Commit Graph

176 Commits

Author SHA1 Message Date
Ted Kremenek 01c414c070 Remove FIXME comment.
llvm-svn: 59973
2008-11-24 19:27:06 +00:00
Zhongxing Xu 9165ed69af Add support for AllocaRegion extent with GDM.
One design problem that is emerging is the signed-ness problem during static
analysis. Many unsigned value have to be converted into signed value because
it partipates in operations with signed values. 

On the other hand, we cannot blindly make all values occuring in static analysis
signed, because we do have cases where unsignedness is required, for example,
integer overflow detection.

llvm-svn: 59957
2008-11-24 09:44:56 +00:00
Zhongxing Xu 6587c75488 Cleanup code with utility method.
llvm-svn: 59951
2008-11-24 07:02:06 +00:00
Zhongxing Xu aa86cff14c Add out-of-bound memory access warning report code.
llvm-svn: 59903
2008-11-23 05:52:28 +00:00
Zhongxing Xu 4d45b34a8a Initial support for checking out of bound memory access. Only support
ConcreteInt index for now.

llvm-svn: 59869
2008-11-22 13:21:46 +00:00
Ted Kremenek 0b63f96ab5 - Clean up transfer function logic for 'return' statements.
- Add check for returning an undefined value to a caller.

llvm-svn: 59764
2008-11-21 00:27:44 +00:00
Zhongxing Xu 99a96d6ef3 Enhance modularization: return a <state,loc> pair to let GRExprEngine modify the
environment.

llvm-svn: 59407
2008-11-16 07:06:26 +00:00
Zhongxing Xu ceca80619f Enhances SCA to process untyped region to typed region conversion.
- RegionView and RegionViewMap is introduced to assist back-mapping from
   super region to subregions.
 - GDM is used to carry RegionView information.
 - AnonTypedRegion is added to represent a typed region introduced by pointer
   casting. Later AnonTypedRegion can be used in other similar cases, e.g.,
   malloc()'ed region.
 - The specific conversion is delegated to store manager.

llvm-svn: 59382
2008-11-16 04:07:26 +00:00
Ted Kremenek 1b2dace792 Reduce permissiveness of assertion.
llvm-svn: 59354
2008-11-15 05:00:27 +00:00
Ted Kremenek 4413714946 Reverted part of r59335: http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20081110/009243.html
In that patch I added a bogus type promotion for unary '!'.

The real bug was more fallout from edges cases with compound assignments and conjured symbolic values.  Now the conjured value has the type of the LHS expression, and we do a promotion to the computation type.  We also now correctly do a conversion from the computation type back to the LHS type.

llvm-svn: 59349
2008-11-15 04:01:56 +00:00
Ted Kremenek ac172fc574 Re-enable an assertion that I mistakenly removed.
llvm-svn: 59348
2008-11-15 02:35:08 +00:00
Ted Kremenek 519a223056 Use the correct QualType when creating the '0' constant.
llvm-svn: 59343
2008-11-15 00:40:08 +00:00
Ted Kremenek 1ca3346b19 Implement FIXME in GRExprEngine::VisitUnaryOperator() to handle implicit conversions caused by the '!' operator. This required adding some logic to GRSimpleVals to reason about nonloc::LocAsInteger SVals. This code appears to work fine, but it should eventually be cleaned up.
llvm-svn: 59335
2008-11-15 00:20:05 +00:00
Ted Kremenek 537f6387a2 Second attempt at implementation transfer function support for ObjCForCollectionStmt. We now assume that the 'element' expression can be any lvalue.
llvm-svn: 59313
2008-11-14 19:47:18 +00:00
Douglas Gregor 993603d80d Add a new expression node, CXXOperatorCallExpr, which expresses a
function call created in response to the use of operator syntax that
resolves to an overloaded operator in C++, e.g., "str1 +
str2" that resolves to std::operator+(str1, str2)". We now build a
CXXOperatorCallExpr in C++ when we pick an overloaded operator. (But
only for binary operators, where we actually implement overloading)

I decided *not* to refactor the current CallExpr to make it abstract
(with FunctionCallExpr and CXXOperatorCallExpr as derived
classes). Doing so would allow us to make CXXOperatorCallExpr a little
bit smaller, at the cost of making the argument and callee accessors
virtual. We won't know if this is going to be a win until we can parse
lots of C++ code to determine how much memory we'll save by making
this change vs. the performance penalty due to the extra virtual
calls.

llvm-svn: 59306
2008-11-14 16:09:21 +00:00
Zhongxing Xu c967d03528 Improve comments.
llvm-svn: 59294
2008-11-14 09:23:38 +00:00
Ted Kremenek 7d5389e4b3 - Revert r59229 and r59232: AllocRegion should be immutable.
- Temporarily disabled test Analysis/array-struct.c for region store.

llvm-svn: 59245
2008-11-13 15:42:31 +00:00
Zhongxing Xu 0dbeeaa886 Lift the pointer to alloca'ed region to the pointer to its first element.
This is required by some operations, e.g., *p = 1; p[0] = 1;.
Also set the AllocaRegion's type during the cast.

llvm-svn: 59232
2008-11-13 07:58:20 +00:00
Ted Kremenek 16866d6fd8 GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) of vector types. Add explicit checks that when we process integers that they really are scalars.
llvm-svn: 59225
2008-11-13 06:10:40 +00:00
Ted Kremenek 45698bf05f GRExprEngine::VisitInitListExpr:
- Don't crash on vector types.
- Handle typedefs.

llvm-svn: 59220
2008-11-13 05:05:34 +00:00
Ted Kremenek df31792a66 Shore up transfer function for ObjCForCollectionStmt.
llvm-svn: 59162
2008-11-12 21:12:46 +00:00
Ted Kremenek 1781080c34 Add (preliminary) transfer function support for ObjCForCollectionStmt. Still need to flesh out some logic.
When processing DeclStmt, use the new interface to StateManager::BindDecl.  Conjuring of symbols is now done in VisitDeclStmt.

llvm-svn: 59155
2008-11-12 19:24:17 +00:00
Sebastian Redl 6f28289aca Introduce a single AST node SizeOfAlignOfExpr for all sizeof and alignof expressions, both of values and types.
llvm-svn: 59057
2008-11-11 17:56:53 +00:00
Chris Lattner 231f7bbdbe silence a warning from gcc.
llvm-svn: 58956
2008-11-10 03:00:37 +00:00
Zhongxing Xu 3d43015bc7 Add a boilerplate for out-of-bound array checking. This has no real function currently.
llvm-svn: 58886
2008-11-08 03:45:42 +00:00
Zhongxing Xu 2c677c34d5 Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is
available, things get much simplified.

One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue
context.

llvm-svn: 58837
2008-11-07 10:38:33 +00:00
Ted Kremenek 9bf363979d Add transfer function logic for alloca().
llvm-svn: 58552
2008-11-02 00:35:01 +00:00
Ted Kremenek 59ae7c0fd5 Comment out invalid assertion. I'm leaving it in the code for now as a reminder to produce a test case.
llvm-svn: 58510
2008-10-31 15:33:11 +00:00
Zhongxing Xu 4de1c851d3 Fix 80-col violations.
llvm-svn: 58495
2008-10-31 07:26:14 +00:00
Zhongxing Xu 2caf586d2f Add a tentative assertion.
llvm-svn: 58492
2008-10-31 06:05:32 +00:00
Zhongxing Xu 121a53a176 Fix a comment.
llvm-svn: 58487
2008-10-31 03:01:26 +00:00
Ted Kremenek 828e6dff9b Handle the case in VisitInitListExprs where there are no initializers in the compound literal.
llvm-svn: 58468
2008-10-30 23:14:36 +00:00
Ted Kremenek 0f0adc97c5 Use the correct predecessor node.
llvm-svn: 58446
2008-10-30 18:37:08 +00:00
Ted Kremenek 28f41ba829 Add missing return statement.
llvm-svn: 58444
2008-10-30 18:34:31 +00:00
Ted Kremenek f68bf63611 Use a worklist in GRExprEngine::VisitInitListExpr to process subexpressions.
llvm-svn: 58440
2008-10-30 17:47:32 +00:00
Zhongxing Xu 610634fe39 Merge the array and struct case. They are essentially the same.
llvm-svn: 58422
2008-10-30 05:35:59 +00:00
Zhongxing Xu a15cfd4db9 Rename:
- SetSVal(GRState*, Loc, SVal) => BindLoc
 - SetSVal(GRState*, Expr*, SVal) => BindExpr 

llvm-svn: 58421
2008-10-30 05:33:54 +00:00
Zhongxing Xu b281cdda87 Implement VisitInitListExpr(). InitListExpr will have a nonloc::CompoundVal value.
llvm-svn: 58419
2008-10-30 05:02:23 +00:00
Ted Kremenek 204ae1f0d9 Mark yy_fatal_error as a panic function.
llvm-svn: 58410
2008-10-30 00:00:57 +00:00
Zhongxing Xu 628ae879ea Rename: AddDecl => BindDecl
BindDecl better describes what the function does:
  - Bind the VarDecl to its memory region
  - Bind the memory region to some initial value.

llvm-svn: 58359
2008-10-29 02:34:02 +00:00
Douglas Gregor f19b2319c9 Rename ExplicitCCastExpr to CStyleCastExpr
llvm-svn: 58331
2008-10-28 15:36:24 +00:00
Douglas Gregor 6b75484ba6 Improve our handling of (C++) references within Clang. Specifically:
- Do not allow expressions to ever have reference type
  - Extend Expr::isLvalue to handle more cases where having written a
    reference into the source implies that the expression is an lvalue
    (e.g., function calls, C++ casts).
  - Make GRExprEngine::VisitCall treat the call arguments as lvalues when
    they are being bound to a reference parameter.

llvm-svn: 58306
2008-10-28 00:22:11 +00:00
Ted Kremenek 54d399ac5d Remove type-punning warning in GRExprEngine. No functionality change.
llvm-svn: 58292
2008-10-27 23:02:39 +00:00
Ted Kremenek bf26368255 Added preliminary support for CompoundLiterals in the static analyzer:
- GRExprEngine::VisitCompoundLiteral...
   (1) visits the initializer list (generating ExplodedNodes)
   (2) creates a CompoundMemRegion for the literal
   (3) creates a new state with the bound literal values using
       GRStateManager::BindCompoundLiteral

- GRStateManager::BindCompoundLiteral simply calls 
  StoreManager::BindCompoundLiteral to get a new store and returns a persistent
  GRState with that store.

- BasicStore::BindCompoundLiteral simply returns the same store, as it
  doesn't handle field sensitivity
  
- RegionStore::BindCompoundLiteral currently fires an assert (pending discussion
  of how to best implement mappings for CompoundLiteralRegion).

llvm-svn: 58277
2008-10-27 21:54:31 +00:00
Douglas Gregor e200adc503 Refactor the expression class hierarchy for casts. Most importantly:
- CastExpr is the root of all casts
  - ImplicitCastExpr is (still) used for all explicit casts
  - ExplicitCastExpr is now the root of all *explicit* casts
  - ExplicitCCastExpr (new name needed!?) is a C-style cast in C or C++
  - CXXFunctionalCastExpr inherits from ExplicitCastExpr
  - CXXNamedCastExpr inherits from ExplicitCastExpr and is the root of all
    of the C++ named cast expression types (static_cast, dynamic_cast, etc.)
  - Added classes CXXStaticCastExpr, CXXDynamicCastExpr, 
    CXXReinterpretCastExpr, and CXXConstCastExpr to 

Also, fixed returned-stack-addr.cpp, which broke once when we fixed
reinterpret_cast to diagnose double->int* conversions and again when
we eliminated implicit conversions to reference types. The fix is in
both testcase and SemaChecking.cpp.

Most of this patch is simply support for the renaming. There's very
little actual change in semantics.

llvm-svn: 58264
2008-10-27 19:41:14 +00:00
Ted Kremenek e69a1fa342 Do not crash when performing VisitLValue on union types.
This fixes PR 2948.

llvm-svn: 58148
2008-10-25 20:09:21 +00:00
Zhongxing Xu 0d2706f6b8 Add code for get the lvalue for string literals. Now we return a StringRegion
for StringLiteral lvalue evaluation, instead of directly returning a
loc::StringLiteralVal by the Environment.

llvm-svn: 58138
2008-10-25 14:18:57 +00:00
Zhongxing Xu ad20b671fc Now we can handle arrays.
llvm-svn: 58135
2008-10-25 10:26:46 +00:00
Ted Kremenek 6e09d8f632 Implicit conversions from arrays can also be conversions to references (will add a test case shortly).
llvm-svn: 58110
2008-10-24 21:10:49 +00:00
Ted Kremenek f3be44f191 Added method "getSelfRegion" to Store. This method returns the region associated with the "this" or "self" object (C++ and Objective-C respectively).
llvm-svn: 58107
2008-10-24 20:32:16 +00:00