Commit Graph

309 Commits

Author SHA1 Message Date
Ted Kremenek 648ef7a2d7 Implement RegionStoreManager::iterBindings(). This implementation only returns the base region in
the binding key instead of the region + offset.  It isn't clear if this is the best semantics, but most
clients will likely only care about simple bindings, or bindings to a particular variable.  We can
refine later if necessary.

llvm-svn: 106183
2010-06-17 00:24:42 +00:00
Ted Kremenek 70c090822d Correctly return early from BasicStoreManager::iterBindings() when the BindingsHandler returns false.
llvm-svn: 106182
2010-06-17 00:24:37 +00:00
Zhongxing Xu abd60dd1fc We return Loc where we know.
llvm-svn: 106087
2010-06-16 06:16:46 +00:00
Zhongxing Xu 7880db8a89 Typo.
llvm-svn: 106086
2010-06-16 05:58:35 +00:00
Zhongxing Xu b4126ee133 Although arguments can not be undefined when we get here, they can still be
unknown.

llvm-svn: 106085
2010-06-16 05:56:39 +00:00
Zhongxing Xu 9fe7e9129b Cast earlier. We know we can get a DefinedSVal.
llvm-svn: 106084
2010-06-16 05:52:03 +00:00
Zhongxing Xu 8225bda0d5 Register CallAndMessageChecker before AttrNonNullChecker. Then we can assume
arguments are not undefined.

llvm-svn: 106083
2010-06-16 05:45:09 +00:00
Zhongxing Xu 0fa7cddbab Add StreamChecker. This checker models and checks stream manipulation functions.
This is the start.

llvm-svn: 106082
2010-06-16 05:38:05 +00:00
Douglas Gregor b90df60b3b Introduce Type::isIntegralOrEnumerationType(), to cover those places
in C++ that involve both integral and enumeration types. Convert all
of the callers to Type::isIntegralType() that are meant to work with
both integral and enumeration types over to
Type::isIntegralOrEnumerationType(), to prepare to eliminate
enumeration types as integral types.

llvm-svn: 106071
2010-06-16 00:17:44 +00:00
Daniel Dunbar c1b1729b66 Break Frontend's dependency on Rewrite, Checker and CodeGen in shared library configuration
Currently, all AST consumers are located in the Frontend library,
meaning that in a shared library configuration, Frontend has a
dependency on Rewrite, Checker and CodeGen.  This is suboptimal for
clients which only wish to make use of the frontend.  CodeGen in
particular introduces a large number of unwanted dependencies.

This patch breaks the dependency by moving all AST consumers with
dependencies on Rewrite, Checker and/or CodeGen to their respective
libraries.  The patch therefore introduces dependencies in the other
direction (i.e. from Rewrite, Checker and CodeGen to Frontend).

After applying this patch, Clang builds correctly using CMake and
shared libraries ("cmake -DBUILD_SHARED_LIBS=ON").

N.B. This patch includes file renames which are indicated in the
patch body.

Changes in this revision of the patch:
 - Fixed some copy-paste mistakes in the header files
 - Modified certain aspects of the coding to comply with the LLVM
   Coding Standards

llvm-svn: 106010
2010-06-15 17:48:49 +00:00
Chandler Carruth b52b9100bf Remove an entry for a now deleted file. Fixes the neglected CMake build. ;]
llvm-svn: 105708
2010-06-09 08:12:12 +00:00
Zhongxing Xu 1225aacacf Merge StackAddrLeakChecker and ReturnStackAddressChecker.
llvm-svn: 105687
2010-06-09 06:08:24 +00:00
Zhongxing Xu 4200be5e76 Directly compare the StackFrameContext. This greatly simplifies logic and
improves generality. Thanks Ted.

llvm-svn: 105686
2010-06-09 05:50:38 +00:00
Jordy Rose 954238366b Code cleanup: remove explicit flush() in favor of using the ostream's str()
llvm-svn: 105657
2010-06-08 22:59:01 +00:00
Daniel Dunbar ee6b692551 Makefiles: Set Clang CPP compiler flags in a single location, instead of scattered throughout the project Makefiles.
llvm-svn: 105638
2010-06-08 20:44:43 +00:00
Daniel Dunbar e6c1daa8fd Makefile: Switch Clang Makefiles to always include the top-level Clang Makefile.
- This eliminates most dependencies on how Clang is installed relative to LLVM.

llvm-svn: 105637
2010-06-08 20:34:18 +00:00
Zhongxing Xu 87e7fc5dc2 Add a checker check if a global variable holds a local variable's address after
the function call is left where the local variable is declared.

llvm-svn: 105602
2010-06-08 10:00:00 +00:00
Jordy Rose 3597b21f20 Catch free()s on non-regions and regions known to be not from malloc(), by checking the symbol type and memory space.
llvm-svn: 105547
2010-06-07 19:32:37 +00:00
Zhongxing Xu 3b7294777c Add comments.
llvm-svn: 105382
2010-06-03 06:19:01 +00:00
Zhongxing Xu ce83656f97 Limit the use of BindDefault().
llvm-svn: 105265
2010-06-01 04:49:26 +00:00
Zhongxing Xu 527ff6d1dc Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.

llvm-svn: 105264
2010-06-01 03:01:33 +00:00
Ted Kremenek 4708f5a89b After conversations with Zhongxing Xu and Jordy Rose, refine the logic in
RegionStoreManager::RetrieveElement() that handles indexing into a larger scalar
object to only consult the direct binding of a super region if it is a scalar.
This isn't perfect yet, and a big FIXME is attached to the code.  This causes
the test case for PR 7218 now to pass.

llvm-svn: 105195
2010-05-31 01:22:04 +00:00
Nick Lewycky 6cbc3f7de4 Refactor the Is{Std,Clang,LLVM}Namespace methods and rename 'isClangAttr' to
'IsClangAttr' to match prevailing style in this file. Patch by Jon Mulder!

llvm-svn: 105170
2010-05-30 18:05:23 +00:00
Alexis Hunt ed05325dbe Convert DeclNodes to use TableGen.
The macros required for DeclNodes use have changed to match the use of
StmtNodes. The FooFirst enumerator constants have been named firstFoo
to match usage elsewhere.

llvm-svn: 105165
2010-05-30 07:21:58 +00:00
Zhongxing Xu 94aec9381d Revert r105097. Thinking about a better fix.
llvm-svn: 105099
2010-05-29 06:49:04 +00:00
Zhongxing Xu 928a190a8e Fix PR7218. Patch by Jordy Rose.
llvm-svn: 105097
2010-05-29 06:23:24 +00:00
Ted Kremenek 15a0abd399 Discard qualifiers for ElementRegions so that a 'const' doesn't change the lookup semantics
in the symbol store.  We may wish to push this down into the StoreManager itself.

llvm-svn: 104788
2010-05-27 00:29:00 +00:00
Zhongxing Xu eb4fc4a64c Small fix.
llvm-svn: 104669
2010-05-26 03:36:08 +00:00
Zhongxing Xu d4f1294f1e Remove extents of dead symbolic regions when RemoveDeadBindings.
This requires creating new persistent states due to the nature of GDM.

llvm-svn: 104668
2010-05-26 03:27:35 +00:00
Zhongxing Xu 658dd8b176 CastSizeChecker checks when casting a malloc'ed symbolic region to type T,
whether the size of the symbolic region is a multiple of the size of T.
Fixes PR6123 and PR7217.

llvm-svn: 104584
2010-05-25 04:59:19 +00:00
Ted Kremenek a2448b85be Update retain-release checker to understand changes to how 'super' is represented
in the ASTs.  Fixes <rdar://problem/8015556>.

llvm-svn: 104389
2010-05-21 21:57:00 +00:00
Ted Kremenek 5f03be9704 Pass around an error SourceRange instead of an Expr* when reporting errors
in the Objective-C memory checker.

llvm-svn: 104388
2010-05-21 21:56:53 +00:00
Ted Kremenek 26bde774df Add clang support for IBOutletCollection.
llvm-svn: 104135
2010-05-19 17:38:06 +00:00
Zhongxing Xu b013b0bc04 Add option '-analyzer-max-loop', which specifies the maximum
number of times the analyzer will go through a loop.

llvm-svn: 104007
2010-05-18 00:28:37 +00:00
John McCall 96fa4845f7 Clean up some more uses of getAs<ObjCInterfaceType>() that Fariborz pointed
out.  The remaining ones are okay.

llvm-svn: 103973
2010-05-17 21:00:27 +00:00
John McCall 8b07ec253d Substantially alter the design of the Objective C type AST by introducing
ObjCObjectType, which is basically just a pair of
  one of {primitive-id, primitive-Class, user-defined @class}
with
  a list of protocols.
An ObjCObjectPointerType is therefore just a pointer which always points to
one of these types (possibly sugared).  ObjCInterfaceType is now just a kind
of ObjCObjectType which happens to not carry any protocols.

Alter a rather large number of use sites to use ObjCObjectType instead of
ObjCInterfaceType.  Store an ObjCInterfaceType as a pointer on the decl rather
than hashing them in a FoldingSet.  Remove some number of methods that are no
longer used, at least after this patch.

By simplifying ObjCObjectPointerType, we are now able to easily remove and apply
pointers to Objective-C types, which is crucial for a certain kind of ObjC++
metaprogramming common in WebKit.

llvm-svn: 103870
2010-05-15 11:32:37 +00:00
Zhongxing Xu 6e8417c0e5 Relax an assertion. Various cases could lead to non-symbol values.
llvm-svn: 103707
2010-05-13 08:26:32 +00:00
Abramo Bagnara 6150c884df Merged Elaborated and QualifiedName types.
llvm-svn: 103517
2010-05-11 21:36:43 +00:00
Douglas Gregor 10dc8aa581 Fixes for compilation with Microsoft Visual Studio 2010, from Steven Watanabe!
llvm-svn: 103458
2010-05-11 06:18:17 +00:00
Zhongxing Xu 1a56a488ed Turn -analyzer-inline-call on for C functions. This also fixed a bug that
after inlining post-call checking shouldn't be done.

llvm-svn: 103161
2010-05-06 03:38:27 +00:00
Zhongxing Xu 9174b2c2f9 Make -analyzer-inline-call not a separate analysis. Instead it's a boolean
flag now, and can be used with other analyses. Only turned it on for C++ 
methods for now.

llvm-svn: 103160
2010-05-06 02:59:29 +00:00
Douglas Gregor ecc60b99f9 Unbreak CMake build.
llvm-svn: 103077
2010-05-05 05:41:05 +00:00
Douglas Gregor 882211c1da Completely reimplement __builtin_offsetof, based on a patch by Roberto
Amadini.

This change introduces a new expression node type, OffsetOfExpr, that
describes __builtin_offsetof. Previously, __builtin_offsetof was
implemented using a unary operator whose subexpression involved
various synthesized array-subscript and member-reference expressions,
which was ugly and made it very hard to instantiate as a
template. OffsetOfExpr represents the AST more faithfully, with proper
type source information and a more compact representation.

OffsetOfExpr also has support for dependent __builtin_offsetof
expressions; it can be value-dependent, but will never be
type-dependent (like sizeof or alignof). This commit introduces
template instantiation for __builtin_offsetof as well.

There are two major caveats to this patch:

  1) CodeGen cannot handle the case where __builtin_offsetof is not a
  constant expression, so it produces an error. So, to avoid
  regressing in C, we retain the old UnaryOperator-based
  __builtin_offsetof implementation in C while using the shiny new
  OffsetOfExpr implementation in C++. The old implementation can go
  away once we have proper CodeGen support for this case, which we
  expect won't cause much trouble in C++.

  2) __builtin_offsetof doesn't work well with non-POD class types,
  particularly when the designated field is found within a base
  class. I will address this in a subsequent patch.

Fixes PR5880 and a bunch of assertions when building Boost.Python
tests. 

llvm-svn: 102542
2010-04-28 22:16:22 +00:00
Douglas Gregor 8385a06929 Introduce Type::isStructureOrClassType(), which does the obvious
thing. Audit all uses of Type::isStructure(), changing those calls to
isStructureOrClassType() as needed (which is alsmost
everywhere). Fixes the remaining failure in Boost.Utility/Swap.

llvm-svn: 102386
2010-04-26 21:31:17 +00:00
Zhongxing Xu 105dfb5a72 CXXNamedCastExpr is actually an abstract expression.
llvm-svn: 101994
2010-04-21 06:32:25 +00:00
Zhongxing Xu 3affbe6b50 Use the right predecessor.
llvm-svn: 101981
2010-04-21 02:20:10 +00:00
Zhongxing Xu d80755dac2 Add initial support for C++ delete expr.
llvm-svn: 101980
2010-04-21 02:17:31 +00:00
Douglas Gregor 9a12919421 Overhaul the AST representation of Objective-C message send
expressions, to improve source-location information, clarify the
actual receiver of the message, and pave the way for proper C++
support. The ObjCMessageExpr node represents four different kinds of
message sends in a single AST node:

  1) Send to a object instance described by an expression (e.g., [x method:5])
  2) Send to a class described by the class name (e.g., [NSString method:5])
  3) Send to a superclass class (e.g, [super method:5] in class method)
  4) Send to a superclass instance (e.g., [super method:5] in instance method)

Previously these four cases where tangled together. Now, they have
more distinct representations. Specific changes:

  1) Unchanged; the object instance is represented by an Expr*.

  2) Previously stored the ObjCInterfaceDecl* referring to the class
  receiving the message. Now stores a TypeSourceInfo* so that we know
  how the class was spelled. This both maintains typedef information
  and opens the door for more complicated C++ types (e.g., dependent
  types). There was an alternative, unused representation of these
  sends by naming the class via an IdentifierInfo *. In practice, we
  either had an ObjCInterfaceDecl *, from which we would get the
  IdentifierInfo *, or we fell into the case below...

  3) Previously represented by a class message whose IdentifierInfo *
  referred to "super". Sema and CodeGen would use isStr("super") to
  determine if they had a send to super. Now represented as a
  "class super" send, where we have both the location of the "super"
  keyword and the ObjCInterfaceDecl* of the superclass we're
  targetting (statically).

  4) Previously represented by an instance message whose receiver is a
  an ObjCSuperExpr, which Sema and CodeGen would check for via
  isa<ObjCSuperExpr>(). Now represented as an "instance super" send,
  where we have both the location of the "super" keyword and the
  ObjCInterfaceDecl* of the superclass we're targetting
  (statically). Note that ObjCSuperExpr only has one remaining use in
  the AST, which is for "super.prop" references.

The new representation of ObjCMessageExpr is 2 pointers smaller than
the old one, since it combines more storage. It also eliminates a leak
when we loaded message-send expressions from a precompiled header. The
representation also feels much cleaner to me; comments welcome!

This patch attempts to maintain the same semantics we previously had
with Objective-C message sends. In several places, there are massive
changes that boil down to simply replacing a nested-if structure such
as:

  if (message has a receiver expression) {
    // instance message
    if (isa<ObjCSuperExpr>(...)) {
     // send to super
    } else {
     // send to an object
   }
  } else {
    // class message
    if (name->isStr("super")) {
      // class send to super
    } else {
      // send to class
    }
  }

with a switch

  switch (E->getReceiverKind()) {
  case ObjCMessageExpr::SuperInstance: ...
  case ObjCMessageExpr::Instance: ...
  case ObjCMessageExpr::SuperClass: ...
  case ObjCMessageExpr::Class:...
  }

There are quite a few places (particularly in the checkers) where
send-to-super is effectively ignored. I've placed FIXMEs in most of
them, and attempted to address send-to-super in a reasonable way. This
could use some review.

llvm-svn: 101972
2010-04-21 00:45:42 +00:00
Zhongxing Xu 23030c9004 Replace code with a method call. No functionality change.
llvm-svn: 101876
2010-04-20 05:40:40 +00:00
Zhongxing Xu 4d4b8d833e Use GetState() to get the possible cleaned state.
llvm-svn: 101867
2010-04-20 04:53:09 +00:00
Zhongxing Xu 40eb21a827 Improve handling of CXXNewExpr.
llvm-svn: 101862
2010-04-20 03:37:34 +00:00
Dan Gohman 145f3f1e83 Fix -Wcast-qual warnings.
llvm-svn: 101786
2010-04-19 16:39:44 +00:00
Zhongxing Xu 6a479bf281 Move all C++ expression evaluation logic into its own file.
llvm-svn: 101772
2010-04-19 12:51:02 +00:00
Zhongxing Xu b6843f5f35 Analyzer: add support for CXXNewExpr.
llvm-svn: 101771
2010-04-19 11:47:28 +00:00
Benjamin Kramer b11416d061 Add raw_ostream operators to NamedDecl for convenience. Switch over all users of getNameAsString on a stream.
The next step is to print the name directly into the stream, avoiding a temporary std::string copy.

llvm-svn: 101632
2010-04-17 09:33:03 +00:00
Ted Kremenek ef55dd17ec Static analyzer: Don't crash when casting a symbolic region address to a float. Fixes PR 6854.
llvm-svn: 101499
2010-04-16 17:54:33 +00:00
Ted Kremenek 8db54ff1de Fix PR 6844, a regression caused by the introduction of llvm_unreachable for the default
case in GRExprEngine::Visit (in r101129).  Instead, enumerate all Stmt cases and have
no 'default' case in the switch statement.  When we encounter a Stmt we don't handle,
we should explicitly add it to the switch statement.

llvm-svn: 101378
2010-04-15 17:33:31 +00:00
Zhongxing Xu 5eb08f79fc Move GRStmtNodeBuilder::MakeNode() out of line. No functionality change.
llvm-svn: 101239
2010-04-14 06:35:09 +00:00
Zhongxing Xu 3fd05096ce Add support for CXXBoolLiteralExpr.
llvm-svn: 101238
2010-04-14 06:29:29 +00:00
Zhongxing Xu 17b33ed0cf Make all cases that we don't handle explicit.
llvm-svn: 101129
2010-04-13 13:15:19 +00:00
Zhongxing Xu b6f02c3d67 Dispatch all C++ cast expr to VisitCast().
llvm-svn: 101128
2010-04-13 12:38:32 +00:00
Ted Kremenek 26984fb4eb Remove copy of 'Optional' in Clang tree, and convert clients to use the one now in the LLVM tree.
llvm-svn: 100891
2010-04-09 20:26:58 +00:00
Ted Kremenek 212182d12b For 'open' check in UnixAPIChecker, hard code value of 'O_CREAT' on Darwin.
This is still not an ideal solution, but should disable the check for other
targets where the value of O_CREAT is different.

llvm-svn: 100818
2010-04-08 22:15:34 +00:00
Ted Kremenek 769b06cba3 Temporarily only enable 'open' check on Mac OS X to unbreak Windows buildbot. I'm
looking into an alternate fix right now.

llvm-svn: 100816
2010-04-08 21:54:13 +00:00
Ted Kremenek ea4a5abf61 Add static analyzer check for calls to 'pthread_once()' where the control-flow has
automatic storage.  This matches the corresponding check for 'dispatch_once()'.

llvm-svn: 100803
2010-04-08 19:53:31 +00:00
Ted Kremenek 6e95bfc6a5 Fix crash in StoreManager::CastRegion() when the base region is a type with 0 size.
llvm-svn: 100594
2010-04-07 00:46:49 +00:00
Ted Kremenek f969841a1a Teach MemRegion::getBaseRegion() about ObjCIvarRegions. We want to treat
them the same way as fields.  This fixes a regression in RegionStore::RemoveDeadbindings()
that emerged from going to the cluster-based analysis.

llvm-svn: 100570
2010-04-06 22:06:03 +00:00
Zhongxing Xu 0f290ec0f0 Fix PR 6725. It looks like the copy constructor gets elided during inlining.
This bug only shows up with GCC 4.4.1 Release-Asserts build.

llvm-svn: 100516
2010-04-06 03:01:56 +00:00
Zhongxing Xu faa4905e0c Always assume block-level expressions in the caller are alive when analyzing
the callee.

llvm-svn: 100429
2010-04-05 13:16:29 +00:00
Zhongxing Xu 973b5f55f8 Since now we process regions in clusters when removing dead bindings, this
code can be removed.

llvm-svn: 100428
2010-04-05 13:00:12 +00:00
Zhongxing Xu 640aad7667 Use the element type to compute the array size when the base region is a VarRegion.
Patch by Jordy Rose.

llvm-svn: 100099
2010-04-01 08:20:27 +00:00
Zhongxing Xu 920070cfe7 Initial support for visiting CXXMemberCallExpr.
llvm-svn: 100098
2010-04-01 07:58:50 +00:00
Zhongxing Xu 8cea7f6f70 Improve C++ constructor handling.
llvm-svn: 100080
2010-04-01 03:47:27 +00:00
Ted Kremenek c3e1f2f9ba Fix a bug (PR 6699) in RegionStore::RemoveDeadBindings() where
array values with a non-zero offset would get prematurely pruned from the store.

llvm-svn: 100067
2010-04-01 00:15:55 +00:00
Douglas Gregor a771f46c82 Reinstate my CodeModificationHint -> FixItHint renaming patch, without
the C-only "optimization".

llvm-svn: 100022
2010-03-31 17:46:05 +00:00
Douglas Gregor 30e631862f Revert r100008, which inexplicably breaks the clang-i686-darwin10 builder
llvm-svn: 100018
2010-03-31 17:25:35 +00:00
Douglas Gregor 3baad0d4f7 Rename CodeModificationHint to FixItHint, since we've been using the
term "fix-it" everywhere and even *I* get tired of long names
sometimes. No functionality change.

llvm-svn: 100008
2010-03-31 15:31:50 +00:00
John McCall d9c7c6568e Introduce a new kind of derived-to-base cast which bypasses the need for
null checks, and make sure we elide null checks when accessing base class
members.

llvm-svn: 99963
2010-03-30 23:58:03 +00:00
Ted Kremenek 2d107f9d1d RegionStore: specially handle loads from integer global variables declared 'const'.
Fixes a false positive reported in PR 6288.

llvm-svn: 99922
2010-03-30 20:31:04 +00:00
Ted Kremenek f7c226da00 Use 'const Optional<SVal>&' to avoid an extra copy.
llvm-svn: 99921
2010-03-30 20:30:52 +00:00
Rafael Espindola c50c27cca8 the big refactoring bits of PR3782.
This introduces FunctionType::ExtInfo to hold the calling convention and the
noreturn attribute. The next patch will extend it to include the regparm
attribute and fix the bug.

llvm-svn: 99920
2010-03-30 20:24:48 +00:00
Ted Kremenek 4be6a75884 Change the analyzer to recognize (but ignore) assignments to isa. Fixes PR 6302.
llvm-svn: 99904
2010-03-30 18:24:54 +00:00
Rafael Espindola 8756268ee5 Be a bit more consistent in using operator->
This patch moves some methods from QualType to Type and changes the users to
use -> instead of .

llvm-svn: 99805
2010-03-29 03:39:46 +00:00
Benjamin Kramer c048322523 Checker: random include cleanup.
llvm-svn: 99731
2010-03-27 21:19:47 +00:00
Ted Kremenek 0f250e4c5b Fix NoReturnFunctionChecker to properly look at a function's type
when determining if it returns.  Fixes <rdar://problem/7796563>.

llvm-svn: 99663
2010-03-26 22:57:13 +00:00
Zhongxing Xu b6e1c13c36 Add methods to remove a GDM entry.
Instead of setting the ReturnExpr GDM to NULL, remove it.

llvm-svn: 99470
2010-03-25 01:39:39 +00:00
Ted Kremenek 8edc6dfd20 Use llvm::SmallString instead of std::string.
llvm-svn: 99442
2010-03-24 22:39:47 +00:00
Ted Kremenek aeaf3d2ce6 Improve static analyzer diagnostic concerning the use of 'mktemp'
llvm-svn: 99441
2010-03-24 22:39:45 +00:00
Zhongxing Xu e248dca300 Bind the constructed object value to CXXConstructExpr.
llvm-svn: 99271
2010-03-23 09:13:17 +00:00
Zhongxing Xu b473f91498 update CMakeLists.txt
llvm-svn: 99269
2010-03-23 08:14:19 +00:00
Zhongxing Xu bf2f0d74a2 Clear the return expr GDM after using it.
llvm-svn: 99268
2010-03-23 08:09:29 +00:00
Zhongxing Xu 1ff3dcef1f Add a AggExprVisitor class. It contains lots of boiler
plate code for evaluating expressions of C++ class type.

llvm-svn: 99267
2010-03-23 07:32:14 +00:00
Zhongxing Xu 7fffbcc756 merge line.
llvm-svn: 99259
2010-03-23 05:13:26 +00:00
Zhongxing Xu 3c0c81a4d4 Since we now may have basicblocks with the same block is in different function,
change the block counter map from unsigned -> unsigned to 
<StackFrameContext*, unsigned> -> unsigned.

llvm-svn: 99255
2010-03-23 05:05:02 +00:00
Ted Kremenek bb6f5af4a4 Tweak null dereference diagnostics to give clearer diagnostics when
a null dereference results from a field access.

llvm-svn: 99236
2010-03-23 01:11:38 +00:00
Ted Kremenek 28ec56d7dd Improve the diagnostics for the UndefinedAssignmentChecker when an
uninitialized value is used in the LHS of a compound assignment.

llvm-svn: 99221
2010-03-22 22:16:26 +00:00
Kovarththanan Rajaratnam a6405f7a95 Sort calls to add_clang_library()
llvm-svn: 99191
2010-03-22 18:16:06 +00:00
Ted Kremenek bf1dbf37e7 Delete the new visitor if an old one already exists.
llvm-svn: 99114
2010-03-21 04:38:40 +00:00
Ted Kremenek 3460b539df Reapply r99024 (but with the memory issue now fixed).
llvm-svn: 99064
2010-03-20 18:02:01 +00:00
Ted Kremenek 92713e7ec3 Check if a BugReporterVisitor has already been added to a BugReporterContext.
This avoids redundant diagnostics.

llvm-svn: 99063
2010-03-20 18:01:57 +00:00
Daniel Dunbar 4e3e0991e9 Revert r99024, "Augment path diagnostics to include displaying when a message
expression", statistical evidence indicates it has some kind of memory error.

llvm-svn: 99040
2010-03-20 04:28:39 +00:00
Ted Kremenek 8a8e3e61aa Augment path diagnostics to include displaying when a message expression
is not evaluated because the receiver is nil.

llvm-svn: 99024
2010-03-20 01:17:30 +00:00
Ted Kremenek c342c9c001 Refactor argument checking in CallAndMessageChecker to be the same
for both CallExprs and ObjCMessageExprs.

llvm-svn: 98800
2010-03-18 03:22:29 +00:00
Ted Kremenek 9c05f4ef69 Detect pass-by-value arguments that are structs that contain
uninitialized data.

llvm-svn: 98796
2010-03-18 02:17:27 +00:00
Ted Kremenek e174fda979 Tweak dead stores checker to not emit a warning when initialization
a scalar variable with a scalar parameter.  This is a
form of defensive programming.  If the variable is unused,
it will be caused by -Wunused-variable.

llvm-svn: 98795
2010-03-18 01:22:39 +00:00
Zhongxing Xu 03fd76663e Mark CXXThisRegion in the current or parent stack frame context as live so that
their bindings are not removed.

llvm-svn: 98705
2010-03-17 03:35:08 +00:00
Zhongxing Xu 0eb690390d Add VisitCXXContructExpr logic to the analyzer. This still has not fully worked
since RemoveDeadBinding mistakenly remove the binding to CXXThisRegion. 

llvm-svn: 98629
2010-03-16 13:14:16 +00:00
Jeffrey Yasskin f6442f80cb Allow users to set CPPFLAGS and CXXFLAGS on the make command line.
Tested: make CPPFLAGS=-m64 CXXFLAGS=-m64 -j8 && (cd tools/clang;make test)
llvm-svn: 98399
2010-03-12 22:55:16 +00:00
Ted Kremenek 1794ec4a30 Simplify assertion.
llvm-svn: 98176
2010-03-10 19:09:37 +00:00
Ted Kremenek fe697ebaaf Remove '#if 0' code. Lazy compound values have proven their worth.
llvm-svn: 98175
2010-03-10 19:09:34 +00:00
Ted Kremenek 9e92d3f99d Remove the subregion map cache. It is no longer used.
llvm-svn: 98161
2010-03-10 16:38:44 +00:00
Ted Kremenek 2ce82b2323 Fix stale comment.
llvm-svn: 98160
2010-03-10 16:38:41 +00:00
Ted Kremenek ddce4a3d0f Really apply (unnoticed weird git-svn merge conflict in 98144): Refactor RegionStore::RemoveDeadBindings to use the same core cluster analysis algorithm as RegionStore::InvalidateRegions().
Beyond simplifying the algorithm significantly, we no longer
need to build subregion maps in RemoveDeadBindings().  This
and other changes cause a significant speedup: the time to
analyze sqlite3.c (single core) drops by 14%.

llvm-svn: 98159
2010-03-10 16:32:56 +00:00
Ted Kremenek ba2e6c6b73 Refactor RegionStore::RemoveDeadBindings to use the same core
cluster analysis algorithm as RegionStore::InvalidateRegions().

Beyond simplifying the algorithm significantly, we no longer
need to build subregion maps in RemoveDeadBindings().  This
and other changes cause a significant speedup: the time to
analyze sqlite3.c (single core) drops by 14%.

llvm-svn: 98144
2010-03-10 07:20:03 +00:00
Ted Kremenek a2536b642c Refactor some of RegionStore's InvalidateRegionsWorker class
into a 'ClusterAnalysis' parent class.  The idea is
to potentially reuse this for reworking RemoveDeadBindings.

llvm-svn: 98143
2010-03-10 07:19:59 +00:00
Zhongxing Xu 1bb6a1a593 Add use-after-free check to MallocChecker.
llvm-svn: 98136
2010-03-10 04:58:55 +00:00
Ted Kremenek 7de5f32479 Enhance basic store to also lazily symbolicate VarRegions
with an 'unknown' memory space.

llvm-svn: 98110
2010-03-10 00:18:08 +00:00
Douglas Gregor de4827dd34 Extend ObjCMessageExpr for class method sends with the source location
of the class name.

llvm-svn: 97943
2010-03-08 16:40:19 +00:00
Duncan Sands 7a9ba76825 Remove unused headers.
llvm-svn: 97941
2010-03-08 11:29:03 +00:00
Zhongxing Xu e73584384a Remove reference to AnalysisContext in Environment. We already have LocationContext
information in ExplodedNode.

llvm-svn: 97785
2010-03-05 04:45:36 +00:00
Zhongxing Xu 5cb8d9d40f When profiling Environment, also profile with AnalysisContext*, bacause
we now may have identical states with different analysis context.

Set the right AnalysisContext in state when entering and leaving a callee.

With both of the above changes, we can pass the test case.

llvm-svn: 97724
2010-03-04 09:04:52 +00:00
Ted Kremenek 5d2bb1b9b3 [CFG]
After discussion with Zhongxing, don't force the initializer of DeclStmts to be
block-level expressions.

This led to some interesting fallout:

[UninitializedValues]

Always visit the initializer of DeclStmts (do not assume they are block-level expressions).

[BasicStore]

With initializers of DeclStmts no longer block-level expressions, this causes self-referencing initializers (e.g. 'int x = x') to no longer cause the initialized variable to be live before the DeclStmt.  While this is correct, it caused BasicStore::RemoveDeadBindings() to prune off the values of these variables from the initial store (where they are set to uninitialized).  The fix is to back-port some (and only some) of the lazy-binding logic from RegionStore to
BasicStore.  Now the default values of local variables are determined lazily as opposed
to explicitly initialized.

llvm-svn: 97591
2010-03-02 21:43:54 +00:00
Ted Kremenek c3c1b10243 Don't conjure a symbol for DeclStmts when the variable is a C++ reference.
llvm-svn: 97590
2010-03-02 21:43:52 +00:00
Zhongxing Xu 6d3cc382df Since now we store the cast type with an ElementRegion, there is
no need to store a type with SymbolRegionValue.

llvm-svn: 97437
2010-03-01 06:56:52 +00:00
Zhongxing Xu b0e5c27113 Assert when loading from a code text region instead of returning an unknown silently.
llvm-svn: 97436
2010-03-01 05:29:02 +00:00
Zhongxing Xu 7ba9e99015 Use getBody() to get the function definition when the decl referenced is not
definition.

llvm-svn: 97373
2010-02-28 06:39:11 +00:00
Zhongxing Xu 5c07584f44 Use a GDM to record the returned expression in the state when VisitReturnStmt.
Use this information to find the returned value and bind it to CallExpr in
ProcessCallExit.
And there is no need to remove dead bindings in ProcessCallExit, because
a. it would clean up the return value bound to CallExpr
b. we still would do it in the next ProcessStmt(), where we would not misclean
   up the return value.

llvm-svn: 97225
2010-02-26 15:43:34 +00:00
Zhongxing Xu d041bc6ff4 Remove derelict GRStmtNodeBuilder::LastNode.
llvm-svn: 97207
2010-02-26 02:38:09 +00:00
Douglas Gregor a2fbc94458 Restore Zhongxing's commits r97122 r97127 r97129 r97131 which were reverted due to a Clang-on-Clang failure
llvm-svn: 97162
2010-02-25 19:01:53 +00:00
Jakob Stoklund Olesen 5a8f9acaa8 Revert patches r97122 r97127 r97129 r97131.
They were breaking clang-x86_64-darwin10-selfhost

llvm-svn: 97138
2010-02-25 15:47:53 +00:00
Zhongxing Xu ee29cc3b66 Move the GenerateCallExitNode logic completely into GREndPathNodeBuilder.
llvm-svn: 97131
2010-02-25 07:57:35 +00:00
Zhongxing Xu 9516feac36 Move the dead bindings removal logic from CallInliner to GRExprEngine::ProcessCallExit().
llvm-svn: 97129
2010-02-25 07:36:34 +00:00
Zhongxing Xu 2fa52b06d0 Add comments.
llvm-svn: 97127
2010-02-25 07:03:08 +00:00
Zhongxing Xu 14863610f9 Call inliner improvements:
This patch implements the CallEnter/CallExit idea of Ted.

Add two interfaces to GRSubEngine: ProcessCallEnter, ProcessCallExit.

The CallEnter program point uses caller's location context. The
CallExit program point uses callee's location context.

CallEnter is built by GRStmtNodeBuilder. CallExit is built by
GREndPathNodeBuilder.

llvm-svn: 97122
2010-02-25 06:46:30 +00:00
Ted Kremenek b663ffe5f8 Add MacOSXAPIChecker, a meta checker to include various precondition checks for calls
to various MacOS X functions.  The checks in BasicObjCFoundationChecks.cpp will
gradually be migrated here.

As a first check, check that when 'dispatch_once()' is passed a predicate value
that has non-local storage.

llvm-svn: 97116
2010-02-25 05:44:09 +00:00
Ted Kremenek 5563dea713 When generating error node, check to see if we already cached out.
llvm-svn: 97115
2010-02-25 05:44:05 +00:00
Ted Kremenek d98d22b9af Enhance the unused ivar checker to not consider an ivar to be accidentally unused
when it is explicitly marked as unused via __attribute__((unused)).

llvm-svn: 97104
2010-02-25 03:26:55 +00:00
Ted Kremenek d55522f02e Add UnixAPIChecker, a meta checker to include various precondition checks for calls
to various unix/posix functions, e.g. 'open()'.

As a first check, check that when 'open()' is passed 'O_CREAT' that it has
a third argument.

llvm-svn: 97086
2010-02-25 00:20:35 +00:00
Ted Kremenek bfe9f5f4db Remove stray #include.
llvm-svn: 97085
2010-02-25 00:20:31 +00:00
Ted Kremenek ad744f4b88 Remove #include.
llvm-svn: 97084
2010-02-25 00:20:28 +00:00
Ted Kremenek 11e899c199 Divide list of registration functions in API and foundational checks. Also trim whitespace.
llvm-svn: 97083
2010-02-25 00:20:25 +00:00
Ted Kremenek 43fddf77a4 Sort list of checker registration functions.
llvm-svn: 97082
2010-02-25 00:20:22 +00:00
Ted Kremenek b4331a9908 Dead emit dead store warnings when assigning nil to an ObjC object
pointer (for defensive programming).  This matches the behavior with
assigning NULL to a regular pointer.  Fixes <rdar://problem/7631278>.

llvm-svn: 96985
2010-02-23 21:19:33 +00:00
Ted Kremenek 1fcc56c57a Recognize attributes ns_returns_not_retained and cf_returns_not_retained
in the static analyzer.

llvm-svn: 96539
2010-02-18 00:06:12 +00:00
Ted Kremenek 2b36f3f666 Sort @includes.
llvm-svn: 96537
2010-02-18 00:05:58 +00:00
Zhongxing Xu b2ef2f1427 In symbol reaper, a variable is live if its stack frame is the parent of the
current stack frame.

When leaving a callee, remove all bindings belonging to that callee.

llvm-svn: 96473
2010-02-17 08:50:05 +00:00
Zhongxing Xu daf4616455 For inline-based inter-procedural analysis, we will have multiple stack space regions. Use a dense map to store them.
llvm-svn: 96472
2010-02-17 08:46:50 +00:00
Ted Kremenek 228639746a Add simpler checker to check if variables captured by a block are uninitialized.
llvm-svn: 96341
2010-02-16 08:33:59 +00:00
Ted Kremenek d51217e968 Convert GRExprEngine's handling of ObjCMessageExprs to use a worklist
to evaluate arguments.

llvm-svn: 96293
2010-02-15 23:02:46 +00:00
Ted Kremenek 4ba99bee2a clang::Attr objects should be treated as AST nodes as well by
the LLVMConventionsChecker.

llvm-svn: 96202
2010-02-14 22:58:16 +00:00