Commit Graph

4382 Commits

Author SHA1 Message Date
Valeriy Savchenko 61ae2db2d7 [analyzer] Adjust the reported variable name in retain count checker
When reporting leaks, we try to attach the leaking object to some
variable, so it's easier to understand.  Before the patch, we always
tried to use the first variable that stored the object in question.
This can get very confusing for the user, if that variable doesn't
contain that object at the moment of the actual leak.  In many cases,
the warning is dismissed as false positive and it is effectively a
false positive when we fail to properly explain the warning to the
user.

This patch addresses the bigest issue in cases like this.  Now we
check if the variable still contains the leaking symbolic object.
If not, we look for the last variable to actually hold it and use
that variable instead.

rdar://76645710

Differential Revision: https://reviews.llvm.org/D100839
2021-04-28 18:37:37 +03:00
Valeriy Savchenko 1dad8c5036 [analyzer][NFC] Remove duplicated work from retain count leak report
Allocation site is the key location for the leak checker.  It is a
uniqueing location for the report and a source of information for
the warning's message.

Before this patch, we calculated and used it twice in bug report and
in bug report visitor.  Such duplication is not only harmful
performance-wise (not much, but still), but also design-wise.  Because
changing something about the end piece of the report should've been
repeated for description as well.

Differential Revision: https://reviews.llvm.org/D100626
2021-04-28 18:37:37 +03:00
Gabor Marton 4b99f9c7db [analyzer][StdLibraryFunctionsChecker] Track dependent arguments
When we report an argument constraint violation, we should track those
other arguments that participate in the evaluation of the violation. By
default, we depend only on the argument that is constrained, however,
there are some special cases like the buffer size constraint that might
be encoded in another argument(s).

Differential Revision: https://reviews.llvm.org/D101358
2021-04-27 15:35:58 +02:00
Gabor Marton a7cb951fa4 [Analyzer][StdLibraryFunctionsChecker] Describe arg constraints
In this patch, I provide a detailed explanation for each argument
constraint. This explanation is added in an extra 'note' tag, which is
displayed alongside the warning.
Since these new notes describe clearly the constraint, there is no need
to provide the number of the argument (e.g. 'Arg3') within the warning.
However, I decided to keep the name of the constraint in the warning (but
this could be a subject of discussion) in order to be able to identify
the different kind of constraint violations easily in a bug database
(e.g. CodeChecker).

Differential Revision: https://reviews.llvm.org/D101060
2021-04-23 17:27:54 +02:00
Denys Petrov 01ddfa95bd [analyzer] [NFC] Eliminate dispatchCast, evalCastFromNonLoc and evalCastFromLoc functions from SValBuilder
Summary: Remove dispatchCast, evalCastFromNonLoc and evalCastFromLoc functions since their functionality has been moved to common evalCast function. Use evalCast instead.

Post-clean up patch for https://reviews.llvm.org/D96090 patch. The patch shall not change any behavior.

Differential Revision: https://reviews.llvm.org/D97277
2021-04-13 18:56:04 +03:00
Denys Petrov 7736b08c28 [analyzer] Replace StoreManager::CastRetrievedVal with SValBuilder::evalCast
Summary: Move logic from CastRetrievedVal to evalCast and replace CastRetrievedVal with evalCast. Also move guts from SimpleSValBuilder::dispatchCast inside evalCast.
evalCast intends to substitute dispatchCast, evalCastFromNonLoc and evalCastFromLoc in the future. OriginalTy provides additional information for casting, which is useful for some cases and useless for others.  If `OriginalTy.isNull()` is true, then cast performs based on CastTy only. Now evalCast operates in two ways. It retains all previous behavior and take over dispatchCast behavior. dispatchCast, evalCastFromNonLoc and evalCastFromLoc is considered as buggy since it doesn't take into account OriginalTy of the SVal and should be improved.

From this patch use evalCast instead of dispatchCast, evalCastFromNonLoc and evalCastFromLoc functions. dispatchCast redirects to evalCast.

This patch shall not change any behavior.

Differential Revision: https://reviews.llvm.org/D96090
2021-04-13 18:10:06 +03:00
Saurabh Jha 71ab6c98a0
[Matrix] Implement C-style explicit type conversions for matrix types.
This implements C-style type conversions for matrix types, as specified
in clang/docs/MatrixTypes.rst.

Fixes PR47141.

Reviewed By: fhahn

Differential Revision: https://reviews.llvm.org/D99037
2021-04-10 11:48:41 +01:00
cchen 1a43fd2769 [OpenMP51] Initial support for masked directive and filter clause
Adds basic parsing/sema/serialization support for the #pragma omp masked
directive.

Reviewed By: ABataev

Differential Revision: https://reviews.llvm.org/D99995
2021-04-09 14:00:36 -05:00
Valeriy Savchenko 663ac91ed1 [analyzer] Fix false positives in inner pointer checker (PR49628)
This patch supports std::data and std::addressof functions.

rdar://73463300

Differential Revision: https://reviews.llvm.org/D99260
2021-04-08 20:30:12 +03:00
Valeriy Savchenko 4b958dd6bc [analyzer] Fix crash on spaceship operator (PR47511)
rdar://68954187

Differential Revision: https://reviews.llvm.org/D99181
2021-04-08 20:28:05 +03:00
Valeriy Savchenko 9f0d8bac14 [analyzer] Fix dead store checker false positive
It is common to zero-initialize not only scalar variables,
but also structs.  This is also defensive programming and
we shouldn't complain about that.

rdar://34122265

Differential Revision: https://reviews.llvm.org/D99262
2021-04-08 16:12:42 +03:00
Abhina Sreeskantharajan 82b3e28e83 [SystemZ][z/OS][Windows] Add new OF_TextWithCRLF flag and use this flag instead of OF_Text
Problem:
On SystemZ we need to open text files in text mode. On Windows, files opened in text mode adds a CRLF '\r\n' which may not be desirable.

Solution:
This patch adds two new flags

  - OF_CRLF which indicates that CRLF translation is used.
  - OF_TextWithCRLF = OF_Text | OF_CRLF indicates that the file is text and uses CRLF translation.

Developers should now use either the OF_Text or OF_TextWithCRLF for text files and OF_None for binary files. If the developer doesn't want carriage returns on Windows, they should use OF_Text, if they do want carriage returns on Windows, they should use OF_TextWithCRLF.

So this is the behaviour per platform with my patch:

z/OS:
OF_None: open in binary mode
OF_Text : open in text mode
OF_TextWithCRLF: open in text mode

Windows:
OF_None: open file with no carriage return
OF_Text: open file with no carriage return
OF_TextWithCRLF: open file with carriage return

The Major change is in llvm/lib/Support/Windows/Path.inc to only set text mode if the OF_CRLF is set.
```
  if (Flags & OF_CRLF)
    CrtOpenFlags |= _O_TEXT;
```

These following files are the ones that still use OF_Text which I left unchanged. I modified all these except raw_ostream.cpp in recent patches so I know these were previously in Binary mode on Windows.
./llvm/lib/Support/raw_ostream.cpp
./llvm/lib/TableGen/Main.cpp
./llvm/tools/dsymutil/DwarfLinkerForBinary.cpp
./llvm/unittests/Support/Path.cpp
./clang/lib/StaticAnalyzer/Core/HTMLDiagnostics.cpp
./clang/lib/Frontend/CompilerInstance.cpp
./clang/lib/Driver/Driver.cpp
./clang/lib/Driver/ToolChains/Clang.cpp

Reviewed By: MaskRay

Differential Revision: https://reviews.llvm.org/D99426
2021-04-06 07:23:31 -04:00
Balázs Kéri bee4813789 [clang][Checkers] Fix PthreadLockChecker state cleanup at dead symbol.
It is possible that an entry in 'DestroyRetVal' lives longer
than an entry in 'LockMap' if not removed at checkDeadSymbols.
The added test case demonstrates this.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D98504
2021-04-06 11:15:29 +02:00
Charusso 9b3df78b4c [analyzer] DynamicSize: Rename 'size' to 'extent' 2021-04-05 19:20:43 +02:00
Charusso 89d210fe1a [analyzer] DynamicSize: Debug facility
This patch adds two debug functions to ExprInspectionChecker to dump out
the dynamic extent and element count of symbolic values:
dumpExtent(), dumpElementCount().
2021-04-05 19:17:52 +02:00
Charusso df64f471d1 [analyzer] DynamicSize: Store the dynamic size
This patch introduces a way to store the size.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D69726
2021-04-05 19:04:53 +02:00
Balázs Kéri df4fa53fdd [clang][Checkers] Extend PthreadLockChecker state dump (NFC).
Add printing of map 'DestroyRetVal'.

Reviewed By: steakhal

Differential Revision: https://reviews.llvm.org/D98502
2021-04-01 11:59:00 +02:00
Balázs Kéri ffcb4b43b7 Revert "[clang][Checkers] Extend PthreadLockChecker state dump (NFC)."
This reverts commit 49c0ab6d76.

Test failures showed up because non-deterministic output.
2021-03-31 15:28:53 +02:00
Balázs Kéri 49c0ab6d76 [clang][Checkers] Extend PthreadLockChecker state dump (NFC).
Add printing of map 'DestroyRetVal'.

Reviewed By: steakhal

Differential Revision: https://reviews.llvm.org/D98502
2021-03-31 11:19:42 +02:00
Mike Rice b7899ba0e8 [OPENMP51]Initial support for the dispatch directive.
Added basic parsing/sema/serialization support for dispatch directive.

Differential Revision: https://reviews.llvm.org/D99537
2021-03-30 14:12:53 -07:00
Valeriy Savchenko 90377308de [analyzer] Support allocClassWithName in OSObjectCStyleCast checker
`allocClassWithName` allocates an object with the given type.
The type is actually provided as a string argument (type's name).
This creates a possibility for not particularly useful warnings
from the analyzer.

In order to combat with those, this patch checks for casts of the
`allocClassWithName` results to types mentioned directly as its
argument.  All other uses of this method should be reasoned about
as before.

rdar://72165694

Differential Revision: https://reviews.llvm.org/D99500
2021-03-30 15:58:06 +03:00
Gabor Marton efa7df1682 [Analyzer] Track RValue expressions
It makes sense to track rvalue expressions in the case of special
concrete integer values. The most notable special value is zero (later
we may find other values). By tracking the origin of 0, we can provide a
better explanation for users e.g. in case of division by 0 warnings.
When the divisor is a product of a multiplication then now we can show
which operand (or both) was (were) zero and why.

Differential Revision: https://reviews.llvm.org/D99344
2021-03-30 14:48:38 +02:00
Gabor Marton 015c39882e [Analyzer] Infer 0 value when the divisible is 0 (bug fix)
Currently, we infer 0 if the divisible of the modulo op is 0:
  int a = x < 0; // a can be 0
  int b = a % y; // b is either 1 % sym or 0
However, we don't when the op is / :
  int a = x < 0; // a can be 0
  int b = a / y; // b is either 1 / sym or 0 / sym

This commit fixes the discrepancy.

Differential Revision: https://reviews.llvm.org/D99343
2021-03-25 18:25:06 +01:00
Gabor Marton f8a850ccf4 [Analyzer][NFC] Fix typos in comments 2021-03-24 11:46:10 +01:00
Valeriy Savchenko 02b51e5316 [analyzer][solver] Redesign constraint ranges data structure
ImmutableSet doesn't seem like the perfect fit for the RangeSet
data structure.  It is good for saving memory in a persistent
setting, but not for the case when the population of the container
is tiny.  This commit replaces RangeSet implementation and
redesigns the most common operations to be more efficient.

Differential Revision: https://reviews.llvm.org/D86465
2021-03-22 13:52:35 +03:00
Valeriy Savchenko 3085bda2b3 [analyzer][solver] Fix infeasible constraints (PR49642)
Additionally, this patch puts an assertion checking for feasible
constraints in every place where constraints are assigned to states.

Differential Revision: https://reviews.llvm.org/D98948
2021-03-22 11:02:02 +03:00
Abhina Sreeskantharajan 4f750f6ebc [SystemZ][z/OS] Distinguish between text and binary files on z/OS
This patch consists of the initial changes to help distinguish between text and binary content correctly on z/OS. I would like to get feedback from Windows users on setting OF_None for all ToolOutputFiles. This seems to have been done as an optimization to prevent CRLF translation on Windows in the past.

Reviewed By: zibi

Differential Revision: https://reviews.llvm.org/D97785
2021-03-19 08:09:57 -04:00
Artem Dergachev c75b2261a0 [analyzer] Introduce common bug category "Unused code".
This category is generic enough to hold a variety of checkers.
Currently it contains the Dead Stores checker and an alpha unreachable
code checker.

Differential Revision: https://reviews.llvm.org/D98741
2021-03-17 20:58:27 -07:00
Mike Rice 410f09af09 [OPENMP51]Initial support for the interop directive.
Added basic parsing/sema/serialization support for interop directive.
Support for the 'init' clause.

Differential Revision: https://reviews.llvm.org/D98558
2021-03-17 09:42:07 -07:00
Vassil Vassilev 0cb7e7ca0c Make iteration over the DeclContext::lookup_result safe.
The idiom:
```
DeclContext::lookup_result R = DeclContext::lookup(Name);
for (auto *D : R) {...}
```

is not safe when in the loop body we trigger deserialization from an AST file.
The deserialization can insert new declarations in the StoredDeclsList whose
underlying type is a vector. When the vector decides to reallocate its storage
the pointer we hold becomes invalid.

This patch replaces a SmallVector with an singly-linked list. The current
approach stores a SmallVector<NamedDecl*, 4> which is around 8 pointers.
The linked list is 3, 5, or 7. We do better in terms of memory usage for small
cases (and worse in terms of locality -- the linked list entries won't be near
each other, but will be near their corresponding declarations, and we were going
to fetch those memory pages anyway). For larger cases: the vector uses a
doubling strategy for reallocation, so will generally be between half-full and
full. Let's say it's 75% full on average, so there's N * 4/3 + 4 pointers' worth
of space allocated currently and will be 2N pointers with the linked list. So we
break even when there are N=6 entries and slightly lose in terms of memory usage
after that. We suspect that's still a win on average.

Thanks to @rsmith!

Differential revision: https://reviews.llvm.org/D91524
2021-03-17 08:59:04 +00:00
Aaron Puchert 1cb15b10ea Correct Doxygen syntax for inline code
There is no syntax like {@code ...} in Doxygen, @code is a block command
that ends with @endcode, and generally these are not enclosed in braces.
The correct syntax for inline code snippets is @c <code>.

Reviewed By: aaron.ballman

Differential Revision: https://reviews.llvm.org/D98665
2021-03-16 15:17:45 +01:00
Valeriy Savchenko 6dc1523508 [analyzer][solver] Prevent infeasible states (PR49490)
This patch fixes the situation when our knowledge of disequalities
can help us figuring out that some assumption is infeasible, but
the solver still produces a state with inconsistent constraints.

Additionally, this patch adds a couple of assertions to catch this
type of problems easier.

Differential Revision: https://reviews.llvm.org/D98341
2021-03-12 15:56:48 +03:00
Adam Balogh bcc662484a [analyzer] Crash fix for alpha.cplusplus.IteratorRange
If the non-iterator side of an iterator operation
`+`, `+=`, `-` or `-=` is `UndefinedVal` an assertions happens.
This small fix prevents this.

Patch by Adam Balogh.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D85424
2021-03-10 12:42:24 +01:00
Valeriy Savchenko c7635040ce [analyzer] Fix StdLibraryFunctionsChecker performance issue
`initFunctionSummaries` lazily initializes a data structure with
function summaries for standard library functions.  It is called for
every pre-, post-, and eval-call events, i.e. 3 times for each call on
the path.  If the initialization doesn't find any standard library
functions in the translation unit, it will get re-tried (with the same
effect) many times even for small translation units.

For projects not using standard libraries, the speed-up can reach 50%
after this patch.

Differential Revision: https://reviews.llvm.org/D98244
2021-03-10 10:44:04 +03:00
Michael Kruse bc172e532a [clang][StaticAnalyzer] Compilation fix.
An enum was unhandled after landing of D94973. Add the new
OMPCanonicalLoopClass to the list of unhandled cases.
2021-03-04 23:23:58 -06:00
Balazs Benics 38b185832e [analyzer][CTU] API for CTU macro expansions
Removes `CrossTranslationUnitContext::getImportedFromSourceLocation`
Removes the corresponding unit-test segment.

Introduces the `CrossTranslationUnitContext::getMacroExpansionContextForSourceLocation`
which will return the macro expansion context for an imported TU. Also adds a
few implementation FIXME notes where applicable, since this feature is
not implemented yet. This fact is also noted as Doxygen comments.

Uplifts a few CTU LIT test to match the current **incomplete** behavior.

It is a regression to some extent since now we don't expand any
macros in imported TUs. At least we don't crash anymore.

Note that the introduced function is already covered by LIT tests.
Eg.: Analysis/plist-macros-with-expansion-ctu.c

Reviewed By: balazske, Szelethus

Differential Revision: https://reviews.llvm.org/D94673
2021-02-22 11:12:22 +01:00
Balazs Benics 170c67d5b8 [analyzer] Use the MacroExpansionContext for macro expansions in plists
Removes the obsolete ad-hoc macro expansions during bugreport constructions.
It will skip the macro expansion if the expansion happened in an imported TU.

Also removes the expected plist file, while expanding matching context for
the tests.
Adds a previously crashing `plist-macros-with-expansion.c` testfile.
Temporarily marks `plist-macros-with-expansion-ctu.c ` to `XFAIL`.

Reviewed By: xazax.hun, Szelethus

Differential Revision: https://reviews.llvm.org/D93224
2021-02-22 11:12:18 +01:00
Balazs Benics 7c58fb6ba0 [analyzer] Create MacroExpansionContext member in AnalysisConsumer
Adds a `MacroExpansionContext` member to the `AnalysisConsumer` class.
Tracks macro expansions only if the `ShouldDisplayMacroExpansions` is set.
Passes a reference down the pipeline letting AnalysisConsumers query macro
expansions during bugreport construction.

Reviewed By: martong, Szelethus

Differential Revision: https://reviews.llvm.org/D93223
2021-02-22 11:12:14 +01:00
Michael Kruse 6c05005238 [OpenMP] Implement '#pragma omp tile', by Michael Kruse (@Meinersbur).
The tile directive is in OpenMP's Technical Report 8 and foreseeably will be part of the upcoming OpenMP 5.1 standard.

This implementation is based on an AST transformation providing a de-sugared loop nest. This makes it simple to forward the de-sugared transformation to loop associated directives taking the tiled loops. In contrast to other loop associated directives, the OMPTileDirective does not use CapturedStmts. Letting loop associated directives consume loops from different capture context would be difficult.

A significant amount of code generation logic is taking place in the Sema class. Eventually, I would prefer if these would move into the CodeGen component such that we could make use of the OpenMPIRBuilder, together with flang. Only expressions converting between the language's iteration variable and the logical iteration space need to take place in the semantic analyzer: Getting the of iterations (e.g. the overload resolution of `std::distance`) and converting the logical iteration number to the iteration variable (e.g. overload resolution of `iteration + .omp.iv`). In clang, only CXXForRangeStmt is also represented by its de-sugared components. However, OpenMP loop are not defined as syntatic sugar. Starting with an AST-based approach allows us to gradually move generated AST statements into CodeGen, instead all at once.

I would also like to refactor `checkOpenMPLoop` into its functionalities in a follow-up. In this patch it is used twice. Once for checking proper nesting and emitting diagnostics, and additionally for deriving the logical iteration space per-loop (instead of for the loop nest).

Differential Revision: https://reviews.llvm.org/D76342
2021-02-16 09:45:07 -08:00
Kazu Hirata 1a323c8a96 [analyzer] Fix a warning
This patch fixes a warning from -Wcovered-switch-default.  The switch
statement in question handles all the enum values.
2021-02-16 09:12:07 -08:00
Denys Petrov 13f4448ae7 [analyzer] Rework SValBuilder::evalCast function into maintainable and clear way
Summary: Refactor SValBuilder::evalCast function. Make the function clear and get rid of redundant and repetitive code. Unite SValBuilder::evalCast, SimpleSValBuilder::dispatchCast, SimpleSValBuilder::evalCastFromNonLoc and SimpleSValBuilder::evalCastFromLoc functions into single SValBuilder::evalCast.
This patch shall not change any previous behavior.

Differential Revision: https://reviews.llvm.org/D90157
2021-02-16 14:30:51 +02:00
Deep Majumder 21daada950 [analyzer] Fix static_cast on pointer-to-member handling
This commit fixes bug #48739. The bug was caused by the way static_casts
on pointer-to-member caused the CXXBaseSpecifier list of a
MemberToPointer to grow instead of shrink.
The list is now grown by implicit casts and corresponding entries are
removed by static_casts. No-op static_casts cause no effect.

Reviewed By: vsavchenko

Differential Revision: https://reviews.llvm.org/D95877
2021-02-15 11:44:37 +03:00
Daniel Hwang 2407eb08a5 [analyzer] Update static analyzer to be support sarif-html
Updates static analyzer to be able to generate both sarif and html
output in a single run similar to plist-html.

Differential Revision: https://reviews.llvm.org/D96389
2021-02-10 18:34:53 -08:00
Artem Dergachev 3e206a5922 [analyzer] NFC: Introduce reusable bug category for "C++ move semantics".
Currently only used by MoveChecker but ideally all checkers
should have reusable categories.
2021-01-27 03:39:18 -08:00
Simon Pilgrim 879c12d95a Fix null dereference static analysis warning. NFCI.
Replace cast_or_null<> with cast<> as we immediately dereference the pointer afterward so we're not expecting a null pointer.
2021-01-26 16:19:18 +00:00
Alexander Belyaev 9c4b2225b2 Revert "Revert "Revert "Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis."""""
This reverts commit 6b0ee02747.

Circular dependency again.
2021-01-08 14:17:18 +01:00
Artem Dergachev 6b0ee02747 Revert "Revert "Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis.""""
This reverts commit b12f26733a.

Fix dead include that looked like another missed circular dependency.
2021-01-07 20:22:22 -08:00
David Blaikie b12f26733a Revert "Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis."""
This reverts commit d2ddc694ff.

This still contains a circular dependency between Analysis and CrossTU:

$ grep -r include.*Analysis clang/include/clang/CrossTU
clang/include/clang/CrossTU/CrossTranslationUnit.h:
  #include "clang/Analysis/CrossTUAnalysisHelper.h"
$ grep -r include.*CrossTU clang/lib/Analysis
clang/lib/Analysis/PlistHTMLPathDiagnosticConsumer.cpp:
  #include "clang/CrossTU/CrossTranslationUnit.h"
clang/lib/Analysis/PlistPathDiagnosticConsumer.cpp:
  #include "clang/Analysis/CrossTUAnalysisHelper.h"
2021-01-07 18:18:23 -08:00
Artem Dergachev d2ddc694ff Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis.""
This reverts commit 5663bf201f.

The cyclic dependency problem is addressed now.
This is the ~fifth attempt to land this change.
2021-01-07 00:28:22 -08:00
Daniel Hwang 8deaec122e [analyzer] Update Fuchsia checker to catch releasing unowned handles.
Certain Fuchsia functions may return handles that are not owned by the
current closure. This adds a check in order to determine when these
handles are released.

Differential Revision: https://reviews.llvm.org/D93868
2021-01-06 16:23:49 -08:00
Barry Revzin 92310454bf Make LLVM build in C++20 mode
Part of the <=> changes in C++20 make certain patterns of writing equality
operators ambiguous with themselves (sorry!).
This patch goes through and adjusts all the comparison operators such that
they should work in both C++17 and C++20 modes. It also makes two other small
C++20-specific changes (adding a constructor to a type that cases to be an
aggregate, and adding casts from u8 literals which no longer have type
const char*).

There were four categories of errors that this review fixes.
Here are canonical examples of them, ordered from most to least common:

// 1) Missing const
namespace missing_const {
    struct A {
    #ifndef FIXED
        bool operator==(A const&);
    #else
        bool operator==(A const&) const;
    #endif
    };

    bool a = A{} == A{}; // error
}

// 2) Type mismatch on CRTP
namespace crtp_mismatch {
    template <typename Derived>
    struct Base {
    #ifndef FIXED
        bool operator==(Derived const&) const;
    #else
        // in one case changed to taking Base const&
        friend bool operator==(Derived const&, Derived const&);
    #endif
    };

    struct D : Base<D> { };

    bool b = D{} == D{}; // error
}

// 3) iterator/const_iterator with only mixed comparison
namespace iter_const_iter {
    template <bool Const>
    struct iterator {
        using const_iterator = iterator<true>;

        iterator();

        template <bool B, std::enable_if_t<(Const && !B), int> = 0>
        iterator(iterator<B> const&);

    #ifndef FIXED
        bool operator==(const_iterator const&) const;
    #else
        friend bool operator==(iterator const&, iterator const&);
    #endif
    };

    bool c = iterator<false>{} == iterator<false>{} // error
          || iterator<false>{} == iterator<true>{}
          || iterator<true>{} == iterator<false>{}
          || iterator<true>{} == iterator<true>{};
}

// 4) Same-type comparison but only have mixed-type operator
namespace ambiguous_choice {
    enum Color { Red };

    struct C {
        C();
        C(Color);
        operator Color() const;
        bool operator==(Color) const;
        friend bool operator==(C, C);
    };

    bool c = C{} == C{}; // error
    bool d = C{} == Red;
}

Differential revision: https://reviews.llvm.org/D78938
2020-12-17 10:44:10 +00:00
Bardia Mahjour 6eff12788e [DDG] Data Dependence Graph - DOT printer - recommit
This is being recommitted to try and address the MSVC complaint.

This patch implements a DDG printer pass that generates a graph in
the DOT description language, providing a more visually appealing
representation of the DDG. Similar to the CFG DOT printer, this
functionality is provided under an option called -dot-ddg and can
be generated in a less verbose mode under -dot-ddg-only option.

Reviewed By: Meinersbur

Differential Revision: https://reviews.llvm.org/D90159
2020-12-16 12:37:36 -05:00
Bardia Mahjour a29ecca781 Revert "[DDG] Data Dependence Graph - DOT printer"
This reverts commit fd4a10732c, to
investigate the failure on windows: http://lab.llvm.org:8011/#/builders/127/builds/3274
2020-12-14 16:54:20 -05:00
Bardia Mahjour fd4a10732c [DDG] Data Dependence Graph - DOT printer
This patch implements a DDG printer pass that generates a graph in
the DOT description language, providing a more visually appealing
representation of the DDG. Similar to the CFG DOT printer, this
functionality is provided under an option called -dot-ddg and can
be generated in a less verbose mode under -dot-ddg-only option.

Differential Revision: https://reviews.llvm.org/D90159
2020-12-14 16:41:14 -05:00
Haojian Wu 5663bf201f Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis."
The patch introduced a cycle dependency:

clangAnalysis -> clangFrontend -> clangSema -> clangAnalysis

This reverts commit 00ffea77ad.
This reverts commit ea6641085d.
2020-12-11 10:16:13 +01:00
Artem Dergachev 8c5ca7c6e6 [analyzer] OSObjectCStyleCast: Improve warning message.
Suggest OSRequiredCast as a closer alternative to C-style cast.
Explain how to decide.
2020-12-10 19:46:33 -08:00
Artem Dergachev ea6641085d Revert "Revert "Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis.""""
This reverts commit 6a89cb8136.
2020-12-10 11:02:54 -08:00
Gabor Marton febe75032f [analyzer][StdLibraryFunctionsChecker] Add more return value contraints
This time, we add contraints to functions that either return with [0, -1] or
with a file descriptor.

Differential Revision: https://reviews.llvm.org/D92771
2020-12-08 17:04:29 +01:00
Gabor Marton d14c631673 [analyzer][StdLibraryFunctionsChecker] Make close and mmap to accept -1 as fd
close:
It is quite often that users chose to call close even if the fd is
negative. Theoretically, it would be nicer to close only valid fds, but
in practice the implementations of close just returns with EBADF in case
of a non-valid fd param. So, we can eliminate many false positives if we
let close to take -1 as an fd. Other negative values are very unlikely,
because open and other fd factories return with -1 in case of failure.

mmap:
In the case of MAP_ANONYMOUS flag (which is supported e.g. in Linux) the
mapping is not backed by any file; its contents are initialized to zero.
The fd argument is ignored; however, some implementations require fd to
be -1 if MAP_ANONYMOUS (or MAP_ANON) is specified, and portable
applications should ensure this.
Consequently, we must allow -1 as the 4th arg.

Differential Revision: https://reviews.llvm.org/D92764
2020-12-08 16:58:30 +01:00
Yu Shan 3ce78f54ed [analyzer] Ignore annotations if func is inlined.
When we annotating a function header so that it could be used by other
TU, we also need to make sure the function is parsed correctly within
the same TU. So if we can find the function's implementation,
ignore the annotations, otherwise, false positive would occur.
Move the escape by value case to post call and do not escape the handle
if the function is inlined and we have analyzed the handle.

Differential Revision: https://reviews.llvm.org/D91902
2020-12-07 11:28:11 -08:00
Gabor Marton b40b3196b3 [analyzer][StdLibraryFunctionsChecker] Add return value constraint to functions with BufferSize
Differential Revision: https://reviews.llvm.org/D92474
2020-12-02 17:54:48 +01:00
Balazs Benics ee073c7985 [analyzer][StdLibraryFunctionsChecker] Fix typos in summaries of mmap and mmap64
The fd parameter of
```
void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset)
```
should be constrained to the range [0, IntMax] as that is of type int.
Constraining to the range [0, Off_tMax] would result in a crash as that is
of a signed type with the value of 0xff..f (-1).

The crash would happen when we try to apply the arg constraints.
At line 583: assert(Min <= Max), as 0 <= -1 is not satisfied

The mmap64 is fixed for the same reason.

Reviewed By: martong, vsavchenko

Differential Revision: https://reviews.llvm.org/D92307
2020-11-30 18:06:28 +01:00
Richard Smith 3fb0879867 Refactor and simplify class scope name lookup.
This is partly in preparation for an upcoming change that can change the
order in which DeclContext lookup results are presented.

In passing, fix some obvious errors where name lookup's notion of a
"static member function" missed static member function templates, and
where its notion of "same set of declarations" was confused by the same
declarations appearing in a different order.
2020-11-25 16:25:33 -08:00
Haowei Wu 914f6c4ff8 [StaticAnalyzer] Support struct annotations in FuchsiaHandleChecker
Support adding handle annotations to sturucture that contains
handles. All the handles referenced by the structure (direct
value or ptr) would be treated as containing the
release/use/acquire annotations directly.

Patch by Yu Shan

Differential Revision: https://reviews.llvm.org/D91223
2020-11-21 19:59:51 -08:00
Artem Dergachev 6a89cb8136 Revert "Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis."""
This reverts commit 41bcc05e2a.
2020-11-17 18:59:21 -08:00
Artem Dergachev 41bcc05e2a Revert "Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis.""
This reverts commit 77bb3ebebb.
2020-11-17 18:45:09 -08:00
Artem Dergachev f8f6d6455f Revert "Revert "[analyzer] NFC: Move IssueHash to libAnalysis.""
This reverts commit 662ed9e67a.
2020-11-17 16:01:49 -08:00
Nathan James d44edfc109
[clang][NFC] Use SmallString instead of SmallVector<char
Simplifies code in some places and is more explicit about what is being used.
No additional includes were added here so no impact on compile time.
2020-11-17 13:02:58 +00:00
Artem Dergachev 499bce3aba Revert "Revert "[analyzer] NFC: Separate PathDiagnosticConsumer options from AnalyzerOptions.""
This reverts commit 10f1ca99b4.

(cherry picked from commit c599fc738a70e482976c6cc0ea31bef561641279)
2020-11-16 14:37:50 -08:00
Kirstóf Umann 22e7182002 [analyzer][ReturnPtrRangeChecker] Fix a false positive on end() iterator
ReturnPtrRange checker emits a report if a function returns a pointer which
points out of the buffer. However, end() iterator of containers is always such
a pointer, so this always results a false positive report. This false positive
case is now eliminated.

This patch resolves these tickets:
https://bugs.llvm.org/show_bug.cgi?id=20929
https://bugs.llvm.org/show_bug.cgi?id=25226
https://bugs.llvm.org/show_bug.cgi?id=27701

Patch by Tibor Brunner!

Differential Revision: https://reviews.llvm.org/D83678
2020-11-02 16:41:17 +01:00
Simon Pilgrim 2bc2e2e9fe [MallocChecker] Remove duplicate QCoreApplication::postEvent check. NFCI.
This appears to have been in the original patch in D14170.

Reported as "Snippet 11" in https://www.viva64.com/en/b/0771/
2020-10-27 13:14:54 +00:00
Mikhail Maltsev 443ab4d2e0 [clang][Basic] Integrate SourceLocation with FoldingSet, NFCI
This patch removes the necessity to access the SourceLocation internal
representation in several places that use FoldingSet objects.

Reviewed By: dexonsmith

Differential Revision: https://reviews.llvm.org/D69844
2020-10-27 10:43:39 +00:00
Denys Petrov 32efb81ea6 [analyzer] [NFC] Simplify SVal::getAsLocSymbol function using existing functions
Summary: Method of obtaining MemRegion from LocAsInteger/MemRegionVal already exists in SVal::getAsRegion function. Replace repetitive conditions in SVal::getAsLocSymbol with SVal::getAsRegion function.

Differential Revision: https://reviews.llvm.org/D89982
2020-10-26 17:00:29 +02:00
Duncan P. N. Exon Smith af4fb416bd clang/StaticAnalyzer: Stop using SourceManager::getBuffer
Update clang/lib/StaticAnalyzer to stop relying on a `MemoryBuffer*`,
using the `MemoryBufferRef` from `getBufferOrNone` or the
`Optional<MemoryBufferRef>` from `getBufferOrFake`, depending on whether
there's logic for checking validity of the buffer. The change to
clang/lib/StaticAnalyzer/Core/IssueHash.cpp is potentially a
functionality change, since the logic was wrong (it checked for
`nullptr`, which was never returned by the old API), but if that was
reachable the new behaviour should be better.

Differential Revision: https://reviews.llvm.org/D89414
2020-10-15 00:34:24 -04:00
Artem Dergachev 10f1ca99b4 Revert "[analyzer] NFC: Separate PathDiagnosticConsumer options from AnalyzerOptions."
This reverts commit fd4b3f123d.
2020-10-13 12:07:36 -07:00
Artem Dergachev 662ed9e67a Revert "[analyzer] NFC: Move IssueHash to libAnalysis."
This reverts commit b76dc111dd.
2020-10-13 12:07:28 -07:00
Artem Dergachev 77bb3ebebb Revert "[analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis."
This reverts commit 44b7cf2983.
2020-10-13 12:03:04 -07:00
Artem Dergachev 44b7cf2983 [analyzer] NFC: Move path diagnostic consumer implementations to libAnalysis.
With this change, we're more or less ready to allow users outside
of the Static Analyzer to take advantage of path diagnostic consumers
for emitting their warnings in different formats.

Differential Revision: https://reviews.llvm.org/D67422
2020-10-13 10:53:10 -07:00
Artem Dergachev b76dc111dd [analyzer] NFC: Move IssueHash to libAnalysis.
IssueHash is an attempt to introduce stable warning identifiers
that won't change when code around them gets moved around.
Path diagnostic consumers print issue hashes for the emitted diagnostics.

This move will allow us to ultimately move path diagnostic consumers
to libAnalysis.

Differential Revision: https://reviews.llvm.org/D67421
2020-10-13 10:53:10 -07:00
Artem Dergachev fd4b3f123d [analyzer] NFC: Separate PathDiagnosticConsumer options from AnalyzerOptions.
The AnalyzerOptions object contains too much information that's
entirely specific to the Analyzer. It is also being referenced by
path diagnostic consumers to tweak their behavior. In order for path
diagnostic consumers to function separately from the analyzer,
make a smaller options object that only contains relevant options.

Differential Revision: https://reviews.llvm.org/D67420
2020-10-13 10:53:10 -07:00
Bevin Hansson 101309fe04 [AST] Change return type of getTypeInfoInChars to a proper struct instead of std::pair.
Followup to D85191.

This changes getTypeInfoInChars to return a TypeInfoChars
struct instead of a std::pair of CharUnits. This lets the
interface match getTypeInfo more closely.

Reviewed By: efriedma

Differential Revision: https://reviews.llvm.org/D86447
2020-10-13 13:26:56 +02:00
Bevin Hansson 9fa7f48459 [Fixed Point] Add fixed-point to floating point cast types and consteval.
Reviewed By: leonardchan

Differential Revision: https://reviews.llvm.org/D86631
2020-10-13 13:26:56 +02:00
Nithin Vadukkumchery Rajendrakumar 0b4fe8086f [Analyzer] Fix for dereferece of smart pointer after branching on unknown inner pointer
Summary: Enabling warning after dereferece of smart pointer after branching on unknown inner pointer.

Reviewers: NoQ, Szelethus, vsavchenko, xazax.hun
Reviewed By: NoQ
Subscribers: martong, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D87043
2020-10-09 13:42:25 +02:00
Benjamin Kramer 6a1bca8798 [Analyzer] Fix unused variable warning in Release builds
clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp:377:19: warning: unused variable 'Init'
2020-09-25 14:09:43 +02:00
Adam Balogh facad21b29 [Analyzer] Fix for `ExprEngine::computeObjectUnderConstruction()` for base and delegating consturctor initializers
For /C++/ constructor initializers `ExprEngine:computeUnderConstruction()`
asserts that they are all member initializers. This is not neccessarily
true when this function is used to get the return value for the
construction context thus attempts to fetch return values of base and
delegating constructor initializers result in assertions. This small
patch fixes this issue.

Differential Revision: https://reviews.llvm.org/D85351
2020-09-25 13:28:22 +02:00
Gabor Marton 11d2e63ab0 [analyzer][StdLibraryFunctionsChecker] Separate the signature from the summaries
The signature should not be part of the summaries as many FIXME comments
suggests. By separating the signature, we open up the way to a generic
matching implementation which could be used later under the hoods of
CallDescriptionMap.

Differential Revision: https://reviews.llvm.org/D88100
2020-09-23 10:59:34 +02:00
Gabor Marton d63a945a13 [analyzer][StdLibraryFunctionsChecker] Fix getline/getdelim signatures
It is no longer needed to add summaries of 'getline' for different
possible underlying types of ssize_t. We can just simply lookup the
type.

Differential Revision: https://reviews.llvm.org/D88092
2020-09-23 10:48:14 +02:00
Jan Korous 47e6851423 [Analyzer][WebKit] Use tri-state types for relevant predicates
Some of the predicates can't always be decided - for example when a type
definition isn't available. At the same time it's necessary to let
client code decide what to do about such cases - specifically we can't
just use true or false values as there are callees with
conflicting strategies how to handle this.

This is a speculative fix for PR47276.

Differential Revision: https://reviews.llvm.org/D88133
2020-09-22 21:57:24 -07:00
Jan Korous 8a64689e26 [Analyzer][WebKit] UncountedLocalVarsChecker
Differential Review: https://reviews.llvm.org/D83259
2020-09-22 11:05:04 -07:00
Chris Hamilton 2697d138a6 [Analyzer] GNU named variadic macros in Plister
Added support for GNU named variadic macros in
macro expansion for plist generation.

Fix for https://bugs.llvm.org/show_bug.cgi?id=44493

Reviewed By: Szelethus

Differential Revision: https://reviews.llvm.org/D87942
2020-09-21 15:38:28 -05:00
Gabor Marton 0c4f91f84b [analyzer][solver] Fix issue with symbol non-equality tracking
We should track non-equivalency (disequality) in case of greater-then or
less-then assumptions.

Differential Revision: https://reviews.llvm.org/D88019
2020-09-21 16:59:18 +02:00
Kristóf Umann dd1d5488e4 [analyzer][Liveness][NFC] Get rid of statement liveness, because such a thing doesn't exist
The summary and very short discussion in D82122 summarizes whats happening here.

In short, liveness talks about variables, or expressions, anything that
has a value. Well, statements just simply don't have a one.

Differential Revision: https://reviews.llvm.org/D82598
2020-09-15 17:43:02 +02:00
Gabor Marton a012bc4c42 [analyzer][StdLibraryFunctionsChecker] Elaborate the summary of fread and fwrite
Add the BufferSize argument constraint to fread and fwrite. This change
itself makes it possible to discover a security critical case, described
in SEI-CERT ARR38-C.

We also add the not-null constraint on the 3rd arguments.

In this patch, I also remove those lambdas that don't take any
parameters (Fwrite, Fread, Getc), thus making the code better
structured.

Differential Revision: https://reviews.llvm.org/D87081
2020-09-15 16:35:39 +02:00
Balazs Benics cdacffe4ac [analyzer][z3] Use more elaborate Z3 variable names
Previously, it was a tedious task to comprehend Z3 dumps.
We will use the same name prefix just as we use in the corresponding dump method

For all `SymbolData` values:
    `$###` -> `conj_$###`
    `$###` -> `derived_$###`
    `$###` -> `extent_$###`
    `$###` -> `meta_$###`
    `$###` -> `reg_$###`

Reviewed By: xazax.hun,mikhail.ramalho

Differential Revision: https://reviews.llvm.org/D86223
2020-09-14 08:43:56 +02:00
Balazs Benics 163863604f [analyzer] Evaluate PredefinedExpressions
We did not evaluate such expressions, just returned `Unknown` for such cases.
After this patch, we will be able to access a unique value identifying a template instantiation via the value of the `PRETTY_FUNCTION` predefined expression.

Reviewed By: vsavchenko

Differential Revision: https://reviews.llvm.org/D87004
2020-09-14 08:43:56 +02:00
Vitaly Buka a8503b87f7 [NFC] Remove unused static function 2020-09-11 16:50:30 -07:00
Kristóf Umann b9bca883c9 [analyzer][NFC] Don't bind values to ObjCForCollectionStmt, replace it with a GDM trait
Based on the discussion in D82598#2171312. Thanks @NoQ!

D82598 is titled "Get rid of statement liveness, because such a thing doesn't
exist", and indeed, expressions express a value, non-expression statements
don't.

if (a && get() || []{ return true; }())
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ has a value
    ~ has a value
    ~~~~~~~~~~ has a value
                  ~~~~~~~~~~~~~~~~~~~~ has a value
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ doesn't have a value

That is simple enough, so it would only make sense if we only assigned symbolic
values to expressions in the static analyzer. Yet the interface checkers can
access presents, among other strange things, the following two methods:

ProgramState::BindExpr(const Stmt *S, const LocationContext *LCtx, SVal V,
                       bool Invalidate=true)
ProgramState::getSVal(const Stmt *S, const LocationContext *LCtx)

So, what gives? Turns out, we make an exception for ReturnStmt (which we'll
leave for another time) and ObjCForCollectionStmt. For any other loops, in order
to know whether we should analyze another iteration, among other things, we
evaluate it's condition. Which is a problem for ObjCForCollectionStmt, because
it simply doesn't have one (CXXForRangeStmt has an implicit one!). In its
absence, we assigned the actual statement with a concrete 1 or 0 to indicate
whether there are any more iterations left. However, this is wildly incorrect,
its just simply not true that the for statement has a value of 1 or 0, we can't
calculate its liveness because that doesn't make any sense either, so this patch
turns it into a GDM trait.

Fixing this allows us to reinstate the assert removed in
https://reviews.llvm.org/rG032b78a0762bee129f33e4255ada6d374aa70c71.

Differential Revision: https://reviews.llvm.org/D86736
2020-09-11 15:58:48 +02:00
Kristóf Umann be0d79f329 [analyzer][MacroExpansion] Fix a crash where multiple parameters resolved to __VA_ARGS__
In short, macro expansions handled the case where a variadic parameter mapped to
multiple arguments, but not the other way around. An internal ticket was
submitted that demonstrated that we fail an assertion. Macro expansion so far
worked by lexing the source code token-by-token and using the Preprocessor to
turn these tokens into identifiers or just get their proper spelling, but what
this counter intuitively doesn't do, is actually expand these macros, so we have
to do the heavy lifting -- in this case, figure out what __VA_ARGS__ expands
into. Since this case can only occur in a nested macro, the information we
gathered from the containing macro does contain this information. If a parameter
resolves to __VA_ARGS__, we need to temporarily stop getting our tokens from the
lexer, and get the tokens from what __VA_ARGS__ maps to.

Differential Revision: https://reviews.llvm.org/D86135
2020-09-11 14:07:58 +02:00
Kirstóf Umann 26d9a94681 [analyzer][MacroExpansion][NFC] Fix incorrectly calling parameters arguments 2020-09-11 13:33:02 +02:00
Kirstóf Umann 1c08da3867 [analyzer][MacroExpansion] Add a few dumps functions 2020-09-11 13:29:14 +02:00