Commit Graph

219 Commits

Author SHA1 Message Date
Zhongxing Xu b7cf95957d Instead of setting the default value of the array region, bind the rest of the
array elements to 0 explicitly. Create 0 values with the element type.

llvm-svn: 73946
2009-06-23 05:23:38 +00:00
Zhongxing Xu 1a195b264f Remove duplicated methods.
llvm-svn: 73940
2009-06-23 02:51:21 +00:00
Zhongxing Xu 74fa0bc3de add a fixme.
llvm-svn: 73939
2009-06-23 02:08:56 +00:00
Zhongxing Xu 8077d7eb15 Allow CodeTextRegion to be cast to 'void *'.
llvm-svn: 73880
2009-06-22 08:36:10 +00:00
Zhongxing Xu 540c009fbe Return UnknownVal for pointer arithmetic on struct fields.
llvm-svn: 73851
2009-06-21 13:24:24 +00:00
Zhongxing Xu cc45762253 If the SymbolicRegion was cast to another type, use that type to create the
ElementRegion.

llvm-svn: 73754
2009-06-19 04:51:14 +00:00
Zhongxing Xu cea6578078 When casting region, if we do not create an element region, record the cast-to
type. 

When retrieving the region value, if we are going to create a symbol value, use
the cast-to type if possible.

llvm-svn: 73690
2009-06-18 06:29:10 +00:00
Steve Naroff fb4330f255 First step toward fixing <rdar://problem/6613046> refactor clang objc type representation.
Add a type (ObjCObjectPointerType) and remove a type (ObjCQualifiedIdType).

This large/tedious patch is just a first step. Next step is to remove ObjCQualifiedInterfaceType. After that, I will remove the magic TypedefType for 'id' (installed by Sema). This work will enable various simplifications throughout clang (when dealing with ObjC types). 

No functionality change.

llvm-svn: 73649
2009-06-17 22:40:22 +00:00
Ted Kremenek 609df30929 Start moving in the direction of removing GRStateRef. Now each
GRState object has a direct reference to its GRStateManager, making
the functionality of GRStateRef redunandant.  This will lead to some
nice API cleanup and code shrinking across libAnalysis.

llvm-svn: 73644
2009-06-17 22:02:04 +00:00
Ted Kremenek 4533a55696 RegionStoreManager:
- Add "sections" to RegionStoreManager.cpp to delineate functionality.
- Add new function "CreateFieldsOnlyRegionStoreManager" that uses the new
  RegionStoreFeatures class to use a reduced set of features from
  RegionStoreManager (in this case, only field-sensitivity). This isn't
  completely hooked up yet.

llvm-svn: 73572
2009-06-16 22:36:44 +00:00
Zhongxing Xu 838a0db0ba Use canonical type for building ElementRegion. Otherwise ElementRegions cannot
be unique.

llvm-svn: 73482
2009-06-16 09:55:50 +00:00
Zhongxing Xu 70b27e6f8b Stop tracking non-compound value for struct. It may be caused by imprecise cast
logic.

llvm-svn: 73279
2009-06-13 01:31:11 +00:00
Zhongxing Xu 2693c504c2 use getAsPointerType() method.
llvm-svn: 73218
2009-06-12 03:59:12 +00:00
Zhongxing Xu 519a47d4bd Bind the mistakenly generated nonloc::SymbolVal to struct correctly. See the
comments for added test case for details.

llvm-svn: 73189
2009-06-11 09:11:27 +00:00
Zhongxing Xu d85a991253 Use more robust getAsRecordType() method.
llvm-svn: 73186
2009-06-11 07:27:30 +00:00
Zhongxing Xu 1075cc0b02 Treat AllocaRegion as SymbolicRegion in RegionStore::Retrieve().
llvm-svn: 72166
2009-05-20 09:18:48 +00:00
Zhongxing Xu a7907608fb * API change: we need to pass GRState to GRExprEngine::EvalBinOp() because
RegionStore needs to know the type of alloca region. 
* RegionStoreManager::EvalBinOp() now converts the alloca region to its first
  element region, as what is done to symbolic region.

llvm-svn: 72164
2009-05-20 09:00:16 +00:00
Daniel Dunbar 29f36b4c9a Silence a Release-Asserts warning.
llvm-svn: 72013
2009-05-18 16:48:48 +00:00
Zhongxing Xu 08a2ede018 Add logic for invalidating array region to CFRefCount.cpp. When invalidating
array region, set its default value to conjured symbol. When retrieving its
element, create new region value symbol for the element.

Also fix some 80 columns violations.

llvm-svn: 71548
2009-05-12 10:10:00 +00:00
Zhongxing Xu c012656266 When retrieving an ElementRegion, if its super region is a StringRegion,
retrieve the string value.

llvm-svn: 71430
2009-05-11 14:23:36 +00:00
Zhongxing Xu bf938d3160 Fix a bug that leads to infinite loop. Set the correct element type to
ElementRegion.

llvm-svn: 71428
2009-05-11 12:48:56 +00:00
Zhongxing Xu c9c3dab491 When casting VarRegion, if the var type is aggregate type and the cast-to
pointee type is scalar type, create element region regardless with the sizes
of types.

llvm-svn: 71360
2009-05-09 15:34:29 +00:00
Zhongxing Xu 4131114d99 Remove the rest TypedViewRegion processing code. There should be no
TypedViewRegion usage in region store.

llvm-svn: 71359
2009-05-09 15:23:42 +00:00
Zhongxing Xu d6daef9165 When evaluating pointer arithmetic, if the base location is a symbolic region,
convert it to the first element region.
Also do not assume the array region is typed.

llvm-svn: 71358
2009-05-09 15:18:12 +00:00
Zhongxing Xu b18d7cab0c Do not create a TypedViewRegion when the base struct region is a symbolic
region. In the future we may set the cast-to type as the same time. But for
now, we simply leave it as it is.

llvm-svn: 71357
2009-05-09 13:36:16 +00:00
Zhongxing Xu 7c3826484e Do not layer a TypedViewRegion when casting symbolic or alloca regions.
Modify getLValueElement accordingly. Now we don't require base region 
to be a typed region. Do not create TypedViewRegion when base region is 
symbolic or alloca region. We can do so because each element region has 
its type information.

llvm-svn: 71355
2009-05-09 13:20:07 +00:00
Zhongxing Xu e3e94bbf19 Remove the case for casting to compatible type in
RegionStoreManager::CastRegion(). This case should be subsumed by others.

llvm-svn: 71353
2009-05-09 10:03:08 +00:00
Zhongxing Xu 91e2ab496f Rename:
SymbolRegionRValue => SymbolRegionValue
  SymExpr::RegionRValue => SymExpr::RegionValueKind

llvm-svn: 71322
2009-05-09 04:08:27 +00:00
Zhongxing Xu 34d04b3ca9 As discussed with Ted, rename TypedRegion::getObjectType() to
TypedRegion::getValueType().

llvm-svn: 71321
2009-05-09 03:57:34 +00:00
Zhongxing Xu 8038f7b30f rename: MemRegion:
RValueType => ObjectType
 LValueType => LocationType

No functionality change.

llvm-svn: 71304
2009-05-09 00:50:33 +00:00
Zhongxing Xu ca143e73ea Fix PR4182.
llvm-svn: 71288
2009-05-08 23:28:07 +00:00
Zhongxing Xu d2e8fa14df Region store: when casting VarRegions, if the cast-to pointee type is
incomplete, do not compute its size and return the original region.

llvm-svn: 71213
2009-05-08 07:28:25 +00:00
Zhongxing Xu afc875c766 Replace the heuristic isSmallerThan with ASTContext::getTypeSize().
llvm-svn: 71206
2009-05-08 02:12:59 +00:00
Zhongxing Xu c0c074655d Replace getTypeWidth() with ASTContext::getTypeSize().
llvm-svn: 71205
2009-05-08 02:00:55 +00:00
Zhongxing Xu 1ba79dfeea Revert r71079.
llvm-svn: 71202
2009-05-08 01:33:18 +00:00
Zhongxing Xu ea8c48d5a1 Improve RegionStoreManager::getSizeInElements()
- add a static function getTypeWidth(), which computes the width of a type
   with the help of TargetInfo.
 - no-outofbounds.c now passes for region store.

llvm-svn: 71080
2009-05-06 11:51:48 +00:00
Zhongxing Xu c98868136f Add a GDM for recording the cast type of regions.
llvm-svn: 71076
2009-05-06 08:33:50 +00:00
Zhongxing Xu 1813e23a52 Implement a heuristic type size comparison method for now.
llvm-svn: 71074
2009-05-06 08:08:27 +00:00
Zhongxing Xu b2d4a52e3f remove commented code.
llvm-svn: 71060
2009-05-06 02:54:11 +00:00
Zhongxing Xu d5e09be293 Make StoreManager::CastRegion() virtual and implement a new CastRegion() for
RegionStore.

This CastRegion() performs casts according to the kind of the region being 
cast instead of the type that is cast to.

llvm-svn: 71058
2009-05-06 02:42:32 +00:00
Ted Kremenek 02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Zhongxing Xu 3e3e69bbe7 region store: make Retrieve() can retrieve embedded array correctly. Also
simplify the retrieve logic.

llvm-svn: 70651
2009-05-03 00:27:40 +00:00
Zhongxing Xu f985648e83 SymbolicRegions may also be live roots.
llvm-svn: 70380
2009-04-29 09:24:35 +00:00
Ted Kremenek 2d495a6f43 Refactor 'BasicStoreManager::CastRegion' and 'RegionStoreManager::CastRegion'
into StoreManager::CastRegion. Both methods were practically identical, and this
is core logic that is common to all StoreManagers since it defines the basic
invariants of the abstract memory model.

llvm-svn: 69730
2009-04-21 21:51:34 +00:00
Zhongxing Xu 3070210377 Remove loc::FuncVal.
llvm-svn: 69577
2009-04-20 06:35:22 +00:00
Zhongxing Xu dadf250598 Finally nuke loc::SymbolVal.
llvm-svn: 68771
2009-04-10 06:06:13 +00:00
Ted Kremenek f2489ea043 - Move ownership of MemRegionManager into ValueManager.
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly
simplifies the calling interface to clients.

llvm-svn: 68731
2009-04-09 22:22:44 +00:00
Douglas Gregor bcced4ec31 Propagate the ASTContext to various AST traversal and lookup functions.
No functionality change (really).

llvm-svn: 68726
2009-04-09 21:40:53 +00:00
Zhongxing Xu ec7e7dfe0a This is the first step to gradually remove the use of loc::SymbolVal. Now
when creating symbolic values, we distinguish between location and non-location
values. For location values, we create a symbolic region instead of a
loc::SymbolVal.

llvm-svn: 68373
2009-04-03 07:33:13 +00:00
Ted Kremenek 7857bd2743 Re-apply 68028. The code had drifted enough that the tests would fail without
it.  Will discuss offline whether symbolic regions should by typed or typeless.

llvm-svn: 68070
2009-03-30 22:20:54 +00:00
Ted Kremenek 5715393da2 Revert 68028.
llvm-svn: 68068
2009-03-30 21:56:17 +00:00
Zhongxing Xu 5415b207e3 Make SymbolicRegion untyped.
Layer the type information with a TypedViewRegion on top of the SymbolicRegion.

llvm-svn: 68028
2009-03-30 06:48:56 +00:00
Zhongxing Xu a865b79f87 Implement a FIXME.
llvm-svn: 68024
2009-03-30 05:55:46 +00:00
Zhongxing Xu 17e28b7a54 remove dead code.
llvm-svn: 67825
2009-03-27 05:31:12 +00:00
Ted Kremenek 3e31c26f81 analyzer infrastructure: make a bunch of changes to symbolic expressions that
Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731
2009-03-26 03:35:11 +00:00
Zhongxing Xu 17299e6172 Use a work list to recursively build up the subregion mapping, and mark live
var region roots.

llvm-svn: 67152
2009-03-18 01:54:31 +00:00
Ted Kremenek 0bf152ef0b Updated comment.
llvm-svn: 66894
2009-03-13 15:39:16 +00:00
Ted Kremenek ec94f08dce Fix failure reported by Sebastian of test/Analysis/ptr-arith.c when the target
is 64-bit. I used his suggestion of doing a direct bitwidth/signedness
conversion of the 'offset' instead of just changing the sign. For more
information, see:

http://lists.cs.uiuc.edu/pipermail/cfe-dev/2009-March/004587.html

llvm-svn: 66892
2009-03-13 15:35:24 +00:00
Zhongxing Xu 5a6fee9fb8 Use getAsRecordType() to get around sugar types.
llvm-svn: 66768
2009-03-12 03:45:35 +00:00
Zhongxing Xu d2e89ae055 Do not stipulate the record type is a definition in BindStruct().
llvm-svn: 66654
2009-03-11 09:07:35 +00:00
Zhongxing Xu 507202ecb7 Fix crash when LHS of pointer arithmetic is not ElementRegion.
llvm-svn: 66649
2009-03-11 07:43:49 +00:00
Ted Kremenek 90e213f025 RegionStore::getLValueElement: Handle the case where the signedness of the
offset may be different that the base. Ultimately we need a better solution for
these issues, but this point-by-point fixes are gradually outlining the scope of
the problem.

llvm-svn: 66638
2009-03-11 04:04:20 +00:00
Ted Kremenek 0603222888 RegionStore::getElementLValue(): Handle the case where the base is a null pointer.
llvm-svn: 66486
2009-03-09 22:44:49 +00:00
Zhongxing Xu 7219d1bada Only track integer and pointer values.
llvm-svn: 66419
2009-03-09 09:31:22 +00:00
Zhongxing Xu ce270a6dbc Now we do not retrieve untyped regions.
llvm-svn: 66418
2009-03-09 09:15:51 +00:00
Zhongxing Xu b09280bcc0 Fix a serious bug in RegionStore: we got the new state with new store from
Bind() and BindStruct(), but we returned a state with the old store.

llvm-svn: 66409
2009-03-09 06:49:50 +00:00
Ted Kremenek d3c82768e4 Add initial support for tracking ivars, with special handling for ivars of 'self'.
llvm-svn: 66133
2009-03-05 04:50:08 +00:00
Ted Kremenek 52170722ec RegionStore: Handle implicit parameters.
llvm-svn: 65987
2009-03-04 00:23:05 +00:00
Ted Kremenek 67c710e2c8 RegionStore::RemoveDeadBindings needs to check all the symbols of the super region of a scanned region as well.
llvm-svn: 65981
2009-03-04 00:11:38 +00:00
Ted Kremenek 9f276d6279 Don't use std::auto_ptr with getSubRegionMap().
llvm-svn: 65957
2009-03-03 19:02:42 +00:00
Ted Kremenek 4c8a5817a5 Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning MemRegions.
llvm-svn: 65919
2009-03-03 02:51:43 +00:00
Ted Kremenek 8dc671cdc9 Add StoreManager::getSubRegionMap(). This method returns an opaque mapping for clients of StoreManagers from MemRegions to their subregions.
llvm-svn: 65914
2009-03-03 01:35:36 +00:00
Zhongxing Xu 57359cad17 remove an implemented fixme.
llvm-svn: 65817
2009-03-02 08:25:09 +00:00
Zhongxing Xu e7d1493216 Initial support for pointer arithmetic. Only support concrete indexes and
offsets for now.

llvm-svn: 65814
2009-03-02 07:52:23 +00:00
Ted Kremenek 07e95680fd Rename AnonTypedRegion to TypedViewRegion.
llvm-svn: 65764
2009-03-01 05:44:08 +00:00
Ted Kremenek cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Zhongxing Xu 617bc3d02e Add an example in comments.
llvm-svn: 65110
2009-02-20 05:19:30 +00:00
Zhongxing Xu 69aac369c3 only track integer and pointer values for now.
llvm-svn: 65041
2009-02-19 09:56:08 +00:00
Zhongxing Xu f74ab25e22 Convert the offset to signed before making an ElementRegion with it. It seems
that this problem arises from time to time. We should find a fundamental 
solution for it.

llvm-svn: 65035
2009-02-19 08:37:16 +00:00
Zhongxing Xu e42755334c SymbolicRegions really have unknown sizes.
llvm-svn: 63929
2009-02-06 08:51:30 +00:00
Zhongxing Xu dec48a50df Create ElementRegion when the base is SymbolicRegion. This is like what we do
for FieldRegion. This enables us to track more values.

Simplify SymbolicRegion::getRValueType(). We assume the symbol always has
pointer type.

llvm-svn: 63928
2009-02-06 08:44:27 +00:00
Zhongxing Xu 9103df1688 Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so
do the symblic regions associated with them and we need them to be typed.

Current SymbolicRegion::getRValueType() method is very restricting. It may be
modified when we are more clear about what could be the types of symblic
regions.

BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a
subclass of SubRegion.
 

llvm-svn: 63844
2009-02-05 06:57:29 +00:00
Ted Kremenek 7594e2a59a Fix a couple bugs:
- NonLoc::MakeVal() would use sizeof(unsigned) (literally) instead of consulting
  ASTContext for the size (in bits) of 'int'. While it worked, it was a
  conflation of concepts and using ASTContext.IntTy is 100% correct.
- RegionStore::getSizeInElements() no longer assumes that a VarRegion has the
  type "ConstantArray", and handles the case when uses use ordinary variables
  as if they were arrays.
- Fixed ElementRegion::getRValueType() to just return the rvalue type of its
  "array region" in the case the array didn't have ArrayType.
- All of this fixes <rdar://problem/6541136>

llvm-svn: 63347
2009-01-30 00:08:43 +00:00
Sebastian Redl 54cb4c88e1 Correct size assumption; fixes a crash on amd64.
llvm-svn: 63031
2009-01-26 19:54:12 +00:00
Zhongxing Xu e37f9afb2e Implement retrieval of the default value of element and field regions.
llvm-svn: 62847
2009-01-23 11:22:12 +00:00
Zhongxing Xu 804f26a60a Now this comment should be resolved. See the comments for the KillSet.
llvm-svn: 62846
2009-01-23 10:42:17 +00:00
Ted Kremenek 2e1dfe25c5 For now, return UnknownVal() in RegionStore::getElementsSize() for AnonTypedRegions. It wasn't really doing the right thing and was crashing on rdar-6442306-1.m. This fix causes all path-sensitive test cases to pass with RegionStore.
llvm-svn: 62816
2009-01-22 23:56:56 +00:00
Ted Kremenek fe0f1788ca Add RegionStore support for the implicit object region that 'self' references. This causes tests 'ObjCProperties.m' and 'refcnt_naming.m' to now pass with RegionStore.
llvm-svn: 62814
2009-01-22 23:43:57 +00:00
Ted Kremenek 92d48a71f5 Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781
2009-01-22 20:27:48 +00:00
Ted Kremenek 74040833e4 Static analyzer: Remove a bunch of outdated SymbolData objects and
their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769
2009-01-22 18:23:34 +00:00
Ted Kremenek 1322ca1364 Combine two branches into one. No functionality change.
llvm-svn: 62727
2009-01-21 22:58:50 +00:00
Ted Kremenek 16fbfe699e Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.
llvm-svn: 62722
2009-01-21 22:26:05 +00:00
Ted Kremenek fe32cc0ba6 Get RegionStore to work with the retain/release checker and its test cases.
Because the RegionStore can reason about values beyond the reasoning power of BasicStore, this patch splits some of the test cases for the retain/release checker to have versions that are handled by RegionStore (more warnings) and BasicStore (less warnings).

llvm-svn: 62667
2009-01-21 06:57:53 +00:00
Zhongxing Xu 2436f86024 add a fixme.
llvm-svn: 62142
2009-01-13 03:07:41 +00:00
Zhongxing Xu cff637a568 Add KillStruct to region store.
- put the killed region in the kill set.
 - set its default value to unknown.
 - removes all bindings for its subregions.  

llvm-svn: 62138
2009-01-13 01:49:57 +00:00
Ted Kremenek 167f2fa5f4 Invert condition on branch (was causing RegionStore::ArrayToPointer to return 'unknown' on most cases.
llvm-svn: 62129
2009-01-13 01:03:27 +00:00
Ted Kremenek 682c3a6dd6 Refactor MemRegionManager instance variable into parent class. No functionality change.
llvm-svn: 61888
2009-01-07 22:18:50 +00:00
Ted Kremenek 47ad37dbe4 Return UnknownVal in RegionStoreManager::getSizeInElements() for unsupported regions. This silences a warning when compiling Release-Asserts builds.
llvm-svn: 61818
2009-01-06 19:12:06 +00:00
Ted Kremenek 2907ab7d77 Add a bunch of comments and FIXMEs.
llvm-svn: 61419
2008-12-24 07:46:32 +00:00
Zhongxing Xu c7a2792817 set region default value if there are not enough init values for array and struct.
llvm-svn: 61418
2008-12-24 07:29:24 +00:00