Commit Graph

1193 Commits

Author SHA1 Message Date
Jordy Rose 31ae259a41 [analyzer] Introduce clang_analyzer_eval for regression test constraint checks.
The new debug.ExprInspection checker looks for calls to clang_analyzer_eval,
and emits a warning of TRUE, FALSE, or UNKNOWN (or UNDEFINED) based on the
constrained value of its (boolean) argument. It does not modify the analysis
state though the conditions tested can result in branches (e.g. through the
use of short-circuit operators).

llvm-svn: 156919
2012-05-16 16:01:07 +00:00
Anna Zaks 58d986c866 [analyzer] Fix a regression in ObjCUnusedIVars checker.
We can no longer rely on children iterator to visit all the AST
tree children of an expression (OpaqueValueExpr has no children).

llvm-svn: 156870
2012-05-15 22:31:56 +00:00
Jordy Rose 459d5f62c2 [analyzer] strncpy: Special-case a length of 0 to avoid an incorrect warning.
We check the address of the last element accessed, but with 0 calculating that
address results in element -1. This patch bails out early (and avoids a bunch
of other work at that).

Fixes PR12807.

llvm-svn: 156769
2012-05-14 17:58:35 +00:00
Jordy Rose 6393f82b5b [analyzer] RetainCountChecker: track ObjC boxed expression objects.
llvm-svn: 156699
2012-05-12 05:10:43 +00:00
Anna Zaks e7e7c9ebf9 [analyzer] Do not walk the types for call graph construction.
llvm-svn: 156661
2012-05-11 23:15:18 +00:00
Argyrios Kyrtzidis 45f5118248 The Lexer constructor expects a source location at the start of the
file buffer, not at the start of lexing.

Fixes assertion hit in format diagnostics. rdar://11418366

llvm-svn: 156647
2012-05-11 21:39:18 +00:00
Ted Kremenek 2342067c6e Include line that was meant to be in my last commit.
llvm-svn: 156582
2012-05-10 22:49:10 +00:00
Ted Kremenek 77cbb8481b Fix insidious RegionStore bug where we (a) didn't handle vector types and (b) had
a horrible bug in GetLazyBindings where we falsely appended a field suffix when traversing 3 or more
layers of lazy bindings.  I don't have a reduced test case yet; but I have added the original source
to an internal regression test suite.  I'll see about coming up with a reduced test case.

Fixes <rdar://problem/11405978> (for real).

llvm-svn: 156580
2012-05-10 22:02:39 +00:00
Anna Zaks fe1ccee0f5 [analyzer] Exit early if constraint solver is given a non-integer symbol
to reason about.

As part of taint propagation, we now allow creation of non-integer
symbolic expressions like a cast from int to float.

Addresses PR12511 (radar://11215362).

llvm-svn: 156578
2012-05-10 21:49:52 +00:00
Anna Zaks 62cce9e47d [analyzer] Do not highlight the range of the statement in case of leak.
We report a leak at a point a leaked variable is no longer accessible.
The statement that happens to be at that point is not relevant to the
leak diagnostic and, thus, should not be highlighted.

radar://11178519

llvm-svn: 156530
2012-05-10 01:37:40 +00:00
Anna Zaks d60f4c8fef [analyzer] Simplify r156446, as per Ted's review.
llvm-svn: 156482
2012-05-09 17:23:15 +00:00
Anna Zaks 325520a7b8 [analyzer] Allow pointers to escape through selector callbacks.
llvm-svn: 156481
2012-05-09 17:23:11 +00:00
Anna Zaks d0f89283cf [analyzer] We currently do not fully support CompoundLiterals in
RegionStore, so be explicit about it and generate UnknownVal().

This is a hack to ensure we never produce undefined values for a value
coming from a compound value. (The undefined values can lead to
false positives.) 

radar://10127782

llvm-svn: 156446
2012-05-08 23:40:38 +00:00
Ted Kremenek f534e91882 Having RegionStore lower field bindings to raw offsets, just like ElementRegions. This is a bit
disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values
as structs.  Fixes <rdar://problem/11405978>.

llvm-svn: 156428
2012-05-08 21:49:54 +00:00
Ted Kremenek b4235b48ca When creating lazy bindings in RegionStore, propagate existing lazy bindings instead of creating new ones.
This is a functionality optimization.

llvm-svn: 156427
2012-05-08 21:49:51 +00:00
Ted Kremenek 228571b69b Include address of Store in graphviz output of ExplodedGraph.
llvm-svn: 156426
2012-05-08 21:49:47 +00:00
Anna Zaks 66843480a6 [analyzer] SelfInit: Stop tracking self if it's assigned a value we
don't reason about.

Self is just like a local variable in init methods, so it can be
assigned anything like result of static functions, other methods ... So
to suppress false positives that result in such cases, stop tracking the
checker-specific state after self is being assigned to (unless the
value is't being assigned to is either self or conforms to our rules).

This change does not invalidate any existing regression tests.

llvm-svn: 156420
2012-05-08 21:19:21 +00:00
Ted Kremenek e87b55214b Teach the analyzer about CXXScaleValueInitExpr.
llvm-svn: 156369
2012-05-08 05:13:40 +00:00
Jordy Rose 675d541ab6 [analyzer] BasicConstraintManager: drop NE-constraints once we have a value.
This could conceivably cut down on state proliferation, although we don't
use BasicConstraintManager by default anymore. No functionality change.

llvm-svn: 156362
2012-05-08 03:27:20 +00:00
Jordy Rose 728be7f6ac [analyzer] Rework both constraint managers to handle mixed-type comparisons.
This involves keeping track of three separate types: the symbol type, the
adjustment type, and the comparison type. For example, in "$x + 5 > 0ULL",
if the type of $x is 'signed char', the adjustment type is 'int' and the
comparison type is 'unsigned long long'. Most of the time these three types
will be the same, but we should still do the right thing when the
comparison value is out of range, and wraparound should be calculated in
the adjustment type.

This also re-disables an out-of-bounds test; we were extracting the symbol
from non-additive SymIntExprs, but then throwing away the integer.

Sorry for the large patch; both the basic and range constraint managers needed
to be updated together, since they share code in SimpleConstraintManager.

llvm-svn: 156361
2012-05-08 03:27:16 +00:00
Jordy Rose 7e3c3ea341 [analyzer] Add an abstraction for the bit width and signedness of an APSInt. No functionality change.
There are more parts of the analyzer that could use the convenience of APSIntType, particularly the constraint engine, but that needs a fair amount of rewriting to handle mixed-type constraints anyway.

llvm-svn: 156360
2012-05-08 03:26:58 +00:00
Ted Kremenek ececf9f0ae Teach the static analyzer that NSLog() and friends do not hold on to object references (thus extending their lifetime).
llvm-svn: 156346
2012-05-08 00:12:09 +00:00
Anna Zaks 590c7bc12e [analyzer]Turn on MallocSizeOfChecker by default; shorten the diagnostic
llvm-svn: 156341
2012-05-07 23:30:29 +00:00
Anna Zaks 386e832c07 [analyzer] Fix a crash in triggered by OSAtomicChecker.
SValBuilder should return an UnknownVal() when comparison of int and ptr
fails. Previous to this commit, it went on assuming that we are dealing
with pointer arithmetic.

PR12509, radar://11390991

llvm-svn: 156320
2012-05-07 19:40:49 +00:00
Anna Zaks 41e7ab8f81 [analyzer]Fixup r156215: use StopTracking summary instead of ScratchArgs
As per Jordy's and Ted's comment, use the default StopTracking summary
instead of adding all arguments to ScratchArs.

llvm-svn: 156310
2012-05-07 17:47:09 +00:00
David Blaikie 0f09df1f52 Remove variable made unused by r156270.
llvm-svn: 156273
2012-05-07 00:53:51 +00:00
Jordy Rose 54569448f8 [analyzer] Reduce parallel code paths in SimpleSValBuilder::evalBinOpNN, and handle mixed-type operations more generally.
The logical change is that the integers in SymIntExprs may not have the same type as the symbols they are paired with. This was already the case with taint-propagation expressions created by SValBuilder::makeSymExprValNN, but I think those integers may never have been used. SimpleSValBuilder should be able to handle mixed-integer-type SymIntExprs fine now, though, and the constraint managers were already being defensive (though not entirely correct). All existing tests pass.

The logic in evalBinOpNN has been simplified so that conversion is done as late as possible. As a result, most of the switch cases have been reduced to do the minimal amount of work, delegating to another case when they can by substituting ConcreteInts and (as before) reversing the left and right arguments when useful.

Comparisons require special handling in two places (building SymIntExprs and evaluating constant-constant operations) because we don't /know/ the best type for comparing the two values. I've approximated the rules in Sema [C99 6.3.1.8]  but it'd be nice to refactor Sema's actual algorithm into ASTContext.

This is also groundwork for handling mixed-type constraints better than we do now.

llvm-svn: 156270
2012-05-06 23:40:02 +00:00
Anna Zaks f4c5ea515f [analyzer] RetainCountChecker: Allow objects to escape through callbacks
Fixes radar://10973977.

llvm-svn: 156215
2012-05-04 22:18:39 +00:00
Ted Kremenek fd727748bd Explicitly model capturing variables for blocks in the static analyzer. Fixes <rdar://problem/11125868>.
llvm-svn: 156211
2012-05-04 21:48:42 +00:00
Anna Zaks 63509fbacc [analyzer]Fixup r156134: Handle the case when FunctionDecl isn't avail.
llvm-svn: 156183
2012-05-04 17:37:16 +00:00
Anna Zaks 6ccfcf346d [analyzer] Assume pointer escapes when a callback is passed inside
a struct.

llvm-svn: 156135
2012-05-03 23:50:33 +00:00
Anna Zaks 228f9c7b68 [analyzer] Allow pointers escape through calls containing callback args.
(Since we don't have a generic pointer escape callback, modify
ExprEngineCallAndReturn as well as the malloc checker.)

llvm-svn: 156134
2012-05-03 23:50:28 +00:00
Jordy Rose 1d4660bc51 [analyzer] When promoting constant integers in a comparison, use the larger width of the two to avoid truncation.
llvm-svn: 156089
2012-05-03 19:05:48 +00:00
Anna Zaks b3b56bb960 [analyzer] CString Checker: Do not split the path unless the user
specifically checks for equality to null.

Enforcing this general practice, which keeps the analyzer less
noisy, in the CString Checker. This change suppresses "Assigned value is
garbage or undefined" warning in the added test case.

llvm-svn: 156085
2012-05-03 18:21:28 +00:00
Jordy Rose d23232975f [analyzer] Equality ops are like relational ops in that the arguments shouldn't be converted to the result type. Fixes PR12206 and dupe PR12510.
This was probably the original intent of r133041 (also me, a year ago).

llvm-svn: 156062
2012-05-03 07:34:01 +00:00
Anna Zaks 1655aee1e3 [analyzer] Conjure a symbol to ensure we can identify pointer arithmetic
We need to identify the value of ptr as
ElementRegion (result of pointer arithmetic) in the following code.
However, before this commit '(2-x)' evaluated to Unknown value, and as
the result, 'p + (2-x)' evaluated to Unknown value as well.

int *p = malloc(sizeof(int));
ptr = p + (2-x);

llvm-svn: 156052
2012-05-03 02:13:56 +00:00
Anna Zaks f0e9ca8604 [analyzer] Do not assert on constructing SymSymExpr with diff types.
The resulting type info is stored in the SymSymExpr, so no reason not to
support construction of expression with different subexpression types.

llvm-svn: 156051
2012-05-03 02:13:53 +00:00
Anna Zaks 1d3d51a6e6 [analyzer] Add a complexity bound on history tracking.
(Currently, this is only relevant for tainted data.)

llvm-svn: 156050
2012-05-03 02:13:50 +00:00
Anna Zaks 7124b4b124 [analyzer] Revert the functional part of r155944.
The change resulted in multiple issues on the buildbot, so it's not
ready for prime time. Only enable history tracking for tainted
data(which is experimental) for now.

llvm-svn: 156049
2012-05-03 02:13:46 +00:00
Ted Kremenek 170641b0e0 Refine analyzer diagnostics by adding an expression "cone-of-influence" to reverse track interesting
values through interesting expressions.  This allows us to map from interesting values in a caller
to interesting values in a caller, thus recovering some precision in diagnostics lost from IPA.

Fixes <rdar://problem/11327497>

llvm-svn: 155971
2012-05-02 00:31:29 +00:00
Anna Zaks 70de772d45 [analyzer] RetainRelease: Self assignment should not suppress a leak
warning.

llvm-svn: 155966
2012-05-02 00:15:40 +00:00
Anna Zaks 06be9117bf [analyzer] Fix an assertion failure triggered by the analyzer buildbot.
llvm-svn: 155964
2012-05-02 00:05:23 +00:00
Anna Zaks 263b7e016e [analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.
llvm-svn: 155963
2012-05-02 00:05:20 +00:00
Ted Kremenek f56d4f2991 Teach SValBuilder to handle casts of symbolic pointer values to an integer twice. Fixes <rdar://problem/11212866>.
llvm-svn: 155950
2012-05-01 21:58:29 +00:00
Anna Zaks b35437a85e [analyzer] Construct a SymExpr even when the constraint solver cannot
reason about the expression.

This essentially keeps more history about how symbolic values were
constructed. As an optimization, previous to this commit, we only kept
the history if one of the symbols was tainted, but it's valuable keep
the history around for other purposes as well: it allows us to avoid
constructing conjured symbols.

Specifically, we need to identify the value of ptr as
ElementRegion (result of pointer arithmetic) in the following code.
However, before this commit '(2-x)' evaluated to Unknown value, and as
the result, 'p + (2-x)' evaluated to Unknown value as well.

int *p = malloc(sizeof(int));
ptr = p + (2-x);

This change brings 2% slowdown on sqlite. Fixes radar://11329382.

llvm-svn: 155944
2012-05-01 21:10:26 +00:00
Ted Kremenek 555560c490 Teach RetainCountchecker about IORegistryEntrySearchCFProperty returning retained objects. I know there is an SDK enhancement request for this to have the cf_returns_retained annotation, so this is just a stop gap.
llvm-svn: 155887
2012-05-01 05:28:27 +00:00
Ted Kremenek ad8cd30095 malloc size checker: Ignore const'ness of pointer types when determining of a sizeof() type is compatible with a pointed type.
Fixes <rdar://problem/11292586>.

llvm-svn: 155864
2012-05-01 00:10:19 +00:00
David Blaikie 2d7c57ec1d Remove the ref/value inconsistency in filter_decl_iterator.
filter_decl_iterator had a weird mismatch where both op* and op-> returned T*
making it difficult to generalize this filtering behavior into a reusable
library of any kind.

This change errs on the side of value, making op-> return T* and op* return
T&.

(reviewed by Richard Smith)

llvm-svn: 155808
2012-04-30 02:36:29 +00:00
Jordy Rose 4f8198e788 [analyzer] Remove references to idx::TranslationUnit. Index is dead, cross-TU inlining never panned out.
llvm-svn: 155751
2012-04-28 01:58:08 +00:00
Ted Kremenek 2964aac03b Use a deque instead of an ImmutableList in AnalysisConsumer to preserve the file order that functions are visited. Should fix the buildbots.
llvm-svn: 155693
2012-04-27 04:54:28 +00:00
Ted Kremenek b2a470646a Change FunctionSummary.h's definition of SetOfDecls to be an ImmutableList instead
of a mutable SmallPtrSet.  While iterating over LocalTUDecls, there were cases
where we could modify LocalTUDecls, which could result in invalidating an iterator
and an analyzer crash.  Along the way, switch some uses of std::queue to std::dequeue,
which should be slightly more efficient.

Unfortunately, this is a difficult case to create a test case for.

llvm-svn: 155680
2012-04-27 00:38:33 +00:00
Ted Kremenek 468365b6be [analyzer] check lazy bindings in RegionStore first before looking for default values. Fixes <rdar://problem/11269741>.
llvm-svn: 155615
2012-04-26 05:08:26 +00:00
Ted Kremenek 01d152f43f Teach RetainCountChecker that it doesn't quite understand pthread_setspecific and it should just give up when it sees it. Fixes <rdar://problem/11282706>.
llvm-svn: 155613
2012-04-26 04:32:23 +00:00
Anna Zaks 7e53bd6fb0 [analyzer] Run remove dead bindings right before leaving a function.
This is needed to ensure that we always report issues in the correct
function. For example, leaks are identified when we call remove dead
bindings. In order to make sure we report a callee's leak in the callee,
we have to run the operation in the callee's context.

This change required quite a bit of infrastructure work since:
 - We used to only run remove dead bindings before a given statement;
here we need to run it after the last statement in the function. For
this, we added additional Program Point and special mode in the
SymbolReaper to remove all symbols in context lower than the current
one.
 - The call exit operation turned into a sequence of nodes, which are
now guarded by CallExitBegin and CallExitEnd nodes for clarity and
convenience.

(Sorry for the long diff.)

llvm-svn: 155244
2012-04-20 21:59:08 +00:00
Patrick Beard 0caa39474b Implements boxed expressions for Objective-C. <rdar://problem/10194391>
llvm-svn: 155082
2012-04-19 00:25:12 +00:00
Ted Kremenek 92e27e0900 Change ExprEngine::shouldInlineDecl() to be defensive in checking if the CFG of the callee is valid. Fixes <rdar://problem/11257631>.
llvm-svn: 154896
2012-04-17 01:36:03 +00:00
Anna Zaks 51244c22be [analyzer] Fix a false alarm in SelfInitChecker (radar://11235991).
Along with it, fix a couple of other corner cases and add more tests.

llvm-svn: 154866
2012-04-16 21:51:09 +00:00
Richard Smith c202b2809a Add an AttributedStmt type to represent a statement with C++11 attributes
attached. Since we do not support any attributes which appertain to a statement
(yet), testing of this is necessarily quite minimal.

Patch by Alexander Kornienko!

llvm-svn: 154723
2012-04-14 00:33:13 +00:00
Douglas Gregor 0481c8f206 Remove the unused, unmaintained, incomplete 'Index' library.
llvm-svn: 154672
2012-04-13 16:31:46 +00:00
Anna Zaks 8e0785286a [analyzer] PCH deserialization optimization.
We should not deserialize unused declarations from the PCH file. Achieve
this by storing the top level declarations during parsing
(HandleTopLevelDecl ASTConsumer callback) and analyzing/building a call
graph only for those.

Tested the patch on a sample ObjC file that uses PCH. With the patch, 
 the analyzes is 17.5% faster and clang consumes 40% less memory.
Got about 10% overall build/analyzes time decrease on a large Objective
C project.

A bit of CallGraph refactoring/cleanup as well..

llvm-svn: 154625
2012-04-12 22:36:48 +00:00
Anna Zaks f36a6f54ae [analyzer] dynamic_cast Simplify null value generation.
As per Jordy's review. Creating a symbol here is more flexible; however
I could not come up with an example where it was needed. (What
constrains can be added on of the symbol constrained to 0?)

llvm-svn: 154542
2012-04-11 22:20:07 +00:00
Anna Zaks b508d29b78 [analyzer] Don't crash even when the system functions are redefined.
(Applied changes to CStringAPI, Malloc, and Taint.)

This might almost never happen, but we should not crash even if it does.
This fixes a crash on the internal analyzer buildbot, where postgresql's
configure was redefining memmove (radar://11219852).

llvm-svn: 154451
2012-04-10 23:41:11 +00:00
Anna Zaks 02ecae9282 [analyzer] dynamic_cast: Better model cast from a reference.
Generate a sink when the dynamic_cast from a reference fails to
represent a thrown exception.

llvm-svn: 154438
2012-04-10 21:29:03 +00:00
Anna Zaks 3bc6809ecb [analyzer] Add support for C++ dynamic_cast.
Simulate the C++ dynamic_cast in the analyzer.

llvm-svn: 154434
2012-04-10 20:59:00 +00:00
Ted Kremenek a85f38ba3a Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that when we generate a new ExplodedNode
we use the same Expr* as the one being currently visited.  This is preparation for transitioning to having
ProgramPoints refer to CFGStmts.

This required a bit of trickery.  We wish to keep the old Expr* bindings in the Environment intact,
as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for
the ProgramPoint to be different than the Expr* being used for bindings.  This requires adding an extra
argument for some functions (e.g., evalLocation).  This looks a bit strange for some clients, but
it will look a lot cleaner when were start using CFGStmt* in the appropriate places.

As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed.
I have audited these, and they look reasonable.

llvm-svn: 154214
2012-04-06 22:10:18 +00:00
Jordy Rose c0230d7a35 [analyzer] Check that the arguments to NSOrderedSet creation methods are valid ObjC objects.
Patch by Sean McBride!

llvm-svn: 154194
2012-04-06 19:06:01 +00:00
Ted Kremenek b45d198b6f Require that all static analyzer issues have a category. As part of this change,
consolidate some commonly used category strings into global references (more of this can be done, I just did a few).

Fixes <rdar://problem/11191537>.

llvm-svn: 154121
2012-04-05 20:43:28 +00:00
Ted Kremenek 34ac1cf3cd Handle symbolicating a reference in an initializer expression that we don't understand.
llvm-svn: 154084
2012-04-05 05:56:31 +00:00
Ted Kremenek 00fa5968cb Teach ObjCContainersChecker that the array passed to CFArrayGetValueAtIndex might not be a symbolic value.
llvm-svn: 154083
2012-04-05 05:18:05 +00:00
Anna Zaks 8382e4547f [analyzer] Move stats calculation out of AnalysisConsumer destructor.
The ASTConsumer does not get deleted with clang --analyze (for
performance reasons), we still want the diagnostics to work.

llvm-svn: 154078
2012-04-05 02:10:21 +00:00
Anna Zaks 67c83d247e [analyzer] Change warding in a path diagnostic:
"No method actually called because receiver is nil" ->
"No method is called because receiver is nil"

llvm-svn: 154077
2012-04-05 02:10:19 +00:00
Anna Zaks e70eea0234 [analyzer] Remove redundant if statement (pointed out by Ted).
llvm-svn: 154075
2012-04-05 02:10:14 +00:00
Ted Kremenek dc53f0094b Look through chains of 'x = y = z' when employing silencing heuristics in the DeadStoresChecker.
Fixes <rdar://problem/11185138>.

llvm-svn: 154040
2012-04-04 19:58:03 +00:00
Ted Kremenek 5a10f08b52 Include the "issue context" (e.g. function or method) where a static analyzer issue occurred in the plist output.
Fixes <rdar://problem/11004527>

llvm-svn: 154030
2012-04-04 18:11:35 +00:00
Ted Kremenek 56458cab04 Change BugReporter's usage of IsCachedDiagnostic to only impact pruning diagnostics emitted to the
console, and leave it up to PathDiagnosticConsumer to unique reports with the shortest path.

llvm-svn: 153987
2012-04-04 00:55:29 +00:00
Anna Zaks cc24e45e27 [analyzer] Record the basic blocks covered by the analyzes run.
Store this info inside the function summary generated for all analyzed
functions. This is useful for coverage stats and can be helpful for
analyzer state space search strategies.

llvm-svn: 153923
2012-04-03 02:05:47 +00:00
Ted Kremenek b75f4e5e9b Fix another false positive in RegionStore involving doing loads from symbolic offsets. We still don't
properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings
either.  Fixes <rdar://problem/11127008>.

llvm-svn: 153913
2012-04-03 00:03:34 +00:00
Ted Kremenek 3b008eecf4 Fix potential null dereference in the static analyzer when inlining a call that has already been inlined. Unfortunately I have no test case.
llvm-svn: 153900
2012-04-02 21:55:06 +00:00
Benjamin Kramer ac19edd2b0 Analyzer: Store BugReports directly in a ilist instead of adding another layer of inderection with std::list
llvm-svn: 153847
2012-04-01 19:30:51 +00:00
Anna Zaks 90ab9bfa11 [analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.
Fixes a false positive (radar://11152419). The current solution of
adding the info into 3 places is quite ugly. Pending a generic pointer
escapes callback.

llvm-svn: 153731
2012-03-30 05:48:16 +00:00
Anna Zaks 54fd4a0766 [analyzer] Do not inline functions which previously reached max block
count.

This is an optimization for "retry without inlining" option. Here, if we
failed to inline a function due to reaching the basic block max count,
we are going to store this information and not try to inline it
again in the translation unit. This can be viewed as a function summary.

On sqlite, with this optimization, we are 30% faster then before and
cover 10% more basic blocks (partially because the number of times we
reach timeout is decreased by 20%).

llvm-svn: 153730
2012-03-30 05:48:10 +00:00
Anna Zaks 72eee39df7 [analyzer] Enable retry exhausted without inlining by default.
llvm-svn: 153591
2012-03-28 19:59:16 +00:00
Anna Zaks 850d2dea82 [analyser] Stats checker: do not mark a node as exhausted if we will
retry without inlining.

(+ other minor cleanups)

llvm-svn: 153581
2012-03-28 17:05:50 +00:00
Anna Zaks 8293bae850 [analyzer] Refactor: Use Decl when determining if the Block belongs to
the root function.

(This is a bit cleaner then using the StackFrame.)

llvm-svn: 153580
2012-03-28 17:05:46 +00:00
Ted Kremenek 41daf12e2c Fix suspicious comparison reported by PVS-Studio!
llvm-svn: 153568
2012-03-28 05:24:50 +00:00
Anna Zaks 5b3939fae6 [analyzer] Add an option to re-analyze a dead-end path without inlining.
The analyzer gives up path exploration under certain conditions. For
example, when the same basic block has been visited more than 4 times.
With inlining turned on, this could lead to decrease in code coverage.
Specifically, if we give up inside the inlined function, the rest of
parent's basic blocks will not get analyzed.

This commit introduces an option to enable re-run along the failed path,
in which we do not inline the last inlined call site. This is done by
enqueueing the node before the processing of the inlined call site
with a special policy encoded in the state. The policy tells us not to
inline the call site along the path.

This lead to ~10% increase in the number of paths analyzed. Even though
we expected a much greater coverage improvement. 

The option is turned off by default for now.

llvm-svn: 153534
2012-03-27 20:02:53 +00:00
Anna Zaks dc36e616a4 [analyzer] Stats checker: minor interprocedural tweaks.
Report root function name with exhausted block diagnostic.

Also, use stack frames, not just any location context when checking if
the basic block is in the same context.

llvm-svn: 153532
2012-03-27 20:02:44 +00:00
Anna Zaks 23df6bb18f [analyzer] Stats: Only count the number of times we run path sensitive
analyzes.

(This method can be called twice on the same function.)

llvm-svn: 153531
2012-03-27 20:02:41 +00:00
Ted Kremenek e9a5bcf17e Change RetainCountChecker to eagerly "escape" retained objects when they are
assigned to a struct.  This is fallout from inlining results, which expose
far more patterns where people stuff CF objects into structs and pass them
around (and we can reason about it).  The problem is that we don't have
a general way to detect when values have escaped, so as an intermediate step
we need to eagerly prune out such tracking.

Fixes <rdar://problem/11104566>.

llvm-svn: 153489
2012-03-27 01:12:45 +00:00
Anna Zaks a651c4099d [analyzer] Malloc: Allow a pointer to escape through OSAtomicEnqueue.
llvm-svn: 153453
2012-03-26 18:18:39 +00:00
Jordy Rose 21ff76e916 [analyzer] Tighten up the realloc() failure path note generation...make sure we get the right realloc()!
llvm-svn: 153370
2012-03-24 03:15:09 +00:00
Jordy Rose 43a9af7352 [analyzer] Restart path diagnostic generation if any of the visitors change the report configuration while walking the path.
This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type.

Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior.

llvm-svn: 153369
2012-03-24 03:03:29 +00:00
Jordy Rose f78877e99a [analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able to reset diagnostic generation.
llvm-svn: 153368
2012-03-24 02:45:35 +00:00
Ted Kremenek 161046edab Avoid applying retain/release effects twice in RetainCountChecker when a function call was inlined (i.e., we do not need to apply summaries in such cases).
llvm-svn: 153309
2012-03-23 06:26:56 +00:00
Anton Yartsev edb062887f corrected check::EndOfTranslationUnit checker name and added 'const' to declaration
llvm-svn: 153302
2012-03-23 02:43:24 +00:00
Ted Kremenek 30de950bba Fix static analyzer crash on code taking the address of a field. Fixes PR 11146.
llvm-svn: 153283
2012-03-22 21:42:31 +00:00
Anna Zaks a407b59ce8 [analyzer] Add the stat for the number of successfully explored paths.
llvm-svn: 153281
2012-03-22 21:06:06 +00:00
Anna Zaks 06bf78c242 [analyzer] Add stats useful for coverage investigations.
llvm-svn: 153280
2012-03-22 21:06:03 +00:00
Anna Zaks 395c0dd70e [analyzer] Add inlining awareness to the block coverage computation
(Stats Checker).

llvm-svn: 153279
2012-03-22 21:05:57 +00:00
Ted Kremenek 40c13431aa "Teach" RetainCountChecker about dispatch_set_context, which can indirectly free its argument later. Fixes <rdar://problem/11059275>.
llvm-svn: 153244
2012-03-22 06:29:41 +00:00
Anna Zaks 9fe8098e29 [analyzer] Malloc: drop symbols captured by blocks.
llvm-svn: 153232
2012-03-22 00:57:20 +00:00
Benjamin Kramer c25c5e0ba2 Remove unused variable, fix indentation.
llvm-svn: 153220
2012-03-21 21:03:48 +00:00
Anna Zaks fc2e153444 [analyzer] Malloc: Utter the name of the leaked variable.
Specifically, we use the last store of the leaked symbol in the leak diagnostic.
(No support for struct fields since the malloc checker doesn't track those
yet.)

+ Infrastructure to track the regions used in store evaluations.
This approach is more precise than iterating the store to
obtain the region bound to the symbol, which is used in RetainCount
checker. The region corresponds to what is uttered in the code in the
last store and we do not rely on the store implementation to support
this functionality.

llvm-svn: 153212
2012-03-21 19:45:08 +00:00
Anna Zaks 6797d6ee23 [analyser] Factor out FindUniqueBinding from RetainCount checker.
So that others could use it as well. No functionality change.

llvm-svn: 153211
2012-03-21 19:45:01 +00:00
Jordy Rose bf38f20e79 [analyzer] Mark a failed-realloc's result as an interesting symbol between the realloc call and the null check, so we get nicer path notes. Fixes a regression introduced by the diagnostic pruning added in r152361.
This is accomplished by calling markInteresting /during/ path diagnostic generation, and as such relies on deterministic ordering of BugReporterVisitors -- namely, that BugReporterVisitors are run in /reverse/ order from how they are added. (Right now that's a consequence of storing visitors in an ImmutableList, where new items are added to the front.) It's a little hacky, but it works for now.

I think this is the best we can do without storing the relation between the old and new symbols, and that would be a hit whether or not there ends up being an error.

llvm-svn: 153010
2012-03-18 07:43:35 +00:00
Jordy Rose 61c974b492 [analyzer] Use a FoldingSet to cache simple RetainSummary instances, rather than explicitly keeping DoNothing and StopTracking summaries and nothing else.
I tried to test the effects of this change on memory usage and run time, but what I saw on retain-release.m was indistinguishable from noise (debug and release builds). Even so, some caveman profiling showed 101 cache hits that we would have generated new summaries for before (i.e. not default or stop summaries), and the more code we analyze, the more memory we should save.

Maybe we should have a standard project for benchmarking the retain count checker's memory and time?

llvm-svn: 153007
2012-03-18 01:26:10 +00:00
Jordy Rose 35e71c771d [analyzer] Unify retain-count summary generation for class and instance methods. No functionality change.
llvm-svn: 153001
2012-03-17 21:13:07 +00:00
Jordy Rose 7063883e8c [analyzer] Remove duplicate work on deriving method behavior. No functionality change.
The cocoa::deriveNamingConventions helper is just using method families anyway now, and the way RetainSummaryTemplate works means we're allocating an extra summary for every method with a relevant family.

Also, fix RetainSummaryTemplate to do the right thing w/r/t annotating an /existing/ summary. This was probably the real cause of <rdar://problem/10824732> and the fix in r152448.

llvm-svn: 152998
2012-03-17 19:53:04 +00:00
NAKAMURA Takumi 3ec7c4574f StaticAnalyzer: Fix abuse of StringRef in r152962.
llvm-svn: 152982
2012-03-17 13:06:05 +00:00
Jordy Rose 78373e505d [analyzer] Don't claim an object was returned with +1 retain count before counting autoreleases. Fixes PR10376.
(Also, 80-column violations.)

llvm-svn: 152976
2012-03-17 05:49:15 +00:00
Anna Zaks a7f457a5ea [analyzer] Shorten the stack hint diagnostic.
Do not display the standard "Returning from 'foo'", when a stack hint is
available.

llvm-svn: 152964
2012-03-16 23:44:28 +00:00
Anna Zaks cba4f298c6 [analyzer] Create symbol-aware stack hints (building upon r152837).
The symbol-aware stack hint combines the checker-provided message
with the information about how the symbol was passed to the callee: as
a parameter or a return value.

For malloc, the generated messages look like this :
"Returning from 'foo'; released memory via 1st parameter"
"Returning from 'foo'; allocated memory via 1st parameter"
"Returning from 'foo'; allocated memory returned"
"Returning from 'foo'; reallocation of 1st parameter failed"


(We are yet to handle cases when the symbol is a field in a struct or
an array element.)

llvm-svn: 152962
2012-03-16 23:24:20 +00:00
Anna Zaks 180e4aa246 [analyzer] +Comments
llvm-svn: 152961
2012-03-16 23:24:16 +00:00
Anna Zaks bbea3e7780 [analyzer] Add a statistic for the number of times we reach the max
number of steps in the work list.

llvm-svn: 152960
2012-03-16 23:24:13 +00:00
Ted Kremenek b1279b5c47 Fix analyzer crash on analyzing 'catch' with no condition variable.
llvm-svn: 152900
2012-03-16 05:58:15 +00:00
Jordy Rose 735724fb1e [analyzer] If a metadata symbol is interesting, its region is interesting as well.
llvm-svn: 152868
2012-03-15 22:45:29 +00:00
Jordy Rose 01b59cd87a [analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ expressions with a "base object", because the CFG is now linearized.
The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway.

llvm-svn: 152856
2012-03-15 21:46:47 +00:00
Anna Zaks 1ff57d57e8 [analyzer] Allow checkers to supply call stack diagnostic hints for the
BugVisitor DiagnosticPieces.

When checkers create a DiagnosticPieceEvent, they can supply an extra
string, which will be concatenated with the call exit message for every
call on the stack between the diagnostic event and the final bug report.
(This is a simple version, which could be/will be further enhanced.)

For example, this is used in Malloc checker to produce the ",
which allocated memory" in the following example:

static char *malloc_wrapper() { // 2. Entered call from 'use'
    return malloc(12);    // 3. Memory is allocated
}

void use() {
    char *v;
    v = malloc_wrapper(); // 1. Calling 'malloc_wrappers'
        // 4. Returning from 'malloc_wrapper', which allocated memory
}                         // 5. Memory is never released; potential
memory leak

llvm-svn: 152837
2012-03-15 21:13:02 +00:00
Matt Beaumont-Gay be84d85905 '#if 0' out a variable that's only used in other preprocessor-disabled code.
(Why are we keeping all of this code around anyway? Say the word and I'll
start swinging the delete hammer.)

llvm-svn: 152749
2012-03-14 23:12:42 +00:00
Anna Zaks d4e9059fe0 [analyzer] Diagnostics: Supply Caller information even if the bug occurs
in the callee.

llvm-svn: 152734
2012-03-14 18:58:28 +00:00
Erik Verbruggen 5923cbd27b [Analyser] Remove unnecessary recursive visits for ExprWithCleanups and
MaterializeTemporaryExpr.

llvm-svn: 152730
2012-03-14 18:01:43 +00:00
Erik Verbruggen fe66dd624d [Analyser] Removes more recursive visitations in ExprEngine that are no
longer needed as the CFG is fully linearized.

llvm-svn: 152720
2012-03-14 15:38:55 +00:00
Anna Zaks 9ff686239a [analyser] Refactor shouldInline logic into a helper.
llvm-svn: 152677
2012-03-13 22:15:58 +00:00
Anna Zaks 6e5b48a6b4 [analyzer] Call enter/exit diagnostic should refer to caller/callee,
respectively.

llvm-svn: 152676
2012-03-13 22:15:55 +00:00
Anna Zaks 943c680605 [analyzer] Change the order in which we analyze the functions under
inlining to be the reverse of their declaration.

This optimizes running time under inlining up to 20% since we do not
re-analyze the utility functions which are usually defined first in the
translation unit if they have already been analyzed while inlined into
the root functions.

llvm-svn: 152653
2012-03-13 19:32:19 +00:00
Anna Zaks ca70ed53da [analyzer] Use BFS over call graph when analysing functions.
BFS should give slightly better performance. Ex: Suppose, we have two
roots R1 and R2. A callee function C is reachable through both. However,
C is not inlined when analyzing R1 due to inline stack depth limit. With
DFS, C will be analyzed as top level even though it would be analyzed as
inlined through R2. On the other hand, BFS could avoid analyzing C as
top level.

llvm-svn: 152652
2012-03-13 19:32:13 +00:00
Anna Zaks 32da47b9a1 [analyzer] Refactor CallGraph to use Recursive AST visitor when
collecting function Decls.

llvm-svn: 152651
2012-03-13 19:32:08 +00:00
Anna Zaks 1418951405 [analyzer] Use recursive AST visitor to drive simple visitation order in
AnalysisConsumer.

As a result:
 - We now analyze the C++ methods which are defined within the
class body. These were completely skipped before.

- Ensure that AST checkers are called on functions in the
order they are defined in the Translation unit.

llvm-svn: 152650
2012-03-13 19:32:00 +00:00
Anna Zaks aa19abe978 [analyzer] Minor: factor out logic for determining if we should skip a
function.

llvm-svn: 152649
2012-03-13 19:31:54 +00:00
Anna Zaks e756ce0c5d [analyzer] Move the check for parser errors out of the loop over Decls.
llvm-svn: 152648
2012-03-13 19:31:47 +00:00
Ted Kremenek e6aac4e888 Add new analyzer diagnostic mode where plists can have bugs that span multiple files.
llvm-svn: 152586
2012-03-12 23:14:53 +00:00
Ted Kremenek 487cdbfdb0 [analyzer] Include inlining call stack depth in plist output.
llvm-svn: 152584
2012-03-12 22:10:57 +00:00
David Blaikie bbafb8a745 Unify naming of LangOptions variable/get function across the Clang stack (Lex to AST).
The member variable is always "LangOpts" and the member function is always "getLangOpts".

Reviewed by Chris Lattner

llvm-svn: 152536
2012-03-11 07:00:24 +00:00
Jordy Rose f80b2cced7 [analyzer] Replace a static helper with existing logic. No functionality change.
llvm-svn: 152521
2012-03-11 00:08:24 +00:00
John McCall 113bee0536 Remove BlockDeclRefExpr and introduce a bit on DeclRefExpr to
track whether the referenced declaration comes from an enclosing
local context.  I'm amenable to suggestions about the exact meaning
of this bit.

llvm-svn: 152491
2012-03-10 09:33:50 +00:00
Ted Kremenek 8fdb59f979 [analyzer] fix regression in analyzer of NOT actually aborting on Stmts it doesn't understand. We registered
as aborted, but didn't treat such cases as sinks in the ExplodedGraph.

Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly).

Fixes: <rdar://problem/10892489>
llvm-svn: 152468
2012-03-10 01:34:17 +00:00
Ted Kremenek 33be12003f Teach RetainCountChecker about mixing method families with explicit annotations. Fixes <rdar://problem/10824732>.
llvm-svn: 152448
2012-03-09 23:34:08 +00:00
Anna Zaks 394d07ea88 [analyzer] Add support for NoRedundancy inlining mode.
We do not reanalyze a function, which has already been analyzed as an
inlined callee. As per PRELIMINARY testing, this gives over
50% run time reduction on some benchmarks without decreasing of the
number of bugs found.

Turning the mode on by default.

llvm-svn: 152440
2012-03-09 21:14:01 +00:00
Ted Kremenek 1e809b4c4c [analyzer] Implement basic path diagnostic pruning based on "interesting" symbols and regions.
Essentially, a bug centers around a story for various symbols and regions.  We should only include
the path diagnostic events that relate to those symbols and regions.

The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which
can be modified at BugReport creation or by BugReporterVisitors.

This patch reduces the diagnostics emitted in several of our test cases.  I've vetted these as
having desired behavior.  The only regression is a missing null check diagnostic for the return
value of realloc() in test/Analysis/malloc-plist.c.  This will require some investigation to fix,
and I have added a FIXME to the test case.

llvm-svn: 152361
2012-03-09 01:13:14 +00:00
Anna Zaks eee9110721 [analyzer] Use call graph to determine order in which functions are
analyzed.

The CallGraph is used when inlining is on, which is the current default.

This alone does not bring any performance improvement. It's a
stepping stone for the upcoming optimization in which we do not
re-analyze a function that has already been analyzed while inlined in
other functions. Using the call graph makes it easier to play with
the order of functions to minimize redundant analyzes.

llvm-svn: 152352
2012-03-08 23:16:38 +00:00
Anna Zaks 0af3e06ff6 [analyzer] Rework inlining related command line options.
- Remove -analyzer-inline-call.
 - Add -analyzer-ipa=[none|inlining]
 - Add -analyzer-inlining-mode to allow experimentation for
different performance tuning methods.

llvm-svn: 152351
2012-03-08 23:16:35 +00:00
Anna Zaks c000e7ed3d Add a basic CallGraph to Analysis.
The final graph contains a single root node, which is a parent of all externally available functions(and 'main'). As well as a list of Parentless/Unreachable functions, which are either truly unreachable or are unreachable due to our analyses imprecision.

The analyzer checkers debug.DumpCallGraph or debug.ViewGraph can be used to look at the produced graph.

Currently, the graph is not very precise, for example, it entirely skips edges resulted from ObjC method calls.

llvm-svn: 152272
2012-03-08 00:42:23 +00:00
Richard Smith c67fdd4eb9 AST representation for user-defined literals, plus just enough of semantic
analysis to make the AST representation testable. They are represented by a
new UserDefinedLiteral AST node, which is a sugared CallExpr. All semantic
properties, including full CodeGen support, are achieved for free by this
representation.

UserDefinedLiterals can never be dependent, so no custom instantiation
behavior is required. They are mangled as if they were direct calls to the
underlying literal operator. This matches g++'s apparent behavior (but not its
actual mangling, which is broken for literal-operator-ids).

User-defined *string* literals are now fully-operational, but the semantic
analysis is quite hacky and needs more work. No other forms of user-defined
literal are created yet, but the AST support for them is present.

This patch committed after midnight because we had already hit the quota for
new kinds of literal yesterday.

llvm-svn: 152211
2012-03-07 08:35:16 +00:00
Ted Kremenek 415287d943 Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.
llvm-svn: 152139
2012-03-06 20:06:12 +00:00
Ted Kremenek 04e860df2c [analyzer] add a diagnostic event when entering a call via inlining, within the callee, and add an edge.
llvm-svn: 152086
2012-03-06 01:25:01 +00:00
Ted Kremenek 024ba20bef [analyzer] 'Looping back to the head of the loop' diagnostics are prunable.
llvm-svn: 152083
2012-03-06 01:00:36 +00:00
Jordy Rose 330de22fe0 [analyzer] Remove now-unused constant. No functionality change.
llvm-svn: 152080
2012-03-06 00:33:35 +00:00
Jordy Rose 0accc6ae7b [analyzer] Fix unnecessary dyn_cast_or_null. No functionality change.
llvm-svn: 152078
2012-03-06 00:28:20 +00:00
Ted Kremenek 6762a94040 Teak CallAndMessageChecker to only warn about uninitialized struct fields in call arguments
when the called function is never inlined.

Fixes <rdar://problem/10977037>.

llvm-svn: 152073
2012-03-05 23:57:14 +00:00
Ted Kremenek 9d96f843b8 Teach SimpleSValBuilder that (in the absence of more information) stack memory doesn't alias symbolic memory. This is a heuristic/hack, but works well in practice. Fixes <rdar://problem/10978247>.
llvm-svn: 152065
2012-03-05 23:06:19 +00:00
Anna Zaks 9bd4be9657 [analyzer] Time the execution (per each TU) with -analyzer-stats.
llvm-svn: 152059
2012-03-05 20:53:59 +00:00
Anna Zaks 53a0b6c161 [analyzer] False positive in SelfInit - teach the checker about method
calls with self as a parameter.

llvm-svn: 152039
2012-03-05 18:58:25 +00:00
Anna Zaks 12a8b90a36 [analyzer] Malloc should assume that ownership is transfered when
calling an ObjC method ending with 'NoCopy'.

llvm-svn: 152037
2012-03-05 17:42:10 +00:00
Erik Verbruggen 8c738bc98a Remove a recursive visitation in ExprEngine that is no longer needed because the CFG is fully linearized.
llvm-svn: 152007
2012-03-04 18:12:21 +00:00
Ted Kremenek 868dbda367 [analyzer] do not warn about returning stack-allocated memory when it comes from an ancestor stack frame.
llvm-svn: 151964
2012-03-03 01:22:03 +00:00
Ted Kremenek aa1f96add5 [analyzer diagnostics] flush locations *before* popping the current path when visiting a CallEnter.
Fixes <rdar://problem/10967815>

llvm-svn: 151938
2012-03-02 21:16:22 +00:00
Anna Zaks 265087721a [analyzer] Bound the size of the functions being inlined + provide
command line options for inlining tuning.

This adds the option for stack depth bound as well as function size
bound. 

+ minor doxygenification

llvm-svn: 151930
2012-03-02 19:05:03 +00:00
Ted Kremenek f9e9d33019 [analyzer diagnostics] Change CompactPathDiagnostic to recursively compact diagnostics in calls into macro pieces.
Also fix handling of macros within calls in the HTMLDiagnostics.

This also adds a test case for r151774.

llvm-svn: 151872
2012-03-02 01:27:31 +00:00
Ted Kremenek 57207d6074 Teach the analyzer to just ignore CXXBindTemporaryExpr. There's nothing special to do with it, since destructors are represented explicitly in the CFG.
llvm-svn: 151856
2012-03-01 23:06:04 +00:00
Anna Zaks 8dc53af5dc [analyzer] Fix a regression introduced in malloc with
attributes, introduced in r151188.

+ the test to catch it.

Thanks to Ahmed Charles for pointing this out.

llvm-svn: 151840
2012-03-01 22:06:06 +00:00
Argyrios Kyrtzidis 981a961d03 Move llvm/ADT/SaveAndRestore.h -> llvm/Support/SaveAndRestore.h.
Needs llvm update.

llvm-svn: 151829
2012-03-01 19:45:56 +00:00
Anna Zaks ec9c4e487c [analyzer] Diagnostics - do not try to cleanup the path with macros, it
will be done by the general cleanup later on.
A Patch by Ted.

llvm-svn: 151784
2012-03-01 01:30:58 +00:00
Ted Kremenek 0a8e00d493 Change if...else if...else if... to a switch.
llvm-svn: 151775
2012-03-01 00:05:06 +00:00
Ted Kremenek 0f0cc35935 [analyzer] when scanning FIDs in a PathDiagnostic, correctly recurse calls and macros.
llvm-svn: 151774
2012-02-29 23:59:20 +00:00
Anna Zaks e0c03cab58 [analyzer] Malloc: A pointer might escape through CFContainers APIs,
funopen, setvbuf.

Teach the checker and the engine about these APIs to resolve malloc
false positives. As I am adding more of these APIs, it is clear that all
this should be factored out into a separate callback (for example,
region escapes). Malloc, KeyChainAPI and RetainRelease checkers could
all use it.

llvm-svn: 151737
2012-02-29 18:42:47 +00:00
Erik Verbruggen 64aea6524d Remove a recursive visitiation in ExprEngine that is no longer needed
because the CFG is fully linearized.

llvm-svn: 151711
2012-02-29 08:42:57 +00:00
Ted Kremenek ef5c554df4 [analyzer] Tweak the UnreachableCode checker to not warning about unreachable default blocks. Patch by Cyril Roelandt!
llvm-svn: 151709
2012-02-29 06:05:28 +00:00
Ted Kremenek 0f70a6f51e [analyzer diagnostics] Refactor filtration for PathDiagnosticConsumers that don't support cross-file diagnostics
into a common place.  Currently enable this filtration for Plist diagnostics as well.

llvm-svn: 151664
2012-02-28 23:27:39 +00:00
Ted Kremenek 2429c6ffe7 [analyzer diagnostics] start prototyping stripping PathDiagnostics of unnecessary cruft caused by path inlining.
This introduces a concept of a "prunable" PathDiagnosticEvent.  Currently this is a flag, but
we may evolve the concept to make this more dynamically inferred.

llvm-svn: 151663
2012-02-28 23:06:21 +00:00
Anna Zaks 75de32322a [analyzer] Leaks should be uniqued by the allocation point in the
closest function context (RetainCountChecker).

llvm-svn: 151661
2012-02-28 22:39:22 +00:00
Anna Zaks 16f3831064 [analyzer] Retain release: drop the line number info from the leak
message.

llvm-svn: 151657
2012-02-28 21:49:08 +00:00
Anna Zaks b6e2854f68 [analyzer] Stats: Add the stats about remove dead bindings, correct the
test.

llvm-svn: 151656
2012-02-28 21:49:04 +00:00
Anna Zaks 6ca4fd5b88 [analyzer] Leaks should be uniqued by the allocation point in the
closest function context (Keychain API).

llvm-svn: 151613
2012-02-28 03:07:06 +00:00
Anna Zaks 06a77fc1b9 [analyzer] Fix Malloc False Positive (PR 12100)
When allocated buffer is passed to CF/NS..NoCopy functions, the
ownership is transfered unless the deallocator argument is set to
'kCFAllocatorNull'.

llvm-svn: 151608
2012-02-28 01:54:22 +00:00
Ted Kremenek 3bc5372fae [analyzer] teach analyzer about ObjC literals, thus trimming out a false positive with the malloc() checker involving
comparing literal addresses to nil.

Fixes <rdar://problem/10579586>

llvm-svn: 151602
2012-02-28 00:56:05 +00:00
Anna Zaks 43ffba2676 [analyzer] Leaks should be uniqued by the allocation point in the
closest function context. 

This prevents us from uniqueing all leaks from the same allocation
helper. radar://10932226

llvm-svn: 151592
2012-02-27 23:40:55 +00:00
Ted Kremenek e0bce93e14 [analyzer] Don't generate an explicit ExplodedNode for StringLiterals; have the SVal lazily generated from Environment::getSVal().
llvm-svn: 151589
2012-02-27 23:34:19 +00:00
Anna Zaks b028654031 [analyzer] Add -analyzer-stats, which hooks up LLVM stats tracking.
As in http://llvm.org/docs/ProgrammersManual.html#Statistic

llvm-svn: 151570
2012-02-27 21:33:16 +00:00
Argyrios Kyrtzidis bb5abc7b49 Move "clang/Analysis/Support/SaveAndRestore.h" to "llvm/ADT/SaveAndRestore.h"
to make it more widely available.

Depends on llvm commit r151564

llvm-svn: 151566
2012-02-27 21:09:45 +00:00
Ted Kremenek ef31f376bb RetainCountChecker: don't adjust the retain count when analyzing a ReturnStmt unless we are in the top-level call frame. We can do more later, but this makes the checker self-consistent (and fixes a crash).
llvm-svn: 151426
2012-02-25 02:09:09 +00:00
Anna Zaks 7ac344a48a [analyzer] Malloc: reason about the ObjC messages and C++.
Assume none of the ObjC messages defined in system headers free memory,
except for the ones containing 'freeWhenDone' selector. Currently, just
assume that the region escapes to the messages with 'freeWhenDone'
(ideally, we want to treat it as 'free()').

For now, always assume that regions escape when passed to C++ methods.

llvm-svn: 151410
2012-02-24 23:56:53 +00:00
Anna Zaks 18de54b1a6 [analyzer] Run remove dead bindings before each call.
This ensures that we report the bugs associated with symbols going
out of scope in the correct function context.

llvm-svn: 151369
2012-02-24 16:49:46 +00:00
Anna Zaks cdf24a9a5e [analyzer] We were silently stopping exploring the path after
visiting 'return;' statement!

This most likely caused us to skip a bunch of code when analyzing with
inlining.

llvm-svn: 151368
2012-02-24 16:49:41 +00:00
Douglas Gregor 29c42f2a25 Implement a new type trait __is_trivially_constructible(T, Args...)
that provides the behavior of the C++11 library trait
std::is_trivially_constructible<T, Args...>, which can't be
implemented purely as a library.

Since __is_trivially_constructible can have zero or more arguments, I
needed to add Yet Another Type Trait Expression Class, this one
handling arbitrary arguments. The next step will be to migrate
UnaryTypeTrait and BinaryTypeTrait over to this new, more general
TypeTrait class.

Fixes the Clang side of <rdar://problem/10895483> / PR12038.

llvm-svn: 151352
2012-02-24 07:38:34 +00:00
Ted Kremenek 1bf3b04726 Make PathDiagnosticBuilder sensitive to varying LocationContexts, thus fixing a bug in the inlining diagnostics where the wrong location could be used.
llvm-svn: 151349
2012-02-24 07:12:52 +00:00
Ted Kremenek 60a7820ffe Reapply r151317, but when computing the PathDiagnostic profile and size keep into account the nested structure. Also fix a problem with how
inlining impacted Plist diagnostics, and adjust some ranges in the Plist output due to richer information.

llvm-svn: 151346
2012-02-24 06:00:00 +00:00
Chad Rosier c0ea158a2b Revert r151317 - Rework PathDiagnostics creation.. - to appease buildbots.
llvm-svn: 151338
2012-02-24 02:06:33 +00:00
Ted Kremenek f2131e7d95 Rework PathDiagnostic creation so that call stacks are captured by a nested PathDiagnosticCallPiece.
llvm-svn: 151317
2012-02-24 00:38:56 +00:00
Anna Zaks 4b062cb904 [analyzer] KeyChainAPI: unique the leaks by allocation site.
(Very similar to the previous change in malloc.)

llvm-svn: 151297
2012-02-23 22:53:29 +00:00
Anna Zaks df901a4419 [analyzer] Malloc: unique leak reports by allocation site.
When we find two leak reports with the same allocation site, report only
one of them.

Provide a helper method to BugReporter to facilitate this.

llvm-svn: 151287
2012-02-23 21:38:21 +00:00
Anna Zaks 07de9c12f3 [analyzer] Invalidate the region passed to pthread_setspecific() call.
Make this call an exception in ExprEngine::invalidateArguments:
'int pthread_setspecific(ptheread_key k, const void *)' stores
a value into thread local storage. The value can later be retrieved
with 'void *ptheread_getspecific(pthread_key)'. So even thought the
parameter is 'const void *', the region escapes through the
call.

(Here we just blacklist the call in the ExprEngine's default
logic. Another option would be to add a checker which evaluates
the call and triggers the call to invalidate regions.)

Teach the Malloc Checker, which treats all system calls as safe about
the API.

llvm-svn: 151220
2012-02-23 01:05:27 +00:00
Anna Zaks 40a7eb3837 [analyzer] Malloc cleanup:
- We should not evaluate strdup in the Malloc Checker, it's the job of
CString checker, so just update the RefState to reflect allocated
memory.

- Refactor to reduce LOC: remove some wrapper auxiliary functions, make
all functions return the state and add the transition in one place
(instead of in each auxiliary function).

llvm-svn: 151188
2012-02-22 19:24:52 +00:00
Douglas Gregor ed90df3800 Generate an AST for the conversion from a lambda closure type to a
block pointer that returns a block literal which captures (by copy)
the lambda closure itself. Some aspects of the block literal are left
unspecified, namely the capture variable (which doesn't actually
exist) and the body (which will be filled in by IRgen because it can't
be written as an AST).

Because we're switching to this model, this patch also eliminates
tracking the copy-initialization expression for the block capture of
the conversion function, since that information is now embedded in the
synthesized block literal. -1 side tables FTW.

llvm-svn: 151131
2012-02-22 05:02:47 +00:00
Anna Zaks 199e8e585b [analyzer] Malloc checker: mark 'strdup' and 'strndup' as allocators.
llvm-svn: 151124
2012-02-22 03:14:20 +00:00
Anna Zaks 4ca45b1d00 [analyzer] Malloc: fix another false positive.
, when we return a symbol reachable to the malloced one via pointer
arithmetic.

llvm-svn: 151121
2012-02-22 02:36:01 +00:00
Anna Zaks 3705a1ee10 [analyzer] Change naming in bug reports "tainted" -> "untrusted"
llvm-svn: 151120
2012-02-22 02:35:58 +00:00
Ted Kremenek b14b42d477 Have ScanReachableSymbols reported reachable regions. Fixes a false positive with nested array literals. <rdar://problem/10686586>
llvm-svn: 151012
2012-02-21 00:46:29 +00:00
Anna Zaks 19a66678d5 [analyzer] Make KeyChainAPI checker inlining-aware.
llvm-svn: 151007
2012-02-21 00:00:44 +00:00
Anna Zaks 1526881ee0 [analyzer] Make Malloc aware of inter-procedural execution + basic
tests.

llvm-svn: 150993
2012-02-20 22:25:23 +00:00
Anna Zaks 0cdce4df76 [analyzer] Turn on by default the Malloc Checker and a couple of CString
checks:

- unix.Malloc - Checks for memory leaks, double free, use-after-free.
- unix.cstring.NullArg - Checks for null pointers passed as arguments to
CString functions + evaluates CString functions.
- unix.cstring.BadSizeArg - Checks for common anti-patterns in
strncat size argument.

llvm-svn: 150988
2012-02-20 21:10:37 +00:00
Dylan Noblesmith c95d81924d Basic: import IntrusiveRefCntPtr<> into clang namespace
The class name is long enough without the llvm:: added.
Also bring in RefCountedBase and RefCountedBaseVPTR.

llvm-svn: 150958
2012-02-20 14:00:23 +00:00
Ted Kremenek 1c95ef4e94 Teach analyzer that blocks with no captures are globals. Fixes <rdar://problem/10348049>.
llvm-svn: 150896
2012-02-18 22:41:01 +00:00
Ted Kremenek e8a5ba89ec Teach analyzer about NSAutoreleasePool -allocWithZone:. Fixes <rdar://problem/10640253>.
llvm-svn: 150892
2012-02-18 21:37:48 +00:00
Ted Kremenek e98d63a823 Adopt ExprEngine and checkers to ObjC property refactoring. Everything was working, but now diagnostics are aware of message expressions implied by uses of properties. Fixes <rdar://problem/9241180>.
llvm-svn: 150888
2012-02-18 20:53:30 +00:00
Ted Kremenek d519cae8aa Have conjured symbols depend on LocationContext, to add context sensitivity for functions called more than once.
llvm-svn: 150849
2012-02-17 23:13:45 +00:00
Anna Zaks e56167e8f8 [analyzer] Fix another false positive in the Malloc Checker, by making
it aware of CString APIs that return the input parameter.

Malloc Checker needs to know how the 'strcpy' function is
evaluated. Introduce the dependency on CStringChecker for that.
CStringChecker knows all about these APIs.

Addresses radar://10864450

llvm-svn: 150846
2012-02-17 22:35:31 +00:00
Anna Zaks 6348a810fe [analyzer] Generalize function name checking in CString checker.
(Ex: It was not treating __inline_strcpy as strcpy. Will add tests that
rely on this later on.)

llvm-svn: 150845
2012-02-17 22:35:26 +00:00
Anna Zaks 546c49c3b2 [analyzer] Malloc Checker: Clean up bug naming:
- Rename the category "Logic Error" -> "Memory Error".
 - Shorten all the messages.

llvm-svn: 150733
2012-02-16 22:26:12 +00:00
Anna Zaks 9eb7bc82ae [analyzer] Malloc Checker: Make the diagnostic visitor handle the case
of failing realloc. + Minor cleanups.

llvm-svn: 150732
2012-02-16 22:26:07 +00:00
Ted Kremenek 2eef6b9e4b Add checker visitation hooks in ExprEngine::Visit() for common no-op expressions. To be used later.
llvm-svn: 150723
2012-02-16 20:56:01 +00:00
Ted Kremenek 35e55fe49f Revert "Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change."
llvm-svn: 150722
2012-02-16 20:48:04 +00:00
Ted Kremenek ea8dbdeefd Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change.
llvm-svn: 150720
2012-02-16 20:19:30 +00:00
Ted Kremenek a2aa929e74 Minor cleanup to node data structures in ExplodedGraph. No functionality change.
llvm-svn: 150719
2012-02-16 20:19:25 +00:00
Sebastian Redl 6047f07e81 Revert "Revert "Make CXXNewExpr contain only a single initialier, and not hold the used constructor itself.""
This reintroduces commit r150682 with a fix for the Bullet benchmark crash.

llvm-svn: 150685
2012-02-16 12:22:20 +00:00
Sebastian Redl c3a3c60040 Revert "Make CXXNewExpr contain only a single initialier, and not hold the used constructor itself."
It leads to a compiler crash in the Bullet benchmark.

This reverts commit r12014.

llvm-svn: 150684
2012-02-16 11:35:52 +00:00
Sebastian Redl 86fab844bb Make CXXNewExpr contain only a single initialier, and not hold the used constructor itself.
Holding the constructor directly makes no sense when list-initialized arrays come into play. The constructor is now held in a CXXConstructExpr, if construction is what is done. The new design can also distinguish properly between list-initialization and direct-initialization, as well as implicit default-initialization constructors and explicit value-initialization constructors. Finally, doing it this way removes redundance from the AST because CXXNewExpr doesn't try to handle both the allocation and the initialization responsibilities.

This breaks the static analysis of new expressions. I've filed PR12014 to track this.

llvm-svn: 150682
2012-02-16 10:58:10 +00:00
Anna Zaks 95308d3798 [analyzer] Diagnostics: Ensure that the default end of diagnostic path
piece can always be generated.

The default end of diagnostic path piece was failing to generate on a
BlockEdge that was outgoing from a basic block without a terminator,
resulting in a very simple diagnostic being rendered (ex: no path
highlighting or custom visitors). Reuse another function, which is
essentially doing the same thing and correct it not to fail when a block
has no terminator.

llvm-svn: 150659
2012-02-16 03:41:01 +00:00
Anna Zaks d32ead82d9 [analyzer] Malloc Checker: Give up when a pointer escapes into a struct.
We are not properly handling the memory regions that escape into struct
fields, which led to a bunch of false positives. Be conservative here
and give up when a pointer escapes into a struct.

llvm-svn: 150658
2012-02-16 03:40:57 +00:00
Anna Zaks d1ff1cbe23 [analyzer] Malloc checker: make a bit safer.
llvm-svn: 150556
2012-02-15 02:12:00 +00:00
John McCall c62bb39142 Split reinterpret_casts of member pointers out from CK_BitCast; this
is general goodness because representations of member pointers are
not always equivalent across member pointer types on all ABIs
(even though this isn't really standard-endorsed).

Take advantage of the new information to teach IR-generation how
to do these reinterprets in constant initializers.  Make sure this
works when intermingled with hierarchy conversions (although
this is not part of our motivating use case).  Doing this in the
constant-evaluator would probably have been better, but that would
require a *lot* of extra structure in the representation of
constant member pointers:  you'd really have to track an arbitrary
chain of hierarchy conversions and reinterpretations in order to
get this right.  Ultimately, this seems less complex.  I also
wasn't quite sure how to extend the constant evaluator to handle
foldings that we don't actually want to treat as extended
constant expressions.

llvm-svn: 150551
2012-02-15 01:22:51 +00:00
Anna Zaks ac06814d2f [analyzer] Malloc Checker: add support for reallocf, which always frees
the passed in pointer on failure.

llvm-svn: 150533
2012-02-15 00:11:25 +00:00
Anna Zaks d51574850e [analyzer] Malloc Checker: add support for valloc + minor code
hardening.

llvm-svn: 150532
2012-02-15 00:11:22 +00:00
Anna Zaks 3d34834bb0 [analyzer] Make Malloc Checker optimistic in presence of inlining.
(In response of Ted's review of r150112.)

This moves the logic which checked if a symbol escapes through a
parameter to invalidateRegionCallback (instead of post CallExpr visit.)

To accommodate the change, added a CallOrObjCMessage parameter to
checkRegionChanges callback.

llvm-svn: 150513
2012-02-14 21:55:24 +00:00
Ted Kremenek 76978f9d6c Remove recusive expression visitation in ExprEngine::VisitIncrementDecrementOperator().
llvm-svn: 150511
2012-02-14 21:38:30 +00:00
Ted Kremenek 89dbd3ba40 Remove recursive visitation in ExprEngine for UO_Not, UO_Minus, UO_LNot.
llvm-svn: 150509
2012-02-14 21:31:00 +00:00
Ted Kremenek 8c8578c0b8 Remove recursive visitation in ExprEngine for UO_Deref, UO_AddrOf, and UO_Extension.
llvm-svn: 150506
2012-02-14 21:27:05 +00:00
Ted Kremenek c14557fb6a Remove ExprEngine recursive visitation of unary UO_Imag operation.
llvm-svn: 150505
2012-02-14 21:27:02 +00:00
Ted Kremenek b5d87d8843 Further remove some recursive visitiation in ExprEngine that is no longer needed because the CFG is fully linearized.
llvm-svn: 150504
2012-02-14 21:26:59 +00:00
Anna Zaks ad01ef5fb9 [analyzer] Malloc Checker: realloc: add dependency between the symbols
in realloc map. 

If there is no dependency, the reallocated ptr will get garbage
collected before we know that realloc failed, which would lead us to
missing a memory leak warning.

Also added new test cases, which we can handle now.
Plus minor cleanups.

llvm-svn: 150446
2012-02-14 00:26:13 +00:00
Anna Zaks 8fd0f2a6cb [analyzer] Malloc Checker: realloc: correct the way we are handing the
case when size is 0.

llvm-svn: 150412
2012-02-13 20:57:07 +00:00
Anna Zaks d56c8794d3 [analyzer] Malloc checker: rework realloc handling:
1) Support the case when realloc fails to reduce False Positives. (We
essentially need to restore the state of the pointer being reallocated.)

2) Realloc behaves differently under special conditions (from pointer is
null, size is 0). When detecting these cases, we should consider
under-constrained states (size might or might not be 0). The
old version handled this in a very hacky way. The code did not
differentiate between definite and possible (no consideration for
under-constrained states). Further, after processing each special case,
the realloc processing function did not return but chained to the next
special case processing. So you could end up in an execution in which
you first see the states in which size is 0 and realloc ~ free(),
followed by the states corresponding to size is not 0 followed by the
evaluation of the regular realloc behavior.

llvm-svn: 150402
2012-02-13 18:05:39 +00:00
Anna Zaks 41b84847bf [analyzer] Malloc Checker: reduce false negatives rate by assuming that
a pointer cannot escape through calls to system functions. Also, stop
after reporting the first use-after-free.

llvm-svn: 150315
2012-02-11 23:46:36 +00:00
Anna Zaks 3aa5225d5e [analyzer] Malloc Checker: Report a leak when we are returning freed
memory.
(As per one test case, the existing checker thought that this could
cause a lot of false positives - not sure if that's valid, to be
verified.)

llvm-svn: 150313
2012-02-11 21:44:39 +00:00
Anna Zaks d3571e5ad3 [analyzer] Malloc checker: Leak bugs should be suppressed by sinks.
Resolves a common false positive, where we were reporting a leak inside
asserts

llvm-svn: 150312
2012-02-11 21:02:40 +00:00
Anna Zaks bb1ef9011d [analyzer] MallocChecker: refactor/improve the symbol escape logic.
We use the same logic here as the RetainRelease checker.

llvm-svn: 150311
2012-02-11 21:02:35 +00:00
Ryan Govostes 55011c017c [analyzer] New checker for assignment of non-0/1 values to Boolean variables.
llvm-svn: 150306
2012-02-11 16:32:09 +00:00
Anna Zaks 3188686c55 [analyzer] MallocChecker Cleanup - harden against crashes, fix an error
(use of return instead of continue), wording.

llvm-svn: 150215
2012-02-10 01:11:00 +00:00
Ted Kremenek 482080a621 [analyzer] Proactively avoid inlining vararg functions and blocks until we properly support them.
llvm-svn: 150207
2012-02-09 21:59:52 +00:00
Benjamin Kramer 541687f4be Remove unused fun.
llvm-svn: 150172
2012-02-09 12:05:18 +00:00
Anna Zaks 78edc2fb3c [analyzer] MallocChecker: address a diagnostic "fixme".
llvm-svn: 150158
2012-02-09 06:48:19 +00:00
Anna Zaks 2b5bb97986 [analyzer] Add custom path diagnostic to the Malloc Checker.
Very simple so far - we just highlight every allocation and release
site.

llvm-svn: 150156
2012-02-09 06:25:51 +00:00
Anna Zaks 12259b443d [analyzer] MallocChecker cleanup, more tests.
llvm-svn: 150155
2012-02-09 06:25:47 +00:00
Anna Zaks a1b227b6a7 [analyzer] MallocChecker: implement pessimistic version of the checker,
which allows values to escape through unknown calls.

Assumes all calls but the malloc family are unknown.

Also, catch a use-after-free when a pointer is passed to a
function after a call to free (previously, you had to explicitly
dereference the pointer value).

llvm-svn: 150112
2012-02-08 23:16:56 +00:00
Anna Zaks cd37bf4ec8 [analyzer] Split the MallocChecker into two versions - pessimistic and
optimistic.

TODO: actually implement the pessimistic version of the checker. Ex: it
needs to assume that any function that takes a pointer might free it.

The optimistic version relies on annotations to tell us which functions
can free the pointer.

llvm-svn: 150111
2012-02-08 23:16:52 +00:00
Ted Kremenek 7df15cd21f Remove explicit delete of PathDiagnosticMacroPiece, as it is now reference counted.
llvm-svn: 150110
2012-02-08 22:48:17 +00:00
Anna Zaks c68bf4c036 [analyzer] MallocChecker: convert from using evalCall to
post visit of CallExpr.

In general, we should avoid using evalCall as it leads to interference
with other checkers.

llvm-svn: 150086
2012-02-08 20:13:28 +00:00
Ted Kremenek afa6e249cb Change PathDiagnosticPieces to be reference counted (simplifying their management), and introduce 'PathPieces' as a common container for PathDiagnosticPieces.
llvm-svn: 150054
2012-02-08 04:32:34 +00:00
Ted Kremenek 3116c4e5cd Refactor pieces of PathDiagnostic into its own data structure. No functionality change.
llvm-svn: 150053
2012-02-08 04:32:27 +00:00
Benjamin Kramer 7ec12c928a Revert my patches which removed Diagnostic.h includes by moving some operator overloads out of line.
This seems to negatively affect compile time onsome ObjC tests
(which use a lot of partial diagnostics I assume). I have to come
up with a way to keep them inline without including Diagnostic.h
everywhere. Now adding a new diagnostic requires a full rebuild
of e.g. the static analyzer which doesn't even use those diagnostics.

This reverts commit 6496bd10dc3a6d5e3266348f08b6e35f8184bc99.
This reverts commit 7af19b817ba964ac560b50c1ed6183235f699789.
This reverts commit fdd15602a42bbe26185978ef1e17019f6d969aa7.
This reverts commit 00bd44d5677783527d7517c1ffe45e4d75a0f56f.
This reverts commit ef9b60ffed980864a8db26ad30344be429e58ff5.

llvm-svn: 150006
2012-02-07 22:29:24 +00:00
Benjamin Kramer db0fc5131d Print NamedDecls directly to a raw_ostream where possible.
llvm-svn: 149982
2012-02-07 11:57:57 +00:00