Commit Graph

123 Commits

Author SHA1 Message Date
Ted Kremenek 9abe474852 Add preliminary support for enhancing null-pointer dereference diagnostics.
llvm-svn: 71135
2009-05-07 00:45:33 +00:00
Ted Kremenek bb8d546208 Refactor BugReporter interface to have a new 'BugReporterContext' and
'BugReporterVisitor'. This simplifies callbacks from BugReporter to BugReports
(via VisitNode). It also lays the foundation for arbitrary visitor "call backs"
that can be registered to a BugReporterContext as a PathDiagnostic is
constructed. These call backs can help operate as separate "experts" that can
work on constructed pieces of a PathDiagnostic for which they possess special
knowledge.

llvm-svn: 71121
2009-05-06 21:39:49 +00:00
Ted Kremenek a8106efce9 BugReporter (extensive diagnostics): improve location context generation for the
start of 'do' and '@synchronized' statements.

llvm-svn: 71038
2009-05-05 23:13:38 +00:00
Ted Kremenek 98017051ae BugReporter (extensive diagnostics): Fix getEnclosingStmtLocation to reason
about Exprs that are not consumed and fix where the loop iteration diagnostic
goes.

llvm-svn: 71027
2009-05-05 22:19:17 +00:00
Ted Kremenek e396f72ec7 BugReporter (extensive diagnostics): don't mark location contexts that are
control-flow expressions as dead.

llvm-svn: 70887
2009-05-04 18:15:17 +00:00
Ted Kremenek afbff15e64 BugReporter (extensive diagnostics): introduce the notion of a "dead"
location context.  This allows us to postpone the decision of whether
or not a context should add a control-flow piece to the diagnostics
when inspecting its subexpressions.

llvm-svn: 70545
2009-05-01 16:08:09 +00:00
Ted Kremenek 29d0880e50 Remove #if 0'ed code.
llvm-svn: 70542
2009-05-01 15:19:33 +00:00
Ted Kremenek 9f08b842e1 Fix null dereference.
llvm-svn: 70417
2009-04-29 22:05:03 +00:00
Ted Kremenek 47187c6ad2 BugReporter/PathDiagnostics:
- Add an (optional) short description for BugReports for clients that want
  to distinguish between long and short descriptions for bugs
- Make the bug report for VLA less obscene for Plist diagnostics by using
  the short description

llvm-svn: 70415
2009-04-29 21:58:13 +00:00
Ted Kremenek 9bea0dc178 Extensive diagnostics: Do not add a location context for do...while statements.
llvm-svn: 70286
2009-04-28 04:28:12 +00:00
Ted Kremenek 61114bc558 BugReporter (extensive diagnostics): Clean up do...while control-flow edges, and
add "Looping back to the head of the loop" diagnostic for loops.

llvm-svn: 70285
2009-04-28 04:23:15 +00:00
Sebastian Redl a7b98a772c Implement function-try-blocks. However, there's a very subtle bug that I can't track down.
llvm-svn: 70155
2009-04-26 20:35:05 +00:00
Eli Friedman 5cdb8cc267 Minor code cleanup.
llvm-svn: 70144
2009-04-26 19:04:51 +00:00
Chris Lattner f0b64d73a8 split ObjC and C++ Statements out into their own headers.
llvm-svn: 70105
2009-04-26 01:32:48 +00:00
Ted Kremenek 3ebc5057ac BugReporter (extensive diagnostics): Recursively adjust the referred expression
when popping location contexts.

llvm-svn: 69898
2009-04-23 16:44:22 +00:00
Ted Kremenek e60809c31d BugReporter (extensive diagnostics): Ignore parentheses when added control-flow
pieces for location contexts.

llvm-svn: 69895
2009-04-23 16:19:29 +00:00
Ted Kremenek 48b7875e55 BugReporter (extensive diagnostics): Use correct location for location contexts.
llvm-svn: 69824
2009-04-22 20:51:59 +00:00
Ted Kremenek fb05406cef BugReporter (extensive diagnostics): always add an edge if there is no location
context.

llvm-svn: 69823
2009-04-22 20:36:26 +00:00
Ted Kremenek 6c867a1460 BugReporter (extensive diagnostics):
- Remove stale assertion that was breaking the test suite.
- When popping location contexts, only add a control-flow piece for fileID
  locations.

llvm-svn: 69814
2009-04-22 18:37:42 +00:00
Ted Kremenek 0752a5dff3 BugReporter (extensive diagnostic algorithm): The initial control-flow edge now
starts from the first character of the first statement.

llvm-svn: 69813
2009-04-22 18:16:20 +00:00
Douglas Gregor e3dcb2ddd1 FunctionDecl::getBody() is getting an ASTContext argument for use in
lazy PCH deserialization. Propagate that argument wherever it needs to
be. No functionality change, except that I've tightened up a few PCH
tests in preparation.

llvm-svn: 69406
2009-04-18 00:02:19 +00:00
Ted Kremenek 3cb8a84924 Removed some commented code.
llvm-svn: 68495
2009-04-07 04:53:35 +00:00
Ted Kremenek 86d52c4c02 PathDiagnostic generation: experiment with avoiding generation of control-flow
pieces between block entrance and block end unless necessary.

llvm-svn: 68483
2009-04-07 01:34:17 +00:00
Ted Kremenek d7c1aaa6c5 Don't overguard to adding a control-flow piece when "alwaysAdd" is true.
llvm-svn: 68476
2009-04-07 00:11:40 +00:00
Ted Kremenek c4c9ed0f9b Rewrite control-flow diagnostic generation "extensive" algorithm using "edge
contexts".  This allows us to use a stack of contexts to keep track of what control-flow pieces to include when exiting blocks like 'if', 'for', etc.

llvm-svn: 68473
2009-04-06 23:06:54 +00:00
Ted Kremenek a2a735e7fa Add another null pointer check. Simplify condition.
llvm-svn: 68283
2009-04-02 03:44:00 +00:00
Ted Kremenek 5d6d7d8184 Add null pointer check.
llvm-svn: 68281
2009-04-02 03:30:55 +00:00
Ted Kremenek afb066d1f5 BugReporter, extensive path-diagnostics: add an extra control-flow edge to the
enclosing statement when jumping to a subexpression.

llvm-svn: 68244
2009-04-01 21:12:06 +00:00
Ted Kremenek 95af35e251 Fix comment.
llvm-svn: 68236
2009-04-01 19:43:28 +00:00
Ted Kremenek ed47d79cc2 BugReporter: for extensive path diagnostics:
- When processing BlockEdges with terminators, using the condition as the
  control-flow point for terminators that are expressions (e.g., '&&', '?')
- When processing events, allow intra-compound statement "jumping"

llvm-svn: 68228
2009-04-01 18:48:52 +00:00
Ted Kremenek 9ce13241ff BugReporter: for extensive PathDiagnostic generation, add control-flow from the
start of the function/method.

llvm-svn: 68217
2009-04-01 17:52:26 +00:00
Ted Kremenek 45a75f718c BugReporter: For the "extensive" PathDiagnostic generation algorithm, elide most
intra-compound statement jumps unless they are between terminators (i.e.,
branches).

llvm-svn: 68216
2009-04-01 17:18:21 +00:00
Ted Kremenek 0bb0909233 - Changed PathDiagnosticPiece::getLocation() to return a PathDiagnosticLocation
instead of a FullSourceLoc. This resulted in a bunch of small edits in various
  clients.
- Updated BugReporter to include an alternate PathDiagnostic generation
  algorithm for PathDiagnosticClients desiring more control-flow pieces.

llvm-svn: 68193
2009-04-01 06:13:56 +00:00
Ted Kremenek 7062c50772 More code reshuffling. No functionality change.
llvm-svn: 68157
2009-03-31 23:00:32 +00:00
Ted Kremenek 4e81c3ccac Allow two codepaths for PathDiagnostic generation. This patch mainly consists of
refactoring to make this possible (no functionality change).

llvm-svn: 68141
2009-03-31 20:22:36 +00:00
Ted Kremenek ac508988a5 Simplify more code by using SVal::getAsSymbol().
llvm-svn: 68052
2009-03-30 19:53:37 +00:00
Ted Kremenek a53eb7fa80 Convert use of loc::SymbolVal and nonloc::SymbolVal to V.getAsSymbol(). This
also makes this code more correct as it transparently handles SVals that wrapped
TypedViewRegions(SymbolicRegions).

llvm-svn: 68048
2009-03-30 18:39:15 +00:00
Ted Kremenek b505811250 Adjust control-flow endpoints for '&&' and '||'.
llvm-svn: 67948
2009-03-28 17:33:57 +00:00
Ted Kremenek cd58cced81 Text PathDiagnosticBuilder::getEnclosingStmt() about '?'
llvm-svn: 67909
2009-03-28 04:08:14 +00:00
Ted Kremenek b9411565ea Teach PathDiagnosticBuilder::getEnclosingStmtLocation() about while/if/do/for,
etc., so that the "body" is always considered a top-level statement for edge
transitions (even if it is an expression).

llvm-svn: 67901
2009-03-28 03:37:59 +00:00
Ted Kremenek 7a621b9747 BugReporter: For control-flow edges from 'if', 'for', 'do', 'while' to
successor, using 'getEnclosingStmt()' to have the end location be the top-level
Stmt* enclosing the target Expr*.

llvm-svn: 67869
2009-03-27 21:16:25 +00:00
Ted Kremenek 41d865cbaa BugReporter: PathDiagnosticBuilder::ExecutionContinues now returns a
PathDiagnosticLocation.

llvm-svn: 67866
2009-03-27 20:55:39 +00:00
Ted Kremenek a7ec0ded63 BugReporter:
- Added an internal helper class 'PathDiagnosticBuilder' which now bundles the
  'ExecutionContinues' methods.
- Added preliminary diagnostics for short-circuit '&&' and '||'

llvm-svn: 67822
2009-03-27 05:06:10 +00:00
Ted Kremenek 46dee7b0f6 - Add class PathDiagosticLocationPair.
- Have PathDiagnosticControlFlowPiece use a vector of PathDiagnosticLocationPairs to represent transitions.

llvm-svn: 67786
2009-03-26 23:12:02 +00:00
Ted Kremenek 3e31c26f81 analyzer infrastructure: make a bunch of changes to symbolic expressions that
Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731
2009-03-26 03:35:11 +00:00
Ted Kremenek e413a76004 Use the correct data structures!
ExplodedGraph::TrimGraph:
- Just do a DFS both ways instead of BFS-DFS. We're just determining what subset
  of the nodes are reachable from the root and reverse-reachable from the bug
  nodes.  DFS is more efficient for this task.
  
BugReporter:
- MakeReportGraph: Do a reverse-BFS instead of a reverse-DFS to determine the
  approximate shortest path through the simulation graph. We were seeing some
  weird cases where too many loops were being reported for simple bugs. Possibly
  we will need to replace this with actually computing the shortest path in
  terms of line numbers.

llvm-svn: 66842
2009-03-12 23:41:59 +00:00
Ted Kremenek 9d1ce8faae PathDiagnostics:
- PathDiagnosticControlFlowPiece now consists of a "start" and "end" location
  to indicating the branch location and where the branch goes.

BugReporter:
- Updated BugReporter to construct PathDiagnosticControlFlowPiece objects with
  "end" locations.

PlistDiagnostics:
- Plists now contain the bug "type" (not just bug "category")
- Plists now encode control-flow pieces differently than events; now the
  "start" and "end" locations are recorded

llvm-svn: 66818
2009-03-12 18:41:53 +00:00
Ted Kremenek b4947e4378 BugReporter:
- Group control flow and event PathDiagnosticPieces into PathDiagnosticMacroPieces.
- Afterwards, eliminate any PathDiagnosticMacroPieces from a PathDiagnostic that
  contain no informative events.

HTMLDiagnostics:
- Use new information about PathDiagnosticMacroPieces to specially format
  message bubbles for macro expansions containing interesting events.

llvm-svn: 66524
2009-03-10 05:16:17 +00:00
Ted Kremenek b6b7ce4b50 Create PathDiagnosticPiece subclasses PathDiagnosticEventPiece and
PathDiagnosticControlFlowPiece to distinguish (in the class hierarchy) between
events and control-flow diagnostic pieces. Clients must now use these directly
when constructing PathDiagnosticPieces.

llvm-svn: 66310
2009-03-06 23:58:11 +00:00
Ted Kremenek 2f340d6cb6 BasicStore:
- Store bindings using a MemRegion -> SVal binding instead of VarDecl -> SVal
  binding. This mirrors some of the idea of RegionStore, but is far simpler and
  not nearly as functional.  This leads to some code simplification and
  some potential for some minor precision hacks.
  
Along the way...
- constify the use of MemRegion* in a few places
- add operator<<(llvm::raw_ostream, const MemRegion*)

llvm-svn: 66163
2009-03-05 16:31:07 +00:00