Commit Graph

90 Commits

Author SHA1 Message Date
Zhongxing Xu e42755334c SymbolicRegions really have unknown sizes.
llvm-svn: 63929
2009-02-06 08:51:30 +00:00
Zhongxing Xu dec48a50df Create ElementRegion when the base is SymbolicRegion. This is like what we do
for FieldRegion. This enables us to track more values.

Simplify SymbolicRegion::getRValueType(). We assume the symbol always has
pointer type.

llvm-svn: 63928
2009-02-06 08:44:27 +00:00
Zhongxing Xu 9103df1688 Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so
do the symblic regions associated with them and we need them to be typed.

Current SymbolicRegion::getRValueType() method is very restricting. It may be
modified when we are more clear about what could be the types of symblic
regions.

BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a
subclass of SubRegion.
 

llvm-svn: 63844
2009-02-05 06:57:29 +00:00
Ted Kremenek 7594e2a59a Fix a couple bugs:
- NonLoc::MakeVal() would use sizeof(unsigned) (literally) instead of consulting
  ASTContext for the size (in bits) of 'int'. While it worked, it was a
  conflation of concepts and using ASTContext.IntTy is 100% correct.
- RegionStore::getSizeInElements() no longer assumes that a VarRegion has the
  type "ConstantArray", and handles the case when uses use ordinary variables
  as if they were arrays.
- Fixed ElementRegion::getRValueType() to just return the rvalue type of its
  "array region" in the case the array didn't have ArrayType.
- All of this fixes <rdar://problem/6541136>

llvm-svn: 63347
2009-01-30 00:08:43 +00:00
Sebastian Redl 54cb4c88e1 Correct size assumption; fixes a crash on amd64.
llvm-svn: 63031
2009-01-26 19:54:12 +00:00
Zhongxing Xu e37f9afb2e Implement retrieval of the default value of element and field regions.
llvm-svn: 62847
2009-01-23 11:22:12 +00:00
Zhongxing Xu 804f26a60a Now this comment should be resolved. See the comments for the KillSet.
llvm-svn: 62846
2009-01-23 10:42:17 +00:00
Ted Kremenek 2e1dfe25c5 For now, return UnknownVal() in RegionStore::getElementsSize() for AnonTypedRegions. It wasn't really doing the right thing and was crashing on rdar-6442306-1.m. This fix causes all path-sensitive test cases to pass with RegionStore.
llvm-svn: 62816
2009-01-22 23:56:56 +00:00
Ted Kremenek fe0f1788ca Add RegionStore support for the implicit object region that 'self' references. This causes tests 'ObjCProperties.m' and 'refcnt_naming.m' to now pass with RegionStore.
llvm-svn: 62814
2009-01-22 23:43:57 +00:00
Ted Kremenek 92d48a71f5 Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781
2009-01-22 20:27:48 +00:00
Ted Kremenek 74040833e4 Static analyzer: Remove a bunch of outdated SymbolData objects and
their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769
2009-01-22 18:23:34 +00:00
Ted Kremenek 1322ca1364 Combine two branches into one. No functionality change.
llvm-svn: 62727
2009-01-21 22:58:50 +00:00
Ted Kremenek 16fbfe699e Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.
llvm-svn: 62722
2009-01-21 22:26:05 +00:00
Ted Kremenek fe32cc0ba6 Get RegionStore to work with the retain/release checker and its test cases.
Because the RegionStore can reason about values beyond the reasoning power of BasicStore, this patch splits some of the test cases for the retain/release checker to have versions that are handled by RegionStore (more warnings) and BasicStore (less warnings).

llvm-svn: 62667
2009-01-21 06:57:53 +00:00
Zhongxing Xu 2436f86024 add a fixme.
llvm-svn: 62142
2009-01-13 03:07:41 +00:00
Zhongxing Xu cff637a568 Add KillStruct to region store.
- put the killed region in the kill set.
 - set its default value to unknown.
 - removes all bindings for its subregions.  

llvm-svn: 62138
2009-01-13 01:49:57 +00:00
Ted Kremenek 167f2fa5f4 Invert condition on branch (was causing RegionStore::ArrayToPointer to return 'unknown' on most cases.
llvm-svn: 62129
2009-01-13 01:03:27 +00:00
Ted Kremenek 682c3a6dd6 Refactor MemRegionManager instance variable into parent class. No functionality change.
llvm-svn: 61888
2009-01-07 22:18:50 +00:00
Ted Kremenek 47ad37dbe4 Return UnknownVal in RegionStoreManager::getSizeInElements() for unsupported regions. This silences a warning when compiling Release-Asserts builds.
llvm-svn: 61818
2009-01-06 19:12:06 +00:00
Ted Kremenek 2907ab7d77 Add a bunch of comments and FIXMEs.
llvm-svn: 61419
2008-12-24 07:46:32 +00:00
Zhongxing Xu c7a2792817 set region default value if there are not enough init values for array and struct.
llvm-svn: 61418
2008-12-24 07:29:24 +00:00
Ted Kremenek ae189ec1be Comment and fixup GDM entries for RegionStore to use unique 'tag classes' to identify GDM entries.
llvm-svn: 61409
2008-12-24 01:05:03 +00:00
Zhongxing Xu af7415ffb1 Lazy bingding for region-store manager.
* Now Bind() methods take and return GRState* because binding could
  also alter GDM.
* No variables are initialized except those declared with initial
  values.
* failed C test cases are due to bugs in RemoveDeadBindings(),
which removes constraints that is still alive. This will be fixed in later
patch.
* default value of array and struct regions will be implemented in later patch.

llvm-svn: 61274
2008-12-20 06:32:12 +00:00
Zhongxing Xu c4a4c5f02d Implement RegionStoreManager::Remove().
llvm-svn: 61069
2008-12-16 02:36:30 +00:00
Zhongxing Xu b0cc30ddb4 I think we should getRValueType here. The lvaluetype of an array region is 'pointer to array'.
llvm-svn: 61003
2008-12-14 03:14:52 +00:00
Ted Kremenek b5670fd555 MemRegion:
- Overhauled the notion of "types" for TypedRegions.  We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()).  Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs.
- Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type.  We can add it back once there is a need for it and we can resolve its role with these concepts.

StoreManager:
- Overhauled StoreManager::CastRegion.  It expects an *lvalue* type for a region.  This is actually what motivated the overhaul to the MemRegion type mechanism.  It also no longer returns an SVal; we can just return a MemRegion*.
- BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts.  This matches with the MemRegion changes.
- Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion().

AuditCFNumberCreate check:
- Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type.  This change was needed to work with the changes to StoreManager::CastRegion.

GRExprEngine::VisitCast:
- Conform to the new interface of StoreManager::CastRegion.

Tests:
- None of the analysis tests fail now for using the "basic store".
- Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing.

llvm-svn: 60995
2008-12-13 21:49:13 +00:00
Ted Kremenek f065b15f7d A series of cleanups/fixes motivated by <rdar://problem/6442306>:
GRExprEngine (VisitCast):
- When using StoreManager::CastRegion, always use the state and value it returns to generate the next node.  Failure to do so means that region values returned that don't require the state to be modified will get ignored.

MemRegion:
- Tighten the interface for ElementRegion.  Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion.  Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions.
- Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region.
- Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion.  All that matters is that it is a TypedRegion, which is now true all the time by design.

BasicStore:
- Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion.  This conforms to the updated interface for ElementRegion.

RegionStore:
- In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion.

llvm-svn: 60990
2008-12-13 19:24:37 +00:00
Douglas Gregor 7a4fad1b0b Address some comments on the name lookup/DeclContext patch from Chris
llvm-svn: 60897
2008-12-11 20:41:00 +00:00
Douglas Gregor 91f84216f7 Unifies the name-lookup mechanisms used in various parts of the AST
and separates lexical name lookup from qualified name lookup. In
particular:
  * Make DeclContext the central data structure for storing and
    looking up declarations within existing declarations, e.g., members
    of structs/unions/classes, enumerators in C++0x enums, members of
    C++ namespaces, and (later) members of Objective-C
    interfaces/implementations. DeclContext uses a lazily-constructed
    data structure optimized for fast lookup (array for small contexts,
    hash table for larger contexts). 

  * Implement C++ qualified name lookup in terms of lookup into
    DeclContext.

  * Implement C++ unqualified name lookup in terms of
    qualified+unqualified name lookup (since unqualified lookup is not
    purely lexical in C++!)

  * Limit the use of the chains of declarations stored in
    IdentifierInfo to those names declared lexically.

  * Eliminate CXXFieldDecl, collapsing its behavior into
    FieldDecl. (FieldDecl is now a ScopedDecl).

  * Make RecordDecl into a DeclContext and eliminates its
    Members/NumMembers fields (since one can just iterate through the
    DeclContext to get the fields).

llvm-svn: 60878
2008-12-11 16:49:14 +00:00
Ted Kremenek d8242f19f7 Rename SymbolID to SymbolRef. This is a precursor to some overhauling of the representation of symbolic values.
llvm-svn: 60575
2008-12-05 02:27:51 +00:00
Ted Kremenek d368de794a StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a GRState* argument instead of a Store. This allows them to use the GDM for storing other data.
llvm-svn: 60570
2008-12-05 00:47:52 +00:00
Ted Kremenek 677779ab36 Revamp RegionStoreManager::RemoveDeadBindings. This method now does a complete mark-and-sweep of the store, removing dead regions and recording the set of live and dead symbols appropriately.
llvm-svn: 60523
2008-12-04 02:08:27 +00:00
Zhongxing Xu 96c0fa8b42 Add comments.
llvm-svn: 60516
2008-12-04 01:12:41 +00:00
Sebastian Redl 6ef75e9ee8 Make RegionStoreManager::InitializeArray safe against array sizes that don't have pointer width.
This may be the case on 64-bit systems. Whether that fact is a bug is a different question, but it's easy to cure the symptom.

llvm-svn: 60422
2008-12-02 16:47:35 +00:00
Zhongxing Xu d2fa1e0999 Add support for initializing array with string literal.
This fixes PR3127
http://llvm.org/bugs/show_bug.cgi?id=3127

llvm-svn: 60280
2008-11-30 05:49:49 +00:00
Zhongxing Xu 452273d9c6 To be consistent, make the index of the ElementRegion always signed.
llvm-svn: 60248
2008-11-29 12:05:04 +00:00
Zhongxing Xu e31a8ebfdc Fix a serious bug.
When initialized, the index of the ElementRegion was unsigned. But the index
value of the ArraySubscriptExpr is signed. This inconsistency caused the value
of the array element retrieved to be UnknownVal despite it was initialized to
symbolic.

This is only a hack. Real fix of this problem is required.

llvm-svn: 60207
2008-11-28 08:41:39 +00:00
Zhongxing Xu 85b6e201f4 Use std::make_pair instead of std::pair's ctor.
llvm-svn: 60205
2008-11-28 03:55:52 +00:00
Zhongxing Xu b670f294c9 RegionViewMap factory is actually not used. All GDMs should use factories from
GDMContext.

llvm-svn: 60150
2008-11-27 06:03:03 +00:00
Sebastian Redl f7cb84d771 Fix the fix of revision 59974. Now array-struct.c passes too.
llvm-svn: 59975
2008-11-24 19:39:40 +00:00
Sebastian Redl 81c1e1306c Fix crash of array bounds checking under 64-bit.
There might be other, similar bugs lurking there.

llvm-svn: 59974
2008-11-24 19:35:33 +00:00
Zhongxing Xu 9165ed69af Add support for AllocaRegion extent with GDM.
One design problem that is emerging is the signed-ness problem during static
analysis. Many unsigned value have to be converted into signed value because
it partipates in operations with signed values. 

On the other hand, we cannot blindly make all values occuring in static analysis
signed, because we do have cases where unsignedness is required, for example,
integer overflow detection.

llvm-svn: 59957
2008-11-24 09:44:56 +00:00
Zhongxing Xu f556cd6cb9 Strings are NULL terminated. So the region size should plus one.
llvm-svn: 59943
2008-11-24 05:16:01 +00:00
Zhongxing Xu 8361d4c51b Add a comment about the signedness.
llvm-svn: 59932
2008-11-24 02:30:48 +00:00
Zhongxing Xu a61731dd0d Add getSize() support for StringRegion.
llvm-svn: 59930
2008-11-24 02:18:56 +00:00
Zhongxing Xu cdf25053ee Clean up code by using utility methods.
llvm-svn: 59899
2008-11-23 04:30:35 +00:00
Zhongxing Xu 4c8bf0086a Remove debug code.
llvm-svn: 59870
2008-11-22 13:23:00 +00:00
Zhongxing Xu 4d45b34a8a Initial support for checking out of bound memory access. Only support
ConcreteInt index for now.

llvm-svn: 59869
2008-11-22 13:21:46 +00:00
Zhongxing Xu e5816f213d Add support for symbolicating global structs and arrays in RegionStoreManager::getInitialStore().
llvm-svn: 59619
2008-11-19 11:06:24 +00:00
Ted Kremenek c0145fd0bf Fix warning about RegionStoreManager::Retrieve() not always returning a value.
llvm-svn: 59571
2008-11-19 00:27:37 +00:00