Commit Graph

911 Commits

Author SHA1 Message Date
Ted Kremenek ed47d79cc2 BugReporter: for extensive path diagnostics:
- When processing BlockEdges with terminators, using the condition as the
  control-flow point for terminators that are expressions (e.g., '&&', '?')
- When processing events, allow intra-compound statement "jumping"

llvm-svn: 68228
2009-04-01 18:48:52 +00:00
Ted Kremenek 9ce13241ff BugReporter: for extensive PathDiagnostic generation, add control-flow from the
start of the function/method.

llvm-svn: 68217
2009-04-01 17:52:26 +00:00
Ted Kremenek 45a75f718c BugReporter: For the "extensive" PathDiagnostic generation algorithm, elide most
intra-compound statement jumps unless they are between terminators (i.e.,
branches).

llvm-svn: 68216
2009-04-01 17:18:21 +00:00
Ted Kremenek 8b0dba358a Fix: <rdar://problem/6740387>. Sending nil to an object that returns a struct
should only be an error if that value is consumed. This fix was largely
accomplished by moving 'isConsumedExpr' back to ParentMap.

llvm-svn: 68195
2009-04-01 06:52:48 +00:00
Ted Kremenek 0bb0909233 - Changed PathDiagnosticPiece::getLocation() to return a PathDiagnosticLocation
instead of a FullSourceLoc. This resulted in a bunch of small edits in various
  clients.
- Updated BugReporter to include an alternate PathDiagnostic generation
  algorithm for PathDiagnosticClients desiring more control-flow pieces.

llvm-svn: 68193
2009-04-01 06:13:56 +00:00
Ted Kremenek 7062c50772 More code reshuffling. No functionality change.
llvm-svn: 68157
2009-03-31 23:00:32 +00:00
Ted Kremenek 4e81c3ccac Allow two codepaths for PathDiagnostic generation. This patch mainly consists of
refactoring to make this possible (no functionality change).

llvm-svn: 68141
2009-03-31 20:22:36 +00:00
Ted Kremenek 7857bd2743 Re-apply 68028. The code had drifted enough that the tests would fail without
it.  Will discuss offline whether symbolic regions should by typed or typeless.

llvm-svn: 68070
2009-03-30 22:20:54 +00:00
Ted Kremenek 5715393da2 Revert 68028.
llvm-svn: 68068
2009-03-30 21:56:17 +00:00
Ted Kremenek 3cd88e5d99 Remove dead code.
llvm-svn: 68063
2009-03-30 21:27:41 +00:00
Ted Kremenek ac508988a5 Simplify more code by using SVal::getAsSymbol().
llvm-svn: 68052
2009-03-30 19:53:37 +00:00
Ted Kremenek 248fd2bc24 Simplify more code by using SVal::getAsSymbol() instead of
loc::SymbolVal/nonloc::SymbolVal probing.

llvm-svn: 68049
2009-03-30 18:45:36 +00:00
Ted Kremenek a53eb7fa80 Convert use of loc::SymbolVal and nonloc::SymbolVal to V.getAsSymbol(). This
also makes this code more correct as it transparently handles SVals that wrapped
TypedViewRegions(SymbolicRegions).

llvm-svn: 68048
2009-03-30 18:39:15 +00:00
Ted Kremenek 4967c8979e Add version of GRExprEngine::AddCheck that registered a GRSimpleAPICheck that
will be called for every expression in a basic block.

llvm-svn: 68041
2009-03-30 17:53:05 +00:00
Zhongxing Xu 5415b207e3 Make SymbolicRegion untyped.
Layer the type information with a TypedViewRegion on top of the SymbolicRegion.

llvm-svn: 68028
2009-03-30 06:48:56 +00:00
Zhongxing Xu a865b79f87 Implement a FIXME.
llvm-svn: 68024
2009-03-30 05:55:46 +00:00
Ted Kremenek 035cf930d5 Fix regression in pointer comparison with NULL (e.g., 0 != ptr). This fixes
<rdar://problem/6732151>.

llvm-svn: 67954
2009-03-28 19:59:33 +00:00
Ted Kremenek b505811250 Adjust control-flow endpoints for '&&' and '||'.
llvm-svn: 67948
2009-03-28 17:33:57 +00:00
Chris Lattner 529efc74ad rename some methods.
llvm-svn: 67923
2009-03-28 06:33:19 +00:00
Ted Kremenek cd58cced81 Text PathDiagnosticBuilder::getEnclosingStmt() about '?'
llvm-svn: 67909
2009-03-28 04:08:14 +00:00
Ted Kremenek b9411565ea Teach PathDiagnosticBuilder::getEnclosingStmtLocation() about while/if/do/for,
etc., so that the "body" is always considered a top-level statement for edge
transitions (even if it is an expression).

llvm-svn: 67901
2009-03-28 03:37:59 +00:00
Eli Friedman 8b7b1b1aee Change compound assignment operators to keep track of both the promoted
LHS type and the computation result type; this encodes information into 
the AST which is otherwise non-obvious.  Fix Sema to always come up with the 
right answer for both of these types.  Fix IRGen and the analyzer to 
account for these changes.  This fixes PR2601.  The approach is inspired 
by PR2601 comment 2.

Note that this changes real *= complex in CodeGen from a silent 
miscompilation to an explicit error.

I'm not really sure that the analyzer changes are correct, or how to 
test them... someone more familiar with the analyzer should check those 
changes.

llvm-svn: 67889
2009-03-28 01:22:36 +00:00
Ted Kremenek 7a621b9747 BugReporter: For control-flow edges from 'if', 'for', 'do', 'while' to
successor, using 'getEnclosingStmt()' to have the end location be the top-level
Stmt* enclosing the target Expr*.

llvm-svn: 67869
2009-03-27 21:16:25 +00:00
Ted Kremenek 41d865cbaa BugReporter: PathDiagnosticBuilder::ExecutionContinues now returns a
PathDiagnosticLocation.

llvm-svn: 67866
2009-03-27 20:55:39 +00:00
Zhongxing Xu 17e28b7a54 remove dead code.
llvm-svn: 67825
2009-03-27 05:31:12 +00:00
Ted Kremenek a7ec0ded63 BugReporter:
- Added an internal helper class 'PathDiagnosticBuilder' which now bundles the
  'ExecutionContinues' methods.
- Added preliminary diagnostics for short-circuit '&&' and '||'

llvm-svn: 67822
2009-03-27 05:06:10 +00:00
Zhongxing Xu c1c09b1f35 remove the updated notes.
llvm-svn: 67813
2009-03-27 02:22:41 +00:00
Ted Kremenek 46dee7b0f6 - Add class PathDiagosticLocationPair.
- Have PathDiagnosticControlFlowPiece use a vector of PathDiagnosticLocationPairs to represent transitions.

llvm-svn: 67786
2009-03-26 23:12:02 +00:00
Ted Kremenek 96110d5920 Implement PathDiagnosticLocation::asRange() and PathDiagnosticLocation::asStmt().
llvm-svn: 67777
2009-03-26 21:48:17 +00:00
Ted Kremenek c25116576f Add comment.
llvm-svn: 67776
2009-03-26 21:42:51 +00:00
Ted Kremenek 7c36d902d0 Restructure code to silence bogus GCC warning.
llvm-svn: 67775
2009-03-26 21:42:00 +00:00
Ted Kremenek bade06e7d7 - Implement PathDiagnosticLocation::asLocation.
- Switch PathDiagnosticEventPiece and PathDiagnosticMacroPiece to use
  PathDiagnosticLocation.

llvm-svn: 67774
2009-03-26 21:39:39 +00:00
Ted Kremenek 3d46b1cfb4 PathDiagnostics (analyzer):
- Added a new class, 'PathDiagnosticLocation', that is a variant for
  SourceLocation, SourceRange, or Stmt*. This will be used soon by
  PathDiagnosticPieces to describe locations for targets of branches, locations
  of events, etc.
- Did some prep. refactoring of PathDiagnosticPieces to prepare them for
  adopting the new PathDiagnosticLocation

llvm-svn: 67767
2009-03-26 21:21:35 +00:00
Ted Kremenek a32f7a124a Move "regions" analyzer design document to 'docs'.
llvm-svn: 67752
2009-03-26 15:29:38 +00:00
Zhongxing Xu 8346601e0b Simplify some code. No functionality change.
llvm-svn: 67748
2009-03-26 08:40:37 +00:00
Zhongxing Xu 2d44866316 Check in some design documents to centralize ideas around region store and the
analysis engine.

llvm-svn: 67747
2009-03-26 08:23:58 +00:00
Ted Kremenek 3e31c26f81 analyzer infrastructure: make a bunch of changes to symbolic expressions that
Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731
2009-03-26 03:35:11 +00:00
Zhongxing Xu 24e7eade19 This patch adds two more SymbolData subclasses: SymIntExpr and SymSymExpr, for
representing symbolic expressions like 'x'+3 and 'x'+'y'. The design is
subjected to change later when we fix the class hierarchy of symbolic
expressions.

llvm-svn: 67678
2009-03-25 05:58:37 +00:00
Ted Kremenek b294d196b3 analyzer: Provide temporary workaround for false positive reported by
<rdar://problem/6704930> involving SimpleConstraintManager not reasoning well
about symbolic constraint values involving arithmetic operators.

llvm-svn: 67534
2009-03-23 17:10:25 +00:00
Ted Kremenek c7fef2ad53 analyzer: Fix embarrassing regression in BasicStore when invalidating struct
values passed-by-reference to unknown functions.

llvm-svn: 67519
2009-03-23 15:42:58 +00:00
Ted Kremenek 6b31533ad1 GRExprEngine:
- Conjure symbols at '--' and '++' unary operations
- Add utility method SVal::GetConjuredSymbolVal() and constify some arguments
  along the way.

llvm-svn: 67395
2009-03-20 20:10:45 +00:00
Ted Kremenek 8c3f0047b4 retain/release checker: Tracking autorelease counts for objects. We're still not
completely there with accurately modeling autorelease pools.

llvm-svn: 67384
2009-03-20 17:34:15 +00:00
Ted Kremenek 891642e4da Fix PR 3836 by eagerly assuming symbolic constraints returned by unary '!'.
llvm-svn: 67260
2009-03-18 23:49:26 +00:00
Ted Kremenek b36e01d87e Fix crash reported in <rdar://problem/6695527>. We now have
SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of
having BasicStoreManager do it (which wasn't always doing the check
consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in
one centralized place.

llvm-svn: 67245
2009-03-18 22:10:22 +00:00
Zhongxing Xu 17299e6172 Use a work list to recursively build up the subregion mapping, and mark live
var region roots.

llvm-svn: 67152
2009-03-18 01:54:31 +00:00
Ted Kremenek 211094d793 Stub out some code for support for NSDeallocateObject. This is enabled yet until
we resolve the semantics of this function when GC is enabled.

llvm-svn: 67116
2009-03-17 22:43:44 +00:00
Ted Kremenek ea072e3cae retain/release checker: Add support for reasoning about -dealloc.
llvm-svn: 67094
2009-03-17 19:42:23 +00:00
Douglas Gregor 23d75bb326 Build system changes to use TableGen to generate the various
diagnostics. This builds on the patch that Sebastian committed and
then revert. Major differences are:

  - We don't remove or use the current ".def" files. Instead, for now,
    we just make sure that we're building the ".inc" files.
  - Fixed CMake makefiles to run TableGen and build the ".inc" files
    when needed. Tested with both the Xcode and Makefile generators
    provided by CMake, so it should be solid.
  - Fixed normal makefiles to handle out-of-source builds that involve
    the ".inc" files.

I'll send a separate patch to the list with Sebastian's changes that
eliminate the use of the .def files.

llvm-svn: 67058
2009-03-16 23:06:59 +00:00
Ted Kremenek 340fd2dd6e Fix PR 3677 [retain checker]: custom 'allocWithZone' methods should be allowed
to return an owning pointer.

llvm-svn: 66934
2009-03-13 20:27:06 +00:00
Ted Kremenek 22358bd681 Add a hack in the analyzer to recover some path-sensitivity at branch
conditions. Currently the analyzer does not reason well about
promotions/truncations of symbolic values, so at branch conditions when we see:

  if (condition)
  
and condition is something like a 'short' or 'char', essentially ignore the
promotion to 'int' so that we track constraints on the original symbolic value.
We only ignore the casts if the underlying type has the same or fewer bits as
the converted type.

This fixes:

<rdar://problem/6619921>

llvm-svn: 66899
2009-03-13 16:32:54 +00:00