Commit Graph

115 Commits

Author SHA1 Message Date
Eric Christopher 4c08be18b1 Fix testcase for case.
llvm-svn: 209218
2014-05-20 17:15:31 +00:00
Eric Christopher c9e2a68905 Clean up language and grammar.
Based on a patch by jfcaron3@gmail.com!
PR19806

llvm-svn: 209215
2014-05-20 17:10:39 +00:00
Ted Kremenek 776409286b [analyzer] Remove IdempotentOperations checker.
This checker has not been updated to work with interprocedural analysis,
and actually contains both logical correctness issues but also
memory bugs.  We can resuscitate it from version control once there
is focused interest in making it a real viable checker again.

llvm-svn: 198476
2014-01-04 05:52:11 +00:00
Fariborz Jahanian 7e1eae004c Fixes a typo in my last patch.
llvm-svn: 178184
2013-03-27 21:33:52 +00:00
Fariborz Jahanian 84510744d9 Objective-C: Issue more precise warning when user
is accessing 'isa' as an object pointer.
// rdar://13503456. FixIt to follow in another patch.

llvm-svn: 178179
2013-03-27 21:19:25 +00:00
Anna Zaks ef89339986 [analyzer] Rename AttrNonNullChecker -> NonNullParamChecker
llvm-svn: 176755
2013-03-09 03:23:14 +00:00
Ted Kremenek 1d6aac5b6a Fix capitalization of Objective-C in diagnostic.
llvm-svn: 171440
2013-01-03 01:30:20 +00:00
David Blaikie 282ad876bd Implement GCC's -Wint-to-pointer-cast.
This implementation doesn't warn on anything that GCC doesn't warn on with the
exception of templates specializations (GCC doesn't warn, Clang does). The
specific skipped cases (boolean, constant expressions, enums) are open for
debate/adjustment if anyone wants to demonstrate that GCC is being overly
conservative here. The only really obvious false positive I found was in the
Clang regression suite's MPI test - apparently MPI uses specific flag values in
pointer constants. (eg: #define FOO (void*)~0)

llvm-svn: 166039
2012-10-16 18:53:14 +00:00
Ted Kremenek 722398f1d4 Fix analyzer tests.
llvm-svn: 162588
2012-08-24 20:39:55 +00:00
Ted Kremenek 9bf9af92a4 Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the same time.
This fixes several issues:

- removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer,
but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer
was used by itself.

- emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special
case, just another PathDiagnosticConsumer.  This also magically resolved some duplicate warnings,
as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation
unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine).

As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped,
just like with diagnostics emitted to plists and HTML.  This required some tests to be updated, but now
the tests have higher fidelity with what users will see.

There are some inefficiencies in this patch.  We currently generate the report graph (from the ExplodedGraph)
once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the
logic stack.  There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue)
for different PathDiagnosticConsumers.  This is necessary to produce the diagnostics that a particular
consumer expects.

llvm-svn: 162028
2012-08-16 17:45:23 +00:00
Jordan Rose 682b31621f [analyzer] Convert existing checkers to use check::preCall and check::postCall.
llvm-svn: 159563
2012-07-02 19:28:21 +00:00
Ted Kremenek fd727748bd Explicitly model capturing variables for blocks in the static analyzer. Fixes <rdar://problem/11125868>.
llvm-svn: 156211
2012-05-04 21:48:42 +00:00
Patrick Beard acfbe9e1f2 Added a new attribute, objc_root_class, which informs the compiler when a root class is intentionally declared.
The warning this inhibits, -Wobjc-root-class, is opt-in for now. However, all clang unit tests that would trigger
the warning have been updated to use -Wno-objc-root-class. <rdar://problem/7446698>

llvm-svn: 154187
2012-04-06 18:12:22 +00:00
Ted Kremenek b75f4e5e9b Fix another false positive in RegionStore involving doing loads from symbolic offsets. We still don't
properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings
either.  Fixes <rdar://problem/11127008>.

llvm-svn: 153913
2012-04-03 00:03:34 +00:00
Anna Zaks d5c3027473 [analyzer] Turn inlining on by default for better testing exposure.
Fix a test, which was most likely an unintended recursive call.

llvm-svn: 151848
2012-03-01 22:37:46 +00:00
Ted Kremenek b9ff6b2302 Reenable DeadStoresChecker under --analyze, and move the IdempotentOperationsChecker to the 'experimental' category. Fixes <rdar://problem/10146347>.
llvm-svn: 148533
2012-01-20 06:00:17 +00:00
Fariborz Jahanian 28324b0066 objc: deprecate direct usage of 'isa' of objc objects
in favor of usage of api's intended for.
// rdar://8290002

llvm-svn: 148404
2012-01-18 19:08:56 +00:00
Ted Kremenek 3f955e6d89 [analyzer] rename all experimental checker packages to have 'experimental' be the common root package.
llvm-svn: 136835
2011-08-03 23:14:55 +00:00
Ted Kremenek 109b127e02 Fix regression in static analyzer's handling of prefix '--' operator. It was being treated as postfix '--' in C mode.
llvm-svn: 131770
2011-05-20 23:40:06 +00:00
Ted Kremenek 850d35be16 Fix RegionStore bug when doing a field load whose parent is also a field assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522.
llvm-svn: 128783
2011-04-03 04:09:15 +00:00
Ted Kremenek 49c79790de Rework checker "packages" and groups to be more hierarchical.
llvm-svn: 128187
2011-03-24 00:28:47 +00:00
Ted Kremenek 3e5ad5932e Tweak RegionStore's handling of lazy compound values to use the 'Default' versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without
invalidating the entire binding.  Fixes PR 9455.

llvm-svn: 127796
2011-03-17 03:51:51 +00:00
Ted Kremenek a4a57c10da Re-enable the IdempotentOperations checker for --analyze, and put it and the DeadStores checker into the "deadcode" group.
llvm-svn: 127531
2011-03-12 06:14:28 +00:00
Ted Kremenek 4bb6c6b37e static analyzer: Fix use-after-free bug in RegionStore involving LazyCompoundValueData not reference counting Store objects.
llvm-svn: 127288
2011-03-08 23:18:00 +00:00
Argyrios Kyrtzidis 9eb02dfa89 [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
llvm-svn: 126676
2011-02-28 19:49:42 +00:00
Argyrios Kyrtzidis d4d3cee6e4 [analyzer] Migrate UndefResultChecker to CheckerV2.
llvm-svn: 126614
2011-02-28 01:27:22 +00:00
Argyrios Kyrtzidis b388f77ad9 [analyzer] Remove '-analyzer-experimental-internal-checks' flag, it doesn't have any checkers associated with it anymore.
llvm-svn: 126440
2011-02-24 21:43:08 +00:00
Argyrios Kyrtzidis c08d89e6c2 Allow passing a list of comma separated checker names to -analyzer-checker, e.g:
-analyzer-checker=cocoa,unix

llvm-svn: 126372
2011-02-24 08:42:20 +00:00
Argyrios Kyrtzidis dd407f423b [analyzer] Migrate ArrayBoundChecker to CheckerV2.
llvm-svn: 126371
2011-02-24 08:42:12 +00:00
Argyrios Kyrtzidis 7bc0141043 [analyzer] Migrate ReturnPointerRangeChecker to CheckerV2.
llvm-svn: 126369
2011-02-24 08:41:57 +00:00
Argyrios Kyrtzidis a9215281de [analyzer] Use the new registration mechanism on some of the experimental internal checkers:
CastToStructChecker
  FixedAddressChecker
  PointerArithChecker
  PointerSubChecker

llvm-svn: 125612
2011-02-15 22:55:20 +00:00
Argyrios Kyrtzidis b2400924d9 [analyzer] Use the new registration mechanism on the IdempotentOperationChecker.
llvm-svn: 125611
2011-02-15 22:55:14 +00:00
Ted Kremenek fedad3c668 Don't try and symbolicate unions; we don't reason
about them yet.  Fixes crash reported in PR 9049.

llvm-svn: 124228
2011-01-25 21:08:47 +00:00
Ted Kremenek 304b6e4aa1 Fix a corner case in RegionStore where we assign
a struct value to a symbolic index into array.
RegionStore can't actually reason about this,
so we were getting bogus warnings about loading
uninitialized values from the array.  The solution
is invalidate the entire array when we cannot
represent the binding explicitly.

Fixes <rdar://problem/8848957>

llvm-svn: 123368
2011-01-13 06:58:15 +00:00
Ted Kremenek dcf85a8d18 Teach AttrNonNullChecker about transparent unions. Fixes crash reported in <rdar://problem/8642434>.
llvm-svn: 118473
2010-11-09 02:11:43 +00:00
Zhongxing Xu d95ccd58a9 If visiting RHS causes us to finish 'Block', e.g. the RHS is a StmtExpr
containing a DoStmt, and the LHS doesn't create a new block, then we should
return RBlock.  Otherwise we'll incorrectly return NULL.

Also relax an assertion in VisitWhileStmt(). Reset 'Block' when it is finished.

llvm-svn: 117436
2010-10-27 03:23:10 +00:00
Ted Kremenek c95589d2e6 Don't divide-by-zero in RegionStoreManager::getSizeInElements() when getting the size of a VLA. We don't track VLA extents yet,
but we should at least not crash.  Fixes <rdar://problem/8424269>.

llvm-svn: 113888
2010-09-14 23:08:34 +00:00
Ted Kremenek 8abff774aa Fix CFGBuilder crash reported in PR 8141.
llvm-svn: 113826
2010-09-14 01:13:32 +00:00
Ted Kremenek 5cdaeaaa1d Clean up obtuse wording of checker diagnostic of using an uninitialized value in a function call.
Fixes: <rdar://problem/8409480> “warning: Pass-by-value argument in function call is undefined” message can be improved
llvm-svn: 113554
2010-09-09 22:51:55 +00:00
Ted Kremenek 5f256da834 Rename GRState::getSVal() -> getRawSVal() and getSimplifiedSVal() -> getSVal().
The end result is now we eagarly constant-fold symbols in the analyzer that are perfectly constrained
to be a constant value.  This allows us to recover some path-sensitivity in some cases by lowering
the required level of reasoning power needed to evaluate some expressions.

The net win from this change is that the false positive in PR 8015 is fixed, and we also
find more idempotent operations bugs.

We do, however, regress with the BugReporterVisitors, which need to be modified to understand
this constant folding (and look past it).  This causes some diagnostic regressions in plist-output.m
which will get addressed in a future patch.  plist-output.m is now marked XFAIL, while
plist-output-alternate.m now tests that the plist output is working, but with the suboptimal
diagnostics.  This second test file will eventually be removed.

llvm-svn: 113477
2010-09-09 07:13:00 +00:00
Zhongxing Xu ef94284f2f Tweak test case. 'int' would introduce out-of-bound issues. We focus on array
index constraints in this case.

llvm-svn: 112794
2010-09-02 01:42:44 +00:00
Ted Kremenek f3a734d8ee Add yet another test case for PR 8015, showing how reasoning over symbolic indices should exactly resolve over multiple index possibilities (and thus suppress the false positive in the test).
llvm-svn: 112770
2010-09-01 23:37:38 +00:00
Ted Kremenek 121ddd6a5c Add another test case for PR 8015, here with the array index being within a valid range and not just a single constant.
llvm-svn: 112769
2010-09-01 23:37:36 +00:00
Ted Kremenek 0e12f9cc7b Partial fix for PR 8015 (fix is actually by Jordy Rose, and I added a test case for follow-on work). This patch adds a bandaid for RegionStore's limited reasoning about symbolic array values.
llvm-svn: 112766
2010-09-01 23:27:26 +00:00
Ted Kremenek d588e78b95 Don't assert in the analyzer when analyze code does a byte load from a function's address. Fixes PR 8052.
llvm-svn: 112761
2010-09-01 23:00:46 +00:00
Tom Care 9026d4b488 Adjusted the semantics of assign checking in IdempotentOperationChecker
- Fixed a regression where assigning '0' would be reported
- Changed the way self assignments are filtered to allow constant testing
- Added a test case for assign ops
- Fixed one test case where a function pointer was not considered constant
- Fixed test cases relating to 0 assignment

llvm-svn: 112501
2010-08-30 19:25:43 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 4b83f753a1 Add test case for <rdar://problem/8258814>.
llvm-svn: 110058
2010-08-02 20:33:00 +00:00
Ted Kremenek 385f71b1f4 Augment RegionStore::BindStruct() to bind symbolicated struct values. This fixes a false path issue reported in <rdar://problem/8243408> and also spurs another cause where the idempotent operations checker fires.
llvm-svn: 109710
2010-07-29 00:28:47 +00:00
Ted Kremenek 2a33a0deef Correctly construct an ElementRegion for alloca() + pointer arithmetic. Fixes analyzer
crash reported in PR 7450.

llvm-svn: 106609
2010-06-22 23:58:31 +00:00