Commit Graph

83 Commits

Author SHA1 Message Date
Eugene Zelenko 0a4f3f4373 Fix some Clang-tidy readability-redundant-control-flow warnings; other minor fixes.
Differential revision: http://reviews.llvm.org/D17060

llvm-svn: 260414
2016-02-10 19:11:58 +00:00
Aaron Ballman a88b93ed62 Minor cleanup to remove casts and improve some const correctness. NFC.
Patch by Alexander Riccio.

llvm-svn: 259652
2016-02-03 15:20:51 +00:00
Yaron Keren cdae941e03 Annotate dump() methods with LLVM_DUMP_METHOD, addressing Richard Smith r259192 post commit comment.
llvm-svn: 259232
2016-01-29 19:38:18 +00:00
Aaron Ballman 865a7d8aab Removing unnecessary casts; NFC.
llvm-svn: 259194
2016-01-29 13:53:26 +00:00
Artem Dergachev 73f018e381 [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.
The purpose of these changes is to simplify introduction of definition files
for the three hierarchies.

1. For every sub-class C of these classes, its kind in the relevant enumeration
is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg:

  MemRegionKind   -> MemRegionValKind
  RegionValueKind -> SymbolRegionValueKind
  CastSymbolKind  -> SymbolCastKind
  SymIntKind      -> SymIntExprKind

2. MemSpaceRegion used to be inconsistently used as both an abstract base and
a particular region. This region class is now an abstract base and no longer
occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion,
is introduced for handling the unique use case for MemSpaceRegion as
"the generic memory space" (when it represents a memory space that holds all
executable code).

3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for
consisitency with symbol kind ranges.

4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and
BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and
we already refer to BlockTextRegion as a 'code region' in BlockDataRegion.

Differential Revision: http://reviews.llvm.org/D16062

llvm-svn: 257598
2016-01-13 13:49:29 +00:00
Devin Coughlin 46089867de [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).
This commit prevents MemRegion::getAsOffset() from crashing when the analyzed
program casts a symbolic region of a non-record type to some derived type and
then attempts to access a field of the base type.

rdar://problem/23458069

llvm-svn: 254806
2015-12-05 00:22:36 +00:00
Gabor Horvath 244d27149a [analyzer] Fix another crash when analyzing lambda functions.
llvm-svn: 251404
2015-10-27 12:36:26 +00:00
Gabor Horvath 7910b3358b [analyzer] Fixed a rare crash when analyzing lambda functions.
llvm-svn: 251289
2015-10-26 13:32:26 +00:00
Angel Garcia Gomez 637d1e6694 Roll-back r250822.
Summary: It breaks the build for the ASTMatchers

Subscribers: klimek, cfe-commits

Differential Revision: http://reviews.llvm.org/D13893

llvm-svn: 250827
2015-10-20 13:23:58 +00:00
Angel Garcia Gomez b5250d3448 Apply modernize-use-default to clang.
Summary: Replace empty bodies of default constructors and destructors with '= default'.

Reviewers: bkramer, klimek

Subscribers: klimek, alexfh, cfe-commits

Differential Revision: http://reviews.llvm.org/D13890

llvm-svn: 250822
2015-10-20 12:52:55 +00:00
Gabor Horvath 15843343b6 [Static Analyzer] Lambda support.
Differential Revision: http://reviews.llvm.org/D12652

llvm-svn: 247426
2015-09-11 16:55:01 +00:00
Ted Kremenek 3a0678e33c [analyzer] Apply whitespace cleanups by Honggyu Kim.
llvm-svn: 246978
2015-09-08 03:50:52 +00:00
Jordan Rose 9503501dae [analyzer] When forced to fake a block type, do it correctly.
BlockDecl has a poor AST representation because it doesn't carry its type
with it. Instead, the containing BlockExpr has the full type. This almost
never matters for the analyzer, but if the block decl contains static
local variables we need to synthesize a region to put them in, and this
region will necessarily not have the right type.

Even /that/ doesn't matter, unless

(1) the block calls the function or method containing the block, and
(2) the value of the block expr is used in some interesting way.

In this case, we actually end up needing the type of the block region,
and it will be set to our synthesized type. It turns out we've been doing
a terrible job faking that type -- it wasn't a block pointer type at all.
This commit fixes that to at least guarantee a block pointer type, using
the signature written by the user if there is one.

This is not really a correct answer because the block region's type will
/still/ be wrong, but further efforts to make this right in the analyzer
would probably be silly. We should just change the AST.

rdar://problem/21698099

llvm-svn: 241944
2015-07-10 21:41:59 +00:00
Benjamin Kramer b4ef66832d Update APIs that return a pair of iterators to return an iterator_range instead.
Convert uses of those APIs into ranged for loops. NFC.

llvm-svn: 228404
2015-02-06 17:25:10 +00:00
Anna Zaks 0820e13e2a [analyzer] Refactor and cleanup IsCompleteType
There are three copies of IsCompleteType(...) functions in CSA and all
of them are incomplete (I experienced  crashes in some CSA's test cases).
I have replaced these function calls with Type::isIncompleteType() calls.

A patch by Aleksei Sidorin!

llvm-svn: 219026
2014-10-03 21:49:03 +00:00
Richard Trieu ddd01cec0e Removing an "if (this == nullptr)" check from two print methods. The condition
will never be true in a well-defined context.  The checking for null pointers
has been moved into the caller logic so it does not rely on undefined behavior.

llvm-svn: 210498
2014-06-09 22:53:25 +00:00
Craig Topper 0dbb783c7b [C++11] Use 'nullptr'. StaticAnalyzer edition.
llvm-svn: 209642
2014-05-27 02:45:47 +00:00
Aaron Ballman 574705ed7f [C++11] Replacing CXXRecordDecl iterators bases_begin() and bases_end() with iterator_range bases(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203803
2014-03-13 15:41:46 +00:00
Benjamin Kramer 867ea1d426 [C++11] Replace llvm::tie with std::tie.
llvm-svn: 202639
2014-03-02 13:01:17 +00:00
Aaron Ballman 9ead1243a5 Replacing calls to getAttr with calls to hasAttr for clarity. No functional change intended -- this only replaces Boolean uses of getAttr.
llvm-svn: 197648
2013-12-19 02:39:40 +00:00
Anna Zaks d2a807d831 [analyzer] Fix an infinite recursion in region invalidation by adding block count to the BlockDataRegion.
llvm-svn: 195174
2013-11-20 00:11:42 +00:00
Anton Yartsev 424ad95fa7 [analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future.
With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters.

This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker.

llvm-svn: 191342
2013-09-24 23:47:29 +00:00
Aaron Ballman a5e9c5b865 Using the function pointer instead of the function type; this allows us to re-enable a warning in MSVC by default.
llvm-svn: 187292
2013-07-27 03:34:50 +00:00
Pavel Labath cf878bbe65 [analyzer] Fix FP warnings when binding a temporary to a local static variable
Summary:
When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

llvm-svn: 187196
2013-07-26 11:50:42 +00:00
Jordan Rose 1bd1927a14 [analyzer] Accept references to variables declared "extern void" (C only).
In C, 'void' is treated like any other incomplete type, and though it is
never completed, you can cast the address of a void-typed variable to do
something useful. (In C++ it's illegal to declare a variable with void type.)

Previously we asserted on this code; now we just treat it like any other
incomplete type.

And speaking of incomplete types, we don't know their extent. Actually
check that in TypedValueRegion::getExtent, though that's not being used
by any checkers that are on by default.

llvm-svn: 182880
2013-05-29 20:50:34 +00:00
Jordan Rose 1bfe9c787f [analyzer] Don't crash if a block doesn't have a type signature.
Currently, blocks instantiated in templates lose their "signature as
written"; it's not clear if this is intentional. Change the analyzer's
use of BlockDecl::getSignatureAsWritten to check whether or not the
signature is actually there.

<rdar://problem/13954714>

llvm-svn: 182497
2013-05-22 18:09:44 +00:00
Anna Zaks 6c0c47ede5 [analyzer] Ensure BugReporterTracking works on regions with pointer arithmetic
Introduce a new helper function, which computes the first symbolic region in
the base region chain. The corresponding symbol has been used for assuming that
a pointer is null. Now, it will also be used for checking if it is null.

This ensures that we are tracking a null pointer correctly in the BugReporter.

llvm-svn: 179916
2013-04-20 01:15:42 +00:00
Anna Zaks 390fb10a9b [analyzer] Flip printPretty and printPrettyAsExpr as per suggestion from Jordan (r179572)
llvm-svn: 179915
2013-04-20 01:15:36 +00:00
Anna Zaks 7460deb15d [analyzer] Add pretty printing to CXXBaseObjectRegion.
llvm-svn: 179573
2013-04-15 22:38:04 +00:00
Anna Zaks e2e8ea62df [analyzer] Address code review for r179395
Mostly refactoring + handle the nested fields by printing the innermost field only.

llvm-svn: 179572
2013-04-15 22:37:59 +00:00
Anna Zaks 6cea7d9e5e [analyzer]Print field region even when the base region is not printable
llvm-svn: 179395
2013-04-12 18:40:21 +00:00
Jordan Rose e185d73101 [analyzer] Special-case bitfields when finding sub-region bindings.
Previously we were assuming that we'd never ask for the sub-region bindings
of a bitfield, since a bitfield cannot have subregions. However,
unification of code paths has made that assumption invalid. While we could
take advantage of this by just checking for the single possible binding,
it's probably better to do the right thing, so that if/when we someday
support unions we'll do the right thing there, too.

This fixes a handful of false positives in analyzing LLVM.

<rdar://problem/13325522>

llvm-svn: 176388
2013-03-01 23:03:17 +00:00
Jordan Rose f9e9a9f41b [analyzer] Base regions may be invalid when layered on symbolic regions.
While RegionStore checks to make sure casts on TypedValueRegions are valid,
it does not do the same for SymbolicRegions, which do not have perfect type
info anyway. Additionally, MemRegion::getAsOffset does not take a
ProgramState, so it can't use dynamic type info to determine a better type
for the regions. (This could also be dangerous if the type of a super-region
changes!)

Account for this by checking that a base object region is valid on top of a
symbolic region, and falling back to "symbolic offset" mode if not.

Fixes PR15345.

llvm-svn: 176034
2013-02-25 18:36:15 +00:00
Ted Kremenek 9625048278 [analyzer] tracking stores/constraints now works for ObjC ivars or struct fields.
This required more changes than I originally expected:

- ObjCIvarRegion implements "canPrintPretty" et al
- DereferenceChecker indicates the null pointer source is an ivar
- bugreporter::trackNullOrUndefValue() uses an alternate algorithm
  to compute the location region to track by scouring the ExplodedGraph.
  This allows us to get the actual MemRegion for variables, ivars,
  fields, etc.  We only hand construct a VarRegion for C++ references.
- ExplodedGraph no longer drops nodes for expressions that are marked
  'lvalue'.  This is to facilitate the logic in the previous bullet.
  This may lead to a slight increase in size in the ExplodedGraph,
  which I have not measured, but it is likely not to be a big deal.

I have validated each of the changed plist output.

Fixes <rdar://problem/12114812>

llvm-svn: 175988
2013-02-24 07:21:01 +00:00
Jordan Rose 893d73b7e9 [analyzer] Don't canonicalize the RecordDecl used in CXXBaseObjectRegion.
This Decl shouldn't be the canonical Decl; it should be the Decl used by
the CXXBaseSpecifier in the subclass. Unfortunately, that means continuing
to throw getCanonicalDecl() on all comparisons.

This fixes MemRegion::getAsOffset's use of ASTRecordLayout when redeclarations
are involved.

llvm-svn: 175913
2013-02-22 19:33:13 +00:00
NAKAMURA Takumi a7a7e15d0d StaticAnalyzer/Core: Suppress warnings. [-Wunused-variable, -Wunused-function]
llvm-svn: 175721
2013-02-21 04:40:10 +00:00
NAKAMURA Takumi d4a50704b3 Whitespace.
llvm-svn: 175720
2013-02-21 04:40:04 +00:00
Jordan Rose 599f85ab85 [analyzer] Record whether a base object region represents a virtual base.
This allows MemRegion and MemRegionManager to avoid asking over and over
again whether an class is a virtual base or a non-virtual base.

Minor optimization/cleanup; no functionality change.

llvm-svn: 175716
2013-02-21 03:12:32 +00:00
David Blaikie 05785d1622 Include llvm::Optional in clang/Basic/LLVM.h
Post-commit CR feedback from Jordan Rose regarding r175594.

llvm-svn: 175679
2013-02-20 22:23:23 +00:00
David Blaikie 2fdacbc5b0 Replace SVal llvm::cast support to be well-defined.
See r175462 for another example/more details.

llvm-svn: 175594
2013-02-20 05:52:05 +00:00
Jordan Rose e3fd708f9c [analyzer] Refactor RegionStore's sub-region bindings traversal.
This is going to be used in the next commit.
While I'm here, tighten up assumptions about symbolic offset
BindingKeys, and make offset calculation explicitly handle all
MemRegion kinds.

No functionality change.

llvm-svn: 175228
2013-02-15 00:32:03 +00:00
Ted Kremenek 8ae67871b4 Change subexpressions to be visited in the CFG from left-to-right.
This is a more natural order of evaluation, and it is very important
for visualization in the static analyzer.  Within Xcode, the arrows
will not jump from right to left, which looks very visually jarring.
It also provides a more natural location for dataflow-based diagnostics.

Along the way, we found a case in the analyzer diagnostics where we
needed to indicate that a variable was "captured" by a block.

-fsyntax-only timings on sqlite3.c show no visible performance change,
although this is just one test case.

Fixes <rdar://problem/13016513>

llvm-svn: 174447
2013-02-05 22:00:19 +00:00
Ted Kremenek ff989016c1 Pull logic to map from VarDecl* to captured region using a helper function. WIP.
llvm-svn: 169479
2012-12-06 07:17:13 +00:00
Chandler Carruth 3a02247dc9 Sort all of Clang's files under 'lib', and fix up the broken headers
uncovered.

This required manually correcting all of the incorrect main-module
headers I could find, and running the new llvm/utils/sort_includes.py
script over the files.

I also manually added quite a few missing headers that were uncovered by
shuffling the order or moving headers up to be main-module-headers.

llvm-svn: 169237
2012-12-04 09:13:33 +00:00
Benjamin Kramer ea70eb30a0 Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't pull in all the generated Attr code.
Required to pull some functions out of line, but this shouldn't have a perf impact.
No functionality change.

llvm-svn: 169092
2012-12-01 15:09:41 +00:00
Anna Zaks e3beeaa5e7 [analyzer] Fix a crash reported in PR 14400.
The AllocaRegion did not have the superRegion (based on LocationContext)
as part of it's hash. As a consequence, the AllocaRegions from
different frames were uniqued to be the same region.

llvm-svn: 168599
2012-11-26 19:11:46 +00:00
Jordan Rose e15fb77df8 Reapply "[analyzer] Treat fields of unions as having symbolic offsets."
This time, actually uncomment the code that's supposed to fix the problem.

This reverts r165671 / 8ceb837585ed973dc36fba8dfc57ef60fc8f2735.

llvm-svn: 165676
2012-10-10 23:23:21 +00:00
Eric Christopher a529f8c9c2 Temporarily Revert "[analyzer] Treat fields of unions as having symbolic offsets."
Author: Jordan Rose <jordan_rose@apple.com>
Date:   Wed Oct 10 21:31:21 2012 +0000

    [analyzer] Treat fields of unions as having symbolic offsets.

    This allows only one field to be active at a time in RegionStore.
    This isn't quite the correct behavior for unions, but it at least
    would handle the case of "value goes in, value comes out" from the
    same field.

    RegionStore currently has a number of places where any access to a union
    results in UnknownVal being returned. However, it is clearly missing
    some cases, or the original issue wouldn't have occurred. It is probably
    now safe to remove those changes, but that's a potentially destabilizing
    change that should wait for more thorough testing.

    Fixes PR14054.

    git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165660 91177308-0d34-0410-b5e6-96231b3b80d8

This reverts commit cf9030e480f77ab349672f00ad302e216c26c92c.

llvm-svn: 165671
2012-10-10 22:49:05 +00:00
Jordan Rose fb29410c85 [analyzer] Treat fields of unions as having symbolic offsets.
This allows only one field to be active at a time in RegionStore.
This isn't quite the correct behavior for unions, but it at least
would handle the case of "value goes in, value comes out" from the
same field.

RegionStore currently has a number of places where any access to a union
results in UnknownVal being returned. However, it is clearly missing
some cases, or the original issue wouldn't have occurred. It is probably
now safe to remove those changes, but that's a potentially destabilizing
change that should wait for more thorough testing.

Fixes PR14054.

llvm-svn: 165660
2012-10-10 21:31:21 +00:00
Ted Kremenek a808e165b2 Remove unnecessary ASTContext& parameter from SymExpr::getType().
llvm-svn: 164661
2012-09-26 06:00:14 +00:00