Commit Graph

936 Commits

Author SHA1 Message Date
Fariborz Jahanian 3aa19e9a70 Fold -fobjc-nonfragile-abi2 into -fobjc-nonfragile-abi.
// rdar://8818375

llvm-svn: 122831
2011-01-04 20:05:20 +00:00
Ted Kremenek 5614c46fcf Add basic support for pointer arithmetic in
SimpleSValBuilder.  This clears up some
false positives emitted by ArrayBoundCheckerV2
due to the lack of support for pointer arithmetic.

llvm-svn: 122546
2010-12-24 08:39:33 +00:00
Ted Kremenek bd5fcdf803 It's amazing what you find when you actually
set the RUN line correctly in a test file!

Mark a bunch of tests for ArrayBoundCheckerV2
as FIXME's, as our current lack of pointer
arithmetic handling causes these to be all
false positives/negatives.

llvm-svn: 122471
2010-12-23 02:42:49 +00:00
Ted Kremenek e73571b9cc Add WIP prototype of a new buffer overflow
checker based on using raw (symbolic) byte offsets
from a base region.

llvm-svn: 122469
2010-12-23 02:42:43 +00:00
Zhongxing Xu 6f8a8f92b8 If the unary operator is prefix and an lvalue (in C++), bind
the location (l-value) to it.

llvm-svn: 122396
2010-12-22 08:38:13 +00:00
Zhongxing Xu 7089250f5a After inlining the CXXConstructExpr, bind the temporary object region to it.
This change is necessary when the variable is a const reference and we need
the l-value of the construct expr.  After that, when binding the variable,
recover the lazy compound value when the variable is not a reference.

In Environment, use the value of a no-op cast expression when it has one.
Otherwise, blast-through it.

llvm-svn: 122388
2010-12-22 07:20:27 +00:00
Zhongxing Xu 7e2a9fd620 If the initializer is an rvalue and the variable is a const reference,
create a temporary object for it.

llvm-svn: 122161
2010-12-19 02:26:37 +00:00
Ted Kremenek b44f0f9abe Fix assertion failure in cocoa::deriveNamingConvention()
when the selector is the string 'mutable'.

llvm-svn: 122046
2010-12-17 07:11:57 +00:00
Ted Kremenek edb1cdff77 Revise Cocoa conventions detection: 'copy' and 'mutableCopy'
only indicates the create rule if it starts
at the beginning of the method name, not
within the method name.

llvm-svn: 122036
2010-12-17 04:44:43 +00:00
John McCall 57cdd88897 Do lvalue-to-rvalue conversions on the LHS of a shift operator.
Fixes rdar://problem/8776586.

llvm-svn: 121992
2010-12-16 19:28:59 +00:00
Ted Kremenek 8219b82125 Start migration of static analyzer to using the
implicit lvalue-to-rvalue casts that John McCall
recently introduced.  This causes a whole bunch
of logic in the analyzer for handling lvalues
to vanish.  It does, however, raise a few issues
in the analyzer w.r.t to modeling various constructs
(e.g., field accesses to compound literals).

The .c/.m analysis test cases that fail are
due to a missing lvalue-to-rvalue cast that
will get introduced into the AST.  The .cpp
failures were more than I could investigate in
one go, and the patch was already getting huge.
I have XFAILED some of these tests, and they
should obviously be further investigated.

Some highlights of this patch include:

- CFG no longer requires an lvalue bit for
  CFGElements
- StackFrameContext doesn't need an 'asLValue'
  flag
- The "VisitLValue" path from GRExprEngine has
  been eliminated.

Besides the test case failures (XFAILed), there
are surely other bugs that are fallout from
this change.

llvm-svn: 121960
2010-12-16 07:46:53 +00:00
Ted Kremenek f9f944166a Add test case for r120795.
llvm-svn: 120796
2010-12-03 06:53:12 +00:00
Argyrios Kyrtzidis e72f7154f1 Follow through references to catch returned stack addresses, local blocks, label addresses or references to temporaries, e.g:
const int& g2() {
  int s1;
  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
  return s2; // expected-warning {{reference to stack memory associated with local variable 's1' returned}}
}

llvm-svn: 120483
2010-11-30 22:57:32 +00:00
Argyrios Kyrtzidis 091d97c709 Revert r120331 since it causes spurious warnings and a possible assertion hit when self-host.
llvm-svn: 120351
2010-11-29 23:42:03 +00:00
Argyrios Kyrtzidis 569cad9734 Emit warnings if we are returning a reference to a local temporary.
The issue was brought to our attention by Matthieu Monrocq.

llvm-svn: 120331
2010-11-29 22:32:08 +00:00
Zhongxing Xu ec0b8e32ee Regionstore: support derived-to-base cast by creating a CXXBaseObjectRegion.
llvm-svn: 120173
2010-11-26 08:21:53 +00:00
Zhongxing Xu 33f13595c9 handle CXXFunctionalCastExpr in visitLValue and Environment.
llvm-svn: 120143
2010-11-25 03:18:57 +00:00
Zhongxing Xu 8be65a792f When getting CXXThisRegion from CXXMethodDecl, use the qualifiers. This is
to be consistent with the type of 'this' expr in the method.
此行及以下内容将会被忽略--

M    test/Analysis/method-call.cpp
M    include/clang/Checker/PathSensitive/GRExprEngine.h
M    lib/Checker/GRCXXExprEngine.cpp

llvm-svn: 120094
2010-11-24 13:48:50 +00:00
Zhanyong Wan 6dace61730 Fix PR8419. Reviewed by kremenek and xuzhongxing.
llvm-svn: 119960
2010-11-22 08:45:56 +00:00
Zhongxing Xu 2c966716ff Handle CFGAutomaticObjDtor.
llvm-svn: 119897
2010-11-20 06:53:12 +00:00
Ted Kremenek 0c27bcfd05 Static analyzer: Catch calls to malloc() with
allocation sizes of 0 bytes.

Fixes PR 2899.

llvm-svn: 119364
2010-11-16 18:47:04 +00:00
Zhongxing Xu 1ade3267d7 Handle member initializer in C++ ctor.
- Add a new Kind of ProgramPoint: PostInitializer.
 - Still use GRStmtNodeBuilder. But special handling PostInitializer in 
   GRStmtNodeBuilder::GenerateAutoTransition().
 - Someday we should clean up the interface of GRStmtNodeBuilder.

llvm-svn: 119335
2010-11-16 07:52:17 +00:00
Ted Kremenek 18fb1665bf Remove invalid assertion from CFG builder. When building the CFG pieces for a ternary '?' expression,
it is possible for the confluence block to only have a single predecessor due to calls to 'noreturn'
functions.  Fixes assertion failure reported in PR 8619.

llvm-svn: 119284
2010-11-15 22:59:22 +00:00
Ted Kremenek db73d599b7 Relax assertion in SValuator so that we don't crash when analyzing a call via a function pointer that
casts the return value to something completely different.  While we need better reasoning here,
we should definately not crash.

llvm-svn: 119177
2010-11-15 20:09:42 +00:00
Zhongxing Xu fee455fcf5 Revert r118991.
Elidable CXXConstructExpr should inhibit calling destructor for temporary 
that is copied, not the one created. This is because eliding copy constructor 
means that the object that was to be copied will be constructed directly in 
memory the copy would be constructed in.

llvm-svn: 119044
2010-11-14 15:23:50 +00:00
Zhongxing Xu 1b038fa00f Do not add implicit dtors for CXXBindTemporaryExpr with elidable
CXXConstructExpr.

llvm-svn: 118991
2010-11-13 07:30:59 +00:00
Ted Kremenek 843c53828f RegionStore/BasicStore: do not return UndefinedVal for accesses to concrete addresses; instead return UnknownVal. This
leads it up to checkers (e.g., DereferenceChecker) to guard against illegal accesses (e.g., null dereferences).

Fixes PR 5272 and <rdar://problem/6839683>.

llvm-svn: 118852
2010-11-11 23:10:10 +00:00
Ted Kremenek dcf85a8d18 Teach AttrNonNullChecker about transparent unions. Fixes crash reported in <rdar://problem/8642434>.
llvm-svn: 118473
2010-11-09 02:11:43 +00:00
Zhongxing Xu 0806da8f28 fix test case.
llvm-svn: 118166
2010-11-03 11:24:56 +00:00
Marcin Swiderski 3ab17ad8ec Added generating destructors for temporary objects. Two cases I know of, that are not handled properly:
1. For statement: const C& c = C(0) ?: C(1) destructors generated for condition will not differ from those generated for case without prolonged lifetime of temporary,
2. There will be no destructor for constant reference member bound to temporary at the exit from constructor.

llvm-svn: 118158
2010-11-03 06:19:35 +00:00
Douglas Gregor e5a6fed7dc Make my test case test what it meant to
llvm-svn: 117974
2010-11-01 23:33:11 +00:00
Douglas Gregor 4b8eca88b0 Teach the CStringChecker and PthreadLockChecker about non-identifier
declaration names, from Jim Goodnow II!

llvm-svn: 117970
2010-11-01 23:16:05 +00:00
Zhongxing Xu 627a1868d2 Now initializer of C++ record type is visited as block-level expr.
Let the destination of AggExprVisitor be an explicit MemRegion. 
Reenable the test case.

llvm-svn: 117908
2010-11-01 09:09:44 +00:00
Zhongxing Xu 0b51d4db8c Make all CXXConstructExpr's block-level expressions. This is required by
method inlining. Temporarily fail a test case.

llvm-svn: 117907
2010-11-01 06:46:05 +00:00
Zhanyong Wan e4f7df694d Make Clang static analyzer skip function template definitions. This fixes Clang PR 8426, 8427, & 8433. Reviewed by Ted Kremenek and Doug Gregor.
llvm-svn: 117853
2010-10-31 04:22:34 +00:00
Ted Kremenek 310c5a8e31 Don't flag idempotent '+' or '-' warnings for pointer arithmetic (typically false positives).
Fixes <rdar://problem/8601243>.

llvm-svn: 117635
2010-10-29 01:06:54 +00:00
Ted Kremenek eaae1adb94 Add test case for <rdar://problem/8356342>.
llvm-svn: 117525
2010-10-28 02:50:32 +00:00
Ted Kremenek 0abd85c7ae Don't warn about unamed bitfield ivars in the ObjCUnusedIvarsChecker. Fixes <rdar://problem/8481311>.
llvm-svn: 117521
2010-10-28 02:16:22 +00:00
Zhongxing Xu d95ccd58a9 If visiting RHS causes us to finish 'Block', e.g. the RHS is a StmtExpr
containing a DoStmt, and the LHS doesn't create a new block, then we should
return RBlock.  Otherwise we'll incorrectly return NULL.

Also relax an assertion in VisitWhileStmt(). Reset 'Block' when it is finished.

llvm-svn: 117436
2010-10-27 03:23:10 +00:00
Ted Kremenek 6348dac7a0 Fix lazy symbolication bug in RegionStore involving fields of global variables. When invalidated, the entire
globals memory space gets assigned a symbolic value, but that value was not being used for lazy symbolication
of fields of globals.  This could result in cases where bogus null dereferences were being reported.

Fixes PR 8440.

llvm-svn: 117336
2010-10-26 00:06:17 +00:00
Ted Kremenek 731310e13e Tweak null dereference checker to give better diagnostics for null dereferences resulting from array accesses.
llvm-svn: 117334
2010-10-26 00:06:13 +00:00
Ted Kremenek c07d8353e1 Add check for UnknownVals for mutexes in ObjCAtSyncChecker. Fixes crash reported in PR 8458.
llvm-svn: 117300
2010-10-25 20:20:56 +00:00
Marcin Swiderski 01769904d3 Added generation of destructors for member constant size arrays.
There's only one destructor call generated for each not empty array (at least for now this should be enough).

llvm-svn: 117252
2010-10-25 07:05:54 +00:00
Marcin Swiderski 52e4bc1fed Added generation of destructors for constant size arrays.
There's only one destructor call generated for each not empty array (at least for now this should be enough).

llvm-svn: 117251
2010-10-25 07:00:40 +00:00
Anders Carlsson 73067a02db Warn if a variable marked with the "unused" attribute is used. Patch by Darin Adler!
llvm-svn: 117184
2010-10-22 23:37:08 +00:00
Ted Kremenek 5c97605c1d Fix a horrible bug in all dataflow analyses that use CFGRecStmtVisitor (including live variables analysis).
We shouldn't recurse into CompoundStmts since they are already inlined in the CFG.  This could result in
bogus dead stores warnings (among other things).

llvm-svn: 117162
2010-10-22 22:08:32 +00:00
Ted Kremenek c5644e1b97 Tweak the ObjCAtSyncChecker to assume that a mutex is non-nil after checking that it is
nil.  Otherwise we can get false paths where a second @synchronized using the mutex
can have a bogus warning.  Fixes <rdar://problem/8578650>.

llvm-svn: 117016
2010-10-21 15:38:55 +00:00
Ted Kremenek da8a79ac8d "Fix" bogus idempotent operations warning due to loop unrolling not unrolling enough loops to show that an invariant
doesn't hold.  This fix is to increase the loop unrolling count to 4, which experiments show doesn't typically impact
analysis time.  The real fix is to modify the IdempotentOperationsChecker to suppress warnings where an analysis point
could be preceded by a point where we gave up due to loop unrolling.

llvm-svn: 116769
2010-10-18 23:36:05 +00:00
Ted Kremenek 4f63ac7057 Tweak retain/release checker diagnostics to specify a leak occurs because an object is not referenced later in the path,
not that it isn't referenced later in the code.  Fixes <rdar://problem/8527839>.

llvm-svn: 116636
2010-10-15 22:50:23 +00:00
Zhongxing Xu 271c9c7b6d Add experimental chroot check which checks improper use of chroot(). Patch by
Lei Zhang.

llvm-svn: 116163
2010-10-10 05:45:30 +00:00