Commit Graph

37 Commits

Author SHA1 Message Date
Jordan Rose 690c063b73 [analyzer] Remove the "direct bindings only" Environment lookup.
This was only used by OSAtomicChecker and makes it more
difficult to update values for expressions that the environment
may look through instead (it's not the same as IgnoreParens).
With this gone, we can have bindExpr bind to the inner
expression that getSVal will find.

Groundwork for <rdar://problem/12137950>

llvm-svn: 165866
2012-10-13 05:05:20 +00:00
Roman Divacky e637711ae0 Dont cast away const needlessly. Found by gcc48 -Wcast-qual.
llvm-svn: 163325
2012-09-06 15:59:27 +00:00
Jordan Rose e5d5393efc [analyzer] Support C++ default arguments if they are literal values.
A CXXDefaultArgExpr wraps an Expr owned by a ParmVarDecl belonging to the
called function. In general, ExprEngine and Environment ought to treat this
like a ParenExpr or other transparent wrapper expression, with the inside
expression evaluated first.

However, if we call the same function twice, we'd produce a CFG that contains
the same wrapped expression twice, and we're not set up to handle that. I've
added a FIXME to the CFG builder to come back to that, but meanwhile we can
at least handle expressions that don't need to be explicitly evaluated:
literals. This probably handles many common uses of default parameters:
true/false, null, etc.

Part of PR13385 / <rdar://problem/12156507>

llvm-svn: 162453
2012-08-23 18:10:53 +00:00
Jordan Rose 41c98d9dc3 [analyzer] Look through SubstNonTypeTemplateParmExprs.
We were treating this like a CXXDefaultArgExpr, but
SubstNonTypeTemplateParmExpr actually appears when a template is
instantiated, i.e. we have all the information necessary to evaluate it.
This allows us to inline functions like llvm::array_lengthof.

<rdar://problem/11949235>

llvm-svn: 160846
2012-07-27 01:15:02 +00:00
Ted Kremenek 80b4ac76c5 Remove the ability to stash arbitrary pointers into UndefinedVal (no longer needed).
llvm-svn: 160764
2012-07-25 22:09:19 +00:00
Jordan Rose 074ebb3a6f [analyzer] Remove obsolete ObjCPropRef SVal kind.
ObjC properties are handled through their semantic form of ObjCMessageExprs
and their wrapper PseudoObjectExprs, and have been for quite a while. The
syntactic ObjCPropertyRefExprs do not appear in the CFG and are not visited
by ExprEngine.

No functionality change.

llvm-svn: 160458
2012-07-18 21:59:37 +00:00
Ted Kremenek e87b55214b Teach the analyzer about CXXScaleValueInitExpr.
llvm-svn: 156369
2012-05-08 05:13:40 +00:00
Ted Kremenek 415287d943 Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.
llvm-svn: 152139
2012-03-06 20:06:12 +00:00
Ted Kremenek 3bc5372fae [analyzer] teach analyzer about ObjC literals, thus trimming out a false positive with the malloc() checker involving
comparing literal addresses to nil.

Fixes <rdar://problem/10579586>

llvm-svn: 151602
2012-02-28 00:56:05 +00:00
Ted Kremenek e0bce93e14 [analyzer] Don't generate an explicit ExplodedNode for StringLiterals; have the SVal lazily generated from Environment::getSVal().
llvm-svn: 151589
2012-02-27 23:34:19 +00:00
Ted Kremenek b14b42d477 Have ScanReachableSymbols reported reachable regions. Fixes a false positive with nested array literals. <rdar://problem/10686586>
llvm-svn: 151012
2012-02-21 00:46:29 +00:00
Benjamin Kramer 11764ab4c0 StaticAnalyzer: Move ObjC- and CXX-specific methods out of line so checkers that don't care about the language don't have to pull in all the headers.
llvm-svn: 149178
2012-01-28 12:06:22 +00:00
Ted Kremenek 49b1e38e4b Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.
At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

llvm-svn: 149081
2012-01-26 21:29:00 +00:00
David Blaikie e4d798f078 More dead code removal (using -Wunreachable-code)
llvm-svn: 148577
2012-01-20 21:50:17 +00:00
Ted Kremenek 3f406ba4bf Remove '#if 0' from ExprEngine::InlineCall(), and start fresh by wiring up inlining for straight C calls.
My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders
and re-evaluating how C++ calls are handled in the CFG.  The hope is to turn inlining "on-by-default" as soon as possible
with a core set of things working well, and then expand over time.

llvm-svn: 147904
2012-01-11 01:06:27 +00:00
Ted Kremenek 632e3b7ee2 [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining.  Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back.  There are also potential performance implications
of enlarging the Environment.  Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment.  This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

llvm-svn: 147688
2012-01-06 22:09:28 +00:00
Anna Zaks ff7da05670 Move immutable map canonization out of the removeDeadBindings loop (via using ImmutableMapRef). Gives ~2% speedup.
llvm-svn: 140403
2011-09-23 19:14:09 +00:00
Anna Zaks 9db35a8750 ST->scanReachableSymbols() is creating a SubRegionMap (SRM) on every call since one SRM is created in each ScanReachableSymbols instance. Creating the object just once and calling only scan inside the loop gives ~ 14% speed up of the StaticAnalyzer run (Release+Asserts).
Pull out the declaration of the ScanReachableSymbols so that it can be used directly. Document ProgramState::scanReachableSymbols() methods.

llvm-svn: 140323
2011-09-22 18:10:41 +00:00
Ted Kremenek 60d2ec5765 [analyzer] Handle reads of ObjCPropertyRefExprs implicitly in Environment. No need to bind an explicit value and create a new node.
llvm-svn: 138196
2011-08-20 06:23:25 +00:00
Ted Kremenek 001fd5b498 Rename GRState to ProgramState, and cleanup some code formatting along the way.
llvm-svn: 137665
2011-08-15 22:09:50 +00:00
Ted Kremenek 5ef32dbf2a Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.
llvm-svn: 137537
2011-08-12 23:37:29 +00:00
Ted Kremenek c91ca30b4c [analyzer] Change SymbolReaper to store region roots implied by the Environment, allowing it be queried when
determining if symbols derived from regions are still live.

llvm-svn: 137005
2011-08-06 00:29:57 +00:00
Chandler Carruth 605415923f Remove an unused function (found by Clang's -Wunused-function)
llvm-svn: 136434
2011-07-29 00:15:44 +00:00
Ted Kremenek e9fda1e48a [analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs.
The motivation of this large change is to drastically simplify the logic in ExprEngine going forward.

Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will
need to be fixed over time.  There is also some possible performance regression as RemoveDeadBindings
will be called frequently; this can also be improved over time.

llvm-svn: 136419
2011-07-28 23:07:59 +00:00
Ted Kremenek 47fc816b96 [analyzer] Teach Environment to not look through MaterializeTemporaryExprs.
llvm-svn: 136414
2011-07-28 23:07:41 +00:00
Chris Lattner 0e62c1cc0b remove unneeded llvm:: namespace qualifiers on some core types now that LLVM.h imports
them into the clang namespace.

llvm-svn: 135852
2011-07-23 10:55:15 +00:00
Douglas Gregor fe31481f68 Introduce a new AST node describing reference binding to temporaries.
MaterializeTemporaryExpr captures a reference binding to a temporary
value, making explicit that the temporary value (a prvalue) needs to
be materialized into memory so that its address can be used. The
intended AST invariant here is that a reference will always bind to a
glvalue, and MaterializeTemporaryExpr will be used to convert prvalues
into glvalues for that binding to happen. For example, given

  const int& r = 1.0;

The initializer of "r" will be a MaterializeTemporaryExpr whose
subexpression is an implicit conversion from the double literal "1.0"
to an integer value. 

IR generation benefits most from this new node, since it was
previously guessing (badly) when to materialize temporaries for the
purposes of reference binding. There are likely more refactoring and
cleanups we could perform there, but the introduction of
MaterializeTemporaryExpr fixes PR9565, a case where IR generation
would effectively bind a const reference directly to a bitfield in a
struct. Addresses <rdar://problem/9552231>.

llvm-svn: 133521
2011-06-21 17:03:29 +00:00
Jordy Rose 1734737d9f [analyzer] PR8962 again. Ban ParenExprs (and friends) from block-level expressions (by calling IgnoreParens before adding expressions to blocks). Undo 132769 (LiveVariables' local IgnoreParens), since it's no longer necessary.
Also, have Environment stop looking through NoOp casts; it didn't match the behavior of LiveVariables. And once that's gone, the whole cast block of that switch is unnecessary.

llvm-svn: 132840
2011-06-10 08:49:37 +00:00
Jordy Rose ab8a668849 [analyzer] Look through __extension__ expressions in a GRState's Environment. Fixes PR8962.
llvm-svn: 132762
2011-06-08 22:47:39 +00:00
Ted Kremenek 08b434f450 Allow 'Environment::getSVal()' to allow an optional way for checkers to do a direct lookup to values bound to expressions, without
resulting to lazy logic.  This is critical for the OSAtomicChecker that does a simulated load on any arbitrary expression.

llvm-svn: 130292
2011-04-27 05:34:09 +00:00
Ted Kremenek 11e5c8b31a Add static analyzer support for C++'0X nullptr. Patch by Jim Goodnow II.
llvm-svn: 130003
2011-04-22 18:01:30 +00:00
Peter Collingbourne 9114759641 C1X: implement generic selections
As an extension, generic selection support has been added for all
supported languages.  The syntax is the same as for C1X.

llvm-svn: 129554
2011-04-15 00:35:48 +00:00
Ted Kremenek d813801384 Fix tiny error in CFG construction for BinaryConditionalOperators, making sure the branch always has two successors. Also teach Environment::getSVal() about OpaqueValueExprs.
This fixes a crash reported in PR9287, and also fixes a false positive involving the value of such ternary
expressions not properly getting propagated.

llvm-svn: 126362
2011-02-24 03:09:15 +00:00
Argyrios Kyrtzidis 21f347e729 [analyzer] Fix crash when analyzing C++ code.
llvm-svn: 126013
2011-02-19 01:59:41 +00:00
Argyrios Kyrtzidis e34245b30b [analyzer] Fix crash when analyzing C++ code.
llvm-svn: 126007
2011-02-19 01:08:41 +00:00
Ted Kremenek f8cbac4b91 Split 'include/clang/StaticAnalyzer' into 'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'.
This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries.

llvm-svn: 125251
2011-02-10 01:03:03 +00:00
Argyrios Kyrtzidis fa0734ec4f [analyzer] Move the files in lib/StaticAnalyzer to lib/StaticAnalyzer/Core.
Eventually there will also be a lib/StaticAnalyzer/Frontend that will handle initialization and checker registration.
Yet another library to avoid cyclic dependencies between Core and Checkers.

llvm-svn: 125124
2011-02-08 22:30:36 +00:00