Commit Graph

95 Commits

Author SHA1 Message Date
Ted Kremenek c4deb92316 Disallow the use of UnknownVal as the index for ElementRegions. UnknownVals can be used as
the index when the value evaluation isn't powerful enough.  By creating ElementRegions with
UnknownVals as the index, this gives the false impression that they are the same element, when
they really aren't.  This becomes really problematic when deriving symbols from these regions
(e.g., those representing the initial value of the index), since two different indices will
get the same symbol for their binding.

This fixes an issue with the idempotent operations checker that would cause two indices that
are clearly not the same to make it appear as if they always had the same value.

Fixes <rdar://problem/8431728>.

llvm-svn: 113920
2010-09-15 03:13:30 +00:00
Ted Kremenek 72c9b0d582 Adjust assertion in RegionStoreManager::RetrieveArray() to also take into account typedefs.
llvm-svn: 113893
2010-09-14 23:29:38 +00:00
Ted Kremenek c95589d2e6 Don't divide-by-zero in RegionStoreManager::getSizeInElements() when getting the size of a VLA. We don't track VLA extents yet,
but we should at least not crash.  Fixes <rdar://problem/8424269>.

llvm-svn: 113888
2010-09-14 23:08:34 +00:00
Ted Kremenek 1e424241b4 Fixed unused variable warning.
llvm-svn: 112784
2010-09-02 00:34:30 +00:00
Ted Kremenek 0e12f9cc7b Partial fix for PR 8015 (fix is actually by Jordy Rose, and I added a test case for follow-on work). This patch adds a bandaid for RegionStore's limited reasoning about symbolic array values.
llvm-svn: 112766
2010-09-01 23:27:26 +00:00
Ted Kremenek d588e78b95 Don't assert in the analyzer when analyze code does a byte load from a function's address. Fixes PR 8052.
llvm-svn: 112761
2010-09-01 23:00:46 +00:00
John McCall e302792b61 GCC didn't care for my attempt at API compatibility, so brute-force everything
to the new constants.

llvm-svn: 112047
2010-08-25 11:45:40 +00:00
Zhongxing Xu fee32dc783 Adjust code placement.
llvm-svn: 111790
2010-08-23 01:37:32 +00:00
Zhongxing Xu faf150bbc3 Place method near its class.
llvm-svn: 111737
2010-08-21 12:24:38 +00:00
Zhongxing Xu 7a1a8e25ea Remove dead code.
llvm-svn: 111736
2010-08-21 11:05:46 +00:00
Zhongxing Xu e11f17f5ed Improve comments.
llvm-svn: 111735
2010-08-21 11:03:37 +00:00
Zhongxing Xu 5cba6c85c9 Remove a special case for OSAtomic functions. We can already bind and retrieve
with the same binding key. The only trick here is that sometimes the Symbolic
region is stored in with an LocAsInteger wrapper. We unwrap that in 
SVal::getAsLocSymbol().

llvm-svn: 111734
2010-08-21 11:00:26 +00:00
Zhongxing Xu e70b6d17a4 Remove dead code. We no longer need it because now we treat the first element
region and its base region as the same binding key.

llvm-svn: 111732
2010-08-21 08:55:42 +00:00
Zhongxing Xu cdadf8d9b2 remove unused variable.
llvm-svn: 111731
2010-08-21 06:51:45 +00:00
Zhongxing Xu adc3ac7012 When invalidating a struct region, whether its type definition exists is not
relavant any more, because we set its default value to a symbol, and the type of
default symbolic value is irrelavant.

llvm-svn: 111730
2010-08-21 06:26:59 +00:00
Ted Kremenek 87562e8371 Remove dead code.
llvm-svn: 111616
2010-08-20 06:06:41 +00:00
Jordy Rose 796b5122d9 Handle nested compound values in BindArray for multidimensional arrays. Fixes PR7945.
llvm-svn: 111602
2010-08-20 01:05:59 +00:00
Ted Kremenek 5322150a7f Rewrite code fragment to avoide ICE in MSVC. Fixes PR 7875. Patch by Dimitry Andric!
llvm-svn: 111327
2010-08-17 23:29:06 +00:00
Benjamin Kramer 35b077e674 Convert all uses of StringLiteral::getStrData() to StringLiteral::getString()
and remove getStrData().  Patch by Peter Davies (with some tweaks).

llvm-svn: 111229
2010-08-17 12:54:38 +00:00
Jordy Rose 63a38a1b94 Instead of using operator bool() for testing if a BindingKey is valid, use an explicit isValid() method.
llvm-svn: 111181
2010-08-16 20:53:01 +00:00
Jordy Rose df28e8ec41 - Allow making ElementRegions with complex offsets (expressions or symbols) for the purpose of bounds-checking.
- Rewrite GRState::AssumeInBound to actually do that checking, and to use the normal constraint path.
- Remove ConstraintManager::AssumeInBound.
- Teach RegionStore and FlatStore to ignore those regions for now.

llvm-svn: 111116
2010-08-16 01:15:17 +00:00
Zhongxing Xu ee770d40fd StoreManager::RemoveDeadBindings() can take a Store instead of an entire GRState now.
llvm-svn: 111103
2010-08-15 12:45:09 +00:00
Zhongxing Xu 0ba9fd6c47 Remove redundant method.
llvm-svn: 111099
2010-08-15 10:08:38 +00:00
Jordy Rose ac0ab20e3b Add a callback for when region changes occur. Still somewhat of a work-in-progress, but working! Effect on clients: all changes to a store now go through GRState.
llvm-svn: 111078
2010-08-14 20:44:32 +00:00
Zhongxing Xu 8de0a3d8c3 MemRegion can refer to ASTContext without external help.
llvm-svn: 110784
2010-08-11 06:10:55 +00:00
Jordy Rose c88c74cb2f Remove InvalidateRegion from stores, since it's no longer called from outside.
llvm-svn: 110309
2010-08-05 03:28:45 +00:00
Jordy Rose ddec092641 Makes GRState::makeWithStore private, to encourage clients to make store changes through GRState instead of directly accessing the StoreManager. Also adds cover methods for InvalidateRegion(s) and EnterStackFrame to GRState.
This is in preparation for proposed region change notifications. No functionality change.

llvm-svn: 110137
2010-08-03 20:44:35 +00:00
Zhongxing Xu fd91d27630 Improve flat store: MemRegion::getAsOffset() computes a region's offset within
the top-level object. FlatStore now can bind and retrieve element and field
regions.
PR7297 is fixed by flat store.

llvm-svn: 110020
2010-08-02 04:56:14 +00:00
Jordy Rose daa1c83413 Use a LazyCompoundVal to handle initialization with a string literal, rather than copying each character.
llvm-svn: 109734
2010-07-29 06:40:33 +00:00
Ted Kremenek 385f71b1f4 Augment RegionStore::BindStruct() to bind symbolicated struct values. This fixes a false path issue reported in <rdar://problem/8243408> and also spurs another cause where the idempotent operations checker fires.
llvm-svn: 109710
2010-07-29 00:28:47 +00:00
Ted Kremenek da534381f8 Fix casts in RegionStore to not always assume that bindings are only to SubRegions. Fixes assertion failure
reported in PR 7572.

llvm-svn: 107738
2010-07-06 23:53:29 +00:00
Jordy Rose 674bd55f02 Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.
Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577
2010-07-04 00:00:41 +00:00
Ted Kremenek bd862711fd Fix PR 7475 by enhancing the static analyzer to also invalidate bindings for non-static global variables
when calling a function/method whose impact on global variables we cannot accurately estimate.
This change introduces two new MemSpaceRegions that divide up the memory space of globals, and causes
RegionStore and BasicStore to consult a binding to the NonStaticGlobalsMemSpaceRegion when lazily
determining the value of a global.

llvm-svn: 107423
2010-07-01 20:16:50 +00:00
Jordy Rose f7488ec6dc Add an ivar to SymbolReaper for the current statement, and then stop passing the current statement around everywhere. Preparation for symbolic extents.
llvm-svn: 107422
2010-07-01 20:09:55 +00:00
Jordy Rose 61176897ba Pointer comparisons (and pointer-pointer subtraction). Basically filling in SimpleSValuator::EvalBinOpLL().
llvm-svn: 106992
2010-06-28 08:26:15 +00:00
Jordy Rose c3bcc36a0b When a constant size array is casted to another type, its length should be scaled as well.
llvm-svn: 106911
2010-06-25 23:23:04 +00:00
Tom Care 375387d1f8 Change RegionStoreManager::Retrieve to infer the type of a symbolic region from the context when it is not already available.
llvm-svn: 106868
2010-06-25 18:22:31 +00:00
Ted Kremenek 2a33a0deef Correctly construct an ElementRegion for alloca() + pointer arithmetic. Fixes analyzer
crash reported in PR 7450.

llvm-svn: 106609
2010-06-22 23:58:31 +00:00
Ted Kremenek 648ef7a2d7 Implement RegionStoreManager::iterBindings(). This implementation only returns the base region in
the binding key instead of the region + offset.  It isn't clear if this is the best semantics, but most
clients will likely only care about simple bindings, or bindings to a particular variable.  We can
refine later if necessary.

llvm-svn: 106183
2010-06-17 00:24:42 +00:00
Zhongxing Xu ce83656f97 Limit the use of BindDefault().
llvm-svn: 105265
2010-06-01 04:49:26 +00:00
Zhongxing Xu 527ff6d1dc Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.

llvm-svn: 105264
2010-06-01 03:01:33 +00:00
Ted Kremenek 4708f5a89b After conversations with Zhongxing Xu and Jordy Rose, refine the logic in
RegionStoreManager::RetrieveElement() that handles indexing into a larger scalar
object to only consult the direct binding of a super region if it is a scalar.
This isn't perfect yet, and a big FIXME is attached to the code.  This causes
the test case for PR 7218 now to pass.

llvm-svn: 105195
2010-05-31 01:22:04 +00:00
Zhongxing Xu 94aec9381d Revert r105097. Thinking about a better fix.
llvm-svn: 105099
2010-05-29 06:49:04 +00:00
Zhongxing Xu 928a190a8e Fix PR7218. Patch by Jordy Rose.
llvm-svn: 105097
2010-05-29 06:23:24 +00:00
Zhongxing Xu eb4fc4a64c Small fix.
llvm-svn: 104669
2010-05-26 03:36:08 +00:00
Zhongxing Xu d4f1294f1e Remove extents of dead symbolic regions when RemoveDeadBindings.
This requires creating new persistent states due to the nature of GDM.

llvm-svn: 104668
2010-05-26 03:27:35 +00:00
Zhongxing Xu 658dd8b176 CastSizeChecker checks when casting a malloc'ed symbolic region to type T,
whether the size of the symbolic region is a multiple of the size of T.
Fixes PR6123 and PR7217.

llvm-svn: 104584
2010-05-25 04:59:19 +00:00
Douglas Gregor 8385a06929 Introduce Type::isStructureOrClassType(), which does the obvious
thing. Audit all uses of Type::isStructure(), changing those calls to
isStructureOrClassType() as needed (which is alsmost
everywhere). Fixes the remaining failure in Boost.Utility/Swap.

llvm-svn: 102386
2010-04-26 21:31:17 +00:00
Zhongxing Xu b6843f5f35 Analyzer: add support for CXXNewExpr.
llvm-svn: 101771
2010-04-19 11:47:28 +00:00
Ted Kremenek 26984fb4eb Remove copy of 'Optional' in Clang tree, and convert clients to use the one now in the LLVM tree.
llvm-svn: 100891
2010-04-09 20:26:58 +00:00