Commit Graph

935 Commits

Author SHA1 Message Date
Marcin Swiderski 20b88739ed Added support for base and member destructors in destructor.
llvm-svn: 115592
2010-10-05 05:37:00 +00:00
Marcin Swiderski 87b1bb6fd2 Added support for C++ initializers in CFG.
llvm-svn: 115493
2010-10-04 03:38:22 +00:00
Marcin Swiderski 3546b1aea1 Added generating CFGAutomaticObjDtors for exception variable in catch statement.
llvm-svn: 115266
2010-10-01 01:46:52 +00:00
Marcin Swiderski 6d5ee0c7f9 Added generating CFGAutomaticObjDtors for init statement, condition variable and implicit scope in for statement.
llvm-svn: 115265
2010-10-01 01:38:14 +00:00
Marcin Swiderski e407a3ba1e dded generating CFGAutomaticObjDtors for condition variable and implicit scopes in switch statement.
llvm-svn: 115264
2010-10-01 01:24:41 +00:00
Marcin Swiderski 1f4e15c56f Added generating CFGAutomaticObjDtors for condition variable and implicit scopes in while and do statements.
llvm-svn: 115262
2010-10-01 01:14:17 +00:00
Marcin Swiderski f883ade880 Added generating CFGAutomaticObjDtors for condition variable and implicit scopes in if statement.
llvm-svn: 115256
2010-10-01 00:52:17 +00:00
Marcin Swiderski 667ffecd9e Added:
- Adding LocalScope for CompoundStmt,
- Adding CFGAutomaticObjDtors for end of scope, return, goto, break, continue,
- Regression tests for above cases.

llvm-svn: 115252
2010-10-01 00:23:17 +00:00
Ted Kremenek 3d6c0c0091 Tweak nil receiver checker to not warning about 64-bit return values.
Fixes: <rdar://problem/7513117>
llvm-svn: 115113
2010-09-30 00:37:10 +00:00
Argyrios Kyrtzidis 40cec8326c Revert r114316, -Wunused-value enabled by default was intended.
llvm-svn: 114318
2010-09-19 23:03:35 +00:00
Argyrios Kyrtzidis 3698bf1c6d Make -Wunused-value off by default, matching GCC. Fixes rdar://7126194.
llvm-svn: 114316
2010-09-19 21:21:44 +00:00
Ted Kremenek 7b31a61d10 Relax assertion in CFG builder when processing ForStmts. This fixes an assertion failure
on code containing GNU statement expressions reported in PR 8141.

llvm-svn: 113953
2010-09-15 07:01:20 +00:00
Ted Kremenek c4deb92316 Disallow the use of UnknownVal as the index for ElementRegions. UnknownVals can be used as
the index when the value evaluation isn't powerful enough.  By creating ElementRegions with
UnknownVals as the index, this gives the false impression that they are the same element, when
they really aren't.  This becomes really problematic when deriving symbols from these regions
(e.g., those representing the initial value of the index), since two different indices will
get the same symbol for their binding.

This fixes an issue with the idempotent operations checker that would cause two indices that
are clearly not the same to make it appear as if they always had the same value.

Fixes <rdar://problem/8431728>.

llvm-svn: 113920
2010-09-15 03:13:30 +00:00
Ted Kremenek c95589d2e6 Don't divide-by-zero in RegionStoreManager::getSizeInElements() when getting the size of a VLA. We don't track VLA extents yet,
but we should at least not crash.  Fixes <rdar://problem/8424269>.

llvm-svn: 113888
2010-09-14 23:08:34 +00:00
Ted Kremenek 8abff774aa Fix CFGBuilder crash reported in PR 8141.
llvm-svn: 113826
2010-09-14 01:13:32 +00:00
Ted Kremenek 0a3f523614 Polish diagnostics for null dereferences via ObjC ivar accesses. Finishes up <rdar://problem/6352035>.
llvm-svn: 113612
2010-09-10 20:20:49 +00:00
Ted Kremenek e495c99055 Implement: <rdar://problem/6351970> rule request: warn if @synchronized mutex can be nil
llvm-svn: 113573
2010-09-10 03:05:40 +00:00
Tom Care 4545b2df42 Added AnalyzerStatsChecker, a path sensitive check that reports visitation statistics about analysis. Running clang with the -analyzer-stats flag will emit warnings containing the information. We can then run a postanalysis script to take this data and give useful information about how much the analyzer missed in a project.
llvm-svn: 113568
2010-09-10 00:44:44 +00:00
Ted Kremenek 5cdaeaaa1d Clean up obtuse wording of checker diagnostic of using an uninitialized value in a function call.
Fixes: <rdar://problem/8409480> “warning: Pass-by-value argument in function call is undefined” message can be improved
llvm-svn: 113554
2010-09-09 22:51:55 +00:00
Ted Kremenek ff3a4ff6e9 Use FindReportInEquivalenceClass to identify all the nodes used for the trimmed graph (in BugReporter). This fixes a problem where a leak that happened to occur on both an exit() path and a non-exit() path was getting reported with the exit() path (which users don't care about).
This fixes:

<rdar://problem/8331641> leak reports should not show paths that end with exit() (but ones that don't end with exit())

llvm-svn: 113524
2010-09-09 19:05:34 +00:00
Ted Kremenek 5f256da834 Rename GRState::getSVal() -> getRawSVal() and getSimplifiedSVal() -> getSVal().
The end result is now we eagarly constant-fold symbols in the analyzer that are perfectly constrained
to be a constant value.  This allows us to recover some path-sensitivity in some cases by lowering
the required level of reasoning power needed to evaluate some expressions.

The net win from this change is that the false positive in PR 8015 is fixed, and we also
find more idempotent operations bugs.

We do, however, regress with the BugReporterVisitors, which need to be modified to understand
this constant folding (and look past it).  This causes some diagnostic regressions in plist-output.m
which will get addressed in a future patch.  plist-output.m is now marked XFAIL, while
plist-output-alternate.m now tests that the plist output is working, but with the suboptimal
diagnostics.  This second test file will eventually be removed.

llvm-svn: 113477
2010-09-09 07:13:00 +00:00
Ted Kremenek 5ebb6156d8 Include test case for <rdar://problem/5880430>.
llvm-svn: 113458
2010-09-09 00:40:43 +00:00
John McCall 83556c1a80 Put the tautological-comparison-of-unsigned-against-zero warnings in
-Wtautological-compare instead of -Wsign-compare, which also implies turning
them on by default.

Restoration of r112877.

llvm-svn: 113334
2010-09-08 02:01:27 +00:00
Daniel Dunbar 53c9ac30f9 tests: Use -ffreestanding when including stdint.h, to avoid platform dependencies.
llvm-svn: 113301
2010-09-07 22:54:28 +00:00
Ted Kremenek aba4958db2 Fix null pointer dereference in StreamChecker::Fseek (reported in PR 8081) and simplify surrounding checking logic.
llvm-svn: 113282
2010-09-07 20:45:26 +00:00
Tom Care bc9eaef24c Re-enabled truncation/extension checking in IdempotentOperationChecker and added a test case.
llvm-svn: 113269
2010-09-07 20:27:56 +00:00
Chris Lattner 53fa04909c make clang print types as "const int *" instead of "int const*",
which is should have done from the beginning.  As usual, the most
fun with this sort of change is updating all the testcases.

llvm-svn: 113090
2010-09-05 00:04:01 +00:00
Anders Carlsson af7534f084 Get rid of the "functions declared 'noreturn' should have a 'void' result type" warning.
The rationale behind this is that it is normal for callback functions to have a non-void return type
and it should still be possible to mark them noreturn. (JavaScriptCore is a good example of this).

llvm-svn: 112918
2010-09-03 00:25:02 +00:00
John McCall 310083c3e3 sabre points out that the timing here is pretty pessimal; I'll retry the
experiment in a few days.

llvm-svn: 112882
2010-09-02 22:27:38 +00:00
John McCall 25f7aa8158 Experimentally move the tautological comparison warnings from -Wsign-compare
to -Wtautological-compare.  This implies that they're now on by default.
If this causes chaos, I'll figure something else out.

llvm-svn: 112877
2010-09-02 22:18:59 +00:00
Zhongxing Xu ef94284f2f Tweak test case. 'int' would introduce out-of-bound issues. We focus on array
index constraints in this case.

llvm-svn: 112794
2010-09-02 01:42:44 +00:00
Ted Kremenek 07343c02be For GRExprEngine::EvalBind() (and called visitors), unifiy StoreE and AssignE. Now StoreE (const Stmt*) represents the expression where the store took place, which is the assignment expression if it takes place in an assignment. This removes some conceptual dissidence as well as removes an extra parameter from the Checker::PreVisitBind() visitor. It also improves ranges and source location information in analyzer diagnostics.
llvm-svn: 112789
2010-09-02 00:56:20 +00:00
Ted Kremenek f3a734d8ee Add yet another test case for PR 8015, showing how reasoning over symbolic indices should exactly resolve over multiple index possibilities (and thus suppress the false positive in the test).
llvm-svn: 112770
2010-09-01 23:37:38 +00:00
Ted Kremenek 121ddd6a5c Add another test case for PR 8015, here with the array index being within a valid range and not just a single constant.
llvm-svn: 112769
2010-09-01 23:37:36 +00:00
Ted Kremenek 0e12f9cc7b Partial fix for PR 8015 (fix is actually by Jordy Rose, and I added a test case for follow-on work). This patch adds a bandaid for RegionStore's limited reasoning about symbolic array values.
llvm-svn: 112766
2010-09-01 23:27:26 +00:00
Ted Kremenek d588e78b95 Don't assert in the analyzer when analyze code does a byte load from a function's address. Fixes PR 8052.
llvm-svn: 112761
2010-09-01 23:00:46 +00:00
Ted Kremenek 026cb58a44 Don't assert in CastSizeChecker when the casted-to pointee is an incomplete type. Fixes PR 8050.
llvm-svn: 112738
2010-09-01 20:35:38 +00:00
Ted Kremenek 128d04dfe8 Explicitly handle CXXOperatorCallExpr when building CFGs. We should treat it the same as CallExprs.
Fixes: <rdar://problem/8375510> [Boost] CFGBuilder crash in Boost.Graph
llvm-svn: 112618
2010-08-31 18:47:34 +00:00
Douglas Gregor 79a2788512 Revert my lame attempt at appeasing the CFGBuilder
llvm-svn: 112580
2010-08-31 05:36:56 +00:00
Douglas Gregor f5d453d067 Teach the CFGBuilder not do die on CXXBindTemporaryExpr, CXXOperatorCallExpr. Fixes a Boost.Graph crasher.
llvm-svn: 112578
2010-08-31 05:10:27 +00:00
Tom Care 9026d4b488 Adjusted the semantics of assign checking in IdempotentOperationChecker
- Fixed a regression where assigning '0' would be reported
- Changed the way self assignments are filtered to allow constant testing
- Added a test case for assign ops
- Fixed one test case where a function pointer was not considered constant
- Fixed test cases relating to 0 assignment

llvm-svn: 112501
2010-08-30 19:25:43 +00:00
Tom Care 71cc9d886a Added checking of (x == x) and (x != x) to IdempotentOperationChecker and updated test cases flagged by it.
llvm-svn: 112313
2010-08-27 22:50:47 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 036223bdcf Fix horrible GRExprEngine bug where switch statements with no 'case:' statements would cause the path to get prematurely aborted. Fixes <rdar://problem/8360854>.
llvm-svn: 112233
2010-08-26 22:19:33 +00:00
Tom Care 82b2a1dada Improved the handling of blocks and block variables in PseudoConstantAnalysis
- Removed the assumption that __block vars are all non-constant
- Simplified some repetitive code in RunAnalysis
- Added block walking support
- Code/comments cleanup
- Separated out test for block pseudoconstants

llvm-svn: 112098
2010-08-25 22:37:26 +00:00
Tom Care a460311710 Improvements to IdempotentOperationChecker and its use of PseudoConstantAnalysis
- Added wasReferenced function to PseudoConstantAnalysis to determine if a variable was ever referenced in a function (outside of a self-assignment)
- BlockDeclRefExpr referenced variables are now explicitly added to the non-constant list
- Remove unnecessary ignore of implicit casts
- Generalized parameter self-assign detection to detect deliberate self-assigns of variables to avoid unused variable warnings
- Updated test cases with deliberate self-assignments
- Fixed bug with C++ references and pseudoconstants
- Added test case for C++ references and pseudoconstants

llvm-svn: 111965
2010-08-24 21:09:07 +00:00
Tom Care 905c051e47 Modified pseudoconstant test case to make it a bit clearer and fix a missing line
llvm-svn: 111833
2010-08-23 19:57:25 +00:00
Tom Care e332c3b762 Several small changes to PseudoConstantAnalysis and the way IdempotentOperationChecker uses it.
- Psuedo -> Pseudo (doh...)
- C++ reference support
- Added pseudoconstant test case for __block vars
- Separated out static local checking from pseudoconstant analysis and generalized to non-local checking
- Added missing test cases for storage false positives

llvm-svn: 111832
2010-08-23 19:51:57 +00:00
Jordy Rose 796b5122d9 Handle nested compound values in BindArray for multidimensional arrays. Fixes PR7945.
llvm-svn: 111602
2010-08-20 01:05:59 +00:00
Ted Kremenek 50e0105f1c Add warning for functions/blocks that have attribute 'noreturn' but return a non-void result. (<rdar://problem/7562925>)
llvm-svn: 111492
2010-08-19 00:52:13 +00:00
Tom Care b9933f365e Added psuedo-constant analysis and integrated it into the false positive reduction stage in IdempotentOperationChecker.
- Renamed IdempotentOperationChecker::isConstant to isConstantOrPseudoConstant to better reflect the function
- Changed IdempotentOperationChecker::PreVisitBinaryOperator to only run 'CanVary' once on undefined assumptions
- Created new PsuedoConstantAnalysis class and added it to AnalysisContext
- Changed IdempotentOperationChecker to exploit the new analysis
- Updated tests with psuedo-constants
- Added check to IdempotentOperationChecker to see if a Decl is const qualified

llvm-svn: 111426
2010-08-18 21:17:24 +00:00
Ted Kremenek 4f2ab5a549 Fix horrible CFG bug caused by a series of NullStmts appearing at the beginning of a do...while loop. This would cause
the body of the DoStmt to be disconnected from the preceding code.

llvm-svn: 111283
2010-08-17 21:00:06 +00:00
Tom Care c129cc18f0 Added basic psuedoconstant checking in IdempotentOperationChecker and fixed some test cases.
llvm-svn: 111190
2010-08-16 21:43:52 +00:00
Jordy Rose 722f558f07 Model the effects of strcpy() and stpcpy() in CStringChecker. Other changes:
- Fix memcpy() and friends to actually invalidate the destination buffer.
- Emit a different message for out-of-bounds buffer accesses if the buffer is being written to.
- When conjuring symbols, let ValueManager figure out the type.

llvm-svn: 111120
2010-08-16 07:51:42 +00:00
Jordy Rose df28e8ec41 - Allow making ElementRegions with complex offsets (expressions or symbols) for the purpose of bounds-checking.
- Rewrite GRState::AssumeInBound to actually do that checking, and to use the normal constraint path.
- Remove ConstraintManager::AssumeInBound.
- Teach RegionStore and FlatStore to ignore those regions for now.

llvm-svn: 111116
2010-08-16 01:15:17 +00:00
Jordy Rose 2a2e21c902 Update CStringChecker to take advantage of the new metadata symbols and region change callback. Now does basic tracking of string length for general regions. Currently this is still only used for modeling strlen().
llvm-svn: 111081
2010-08-14 21:02:52 +00:00
Jordy Rose a797475712 Add a test for alloca region extents.
llvm-svn: 111079
2010-08-14 20:46:10 +00:00
Tom Care f8a9863df9 Improved IdempotentOperationChecker false positives and false negatives.
- Unfinished analysis may still report valid warnings if the path was completely analyzed
- New 'CanVary' heuristic to recursively determine if a subexpression has a varying element
- Updated test cases, including one known bug
- Exposed GRCoreEngine through GRExprEngine

llvm-svn: 110970
2010-08-12 22:45:47 +00:00
Jordy Rose c6c0fc9164 Allow EvalBinOpNN to handle expressions of the form $a+$b if $b can be reduced to a constant.
llvm-svn: 110592
2010-08-09 20:31:57 +00:00
Tom Care 925501c548 Removed IdempotentOperationChecker from default analysis and returned back to a flag (-analyzer-check-idempotent-operations)
- Added IdempotentOperationChecker to experimental analyses for testing purposes
- Updated test cases to explictly call the checker

llvm-svn: 110482
2010-08-06 22:23:07 +00:00
Zhongxing Xu 396e041f5e add test case.
llvm-svn: 110408
2010-08-06 00:04:40 +00:00
Jordy Rose afdb053618 When checking if a buffer access is valid, first make sure the buffer has a valid Loc. Fixes PR7830.
llvm-svn: 110390
2010-08-05 23:11:30 +00:00
Tom Care 16ba7c652e Fixed logic error in UnreachableCodeChecker's marking algorithm that would sometimes allow for multiple sequential statements to be flagged.
llvm-svn: 110353
2010-08-05 17:53:44 +00:00
Ted Kremenek 1d08fd9b79 Correctly handle 'Class<...>' when examining Cocoa conventions in the static analyzer. Fixes a crash reported in <rdar://problem/8272168>. Patch by Henry Mason!
llvm-svn: 110289
2010-08-05 00:19:24 +00:00
Ted Kremenek b786156b01 Teach SemaChecking::CheckReturnStackAddr about ImplicitCastExprs that convert values to an lvalue. This allows us to warn (again) about returning references to stack variables. (fixes PR 7812).
llvm-svn: 110242
2010-08-04 20:01:07 +00:00
Ted Kremenek 297e2e5bf6 Fix idempotent operations false positive caused by ivars not being invalidated in function
calls when the enclosing object had retain/release state.  Fixes <rdar://problem/8261992>.

llvm-svn: 110068
2010-08-02 21:59:12 +00:00
Ted Kremenek 4b83f753a1 Add test case for <rdar://problem/8258814>.
llvm-svn: 110058
2010-08-02 20:33:00 +00:00
Zhongxing Xu fd91d27630 Improve flat store: MemRegion::getAsOffset() computes a region's offset within
the top-level object. FlatStore now can bind and retrieve element and field
regions.
PR7297 is fixed by flat store.

llvm-svn: 110020
2010-08-02 04:56:14 +00:00
John McCall a95172baa0 Only run the jump-checker if there's a branch-protected scope *and* there's
a switch or goto somewhere in the function.  Indirect gotos trigger the
jump-checker regardless, because the conditions there are slightly more
elaborate and it's too marginal a case to be worth optimizing.

Turns off the jump-checker in a lot of cases in C++.  rdar://problem/7702918

llvm-svn: 109962
2010-08-01 00:26:45 +00:00
Ted Kremenek d21139a34f After a lengthy design discussion, add support for "ownership attributes" for malloc/free checking. Patch by Andrew McGregor!
llvm-svn: 109939
2010-07-31 01:52:11 +00:00
Tom Care fe1a4944b1 Test case for PR7763.
llvm-svn: 109895
2010-07-30 21:42:31 +00:00
Jordy Rose 23f0f4b7ae Move new test (that requires RegionStore) into its own file.
llvm-svn: 109736
2010-07-29 07:11:59 +00:00
Jordy Rose daa1c83413 Use a LazyCompoundVal to handle initialization with a string literal, rather than copying each character.
llvm-svn: 109734
2010-07-29 06:40:33 +00:00
Ted Kremenek 8bedb7dd3f Teach GRExprEngine::VisitLValue() about FloatingLiteral, ImaginaryLiteral, and CharacterLiteral. Fixes an assertion failure reported in PR 7675.
llvm-svn: 109719
2010-07-29 01:31:59 +00:00
Ted Kremenek 385f71b1f4 Augment RegionStore::BindStruct() to bind symbolicated struct values. This fixes a false path issue reported in <rdar://problem/8243408> and also spurs another cause where the idempotent operations checker fires.
llvm-svn: 109710
2010-07-29 00:28:47 +00:00
Tom Care 29a6250bf0 Added some false positive checking to UnreachableCodeChecker
- Allowed reporting of dead macros
- Added path walking function to search for false positives in conditional statements
- Updated some affected tests
- Added some false positive test cases

llvm-svn: 109561
2010-07-27 23:30:21 +00:00
Ted Kremenek 83b598c14f Finesse 'idempotent operations' analyzer issues to include the opcode of the binary operator for clearer error reporting. Also remove the 'Idempotent operation' prefix in messages; it's redundant since the bug type is the same.
llvm-svn: 109527
2010-07-27 18:49:08 +00:00
Jordy Rose 55442abee6 Don't warn about unreachable code if the block starts with __builtin_unreachable().
The next step is to warn if a block labeled unreachable is, in fact, reachable. Somewhat related to PR810.

llvm-svn: 109487
2010-07-27 03:39:53 +00:00
Jordy Rose b052e8f436 Groundwork for C string length tracking. Currently only handles the length of constant string literals, which is not too helpful, and only calls to strlen() are checked.
llvm-svn: 109480
2010-07-27 01:37:31 +00:00
Tom Care cba9f517ac Added an path-sensitive unreachable code checker to the experimental analyzer checks.
- Created a new class to do post-analysis
- Updated several test cases with unreachable code to expect a warning
- Added some general tests

llvm-svn: 109286
2010-07-23 23:04:53 +00:00
Zhongxing Xu 5e6ef6d957 Add FILE* leak check to StreamChecker. Patch by Lei Zhang.
llvm-svn: 109225
2010-07-23 14:14:59 +00:00
Zhongxing Xu f0c133fe88 This patch adds support for tmpfile in StreamChecker. Patch by Lei Zhang.
llvm-svn: 109106
2010-07-22 14:01:01 +00:00
Zhongxing Xu cf144c6322 fix test case.
llvm-svn: 108671
2010-07-19 02:06:14 +00:00
Zhongxing Xu ec5623570e Add double close check to StreamChecker. Patch by Lei Zhang.
llvm-svn: 108669
2010-07-19 01:52:29 +00:00
Ted Kremenek b32964d02d Fix '<rdar://problem/8202272> __imag passed non-complex should not crash' by removing a bogus assertion.
llvm-svn: 108602
2010-07-17 01:28:55 +00:00
Ted Kremenek 8b9fd890e3 Fix APFloat assertion failure in IdempotentOperationChecker resulting in having
an APFloat with different "float semantics" than the compared float literal.

llvm-svn: 108590
2010-07-17 00:40:32 +00:00
Tom Care 826e6b4023 Improved false positive rate for the idempotent operations checker and moved it into the default path-sensitive analysis options.
- Added checks for static local variables, self assigned parameters, and truncating/extending self assignments
- Removed command line option (now default with --analyze)
- Updated test cases to pass with idempotent operation warnings

llvm-svn: 108550
2010-07-16 20:41:41 +00:00
Chris Lattner 33919e7450 fix PR7280 by making the warning on code like this:
int test1() {
  return;
}

default to an error.

llvm-svn: 108108
2010-07-11 23:34:02 +00:00
Jordy Rose d5d2e50f3e Cleanup in CStringChecker. Now properly bifurcates the state for zero/nonzero sizes.
llvm-svn: 107935
2010-07-08 23:57:29 +00:00
Jordy Rose 65136fb669 Add memcmp() and bcmp() to CStringChecker. These check for valid access to the buffer arguments and have a special-case for when the buffer arguments are known to be the same address, or when the size is zero.
llvm-svn: 107761
2010-07-07 08:15:01 +00:00
Jordy Rose 33c829a6fd Cleanup on CStringChecker and its associated tests. Also check for null arguments...which are allowed if the access length is 0!
llvm-svn: 107759
2010-07-07 07:48:06 +00:00
Chris Lattner 3956106543 implement PR7569, warning about assignment to null, which
people seem to write when they want a deterministic trap.
Suggest instead that they use a volatile pointer or 
__builtin_trap.

llvm-svn: 107756
2010-07-07 06:14:23 +00:00
Tom Care 49f1e908b2 Fix idempotent operations test command line arguments.
llvm-svn: 107735
2010-07-06 23:47:26 +00:00
Jordy Rose 134a236a14 Add a new path-sensitive checker for functions in <string.h>, for both null-terminated strings and memory blocks. Currently only checks memcpy(), memmove(), and bcopy(), but this is intended to be expanded soon.
llvm-svn: 107722
2010-07-06 23:11:01 +00:00
Tom Care 3ff08a8e76 Added a path-sensitive idempotent operation checker (-analyzer-idempotent-operation). Finds idempotent and/or tautological operations in a path sensitive context, flagging operations that have no effect or a predictable effect.
Example:
{
int a = 1;
int b = 5;
int c = b / a; // a is 1 on all paths
}

- New IdempotentOperationChecker class
- Moved recursive Stmt functions in r107675 to IdempotentOperationChecker
- Minor refactoring of SVal to allow checking for any integer
- Added command line option for check
- Added basic test cases

llvm-svn: 107706
2010-07-06 21:43:29 +00:00
Jordy Rose 4c0a919732 Oops, tabs --> spaces in test.
llvm-svn: 107634
2010-07-06 02:42:09 +00:00
Jordy Rose 40c5c24c06 Improve NULL-checking for CFRetain/CFRelease. We now remember that the argument was non-NULL, and we report where the null assumption came from (like AttrNonNullChecker already did).
llvm-svn: 107633
2010-07-06 02:34:42 +00:00
Jordy Rose 0704a7fe43 Support sizeof for VLA expressions (sizeof(someVLA)). sizeof(int[n]) still unimplemented. A VLA region's sizeof value matches its extent.
llvm-svn: 107611
2010-07-05 04:42:43 +00:00
Jordy Rose e6b999bf9a Track extents for VLAs.
llvm-svn: 107603
2010-07-05 00:50:15 +00:00
Jordy Rose 674bd55f02 Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.
Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577
2010-07-04 00:00:41 +00:00