Commit Graph

1837 Commits

Author SHA1 Message Date
Richard Trieu 560910c9b8 Improve -Wtautological-constant-out-of-range-compare by taking into account
type conversion between integers.  This allows the warning to be more accurate.

Also, turned the warning off in an analyzer test.  The relavent test cases
are covered by the tests in Sema.

llvm-svn: 167992
2012-11-14 22:50:24 +00:00
Anna Zaks a14c1d09f6 [analyzer] Address Jordan's code review for r167813.
This simplifies logic, fixes a bug, and adds a test case.
Thanks Jordan!

llvm-svn: 167868
2012-11-13 19:47:40 +00:00
Anna Zaks de13814a37 Add a test that shows that reporting a leak after failure to free is
tricky.

llvm-svn: 167814
2012-11-13 03:34:49 +00:00
Anna Zaks 67291b90f9 Fix a Malloc Checker FP by tracking return values from initWithCharacter
and other functions.

When these functions return null, the pointer is not freed by
them/ownership is not transfered. So we should allow the user to free
the pointer by calling another function when the return value is NULL.

llvm-svn: 167813
2012-11-13 03:18:01 +00:00
Ted Kremenek e6ee671e16 Fix bad CFG construction bug when handling C++ 'try' statements.
This code assigned the last created CFGBlock* to the variable 'Block',
which is a scratch variable which is null'ed out after a block is
completed.  By assigning the last created block to 'Block', we start
editing a completed block, inserting CFGStmts that should be in
another block.  This was the case with 'try'.  The test case that
showed this had a while loop inside a 'try', and the logic before
the while loop was being included as part of the "condition block"
for the loop.  This showed up as a bogus dead store, but could
have lots of implications.

Turns out this bug was replicated a few times within CFG.cpp, so
I went and fixed up those as well.

llvm-svn: 167788
2012-11-13 00:12:13 +00:00
Anna Zaks 6ec9c3cbc1 [analyzer] Follow up to r167762 - precisely determine the adjustment
conditions.

The adjustment is needed only in case of dynamic dispatch performed by
the analyzer - when the runtime declaration is different from the static
one.

Document this explicitly in the code (by adding a helper). Also, use
canonical Decls to avoid matching against the case where the definition
is different from found declaration.

This fix suppresses the testcase I added in r167762, so add another
testcase to make sure we do test commit r167762.

llvm-svn: 167780
2012-11-12 23:40:29 +00:00
Anna Zaks 4e255b62f1 [analyzer] Fix a regression (from r 165079): compare canonical types.
Suppresses a leak false positive (radar://12663777).

In addition, we'll need to rewrite the adjustReturnValue() method not to
return UnknownVal by default, but rather assert in cases we cannot
handle. To make it possible, we need to correctly handle some of the
edge cases we already know about.

llvm-svn: 167762
2012-11-12 22:06:24 +00:00
Jordan Rose 9eb409ace9 [analyzer] When invalidating symbolic offset regions, take fields into account.
Previously, RegionStore was being VERY conservative in saying that because
p[i].x and p[i].y have a concrete base region of 'p', they might overlap.
Now, we check the chain of fields back up to the base object and check if
they match.

This only kicks in when dealing with symbolic offset regions because
RegionStore's "base+offset" representation of concrete offset regions loses
all information about fields. In cases where all offsets are concrete
(s.x and s.y), RegionStore will already do the right thing, but mixing
concrete and symbolic offsets can cause bindings to be invalidated that
are known to not overlap (e.g. p[0].x and p[i].y).
This additional refinement is tracked by <rdar://problem/12676180>.

<rdar://problem/12530149>

llvm-svn: 167654
2012-11-10 01:40:08 +00:00
Jordan Rose 721567af3e [analyzer] Check that the argument to CFMakeCollectable is non-NULL.
Patch by Sean McBride!

llvm-svn: 167537
2012-11-07 17:12:37 +00:00
Anna Zaks 2ed5125502 [analyzer] Add symbol escapes logic to the SimpleStreamChecker.
llvm-svn: 167439
2012-11-06 04:20:57 +00:00
Anna Zaks 8d1f6ed9a8 [analyzer] Run remove dead on end of path.
This will simplify checkers that need to register for leaks. Currently,
they have to register for both: check dead and check end of path.

I've modified the SymbolReaper to consider everything on the stack dead
if the input StackLocationContext is 0.

(This is a bit disruptive, so I'd like to flash out all the issues
asap.)

llvm-svn: 167352
2012-11-03 02:54:20 +00:00
Anna Zaks 1e80d8b49c [analyzer] SimpleStreamChecker - remove evalAssume and other refinements
llvm-svn: 167099
2012-10-31 02:32:41 +00:00
Anna Zaks 7bd0674dea [analyzer]Don't invalidate const arguments when there is no
IdentifierInfo.

Ee: C++ copy constructors.
llvm-svn: 167092
2012-10-31 01:18:26 +00:00
Jordan Rose 9e068aaa6f [analyzer] Warn about reallocf with an allocation size of 0, like realloc.
Patch by Sean McBride!

llvm-svn: 166995
2012-10-30 01:37:16 +00:00
Jordan Rose 3c2f65a73d [analyzer] New checker for missing super calls in UIViewController subclasses.
This is a syntactic checker aimed at helping iOS programmers correctly
subclass and override the methods of UIViewController. While this should
eventually be covered by the 'objc_requires_super' attribute, this
checker can be used with the existing iOS SDKs without any header changes.

This new checker is currently named 'alpha.osx.cocoa.MissingSuperCall'.
Patch by Julian Mayer!

llvm-svn: 166993
2012-10-30 01:21:35 +00:00
Anna Zaks be70d4d0b4 [analyzer] Add SimpleStreamChecker.
This is an example checker for catching fopen fclose API misuses.

llvm-svn: 166976
2012-10-29 22:51:50 +00:00
Jordan Rose ec44ac6a59 [analyzer] New option to not suppress null return paths if an argument is null.
Our one basic suppression heuristic is to assume that functions do not
usually return NULL. However, when one of the arguments is NULL it is
suddenly much more likely that NULL is a valid return value. In this case,
we don't suppress the report here, but we do attach /another/ visitor to
go find out if this NULL argument also comes from an inlined function's
error path.

This new behavior, controlled by the 'avoid-suppressing-null-argument-paths'
analyzer-config option, is turned off by default. Turning it on produced
two false positives and no new true positives when running over LLVM/Clang.

This is one of the possible refinements to our suppression heuristics.
<rdar://problem/12350829>

llvm-svn: 166941
2012-10-29 17:31:59 +00:00
Jordan Rose 199fdd825f [analyzer] Use the CallEnter node to get a value for tracked null arguments.
Additionally, don't collect PostStore nodes -- they are often used in
path diagnostics.

Previously, we tried to track null arguments in the same way as any other
null values, but in many cases the necessary nodes had already been
collected (a memory optimization in ExplodedGraph). Now, we fall back to
using the value of the argument at the time of the call, which may not
always match the actual contents of the region, but often will.

This is a precursor to improving our suppression heuristic.
<rdar://problem/12350829>

llvm-svn: 166940
2012-10-29 17:31:53 +00:00
Ted Kremenek a5958869f6 TrackConstraintBRVisitor and ConditionBRVisitor can emit similar
path notes for cases where a value may be assumed to be null, etc.
Instead of having redundant diagnostics, do a pass over the generated
PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor
that are already covered by ConditionBRVisitor, whose notes tend
to be better.

Fixes <rdar://problem/12252783>

llvm-svn: 166728
2012-10-25 22:07:10 +00:00
David Tweed d8bb236e18 Correct test inovocations to use %clang_cc1 rather than direct invocation (so that it can have additional options set when trying to debug issues causing regressions).
llvm-svn: 166681
2012-10-25 13:56:30 +00:00
Jordan Rose 1bbd143945 [analyzer] Handle 'SomeVar.SomeEnumConstant', which is legal in C++.
This caused assertion failures analyzing LLVM.

<rdar://problem/12560282>

llvm-svn: 166529
2012-10-23 23:59:08 +00:00
Jordan Rose 746c06d0bc [analyzer] Replace -analyzer-no-eagerly-trim-egraph with graph-trim-interval.
After every 1000 CFGElements processed, the ExplodedGraph trims out nodes
that satisfy a number of criteria for being "boring" (single predecessor,
single successor, and more). Rather than controlling this with a cc1 option,
which can only disable this behavior, we now have an analyzer-config option,
'graph-trim-interval', which can change this interval from 1000 to something
else. Setting the value to 0 disables reclamation.

The next commit relies on this behavior to actually test anything.

llvm-svn: 166528
2012-10-23 23:59:05 +00:00
Jordan Rose 3957fd5858 [analyzer] Assume 'new' never returns NULL if it could throw an exception.
This is actually required by the C++ standard in
[basic.stc.dynamic.allocation]p3:

  If an allocation function declared with a non-throwing
  exception-specification fails to allocate storage, it shall return a
  null pointer. Any other allocation function that fails to allocate
  storage shall indicate failure only by throwing an exception of a type
  that would match a handler of type std::bad_alloc.

We don't bother checking for the specific exception type, but just go off
the operator new prototype. This should help with a certain class of lazy
initalization false positives.

<rdar://problem/12115221>

llvm-svn: 166363
2012-10-20 02:32:51 +00:00
Andy Gibbs c6e68daac0 Prior to adding the new "expected-no-diagnostics" directive to VerifyDiagnosticConsumer, make the necessary adjustment to 580 test-cases which will henceforth require this new directive.
llvm-svn: 166280
2012-10-19 12:44:48 +00:00
Anna Zaks 92898a79eb [analyzer] Ivar invalidation: identify properties declared in protocols.
llvm-svn: 166211
2012-10-18 19:17:57 +00:00
Jordan Rose 8e785e214b [analyzer] When binding to a ParenExpr, bind to its inner expression instead.
This actually looks through several kinds of expression, such as
OpaqueValueExpr and ExprWithCleanups. The idea is that binding and lookup
should be consistent, and so if the environment needs to be modified later,
the code doing the modification will not have to manually look through these
"transparent" expressions to find the real binding to change.

This is necessary for proper updating of struct rvalues as described in
the previous commit.

llvm-svn: 166121
2012-10-17 19:35:44 +00:00
Jordan Rose 29fc261cd7 [analyzer] Create a temporary region when accessing a struct rvalue.
In C++, rvalues that need to have their address taken (for example, to be
passed to a function by const reference) will be wrapped in a
MaterializeTemporaryExpr, which lets CodeGen know to create a temporary
region to store this value. However, MaterializeTemporaryExprs are /not/
created when a method is called on an rvalue struct, even though the 'this'
pointer needs a valid value. CodeGen works around this by creating a
temporary region anyway; now, so does the analyzer.

The analyzer also does this when accessing a field of a struct rvalue.
This is a little unfortunate, since the rest of the struct will soon be
thrown away, but it does make things consistent with the rest of the
analyzer.

This allows us to bring back the assumption that all known 'this' values
are Locs. This is a revised version of r164828-9, reverted in r164876-7.

<rdar://problem/12137950>

llvm-svn: 166120
2012-10-17 19:35:37 +00:00
Anna Zaks b642fc5db4 [analyzer] Ivar Invalidation: track ivars in continuations and
@implementation.

llvm-svn: 166047
2012-10-16 19:36:37 +00:00
David Blaikie 282ad876bd Implement GCC's -Wint-to-pointer-cast.
This implementation doesn't warn on anything that GCC doesn't warn on with the
exception of templates specializations (GCC doesn't warn, Clang does). The
specific skipped cases (boolean, constant expressions, enums) are open for
debate/adjustment if anyone wants to demonstrate that GCC is being overly
conservative here. The only really obvious false positive I found was in the
Clang regression suite's MPI test - apparently MPI uses specific flag values in
pointer constants. (eg: #define FOO (void*)~0)

llvm-svn: 166039
2012-10-16 18:53:14 +00:00
Jordan Rose 968a1b58fa [analyzer] ObjCContainersASTChecker: minor cleanup and an extra test case.
Follow-up to r165838, which fixed a potential crash.

llvm-svn: 166002
2012-10-16 00:47:25 +00:00
Anna Zaks f4fd1455e0 [analyzer] Do not warn on direct ivar assignments within copy methods.
llvm-svn: 165992
2012-10-15 22:48:14 +00:00
Ted Kremenek c9822ebc97 Remove OSAtomicChecker.
llvm-svn: 165744
2012-10-11 20:58:21 +00:00
Jordan Rose e15fb77df8 Reapply "[analyzer] Treat fields of unions as having symbolic offsets."
This time, actually uncomment the code that's supposed to fix the problem.

This reverts r165671 / 8ceb837585ed973dc36fba8dfc57ef60fc8f2735.

llvm-svn: 165676
2012-10-10 23:23:21 +00:00
Eric Christopher a529f8c9c2 Temporarily Revert "[analyzer] Treat fields of unions as having symbolic offsets."
Author: Jordan Rose <jordan_rose@apple.com>
Date:   Wed Oct 10 21:31:21 2012 +0000

    [analyzer] Treat fields of unions as having symbolic offsets.

    This allows only one field to be active at a time in RegionStore.
    This isn't quite the correct behavior for unions, but it at least
    would handle the case of "value goes in, value comes out" from the
    same field.

    RegionStore currently has a number of places where any access to a union
    results in UnknownVal being returned. However, it is clearly missing
    some cases, or the original issue wouldn't have occurred. It is probably
    now safe to remove those changes, but that's a potentially destabilizing
    change that should wait for more thorough testing.

    Fixes PR14054.

    git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165660 91177308-0d34-0410-b5e6-96231b3b80d8

This reverts commit cf9030e480f77ab349672f00ad302e216c26c92c.

llvm-svn: 165671
2012-10-10 22:49:05 +00:00
Jordan Rose fb29410c85 [analyzer] Treat fields of unions as having symbolic offsets.
This allows only one field to be active at a time in RegionStore.
This isn't quite the correct behavior for unions, but it at least
would handle the case of "value goes in, value comes out" from the
same field.

RegionStore currently has a number of places where any access to a union
results in UnknownVal being returned. However, it is clearly missing
some cases, or the original issue wouldn't have occurred. It is probably
now safe to remove those changes, but that's a potentially destabilizing
change that should wait for more thorough testing.

Fixes PR14054.

llvm-svn: 165660
2012-10-10 21:31:21 +00:00
Jordan Rose d8665b3d1a [analyzer] Don't run non-path-sensitive checks on system headers...
...but do run them on user headers.

Previously, we were inconsistent here: non-path-sensitive checks on code
/bodies/ were only run in the main source file, but checks on
/declarations/ were run in /all/ headers. Neither of those is the
behavior we want.

Thanks to Sujit for pointing this out!

<rdar://problem/12454226>

llvm-svn: 165635
2012-10-10 17:55:40 +00:00
Jordan Rose 69583bfefd [analyzer] Tweak test to run the retain-count checker even on non-Darwin.
This should fix the bots.

llvm-svn: 165358
2012-10-06 02:06:17 +00:00
Jordan Rose adb5354c2c ParentMap: Restore the ability to update an existing map.
The Clang ASTs are a DAG, not a pure tree. However, ParentMap has to
choose a single parent for each object. In the main (only?) cases in
which the AST forms a DAG, it protects from multiple traversal by using
OpaqueValueExprs. Previously, ParentMap would just unconditionally look
through all OpaqueValueExprs when building its map.

In order to make this behavior better for the analyzer's diagnostics,
ParentMap was changed to not set a statement's parent if there already
was one in the map. However, ParentMap is supposed to allow updating
existing mappings by calling addStmt once again. This change makes the
"transparency" of OpaqueValueExprs explicit, and disables it when it
is not desired, rather than checking the current contents of the map.

This new code seems like a big change, but it should actually have
essentially the same performance as before. Only OpaqueValueExprs and
their users (PseudoObjectExpr and BinaryConditionalOperator) will
have any different behavior.

There should be no user-visible functionality change, though a test
has been added for the current behavior of BinaryConditionalOperator
source locations and accompanying Xcode arrows (which are not so great...).

llvm-svn: 165355
2012-10-06 01:19:36 +00:00
Jordan Rose c8a78a37bb [analyzer] Handle implicit statements used for end-of-path nodes' source locs.
Some implicit statements, such as the implicit 'self' inserted for "free"
Objective-C ivar access, have invalid source locations. If one of these
statements is the location where an issue is reported, we'll now look at
the enclosing statements for a valid source location.

<rdar://problem/12446776>

llvm-svn: 165354
2012-10-06 01:19:30 +00:00
Jordan Rose ef77a87a9e Revert "InlineObjCInstanceMethod.m: Remove lines introduced in r165079."
...and fix the run line so that the expected warnings are the same on
all platforms.

This reverts r165088 / d09074f0ca06626914108f1c0d4e70adeb851e01.

llvm-svn: 165124
2012-10-03 16:00:32 +00:00
NAKAMURA Takumi d10e270ae6 InlineObjCInstanceMethod.m: Remove lines introduced in r165079. It broke some builds, on FreeBSD, Linux and Windows.
error: 'warning' diagnostics expected but not seen:
  Line 94: types are incompatible
1 error generated.

llvm-svn: 165088
2012-10-03 02:35:19 +00:00
Jordan Rose 1dd2afd876 [analyzer] Adjust the return type of an inlined devirtualized method call.
In C++, overriding virtual methods are allowed to specify a covariant
return type -- that is, if the return type of the base method is an
object pointer type (or reference type), the overriding method's return
type can be a pointer to a subclass of the original type. The analyzer
was failing to take this into account when devirtualizing a method call,
and anything that relied on the return value having the proper type later
would crash.

In Objective-C, overriding methods are allowed to specify ANY return type,
meaning we can NEVER be sure that devirtualizing will give us a "safe"
return value. Of course, a program that does this will most likely crash
at runtime, but the analyzer at least shouldn't crash.

The solution is to check and see if the function/method being inlined is
the function that static binding would have picked. If not, check that
the return value has the same type. If the types don't match, see if we
can fix it with a derived-to-base cast (the C++ case). If we can't,
return UnknownVal to avoid crashing later.

<rdar://problem/12409977>

llvm-svn: 165079
2012-10-03 01:08:35 +00:00
Ted Kremenek 3c6932922e Tweak AnalyzerOptions::getOptionAsInteger() to populate the string
table, making it printable with the ConfigDump checker.  Along the
way, fix a really serious bug where the value was getting parsed
from the string in code that was in an assert() call.  This means
in a Release-Asserts build this code wouldn't work as expected.

llvm-svn: 165041
2012-10-02 20:31:56 +00:00
Ted Kremenek 5faa5e04a3 Change AnalyzerOptions::mayInlineCXXMemberFunction to default populate
the config string table.  Also setup a test for dumping the analyzer
configuration for C++.

llvm-svn: 165040
2012-10-02 20:31:52 +00:00
Jordan Rose 92375adafb [analyzer] Allow ObjC ivar lvalues where the base is nil.
By analogy with C structs, this seems to be legal, if probably discouraged.
It's only if the ivar is read from or written to that there's a problem.
Running a program that gets the "address" of an instance variable does in
fact return the offset when the base "object" is nil.

This isn't a full revert because r164442 includes some diagnostic tweaks
as well; those have been kept.

This partially reverts r164442 / 08965091770c9b276c238bac2f716eaa4da2dca4.

llvm-svn: 164960
2012-10-01 19:07:22 +00:00
Jordan Rose 28c06b268e [analyzer] Add a test for PR13927 "offsetof replacement flagged as null deref"
This seems to be legal according to C11 6.5.3.2.

No functionality change.

llvm-svn: 164959
2012-10-01 19:07:19 +00:00
Jordan Rose 12024f8776 Revert "[analyzer] Check that a member expr is valid even when the result is an lvalue."
The original intent of this commit was to catch potential null dereferences
early, but it breaks the common "home-grown offsetof" idiom (PR13927):

 (((struct Foo *)0)->member - ((struct foo *)0))

As it turns out, this appears to be legal in C, per a footnote in
C11 6.5.3.2: "Thus, &*E is equivalent to E (even if E is a null pointer)".
In C++ this issue is still open:
  http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_active.html#232

We'll just have to make sure we have good path notes in the future.

This reverts r164441 / 9be016dcd1ca3986873a7b66bd4bc027309ceb59.

llvm-svn: 164958
2012-10-01 19:07:15 +00:00
Ted Kremenek 4a5b35eeec Have AnalyzerOptions::getBooleanOption() stick the matching config
string in the config table so that it can be dumped as part of the 
config dumper.  Add a test to show that these options are sticking
and can be cross-checked using FileCheck.

llvm-svn: 164954
2012-10-01 18:28:19 +00:00
Jordan Rose 88dd13fdca Reapply "[analyzer] Handle inlined constructors for rvalue temporaries correctly."
This is related to but not blocked by <rdar://problem/12137950>
("Return-by-value structs do not have associated regions")

This reverts r164875 / 3278d41e17749dbedb204a81ef373499f10251d7.

llvm-svn: 164952
2012-10-01 17:51:35 +00:00
Jordan Rose d60b9168fa Revert "[analyzer] Create a temporary region for rvalue structs when accessing fields"
This reverts commit 6f61df3e7256413dcb99afb9673f4206e3c4992c.

llvm-svn: 164877
2012-09-29 01:36:51 +00:00
Jordan Rose d9b0268401 Revert "[analyzer] Create a temp region when a method is called on a struct rvalue."
This reverts commit 0006ba445962621ed82ec84400a6b978205a3fbc.

llvm-svn: 164876
2012-09-29 01:36:47 +00:00
Jordan Rose cd9000e840 Revert "[analyzer] Handle inlined constructors for rvalue temporaries correctly."
This reverts commit 580cd17f256259f39a382e967173f34d68e73859.

llvm-svn: 164875
2012-09-29 01:36:42 +00:00
Anna Zaks 0353aad5a9 [analyzer] Re-implement IvarInvalidationChecker so that it verifies that
the validation occurred.

The original implementation was pessimistic - we assumed that ivars
which escape are invalidated. This version is optimistic, it assumes
that the ivars will always be explicitly invalidated: either set to nil
or sent an invalidation message.

llvm-svn: 164868
2012-09-29 00:20:38 +00:00
Jordan Rose 19ed6748ea [analyzer] Handle inlined constructors for rvalue temporaries correctly.
Previously the analyzer treated all inlined constructors like lvalues,
setting the value of the CXXConstructExpr to the newly-constructed
region. However, some CXXConstructExprs behave like rvalues -- in
particular, the implicit copy constructor into a pass-by-value argument.
In this case, we want only the /contents/ of a temporary object to be
passed, so that we can use the same "copy each argument into the
parameter region" algorithm that we use for scalar arguments.

This may change when we start modeling destructors of temporaries,
but for now this is the last part of <rdar://problem/12137950>.

llvm-svn: 164830
2012-09-28 17:15:25 +00:00
Jordan Rose b559f18584 [analyzer] Create a temp region when a method is called on a struct rvalue.
An rvalue has no address, but calling a C++ member function requires a
'this' pointer. This commit makes the analyzer create a temporary region
in which to store the struct rvalue and use as a 'this' pointer whenever
a member function is called on an rvalue, which is essentially what
CodeGen does.

More of <rdar://problem/12137950>. The last part is tracking down the
C++ FIXME in array-struct-region.cpp.

llvm-svn: 164829
2012-09-28 17:15:21 +00:00
Jordan Rose e7126582a4 [analyzer] Create a temporary region for rvalue structs when accessing fields
Struct rvalues are represented in the analyzer by CompoundVals,
LazyCompoundVals, or plain ConjuredSymbols -- none of which have associated
regions. If the entire structure is going to persist, this is not a
problem -- either the rvalue will be assigned to an existing region, or
a MaterializeTemporaryExpr will be present to create a temporary region.
However, if we just need a field from the struct, we need to create the
temporary region ourselves.

This is inspired by the way CodeGen handles calls to temporaries;
support for that in the analyzer is coming next.

Part of <rdar://problem/12137950>

llvm-svn: 164828
2012-09-28 17:15:12 +00:00
Anna Zaks 6aef455573 [analyzer] Address Jordan's code review for r164790.
llvm-svn: 164803
2012-09-27 21:57:17 +00:00
Anna Zaks a0c8331663 [analyzer] IvarInvalidation: track synthesized ivars and allow escape
through property getters.

llvm-svn: 164802
2012-09-27 21:57:14 +00:00
Anna Zaks 461f239331 [analyzer] Add an experimental ObjC direct ivar assignment checker.
llvm-svn: 164790
2012-09-27 19:45:15 +00:00
Anna Zaks 8c0dd36ede [analyzer] Address Jordan's code review comments for r164716.
llvm-svn: 164788
2012-09-27 19:45:08 +00:00
Anna Zaks 9802f9fb2a [analyzer] Add experimental ObjC invalidation method checker.
This checker is annotation driven. It checks that the annotated
invalidation method accesses all ivars of the enclosing objects that are
objects of type, which in turn contains an invalidation method.

This is driven by
__attribute((annotation("objc_instance_variable_invalidator")).

llvm-svn: 164716
2012-09-26 18:55:16 +00:00
Anna Zaks a3683dd69e [analyzer] Commit a test case for r164579.
llvm-svn: 164715
2012-09-26 18:55:09 +00:00
Nico Weber c05ecd5b17 Fix two more tests that didn't do anything.
Found with
  find test -type f | xargs grep RUN: | grep '%clang' | grep -iv '%s' | grep -v '%t' | grep -v '\\$'

llvm-svn: 164678
2012-09-26 09:09:17 +00:00
Jordan Rose 902f02db72 [analyzer] Add tests for symbolic expression liveness.
There are very few tests here because SValBuilder is fairly aggressive
about not building SymExprs that we can't evaluate, which saves memory
and CPU but also makes it very much tied to the current constraint
manager. We should probably scale back here and let things decay to
UnknownVal later on.

bitwise-ops.c tests that for the SymExprs we do create, we persist our
assumptions about them. traversal-path-unification.c tests that we do
clean out constraints on arbitrary SymExprs once they have actually died.

llvm-svn: 164623
2012-09-25 19:03:09 +00:00
Jordan Rose db72e2fc37 Reapply "[analyzer] Remove constraints on dead symbols as part of removeDeadBindings."
Previously, we'd just keep constraints around forever, which means we'd
never be able to merge paths that differed only in constraints on dead
symbols.

Because we now allow constraints on symbolic expressions, not just single
symbols, this requires changing SymExpr::symbol_iterator to include
intermediate symbol nodes in its traversal, not just the SymbolData leaf
nodes.

This depends on the previous commit to be correct. Originally applied in
r163444, reverted in r164275, now being re-applied.

llvm-svn: 164622
2012-09-25 19:03:06 +00:00
Anna Zaks b9828203df [analyzer] Really turn on dynamic-bifurcation on by default.
Thanks to Byoungyoung for realizing taht we are not passing the default
option correctly.

llvm-svn: 164543
2012-09-24 17:43:47 +00:00
Jordan Rose 52de8eec01 [analyzer] Suppress bugs whose paths go through the return of a null pointer.
This is a heuristic intended to greatly reduce the number of false
positives resulting from inlining, particularly inlining of generic,
defensive C++ methods that live in header files. The suppression is
triggered in the cases where we ask to track where a null pointer came
from, and it turns out that the source of the null pointer was an inlined
function call.

This change brings the number of bug reports in LLVM from ~1500 down to
around ~300, a much more manageable number. Yes, some true positives may
be hidden as well, but from what I looked at the vast majority of silenced
reports are false positives, and many of the true issues found by the
analyzer are still reported.

I'm hoping to improve this heuristic further by adding some exceptions
next week (cases in which a bug should still be reported).

llvm-svn: 164449
2012-09-22 01:25:06 +00:00
Jordan Rose 4ac7cba404 [analyzer] Track a null value back through FindLastStoreBRVisitor.
Also, tidy up the other tracking visitors so that they mark the right
things as interesting and don't do extra work.

llvm-svn: 164448
2012-09-22 01:25:00 +00:00
Jordan Rose 6f3d2f0acd [analyzer] Look through OpaqueValueExprs when tracking a nil value.
This allows us to show /why/ a particular object is nil, even when it is
wrapped in an OpaqueValueExpr.

llvm-svn: 164445
2012-09-22 01:24:49 +00:00
Jordan Rose 106b037a85 [analyzer] Better path notes for null pointers passed as arguments.
Rather than saying "Null pointer value stored to 'foo'", we now say
"Passing null pointer value via Nth parameter 'foo'", which is much better.
The note is also now on the argument expression as well, rather than the
entire call.

This paves the way for continuing to track arguments back to their sources.

<rdar://problem/12211490>

llvm-svn: 164444
2012-09-22 01:24:46 +00:00
Jordan Rose 1d64a49855 [analyzer] Check that an ObjCIvarRefExpr's base is non-null even as an lvalue.
Like with struct fields, we want to catch cases like this early,
so that we can produce better diagnostics and path notes:

  PointObj *p = nil;
  int *px = &p->_x; // should warn here
  *px = 1;

llvm-svn: 164442
2012-09-22 01:24:38 +00:00
Jordan Rose 04dcb7235f [analyzer] Check that a member expr is valid even when the result is an lvalue.
We want to catch cases like this early, so that we can produce better
diagnostics and path notes:

  Point *p = 0;
  int *px = &p->x; // should warn here
  *px = 1;

llvm-svn: 164441
2012-09-22 01:24:33 +00:00
Ted Kremenek d81a4a18b4 Add faux-body support for dispatch_once().
llvm-svn: 164348
2012-09-21 00:52:24 +00:00
Ted Kremenek 14f779c4d6 Implement faux-body-synthesis of well-known functions in the static analyzer when
their implementations are unavailable.  Start by simulating dispatch_sync().

This change is largely a bunch of plumbing around something very simple.  We
use AnalysisDeclContext to conjure up a fake function body (using the
current ASTContext) when one does not exist.  This is controlled
under the analyzer-config option "faux-bodies", which is off by default.

The plumbing in this patch is largely to pass the necessary machinery
around.  CallEvent needs the AnalysisDeclContextManager to get
the function definition, as one may get conjured up lazily.

BugReporter and PathDiagnosticLocation needed to be relaxed to handle
invalid locations, as the conjured body has no real source locations.
We do some primitive recovery in diagnostic generation to generate
some reasonable locations (for arrows and events), but it can be
improved.

llvm-svn: 164339
2012-09-21 00:09:11 +00:00
Fariborz Jahanian 2f4e33aba2 Improvements to my patch in r164143 per
Richard's comments. // rdar://12202422

llvm-svn: 164316
2012-09-20 19:36:41 +00:00
NAKAMURA Takumi 77369457e0 clang/test/Analysis: Fix the declaration of strlen() for 32 bit targets.
- Inputs/system-header-simulator.h: Declare strlen() with size_t.

  - malloc-interprocedural.c: Move the definition of size_t into the header above.

Then XFAIL can be pruned.

llvm-svn: 164300
2012-09-20 11:03:56 +00:00
NAKAMURA Takumi 4aa6a010d2 test/Analysis/malloc-interprocedural.c: Mark it as XFAIL: cygwin,mingw,msvc for now. Investigating.
llvm-svn: 164295
2012-09-20 08:44:12 +00:00
Jordan Rose d6e5fd52f0 [analyzer] MallocChecker should not do post-call checks on inlined functions.
If someone provides their own function called 'strdup', or 'reallocf', or
even 'malloc', and we inlined it, the inlining should have given us all the
malloc-related information we need. If we then try to attach new information
to the return value, we could end up with spurious warnings.

<rdar://problem/12317671>

llvm-svn: 164276
2012-09-20 01:55:32 +00:00
Jordan Rose ae134c6449 Revert "[analyzer] Remove constraints on dead symbols as part of removeDeadBindings."
While we definitely want this optimization in the future, we're not
currently handling constraints on symbolic /expressions/ correctly.
These should stay live even if the SymExpr itself is no longer referenced
because could recreate an identical SymExpr later. Only once the SymExpr
can no longer be recreated -- i.e. a component symbol is dead -- can we
safely remove the constraints on it.

This liveness issue is tracked by <rdar://problem/12333297>.

This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8.

llvm-svn: 164275
2012-09-20 01:54:56 +00:00
Fariborz Jahanian b1885425c4 c: warn when an integer value comparison with an
integral expression have the obvious result.
Patch reviewed by John McCall off line.
// rdar://12202422

llvm-svn: 164143
2012-09-18 17:37:21 +00:00
Anna Zaks 4278234360 [analyzer] Teach the analyzer about implicit initialization of statics
in ObjCMethods.

Extend FunctionTextRegion to represent ObjC methods as well as
functions. Note, it is not clear what type ObjCMethod region should
return. Since the type of the FunctionText region is not currently used,
defer solving this issue.

llvm-svn: 164046
2012-09-17 19:13:56 +00:00
Ted Kremenek e5c0a9bad4 When warning about unsafe uses of dispatch_once, specially handle the
crazy case where dispatch_once gets redefined as a macro that calls
_dispatch_once (which calls the real dispatch_once).  Users want to
see the warning in their own code.

Fixes <rdar://problem/11617767>

llvm-svn: 163816
2012-09-13 18:18:37 +00:00
Anna Zaks 5d2964e770 [analyzer] Do not report use of undef on "return foo();" when the return type is void.
Fixes a false positive found by analyzing LLVM code base.

llvm-svn: 163750
2012-09-12 22:57:40 +00:00
Anna Zaks 75cfbb60a8 [analyzer] Fix another false positive in malloc realloc logic.
llvm-svn: 163749
2012-09-12 22:57:34 +00:00
Anna Zaks e663b80975 [analyzer] Teach UndefOrNullArgVisitor to track parent regions.
llvm-svn: 163748
2012-09-12 22:57:30 +00:00
Jordan Rose 2010d437f9 [analyzer] Re-add reinterpret_cast virtual call test case from r163644.
We mostly just don't want to crash analyzing this test case; it's likely
the code found here will actually crash if compiled and run.

llvm-svn: 163746
2012-09-12 21:50:56 +00:00
Jordan Rose 99c6c2b4e2 Revert "[analyzer] Use the static type for a virtual call if the dynamic type is worse."
Using the static type may be inconsistent with later calls. We should just
report that there is no inlining definition available if the static type is
better than the dynamic type. See next commit.

This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d.

llvm-svn: 163744
2012-09-12 21:48:13 +00:00
NAKAMURA Takumi fcd16e36c8 clang/test: [PR8833] Introduce the feature "LP64" to suppress LLP64-incompatible tests.
I think some of them could be rewritten to fit also LLP64.

llvm-svn: 163699
2012-09-12 10:45:40 +00:00
Ted Kremenek ba22a035ad Fix regression where "looping back to the head of" PathDiagnosticEvents
were not emitted.

Fixes <rdar://problem/12280665>.

llvm-svn: 163683
2012-09-12 06:22:18 +00:00
Chandler Carruth 66a34a6a45 Adjust some analyzer tests to place widely shared inputs inside of an
'Inputs' subdirectory.

The general desire has been to have essentially all of the non-test
input files live in such directories, with some exceptions for obvious
and common patterns like 'foo.c' using 'foo.h'.

This came up because our distributed test runner couldn't find some of
the headers, for example with stl.cpp.

No functionality changed, just shuffling around here.

llvm-svn: 163674
2012-09-12 01:11:10 +00:00
Chandler Carruth 575037f0de Fix up more "$t"s in this test that should be "%t"s.
llvm-svn: 163673
2012-09-12 01:11:05 +00:00
Jordan Rose e35fdeb330 [analyzer] Use the static type for a virtual call if the dynamic type is worse.
reinterpret_cast does not provide any of the usual type information that
static_cast or dynamic_cast provide -- only the new type. This can get us
in a situation where the dynamic type info for an object is actually a
superclass of the static type, which does not match what CodeGen does at all.
In these cases, just fall back to the static type as the best possible type
for devirtualization.

Should fix the crashes on our internal buildbot.

llvm-svn: 163644
2012-09-11 18:47:13 +00:00
Jordan Rose 12f669e3cd [analyzer] Member function calls that use qualified names are non-virtual.
C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
  id-expression in the class member access expression is a qualified-id,
  that function is called. Otherwise, its final overrider in the dynamic type
  of the object expression is called.

<rdar://problem/12255556>

llvm-svn: 163577
2012-09-11 00:31:02 +00:00
Anna Zaks 1ded453e36 [analyzer] Turn stl inlining back on.
The one reported bug, which was exposed by stl inlining, is addressed in
r163558.

llvm-svn: 163574
2012-09-10 23:59:02 +00:00
Anna Zaks 4f9c460874 [analyzer] Do not count calls to small functions when computing stack
depth.

We only want to count how many substantial functions we inlined. This
is an improvement to r163558.

llvm-svn: 163571
2012-09-10 23:35:11 +00:00
Anna Zaks 5446f4dfb1 [analyzer] Add an option to enable/disable objc inlining.
llvm-svn: 163562
2012-09-10 22:56:41 +00:00
Anna Zaks 14ce52492f [analyzer] Add ipa-always-inline-size option (with 3 as the default).
The option allows to always inline very small functions, whose size (in
number of basic blocks) is set using -analyzer-config
ipa-always-inline-size option.

llvm-svn: 163558
2012-09-10 22:37:19 +00:00
Jordan Rose 1e0e4001c8 [analyzer] For now, don't inline C++ standard library functions.
This is a (heavy-handed) solution to PR13724 -- until we know we can do
a good job inlining the STL, it's best to be consistent and not generate
more false positives than we did before. We can selectively whitelist
certain parts of the 'std' namespace that are known to be safe.

This is controlled by analyzer config option 'c++-stdlib-inlining', which
can be set to "true" or "false".

This commit also adds control for whether or not to inline any templated
functions (member or non-member), under the config option
'c++-template-inlining'. This option is currently on by default.

llvm-svn: 163548
2012-09-10 21:27:35 +00:00
Ted Kremenek 83e480f50f Now that I have a test file to work with, disable the Filecheck part of this test.
llvm-svn: 163536
2012-09-10 19:50:17 +00:00
Ted Kremenek a8755da8b3 Correctly 'cat' out test files.
llvm-svn: 163534
2012-09-10 19:13:08 +00:00