Commit Graph

39 Commits

Author SHA1 Message Date
Ted Kremenek 0440494b66 Increased worklist limit for GRSimpleVals.
llvm-svn: 48037
2008-03-07 22:59:32 +00:00
Ted Kremenek 2bdd77696e Added --trim-path-graph to the driver to trim paths from the ExplodedGraph
that are not related to error nodes.

Fixed bug where we did not detect some NULL dereferences.

Added "ExplodedGraph::Trim" to trim all nodes that cannot transitively reach
a set of provided nodes.

Fixed subtle bug in ExplodedNodeImpl where we could create predecessor
iterators that included the mangled "sink" bit.  The better fix is to integrate
this bit into the void* for the wrapped State, not the NodeGroups representing
a node's predecessors and successors.

llvm-svn: 48036
2008-03-07 22:58:01 +00:00
Ted Kremenek 910e9de131 Renamed ValueManager to BasicValueFactory.
llvm-svn: 48025
2008-03-07 20:13:31 +00:00
Ted Kremenek 40bc74fde7 Refined divide-by-zero checking to distinguish between must and may
divide-by-zero errors.

llvm-svn: 48013
2008-03-07 19:04:53 +00:00
Gabor Greif 3a8edd8536 fix typos
llvm-svn: 47995
2008-03-06 10:40:09 +00:00
Chris Lattner 37e0587839 remove the source location arguments to various target query methods.
llvm-svn: 47954
2008-03-05 18:54:05 +00:00
Ted Kremenek d5804b31c4 Plug-in transfer function "EvalCall" now takes as an argument the current
GRStmtNodeBuilder and is now responsible for adding its own nodes to the graph.

llvm-svn: 47923
2008-03-05 00:33:14 +00:00
Ted Kremenek 9f3f827e65 Added preliminary transfer function support for references.
llvm-svn: 47912
2008-03-04 22:16:08 +00:00
Ted Kremenek b2ce263891 Enhanced pretty-printing of undefined-argument errors.
llvm-svn: 47873
2008-03-04 00:42:54 +00:00
Ted Kremenek 51e87ea210 Added extra check for calls to functions where we pass undefined values
as arguments.

llvm-svn: 47778
2008-02-29 23:53:11 +00:00
Ted Kremenek 6f5fca78e4 Add checks for function calls via a function pointer that is NULL, Undefined,
or otherwise a constant integer value that doesn't evaluate to an address.

llvm-svn: 47774
2008-02-29 23:14:48 +00:00
Ted Kremenek b2b50b7bf5 Added simple hack to reduce redundant warnings from the checker:
Cache the location of the error.  Don't emit the same
warning for the same error type that occurs at the same program
location but along a different path.
      

llvm-svn: 47727
2008-02-28 20:38:16 +00:00
Ted Kremenek e0c79380cd Added checking for undefined results of '<<' and '>>' (shifting by too many bits, etc.)
This current implementation only works when both operands are concrete values; later we will add support for symbolic values.

llvm-svn: 47726
2008-02-28 20:32:03 +00:00
Ted Kremenek 22c62c1641 Merged ValueState and ValueStateImpl into just ValueState, with GRExprEngine::StateTy just becoming ValueState*.
llvm-svn: 47714
2008-02-28 10:21:43 +00:00
Ted Kremenek 93d1fed5ff Renamed "Uninitialized" -> "Undefined" in path-sensitive value tracking engine.
llvm-svn: 47713
2008-02-28 09:25:22 +00:00
Ted Kremenek 06516b124b Fixed use of an uninitialized variable.
llvm-svn: 47691
2008-02-27 20:47:56 +00:00
Ted Kremenek fd8352c2b9 Added string "[CHECKER]" to the output diagnostics produced by the GRSimpleVals analysis.
llvm-svn: 47678
2008-02-27 17:56:16 +00:00
Ted Kremenek c025841dd4 Header file cleanups: reduce number of includes; move ValueState.h into include directory tree.
llvm-svn: 47661
2008-02-27 06:07:00 +00:00
Ted Kremenek 448538d860 Added boilerplate for plug-in transfer function support for CallExprs.
GRSimpleVals performs the following action: invalidate all values passed-by-reference.

llvm-svn: 47638
2008-02-26 23:04:29 +00:00
Ted Kremenek e9f30d3288 Removed static analysis-specific diagnostics from DiagnosticKinds.def.
Use custom diagnostics for static analysis checkers.  Added warnings
for dereferencing uninitialized values and divide-by-zeroes.

llvm-svn: 47626
2008-02-26 21:31:18 +00:00
Ted Kremenek 43638a87e5 Punt on unifying symbolic lvalues. This won't be needed for many checkers.
llvm-svn: 47489
2008-02-22 18:41:59 +00:00
Ted Kremenek cb507025d4 Added "assumption" logic for lval::FuncVal and lval::GotoLabel, and simplified
assumption logic for lval::DeclVal.

llvm-svn: 47466
2008-02-22 00:54:56 +00:00
Ted Kremenek d21429a8e7 Remove incorrect casts from UnknownVal to NonLVal.
llvm-svn: 47446
2008-02-21 19:10:12 +00:00
Ted Kremenek 7e4861b3c1 Simplified and generalized transfer function logic for casts, allowing
the transfer function to be invoked without an Expr* for the Cast operation.

Added implicit promotions to the transfer function logic for compound
assignments.

llvm-svn: 47444
2008-02-21 18:43:30 +00:00
Ted Kremenek 7f0639b039 Major cleanup of path-sensitive analysis engine and the current analysis
based on constant. prop. and limited symbolics.

- Renamed class: RValue -> RVal, LValue -> LVal, etc.
- Minor method renamings and interface cleanups.
- Tightened the RVal "type system" so that UninitializedVal and UnknownVal
  cannot be cast to LVal or NonLVal.  This forces these corner cases values
  to be explicitly handled early before being dispatched to plug-in transfer
  function logic.
- Major cleanup in the transfer function logic for binary and unary operators.
  Still fixing some regressions, but we now explicitly handle Uninitialized
  and Unknown values in a more rigorous way.

llvm-svn: 47441
2008-02-21 18:02:17 +00:00
Ted Kremenek 34e83b80fd Implemented transfer function logic for unary '+'
llvm-svn: 47357
2008-02-20 04:12:31 +00:00
Ted Kremenek 86dc7ae58e Fixed bug classof() bug with RValues that could cause an UninitializedVal
or UnknownVal to be interpreted as an actual NonLValue/LValue.

llvm-svn: 47304
2008-02-19 02:34:18 +00:00
Ted Kremenek 0f7130adc4 --grsimple now reports the number of nodes in the ExplodedGraph for
an analyzed function.

GRExprEngine now records stores to "uninitialized lvalues" (which are sinks in
the ExplodedGraph).

llvm-svn: 47293
2008-02-19 00:22:37 +00:00
Ted Kremenek 346169fa3d Added more assertions and checks in transfer function logic to check for
UninitializedVals and UnknownVals.

llvm-svn: 47288
2008-02-18 22:57:02 +00:00
Ted Kremenek 3b1beb224b Temporary solution to push analysis through to analyzing PCRE.
We will implement symbol "unification" later.

llvm-svn: 47284
2008-02-18 21:19:49 +00:00
Eli Friedman 1d88371663 A couple of msvc compile fixes from the ml; I haven't tested with msvc,
but the fixes are reasonable.

llvm-svn: 47224
2008-02-16 23:17:23 +00:00
Ted Kremenek 6698cb8aa3 Refactored code for transfer functions for binary operators involving two LValues.
Fixed bug in transfer functions for sizeof(*); we were incorrectly evaluating to
a value of the wrong type.

Fixed bug in transfer functions for compound assignments where we did not properly
handle assignments involving dereferences of symbolic values.

llvm-svn: 47190
2008-02-15 23:15:23 +00:00
Ted Kremenek bc0ba39a1e Added boilerplate transfer function support for pointer arithmetic operations.
llvm-svn: 47147
2008-02-15 00:52:26 +00:00
Ted Kremenek e161afc4dd Added --grsimple-view option to clang driver; this is the same as
--grsimple except that it visualizes the ExplodedGraph using dot and
outputs the current function being analyzed.  --grsimple is now silent
except when it emits diagnostics.

llvm-svn: 47146
2008-02-15 00:35:38 +00:00
Ted Kremenek 5d8bab7ecd Don't analyze functions when we have parse errors.
llvm-svn: 47139
2008-02-14 22:54:17 +00:00
Ted Kremenek d3122cb83c Renamed GRConstants => GRSimpleVals.
Moved driver logic for --grsimple to GRSimpleVals.cpp.

llvm-svn: 47137
2008-02-14 22:36:46 +00:00
Ted Kremenek cf7cf8e8b0 Migrated transfer functions for binary operators for simple value tracking
from RValues to GRTransferFuncs/GRSimpleVals.

llvm-svn: 47131
2008-02-14 19:37:24 +00:00
Ted Kremenek 4bad8f7ad6 Migrated transfer functions for unary "~" and "-" to GRTransferFuncs/GRSimpleVals.
llvm-svn: 47126
2008-02-14 18:40:24 +00:00
Ted Kremenek 3ca942969e Started partitioning of transfer function logic (and thus the policy behind
these operations) into GRTransferFuncs and its subclasses.  Originally all
of this logic was handled by the class RValue, but in reality different
analyses will want more flexibility on how they evaluate different values.

Transfer functions migrated so far: "Cast"

llvm-svn: 47125
2008-02-14 18:28:23 +00:00