Commit Graph

1539 Commits

Author SHA1 Message Date
Anna Zaks 0dffbd6b8e [analyzer] Convert SimpleStreamChecker to use the PointerEscape callback
The new callback greatly simplifies the checker.

llvm-svn: 170969
2012-12-22 00:18:39 +00:00
Anna Zaks 1ee76c1bae [analyzer] Re-apply r170826 and make the dumping of the GallGraph
deterministic.

Commit message for r170826:

[analyzer] Traverse the Call Graph in topological order.

Modify the call graph by removing the parentless nodes. Instead all
nodes are children of root to ensure they are all reachable. Remove the
tracking of nodes that are "top level" or global. This information is
not used and can be obtained from the Decls stored inside
CallGraphNodes.

Instead of existing ordering hacks, analyze the functions in topological
order over the Call Graph.

Together with the addition of devirtualizable ObjC message sends and
blocks to the call graph, this gives around 6% performance improvement
on several large ObjC benchmarks.

llvm-svn: 170906
2012-12-21 17:27:01 +00:00
Roman Divacky 241f45118b Remove duplicate includes.
llvm-svn: 170903
2012-12-21 17:07:08 +00:00
Anna Zaks 9747febba9 [analyzer] Address Jordan's nitpicks as per code review of r170625.
llvm-svn: 170832
2012-12-21 01:50:14 +00:00
Rafael Espindola e7ec558f25 Revert r170826. The output of
./bin/clang -cc1 -internal-isystem /home/espindola/llvm/build/lib/clang/3.3/include/ -analyze -analyzer-checker=debug.DumpCallGraph /home/espindola/llvm/clang/test/Analysis/debug-CallGraph.c -fblocks

changes in each run.

llvm-svn: 170829
2012-12-21 01:30:23 +00:00
Anna Zaks 77ca7f1bbe [analyzer] Traverse the Call Graph in topological order.
Modify the call graph by removing the parentless nodes. Instead all
nodes are children of root to ensure they are all reachable. Remove the
tracking of nodes that are "top level" or global. This information is
not used and can be obtained from the Decls stored inside
CallGraphNodes.

Instead of existing ordering hacks, analyze the functions in topological
order over the Call Graph.

Together with the addition of devirtualizable ObjC message sends and
blocks to the call graph, this gives around 6% performance improvement
on several large ObjC benchmarks.

llvm-svn: 170826
2012-12-21 01:19:22 +00:00
Anna Zaks 5c32dfc5fb [analyzer] Add blocks and ObjC messages to the call graph.
This paves the road for constructing a better function dependency graph.
If we analyze a function before the functions it calls and inlines,
there is more opportunity for optimization.

Note, we add call edges to the called methods that correspond to
function definitions (declarations with bodies).

llvm-svn: 170825
2012-12-21 01:19:15 +00:00
Ted Kremenek 89abaa3517 Update RetainCountChecker to understand attribute ns_returns_autoreleased.
Fixes <rdar://problem/12887356>.

llvm-svn: 170724
2012-12-20 19:36:22 +00:00
Anna Zaks dc15415da4 [analyzer] Add the pointer escaped callback.
Instead of using several callbacks to identify the pointer escape event,
checkers now can register for the checkPointerEscape.

Converted the Malloc checker to use the new callback.
SimpleStreamChecker will be converted next.

llvm-svn: 170625
2012-12-20 00:38:25 +00:00
Ted Kremenek 3a081a0339 Pass AnalyzerOptions to PathDiagnosticConsumer to make analyzer options accessible there.
This is plumbing needed for later functionality changes.

llvm-svn: 170488
2012-12-19 01:35:35 +00:00
Argyrios Kyrtzidis 475b399721 Don't include the header outside the include guards, it defeats the purpose of the include guards.
llvm-svn: 170364
2012-12-17 20:10:49 +00:00
Anna Zaks ad3704c96a [analyzer] Tweak the NumFunctionsAnalyzed stat so that it's more useful.
llvm-svn: 170362
2012-12-17 20:08:54 +00:00
Anna Zaks d53182b0df [analyzer] Implement "do not inline large functions many times"
performance heuristic

After inlining a function with more than 13 basic blocks 32 times, we
are not going to inline it anymore. The idea is that inlining large
functions leads to drastic performance implications. Since the function
has already been inlined, we know that we've analyzed it in many
contexts. 

The following metrics are used:
 - Large function is a function with more than 13 basic blocks (we
should switch to another metric, like cyclomatic complexity)
 - We consider that we've inlined a function many times if it's been
inlined 32 times. This number is configurable with -analyzer-config
max-times-inline-large=xx

This heuristic addresses a performance regression introduced with
inlining on one benchmark. The analyzer on this benchmark became 60
times slower with inlining turned on. The heuristic allows us to analyze
it in 24% of the time. The performance improvements on the other
benchmarks I've tested with are much lower - under 10%, which is
expected.

llvm-svn: 170361
2012-12-17 20:08:51 +00:00
Anton Yartsev 20ae1dbfd1 fixed line endings
llvm-svn: 170238
2012-12-14 20:28:48 +00:00
Anton Yartsev 5363bf157f added post-statement callback to CXXNewExpr and pre-statement callback to CXXDeleteExpr
llvm-svn: 170234
2012-12-14 19:48:34 +00:00
Anna Zaks a40bcac0ef [analyzer] Propagate the checker's state from checkBranchCondition
Fixes a bug, where we were dropping the state modifications from the
checkBranchCondition checker callback.

llvm-svn: 170232
2012-12-14 19:08:20 +00:00
Anna Zaks 5f2af81e79 [analyzer] Refactor: Store visited Decls instead of CallGraphNodes.
llvm-svn: 170231
2012-12-14 19:08:17 +00:00
Ted Kremenek 45bb8db372 Refactor dump methods to make RegionBindingsRef printable in the debugger.
llvm-svn: 170170
2012-12-14 01:23:13 +00:00
Jordan Rose 2806a549b4 [analyzer] Fix doc error (wrong param name) in ObjCSuperCallChecker.
Thanks for the -Wdocumentation catch, Dmitri!

llvm-svn: 170139
2012-12-13 18:26:05 +00:00
Jordan Rose b0fe7fdb57 [analyzer] Generalize ObjCMissingSuperCallChecker.
We now check a few methods for UIResponder, NSResponder, and NSDocument.

Patch by Julian Mayer!

llvm-svn: 170089
2012-12-13 03:06:45 +00:00
Anna Zaks 3f12949b25 [analyzer] Fix a self-init checker false positive.
This is a Band-Aid fix to a false positive, where we complain about not
initializing self to [super init], where self is not coming from the
init method, but is coming from the caller to init.

The proper solution would be to associate the self and it's state with
the enclosing init.

llvm-svn: 170059
2012-12-13 00:42:19 +00:00
Jordan Rose 4cfdbff3c7 [analyzer] Don't crash running destructors for multidimensional arrays.
We don't handle array destructors correctly yet, but we now apply the same
hack (explicitly destroy the first element, implicitly invalidate the rest)
for multidimensional arrays that we already use for linear arrays.

<rdar://problem/12858542>

llvm-svn: 170000
2012-12-12 19:13:44 +00:00
Anna Zaks a7b1c47c1a [analyzer] Don't generate a summary for "freeWhenDone" if method is
inlined.

Fixes a false positive that occurs if a user writes their own
initWithBytesNoCopy:freeWhenDone wrapper.

llvm-svn: 169795
2012-12-11 00:17:53 +00:00
Anna Zaks 5d484780fb [analyzer] Optimization heuristic: do not reanalyze every ObjC method as
top level.

This heuristic is already turned on for non-ObjC methods
(inlining-mode=noredundancy). If a method has been previously analyzed,
while being inlined inside of another method, do not reanalyze it as top
level.

This commit applies it to ObjCMethods as well. The main caveat here is
that to catch the retain release errors, we are still going to reanalyze
all the ObjC methods but without inlining turned on.

Gives 21% performance increase on one heavy ObjC benchmark, which
suffered large performance regressions due to ObjC inlining.

llvm-svn: 169639
2012-12-07 21:51:47 +00:00
Jordan Rose 9a33913645 [analyzer] Fix r168019 to work with unpruned paths as well.
This is the case where the analyzer tries to print out source locations
for code within a synthesized function body, which of course does not have
a valid source location. The previous fix attempted to do this during
diagnostic path pruning, but some diagnostics have pruning disabled, and
so any diagnostic with a path that goes through a synthesized body will
either hit an assertion or emit invalid output.

<rdar://problem/12657843> (again)

llvm-svn: 169631
2012-12-07 19:56:29 +00:00
Ted Kremenek 54c9a4fad1 Reduce conversions between Store <-> ImmutableMapRef in RegionStore.
This reduces canonicalization of ImmutableMaps.  This reduces analysis time
of one heavy Objective-C file by another 1%.

llvm-svn: 169630
2012-12-07 19:54:25 +00:00
Ted Kremenek 897702e30a Add helper method to convert from a RegionStoreRefBindings to a Store.
llvm-svn: 169622
2012-12-07 18:32:08 +00:00
Ted Kremenek 245e45af7d Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition().
The same queries can happen thousands of times.  This reduces the analysis
time on one heavy Objective-C file by 2.4%.

llvm-svn: 169589
2012-12-07 07:30:19 +00:00
Ted Kremenek f19db16b0e Further reduce analysis time by 0.2% on a heavy Objective-C example by avoiding over-eager canonicalization of clusters.
llvm-svn: 169586
2012-12-07 06:49:27 +00:00
David Blaikie b006d38476 Unbreak the GCC (4.4 & other bot) builds from r169571.
llvm-svn: 169581
2012-12-07 03:28:20 +00:00
Ted Kremenek 147784fdf2 Change RegionStore to always use ImmutableMapRef for processing cluster bindings.
This reduces analysis time by 1.2% on one test case (Objective-C), but
also cleans up some of the code conceptually as well.  We can possible
just make RegionBindingsRef -> RegionBindings, but I wanted to stage
things.

After this, we should revisit Jordan's optimization of not canonicalizing
the immutable AVL trees for the cluster bindings as well.

llvm-svn: 169571
2012-12-07 01:55:21 +00:00
Ted Kremenek cb95a8fd20 Revert "[analyzer] Aggressively cut back on the canonicalization in RegionStore."
Jordan and I discussed this, and we are going to do this another way.

llvm-svn: 169538
2012-12-06 19:40:32 +00:00
Jordan Rose b10aae3fec [analyzer] Remove isa<> followed by dyn_cast<>.
llvm-svn: 169530
2012-12-06 18:58:29 +00:00
Jordan Rose 642e063838 [analyzer] Remove unused fields from ExprEngine.
'currStmt', 'CleanedState', and 'EntryNode' were being set, but only ever
used locally.

llvm-svn: 169529
2012-12-06 18:58:26 +00:00
Jordan Rose de606eaf18 [analyzer] Remove checks that predate the linearized CFG.
llvm-svn: 169528
2012-12-06 18:58:22 +00:00
Jordan Rose ff03c1d26d [analyzer] Simplify RetainCountChecker's handling of dead symbols.
Previously we made three passes over the set of dead symbols, and removed
them from the state /twice/. Now we combine the autorelease pass and the
symbol death pass, and only have to remove the bindings for the symbols
that leaked.

llvm-svn: 169527
2012-12-06 18:58:18 +00:00
Jordan Rose 5e4e61ddf9 [analyzer] Use a smarter algorithm to find the last block in an inlined call.
Previously we would search for the last statement, then back up to the
entrance of the block that contained that statement. Now, while we're
scanning for the statement, we just keep track of which blocks are being
exited (in reverse order).

llvm-svn: 169526
2012-12-06 18:58:15 +00:00
Jordan Rose 1ecba4cc69 [analyzer] Use optimized assumeDual for branches.
This doesn't seem to make much of a difference in practice, but it does
have the potential to avoid a trip through the constraint manager.

llvm-svn: 169524
2012-12-06 18:58:09 +00:00
Jordan Rose 5f28afc8a1 [analyzer] Aggressively cut back on the canonicalization in RegionStore.
Whenever we touch a single bindings cluster multiple times, we can delay
canonicalizing it until the final access. This has some interesting
implications, in particular that we shouldn't remove an /empty/ cluster
from the top-level map until canonicalization.

This is good for a 2% speedup or so on the test case in
<rdar://problem/12810842>

llvm-svn: 169523
2012-12-06 18:58:06 +00:00
Jordan Rose 047208027a [analyzer] Remove bindExprAndLocation, which does extra work for no gain.
This feature was probably intended to improve diagnostics, but was currently
only used when dumping the Environment. It shows what location a given value
was loaded from, e.g. when evaluating an LValueToRValue cast.

llvm-svn: 169522
2012-12-06 18:58:01 +00:00
Ted Kremenek bcf905326c Only provide explicit getCapturedRegion() and getOriginalRegion() from referenced_vars_iterator.
This is a nice conceptual cleanup.

llvm-svn: 169480
2012-12-06 07:17:20 +00:00
Ted Kremenek ff989016c1 Pull logic to map from VarDecl* to captured region using a helper function. WIP.
llvm-svn: 169479
2012-12-06 07:17:13 +00:00
Ted Kremenek 8c2bbfceb7 Use 'getOriginalRegion()' rather than going through the logic to recreate it.
llvm-svn: 169478
2012-12-06 07:17:04 +00:00
Daniel Jasper 7308385539 Add missing virtual destructors reported by -Wnon-virtual-dtor.
llvm-svn: 169365
2012-12-05 09:23:48 +00:00
Anna Zaks 25dd07c112 [analyzer] Implement an opt-in variant of direct ivar assignment.
This will only check the direct ivar assignments in the annotated
methods.

llvm-svn: 169349
2012-12-05 01:14:37 +00:00
Ted Kremenek e71ce97689 Alphabetize source files, just like they have been before.
llvm-svn: 169318
2012-12-04 22:17:32 +00:00
Chandler Carruth 3a02247dc9 Sort all of Clang's files under 'lib', and fix up the broken headers
uncovered.

This required manually correcting all of the incorrect main-module
headers I could find, and running the new llvm/utils/sort_includes.py
script over the files.

I also manually added quite a few missing headers that were uncovered by
shuffling the order or moving headers up to be main-module-headers.

llvm-svn: 169237
2012-12-04 09:13:33 +00:00
Benjamin Kramer cfe5aedd5a Add raw_ostream include to pacify MSVC.
llvm-svn: 169097
2012-12-01 17:54:07 +00:00
Benjamin Kramer 444a1304ad Include pruning and general cleanup.
llvm-svn: 169095
2012-12-01 17:12:56 +00:00
Benjamin Kramer d7d2b1fe45 Don't include Type.h in DeclarationName.h.
Recursively prune some includes.

llvm-svn: 169094
2012-12-01 16:35:25 +00:00