Commit Graph

21 Commits

Author SHA1 Message Date
Anna Zaks cf8d2165ff Revert "[analyzer] Refactor conditional expression evaluating code"
This reverts commit r189090.

The original patch introduced regressions (see the added live-variables.* tests). The patch depends on the correctness of live variable analyses, which are not computed correctly. I've opened PR18159 to track the proper resolution to this problem.

The patch was a stepping block to r189746. This is why part of the patch reverts temporary destructor tests that started crashing. The temporary destructors feature is disabled by default.

llvm-svn: 196593
2013-12-06 18:56:29 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
Pavel Labath 375e18e32c [analyzer] Enable usage of temporaries in InitListExprs
Summary:
ExprEngine had code which specificaly disabled using CXXTempObjectRegions in
InitListExprs. This was a hack put in r168757 to silence a false positive.

The underlying problem seems to have been fixed in the mean time, as removing
this code doesn't seem to break anything. Therefore I propose to remove it and
solve PR16629 in the process.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1325

llvm-svn: 188059
2013-08-09 07:46:29 +00:00
Pavel Labath e4e308625a Fix tests on targets that don't support thread_local
This also reverts r187197.

llvm-svn: 187199
2013-07-26 12:50:30 +00:00
Rafael Espindola 81d648827f Add a triple. Should fix the windows bots.
llvm-svn: 187197
2013-07-26 12:40:55 +00:00
Pavel Labath cf878bbe65 [analyzer] Fix FP warnings when binding a temporary to a local static variable
Summary:
When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

llvm-svn: 187196
2013-07-26 11:50:42 +00:00
Jordan Rose e15a8a49c4 [analyzer] Add regression test for the crash in PR16664.
This goes with r186925, which reverted Pavel's commit in r186498.

Also, add a correctness test for the future.

llvm-svn: 187133
2013-07-25 17:22:05 +00:00
Jordan Rose 5d2abefb62 [analyzer] Handle CXXTemporaryObjectExprs in compound literals.
This occurs because in C++11 the compound literal syntax can trigger a
constructor call via list-initialization. That is, "Point{x, y}" and
"(Point){x, y}" end up being equivalent. If this occurs, the inner
CXXConstructExpr will have already handled the object construction; the
CompoundLiteralExpr just needs to propagate that value forwards.

<rdar://problem/13804098>

llvm-svn: 181213
2013-05-06 16:48:20 +00:00
Jordan Rose 861a174018 [analyzer] Don't look through casts when creating pointer temporaries.
Normally, we need to look through derived-to-base casts when creating
temporary object regions (added in r175854). However, if the temporary
is a pointer (rather than a struct/class instance), we need to /preserve/
the base casts that have been applied.

This also ensures that we really do create a new temporary region when
we need to: MaterializeTemporaryExpr and lvalue CXXDefaultArgExprs.

Fixes PR15342, although the test case doesn't include the crash because
I couldn't isolate it.

llvm-svn: 176069
2013-02-26 01:21:27 +00:00
Jordan Rose c948709cda [analyzer] StackAddrEscapeChecker: strip qualifiers from temporary types.
With the new support for trivial copy constructors, we are not always
consistent about whether a CXXTempObjectRegion gets reused or created
from scratch, which affects whether qualifiers are preserved. However,
we probably don't care anyway.

This also switches to using the current PrintingPolicy for the type,
which means C++ types don't get a spurious 'struct' prefix anymore.

llvm-svn: 176068
2013-02-26 01:21:21 +00:00
Jordan Rose 5772f82d1e [analyzer] Make sure a materialized temporary matches its bindings.
This is a follow-up to r175830, which made sure a temporary object region
created for, say, a struct rvalue matched up with the initial bindings
being stored into it. This does the same for the case in which the AST
actually tells us that we need to create a temporary via a
MaterializeObjectExpr. I've unified the two code paths and moved a static
helper function onto ExprEngine.

This also caused a bit of test churn, causing us to go back to describing
temporary regions without a 'const' qualifier. This seems acceptable; it's
our behavior from a few months ago.

<rdar://problem/13265460> (part 2)

llvm-svn: 175854
2013-02-22 01:51:15 +00:00
Jordan Rose fe03e40d83 [analyzer] Make sure a temporary object region matches its initial bindings.
When creating a temporary region (say, when a struct rvalue is used as
the base of a member expr), make sure we account for any derived-to-base
casts. We don't actually record these in the LazyCompoundVal that
represents the rvalue, but we need to make sure that the temporary region
we're creating (a) matches the bindings, and (b) matches its expression.

Most of the time this will do exactly the same thing as before, but it
fixes spurious "garbage value" warnings introduced in r175234 by the use
of lazy bindings to model trivial copy constructors.

<rdar://problem/13265460>

llvm-svn: 175830
2013-02-21 23:57:17 +00:00
Jordan Rose 88bb563c43 Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."
...after a host of optimizations related to the use of LazyCompoundVals
(our implementation of aggregate binds).

Originally applied in r173951.
Reverted in r174069 because it was causing hangs.
Re-applied in r174212.
Reverted in r174265 because it was /still/ causing hangs.

If this needs to be reverted again it will be punted to far in the future.

llvm-svn: 175234
2013-02-15 00:32:15 +00:00
Jordan Rose e0c260f137 Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."
...again. The problem has not been fixed and our internal buildbot is still
getting hangs.

This reverts r174212, originally applied in r173951, then reverted in r174069.
Will not re-apply until the entire project analyzes successfully on my
local machine.

llvm-svn: 174265
2013-02-02 05:15:53 +00:00
Jordan Rose b6717cc6d0 Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."
With the optimization in the previous commit, this should be safe again.

Originally applied in r173951, then reverted in r174069.

llvm-svn: 174212
2013-02-01 19:49:59 +00:00
Jordan Rose 92d999b3f1 Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."
It's causing hangs on our internal analyzer buildbot. Will restore after
investigating.

This reverts r173951 / baa7ca1142990e1ad6d4e9d2c73adb749ff50789.

llvm-svn: 174069
2013-01-31 18:04:03 +00:00
Jordan Rose 4cf4f8a5d4 [analyzer] Model trivial copy/move ctors with an aggregate bind.
This is faster for the analyzer to process than inlining the constructor
and performing a member-wise copy, and it also solves the problem of
warning when a partially-initialized POD struct is copied.

Before:
  CGPoint p;
  p.x = 0;
  CGPoint p2 = p; <-- assigned value is garbage or undefined

After:
  CGPoint p;
  p.x = 0;
  CGPoint p2 = p; // no-warning

This matches our behavior in C, where we don't see a field-by-field copy.

<rdar://problem/12305288>

llvm-svn: 173951
2013-01-30 18:16:06 +00:00
Anna Zaks 6bab4ef4e8 [analyzer] Replace "-analyzer-ipa" with "-analyzer-config ipa".
The idea is to eventually place all analyzer options under
"analyzer-config". In addition, this lays the ground for introduction of
a high-level analyzer mode option, which will influence the
default setting for IPAMode.

llvm-svn: 173385
2013-01-24 23:15:30 +00:00
Jordan Rose 2c625dd6f9 [analyzer] C++ objects returned on the stack may be wrapped in ExprWithCleanups.
In C++, objects being returned on the stack are actually copy-constructed into
the return value. That means that when a temporary is returned, it still has
to be destroyed, i.e. the returned expression will be wrapped in an
ExprWithCleanups node. Our "returning stack memory" checker needs to look
through this node to see if we really are returning an object by value.

PR13722

llvm-svn: 162817
2012-08-29 01:11:59 +00:00
Douglas Gregor 79a2788512 Revert my lame attempt at appeasing the CFGBuilder
llvm-svn: 112580
2010-08-31 05:36:56 +00:00
Douglas Gregor f5d453d067 Teach the CFGBuilder not do die on CXXBindTemporaryExpr, CXXOperatorCallExpr. Fixes a Boost.Graph crasher.
llvm-svn: 112578
2010-08-31 05:10:27 +00:00