Commit Graph

3782 Commits

Author SHA1 Message Date
Denys Petrov 01f9388d95 [analyzer] Handle `\l` symbol in string literals in exploded-graph-rewriter
Summary:
Handle `\l` separately because a string literal can be in code like "string\\literal" with the `\l` inside. Also on Windows macros __FILE__ produces specific delimiters `\` and a directory or file may starts with the letter `l`.

Fix:
Use regex for replacing all `\l` (like `,\l`, `}\l`, `[\l`) except `\\l`, because a literal as a rule contains multiple `\` before `\l`.

Differential Revision: https://reviews.llvm.org/D82092
2020-06-22 13:44:27 +03:00
Balázs Kéri e935a540ea [Analyzer][StreamChecker] Add note tags for file opening.
Summary:
Bug reports of resource leak are now improved.
If there are multiple resource leak paths for the same stream,
only one wil be reported.

Reviewers: Szelethus, xazax.hun, baloghadamsoftware, NoQ

Reviewed By: Szelethus, NoQ

Subscribers: NoQ, rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D81407
2020-06-22 11:15:35 +02:00
Kirstóf Umann 1614e35408 [analyzer][MallocChecker] PR46253: Correctly recognize standard realloc
https://bugs.llvm.org/show_bug.cgi?id=46253

This is an obvious hack because realloc isn't any more affected than other
functions modeled by MallocChecker (or any user of CallDescription really),
but the nice solution will take some time to implement.

Differential Revision: https://reviews.llvm.org/D81745
2020-06-16 17:50:06 +02:00
Valeriy Savchenko 14b947f306 [analyzer] Fix StdLibraryFunctionsChecker crash on macOS
Summary:
EOF macro token coming from a PCH file on macOS while marked as literal,
doesn't contain any literal data.  This causes crash on every project
using PCHs.

This commit doesn't resolve the problem with PCH (maybe it was
designed like this for a purpose) or with `tryExpandAsInteger`, but
rather simply shoots off a crash itself.

Differential Revision: https://reviews.llvm.org/D81916
2020-06-16 16:10:07 +03:00
Jan Korous a93ff1826b [Analyzer][NFC] Remove prefix from WebKitNoUncountedMemberChecker name 2020-06-15 14:13:56 -07:00
Jan Korous a7eb3692e7 [Analyzer][WebKit] UncountedCallArgsChecker
Differential Revision: https://reviews.llvm.org/D77179
2020-06-15 13:53:36 -07:00
Denys Petrov e1741e34e0 [analyzer] Reasoning about comparison expressions in RangeConstraintManager
Summary:

Implemented RangeConstraintManager::getRangeForComparisonSymbol which handles comparison operators.
RangeConstraintManager::getRangeForComparisonSymbol cares about the sanity of comparison expressions sequences helps reasonably to branch an exploded graph.
It can significantly reduce the graph and speed up the analysis. For more details, please, see the differential revision.

This fixes https://bugs.llvm.org/show_bug.cgi?id=13426

Differential Revision: https://reviews.llvm.org/D78933
2020-06-15 18:35:15 +03:00
Balázs Kéri efa8b6e884 [Analyzer][StreamChecker] Add check for pointer escape.
Summary:
After an escaped FILE* stream handle it is not possible to make
reliable checks on it because any function call can have effect
on it.

Reviewers: Szelethus, baloghadamsoftware, martong, NoQ

Reviewed By: NoQ

Subscribers: NoQ, rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D80699
2020-06-15 15:43:23 +02:00
Kirstóf Umann e22f1c02a2 [analyzer] Introduce weak dependencies to express *preferred* checker callback evaluation order
Checker dependencies were added D54438 to solve a bug where the checker names
were incorrectly registered, for example, InnerPointerChecker would incorrectly
emit diagnostics under the name MallocChecker, or vice versa [1]. Since the
system over the course of about a year matured, our expectations of what a role
of a dependency and a dependent checker should be crystallized a bit more --
D77474 and its summary, as well as a variety of patches in the stack
demonstrates how we try to keep dependencies to play a purely modeling role. In
fact, D78126 outright forbids diagnostics under a dependency checkers name.

These dependencies ensured the registration order and enabling only when all
dependencies are satisfied. This was a very "strong" contract however, that
doesn't fit the dependency added in D79420. As its summary suggests, this
relation is directly in between diagnostics, not modeling -- we'd prefer a more
specific warning over a general one.

To support this, I added a new dependency kind, weak dependencies. These are not
as strict of a contract, they only express a preference in registration order.
If a weak dependency isn't satisfied, the checker may still be enabled, but if
it is, checker registration, and transitively, checker callback evaluation order
is ensured.

If you are not familiar with the TableGen changes, a rather short description
can be found in the summary of D75360. A lengthier one is in D58065.

[1] https://www.youtube.com/watch?v=eqKeqHRAhQM

Differential Revision: https://reviews.llvm.org/D80905
2020-06-12 14:08:38 +02:00
Endre Fülöp 5cc18516c4 [analyzer] On-demand parsing capability for CTU
Summary:
Introduce on-demand parsing of needed ASTs during CTU analysis.
The index-file format is extended, and analyzer-option CTUInvocationList
is added to specify the exact invocations needed to parse the needed
source-files.

Reviewers: martong, balazske, Szelethus, xazax.hun, whisperity

Reviewed By: martong, xazax.hun

Subscribers: gribozavr2, thakis, ASDenysPetrov, ormris, mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, steakhal, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75665
2020-06-11 10:56:59 +02:00
Endre Fülöp 435b458ad0 Revert "[analyzer] On-demand parsing capability for CTU"
This reverts commit 97e07d0c35.
Reason: OSX broke for a different reason, this really only seem to work
on linux and very generic windows builds
2020-06-10 17:55:37 +02:00
Endre Fülöp 97e07d0c35 [analyzer] On-demand parsing capability for CTU
Summary:
Introduce on-demand parsing of needed ASTs during CTU analysis.
The index-file format is extended, and analyzer-option CTUInvocationList
is added to specify the exact invocations needed to parse the needed
source-files.

Reviewers: martong, balazske, Szelethus, xazax.hun, whisperity

Reviewed By: martong, xazax.hun

Subscribers: gribozavr2, thakis, ASDenysPetrov, ormris, mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, steakhal, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75665
2020-06-10 13:43:51 +02:00
Endre Fülöp c640779494 Revert "[analyzer] On-demand parsing capability for CTU"
This reverts commit 020815fafd.
Reason: PS4 buildbot broke
2020-06-10 10:30:10 +02:00
Endre Fülöp 020815fafd [analyzer] On-demand parsing capability for CTU
Summary:
Introduce on-demand parsing of needed ASTs during CTU analysis.
The index-file format is extended, and analyzer-option CTUInvocationList
is added to specify the exact invocations needed to parse the needed
source-files.

Reviewers: martong, balazske, Szelethus, xazax.hun, whisperity

Reviewed By: martong, xazax.hun

Subscribers: gribozavr2, thakis, ASDenysPetrov, ormris, mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, steakhal, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75665
2020-06-10 08:59:04 +02:00
Adam Balogh 5419a31215 [Analyzer] Allow creation of stack frame for functions without definition
Retrieving the parameter location of functions was disabled because it
may causes crashes due to the fact that functions may have multiple
declarations and without definition it is difficult to ensure that
always the same declration is used. Now parameters are stored in
`ParamRegions` which are independent of the declaration of the function,
therefore the same parameters always have the same regions,
independently of the function declaration used actually. This allows us
to remove the limitation described above.

Differential Revision: https://reviews.llvm.org/D80286
2020-06-09 12:08:57 +02:00
Adam Balogh 98db1f990f [Analyzer] [NFC] Parameter Regions
Currently, parameters of functions without their definition present cannot
be represented as regions because it would be difficult to ensure that the
same declaration is used in every case. To overcome this, we split
`VarRegion` to two subclasses: `NonParamVarRegion` and `ParamVarRegion`.
The latter does not store the `Decl` of the parameter variable. Instead it
stores the index of the parameter which enables retrieving the actual
`Decl` every time using the function declaration of the stack frame. To
achieve this we also removed storing of `Decl` from `DeclRegion` and made
`getDecl()` pure virtual. The individual `Decl`s are stored in the
appropriate subclasses, such as `FieldRegion`, `ObjCIvarRegion` and the
newly introduced `NonParamVarRegion`.

Differential Revision: https://reviews.llvm.org/D80522
2020-06-09 12:08:56 +02:00
Abbas Sabra 29353e69d2 [analyzer] LoopWidening: fix crash by avoiding aliased references invalidation
Summary: LoopWidening is invalidating references coming from type
aliases which lead to a crash.

Patch by Abbas Sabra!

Differential Revision: https://reviews.llvm.org/D80669
2020-06-09 12:55:54 +03:00
Vince Bridgers bd42582541 [analyzer] Ignore calculated indices of <= 0 in VLASizeChecker
Summary:
See https://bugs.llvm.org/show_bug.cgi?id=46128. The checker does not
yet comprehend constraints involving multiple symbols, so it's possible
to calculate a VLA size that's negative or 0. A LIT is added to catch
regressions, and this change simply bails if a VLA size of 0 or less is
calculated.

Reviewers: balazske, NoQ, martong, baloghadamsoftware, Szelethus, gamesh411

Reviewed By: balazske, NoQ, Szelethus

Subscribers: xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, ASDenysPetrov, cfe-commits, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D80903
2020-06-04 07:25:35 -05:00
Paul Pelzl 7113271528 [analyzer] ObjCAutoreleaseWriteChecker: Support explicit autoreleasepools.
The checker currently supports only a whitelist of block-enumeration
methods which are known to internally clear an autorelease pool.
Extend this checker to detect writes within the scope of explicit
@autoreleasepool statements.

rdar://25301111

Differential Revision: https://reviews.llvm.org/D81072
2020-06-03 19:06:04 +03:00
Paul Pelzl e94192198f [analyzer] Add support for ObjCIndirectCopyRestoreExpr.
Idiomatic objc using ARC will generate this expression regularly due to
NSError out-param passing.  Providing an implementation for this
expression allows the analyzer to explore many more codepaths in ARC
projects.

The current implementation is not perfect but the differences are hopefully
subtle enough to not cause much problems.

rdar://63918914

Differential Revision: https://reviews.llvm.org/D81071
2020-06-03 19:06:04 +03:00
Jan Korous d61ad66050 [Analyzer][WebKit] Check record definition is available in NoUncountedMembers checker
isRefCountable asserts that the record passed as an argument has a definition available.

Fixes: https://bugs.llvm.org/show_bug.cgi?id=46142

Differential Revision: https://reviews.llvm.org/D81017
2020-06-02 13:10:36 -07:00
Kirstóf Umann 6bedfaf520 [analyzer][MallocChecker] Fix the incorrect retrieval of the from argument in realloc()
In the added testfile, the from argument was recognized as
&Element{SymRegion{reg_$0<long * global_a>},-1 S64b,long}
instead of
reg_$0<long * global_a>.
2020-06-01 22:38:29 +02:00
Gabor Marton 634258b806 [analyzer] StdLibraryFunctionsChecker: Add support to lookup types
Summary:
In this patch I am trying to get rid of the `Irrelevant` types from the
signatures of the functions from the standard C library. For that I've
introduced `lookupType()` to be able to lookup arbitrary types in the global
scope. This makes it possible to define the signatures precisely.

Note 1) `fread`'s signature is now fixed to have the proper `FILE *restrict`
type when C99 is the language.
Note 2) There are still existing `Irrelevant` types, but they are all from
POSIX. I am planning to address those together with the missing POSIX functions
(in D79433).

Reviewers: xazax.hun, NoQ, Szelethus, balazske

Subscribers: whisperity, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, Charusso, steakhal, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D80016
2020-05-29 17:42:05 +02:00
Gabor Marton 41928c97b6 [analyzer] ApiModeling: Add buffer size arg constraint with multiplier involved
Summary:
Further develop the buffer size argumentum constraint so it can handle sizes
that we can get by multiplying two variables.

Reviewers: Szelethus, NoQ, steakhal

Subscribers: whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, Charusso, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77148
2020-05-29 16:24:26 +02:00
Gabor Marton bd03ef19be [analyzer] ApiModeling: Add buffer size arg constraint
Summary:
Introducing a new argument constraint to confine buffer sizes. It is typical in
C APIs that a parameter represents a buffer and another param holds the size of
the buffer (or the size of the data we want to handle from the buffer).

Reviewers: NoQ, Szelethus, Charusso, steakhal

Subscribers: whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77066
2020-05-29 16:13:57 +02:00
Valeriy Savchenko 73c120a989 [analyzer] Introduce reasoning about symbolic remainder operator
Summary:
New logic tries to narrow possible result values of the remainder operation
based on its operands and their ranges.  It also tries to be conservative
with negative operands because according to the standard the sign of
the result is implementation-defined.

rdar://problem/44978988

Differential Revision: https://reviews.llvm.org/D80117
2020-05-28 18:56:38 +03:00
Valeriy Savchenko 2a09daff0f [analyzer] Generalize bitwise AND rules for ranges
Summary:
Previously the current solver started reasoning about bitwise AND
expressions only when one of the operands is a constant.  However,
very similar logic could be applied to ranges.  This commit addresses
this shortcoming.  Additionally, it refines how we deal with negative
operands.

rdar://problem/54359410

Differential Revision: https://reviews.llvm.org/D79434
2020-05-28 18:55:49 +03:00
Valeriy Savchenko 47c4b8bd68 [analyzer] Generalize bitwise OR rules for ranges
Summary:
Previously the current solver started reasoning about bitwise OR
expressions only when one of the operands is a constant.  However,
very similar logic could be applied to ranges.  This commit addresses
this shortcoming.  Additionally, it refines how we deal with negative
operands.

Differential Revision: https://reviews.llvm.org/D79336
2020-05-28 18:55:22 +03:00
Valeriy Savchenko 1f57d76a8d [analyzer] Refactor range inference for symbolic expressions
Summary:
This change introduces a new component to unite all of the reasoning
we have about operations on ranges in the analyzer's solver.
In many cases, we might conclude that the range for a symbolic operation
is much more narrow than the type implies.  While reasoning about
runtime conditions (especially in loops), we need to support more and
more of those little pieces of logic.  The new component mostly plays
a role of an organizer for those, and allows us to focus on the actual
reasoning about ranges and not dispatching manually on the types of the
nested symbolic expressions.

Differential Revision: https://reviews.llvm.org/D79232
2020-05-28 18:54:52 +03:00
Valeriy Savchenko bd06c417e6 [analyzer] Allow bindings of the CompoundLiteralRegion
Summary:
CompoundLiteralRegions have been properly modeled before, but
'getBindingForElement` was not changed to accommodate this change
properly.

rdar://problem/46144644

Differential Revision: https://reviews.llvm.org/D78990
2020-05-28 14:11:57 +03:00
Balázs Kéri 9081fa2099 [Analyzer][StreamChecker] Added check for "indeterminate file position".
Summary:
According to the standard, after a `wread` or `fwrite` call the file position
becomes "indeterminate". It is assumable that a next read or write causes
undefined behavior, so a (fatal error) warning is added for this case.
The indeterminate position can be cleared by some operations, for example
`fseek` or `freopen`, not with `clearerr`.

Reviewers: Szelethus, baloghadamsoftware, martong, NoQ, xazax.hun, dcoughlin

Reviewed By: Szelethus

Subscribers: rnkovacs, NoQ, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D80018
2020-05-28 08:21:57 +02:00
Jan Korous 660cda572d [Analyzer][WebKit] NoUncountedMembersChecker
Differential Revision: https://reviews.llvm.org/D77178
2020-05-27 19:46:32 -07:00
Kristóf Umann efd1a8e66e [analyzer][MallocChecker] Make NewDeleteLeaks depend on DynamicMemoryModeling rather than NewDelete
If you remember the mail [1] I sent out about how I envision the future of the
already existing checkers to look dependencywise, one my main points was that no
checker that emits diagnostics should be a dependency. This is more problematic
for some checkers (ahem, RetainCount [2]) more than for others, like this one.

The MallocChecker family is a mostly big monolithic modeling class some small
reporting checkers that only come to action when we are constructing a warning
message, after the actual bug was detected. The implication of this is that
NewDeleteChecker doesn't really do anything to depend on, so this change was
relatively simple.

The only thing that complicates this change is that FreeMemAux (MallocCheckers
method that models general memory deallocation) returns after calling a bug
reporting method, regardless whether the report was ever emitted (which may not
always happen, for instance, if the checker responsible for the report isn't
enabled). This return unfortunately happens before cleaning up the maps in the
GDM keeping track of the state of symbols (whether they are released, whether
that release was successful, etc). What this means is that upon disabling some
checkers, we would never clean up the map and that could've lead to false
positives, e.g.:

error: 'warning' diagnostics seen but not expected:
  File clang/test/Analysis/NewDelete-intersections.mm Line 66: Potential leak of memory pointed to by 'p'
  File clang/test/Analysis/NewDelete-intersections.mm Line 73: Potential leak of memory pointed to by 'p'
  File clang/test/Analysis/NewDelete-intersections.mm Line 77: Potential leak of memory pointed to by 'p'

error: 'warning' diagnostics seen but not expected:
  File clang/test/Analysis/NewDelete-checker-test.cpp Line 111: Undefined or garbage value returned to caller
  File clang/test/Analysis/NewDelete-checker-test.cpp Line 200: Potential leak of memory pointed to by 'p'

error: 'warning' diagnostics seen but not expected:
  File clang/test/Analysis/new.cpp Line 137: Potential leak of memory pointed to by 'x'
There two possible approaches I had in mind:

Make bug reporting methods of MallocChecker returns whether they succeeded, and
proceed with the rest of FreeMemAux if not,
Halt execution with a sink node upon failure. I decided to go with this, as
described in the code.
As you can see from the removed/changed test files, before the big checker
dependency effort landed, there were tests to check for all the weird
configurations of enabled/disabled checkers and their messy interactions, I
largely repurposed these.

[1] http://lists.llvm.org/pipermail/cfe-dev/2019-August/063070.html
[2] http://lists.llvm.org/pipermail/cfe-dev/2019-August/063205.html

Differential Revision: https://reviews.llvm.org/D77474
2020-05-27 00:03:53 +02:00
Kirstóf Umann 5192783bb2 [analyzer][RetainCount] Tie diagnostics to osx.cocoa.RetainCount rather then RetainCountBase, for the most part
Similarly to other patches of mine, I'm trying to uniformize the checker
interface so that dependency checkers don't emit diagnostics. The checker that
made me most anxious so far was definitely RetainCount, because it is definitely
impacted by backward compatibility concerns, and implements a checker hierarchy
that is a lot different to other examples of similar size. Also, I don't have
authority, nor expertise regarding ObjC related code, so I welcome any
objection/discussion!

Differential Revision: https://reviews.llvm.org/D78099
2020-05-27 00:01:47 +02:00
Kirstóf Umann 6f5431846b [analyzer][RetainCount] Remove the CheckOSObject option
As per http://lists.llvm.org/pipermail/cfe-dev/2019-August/063215.html, lets get rid of this option.

It presents 2 issues that have bugged me for years now:

* OSObject is NOT a boolean option. It in fact has 3 states:
  * osx.OSObjectRetainCount is enabled but OSObject it set to false: RetainCount
    regards the option as disabled.
  * sx.OSObjectRetainCount is enabled and OSObject it set to true: RetainCount
    regards the option as enabled.
  * osx.OSObjectRetainCount is disabled: RetainCount regards the option as
    disabled.
* The hack involves directly modifying AnalyzerOptions::ConfigTable, which
  shouldn't even be public in the first place.

This still isn't really ideal, because it would be better to preserve the option
and remove the checker (we want visible checkers to be associated with
diagnostics, and hidden options like this one to be associated with changing how
the modeling is done), but backwards compatibility is an issue.

Differential Revision: https://reviews.llvm.org/D78097
2020-05-26 13:22:58 +02:00
Denys Petrov ba92b27422 [analyzer] Improved RangeSet::Negate support of unsigned ranges
Summary:
This fixes https://bugs.llvm.org/show_bug.cgi?id=41588
RangeSet Negate function shall handle unsigned ranges as well as signed ones.
RangeSet getRangeForMinusSymbol function shall use wider variety of ranges, not only concrete value ranges.
RangeSet Intersect functions shall not produce assertions.

Changes:
Improved safety of RangeSet::Intersect function. Added isEmpty() check to prevent an assertion.
Added support of handling unsigned ranges to RangeSet::Negate and RangeSet::getRangeForMinusSymbol.
Extended RangeSet::getRangeForMinusSymbol to return not only range sets with single value [n,n], but with wide ranges [n,m].
Added unit test for Negate function.
Added regression tests for unsigned values.

Differential Revision: https://reviews.llvm.org/D77802
2020-05-25 18:52:22 +03:00
Kirstóf Umann 429f030899 Revert "[analyzer] Change the default output type to PD_TEXT_MINIMAL in the frontend, error if an output loc is missing for PathDiagConsumers that need it"
This reverts commit fe1a3a7e8c.
2020-05-22 20:18:16 +02:00
Artem Dergachev 99b94f29ac [analyzer] LoopUnrolling: fix crash when a parameter is a loop counter.
When loop counter is a function parameter "isPossiblyEscaped" will not find
the variable declaration which lead to hitting "llvm_unreachable".
Parameters of reference type should be escaped like global variables;
otherwise treat them as unescaped.

Patch by Abbas Sabra!

Differential Revision: https://reviews.llvm.org/D80171
2020-05-22 16:14:48 +03:00
Jan Korous 54e91a3c70 Reland "[Analyzer][WebKit] RefCntblBaseVirtualDtorChecker"
This reverts commit 1108f5c737.
2020-05-21 16:41:00 -07:00
Nico Weber 1108f5c737 Revert "[Analyzer][WebKit] RefCntblBaseVirtualDtorChecker"
This reverts commit f7c7e8a523.
Breaks build everywhere.
2020-05-21 15:49:46 -04:00
Jan Korous f7c7e8a523 [Analyzer][WebKit] RefCntblBaseVirtualDtorChecker
Differential Revision: https://reviews.llvm.org/D77177
2020-05-21 11:54:49 -07:00
Kirstóf Umann 1c8f999e0b [analyzer][CallAndMessage] Add checker options for each bug type
iAs listed in the summary D77846, we have 5 different categories of bugs we're
checking for in CallAndMessage. I think the documentation placed in the code
explains my thought process behind my decisions quite well.

A non-obvious change I had here is removing the entry for
CallAndMessageUnInitRefArg. In fact, I removed the CheckerNameRef typed field
back in D77845 (it was dead code), so that checker didn't really exist in any
meaningful way anyways.

Differential Revision: https://reviews.llvm.org/D77866
2020-05-21 15:31:37 +02:00
Kirstóf Umann 48a8c7dcbf [analyzer] Make buildbots happy 2020-05-21 01:54:50 +02:00
Kirstóf Umann 1d393eac8f [analyzer] Fix a null FunctionDecl dereference bug after D75432 2020-05-21 01:05:15 +02:00
Balázs Kéri f7c9f77ef3 [Analyzer][StreamChecker] Added support for 'fread' and 'fwrite'.
Summary:
Stream functions `fread` and `fwrite` are evaluated
and preconditions checked.
A new bug type is added for a (non fatal) warning if `fread`
is called in EOF state.

Reviewers: Szelethus, NoQ, dcoughlin, baloghadamsoftware, martong, xazax.hun

Reviewed By: Szelethus

Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D80015
2020-05-20 09:40:57 +02:00
Kirstóf Umann 3a6ee4fefe [analyzer][StackAddressEscape] Tie warnings to the diagnostic checkers rather then core.StackAddrEscapeBase
Differential Revision: https://reviews.llvm.org/D78101
2020-05-20 02:26:40 +02:00
Kirstóf Umann fe1a3a7e8c [analyzer] Change the default output type to PD_TEXT_MINIMAL in the frontend, error if an output loc is missing for PathDiagConsumers that need it
The title and the included test file sums everything up -- the only thing I'm
mildly afraid of is whether anyone actually depends on the weird behavior of
HTMLDiagnostics pretending to be TextDiagnostics if an output directory is not
supplied. If it is, I guess we would need to resort to tiptoeing around the
compatibility flag.

Differential Revision: https://reviews.llvm.org/D76510
2020-05-20 01:36:06 +02:00
Kirstóf Umann 66224d309d [analyzer][ObjCGenerics] Don't emit diagnostics under the name core.DynamicTypePropagation
Differential Revision: https://reviews.llvm.org/D78124
2020-05-20 00:19:20 +02:00
Kirstóf Umann b47d1baa53 [analyzer][NSOrCFError] Don't emit diagnostics under the name osx.NSOrCFErrorDerefChecker
Differential Revision: https://reviews.llvm.org/D78123
2020-05-20 00:05:49 +02:00
Artem Dergachev e42e5e4d0f [analyzer] Move apiModeling.StdCLibraryFunctionArgs to alpha.
It was enabled by default accidentally; still missing some important
features. Also it needs a better package because it doesn't boil down to
API modeling.

Differential Revision: https://reviews.llvm.org/D80213
2020-05-19 23:05:49 +03:00
Kirstóf Umann e4e1080a58 [analyzer][Nullability] Don't emit under the checker name NullabilityBase
Differential Revision: https://reviews.llvm.org/D78122
2020-05-19 17:04:06 +02:00
Kirstóf Umann 268fa40daa [analyzer] Don't print the config count in debug.ConfigDumper
I think anyone who added a checker config wondered why is there a need
to test this. Its just a chore when adding a new config, so I removed
it.

To give some historic insight though, we used to not list **all**
options, but only those explicitly added to AnalyzerOptions, such as the
ones specified on the command line. However, past this change (and
arguably even before that) this line makes little sense.

There is an argument to be made against the entirety of
analyzer-config.c test file, but since this commit fixes some builtbots
and is landing without review, I wouldn't like to be too invasive.
2020-05-19 16:51:14 +02:00
Kirstóf Umann 500479dba3 [analyzer][DirectIvarAssignment] Turn DirectIvarAssignmentForAnnotatedFunctions into a checker option
Since this is an alpha checker, I don't worry about backward compatibility :)

Differential Revision: https://reviews.llvm.org/D78121
2020-05-19 15:41:43 +02:00
Kirstóf Umann 2e5e42d4ae [analyzer][MallocChecker] When modeling realloc-like functions, don't early return if the argument is symbolic
The very essence of MallocChecker lies in 2 overload sets: the FreeMemAux
functions and the MallocMemAux functions. The former houses most of the error
checking as well (aside from leaks), such as incorrect deallocation. There, we
check whether the argument's MemSpaceRegion is the heap or unknown, and if it
isn't, we know we encountered a bug (aside from a corner case patched by
@balazske in D76830), as specified by MEM34-C.

In ReallocMemAux, which really is the combination of  FreeMemAux and
MallocMemAux, we incorrectly early returned if the memory argument of realloc is
non-symbolic. The problem is, one of the cases where this happens when we know
precisely what the region is, like an array, as demonstrated in the test file.
So, lets get rid of this false negative :^)

Side note, I dislike the warning message and the associated checker name, but
I'll address it in a later patch.

Differential Revision: https://reviews.llvm.org/D79415
2020-05-19 13:59:29 +02:00
Balázs Kéri 56079e1de1 [Analyzer][VLASizeChecker] Try to fix vla.c test problems. 2020-05-19 12:12:28 +02:00
Balázs Kéri 51bb2128ef [Analyzer][VLASizeChecker] Check for VLA size overflow.
Summary:
Variable-length array (VLA) should have a size that fits into
a size_t value. According to the standard: "std::size_t can
store the maximum size of a theoretically possible object of
any type (including array)" (this is applied to C too).

The size expression is evaluated at the definition of the
VLA type even if this is a typedef.
The evaluation of the size expression in itself might cause
problems if it overflows.

Reviewers: Szelethus, baloghadamsoftware, martong, gamesh411

Reviewed By: Szelethus, martong, gamesh411

Subscribers: whisperity, rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D79330
2020-05-19 09:44:46 +02:00
Kirstóf Umann 9d69072fb8 [analyzer][NFC] Introduce CXXDeallocatorCall, deploy it in MallocChecker
One of the pain points in simplifying MallocCheckers interface by gradually
changing to CallEvent is that a variety of C++ allocation and deallocation
functionalities are modeled through preStmt<...> where CallEvent is unavailable,
and a single one of these callbacks can prevent a mass parameter change.

This patch introduces a new CallEvent, CXXDeallocatorCall, which happens after
preStmt<CXXDeleteExpr>, and can completely replace that callback as
demonstrated.

Differential Revision: https://reviews.llvm.org/D75430
2020-05-19 00:18:38 +02:00
Gabor Marton 7c3768495e [analyzer] Improve PlacementNewChecker
Summary:
1. Added insufficient storage check for arrays
2. Added align support check

Based on https://reviews.llvm.org/D76229

Reviewers: aaron.ballman, lebedev.ri, NoQ, martong

Reviewed By: martong

Subscribers: xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D76996

Patch by Karasev Nikita!
2020-05-14 15:50:39 +02:00
Gabor Marton ff4492c89f [analyzer] StdLibraryFunctionsChecker: Add option to display loaded summaries
Reviewers: NoQ, Szelethus, baloghadamsoftware, balazske

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, Charusso, steakhal, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D78118
2020-05-14 15:40:58 +02:00
Gabor Marton d061685a83 [analyzer] Make NonNullParamChecker as dependency for StdCLibraryFunctionsChecker
Summary:
If a given parameter in a FunctionDecl has a nonull attribute then the NonNull
constraint in StdCLibraryFunctionsChecker has the same effect as
NonNullParamChecker. I think it is better to emit diagnostics from the simpler
checker. By making NonNullParamChecker as a dependency, in these cases it will
be the first to emit a diagnostic and to stop the analysis on that path.

Reviewers: Szelethus, NoQ, baloghadamsoftware, balazske, steakhal

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, Charusso, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D79420
2020-05-14 15:28:40 +02:00
Balázs Kéri cb1eeb42c0 [Analyzer][VLASizeChecker] Check VLA size in typedef and sizeof.
Summary:
The check of VLA size was done previously for variable declarations
(of VLA type) only. Now it is done for typedef (and type-alias)
and sizeof expressions with VLA too.

Reviewers: Szelethus, martong

Reviewed By: Szelethus, martong

Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D79072
2020-05-14 14:30:05 +02:00
Kirstóf Umann 2a12acda4c [analyzer][StreamChecker] Don't make StreamTestChecker depend on StreamChecker for the time being
The comment in Checkers.td explains whats going on. As StreamChecker grows,
expect a need to have smaller checkers out of it, but let that be a worry for
later.

Differential Revision: https://reviews.llvm.org/D78120
2020-05-13 20:05:11 +02:00
Valeriy Savchenko 855f0ce79b [analyzer] Fix crash for non-pointers annotated as nonnull
Summary:
Nonnull attribute can be applied to non-pointers.  This caused assertion
failures in NonNullParamChecker when we tried to *assume* such parameters
to be non-zero.

rdar://problem/63150074

Differential Revision: https://reviews.llvm.org/D79843
2020-05-13 13:36:49 +03:00
Denys Petrov ba8cda989c [analyzer] Stability improvement for IteratorModeling
Summary:
Some function path may lead to crash.
Fixed using local variable outside the scope  through a pointer.
Fixed minor misspellings.
Added regression test.

This patch covers a bug https://bugs.llvm.org/show_bug.cgi?id=41485

Reviewed By: baloghadamsoftware

Differential Revision: https://reviews.llvm.org/D78289
2020-05-06 14:16:39 +03:00
Denys Petrov f01ac8c657 A test commit as a new contributor to verify commit access is OK. 2020-05-04 21:36:18 +03:00
Valeriy Savchenko 239c53b72b [analyzer] Track runtime types represented by Obj-C Class objects
Summary:
Objective-C Class objects can be used to do a dynamic dispatch on
class methods. The analyzer had a few places where we tried to overcome
the dynamic nature of it and still guess the actual function that
is being called. That was done mostly using some simple heuristics
covering the most widespread cases (e.g. [[self class] classmethod]).
This solution introduces a way to track types represented by Class
objects and work with that instead of direct AST matching.

rdar://problem/50739539

Differential Revision: https://reviews.llvm.org/D78286
2020-04-29 13:35:53 +03:00
Dmitri Gribenko 96717125e8 Revert "[analyzer] On-demand parsing capability for CTU"
This reverts commit 811c0c9eb4. It broke
multiple buildbots.
2020-04-27 14:27:04 +02:00
Balázs Kéri 3b9b3d56ef [Analyzer] Include typedef statements in CFG build.
Summary:
Array size expressions in typedef statements with a VLA
(variable-length array) are handled from now as in plain
(non-typedef) VLA declarations.
Type-aliases with VLA are handled too
(but main focus is on C code).

Reviewers: Szelethus, aaron.ballman, NoQ, xazax.hun

Reviewed By: aaron.ballman, xazax.hun

Subscribers: rnkovacs, NoQ, efriedma, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77809
2020-04-27 12:36:26 +02:00
Endre Fülöp 811c0c9eb4 [analyzer] On-demand parsing capability for CTU
Summary:
Add an option to enable on-demand parsing of needed ASTs during CTU analysis.
Two options are introduced. CTUOnDemandParsing enables the feature, and
CTUOnDemandParsingDatabase specifies the path to a compilation database, which
has all the necessary information to generate the ASTs.

Reviewers: martong, balazske, Szelethus, xazax.hun

Subscribers: ormris, mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, steakhal, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75665
2020-04-27 11:20:35 +02:00
Valeriy Savchenko a88025672f [analyzer] Consider array subscripts to be interesting lvalues.
Static analyzer has a mechanism of clearing redundant nodes when
analysis hits a certain threshold with a number of nodes in exploded
graph (default is 1000). It is similar to GC and aims removing nodes
not useful for analysis. Unfortunately nodes corresponding to array
subscript expressions (that actively participate in data propagation)
get removed during the cleanup. This might prevent the analyzer from
generating useful notes about where it thinks the data came from.

This fix is pretty much consistent with the way analysis works
already. Lvalue "interestingness" stands for the analyzer's
possibility of tracking values through them.

Differential Revision: https://reviews.llvm.org/D78638
2020-04-23 19:52:45 +03:00
Artem Dergachev 8781944141 [analyzer] GenericTaint: Don't expect CallEvent to always have a Decl.
This isn't the case when the callee is completely unknown,
eg. when it is a symbolic function pointer.
2020-04-20 15:31:43 +03:00
Valeriy Savchenko 1f67508b7f [analyzer] Do not report CFError null dereference for nonnull params.
We want to trust user type annotations and stop assuming pointers declared
as nonnull still can be null. This functionality is implemented as part
of NonNullParamChecker because it already checks parameter attributes.
Whenever we start analyzing a new function, we assume that all parameters
with 'nonnull' attribute are indeed non-null.

Patch by Valeriy Savchenko!

Differential Revision: https://reviews.llvm.org/D77806
2020-04-20 12:33:01 +03:00
Valeriy Savchenko 09a1f09050 [analyzer] Do not report NSError null dereference for _Nonnull params.
We want to trust user type annotations and stop assuming pointers declared
as _Nonnull still can be null. This functionality is implemented as part
of NullabilityChecker as it already tracks non-null types.

Patch by Valeriy Savchenko!

Differential Revision: https://reviews.llvm.org/D77722
2020-04-20 12:33:01 +03:00
Balázs Kéri f2b5e60dfd [Analyzer][StreamChecker] Added evaluation of fseek.
Summary:
Function `fseek` is now evaluated with setting error return value
and error flags.

Reviewers: Szelethus, NoQ, xazax.hun, rnkovacs, dcoughlin, baloghadamsoftware, martong

Reviewed By: Szelethus

Subscribers: ASDenysPetrov, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75851
2020-04-14 12:35:28 +02:00
Balázs Kéri 37ac1c19be [Analyzer][VLASize] Support multi-dimensional arrays.
Summary:
Check the size constraints for every (variable) dimension of the array.
Try to compute array size by multiplying size for every dimension.

Reviewers: Szelethus, martong, baloghadamsoftware, gamesh411

Reviewed By: Szelethus, martong

Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77305
2020-04-14 10:26:51 +02:00
Kirstóf Umann 023c4d400e [analyzer][AnalysisOrderChecker] Display the CallEvent type in preCall/postCall
Exactly what it says on the tin! The included testfile demonstrates why this is
important -- for C++ dynamic memory operators, we don't always recognize custom,
or even standard-specified new/delete operators as CXXAllocatorCall or
CXXDeallocatorCall.

Differential Revision: https://reviews.llvm.org/D77391
2020-04-09 16:41:07 +02:00
Kirstóf Umann a2b6ece1fd [analyzer] Display the checker name in the text output
Exactly what it says on the tin! There is no reason I think not to have this.

Also, I added test files for checkers that emit warning under the wrong name.

Differential Revision: https://reviews.llvm.org/D76605
2020-04-09 16:21:45 +02:00
Balazs Benics 30e5c7e82f [analyzer] NFCi: Refactor CStringChecker: use strongly typed internal API
Summary:
I wanted to extend the diagnostics of the CStringChecker with taintedness.
This requires the CStringChecker to be refactored to support a more flexible
reporting mechanism.

This patch does only refactorings, such:
 - eliminates always false parameters (like WarnAboutSize)
 - reduces the number of parameters
 - makes strong types differentiating *source* and *destination* buffers
   (same with size expressions)
 - binds the argument expression and the index, making diagnostics accurate
   and easy to emit
 - removes a bunch of default parameters to make it more readable
 - remove random const char* warning message parameters, making clear where
   and what is going to be emitted

Note that:
 - CheckBufferAccess now checks *only* one buffer, this removed about 100 LOC
   code duplication
 - not every function was refactored to use the /new/ strongly typed API, since
   the CString related functions are really closely coupled monolithic beasts,
   I will refactor them separately
 - all tests are preserved and passing; only the message changed at some places.
   In my opinion, these messages are holding the same information.

I would also highlight that this refactoring caught a bug in
clang/test/Analysis/string.c:454 where the diagnostic did not reflect reality.
This catch backs my effort on simplifying this monolithic CStringChecker.

Reviewers: NoQ, baloghadamsoftware, Szelethus, rengolin, Charusso

Reviewed By: NoQ

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin,
mikhail.ramalho, donat.nagy, dkrupp, Charusso, martong, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D74806
2020-04-09 16:06:32 +02:00
Balázs Kéri 11bd3e5c65 [Analyzer][StreamChecker] Introduction of stream error handling.
Summary:
Store the error flags (EOF or error) of a stream.
Support the functions feof, ferror, clearerr.
Added a test checker for setting the error flags.

Reviewers: Szelethus, NoQ, Charusso, baloghadamsoftware, xazax.hun

Reviewed By: Szelethus

Subscribers: steakhal, ASDenysPetrov, rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75682
2020-04-08 11:30:19 +02:00
Artem Dergachev 0c27fd82e1 Revert "Revert "[analyzer] Teach scan-build how to rebuild index.html without analyzing.""
This reverts commit 21efb06f0a.

Changes since last attempt to land this patch:
- Sort files before deduplicating. This hopefully avoids some buildbot failures.
- Fix use of uninitialized variable when running without --use-analyzer.
- Remove the "REQUIRES: windows" item.
2020-04-07 21:03:16 +03:00
Artem Dergachev 6b3353e832 Revert "[analyzer] Try to lift 'REQUIRES: shell' for scan-build tests."
This reverts commit cfd388d344.
2020-04-07 16:37:42 +03:00
Denys Petrov cfd388d344 [analyzer] Try to lift 'REQUIRES: shell' for scan-build tests.
This is the second part of Denys's patch, committed separately
due to being more risky.

Differential Revision: https://reviews.llvm.org/D76768
2020-04-07 15:56:50 +03:00
cchen a010ef8bd8 Add map-type check for target and target data directive, by Chi Chun
Chen

Reviewers: ABataev, jdoerfert

Reviewed By: ABataev

Subscribers: cfe-commits, dreachem, sandoval

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77581
2020-04-07 07:15:52 -04:00
Artem Dergachev 9b1e4a8218 [analyzer] Fix NSErrorChecker false positives on constructors.
Constructors and delete operators cannot return a boolean value.
Therefore they cannot possibly follow the NS/CFError-related coding
conventions.

Patch by Valeriy Savchenko!

Differential Revision: https://reviews.llvm.org/D77551
2020-04-06 20:33:38 +03:00
Artem Dergachev 2ddd3325c4 [analyzer] Fix scan-build and exploded-graph-rewriter tests on Windows.
Detect script locations in a more straightforward way: we don't need to
search for them because we know exactly where they are anyway.

Fix a file path escaping issue in exploded-graph-rewriter with Windows
backslashes in the path.

'REQUIRES: shell' remains in scan-build tests for now, so that to
observe the buildbot reaction on removing it in a cleaner experiment.

Patch by Denys Petrov!

Differential Revision: https://reviews.llvm.org/D76768
2020-04-06 20:33:37 +03:00
Gabor Marton 8f96139973 [analyzer] StdLibraryFunctionsChecker: match signature based on FunctionDecl
Summary:
Currently we match the summary signature based on the arguments in the CallExpr.
There are a few problems with this approach.
1) Variadic arguments are handled badly. Consider the below code:
     int foo(void *stream, const char *format, ...);
     void test_arg_constraint_on_variadic_fun() {
        foo(0, "%d%d", 1, 2); // CallExpr
     }
   Here the call expression holds 4 arguments, whereas the function declaration
   has only 2 `ParmVarDecl`s. So there is no way to create a summary that
   matches the call expression, because the discrepancy in the number of
   arguments causes a mismatch.
2) The call expression does not handle the `restrict` type qualifier.
   In C99, fwrite's signature is the following:
     size_t fwrite(const void *restrict, size_t, size_t, FILE *restrict);
   However, in a call expression, like below, the type of the argument does not
   have the restrict qualifier.
    void test_fread_fwrite(FILE *fp, int *buf) {
      size_t x = fwrite(buf, sizeof(int), 10, fp);
    }
   This can result in an unmatches signature, so the summary is not applied.
The solution is to match the summary against the referened callee
`FunctionDecl` that we can query from the `CallExpr`.

Further patches will continue with additional refactoring where I am going to
do a lookup during the checker initialization and the signature match will
happen there. That way, we will not check the signature during every call,
rather we will compare only two `FunctionDecl` pointers.

Reviewers: NoQ, Szelethus, gamesh411, baloghadamsoftware

Subscribers: whisperity, xazax.hun, kristof.beyls, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, steakhal, danielkiss, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77410
2020-04-06 17:34:08 +02:00
Gabor Marton ab1fad8a3a [analyzer] StdLibraryFunctionsChecker: Add test for function with default parameter
Reviewers: Szelethus, baloghadamsoftware, gamesh411, steakhal, balazske

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77411
2020-04-06 17:08:58 +02:00
Gabor Marton 1525232e27 [analyzer] StdLibraryFunctionsChecker: fix bug with arg constraints
Summary:
Previously we induced a state split if there were multiple argument
constraints given for a function. This was because we called
`addTransition` inside the for loop.
The fix is to is to store the state and apply the next argument
constraint on that. And once the loop is finished we call `addTransition`.

Reviewers: NoQ, Szelethus, baloghadamsoftware

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, C

Tags: #clang

Differential Revision: https://reviews.llvm.org/D76790
2020-04-02 17:00:11 +02:00
Artem Dergachev 3500cc8d89 [analyzer] RetainCountChecker: Add a suppression for OSSymbols.
OSSymbol objects are particular XNU OSObjects that aren't really
reference-counted. Therefore you cannot do any harm by over- or
under-releasing them.
2020-04-01 18:16:44 +03:00
Vince Bridgers defd95ef45 [analyzer] Fix StdLibraryFunctionsChecker NotNull Constraint Check
Summary:
This check was causing a crash in a test case where the 0th argument was
uninitialized ('Assertion `T::isKind(*this)' at line SVals.h:104). This
was happening since the argument was actually undefined, but the castAs
assumes the value is DefinedOrUnknownSVal.

The fix appears to be simply to check for an undefined value and skip
the check allowing the uninitalized value checker to detect the error.

I included a test case that I verified to produce the negative case
prior to the fix, and passes with the fix.

Reviewers: martong, NoQ

Subscribers: xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, Charusso, ASDenysPetrov, baloghadamsoftware, dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77012
2020-03-30 14:13:08 -05:00
Gabor Marton 1a1bb876db [analyzer] Add core.CallAndMessage to StdCLibraryFunctionArgsChecker's dependency
Reviewers: Szelethus, NoQ

Subscribers: whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, gamesh411, Charusso, steakhal, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D77061
2020-03-30 17:57:15 +02:00
Balázs Kéri dcc04e09cf [Analyzer][MallocChecker] No warning for kfree of ZERO_SIZE_PTR.
Summary:
The kernel kmalloc function may return a constant value ZERO_SIZE_PTR
if a zero-sized block is allocated. This special value is allowed to
be passed to kfree and should produce no warning.

This is a simple version but should be no problem. The macro is always
detected independent of if this is a kernel source code or any other
code.

Reviewers: Szelethus, martong

Reviewed By: Szelethus, martong

Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, gamesh411, Charusso, martong, ASDenysPetrov, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D76830
2020-03-30 10:33:14 +02:00
Adam Balogh eb90692d8a [Analyzer] Rename test `iterator-modelling.cpp` to `iterator-modeling.cpp`
Typo fix.
2020-03-30 09:23:35 +02:00
Adam Balogh afcb77cc88 [Analyzer] Fix for incorrect use of container and iterator checkers
Iterator checkers (and planned container checkers) need the option
aggressive-binary-operation-simplification to be enabled. Without this
option they may cause assertions. To prevent such misuse, this patch adds
a preventive check which issues a warning and denies the registartion of
the checker if this option is disabled.

Differential Revision: https://reviews.llvm.org/D75171
2020-03-30 09:14:45 +02:00
Kirstóf Umann 30a8b77080 [analyzer][MallocChecker] Fix that kfree only takes a single argument
Exactly what it says on the tin!

https://www.kernel.org/doc/htmldocs/kernel-api/API-kfree.html

Differential Revision: https://reviews.llvm.org/D76917
2020-03-27 13:17:35 +01:00
Adam Balogh 1a27d63a88 [Analyzer] Only add container note tags to the operations of the affected container
If an error happens which is related to a container the Container
Modeling checker adds note tags to all the container operations along
the bug path. This may be disturbing if there are other containers
beside the one which is affected by the bug. This patch restricts the
note tags to only the affected container and adjust the debug checkers
to be able to test this change.

Differential Revision: https://reviews.llvm.org/D75514
2020-03-26 09:44:16 +01:00
Adam Balogh a3f4d17a1a [Analyzer] Use note tags to track container begin and and changes
Container operations such as `push_back()`, `pop_front()`
etc. increment and decrement the abstract begin and end
symbols of containers. This patch introduces note tags
to `ContainerModeling` to track these changes. This helps
the user to better identify the source of errors related
to containers and iterators.

Differential Revision: https://reviews.llvm.org/D73720
2020-03-26 07:56:28 +01:00
Adam Balogh ccc0d35181 [Analyzer] IteratorRangeChecker verify `std::advance()`, `std::prev()` and `std::next()`
Upon calling one of the functions `std::advance()`, `std::prev()` and
`std::next()` iterators could get out of their valid range which leads
to undefined behavior. If all these funcions are inlined together with
the functions they call internally (e.g. `__advance()` called by
`std::advance()` in some implementations) the error is detected by
`IteratorRangeChecker` but the bug location is inside the STL
implementation. Even worse, if the budget runs out and one of the calls
is not inlined the bug remains undetected. This patch fixes this
behavior: all the bugs are detected at the point of the STL function
invocation.

Differential Revision: https://reviews.llvm.org/D76379
2020-03-23 17:33:26 +01:00
Adam Balogh 60bad941a1 [Analyzer] Iterator Modeling - Model `std::advance()`, `std::prev()` and `std::next()`
Whenever the analyzer budget runs out just at the point where
`std::advance()`, `std::prev()` or `std::next()` is invoked the function
are not inlined. This results in strange behavior such as
`std::prev(v.end())` equals `v.end()`. To prevent this model these
functions if they were not inlined. It may also happend that although
`std::advance()` is inlined but a function it calls inside (e.g.
`__advance()` in some implementations) is not. This case is also handled
in this patch.

Differential Revision: https://reviews.llvm.org/D76361
2020-03-23 15:29:55 +01:00
Gabor Marton ededa65d55 [analyzer] StdLibraryFunctionsChecker: Add NotNull Arg Constraint
Reviewers: NoQ, Szelethus, balazske, gamesh411, baloghadamsoftware, steakhal

Subscribers: whisperity, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D75063
2020-03-20 17:34:29 +01:00