10 +00:00
Ted Kremenek 67c710e2c8 RegionStore::RemoveDeadBindings needs to check all the symbols of the super region of a scanned region as well.
llvm-svn: 65981
2009-03-04 00:11:38 +00:00
Ted Kremenek c9747dd60f Rework use of loc::SymbolVal in the retain/release checker to use the new method
SVal::getAsLocSymbol(). This simplifies the code and allows the retain/release
checker to (I believe) also correctly reason about location symbols wrapped in
SymbolicRegions.

Along the way I cleaned up SymbolRef a little, disallowing implicit casts to
'unsigned'.

llvm-svn: 65972
2009-03-03 22:06:47 +00:00
Ted Kremenek 9f276d6279 Don't use std::auto_ptr with getSubRegionMap().
llvm-svn: 65957
2009-03-03 19:02:42 +00:00
Ted Kremenek e3852bd252 Fix case where we should use dyn_cast instead of cast.
llvm-svn: 65956
2009-03-03 19:01:37 +00:00
Ted Kremenek 5340b248b4 Fix extra ';' bug noticed by Mike Stump.
llvm-svn: 65954
2009-03-03 18:15:30 +00:00
Ted Kremenek 4c8a5817a5 Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning MemRegions.
llvm-svn: 65919
2009-03-03 02:51:43 +00:00
Ted Kremenek 8dc671cdc9 Add StoreManager::getSubRegionMap(). This method returns an opaque mapping for clients of StoreManagers from MemRegions to their subregions.
llvm-svn: 65914
2009-03-03 01:35:36 +00:00
Ted Kremenek c7b663120e BugReporter: Construct path-related PathDiagnosticPieces with kind "ControlFlow".
llvm-svn: 65876
2009-03-02 21:41:18 +00:00
Ted Kremenek 1f8140d3d4 For now, do not output the 'DisplayHint' in plist files.
llvm-svn: 65860
2009-03-02 19:39:50 +00:00
Zhongxing Xu 57359cad17 remove an implemented fixme.
llvm-svn: 65817
2009-03-02 08:25:09 +00:00
Zhongxing Xu e7d1493216 Initial support for pointer arithmetic. Only support concrete indexes and
offsets for now.

llvm-svn: 65814
2009-03-02 07:52:23 +00:00
Daniel Dunbar 51adf5824e Rename lib/Driver (etc) to lib/Frontend in prep for the *actual*
driver taking lib/Driver.

llvm-svn: 65811
2009-03-02 06:16:29 +00:00
Ted Kremenek 07e95680fd Rename AnonTypedRegion to TypedViewRegion.
llvm-svn: 65764
2009-03-01 05:44:08 +00:00
Ted Kremenek b90a75e55d Adjust wording of bug names.
llvm-svn: 65763
2009-03-01 05:43:22 +00:00
Ted Kremenek 111a6bdbd3 Revert 65707 (causes stack memory to be referenced after it is released).
llvm-svn: 65717
2009-02-28 20:50:43 +00:00
Chris Lattner d4ed7e8bb9 remove static ctor.
llvm-svn: 65707
2009-02-28 19:37:06 +00:00
Chris Lattner 3385fe12ce improve compatibility with the VC++'08 C++ compiler. Patch by
Niklas Larsson!

llvm-svn: 65706
2009-02-28 19:01:03 +00:00
Ted Kremenek cbcc5e83ca When retrieving the location of a Node, for MemberExprs use the location of the
'.' or '->'.

llvm-svn: 65651
2009-02-27 20:05:10 +00:00
Douglas Gregor deaad8cc34 Create a new TypeNodes.def file that enumerates all of the types,
giving them rough classifications (normal types, never-canonical
types, always-dependent types, abstract type representations) and
making it far easier to make sure that we've hit all of the cases when
decoding types. 

Switched some switch() statements on the type class over to using this
mechanism, and filtering out those things we don't care about. For
example, CodeGen should never see always-dependent or non-canonical
types, while debug info generation should never see always-dependent
types. More switch() statements on the type class need to be moved 
over to using this approach, so that we'll get warnings when we add a
new type then fail to account for it somewhere in the compiler.

As part of this, some types have been renamed:

  TypeOfExpr -> TypeOfExprType
  FunctionTypeProto -> FunctionProtoType
  FunctionTypeNoProto -> FunctionNoProtoType

There shouldn't be any functionality change...

llvm-svn: 65591
2009-02-26 23:50:07 +00:00
Ted Kremenek e9817aaa05 PathDiagnosticPiece now automatically strips off trailing periods in diagnostic messages.
llvm-svn: 65574
2009-02-26 21:30:32 +00:00
Ted Kremenek 6832977821 Refine some grammar in the retain/release diagnostics.
llvm-svn: 65571
2009-02-26 21:04:07 +00:00
Douglas Gregor 87f95b0a6a Introduce code modification hints into the diagnostics system. When we
know how to recover from an error, we can attach a hint to the
diagnostic that states how to modify the code, which can be one of:

  - Insert some new code (a text string) at a particular source
    location
  - Remove the code within a given range
  - Replace the code within a given range with some new code (a text
    string)

Right now, we use these hints to annotate diagnostic information. For
example, if one uses the '>>' in a template argument in C++98, as in
this code:

  template<int I> class B { };
  B<1000 >> 2> *b1;

we'll warn that the behavior will change in C++0x. The fix is to
insert parenthese, so we use code insertion annotations to illustrate
where the parentheses go:

test.cpp:10:10: warning: use of right-shift operator ('>>') in template
argument will require parentheses in C++0x
  B<1000 >> 2> *b1;
         ^
    (        )


Use of these annotations is partially implemented for HTML
diagnostics, but it's not (yet) producing valid HTML, which may be
related to PR2386, so it has been #if 0'd out.

In this future, we could consider hooking this mechanism up to the
rewriter to actually try to fix these problems during compilation (or,
after a compilation whose only errors have fixes). For now, however, I
suggest that we use these code modification hints whenever we can, so
that we get better diagnostics now and will have better coverage when
we find better ways to use this information.

This also fixes PR3410 by placing the complaint about missing tokens
just after the previous token (rather than at the location of the next
token).

llvm-svn: 65570
2009-02-26 21:00:50 +00:00
Ted Kremenek 8b09ad17f9 Use Loc::IsLocType() instead of isPointerType() and isReferenceType().
llvm-svn: 65568
2009-02-26 20:29:19 +00:00
Daniel Dunbar e2617d97a5 Drop uses of isPointerLikeType.
- No functionality change.

llvm-svn: 65560
2009-02-26 19:03:24 +00:00
Ted Kremenek ff290caf56 Fix subtle bug in EvalEagerlyAssume: Check if the previous node was at the same statement.
llvm-svn: 65486
2009-02-25 23:32:10 +00:00
Ted Kremenek 8ec8cf0207 Fix recently introduced switch case fallthrough bug.
llvm-svn: 65485
2009-02-25 23:11:49 +00:00
Ted Kremenek dc3f50fbd9 Add experimental logic in GRExprEngine::EvalEagerlyAssume() to handle
expressions of the form: 'short x = (y != 10);' While we handle 'int x = (y !=
10)' lazily, the cast to another integer type currently loses the symbolic
constraint. Eager evaluation of the constraint causes the paths to bifurcate and
eagerly evaluate 'y != 10' to a constant of 1 or 0. This should address
<rdar://problem/6619921> until we have a better (more lazy approach) for
handling promotions/truncations of symbolic integer values.

llvm-svn: 65480
2009-02-25 22:32:02 +00:00
Ted Kremenek dce7846c24 retain/release checker: Implement basic tracking of autorelease stack. Next thing is to wire up pools with their contents.
llvm-svn: 65425
2009-02-25 02:54:57 +00:00
Ted Kremenek 260c49a712 Fix broken logic from my last commit. Branches only occur at basic blocks that end with terminators.
llvm-svn: 65410
2009-02-24 23:34:17 +00:00
Ted Kremenek c324a0e089 Fix diagnostic regression where the leak diagnostic could appear earlier in the path than the branches taken.
llvm-svn: 65407
2009-02-24 23:30:57 +00:00
Ted Kremenek c52f9394ce retain/release checker:
- For autorelease pool tracking, keep information about the stack of pools
  separate from their contents. Also, keep track of the number of times an
  autorelease pool will send the "release" message to an object when the pool is
  destroyed.
- Update CFRefCount::Update to return a new state instead of a reference count
  binding. This will allow us to implement more complicated semantics with
  autorelease pools.

llvm-svn: 65384
2009-02-24 19:15:11 +00:00
Ted Kremenek cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Ted Kremenek 2c2ec42322 Tidy up 'ExecutionContinues' to distinguish between jumping to the end of a 'method' or 'funciton'.
llvm-svn: 65346
2009-02-23 23:13:51 +00:00
Ted Kremenek 62b3879c5e Tidy up the path diagnostic generation logic in BugReporter and remove a case where an "Execution continues..." diagnostic could result in an empty message bubble.
llvm-svn: 65342
2009-02-23 22:44:26 +00:00
Ted Kremenek 50db3d0923 Add more boilerplate logic to more accurately reason about autorelease pools.
This doesn't change the current functionality, but better codifies the
autorelease pool stack itself.

llvm-svn: 65328
2009-02-23 17:45:03 +00:00
Ted Kremenek 726fd5cbf5 Fix 80 col. violations.
llvm-svn: 65322
2009-02-23 16:54:00 +00:00
Ted Kremenek 82157a17c1 Per Chris L.'s suggestion, use getAsFunctionType() instead of getDesguaredType(). Constify some pointers along the way.
llvm-svn: 65321
2009-02-23 16:51:39 +00:00
Ted Kremenek e73f282213 retain/release checker: For now don't track the retain count of NSWindow objects (opt for false negatives).
llvm-svn: 65304
2009-02-23 02:51:29 +00:00
Ted Kremenek 5485a2f70b Remove typo.
llvm-svn: 65302
2009-02-23 02:42:56 +00:00
Ted Kremenek 7d4fc5bcdc '[NSAutoreleasePool addObject:]' has an 'autorelease' effect, not a DoNothing effect.
llvm-svn: 65301
2009-02-23 02:31:16 +00:00
Ted Kremenek 35251f3d92 Fix regression in naming convention derivation: a method only follows the copy 'rule' if it doesn't already start with 'init', etc.
llvm-svn: 65269
2009-02-22 07:32:24 +00:00
Ted Kremenek 97ad7b689e Use llvm::StringsEqualNoCase instead of strncasecmp.
llvm-svn: 65237
2009-02-21 18:26:02 +00:00