Commit Graph

1240 Commits

Author SHA1 Message Date
Gabor Horvath 4df9d8128b [Static Analyzer] Properly clean up the dynamic type information for dead regions.
Differential Revision: http://reviews.llvm.org/D12767

llvm-svn: 247430
2015-09-11 17:19:57 +00:00
Gabor Horvath 3943adb57f [Static Analyzer] Minor cleanups for the nullability checker.
Differential Revision: http://reviews.llvm.org/D12619

llvm-svn: 247423
2015-09-11 16:29:05 +00:00
Gabor Horvath 1cbf435cd6 [Static Analyzer] Objective-C Generics Checker improvements.
Differential Revision: http://reviews.llvm.org/D12701

llvm-svn: 247071
2015-09-08 21:04:14 +00:00
Ted Kremenek 3a0678e33c [analyzer] Apply whitespace cleanups by Honggyu Kim.
llvm-svn: 246978
2015-09-08 03:50:52 +00:00
Gabor Horvath b47128aaf3 [Static Analyzer] Remove sinks from nullability checks.
Differential Revision: http://reviews.llvm.org/D12445 

llvm-svn: 246818
2015-09-03 23:16:21 +00:00
Sanjay Patel a24296b459 add __builtin_unpredictable and convert to metadata
This patch depends on r246688 (D12341).

The goal is to make LLVM generate different code for these functions for a target that
has cheap branches (see PR23827 for more details):

int foo();

int normal(int x, int y, int z) {
   if (x != 0 && y != 0) return foo();
   return 1;
}

int crazy(int x, int y) {
   if (__builtin_unpredictable(x != 0 && y != 0)) return foo();
   return 1;
}

Differential Revision: http://reviews.llvm.org/D12458

llvm-svn: 246699
2015-09-02 20:01:30 +00:00
Gabor Horvath 742fd989b5 Revert r246345 until an assertion is fixed.
llvm-svn: 246479
2015-08-31 20:10:35 +00:00
Devin Coughlin 35d5dd2986 [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire region.
Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size
array fields. With this change, instead of invalidating the entire containing region the
analyzer now invalidates only offsets for the array itself when it can show that the
memcpy stays within the bounds of the array.

This addresses false positive memory leak warnings of the kind reported by
krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954

A patch by Pierre Gousseau!

Differential Revision: http://reviews.llvm.org/D11832

llvm-svn: 246345
2015-08-28 22:26:05 +00:00
Gabor Horvath 8d3ad6b617 [Static Analyzer] Make NonNullParamChecker emit implicit null dereference events.
Differential Revision: http://reviews.llvm.org/D11433

llvm-svn: 246182
2015-08-27 18:49:07 +00:00
Gabor Horvath 28690925ed [Static Analyzer] Checks to catch nullability related issues.
Differential Revision: http://reviews.llvm.org/D11468

llvm-svn: 246105
2015-08-26 23:17:43 +00:00
Ted Kremenek 9589caf04d Add missing newline.
llvm-svn: 246003
2015-08-26 03:11:31 +00:00
Gabor Horvath 3240cd3421 [Static Analyzer] Fixed a typo in a diagnostic message.
llvm-svn: 245949
2015-08-25 16:27:03 +00:00
Alexey Bataev 1a3320e463 [OPENMP 4.0] Initial support for array sections.
Adds parsing/sema analysis/serialization/deserialization for array sections in OpenMP constructs (introduced in OpenMP 4.0).
Currently it is allowed to use array sections only in OpenMP clauses that accepts list of expressions.
Differential Revision: http://reviews.llvm.org/D10732

llvm-svn: 245937
2015-08-25 14:24:04 +00:00
Gabor Horvath 717b51c821 [Static Analyzer] Add checker to catch lightweight generics related type errors in Objective-C.
Differential Revision: http://reviews.llvm.org/D11427

llvm-svn: 245646
2015-08-21 00:18:28 +00:00
NAKAMURA Takumi a0d39dd80a clangStaticAnalyzerCheckers: Update libdesp.
llvm-svn: 245145
2015-08-15 01:56:49 +00:00
Anna Zaks e5d74caf2a [analyzer] Add checkers for OS X / iOS localizability issues
Add checkers that detect code-level localizability issues for OS X / iOS:
  - A path sensitive checker that warns about uses of non-localized
    NSStrings passed to UI methods expecting localized strings.
  - A syntax checker that warns against not including a comment in
    NSLocalizedString macros.

A patch by Kulpreet Chilana!

(This is the second attempt with the compilation issue on Windows and
the random test failures resolved.)

llvm-svn: 245093
2015-08-14 20:22:22 +00:00
David Blaikie 2038b54eae Wdeprecated: Make the SecKeychainBugVisitor copyable (for the clone support in the CRTP base) my removing the user-declared dtor
The implicit dtor is just as good, and avoid suppressing implicit
copy/move ops.

llvm-svn: 244981
2015-08-13 23:09:18 +00:00
David Blaikie 6951e3e406 Wdeprecated: BugReporterVisitors are copied for cloning (BugReporterVisitorImpl), make sure such copies are safe
Make the copy/move ctors defaulted in the base class and make the
derived classes final to avoid any intermediate hierarchy slicing if
these types were further derived.

llvm-svn: 244979
2015-08-13 22:58:37 +00:00
David Blaikie 903c29347a Wdeprecated: CollectReachableSymbolsCallback are move constructed/returned by value, so make sure they're copy/moveable
(return by value is in ExprEngine::processPointerEscapedOnBind and any
other call to the scanReachableSymbols function template used there)

Protect the special members in the base class to avoid slicing, and make
derived classes final so these special members don't accidentally become
public on an intermediate base which would open up the possibility of
slicing again.

llvm-svn: 244975
2015-08-13 22:50:09 +00:00
Yaron Keren 556b21aa10 Remove and forbid raw_svector_ostream::flush() calls.
After r244870 flush() will only compare two null pointers and return,
doing nothing but wasting run time. The call is not required any more
as the stream and its SmallString are always in sync.

Thanks to David Blaikie for reviewing.

llvm-svn: 244928
2015-08-13 18:12:56 +00:00
Daniel Marjamaki 30e2a44a06 [Static Analyzer] Warn when inner and outer conditions are identical. The inner condition is always true.
Reviewed in http://reviews.llvm.org/D10892.

llvm-svn: 244435
2015-08-10 07:18:29 +00:00
Anna Zaks 9592df7901 Revert "[analyzer] Add checkers for OS X / iOS localizability issues"
This reverts commit fc885033a30b6e30ccf82398ae7c30e646727b10.

Revert all localization checker commits until the proper fix is implemented.

llvm-svn: 244394
2015-08-08 04:53:04 +00:00
Anna Zaks 08f3c1e12a Revert "[analyzer] Fixup to r244389 to make this build on windows."
This reverts commit 57a46a75b408245cf4154a838fe13ad702065745.

Revert all localization checker commits until the proper fix is implemented.

llvm-svn: 244393
2015-08-08 04:52:59 +00:00
Anna Zaks 67c4df8313 [analyzer] Fixup to r244389 to make this build on windows.
llvm-svn: 244390
2015-08-08 02:26:07 +00:00
Anna Zaks 38b496a05d [analyzer] Add checkers for OS X / iOS localizability issues
Add checkers that detect code-level localizability issues for OS X / iOS:
 - A path sensitive checker that warns about uses of non-localized
 NSStrings passed to UI methods expecting localized strings.
 - A syntax checker that warns against not including a comment in
 NSLocalizedString macros.

A patch by Kulpreet Chilana!

llvm-svn: 244389
2015-08-08 01:49:26 +00:00
Devin Coughlin de2cc01cd4 [analyzer] Don't issue alarm in ObjCSuperCallChecker for the super class itself.
The ObjCSuperCallChecker issues alarms for various Objective-C APIs that require
a subclass to call to its superclass's version of a method when overriding it.
So, for example, it raises an alarm when the -viewDidLoad method in a subclass
of UIViewController does not call [super viewDidLoad].

This patch fixes a false alarm where the analyzer erroneously required the
implementation of the superclass itself (e.g., UIViewController) to call
super.

rdar://problem/18416944

Differential Revision: http://reviews.llvm.org/D11842

llvm-svn: 244386
2015-08-08 01:31:51 +00:00
Benjamin Kramer 5f6210fa50 [Analyzer] Move FindSuperCallVisitor into an anonymous namespace.
No functionality change.

llvm-svn: 242140
2015-07-14 12:37:59 +00:00
Benjamin Kramer 973431b22f Rewrite users of Stmt::child_begin/end into for-range loops.
No functionality change intended.

llvm-svn: 241355
2015-07-03 15:12:24 +00:00
Benjamin Kramer 642f173ae9 Switch users of the 'for (StmtRange range = stmt->children(); range; ++range)‘ pattern to range for loops.
The pattern was born out of the lack of range-based for loops in C++98
and is somewhat obscure. No functionality change intended.

llvm-svn: 241300
2015-07-02 21:03:14 +00:00
Aaron Ballman 8d3a7a56a9 Clarify pointer ownership semantics by hoisting the std::unique_ptr creation to the caller instead of hiding it in emitReport. NFC.
llvm-svn: 240400
2015-06-23 13:15:32 +00:00
Alexander Kornienko ab9db51042 Revert r240270 ("Fixed/added namespace ending comments using clang-tidy").
llvm-svn: 240353
2015-06-22 23:07:51 +00:00
Aaron Ballman ff661394ce Don't use &* when get() will suffice; NFC.
llvm-svn: 240279
2015-06-22 13:28:21 +00:00
Alexander Kornienko 3d9d929e42 Fixed/added namespace ending comments using clang-tidy. NFC
The patch is generated using this command:

  $ tools/extra/clang-tidy/tool/run-clang-tidy.py -fix \
      -checks=-*,llvm-namespace-comment -header-filter='llvm/.*|clang/.*' \
      work/llvm/tools/clang

To reduce churn, not touching namespaces spanning less than 10 lines.

llvm-svn: 240270
2015-06-22 09:47:44 +00:00
Douglas Gregor eb6e64ca8f Allow the cf_returns_[not_]retained attributes to appear on out-parameters.
Includes a simple static analyzer check and not much else, but we'll also
be able to take advantage of this in Swift.

This feature can be tested for using __has_feature(cf_returns_on_parameters).

This commit also contains two fixes:
- Look through non-typedef sugar when deciding whether something is a CF type.
- When (cf|ns)_returns(_not)?_retained is applied to invalid properties,
  refer to "property" instead of "method" in the error message.

rdar://problem/18742441

llvm-svn: 240185
2015-06-19 23:17:46 +00:00
Devin Coughlin 0bee1d7ff1 [analyzer] Remove ObjCContainersChecker size information when a CFMutableArrayRef escapes
Update ObjCContainersChecker to be notified when pointers escape so it can
remove size information for escaping CFMutableArrayRefs. When such pointers
escape, un-analyzed code could mutate the array and cause the size information
to be incorrect.

rdar://problem/19406485

llvm-svn: 239709
2015-06-15 01:00:42 +00:00
Devin Coughlin d7112c391c [analyzer]Test commit fixing 80-column violation in comment. NFC.
llvm-svn: 238993
2015-06-04 00:18:10 +00:00
Enrico Pertoso 4432d87578 Fixes a typo in a comment.
llvm-svn: 238910
2015-06-03 09:10:58 +00:00
Pete Cooper f9db5737d0 Add a missing forward def of CheckerManager. NFC.
This file doesn't include CheckerManager or forward declare it, so is sensitive to include order.

llvm-svn: 235209
2015-04-17 17:00:16 +00:00
Sylvestre Ledru 3dbaf8534a Remove the assertion as it was useless and broken.
Enforcing the assert caused the following tests to fail:
Clang :: Analysis__bstring.c
Clang :: Analysis__comparison-implicit-casts.cpp
Clang :: Analysis__malloc-interprocedural.c
Clang :: Analysis__malloc.c
Clang :: Analysis__redefined_system.c
Clang :: Analysis__string.c
Clang :: Analysis__weak-functions.c

llvm-svn: 235190
2015-04-17 13:21:39 +00:00
Sylvestre Ledru 91ba4b1af6 Fix a bad assert. Found by coverity. CID 1101110
llvm-svn: 235188
2015-04-17 13:08:54 +00:00
Anton Yartsev b50f4ba461 [analyzer] This implements potential undefbehavior.ZeroAllocDereference checker.
TODO: support realloc(). Currently it is not possible due to the present realloc() handling. Currently RegionState is not being attached to realloc() in case of a zero Size argument. 
llvm-svn: 234889
2015-04-14 14:18:04 +00:00
Alexander Kornienko 34eb20725d Use 'override/final' instead of 'virtual' for overridden methods
Summary:
The patch is generated using clang-tidy misc-use-override check.

This command was used:

  tools/clang/tools/extra/clang-tidy/tool/run-clang-tidy.py \
    -checks='-*,misc-use-override' -header-filter='llvm|clang' -j=32 -fix

Reviewers: dblaikie

Reviewed By: dblaikie

Subscribers: klimek, cfe-commits

Differential Revision: http://reviews.llvm.org/D8926

llvm-svn: 234678
2015-04-11 02:00:23 +00:00
Benjamin Kramer a008d3a9f9 Reduce dyn_cast<> to isa<> or cast<> where possible. Clang edition.
No functional change intended.

llvm-svn: 234587
2015-04-10 11:37:55 +00:00
Jordan Rose 3da3f8e045 [analyzer] Disable all retain count diagnostics on values that come from ivars.
This is imitating a pre-r228174 state where ivars are not considered tracked by
default, but with the addition that even ivars /with/ retain count information
(e.g. "[_ivar retain]; [ivar _release];") are not being tracked as well. This is
to ensure that we don't regress on values accessed through both properties and
ivars, which is what r228174 was trying to fix.

The issue occurs in code like this:

  [_contentView retain];
  [_contentView removeFromSuperview];
  [self addSubview:_contentView]; // invalidates 'self'
  [_contentView release];

In this case, the call to -addSubview: may change the value of self->_contentView,
and so the analyzer can't be sure that we didn't leak the original _contentView.
This is a correct conservative view of the world, but not a useful one. Until we
have a heuristic that allows us to not consider this a leak, not emitting a
diagnostic is our best bet.

This commit disables all of the ivar-related retain count tests, but does not
remove them to ensure that we don't crash trying to evaluate either valid or
erroneous code. The next commit will add a new test for the example above so
that this commit (and the previous one) can be reverted wholesale when a better
solution is implemented.

Rest of rdar://problem/20335433

llvm-svn: 233592
2015-03-30 20:18:00 +00:00
Jordan Rose 218772f87e [analyzer] Don't special-case ivars backing +0 properties.
Give up this checking in order to continue tracking that these values came from
direct ivar access, which will be important in the next commit.

Part of rdar://problem/20335433

llvm-svn: 233591
2015-03-30 20:17:47 +00:00
Jordan Rose 03ad616143 [analyzer] RetainCountChecker: Don't assume +0 for ivars backing readonly properties.
Similarly, don't assume +0 if the property's setter is manually implemented.
In both cases, if the property's ownership is explicitly written, then we /do/
assume the ivar has the same ownership.

rdar://problem/20218183

llvm-svn: 232849
2015-03-20 21:12:27 +00:00
Yaron Keren 1a9f58b32d Fix another ternary Visual C++ is OK wiht but gcc not.
llvm-svn: 232624
2015-03-18 10:30:57 +00:00
Yaron Keren 92e1b62d45 Remove many superfluous SmallString::str() calls.
Now that SmallString is a first-class citizen, most SmallString::str()
calls are not required. This patch removes a whole bunch of them, yet
there are lots more.

There are two use cases where str() is really needed:
1) To use one of StringRef member functions which is not available in
SmallString.
2) To convert to std::string, as StringRef implicitly converts while 
SmallString do not. We may wish to change this, but it may introduce
ambiguity.

llvm-svn: 232622
2015-03-18 10:17:07 +00:00
Ed Schouten e5bdc8516e Enable security checks for arc4random() on CloudABI as well.
CloudABI also supports the arc4random() function. We can enable compiler
warnings for rand(), random() and *rand48() on this system as well.

llvm-svn: 231914
2015-03-11 08:48:55 +00:00
Anton Yartsev 2487dd6501 [analyzer] Make getCheckIfTracked() return either leak or regular checker.
llvm-svn: 231863
2015-03-10 22:24:21 +00:00
Jordan Rose 58f8cc15c9 [analyzer] RetainCountChecker: CF properties are always manually retain-counted.
In theory we could assume a CF property is stored at +0 if there's not a custom
setter, but that's not really worth the complexity. What we do know is that a
CF property can't have ownership attributes, and so we shouldn't assume anything
about the ownership of the ivar.

rdar://problem/20076963

llvm-svn: 231553
2015-03-07 05:47:24 +00:00
Anton Yartsev 80fce4e7da [analyzer] Remove unused type (addition to r231540: "Revert changes from r229593")
llvm-svn: 231548
2015-03-07 01:57:31 +00:00
Anton Yartsev 4eb394d6c1 [analyzer] Revert changes from r229593; an enhancement is under discussion
llvm-svn: 231540
2015-03-07 00:31:53 +00:00
Anton Yartsev 9907fc9053 [analyzer] Bug fix: do not report leaks for alloca()
llvm-svn: 231314
2015-03-04 23:18:21 +00:00
Gabor Horvath e40c71c10a [analyzer] Individual configuration options can be specified for checkers.
Reviewed by: Anna Zaks

Original patch by: Aleksei Sidorin

Differential Revision: http://reviews.llvm.org/D7905

llvm-svn: 231266
2015-03-04 17:59:34 +00:00
Anton Yartsev c38d7952b2 [analyzer] unix.Malloc: preserve AllocaRegion bound to __builtin_alloca().
Binding __builtin_alloca() return value to the symbolic value kills previous binding to a AllocaRegion established by the core.BuiltinFunctions checker. Other checkers may rely upon this information. Rollback handling of __builtin_alloca() to the way prior to r229850.

llvm-svn: 231160
2015-03-03 22:58:46 +00:00
David Majnemer ced8bdf74a Sema: Parenthesized bound destructor member expressions can be called
We would wrongfully reject (a.~A)() in both the destructor and
pseudo-destructor cases.

This fixes PR22668.

llvm-svn: 230512
2015-02-25 17:36:15 +00:00
Jordan Rose 000bac5e17 [analyzer] RetainCountChecker: don't try to track ivars known to be nil.
We expect in general that any nil value has no retain count information
associated with it; violating this results in unexpected state unification
/later/ when we decide to throw the information away. Unexpectedly caching
out can lead to an assertion failure or crash.

rdar://problem/19862648

llvm-svn: 229934
2015-02-19 23:57:04 +00:00
Anton Yartsev 5b5c7cec08 [analyzer] Different handling of alloca().
+ separate bug report for "Free alloca()" error to be able to customize checkers responsible for this error.
+ Muted "Free alloca()" error for NewDelete checker that is not responsible for c-allocated memory, turned on for unix.MismatchedDeallocator checker.
+ RefState for alloca() - to be able to detect usage of zero-allocated memory by upcoming ZeroAllocDereference checker.
+ AF_Alloca family to handle alloca() consistently - keep proper family in RefState, handle 'alloca' by getCheckIfTracked() facility, etc.
+ extra tests.

llvm-svn: 229850
2015-02-19 13:36:20 +00:00
Anton Yartsev e5c0c14213 [analyzer] Refactoring: clarified the way the proper check kind is chosen.
llvm-svn: 229593
2015-02-18 00:39:06 +00:00
Anton Yartsev b3fa86d6f3 [analyzer] Pass actual state to alloc/dealloc handling functions.
The state obtained from CheckerContext::getState() may be outdated by the time the alloc/dealloc handling function is called (e.g. the state was modified but the transition was not performed). State argument was added to all alloc/dealloc handling functions in order to get the latest state and to allow sequential calls to those functions.

llvm-svn: 228737
2015-02-10 20:13:08 +00:00
Benjamin Kramer b4ef66832d Update APIs that return a pair of iterators to return an iterator_range instead.
Convert uses of those APIs into ranged for loops. NFC.

llvm-svn: 228404
2015-02-06 17:25:10 +00:00
Anna Zaks 33f0632640 [analyzer] Do not crash in the KeychainAPI checker on user defined 'free()'.
llvm-svn: 228248
2015-02-05 01:02:56 +00:00
Anna Zaks 486a0ff4b7 [analyzer] Look for allocation site in the parent frames as well as the current one.
Instead of handling edge cases (mostly involving blocks), where we have difficulty finding
an allocation statement, allow the allocation site to be in a parent node.

Previously we assumed that the allocation site can always be found in the same frame
as allocation, but there are scenarios in which an element is leaked in a child
frame but is allocated in the parent.

llvm-svn: 228247
2015-02-05 01:02:53 +00:00
Jordan Rose cb5386cbfc [analyzer] RetainCountChecker: be forgiving when ivars are accessed directly.
A refinement of r204730, itself a refinement of r198953, to better handle
cases where an object is accessed both through a property getter and
through direct ivar access. An object accessed through a property should
always be treated as +0, i.e. not owned by the caller. However, an object
accessed through an ivar may be at +0 or at +1, depending on whether the
ivar is a strong reference. Outside of ARC, we don't always have that
information.

The previous attempt would clear out the +0 provided by a getter, but only
if that +0 hadn't already participated in other retain counting operations.
(That is, "self.foo" is okay, but "[[self.foo retain] autorelease]" is
problematic.) This turned out to not be good enough when our synthesized
getters get involved.

This commit drops the notion of "overridable" reference counting and instead
just tracks whether a value ever came from a (strong) ivar. If it has, we
allow one more release than we otherwise would. This has the added benefit
of being able to catch /some/ overreleases of instance variables, though
it's not likely to come up in practice.

We do still get some false negatives because we currently throw away
refcount state upon assigning a value into an ivar. We should probably
improve on that in the future, especially once we synthesize setters as
well as getters.

rdar://problem/18075108

llvm-svn: 228174
2015-02-04 19:24:52 +00:00
Reid Kleckner ee7cf84c8f Use nullptr to silence -Wsentinel when self-hosting on Windows
Richard rejected my Sema change to interpret an integer literal zero in
a varargs context as a null pointer, so -Wsentinel sees an integer
literal zero and fires off a warning. Only CodeGen currently knows that
it promotes integer literal zeroes in this context to pointer size on
Windows.  I didn't want to teach -Wsentinel about that compatibility
hack. Therefore, I'm migrating to C++11 nullptr.

llvm-svn: 223079
2014-12-01 22:02:27 +00:00
Reid Kleckner 8cd0079d16 Use the new LLVM_END_WITH_NULL name
llvm-svn: 221217
2014-11-04 01:13:43 +00:00
Anton Yartsev 6ca45c92a9 [analyzer] Move the NewDeleteLeaks checker from CplusplusAlpha to Cplusplus package.
llvm-svn: 220289
2014-10-21 12:41:36 +00:00
Ted Kremenek 0c28bc20da [analyzer] Tweak MallocSizeOfChecker to not warn when using sizeof(void*) to allocate a bunch of any pointer type.
This suppresses a common false positive when analyzing libc++.

Along the way, introduce some tests to show this checker actually
works with C++ static_cast<>.

llvm-svn: 220160
2014-10-19 07:30:55 +00:00
Jordan Rose 679659f58c [analyzer] Check all 'nonnull' attributes, not just the first one.
Patch by Daniel Fahlgren!

llvm-svn: 219625
2014-10-13 19:38:02 +00:00
Benjamin Kramer 719772c269 Remove stray enum keywords. MSVC sees this as a redeclaration at global scope.
llvm-svn: 219031
2014-10-03 22:20:30 +00:00
Anna Zaks 0820e13e2a [analyzer] Refactor and cleanup IsCompleteType
There are three copies of IsCompleteType(...) functions in CSA and all
of them are incomplete (I experienced  crashes in some CSA's test cases).
I have replaced these function calls with Type::isIncompleteType() calls.

A patch by Aleksei Sidorin!

llvm-svn: 219026
2014-10-03 21:49:03 +00:00
Anna Zaks d79b840716 [analyzer] Make Malloc Checker track memory allocated by if_nameindex
The MallocChecker does currently not track the memory allocated by
if_nameindex. That memory is dynamically allocated and should be freed
by calling if_freenameindex. The attached patch teaches the checker
about these functions.

Memory allocated by if_nameindex is treated as a separate allocation
"family". That way the checker can verify it is freed by the correct
function.

A patch by Daniel Fahlgren!

llvm-svn: 219025
2014-10-03 21:48:59 +00:00
Anna Zaks 2d2f137ed4 [analyzer] Make CStringChecker correctly calculate return value of mempcpy
The return value of mempcpy is only correct when the destination type is
one byte in size. This patch casts the argument to a char* so the
calculation is also correct for structs, ints etc.

A patch by Daniel Fahlgren!

llvm-svn: 219024
2014-10-03 21:48:54 +00:00
Benjamin Kramer 22c68ef845 Avoid some unnecessary SmallVector copies.
No functionality change.

llvm-svn: 217586
2014-09-11 14:13:49 +00:00
Jordan Rose 21933ccdd7 Teach the analyzer that __builtin_assume_aligned returns its first argument.
Patch by Daniel Fahlgren!

llvm-svn: 217461
2014-09-09 21:42:16 +00:00
Jordan Rose f69e65f75c [analyzer] Don't crash if malloc() has an unexpected function prototype.
Patch by Daniel Fahlgren!

llvm-svn: 217258
2014-09-05 16:33:51 +00:00
David Blaikie 91e7902622 unique_ptrify BugReporter::visitors
llvm-svn: 217205
2014-09-04 23:54:33 +00:00
David Blaikie d15481ccea unique_ptr-ify PathDiagnosticPiece ownership
llvm-svn: 216751
2014-08-29 18:18:43 +00:00
Richard Smith 588bd9b7f8 Fix representation of __attribute__((nonnull)) to support correctly modeling
the no-arguments case. Don't expand this to an __attribute__((nonnull(A, B,
C))) attribute, since that does the wrong thing for function templates and
varargs functions.

In passing, fix a grammar error in the diagnostic, a crash if
__attribute__((nonnull(N))) is applied to a varargs function,
a bug where the same null argument could be diagnosed multiple
times if there were multiple nonnull attributes referring to it,
and a bug where nonnull attributes would not be accumulated correctly
across redeclarations.

llvm-svn: 216520
2014-08-27 04:59:42 +00:00
Jordan Rose 19ecd635fe [analyzer] Remove check covered by -Wobjc-missing-super-calls.
The ObjCDealloc checker is currently disabled because it was too aggressive, but this
is a good first step in getting it back to a useful state.

Patch by David Kilzer!

llvm-svn: 216272
2014-08-22 16:57:33 +00:00
Fariborz Jahanian 78e9debf68 Objective-C. Warn if user has made explicit call
to +initilize as this results in an extra call
to this method. rdar://16628028

llvm-svn: 216271
2014-08-22 16:57:26 +00:00
Benjamin Kramer cb4efc1028 [analyzer] Don't warn on virtual calls in ctors to final methods.
The call will never go to a more derived class, but that's intentional in those
cases.

llvm-svn: 216167
2014-08-21 10:25:03 +00:00
Jordan Rose ba129af62a [analyzer] UnixAPI: Check that the third argument to open(2) (if present) is an integer.
Patch by Daniel Fahlgren.

llvm-svn: 216079
2014-08-20 16:58:09 +00:00
Jordan Rose cd4db5c6d2 [analyzer] UnixAPI: Check when open(2) is called with more than three arguments.
Patch by Daniel Fahlgren.

llvm-svn: 216078
2014-08-20 16:58:03 +00:00
Jordan Rose f3544e913d [analyzer] IdenticalExpr: don't try to compare integer literals with different widths.
PR20659. Patch by Anders Rönnholm.

llvm-svn: 216076
2014-08-20 16:51:26 +00:00
Jordan Rose b6100301e8 [analyzer] IdenticalExpr: use getBytes rather than getString to compare string literals.
PR20693. Patch by Anders Rönnholm.

llvm-svn: 216075
2014-08-20 16:51:18 +00:00
Benjamin Kramer 2f5db8b3db Header guard canonicalization, clang part.
Modifications made by clang-tidy with minor tweaks.

llvm-svn: 215557
2014-08-13 16:25:19 +00:00
Jordan Rose 1a9c0d141c [analyzer] Check for negative values used as the size of a C variable-length array.
Patch by Daniel Fahlgren!

llvm-svn: 215456
2014-08-12 16:44:22 +00:00
Anton Yartsev 4e4cb6bc30 [Analyzer] fix for PR19102
Newly-created unconsumed instance is now assumed escaped if an invoked constructor has an argument of a pointer-to-record type.

llvm-svn: 214909
2014-08-05 18:26:05 +00:00
NAKAMURA Takumi 5787cc2ccf TestAfterDivZeroChecker.cpp: Avoid member initializer. It is unsupported in msc17.
llvm-svn: 212789
2014-07-11 00:32:35 +00:00
Jordan Rose dc352bb82b [analyzer] Check for code testing a variable for 0 after using it as a denominator.
This new checker, alpha.core.TestAfterDivZero, catches issues like this:

  int sum = ...
  int avg = sum / count; // potential division by zero...
  if (count == 0) { ... } // ...caught here

Because the analyzer does not necessarily explore /all/ paths through a program,
this check is restricted to only work on zero checks that immediately follow a
division operation (/ % /= %=). This could later be expanded to handle checks
dominated by a division operation but not necessarily in the same CFG block.

Patch by Anders Rönnholm! (with very minor modifications by me)

llvm-svn: 212731
2014-07-10 16:10:52 +00:00
Alp Toker f994cef836 Track IntrusiveRefCntPtr::get() changes from LLVM r212366
llvm-svn: 212369
2014-07-05 03:08:06 +00:00
Jordan Rose e3f310f3bd [analyzer] Check for NULL passed to CFAutorelease.
Patch by Sean McBride, tests adjusted by me.

llvm-svn: 211453
2014-06-21 23:50:40 +00:00
Anna Zaks a6fea1386f Fix a crash in Retain Count checker error reporting
Fixes a crash in Retain Count checker error reporting logic by handing
the allocation statement retrieval from a BlockEdge program point.

Also added a simple CFG dump routine for debugging.

llvm-svn: 210960
2014-06-13 23:47:38 +00:00
Richard Trieu c771d5d79f Move the logic for testing for namespace std into one location. This check can
be performed by using Decl::isInStdNamespace or DeclContext::isStdNamespace

llvm-svn: 209708
2014-05-28 02:16:01 +00:00
Craig Topper 0dbb783c7b [C++11] Use 'nullptr'. StaticAnalyzer edition.
llvm-svn: 209642
2014-05-27 02:45:47 +00:00
Eric Christopher c9e2a68905 Clean up language and grammar.
Based on a patch by jfcaron3@gmail.com!
PR19806

llvm-svn: 209215
2014-05-20 17:10:39 +00:00
Alp Toker c3f36af8d0 Fix typos
llvm-svn: 208838
2014-05-15 01:35:53 +00:00
Nico Weber 1fa575dcc6 NSOrCFErrorDerefChecker: Don't leak bug type. Similar to r208110/r208155. Found by LSan.
llvm-svn: 208251
2014-05-07 21:28:03 +00:00
Jordan Rose 49afeb072f [analyzer] Use a lazily-initialized BugType in ObjCSelfInitChecker.
Follow-up to Nico's leak-stopping patch in r208110.

llvm-svn: 208155
2014-05-07 03:30:04 +00:00
Nico Weber 7ce830bb67 Fix leak in ObjCSelfInitChecker, found by LSan.
BugReport doesn't take ownership of the bug type, so let the checker own the
the bug type.  (Requires making the bug type mutable, which is icky, but which
is also what other checkers do.)

llvm-svn: 208110
2014-05-06 17:33:42 +00:00
Aaron Ballman a82eaa70f1 Updated the attribute tablegen emitter for variadic arguments to emit a range accessor in addition to the iterators. Updated code using iterators to use range-based for loops.
llvm-svn: 207837
2014-05-02 13:35:42 +00:00
Chandler Carruth 1034666777 [Modules] Fix potential ODR violations by sinking the DEBUG_TYPE
definition below all of the header #include lines, clang edition.

If you want more details about this, you can see some of the commits to
Debug.h in LLVM recently. This is just the clang section of a cleanup
I've done for all uses of DEBUG_TYPE in LLVM.

llvm-svn: 206849
2014-04-22 03:17:02 +00:00
Richard Trieu c65a56901f Add missing include.
llvm-svn: 205828
2014-04-09 03:31:44 +00:00
Jordan Rose 0675c87395 [analyzer] When checking Foundation method calls, match the selectors exactly.
This also includes some infrastructure to make it easier to build multi-argument
selectors, rather than trying to use string matching on each piece. There's a bit
more setup code, but less cost at runtime.

PR18908

llvm-svn: 205827
2014-04-09 01:39:22 +00:00
Jordan Rose 3a176ed16d [analyzer] Lock checker: Allow pthread_mutex_init to reinitialize a destroyed lock.
Patch by Daniel Fahlgren!

llvm-svn: 205276
2014-04-01 03:40:53 +00:00
Jordan Rose 7fcaa14a82 [analyzer] Lock checker: make sure locks aren't used after being destroyed.
Patch by Daniel Fahlgren!

llvm-svn: 205275
2014-04-01 03:40:47 +00:00
Jordan Rose 0696bb4cef [analyzer] Add double-unlock detection to PthreadLockChecker.
We've decided to punt on supporting recursive locks for now; the common case
is non-recursive.

Patch by Daniel Fahlgren!

llvm-svn: 205274
2014-04-01 03:40:38 +00:00
Jordan Rose 6b33c6f234 [analyzer] Handle the M_ZERO and __GFP_ZERO flags in kernel mallocs.
Add M_ZERO awareness to malloc() static analysis in Clang for FreeBSD,
NetBSD, and OpenBSD in a similar fashion to O_CREAT for open(2).
These systems have a three-argument malloc() in the kernel where the
third argument contains flags; the M_ZERO flag will zero-initialize the
allocated buffer.

This should reduce the number of false positives when running static
analysis on BSD kernels.

Additionally, add kmalloc() (Linux kernel malloc()) and treat __GFP_ZERO
like M_ZERO on Linux.

Future work involves a better method of checking for named flags without
hardcoding values.

Patch by Conrad Meyer, with minor modifications by me.

llvm-svn: 204832
2014-03-26 17:05:46 +00:00
Jordan Rose b3ad07e0a6 [analyzer] Don't track retain counts of objects directly accessed through ivars.
A refinement of r198953 to handle cases where an object is accessed both through
a property getter and through direct ivar access. An object accessed through a
property should always be treated as +0, i.e. not owned by the caller. However,
an object accessed through an ivar may be at +0 or at +1, depending on whether
the ivar is a strong reference. Outside of ARC, we don't have that information,
so we just don't track objects accessed through ivars.

With this change, accessing an ivar directly will deliberately override the +0
provided by a getter, but only if the +0 hasn't participated in other retain
counting yet. That isn't perfect, but it's already unusual for people to be
mixing property access with direct ivar access. (The primary use case for this
is in setters, init methods, and -dealloc.)

Thanks to Ted for spotting a few mistakes in private review.

<rdar://problem/16333368>

llvm-svn: 204730
2014-03-25 17:10:58 +00:00
Nuno Lopes fb744589bc remove a bunch of unused private methods
found with a smarter version of -Wunused-member-function that I'm playwing with.
Appologies in advance if I removed someone's WIP code.

 ARCMigrate/TransProperties.cpp                  |    8 -----
 AST/MicrosoftMangle.cpp                         |    1 
 Analysis/AnalysisDeclContext.cpp                |    5 ---
 Analysis/LiveVariables.cpp                      |   14 ----------
 Index/USRGeneration.cpp                         |   10 -------
 Sema/Sema.cpp                                   |   33 +++++++++++++++++++++---
 Sema/SemaChecking.cpp                           |    3 --
 Sema/SemaDecl.cpp                               |   20 ++------------
 StaticAnalyzer/Checkers/GenericTaintChecker.cpp |    1 
 9 files changed, 34 insertions(+), 61 deletions(-)

llvm-svn: 204561
2014-03-23 17:12:37 +00:00
Craig Topper fb6b25b5e4 [C++11] Add 'override' keyword to virtual methods that override their base class.
llvm-svn: 203999
2014-03-15 04:29:04 +00:00
Aaron Ballman 535bbcccb1 [C++11] Replacing DeclStmt iterators decl_begin() and decl_end() with iterator_range decls(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203947
2014-03-14 17:01:24 +00:00
Aaron Ballman d85eff49a3 [C++11] Replacing ObjCCategoryDecl iterators propimpl_begin() and propimpl_end() with iterator_range property_impls(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203930
2014-03-14 15:02:45 +00:00
Aaron Ballman 0f6e64d505 [C++11] Replacing ObjCProtocolDecl iterators protocol_begin() and protocol_end() with iterator_range protocols(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203863
2014-03-13 22:58:06 +00:00
Aaron Ballman f53d8dd37d [C++11] Replacing ObjCInterfaceDecl iterators visible_extensions_begin() and visible_extensions_end() with iterator_range visible_extensions(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203855
2014-03-13 21:47:07 +00:00
Aaron Ballman 3fe486a332 [C++11] Replacing ObjCInterfaceDecl iterators visible_categories_begin() and visible_categories_end() with iterator_range visible_categories(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203851
2014-03-13 21:23:55 +00:00
Aaron Ballman 59abbd4d9b [C++11] Replacing ObjCInterfaceDecl iterators ivar_begin() and ivar_end() with iterator_range ivars(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203849
2014-03-13 21:09:43 +00:00
Aaron Ballman a49c5064a1 [C++11] Replacing ObjCInterfaceDecl iterators protocol_begin() and protocol_end() with iterator_range protocols(). Updating all of the usages of the iterators with range-based for loops.
Drive-by fixing some incorrect types where a for loop would be improperly using ObjCInterfaceDecl::protocol_iterator. No functional changes in these cases.

llvm-svn: 203842
2014-03-13 20:29:09 +00:00
Aaron Ballman f26acce6f7 [C++11] Replacing ObjCContainerDecl iterators instmeth_begin() and instmeth_end() with iterator_range instance_methods(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203839
2014-03-13 19:50:17 +00:00
Aaron Ballman d174edffa0 Renaming the recently-created (r203830) props() range API to properties() for clarity.
llvm-svn: 203835
2014-03-13 19:11:50 +00:00
Aaron Ballman aff18c0446 [C++11] Replacing ObjCContainerDecl iterators meth_begin() and meth_end() with iterator_range methods(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203832
2014-03-13 19:03:34 +00:00
Aaron Ballman dc4bea4676 [C++11] Replacing ObjCContainerDecl iterators prop_begin() and prop_end() with iterator_range props(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203830
2014-03-13 18:47:37 +00:00
Jordan Rose 821a3a0f77 [analyzer] Warn when passing pointers to const but uninitialized memory.
Passing a pointer to an uninitialized memory buffer is normally okay,
but if the function is declared to take a pointer-to-const then it's
very unlikely it will be modifying the buffer. In this case the analyzer
should warn that there will likely be a read of uninitialized memory.

This doesn't check all elements of an array, only the first one.
It also doesn't yet check Objective-C methods, only C functions and
C++ methods.

This is controlled by a new check: alpha.core.CallAndMessageUnInitRefArg.

Patch by Per Viberg!

llvm-svn: 203822
2014-03-13 17:55:39 +00:00
Aaron Ballman 2a4bd6d189 [C++11] Replacing CXXRecordDecl iterators ctor_begin() and ctor_end() with iterator_range ctors(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203814
2014-03-13 16:51:27 +00:00
Aaron Ballman 574705ed7f [C++11] Replacing CXXRecordDecl iterators bases_begin() and bases_end() with iterator_range bases(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203803
2014-03-13 15:41:46 +00:00
Jordan Rose a6839aaa9b [analyzer] Check all conditions in a chained if against each other.
Like the binary operator check of r201702, this actually checks the
condition of every if in a chain against every other condition, an
O(N^2) operation. In most cases N should be small enough to make this
practical, and checking all cases like this makes it much more likely
to catch a copy-paste error within the same series of branches.

Part of IdenticalExprChecker; patch by Daniel Fahlgren!

llvm-svn: 203585
2014-03-11 16:52:29 +00:00
Aaron Ballman be22bcb180 [C++11] Replacing DeclBase iterators specific_attr_begin() and specific_attr_end() with iterator_range specific_attrs(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203474
2014-03-10 17:08:28 +00:00
Aaron Ballman e8a8baef44 [C++11] Replacing RecordDecl iterators field_begin() and field_end() with iterator_range fields(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203355
2014-03-08 20:12:42 +00:00
Benjamin Kramer 4cadf292a5 [C++11] Revert uses of lambdas with array_pod_sort.
Looks like GCC implements the lambda->function pointer conversion differently.

llvm-svn: 203293
2014-03-07 21:51:58 +00:00
Benjamin Kramer 15ae783e14 [C++11] Convert sort predicates into lambdas.
No functionality change.

llvm-svn: 203289
2014-03-07 21:35:40 +00:00
Ahmed Charles b89843299a Replace OwningPtr with std::unique_ptr.
This compiles cleanly with lldb/lld/clang-tools-extra/llvm.

llvm-svn: 203279
2014-03-07 20:03:18 +00:00
Aaron Ballman 629afaefe0 [C++11] Replacing DeclBase iterators decls_begin() and decls_end() with iterator_range decls(). The same is true for the noload versions of these APIs. Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203278
2014-03-07 19:56:05 +00:00
Aaron Ballman 43b68bebe7 [C++11] Replacing ObjCMethodDecl iterators param_begin() and param_end() with iterator_range params(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203255
2014-03-07 17:50:17 +00:00
Aaron Ballman f6bf62e2d0 [C++11] Replacing FunctionDecl iterators param_begin() and param_end() with iterator_range params(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203248
2014-03-07 15:12:56 +00:00
Benjamin Kramer 867ea1d426 [C++11] Replace llvm::tie with std::tie.
llvm-svn: 202639
2014-03-02 13:01:17 +00:00
Ted Kremenek 4b408e7a04 [analyzer] check for now possibly null predecessor edge.
llvm-svn: 202434
2014-02-27 21:56:41 +00:00
NAKAMURA Takumi 9698686505 [CMake] Use LINK_LIBS instead of target_link_libraries().
llvm-svn: 202238
2014-02-26 06:41:29 +00:00
Jordan Rose e359d0168f [analyzer] NonNullParamChecker: don't freak out about nested transparent_unions.
For now, just ignore them. Later, we could try looking through LazyCompoundVals,
but we at least shouldn't crash.

<rdar://problem/16153464>

llvm-svn: 202212
2014-02-26 01:20:19 +00:00
NAKAMURA Takumi 7da9487dd4 [CMake] Get rid of explicit dependencies to include/clang/*.inc and introduce CLANG_TABLEGEN_TARGETS.
This does;
  - clang_tablegen() adds each tblgen'd target to global property CLANG_TABLEGEN_TARGETS as list.
  - List of targets is added to LLVM_COMMON_DEPENDS.
  - all clang libraries and targets depend on generated headers.

You might wonder this would be regression, but in fact, this is little loss.
  - Almost all of clang libraries depend on tblgen'd files and clang-tblgen.
  - clang-tblgen may cause short stall-out but doesn't cause unconditional rebuild.
  - Each library's dependencies to tblgen'd files might vary along headers' structure.
    It made hard to track and update *really optimal* dependencies.

Each dependency to intrinsics_gen and ClangSACheckers is left as DEPENDS.

llvm-svn: 201842
2014-02-21 07:59:59 +00:00
Jordan Rose 45d71a2715 [analyzer] Fix a bug in IdenticalExprChecker concerning while loops.
Somehow both Daniel and I missed the fact that while loops are only identical
if they have identical bodies.

Patch by Daniel Fahlgren!

llvm-svn: 201829
2014-02-21 00:18:31 +00:00
Jordan Rose 94008121fa [analyzer] Extend IdenticalExprChecker to check logical and bitwise expressions.
IdenticalExprChecker now warns if any expressions in a logical or bitwise
chain (&&, ||, &, |, or ^) are the same. Unlike the previous patch, this
actually checks all subexpressions against each other (an O(N^2) operation,
but N is likely to be small).

Patch by Daniel Fahlgren!

llvm-svn: 201702
2014-02-19 17:44:16 +00:00
Jordan Rose 70e7e8718e [analyzer] Extend IdenticalExprChecker to check the two branches of an if.
This extends the checks for identical expressions to handle identical
statements, and compares the consequent and alternative ("then" and "else")
branches of an if-statement to see if they are identical, treating a single
statement surrounded by braces as equivalent to one without braces.

This does /not/ check subsequent branches in an if/else chain, let alone
branches that are not consecutive. This may improve in a future patch, but
it would certainly take more work.

Patch by Daniel Fahlgren!

llvm-svn: 201701
2014-02-19 17:44:11 +00:00
Ted Kremenek 8dd916d6b1 [analyzer] Move checker alpha.osx.cocoa.MissingSuperCall out of alpha category.
llvm-svn: 201640
2014-02-19 05:28:39 +00:00
Jordan Rose 97d2c9cae7 [analyzer] Teach CastSizeChecker about flexible array members.
...as well as fake flexible array members: structs that end in arrays with
length 0 or 1.

Patch by Daniel Fahlgren!

llvm-svn: 201583
2014-02-18 17:06:30 +00:00
Anton Yartsev 6a61922239 [analyzer] Improved checker naming in CFG dump.
This implements FIXME from Checker.cpp (FIXME: We want to return the package + name of the checker here.) and replaces hardcoded checker names with the new ones obtained via getCheckName().getName().

llvm-svn: 201525
2014-02-17 18:25:34 +00:00
Alexander Kornienko 4aca9b1cd8 Expose the name of the checker producing each diagnostic message.
Summary:
In clang-tidy we'd like to know the name of the checker producing each
diagnostic message. PathDiagnostic has BugType and Category fields, which are
both arbitrary human-readable strings, but we need to know the exact name of the
checker in the form that can be used in the CheckersControlList option to
enable/disable the specific checker.

This patch adds the CheckName field to the CheckerBase class, and sets it in
the CheckerManager::registerChecker() method, which gets them from the
CheckerRegistry.

Checkers that implement multiple checks have to store the names of each check
in the respective registerXXXChecker method.

Reviewers: jordan_rose, krememek

Reviewed By: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2557

llvm-svn: 201186
2014-02-11 21:49:21 +00:00
Jordan Rose 4393aa7efb [analyzer] Objective-C object literals are always non-nil.
<rdar://problem/15999214>

llvm-svn: 201007
2014-02-08 00:04:14 +00:00
NAKAMURA Takumi 413496f89b [CMake] Prune stray entries in add_dependencies(). target_link_libraries() implies it.
llvm-svn: 200531
2014-01-31 11:19:04 +00:00
Alp Toker 314cc81b8c Rename getResultType() on function and method declarations to getReturnType()
A return type is the declared or deduced part of the function type specified in
the declaration.

A result type is the (potentially adjusted) type of the value of an expression
that calls the function.

Rule of thumb:

  * Declarations have return types and parameters.
  * Expressions have result types and arguments.

llvm-svn: 200082
2014-01-25 16:55:45 +00:00
Jordan Rose 6adadb9bc2 [analyzer] Future-proof MallocChecker CFG dumping.
Now we'll get a warning if we miss a case. Refinement of r199800.

llvm-svn: 199868
2014-01-23 03:59:01 +00:00
Anton Yartsev fee669054f [analyzer] The patch prevents the analyzer from crashing during CFG dump.
llvm-svn: 199800
2014-01-22 13:19:48 +00:00
Alp Toker 9cacbabd33 Rename FunctionProtoType accessors from 'arguments' to 'parameters'
Fix a perennial source of confusion in the clang type system: Declarations and
function prototypes have parameters to which arguments are supplied, so calling
these 'arguments' was a stretch even in C mode, let alone C++ where default
arguments, templates and overloading make the distinction important to get
right.

Readability win across the board, especially in the casting, ADL and
overloading implementations which make a lot more sense at a glance now.

Will keep an eye on the builders and update dependent projects shortly.

No functional change.

llvm-svn: 199686
2014-01-20 20:26:09 +00:00
Ted Kremenek 115c3f7a36 [analyzer] Fix incorrect spelling of 'pthread_rwlock_trywrlock'. Patch by Jean Baptiste Noblot.
llvm-svn: 199499
2014-01-17 16:06:43 +00:00
Ted Kremenek f0ae7d0201 [analyzer] Teach NonNullParamChecker about 'nonnull' attributes on parameters.
llvm-svn: 199473
2014-01-17 07:15:35 +00:00
Jordan Rose 2a833ca575 [analyzer] BlockCall shouldn't really be an AnyFunctionCall.
Per discussion with Anna a /long/ time ago, it was way too easy to misuse
BlockCall: because it inherited from AnyFunctionCall (through SimpleCall),
getDecl() was constrained to return a FunctionDecl, and you had to call
getBlockDecl() instead. This goes against the whole point of CallEvent
(to abstract over different ways to invoke bodies of code).

Now, BlockCall just inherits directly from CallEvent. There's a bit of
duplication in getting things out of the origin expression (which is still
known to be a CallExpr), but nothing significant.

llvm-svn: 199321
2014-01-15 17:25:15 +00:00
Jordan Rose e02e96a69f [analyzer] Print function name when dumping its CFG.
This allows us to use CHECK-LABEL to ensure that we're checking the right CFG.

Debugging change only.

llvm-svn: 199320
2014-01-15 17:25:05 +00:00
Ted Kremenek 0f83390540 Teach DeadStoresChecker about attribute objc_precise_lifetime.
llvm-svn: 199277
2014-01-15 00:59:23 +00:00
Jordan Rose 1a866cd54b [analyzer] Model getters of known-@synthesized Objective-C properties.
...by synthesizing their body to be "return self->_prop;", with an extra
nudge to RetainCountChecker to still treat the value as +0 if we have no
other information.

This doesn't handle weak properties, but that's mostly correct anyway,
since they can go to nil at any time. This also doesn't apply to properties
whose implementations we can't see, since they may not be backed by an
ivar at all. And finally, this doesn't handle properties of C++ class type,
because we can't invoke the copy constructor. (Sema has actually done this
work already, but the AST it synthesizes is one the analyzer doesn't quite
handle -- it has an rvalue DeclRefExpr.)

Modeling setters is likely to be more difficult (since it requires
handling strong/copy), but not impossible.

<rdar://problem/11956898>

llvm-svn: 198953
2014-01-10 20:06:06 +00:00
Jordan Rose 656fdd55dd [analyzer] Warn about double-delete in C++ at the second delete...
...rather somewhere in the destructor when we try to access something and
realize the object has already been deleted. This is necessary because
the destructor is processed before the 'delete' itself.

Patch by Karthik Bhat!

llvm-svn: 198779
2014-01-08 18:46:55 +00:00
Jordan Rose 514f935411 [analyzer] Pointers escape into +[NSValue valueWithPointer:]...
...even though the argument is declared "const void *", because this is
just a way to pass pointers around as objects. (Though NSData is often
a better one.)

PR18262

llvm-svn: 198710
2014-01-07 21:39:48 +00:00
Jordan Rose 6ad4cb4eca [analyzer] Remove unused ARCNotOwnedSymbol retain count return effect.
RetainCountChecker has to track returned object values to know if they are
retained or not. Under ARC, even methods that return +1 are tracked by the
system and should be treated as +0. However, this effect behaves exactly
like NotOwned(ObjC), i.e. a generic Objective-C method that actually returns
+0, so we don't need a special case for it.

No functionality change.

llvm-svn: 198709
2014-01-07 21:39:41 +00:00
Chandler Carruth 5553d0d4ca Sort all the #include lines with LLVM's utils/sort_includes.py which
encodes the canonical rules for LLVM's style. I noticed this had drifted
quite a bit when cleaning up LLVM, so wanted to clean up Clang as well.

llvm-svn: 198686
2014-01-07 11:51:46 +00:00
Alp Toker ef6b007dc5 Only mark dump() function definitions 'used' in debug builds
This has the dual effect of (1) enabling more dead-stripping in release builds
and (2) ensuring that debug helper functions aren't stripped away in debug
builds, as they're intended to be called from the debugger.

Note that the attribute is applied to definitions rather than declarations in
headers going forward because it's now conditional on NDEBUG:

  /// \brief Mark debug helper function definitions like dump() that should not be
  /// stripped from debug builds.

Requires corresponding macro added in LLVM r198456.

llvm-svn: 198489
2014-01-04 13:47:14 +00:00
Ted Kremenek 776409286b [analyzer] Remove IdempotentOperations checker.
This checker has not been updated to work with interprocedural analysis,
and actually contains both logical correctness issues but also
memory bugs.  We can resuscitate it from version control once there
is focused interest in making it a real viable checker again.

llvm-svn: 198476
2014-01-04 05:52:11 +00:00
Aaron Ballman b190f974c9 Fixed a FIXME; created a print method for Selectors that accepts a raw_ostream, and started using it in places it made sense.
No functional changes intended, just API cleanliness.

llvm-svn: 198428
2014-01-03 17:59:55 +00:00
Ted Kremenek 9b12e72376 [analyzer] Don't track return value of NSNull +null for retain/release tracking.
Fixes <rdar://problem/12858915>.

llvm-svn: 198388
2014-01-03 01:19:28 +00:00
Aaron Ballman 2ef6a435f4 Fixing a compile error that recently started happening for me in MSVC 2013. CFGTerminator has an explicit conversion to bool operator that we can make use of instead of using == 0.
llvm-svn: 198175
2013-12-29 18:59:54 +00:00
Alp Toker a724cff01b Rename isBuiltinCall() to getBuiltinCallee()
This better describes what the function does.

Cleanup only.

llvm-svn: 198127
2013-12-28 21:59:02 +00:00
Aaron Ballman 9ead1243a5 Replacing calls to getAttr with calls to hasAttr for clarity. No functional change intended -- this only replaces Boolean uses of getAttr.
llvm-svn: 197648
2013-12-19 02:39:40 +00:00
Alp Toker cbb9034e2a Eliminate BinaryTypeTraitExpr
There's nothing special about type traits accepting two arguments.

This commit eliminates BinaryTypeTraitExpr and switches all related handling
over to TypeTraitExpr.

Also fixes a CodeGen failure with variadic type traits appearing in a
non-constant expression.

The BTT/TT prefix and evaluation code is retained as-is for now but will soon
be further cleaned up.

This is part of the ongoing work to unify type traits.

llvm-svn: 197273
2013-12-13 20:49:58 +00:00
Jordan Rose 6f2f39006b [analyzer] Misc. tidying in IdenticalExprChecker.
Some things I missed when this first went in.

llvm-svn: 196938
2013-12-10 18:18:10 +00:00
Jordan Rose 60bd88d341 [analyzer] Extend IdenticalExprChecker to check ternary operator results.
Warn if both result expressions of a ternary operator (? :) are the same.
Because only one of them will be executed, this warning will fire even if
the expressions have side effects.

Patch by Anders Rönnholm and Per Viberg!

llvm-svn: 196937
2013-12-10 18:18:06 +00:00
NAKAMURA Takumi 65d42bcc2b [CMake] clang/lib: Satisfy dependencies to add *actually used* libraries on target_link_libraries() and LLVM_LINK_COMPONENTS.
I will prune redundant dependencies later.

llvm-svn: 196800
2013-12-09 19:04:43 +00:00
Alp Toker f6a24ce40f Fix a tranche of comment, test and doc typos
llvm-svn: 196510
2013-12-05 16:25:25 +00:00
Alp Toker 5faf0c00dc Correct a user-visible static analyzer message typo
llvm-svn: 196062
2013-12-02 03:50:25 +00:00
Alp Toker 965f882588 Remove a whole lot of unused variables
There are about 30 removed in this patch, generated by a new FixIt I haven't
got round to submitting yet.

llvm-svn: 195814
2013-11-27 05:22:15 +00:00
Richard Smith 852e9ce3dd Remove 'DistinctSpellings' support from Attr.td and change its only user to
look at the attribute spelling instead. The 'ownership_*' attributes should
probably be split into separate *Attr classes, but that's more than I wanted to
do here.

llvm-svn: 195805
2013-11-27 01:46:48 +00:00
Anton Yartsev 968c60a554 [analyzer] Better modeling of memcpy by the CStringChecker (PR16731).
New rules of invalidation/escape of the source buffer of memcpy: the source buffer contents is invalidated and escape while the source buffer region itself is neither invalidated, nor escape.
In the current modeling of memcpy the information about allocation state of regions, accessible through the source buffer, is not copied to the destination buffer and we can not track the allocation state of those regions anymore. So we invalidate/escape the source buffer indirect regions in anticipation of their being invalidated for real later. This eliminates false-positive leaks reported by the unix.Malloc and alpha.cplusplus.NewDeleteLeaks checkers for the cases like

char *f() {
  void *x = malloc(47);
  char *a;
  memcpy(&a, &x, sizeof a);
  return a;
}

llvm-svn: 194953
2013-11-17 09:18:48 +00:00
Jordan Rose dba2692865 [analyzer] Treat MSVC's _wassert as noreturn.
This makes sure the analyzer actually honors assert() in an MSVC project.

Patch by Anders Montonen!

llvm-svn: 194716
2013-11-14 17:55:00 +00:00
Benjamin Kramer e8a2c18bc7 Move classes into anonymous namespaces.
llvm-svn: 194706
2013-11-14 15:46:10 +00:00
Jordan Rose 5650bcb18e Revert 'Tweak ContainerNonEmptyMap with "int" instead of "bool"'.
I've added the missing ImutProfileInfo [sic] specialization for bool,
so this patch on r194235 is no longer needed.

This reverts r194244 / 2baea2887dfcf023c8e3560e5d4713c42eed7b6b.

llvm-svn: 194265
2013-11-08 17:23:33 +00:00
NAKAMURA Takumi d23177a27e StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp: Tweak ContainerNonEmptyMap with "int" instead of "bool", to appease building since r194235.
In ADT/ImmutableSet, ImutProfileInfo<bool> cannot be matched to ImutProfileInteger.
I didn't have idea it'd the right way if PROFILE_INTEGER_INFO(bool) could be added there.

llvm-svn: 194244
2013-11-08 04:00:53 +00:00
Jordan Rose 51327f9237 [analyzer] Add IdenticalExprChecker, to find copy-pasted code.
This syntactic checker looks for expressions on both sides of comparison
operators that are structurally the same. As a special case, the
floating-point idiom "x != x" for "isnan(x)" is left alone.

Currently this only checks comparison operators, but in the future we could
extend this to include logical operators or chained if-conditionals.

Checker by Per Viberg!

llvm-svn: 194236
2013-11-08 01:15:39 +00:00
Jordan Rose 1a4ae202c7 [analyzer] Track whether an ObjC for-in loop had zero iterations.
An Objective-C for-in loop will have zero iterations if the collection is
empty. Previously, we could only detect this case if the program asked for
the collection's -count /before/ the for-in loop. Now, the analyzer
distinguishes for-in loops that had zero iterations from those with at
least one, and can use this information to constrain the result of calling
-count after the loop.

In order to make this actually useful, teach the checker that methods on
NSArray, NSDictionary, and the other immutable collection classes don't
change the count.

<rdar://problem/14992886>

llvm-svn: 194235
2013-11-08 01:15:35 +00:00
Anna Zaks 3d46ac66d8 [analyzer] Track the count of NSOrderedSet similarly to other fast enumerations.
llvm-svn: 194005
2013-11-04 19:13:08 +00:00
NAKAMURA Takumi a67c9c32aa StaticAnalyzer/Checkers/DynamicTypePropagation.cpp: Fix in comments. 80-col and an utf8 char.
llvm-svn: 193513
2013-10-28 04:14:33 +00:00
Benjamin Kramer 1d5d634c82 Forgot some references to misspelled enums.
llvm-svn: 193047
2013-10-20 11:53:20 +00:00
Benjamin Kramer 2501f14197 Miscellaneous speling fixes.
llvm-svn: 193046
2013-10-20 11:47:15 +00:00
Jordan Rose 42b4248f05 [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.
No functionality change.

llvm-svn: 192114
2013-10-07 17:16:59 +00:00
Jordan Rose 7741132f47 [analyzer] RetainCountChecker: add support for CFAutorelease.
<rdar://problems/13710586&13710643>

llvm-svn: 192113
2013-10-07 17:16:52 +00:00
Jordan Rose 6feda28756 [analyzer] Replace bug category magic strings with shared constants, take 2.
Re-commit r191910 (reverted in r191936) with layering violation fixed, by
moving the bug categories to StaticAnalyzerCore instead of ...Checkers.

llvm-svn: 191937
2013-10-04 00:25:24 +00:00
Richard Smith 25d8e737d8 Temporarily revert r191910 until the layering violation can be fixed.
llvm-svn: 191936
2013-10-03 23:38:02 +00:00
Jordan Rose 761ee868a5 [analyzer] Replace bug category magic strings with shared constants.
One small functionality change is to bring the sizeof-pointer checker in
line with the other checkers by making its category be "Logic error"
instead of just "Logic". There should be no other functionality changes.

Patch by Daniel Marjamäki!

llvm-svn: 191910
2013-10-03 16:57:20 +00:00
Jordan Rose 9db2d9adef [analyzer] Add new debug helper clang_analyzer_warnIfReached.
This will emit a warning if a call to clang_analyzer_warnIfReached is
executed, printing REACHABLE. This is a more explicit way to declare
expected reachability than using clang_analyzer_eval or triggering
a bug (divide-by-zero or null dereference), and unlike the former will
work the same in inlined functions and top-level functions. Like the
other debug helpers, it is part of the debug.ExprInspection checker.

Patch by Jared Grubb!

llvm-svn: 191909
2013-10-03 16:57:03 +00:00
Jordan Rose 44e066c72a [analyzer] Add missing return after function pointer null check.
Also add some tests that there is actually a message and that the bug is
actually a hard error. This actually behaved correctly before, because:

- addTransition() doesn't actually add a transition if the new state is null;
  it assumes you want to propagate the predecessor forward and does nothing.
- generateSink() is called in order to emit a bug report.
- If at least one new node has been generated, the predecessor node is /not/
  propagated forward.

But now it's spelled out explicitly.

Found by Richard Mazorodze, who's working on a patch that may require this.

llvm-svn: 191805
2013-10-02 01:20:28 +00:00
Jordan Rose 1ccc43d50e [analyzer] Handle destructors for the argument to C++ 'delete'.
Now that the CFG includes nodes for the destructors in a delete-expression,
process them in the analyzer using the same common destructor interface
currently used for local, member, and base destructors. Also, check for when
the value is known to be null, in which case no destructor is actually run.

This does not yet handle destructors for deleted /arrays/, which may need
more CFG work. It also causes a slight regression in the location of
double delete warnings; the double delete is detected at the destructor
call, which is implicit, and so is reported on the first access within the
destructor instead of at the 'delete' statement. This will be fixed soon.

Patch by Karthik Bhat!

llvm-svn: 191381
2013-09-25 16:06:17 +00:00
Benjamin Kramer 04bf187e12 Fix array_pod_sort predicates after LLVM change.
llvm-svn: 191176
2013-09-22 14:10:29 +00:00
Benjamin Kramer 402f807d9d array_pod_sort loses some type safety, better use the right types.
llvm-svn: 191174
2013-09-22 12:53:24 +00:00