Commit Graph

73 Commits

Author SHA1 Message Date
Ted Kremenek 2f5198b022 Added test case for <rdar://problem/7152418>.
llvm-svn: 82866
2009-09-26 17:18:44 +00:00
Ted Kremenek 1624a4784a Fix PR 4988 by removing an invalid assertion (a function can be referenced in
GRExprEngine::VisitDeclRefExpr without 'asLValue' being true).

llvm-svn: 82598
2009-09-23 01:30:01 +00:00
Ted Kremenek 3003001a86 Fix: <rdar://problem/7242006> [RegionStore] compound literal assignment with floats not honored
llvm-svn: 82575
2009-09-22 21:19:14 +00:00
Ted Kremenek f9539d0c3f Fix: <rdar://problem/7242015> [RegionStore] variable passed-by-reference (via integer) to function call not invalidated
llvm-svn: 82523
2009-09-22 04:48:39 +00:00
Ted Kremenek fd68c7bdc0 Add test case for <rdar://problem/6829164>, which was implicitly fixed in r79694.
llvm-svn: 82495
2009-09-21 23:22:11 +00:00
Ted Kremenek 0ccd06c017 Re-introduce diagnostic caching in BugReporter that was originally added in
r82198 and then reverted. This is an intermediate solution, as diagnostic
caching should not rely on static variables.

llvm-svn: 82301
2009-09-18 22:37:37 +00:00
Ted Kremenek e3d209ff77 Revert most of r82198, which was causing a large number of crashes
when running the analyzer on real projects.  We'll keep the change to
AnalysisManager.cpp in r82198 so that -fobjc-gc analyzes code
correctly in both GC and non-GC modes, although this may emit two
diagnostics for each bug in some cases (a better solution will come
later).

llvm-svn: 82201
2009-09-18 07:31:15 +00:00
Ted Kremenek 82f7f9c080 Introduce caching of diagnostics in BugReporter. This provides extra
pruning of diagnostics that may be emitted multiple times.  This is
accomplished by adding FoldingSet profiling support to PathDiagnostic,
and then having BugReporter record what diagnostics have been issued.

This was motived to a serious bug introduced by moving the
'divide-by-zero' checking outside of GRExprEngine into a separate
'Checker' class.  When analyzing code using the '-fobjc-gc' option, a
given function would be analyzed twice, but the second time various
"internal checks" would be disabled to avoid emitting multiple
diagnostics (e.g., "null dereference") for the same issue.  The
problem is that such checks also effect path pruning and don't just
emit diagnostics.  This resulted in an assertion failure involving a
real divide-by-zero in some analyzed code where we would get an
assertion failure in APInt because the 'DivZero' check was disabled
and didn't prune the logic that resulted in the divide-by-zero in the
analyzer.

The implemented solution is somewhat of a hack, and may not perform
extremely well.  This will need to be cleaned up over time.

As a regression test, 'misc-ps.m' has been modified so that its tests
are run using -fobjc-gc to test this diagnostic pruning behavior.

llvm-svn: 82198
2009-09-18 05:37:41 +00:00
Ted Kremenek 27347135dd Add static analyzer transfer function support for __builtin_offsetof.
llvm-svn: 81820
2009-09-15 00:40:32 +00:00
Ted Kremenek 84c6f0a1e6 Implement: <rdar://problem/7185647> [RegionStore] 'self' cannot be NULL upon entry to a method
Here we implement this as a precondition within GRExprEngine, even though it is
related to how BasicStoreManager and RegionStoreManager model 'self'
differently. Putting this as a high-level precondition is more general, which is
why it isn't in RegionStore.cpp.

llvm-svn: 81378
2009-09-09 20:36:12 +00:00
Ted Kremenek c4c48be88e Fix regression in BasicStoreManager caused by implicitly casting loaded values and trying to load/store from arrays. RegionStoreManager already properly handles these cases well; we just need to gracefully not handle this case in BasicStoreManager. This fixes PR 4781.
llvm-svn: 80051
2009-08-25 23:29:04 +00:00
Ted Kremenek 3ed9543ace Fix crash reported in <rdar://problem/7124210> by "back-porting" some of the
implicit cast logic in RegionStoreManager to BasicStoreManager. This involved
moving CastRetriedVal from RegionStoreManager to StoreManager.

llvm-svn: 80026
2009-08-25 20:51:30 +00:00
Ted Kremenek 68c1f010d2 Fix a bug in RegionStoreSubRegionManager::add() where multiple subregions wouldn't correctly get registered in the SubRegion map.
llvm-svn: 78162
2009-08-05 05:31:02 +00:00
Ted Kremenek 1624df626d Adjust test case.
llvm-svn: 78028
2009-08-04 00:58:45 +00:00
Ted Kremenek d673098480 Add a pass-by-value test for the analyzer.
llvm-svn: 78018
2009-08-03 23:22:53 +00:00
Ted Kremenek 0bb32e3e5d Handle disgusting corner case where a byte is loaded from the address of a function.
llvm-svn: 78000
2009-08-03 21:41:46 +00:00
Ted Kremenek 9419876e59 Fix regression in StoreManager::CastRegion() to always treat casts to
'void*' (or 'const void*') as an identity transformation.

llvm-svn: 77860
2009-08-02 04:12:53 +00:00
Ted Kremenek 1f22aa7433 This is a fairly large patch, which resulted from a cascade of changes
made to RegionStore (and related classes) in order to handle some
analyzer failures involving casts and manipulation of symbolic memory.

The root of the change is in StoreManager::CastRegion().  Instead of
using ad hoc heuristics to decide when to layer an ElementRegion on a
casted MemRegion, we now always layer an ElementRegion when the cast
type is different than the original type of the region.  This carries
the current cast information associated with a region around without
resorting to the error prone recording of "casted types" in GRState.

Along with this new policy of layering ElementRegions, I added a new
algorithm to strip away existing ElementRegions when they simply
represented casts of a base memory object.  This algorithm computes
the raw "byte offset" that an ElementRegion represents from the base
region, and allows the new ElementRegion to be based off that offset.
The added benefit is that this naturally handles a series of casts of
a MemRegion without building up a set of redundant ElementRegions
(thus canonicalizing the region view).

Other related changes that cascaded from this one (as tests were
failing in RegionStore):

- Revamped RegionStoreManager::InvalidateRegion() to completely remove
  all bindings and default values from a region and all subregions.
  Now invalidated fields are not bound directly to new symbolic
  values; instead the base region has a "default" symbol value from
  which "derived symbols" can be created.  The main advantage of this
  approach is that it allows us to invalidate a region hierarchy and
  then lazily instantiate new values no matter how deep the hierarchy
  went (i.e., regardless of the number of field accesses,
  e.g. x->f->y->z->...).  The previous approach did not do this.

- Slightly reworked RegionStoreManager::RemoveDeadBindings() to also
  incorporate live symbols and live regions that do not have direct
  bindings but also have "default values" used for lazy instantiation.
  The changes to 'InvalidateRegion' revealed that these were necessary
  in order to achieve lazy instantiation of values in the region store
  with those bindings being removed too early.

- The changes to InvalidateRegion() and RemoveDeadBindings() revealed
  a serious bug in 'getSubRegionMap()' where not all region -> subregion
  relationships involved in actually bindings (explicit and implicit)
  were being recorded.  This has been fixed by using a worklist algorithm
  to iteratively fill in the region map.

- Added special support to RegionStoreManager::Bind()/Retrieve() to handle
  OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the
  layering of ElementRegions.

- Fixed a bug in SymbolReaper::isLive() where derived symbols were not
  being marked live if the symbol they were derived from was also live.
  This fix was critical for getting lazy instantiation in RegionStore
  to work.

- Tidied up the implementation of ValueManager::getXXXSymbolVal() methods
  to use SymbolManager::canSymbolicate() to decide whether or not a
  symbol should be symbolicated.

- 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been
  moved to 'test/Analysis/misc-ps.m'.

- Tweaked some pretty-printing of MemRegions, and implemented
  'ElementRegion::getRawOffset()' for use with the CastRegion changes.

llvm-svn: 77782
2009-08-01 06:17:29 +00:00
Ted Kremenek 4301526e8d Remove 'StoreManager::OldCastRegion()', TypedViewRegion (which only
OldCastRegion used), and the associated command line option
'-analyzer-store=old-basic-cast'.

llvm-svn: 77509
2009-07-29 21:43:22 +00:00
Ted Kremenek b2d0409d50 Fix a crasher in StoreManager::InvalidateRegion() caused by using the
'cast type' of a region to invalidate its binding.  This only occurs
when using RegionStoreManager, as it records the cast type.  I'm
currently considering removing the notion of a cast type (see
comments in code).

llvm-svn: 76719
2009-07-22 04:23:20 +00:00
Ted Kremenek ac7c7240f0 Fix PR 4594 by refactoring almost all casting logic from GRExprEngine::VisitCast
to SValuator::EvalCast. In the process, the StoreManagers now use this new cast
machinery, and the hack in GRExprEngine::EvalBind to handle implicit casts
involving OSAtomicCompareAndSwap and friends has been removed (and replaced with
logic closer to the logic specific to those functions).

llvm-svn: 76641
2009-07-21 21:03:30 +00:00
Mike Stump 3fe60b2118 Prep for new warning.
llvm-svn: 76621
2009-07-21 18:59:16 +00:00
Ted Kremenek 834e2f69da Enhanced IsReinterpreted() (RegionStore.cpp) to reason about higher-order
pointers.

Enhanced RegionStoreManager::Retrieve() to handle automatic casts when the
loaded value is different from the requested value. This should be refined over
time, but essentially we should always symbolicate locations as locations, and
convert them to non-locations on demand.

These changes now cause 'misc-ps.m' to pass again.

llvm-svn: 76497
2009-07-20 22:58:02 +00:00
Ted Kremenek bf04f98c1f Add XFAILED test.
llvm-svn: 76469
2009-07-20 21:00:55 +00:00
Ted Kremenek e9812bdac5 Fix crash in StoreManager::NewCastRegion() when handling casts from 'id' (or whatever) to a BlockPointerType.
llvm-svn: 76288
2009-07-18 06:27:51 +00:00
Ted Kremenek c7b1dade86 Move RegionStoreManager over to using new
ValueManager::makeArrayIndex()/convertArrayIndex() methods.  This
handles yet another crash case when reasoning about array indices of
different bitwidth and signedness.

llvm-svn: 75884
2009-07-16 01:33:37 +00:00
Ted Kremenek f3e1e4d9a1 Fix <rdar://problem/7062158> by having BasicStoreManager model values for 'static' global variables.
llvm-svn: 75844
2009-07-15 22:09:25 +00:00
Ted Kremenek b63f71528e Enhance SimpleSValuator::EvalBinOpNN to recognize the trivial case
where we are comparing a symbolic value against itself, regardless of
the nature of that symbolic value.

This enhancement identified a case where RegionStoreManager is not
correctly symbolicating the values of the pointees of parameters.  The
failing test is now in 'test/Analysis/misc-ps-region-store.m', with
that test file now (temporarily) marked XFAIL.

llvm-svn: 75521
2009-07-13 21:55:12 +00:00
Ted Kremenek da03e8443e Handle insidious corner case exposed by RegionStoreManager when handling void* values that are bound
to symbolic regions and then treated like integers.

llvm-svn: 75356
2009-07-11 04:38:49 +00:00
Ted Kremenek 6cb2a34e3c Test case in test/Analysis/xfail_regionstore_wine_crash.c no longer fails, so
move this case to 'test/Analysis/misc-ps.m' to test with both BasicStoreManager
and RegionStoreManager.

llvm-svn: 75294
2009-07-10 21:43:30 +00:00
Ted Kremenek bf73ad47a8 Revert r75281 and simply remove the assertion in NewCastRegion that
CodeTextRegions can only be casted to FunctionPointer or BlockPointerTypes. This
simply isn't true. We can handle bogus operations on CodeTextRegions (e.g, an
array access) elsewhere.

llvm-svn: 75285
2009-07-10 21:24:45 +00:00
Ted Kremenek 6c94771a0b Fix crash in StoreManager::NewCastRegion regarding handling casts to void*,
void**, void***, etc.  Such casts should just pass the region through.

llvm-svn: 75281
2009-07-10 21:11:16 +00:00
Ted Kremenek f66557978e Switch BasicStoreManager to use the new CastRegion implementation by default,
and replace the 'clang-cc' option '-analyzer-store=basic-new-cast' with
'-analyzer-store=basic-old-cast'. We'll keep the old CastRegion implementation
around for a little while for regression testing.

llvm-svn: 75209
2009-07-10 00:41:58 +00:00
Ted Kremenek 8ee3dd7cc5 Fix: <rdar://problem/7034511> ValueManager::makeIntVal(uint64_t X, QualType T) should return a 'Loc' when 'T' is a pointer
llvm-svn: 75062
2009-07-08 22:42:46 +00:00
Ted Kremenek 97213bac53 NewCastRegion: Handle casts *from* pointers to incomplete structs to other types.
llvm-svn: 74884
2009-07-06 23:47:19 +00:00
Ted Kremenek c5ab3a0eab StoreManager::NewCastRegion:
- Refactor logic that creates ElementRegions into a help method 'MakeElementRegion'.
- Fix crash due to not handling StringRegions.  Casts of StringRegions now
  result in a new ElementRegion layered on the original StringRegion.

llvm-svn: 74867
2009-07-06 22:23:45 +00:00
Ted Kremenek eea8c29aa3 Make 'BasicStoreManager' + 'NewCastRegion' testable from the command line using '-analyzer-store=basic-new-cast'.
llvm-svn: 74865
2009-07-06 21:58:46 +00:00
Ted Kremenek 0b0f206efa Fix a horrible CFG bug reported in <rdar://problem/7027684>. The wrong successor
block would get hooked up in some cases when processing empty compound
statements.

llvm-svn: 74743
2009-07-03 00:10:50 +00:00
Ted Kremenek 55e07efeed Add a FIXME to RegionStore, do some minor code cleanup, and get RegionStore to
pass misc-ps.m. Currently RegionStore/BasicStore don't do any special reasoning
about clang-style vectors, so we should return UnknownVal (in all cases) when
accessing their values via an array.

llvm-svn: 74660
2009-07-01 23:19:52 +00:00
Ted Kremenek 3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Ted Kremenek 02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Ted Kremenek 407d81b2cd Add another test case found due to an analyzer regression.
llvm-svn: 70600
2009-05-01 23:35:18 +00:00
Ted Kremenek 9c03f68206 Fix PR 4033: the analyzer shouldn't crash on computed gotos involving symbolic
target addresses.

llvm-svn: 69900
2009-04-23 17:49:43 +00:00
Ted Kremenek 35f875c136 Fix: <rdar://problem/6777209> false Dereference of null pointer in loop: pointer increment/decrement preserves non-nullness
When the StoreManager doesn't reason well about pointer-arithmetic, propagate
the non-nullness constraint on a pointer value when performing pointer
arithmetic uisng ++/--.

llvm-svn: 69741
2009-04-21 22:38:05 +00:00
Ted Kremenek b3b2395520 Split failing test case from misc-ps.m to misc-ps-ranges.m (which tests
functionality specific to RangeConstraintManager).

llvm-svn: 68759
2009-04-10 04:02:38 +00:00
Ted Kremenek 5054663daa Fix: <rdar://problem/6776949> Branch condition evaluates to an uninitialized value (argc is guaranteed to be >= 1)
The analyzer now adds the precondition that the first argument of 'main' is > 0.

llvm-svn: 68757
2009-04-10 00:59:50 +00:00
Ted Kremenek 40f4ee74fd Implement attribute "analyzer_noreturn" (<rdar://problem/6777003>). This allows
clients of the analyzer to designate custom assertion routines as "noreturn"
functions from the analyzer's perspective but not the compiler's.

llvm-svn: 68746
2009-04-10 00:01:14 +00:00
Ted Kremenek 9335fecc2a Update expected warning in test case.
llvm-svn: 68276
2009-04-02 02:52:13 +00:00
Daniel Dunbar a45cf5b6b0 Rename clang to clang-cc.
Tests and drivers updated, still need to shuffle dirs.

llvm-svn: 67602
2009-03-24 02:24:46 +00:00
Ted Kremenek c7fef2ad53 analyzer: Fix embarrassing regression in BasicStore when invalidating struct
values passed-by-reference to unknown functions.

llvm-svn: 67519
2009-03-23 15:42:58 +00:00