Commit Graph

143 Commits

Author SHA1 Message Date
Artem Dergachev 0c33406aaa [analyzer] Add "Assuming..." diagnostic pieces for unsupported conditions.
In the analyzer's path-sensitive reports, when a report goes through a branch
and the branch condition cannot be decided to be definitely true or false
(based on the previous execution path), an event piece is added that tells the
user that a new assumption is added upon the symbolic value of the branch
condition. For example, "Assuming 'a' is equal to 3".

The text of the assumption is hand-crafted in various manners depending on
the AST expression. If the AST expression is too complex and the text of
the assumption fails to be constructed, the event piece is omitted.
This causes loss of information and misunderstanding of the report.

Do not omit the event piece even if the expression is too complex;
add a piece with a generic text instead.

Differential Revision: https://reviews.llvm.org/D23300

llvm-svn: 283301
2016-10-05 08:19:49 +00:00
Devin Coughlin 719238b7d3 [analyzer] Weaken assertion in trackNullOrUndefValue()
We should ignore paren casts when making sure that the semantic expression
in a PseudoObjectExpr for an ObjC getter is a message send.

This has no other intended functionality change.

Adding a test for this exposed an interesting issue in another test case
that only manifests under ARC. trackNullOrUndefValue() is not properly
suppressing for nil values that are the result of nil propagation from a nil
receiver when the nil is returned from a function. I've added a FIXME for that
missing suppression.

rdar://problem/27290568

llvm-svn: 279181
2016-08-19 01:05:31 +00:00
Devin Coughlin 0a53fdf00c [analyzer] Suppress false positives in std::shared_ptr
The analyzer does not model C++ temporary destructors completely and so
reports false alarms about leaks of memory allocated by the internals of
shared_ptr:

  std::shared_ptr<int> p(new int(1));
  p = nullptr; // 'Potential leak of memory pointed to by field __cntrl_'

This patch suppresses all diagnostics where the end of the path is inside
a method in std::shared_ptr.

It also reorganizes the tests for suppressions in the C++ standard library
to use a separate simulated header for library functions with bugs
that were deliberately inserted to test suppression. This will prevent
other tests from using these as models.

rdar://problem/23652766

llvm-svn: 274691
2016-07-06 21:52:55 +00:00
Devin Coughlin 803ee03117 [analyzer] Teach trackNullOrUndefValue() about class property accessors.
Teach trackNullOrUndefValue() how to properly look through PseudoObjectExprs
to find the underlying semantic method call for property getters. This fixes a
crash when looking through class property getters that I introduced in r265839.

rdar://problem/26796666

llvm-svn: 273340
2016-06-22 00:20:00 +00:00
Devin Coughlin b40d14f3d5 [analyzer] Fix assertion in ReturnVisitor for body-farm synthesized getters
Don't emit a path note marking the return site if the return statement does not
have a valid location. This fixes an assertion failure I introduced in r265839.

llvm-svn: 266031
2016-04-12 00:53:26 +00:00
Devin Coughlin ebaa56bb26 [analyzer] Teach trackNullOrUndefValue about calls to property accessors.
Teach trackNullOrUndefValue() how to look through PseudoObjectExprs to find
the underlying method call for property getters. This makes over-suppression
of 'return nil' in getters consistent with the similar over-suppression for
method and function calls.

rdar://problem/24437252

llvm-svn: 265839
2016-04-08 19:59:16 +00:00
Devin Coughlin 4be27d4db9 [analyzer] Make suppression of macro defensive checks work with -analyzer-eagerly-assume.
This is the default for the analyzer but the flag is added by the driver so
our suppression tests didn't cover this case.

llvm-svn: 259288
2016-01-30 01:59:33 +00:00
Devin Coughlin 07c451fa4a [analyzer] Suppress null reports from defensive checks in function-like macros.
We already do this for case splits introduced as a result of defensive null
checks in functions and methods, so do the same for function-like macros.

rdar://problem/19640441

llvm-svn: 259222
2016-01-29 18:47:13 +00:00
Yury Gribov 054873b0be AnalysisConsumer: use canonical decl for both lookup and store of
visited decls.

Due to redeclarations, the function may have different declarations used
in CallExpr and in the definition. However, we need to use a unique
declaration for both store and lookup in VisitedCallees. This patch
fixes issues with analysis in topological order. A simple test is
included.

Patch by Alex Sidorin!

Differential Revision: http://reviews.llvm.org/D15410

llvm-svn: 257318
2016-01-11 09:38:48 +00:00
Anna Zaks ac4c8a639c [analyzer] Suppress reports coming from std::__independent_bits_engine
The analyzer reports a shift by a negative value in the constructor. The bug can
be easily triggered by calling std::random_shuffle on a vector
(<rdar://problem/19658126>).

(The shift by a negative value is reported because __w0_ gets constrained to
63 by the conditions along the path:__w0_ < _WDt && __w0_ >= _WDt-1,
where _WDt is 64. In normal execution, __w0_ is not 63, it is 1 and there is
no overflow. The path is infeasible, but the analyzer does not know about that.)

llvm-svn: 256886
2016-01-06 00:32:52 +00:00
Gabor Horvath b89658f649 Attempt to fix build bot test failures.
llvm-svn: 251014
2015-10-22 13:23:18 +00:00
Gabor Horvath efec16307c [analyzer] Bug identification
This patch adds hashes to the plist and html output to be able to identfy bugs
for suppressing false positives or diff results against a baseline. This hash
aims to be resilient for code evolution and is usable to identify bugs in two
different snapshots of the same software. One missing piece however is a 
permanent unique identifier of the checker that produces the warning. Once that
issue is resolved, the hashes generated are going to change. Until that point
this feature is marked experimental, but it is suitable for early adoption.

Differential Revision: http://reviews.llvm.org/D10305 

Original patch by: Bence Babati!

llvm-svn: 251011
2015-10-22 11:53:04 +00:00
Eli Bendersky 5f4d76efd3 Record correct source range for defaulted/deleted members.
Fixes https://llvm.org/bugs/show_bug.cgi?id=20744

struct A {

A() = default;
};

Previously the source range of the declaration of A ended at the ')'. It should
include the '= default' part as well. The same for '= delete'.

Note: this will break one of the clang-tidy fixers, which is going to be
addessed in a follow-up patch.

Differential Revision: http://reviews.llvm.org/D8465

llvm-svn: 233028
2015-03-23 21:43:28 +00:00
Gabor Horvath c18a11397c [Static Analyzer] The name of the checker that reports a bug is added
to the plist output. This check_name field does not guaranteed to be the
same as the name of the checker in the future.

Reviewer: Anna Zaks

Differential Revision: http://reviews.llvm.org/D6841

llvm-svn: 228624
2015-02-09 22:52:26 +00:00
Anna Zaks b8de0c4278 Do not inline methods of C++ containers (coming from headers).
This silences false positives (leaks, use of uninitialized value) in simple
code that uses containers such as std::vector and std::list. The analyzer
cannot reason about the internal invariances of those data structures which
leads to false positives. Until we come up with a better solution to that
problem, let's just not inline the methods of the containers and allow objects
to escape whenever such methods are called.

This just extends an already existing flag "c++-container-inlining" and applies
the heuristic not only to constructors and destructors of the containers, but
to all of their methods.

We have a bunch of distinct user reports all related to this issue
(radar://16058651, radar://16580751, radar://16384286, radar://16795491
[PR19637]).

llvm-svn: 211832
2014-06-27 01:03:05 +00:00
Daniel Jasper b3b0b8034c Fix/Improve SourceRange of explicitly defaulted members
When adding the implicit compound statement (required for Codegen?), the
end location was previously overridden by the start location, probably
based on the assumptions:

* The location of the compound statement should be the member's location
* The compound statement if present is the last element of a FunctionDecl

This patch changes the location of the compound statement to the
member's end location.

Code review: http://reviews.llvm.org/D4175

llvm-svn: 211344
2014-06-20 08:44:22 +00:00
Richard Trieu f7432755d0 Add -Wtautological-undefined-compare and -Wundefined-bool-conversion warnings
to detect underfined behavior involving pointers.

llvm-svn: 210372
2014-06-06 21:39:26 +00:00
Peter Collingbourne b8d17e7a3b Correctly set brace range for CXXConstructExprs formed by list initialization.
Differential Revision: http://llvm-reviews.chandlerc.com/D2711

llvm-svn: 201926
2014-02-22 02:59:41 +00:00
Jordan Rose c7d0acaf34 [analyzer] Just silence all warnings coming out of std::basic_string.
This means always walking the whole call stack for the end path node, but
we'll assume that's always fairly tractable.

<rdar://problem/15952973>

llvm-svn: 200980
2014-02-07 17:35:04 +00:00
Hans Wennborg 9125b08b52 Update tests in preparation for using the MS ABI for Win32 targets
In preparation for making the Win32 triple imply MS ABI mode,
make all tests pass in this mode, or make them use the Itanium
mode explicitly.

Differential Revision: http://llvm-reviews.chandlerc.com/D2401

llvm-svn: 199130
2014-01-13 19:48:13 +00:00
Jordan Rose 4c56c22634 [analyzer] Silence warnings coming from allocators used by std::basic_string.
This is similar to r194004: because we can't reason about the data structure
invariants of std::basic_string, the analyzer decides it's possible for an
allocator to be used to deallocate the string's inline storage. Just ignore
this by walking up the stack, skipping past methods in classes with
"allocator" in the name, and seeing if we reach std::basic_string that way.

PR17866

llvm-svn: 194764
2013-11-15 02:11:19 +00:00
Anna Zaks 830d2f7701 [analyzer] Suppress warnings coming out of std::basic_string.
The analyzer cannot reason about the internal invariances of the data structure (radar://15194597).

llvm-svn: 194004
2013-11-04 19:13:03 +00:00
Jordan Rose 1417a7b174 [analyzer] Don't crash when a path goes through a 'delete' destructor call.
This was just left unimplemnted from r191381; the fix is to report this call
location as the location of the 'delete' expr.

PR17746

llvm-svn: 193783
2013-10-31 18:41:15 +00:00
Jordan Rose 3553bb384b [analyzer] Make inlining decisions based on the callee being variadic.
...rather than trying to figure it out from the call site, and having
people complain that we guessed wrong and that a prototype-less call is
the same as a variadic call on their system. More importantly, fix a
crash when there's no decl at the call site (though we could have just
returned a default value).

<rdar://problem/15037033>

llvm-svn: 191599
2013-09-28 02:04:19 +00:00
Jordan Rose 7699e4a50b [analyzer] Don't process autorelease counts in synthesized function bodies.
We process autorelease counts when we exit functions, but if there's an
issue in a synthesized body the report will get dropped. Just skip the
processing for now and let it get handled when the caller gets around to
processing autoreleases.

(This is still suboptimal: objects autoreleased in the caller context
should never be warned about when exiting a callee context, synthesized
or not.)

Second half of <rdar://problem/14611722>

llvm-svn: 187625
2013-08-01 22:16:36 +00:00
Jordan Rose 5fbe7f9766 [analyzer] Silently drop all reports within synthesized bodies.
Much of our diagnostic machinery is set up to assume that the report
end path location is valid. Moreover, the user may be quite confused
when something goes wrong in our BodyFarm-synthesized function bodies,
which may be simplified or modified from the real implementations.
Rather than try to make this all work somehow, just drop the report so
that we don't try to go on with an invalid source location.

Note that we still handle reports whose /paths/ go through invalid
locations, just not those that are reported in one.

We do have to be careful not to lose warnings because of this.
The impetus for this change was an autorelease being processed within
the synthesized body, and there may be other possible issues that are
worth reporting in some way. We'll take these as they come, however.

<rdar://problem/14611722>

llvm-svn: 187624
2013-08-01 22:16:30 +00:00
Anna Zaks a42fb525e4 [analyzer] Suppress reports reported in std::list
The motivation is to suppresses false use-after-free reports that occur when calling
std::list::pop_front() or std::list::pop_back() twice. The analyzer does not
reason about the internal invariants of the list implementation, so just do not report
any of warnings in std::list.

Fixes radar://14317928.

llvm-svn: 185609
2013-07-04 02:38:10 +00:00
Anna Zaks 5673b6567a [analyzer] Make sure that inlined defensive checks work on div by zero.
This suppresses a false positive in std::hash_map.
Fixes  radar://14255587.

llvm-svn: 185608
2013-07-04 02:38:06 +00:00
Jordan Rose e83cb0922b Revert "[analyzer] Handle zeroing CXXConstructExprs."
Per review from Anna, this really should have been two commits, and besides
it's causing problems on our internal buildbot. Reverting until these have
been worked out.

This reverts r184511 / 98123284826bb4ce422775563ff1a01580ec5766.

llvm-svn: 184561
2013-06-21 16:30:32 +00:00
Jordan Rose 4ace1a74c0 [analyzer] Handle zeroing CXXConstructExprs.
Certain expressions can cause a constructor invocation to zero-initialize
its object even if the constructor itself does no initialization. The
analyzer now handles that before evaluating the call to the constructor,
using the same "default binding" mechanism that calloc() uses, rather
than simply ignoring the zero-initialization flag.

As a bonus, trivial default constructors are now no longer inlined; they
are instead processed explicitly by ExprEngine. This has a (positive)
effect on the generated path edges: they no longer stop at a default
constructor call unless there's a user-provided implementation.

<rdar://problem/14212563>

llvm-svn: 184511
2013-06-21 00:59:00 +00:00
Jordan Rose 5e2b3a30a0 [analyzer] Enable the new edge algorithm by default.
...but don't yet migrate over the existing plist tests. Some of these
would be trivial to migrate; others could use a bit of inspection first.
In any case, though, the new edge algorithm seems to have proven itself,
and we'd like more coverage (and more usage) of it going forwards.

llvm-svn: 183165
2013-06-03 23:00:19 +00:00
Jordan Rose 14cce0561c [analyzer] Fix test for r182677.
llvm-svn: 182678
2013-05-24 21:49:58 +00:00
Jordan Rose 56138268b0 [analyzer] Treat analyzer-synthesized function bodies like implicit bodies.
When generating path notes, implicit function bodies are shown at the call
site, so that, say, copying a POD type in C++ doesn't jump you to a header
file. This is especially important when the synthesized function itself
calls another function (or block), in which case we should try to jump the
user around as little as possible.

By checking whether a called function has a body in the AST, we can tell
if the analyzer synthesized the body, and if we should therefore collapse
the call down to the call site like a true implicitly-defined function.

<rdar://problem/13978414>

llvm-svn: 182677
2013-05-24 21:43:11 +00:00
Fariborz Jahanian 478536b1c1 improve of note message and minor refactoring of my last
patch (r181847).

llvm-svn: 181896
2013-05-15 15:27:35 +00:00
Fariborz Jahanian 773df4a11f Objective-C [diagnostics] [QOI], when method is not
found for a receiver, note where receiver class
is declaraed (this is most common when receiver is a forward
class). // rdar://3258331

llvm-svn: 181847
2013-05-14 23:24:17 +00:00
Anna Zaks 6afa8f1609 [analyzer] Refactor: address Jordan’s code review of r181738.
(Modifying the checker to record that the values are no longer nil will be done separately.)

llvm-svn: 181744
2013-05-13 23:49:51 +00:00
Anna Zaks e5e416c6de [analyzer] Fix a crash triggered by printing a note on a default argument
Instead, use the location of the call to print the note.

llvm-svn: 181337
2013-05-07 17:42:42 +00:00
Jordan Rose 320fbf057c [analyzer] Check the stack frame when looking for a var's initialization.
FindLastStoreBRVisitor is responsible for finding where a particular region
gets its value; if the region is a VarRegion, it's possible that value was
assigned at initialization, i.e. at its DeclStmt. However, if a function is
called recursively, the same DeclStmt may be evaluated multiple times in
multiple stack frames. FindLastStoreBRVisitor was not taking this into
account and just picking the first one it saw.

<rdar://problem/13787723>

llvm-svn: 180997
2013-05-03 05:47:31 +00:00
Jordan Rose cea47b78fc [analyzer] Fix trackNullOrUndef when tracking args that have nil receivers.
There were actually two bugs here:
- if we decided to look for an interesting lvalue or call expression, we
  wouldn't go find its node if we also knew we were at a (different) call.
- if we looked through one message send with a  nil receiver, we thought we
  were still looking at an argument to the original call.

Put together, this kept us from being able to track the right values, which
means sub-par diagnostics and worse false-positive suppression.

Noticed by inspection.

llvm-svn: 180996
2013-05-03 05:47:24 +00:00
Jordan Rose 7023a90378 [analyzer] Don't inline the [cd]tors of C++ iterators.
This goes with r178516, which instructed the analyzer not to inline the
constructors and destructors of C++ container classes. This goes a step
further and does the same thing for iterators, so that the analyzer won't
falsely decide we're trying to construct an iterator pointing to a
nonexistent element.

The heuristic for determining whether something is an iterator is the
presence of an 'iterator_category' member. This is controlled under the
same -analyzer-config option as container constructor/destructor inlining:
'c++-container-inlining'.

<rdar://problem/13770187>

llvm-svn: 180890
2013-05-01 22:39:31 +00:00
Anna Zaks 4e16b29c13 [analyzer] Refactor BugReport::getLocation and PathDiagnosticLocation::createEndOfPath for greater code reuse
The 2 functions were computing the same location using different logic (each one had edge case bugs that the other
one did not). Refactor them to rely on the same logic.

The location of the warning reported in text/command line output format will now match that of the plist file.

There is one change in the plist output as well. When reporting an error on a BinaryOperator, we use the location of the
operator instead of the beginning of the BinaryOperator expression. This matches our output on command line and
looks better in most cases.

llvm-svn: 180165
2013-04-23 23:57:43 +00:00
Jordan Rose 3437669ca9 [analyzer] Type information from C++ new expressions is perfect.
This improves our handling of dynamic_cast and devirtualization for
objects allocated by 'new'.

llvm-svn: 180051
2013-04-22 21:36:44 +00:00
Anna Zaks 6c0c47ede5 [analyzer] Ensure BugReporterTracking works on regions with pointer arithmetic
Introduce a new helper function, which computes the first symbolic region in
the base region chain. The corresponding symbol has been used for assuming that
a pointer is null. Now, it will also be used for checking if it is null.

This ensures that we are tracking a null pointer correctly in the BugReporter.

llvm-svn: 179916
2013-04-20 01:15:42 +00:00
Anna Zaks 4e88300256 [analyzer] Correct the comment
llvm-svn: 179914
2013-04-20 01:15:32 +00:00
Ted Kremenek d51ad8c125 [analyzer] Refine 'nil receiver' diagnostics to mention the name of the method not called.
llvm-svn: 179776
2013-04-18 17:44:15 +00:00
Anna Zaks 05139fff42 [analyzer] Tweak getDerefExpr more to track DeclRefExprs to references.
In the committed example, we now see a note that tells us when the pointer
was assumed to be null.

This is the only case in which getDerefExpr returned null (failed to get
the dereferenced expr) throughout our regression tests. (There were multiple
occurrences of this one.)

llvm-svn: 179736
2013-04-18 00:15:15 +00:00
Anna Zaks 1baf545fa6 [analyzer] Improve dereferenced expression tracking for MemberExpr with a dot and non-reference base
llvm-svn: 179734
2013-04-17 23:17:43 +00:00
Anna Zaks 4f59835182 [analyzer] Gain more precision retrieving the right SVal by specifying the type of the expression.
Thanks to Jordan for suggesting the fix.

llvm-svn: 179732
2013-04-17 22:29:51 +00:00
Anna Zaks 7460deb15d [analyzer] Add pretty printing to CXXBaseObjectRegion.
llvm-svn: 179573
2013-04-15 22:38:04 +00:00
Anna Zaks e2e8ea62df [analyzer] Address code review for r179395
Mostly refactoring + handle the nested fields by printing the innermost field only.

llvm-svn: 179572
2013-04-15 22:37:59 +00:00