Commit Graph

421 Commits

Author SHA1 Message Date
Zhongxing Xu 9988bab609 add test case for r74407.
llvm-svn: 74761
2009-07-03 05:33:23 +00:00
Ted Kremenek 0b0f206efa Fix a horrible CFG bug reported in <rdar://problem/7027684>. The wrong successor
block would get hooked up in some cases when processing empty compound
statements.

llvm-svn: 74743
2009-07-03 00:10:50 +00:00
Ted Kremenek 725b4a3a51 Enhance RegionStore to lazily symbolicate fields and array elements for
structures passed-by-value as function arguments.

llvm-svn: 74729
2009-07-02 22:02:15 +00:00
Ted Kremenek a8a295f2d9 Temporarily disable RegionStore for stack-addr-ps.c, as a new test case reveals
a case where RegionStore doesn't create symbolic values for the fields of
structs that are passed-by-value.

llvm-svn: 74662
2009-07-01 23:24:11 +00:00
Ted Kremenek 55e07efeed Add a FIXME to RegionStore, do some minor code cleanup, and get RegionStore to
pass misc-ps.m. Currently RegionStore/BasicStore don't do any special reasoning
about clang-style vectors, so we should return UnknownVal (in all cases) when
accessing their values via an array.

llvm-svn: 74660
2009-07-01 23:19:52 +00:00
Zhongxing Xu e205d43c75 When retrieving element region, if its super region has binding, return
unknown for it.

Mark the super region of a live region as live, if the live region is pointed
to by a live pointer variable.

These fixes xfail_regionstore_wine_crash.c.

llvm-svn: 74524
2009-06-30 12:32:59 +00:00
Zhongxing Xu 4744d560b8 Invalidate the alloca region by setting its default value to conjured symbol.
llvm-svn: 74419
2009-06-29 06:43:40 +00:00
Zhongxing Xu 55e070031f Now this test case passes.
llvm-svn: 74410
2009-06-28 14:25:10 +00:00
Zhongxing Xu 6f610707cf Invalidate a field of struct type by setting its default value to conjured
symbol.

llvm-svn: 74408
2009-06-28 13:59:24 +00:00
Ted Kremenek 1642bdaaa5 Introduce a new concept to the static analyzer: SValuator.
GRTransferFuncs had the conflated role of both constructing SVals (symbolic
expressions) as well as handling checker-specific logic. Now SValuator has the
role of constructing SVals from expressions and GRTransferFuncs just handles
checker-specific logic. The motivation is by separating these two concepts we
will be able to much more easily create richer constraint-generating logic
without coupling it to the main checker transfer function logic.

We now have one implementation of SValuator: SimpleSValuator.

SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals
(which is removed in this patch). This includes the logic for EvalBinOp,
EvalCast, etc. Because SValuator has a narrower role than the old
GRTransferFuncs, the interfaces are much simpler, and so is the implementation
of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of
SVal-related logic in GRSimpleVals and cleaned it up while moving it over to
SimpleSValuator.

As a consequence of removing GRSimpleVals, there is no longer a
'-checker-simple' option. The '-checker-cfref' did everything that option did
but also ran the retain/release checker. Of course a user may not always wish to
run the retain/release checker, nor do we wish core analysis logic buried in the
checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp
to separate out these pieces into the core analysis engine.

llvm-svn: 74229
2009-06-26 00:05:51 +00:00
Zhongxing Xu 540c009fbe Return UnknownVal for pointer arithmetic on struct fields.
llvm-svn: 73851
2009-06-21 13:24:24 +00:00
Zhongxing Xu 54fb536b5c A further step of r73690: associate the cast-to type with the created symbol,
because the type of the symbol is used to create the default range. We need the
sign to be consistent.

llvm-svn: 73756
2009-06-19 06:00:32 +00:00
Zhongxing Xu cc45762253 If the SymbolicRegion was cast to another type, use that type to create the
ElementRegion.

llvm-svn: 73754
2009-06-19 04:51:14 +00:00
Zhongxing Xu b21175ccbe Modify test case comments.
llvm-svn: 73691
2009-06-18 06:49:35 +00:00
Zhongxing Xu cea6578078 When casting region, if we do not create an element region, record the cast-to
type. 

When retrieving the region value, if we are going to create a symbol value, use
the cast-to type if possible.

llvm-svn: 73690
2009-06-18 06:29:10 +00:00
Ted Kremenek dc935e99e2 Add IOKit test cases for retain/release checker.
llvm-svn: 73549
2009-06-16 20:44:39 +00:00
Zhongxing Xu 838a0db0ba Use canonical type for building ElementRegion. Otherwise ElementRegions cannot
be unique.

llvm-svn: 73482
2009-06-16 09:55:50 +00:00
Zhongxing Xu e531f048f8 Do not invalidate unboundable regions in GRSimpleVals::EvalCall().
llvm-svn: 73474
2009-06-16 06:18:21 +00:00
Zhongxing Xu 519a47d4bd Bind the mistakenly generated nonloc::SymbolVal to struct correctly. See the
comments for added test case for details.

llvm-svn: 73189
2009-06-11 09:11:27 +00:00
Ted Kremenek a03705c82d Fix:
<rdar://problem/6948053> False positive: object substitution during -init* methods warns about returning +0 when using -fobjc-gc-only

llvm-svn: 72971
2009-06-05 23:18:01 +00:00
Ted Kremenek ea1c221334 Enhance attribute cf_returns_retained to also work (in the analyzer)
for non-Objctive-C pointer types.  This implicitly documents that the
return type is a CF object reference.

llvm-svn: 72968
2009-06-05 23:00:33 +00:00
Eli Friedman 8001b35d5d Clean up builtin lists, add a few new builtins. (I re-sorted the
string.h builtins to be in the same order as the list in the C99 
standard.)

llvm-svn: 72882
2009-06-04 19:35:30 +00:00
Ted Kremenek 2d22c84b4a Add more retain-checker tests for GC mode when using NSMakeCollectable.
llvm-svn: 72799
2009-06-03 19:19:06 +00:00
Ted Kremenek 1036912118 Add special cases to retain checker for 'create' methods in QCView, QCRenderer, and CIContext (Apple APIs).
This fixes:

<rdar://problem/6902710> clang: false positives w/QC and CoreImage methods.

llvm-svn: 72187
2009-05-20 22:39:57 +00:00
Zhongxing Xu 1075cc0b02 Treat AllocaRegion as SymbolicRegion in RegionStore::Retrieve().
llvm-svn: 72166
2009-05-20 09:18:48 +00:00
Zhongxing Xu 1f275ba1b4 Add comments to test case.
llvm-svn: 72165
2009-05-20 09:03:10 +00:00
Zhongxing Xu a7907608fb * API change: we need to pass GRState to GRExprEngine::EvalBinOp() because
RegionStore needs to know the type of alloca region. 
* RegionStoreManager::EvalBinOp() now converts the alloca region to its first
  element region, as what is done to symbolic region.

llvm-svn: 72164
2009-05-20 09:00:16 +00:00
Eli Friedman 45966b4671 Remove the -arch option from clang-cc: for all practical purposes, it's
redundant with -triple.

llvm-svn: 72108
2009-05-19 11:12:40 +00:00
Ted Kremenek 501ba0365a Fix PR 4230: Don't flag leaks of NSAutoreleasePools until we know that we aren' at the top-most scope of autorelease pools.
llvm-svn: 72065
2009-05-18 23:14:34 +00:00
Eli Friedman 0b4af8f755 PR3009: Get rid of bogus warning for scalar compound literals.
This patch isn't quite ideal in that it eliminates the warning for 
constructs like "int a = {1};", where the braces are in fact redundant.  
However, that would have required a bunch of refactoring, and it's 
much less likely to cause confusion compared to redundant nested braces.

llvm-svn: 71939
2009-05-16 11:45:48 +00:00
Ted Kremenek e4302ee3bb Fix: <rdar://problem/6893565> False positive: don't flag leaks for return types that cannot be determined to be CF types
llvm-svn: 71921
2009-05-16 01:38:01 +00:00
Ted Kremenek 3281977dbb Fix crash when deriving the enclosing summary of a method whose first selector slot has a null IdentifierInfo*. This happens when analyzing Growl.
llvm-svn: 71857
2009-05-15 15:49:00 +00:00
Ted Kremenek f9fa3cb78a Fix <rdar://problem/6859457> [NSData dataWithBytesNoCopy] does not return a retained object.
llvm-svn: 71797
2009-05-14 21:29:16 +00:00
Ted Kremenek 3b204e4c2e Add some basic type checking for attributes ns_returns_retained and
cf_returns_retained. Currently this attribute can now be applied to any
Objective-C method or C function that returns a pointer or Objective-C object
type.

Modify the tablegen definition of diagnostic 'warn_attribute_wrong_decl_type' to
expect that the diagnostics infrastructure will add quotes around the attribute
name when appropriate. Alonq with this change, I modified the places where this
warning is issued to passed the attribute's IdentifierInfo* instead of having a
hard-coded C constant string.

llvm-svn: 71718
2009-05-13 21:07:32 +00:00
Ted Kremenek bae777254a Enhance diagnostics value tracking logic for null dereferences and uninitialized values.
llvm-svn: 71700
2009-05-13 19:16:35 +00:00
Ted Kremenek 5801f65a52 Fix crasher reported in PR 4209 caused by an invalid summary
generation when EvalObjCMessageExpr() did not resolve the
ObjCInterfaceDecl* for a receiver when the receiver's symbolic value
wasn't being explicitly tracked.

llvm-svn: 71685
2009-05-13 18:16:01 +00:00
Ted Kremenek 051a03d698 Fix crasher in CFRefCount.cpp reported by Nikita Zhuk due to recently added autorelease tracking.
llvm-svn: 71647
2009-05-13 07:12:33 +00:00
Ted Kremenek 1272f706ca Fix: <rdar://problem/6320065> false positive - init method returns an object owned by caller
Now 'init' methods are treated by the retain/release checker as
claiming their receiver and allocating a new object.

llvm-svn: 71579
2009-05-12 20:06:54 +00:00
Zhongxing Xu 08a2ede018 Add logic for invalidating array region to CFRefCount.cpp. When invalidating
array region, set its default value to conjured symbol. When retrieving its
element, create new region value symbol for the element.

Also fix some 80 columns violations.

llvm-svn: 71548
2009-05-12 10:10:00 +00:00
Ted Kremenek 95d181936a Fix <rdar://problem/6877235> Classes typedef-ed to CF objects should get the same treatment as CF objects
This was accomplished by having	'isTypeRef' recursively walk the typedef stack.

llvm-svn: 71538
2009-05-12 04:53:03 +00:00
Ted Kremenek d0e3ab2196 Fix regression reported in <rdar://problem/6866843>. The analyzer should extend the lifetime of an object stored to a container.
llvm-svn: 71452
2009-05-11 18:30:24 +00:00
Ted Kremenek 7e7ed527dd Add test case for <rdar://problem/6257780>.
llvm-svn: 71444
2009-05-11 17:45:06 +00:00
Ted Kremenek dc7853cd98 Fix a bug found by Thomas Clement where 'return [[[NSString alloc] init] autorelease]' would emit a false 'too many overreleases' error.
llvm-svn: 71432
2009-05-11 15:26:06 +00:00
Ted Kremenek 1f8e4346fa Add special warning about returning a retained object where a GC'ed object is expected.
llvm-svn: 71397
2009-05-10 16:52:15 +00:00
Ted Kremenek dee56e37fc retain/release checker: Flag a warning for non-owned objects returned
where an owned one is expected.  Also add preliminary checking for
returning a positive retain count object in GC mode where an owned GC
object is expected.

llvm-svn: 71388
2009-05-10 06:25:57 +00:00
Ted Kremenek 3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Zhongxing Xu c9c3dab491 When casting VarRegion, if the var type is aggregate type and the cast-to
pointee type is scalar type, create element region regardless with the sizes
of types.

llvm-svn: 71360
2009-05-09 15:34:29 +00:00
Zhongxing Xu 4bc5a4c3bd add comments to test case.
llvm-svn: 71356
2009-05-09 13:27:17 +00:00
Ted Kremenek d73cfc734b Add back test cases for ns_returns_retained and cf_returns_retained.
llvm-svn: 71312
2009-05-09 03:10:32 +00:00
Ted Kremenek 2d0ff62a0d It lives! The retain/release checker now tracks objects that are sent
'autorelease'.

llvm-svn: 71307
2009-05-09 01:50:57 +00:00