Commit Graph

2165 Commits

Author SHA1 Message Date
Jordan Rose 7741132f47 [analyzer] RetainCountChecker: add support for CFAutorelease.
<rdar://problems/13710586&13710643>

llvm-svn: 192113
2013-10-07 17:16:52 +00:00
Jordan Rose 9db2d9adef [analyzer] Add new debug helper clang_analyzer_warnIfReached.
This will emit a warning if a call to clang_analyzer_warnIfReached is
executed, printing REACHABLE. This is a more explicit way to declare
expected reachability than using clang_analyzer_eval or triggering
a bug (divide-by-zero or null dereference), and unlike the former will
work the same in inlined functions and top-level functions. Like the
other debug helpers, it is part of the debug.ExprInspection checker.

Patch by Jared Grubb!

llvm-svn: 191909
2013-10-03 16:57:03 +00:00
Jordan Rose 44e066c72a [analyzer] Add missing return after function pointer null check.
Also add some tests that there is actually a message and that the bug is
actually a hard error. This actually behaved correctly before, because:

- addTransition() doesn't actually add a transition if the new state is null;
  it assumes you want to propagate the predecessor forward and does nothing.
- generateSink() is called in order to emit a bug report.
- If at least one new node has been generated, the predecessor node is /not/
  propagated forward.

But now it's spelled out explicitly.

Found by Richard Mazorodze, who's working on a patch that may require this.

llvm-svn: 191805
2013-10-02 01:20:28 +00:00
Richard Smith bb13c9a49d Per latest drafting, switch to implementing init-captures as if by declaring
and capturing a variable declaration, and complete the implementation of them.

llvm-svn: 191605
2013-09-28 04:02:39 +00:00
Jordan Rose 3553bb384b [analyzer] Make inlining decisions based on the callee being variadic.
...rather than trying to figure it out from the call site, and having
people complain that we guessed wrong and that a prototype-less call is
the same as a variadic call on their system. More importantly, fix a
crash when there's no decl at the call site (though we could have just
returned a default value).

<rdar://problem/15037033>

llvm-svn: 191599
2013-09-28 02:04:19 +00:00
Rafael Espindola ea1ba0adfc Replace -fobjc-default-synthesize-properties with disable-objc-default-synthesize-properties.
We want the modern behavior most of the time, so inverting the option simplifies
the driver and the tests.

llvm-svn: 191551
2013-09-27 20:21:48 +00:00
Jordan Rose 1ccc43d50e [analyzer] Handle destructors for the argument to C++ 'delete'.
Now that the CFG includes nodes for the destructors in a delete-expression,
process them in the analyzer using the same common destructor interface
currently used for local, member, and base destructors. Also, check for when
the value is known to be null, in which case no destructor is actually run.

This does not yet handle destructors for deleted /arrays/, which may need
more CFG work. It also causes a slight regression in the location of
double delete warnings; the double delete is detected at the destructor
call, which is implicit, and so is reported on the first access within the
destructor instead of at the 'delete' statement. This will be fixed soon.

Patch by Karthik Bhat!

llvm-svn: 191381
2013-09-25 16:06:17 +00:00
Jordan Rose 36bc6b4559 [analyzer] Don't even try to convert floats to booleans for now.
We now have symbols with floating-point type to make sure that
(double)x == (double)x comes out true, but we still can't do much with
these. For now, don't even bother trying to create a floating-point zero
value; just give up on conversion to bool.

PR14634, C++ edition.

llvm-svn: 190953
2013-09-18 18:58:58 +00:00
Anna Zaks fb05094b52 [analyzer] Stop tracking the objects with attribute cleanup in the RetainCountChecker.
This suppresses false positive leaks. We stop tracking a value if it is assigned to a variable declared with a cleanup attribute.

llvm-svn: 190835
2013-09-17 00:53:28 +00:00
Amara Emerson 8c3de546d6 Add error checking to reject neon_vector_type attribute on targets without NEON.
Patch by Artyom Skrobov.

llvm-svn: 190801
2013-09-16 18:07:35 +00:00
Anton Yartsev f5bcccee76 New message for cases when ownership is taken:
"+method_name: cannot take ownership of memory allocated by 'new'."
instead of the old
"Memory allocated by 'new' should be deallocated by 'delete', not +method_name"

llvm-svn: 190800
2013-09-16 17:51:25 +00:00
Richard Smith ba8071ec81 PR16054: Slight strengthening for -Wsometimes-uninitialized: if we use a
variable uninitialized every time we reach its (reachable) declaration, or
every time we call the surrounding function, promote the warning from
-Wmaybe-uninitialized to -Wsometimes-uninitialized.

This is still slightly weaker than desired: we should, in general, warn
if a use is uninitialized the first time it is evaluated.

llvm-svn: 190623
2013-09-12 18:49:10 +00:00
Jordan Rose 9519ff59ec [analyzer] Handle zeroing constructors for fields of structs with empty bases.
RegionStore tries to protect against accidentally initializing the same
region twice, but it doesn't take subregions into account very well. If
the outer region being initialized is a struct with an empty base class,
the offset of the first field in the struct will be 0. When we initialize
the base class, we may invalidate the contents of the struct by providing
a default value of Unknown (or some new symbol). We then go to initialize
the member with a zeroing constructor, only to find that the region at
that offset in the struct already has a value. The best we can do here is
to invalidate that value and continue; neither the old default value nor
the new 0 is correct for the entire struct after the member constructor call.

The correct solution for this is to track region extents in the store.

<rdar://problem/14914316>

llvm-svn: 190530
2013-09-11 16:46:50 +00:00
Matt Beaumont-Gay 093f240a73 Fix a crash introduced in r189828.
The predicates in CXXRecordDecl which test various properties of special
members can't be called on incomplete decls.

llvm-svn: 190353
2013-09-09 21:07:58 +00:00
Pavel Labath 921e7650d4 Avoid double edges when constructing CFGs
Summary:
If a noreturn destructor is executed while returning a value from a function,
the resulting CFG has had two edges to the exit block. This crashed the analyzer,
because it expects that blocks with no terminators have only one outgoing edge.
I added code to avoid creating the second edge in this case.

PS: The crashes did not manifest themselves always, as usually the
NoReturnFunctionChecker would stop program evaluation before the analyzer hit
the assertion, but in the case of lifetime extended temporaries, the checker
failed to do that (which is a separate bug in itself).

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1513

llvm-svn: 190125
2013-09-06 08:12:48 +00:00
Pavel Labath 5bd1fc5993 [analyzer] Restructure a test file
Summary:
I've had a test failure here while experimenting and I've found that it's
impossible to find what is wrong with the previous structure of the file. So I
have grouped the expected output with the function that produces it, to make
searching for discrepancies more obvious.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1595

llvm-svn: 190037
2013-09-05 09:18:36 +00:00
Jordan Rose d2f4079db9 Add an implicit dtor CFG node just before C++ 'delete' expressions.
This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

  1. <expr>
  2. [B1.1]->~Foo() (Implicit destructor)
  3. delete [B1.1]

Patch by Karthik Bhat!

llvm-svn: 189828
2013-09-03 17:00:57 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
Jordan Rose e600025528 [analyzer] Treat the rvalue of a forward-declared struct as Unknown.
This will never happen in the analyzed code code, but can happen for checkers
that over-eagerly dereference pointers without checking that it's safe.
UnknownVal is a harmless enough value to get back.

Fixes an issue added in r189590, caught by our internal buildbot.

llvm-svn: 189688
2013-08-30 19:17:26 +00:00
Pavel Labath 58934986f2 Sema: avoid reuse of Exprs when synthesizing operator=
Summary:
Previously, Sema was reusing parts of the AST when synthesizing an assignment
operator, turning it into a AS-dag. This caused problems for the static
analyzer, which assumed an expression appears in the tree only once.

Here I make sure to always create a fresh Expr, when inserting something into
the AST, fixing PR16745 in the process.

Reviewers: doug.gregor

CC: cfe-commits, jordan_rose

Differential Revision: http://llvm-reviews.chandlerc.com/D1425

llvm-svn: 189659
2013-08-30 08:52:28 +00:00
Pavel Labath 2c65dfaab5 [analyzer] Fix handling of "empty" structs with base classes
Summary:
RegionStoreManager had an optimization which replaces references to empty
structs with UnknownVal. Unfortunately, this check didn't take into account
possible field members in base classes.

To address this, I changed this test to "is empty and has no base classes". I
don't consider it worth the trouble to go through base classes and check if all
of them are empty.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1547

llvm-svn: 189590
2013-08-29 16:06:04 +00:00
Jordan Rose acd080b956 [analyzer] Add support for testing the presence of weak functions.
When casting the address of a FunctionTextRegion to bool, or when adding
constraints to such an address, use a stand-in symbol to represent the
presence or absence of the function if the function is weakly linked.
This is groundwork for possible simple availability testing checks, and
can already catch mistakes involving inverted null checks for
weakly-linked functions.

Currently, the implementation reuses the "extent" symbols, originally created
for tracking the size of a malloc region. Since FunctionTextRegions cannot
be dereferenced, the extent symbol will never be used for anything else.
Still, this probably deserves a refactoring in the future.

This patch does not attempt to support testing the presence of weak
/variables/ (global variables), which would likely require much more of
a change and a generalization of "region structure metadata", like the
current "extents", vs. "region contents metadata", like CStringChecker's
"string length".

Patch by Richard <tarka.t.otter@googlemail.com>!

llvm-svn: 189492
2013-08-28 17:07:04 +00:00
Pavel Labath fce1b03ee7 [analyzer] Assume new returns non-null even under -fno-exceptions
Summary:
-fno-exceptions does not implicitly attach a nothrow specifier to every operator
new. Even in this mode, non-nothrow new must not return a null pointer. Failure
to allocate memory can be signalled by other means, or just by killing the
program. This behaviour is consistent with the compiler - even with
-fno-exceptions, the generated code never tests for null (and would segfault if
the opeator actually happened to return null).

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1528

llvm-svn: 189452
2013-08-28 08:04:08 +00:00
Roman Divacky 718fb1cdf9 Make the information about disabled ARCMT/Rewriter/StaticAnalyzer available
to lit and use this info to disable Analysis/FixIt/Rewriter/Analysis tests
when those are not compiled into clang.

llvm-svn: 189395
2013-08-27 19:27:35 +00:00
Pavel Labath 02b64d46a0 [analyzer] Refactor conditional expression evaluating code
Summary:
Instead of digging through the ExplodedGraph, to figure out which edge brought
us here, I compute the value of conditional expression by looking at the
sub-expression values.

To do this, I needed to change the liveness algorithm a bit -- now, the full
conditional expression also depends on all atomic sub-expressions, not only the
outermost ones.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1340

llvm-svn: 189090
2013-08-23 07:19:22 +00:00
Jordan Rose 804a655dea [analyzer] Add a triple to test/Analysis/cfg.cpp
llvm-svn: 188683
2013-08-19 17:46:55 +00:00
Jordan Rose 95cdf9d603 [analyzer] Don't run unreachable code checker on inlined functions.
This is still an alpha checker, but we use it in certain tests to make sure
something is not being executed.

This should fix the buildbots.

llvm-svn: 188682
2013-08-19 17:03:12 +00:00
Jordan Rose 60619a639b [analyzer] Assume that strings are no longer than SIZE_MAX/4.
This keeps the analyzer from making silly assumptions, like thinking
strlen(foo)+1 could wrap around to 0. This fixes PR16558.

Patch by Karthik Bhat!

llvm-svn: 188680
2013-08-19 16:27:34 +00:00
Jordan Rose 5374c07ab9 Omit arguments of __builtin_object_size from the CFG.
This builtin does not actually evaluate its arguments for side effects,
so we shouldn't include them in the CFG. In the analyzer, rely on the
constant expression evaluator to get the proper semantics, at least for
now. (In the future, we could get ambitious and try to provide path-
sensitive size values.)

In theory, this does pose a problem for liveness analysis: a variable can
be used within the __builtin_object_size argument expression but not show
up as live. However, it is very unlikely that such a value would be used
to compute the object size and not used to access the object in some way.

<rdar://problem/14760817>

llvm-svn: 188679
2013-08-19 16:27:28 +00:00
Jordan Rose 367843a04c [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.
This once again restores notes to following their associated warnings
in -analyzer-output=text mode. (This is still only intended for use as a
debugging aid.)

One twist is that the warning locations in "regular" analysis output modes
(plist, multi-file-plist, html, and plist-html) are reported at a different
location on the command line than in the output file, since the command
line has no path context. This commit makes -analyzer-output=text behave
like a normal output format, which means that the *command line output
will be different* in -analyzer-text mode. Again, since -analyzer-text is
a debugging aid and lo-fi stand-in for a regular output mode, this change
makes sense.

Along the way, remove a few pieces of stale code related to the path
diagnostic consumers.

llvm-svn: 188514
2013-08-16 01:06:30 +00:00
Jordan Rose 2f8b0229cb [analyzer] If realloc fails on an escaped region, that region doesn't leak.
When a region is realloc()ed, MallocChecker records whether it was known
to be allocated or not. If it is, and the reallocation fails, the original
region has to be freed. Previously, when an allocated region escaped,
MallocChecker completely stopped tracking it, so a failed reallocation
still (correctly) wouldn't require freeing the original region. Recently,
however, MallocChecker started tracking escaped symbols, so that if it were
freed we could check that the deallocator matched the allocator. This
broke the reallocation model for whether or not a symbol was allocated.

Now, MallocChecker will actually check if a symbol is owned, and only
require freeing after a failed reallocation if it was owned before.

PR16730

llvm-svn: 188468
2013-08-15 17:22:06 +00:00
Tim Northover 19ae1175ae Fix FileCheck --check-prefix lines.
Various tests had sprung up over the years which had --check-prefix=ABC on the
RUN line, but "CHECK-ABC:" later on. This happened to work before, but was
strictly incorrect. FileCheck is getting stricter soon though.

Patch by Ron Ofir.

llvm-svn: 188174
2013-08-12 12:51:05 +00:00
Pavel Labath 375e18e32c [analyzer] Enable usage of temporaries in InitListExprs
Summary:
ExprEngine had code which specificaly disabled using CXXTempObjectRegions in
InitListExprs. This was a hack put in r168757 to silence a false positive.

The underlying problem seems to have been fixed in the mean time, as removing
this code doesn't seem to break anything. Therefore I propose to remove it and
solve PR16629 in the process.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1325

llvm-svn: 188059
2013-08-09 07:46:29 +00:00
Jordan Rose 867b185e63 [analyzer] Warn when using 'delete' on an uninitialized variable.
Patch by Karthik Bhat, modified slightly by me.

llvm-svn: 188043
2013-08-09 00:55:47 +00:00
Jordan Rose 7699e4a50b [analyzer] Don't process autorelease counts in synthesized function bodies.
We process autorelease counts when we exit functions, but if there's an
issue in a synthesized body the report will get dropped. Just skip the
processing for now and let it get handled when the caller gets around to
processing autoreleases.

(This is still suboptimal: objects autoreleased in the caller context
should never be warned about when exiting a callee context, synthesized
or not.)

Second half of <rdar://problem/14611722>

llvm-svn: 187625
2013-08-01 22:16:36 +00:00
Jordan Rose 5fbe7f9766 [analyzer] Silently drop all reports within synthesized bodies.
Much of our diagnostic machinery is set up to assume that the report
end path location is valid. Moreover, the user may be quite confused
when something goes wrong in our BodyFarm-synthesized function bodies,
which may be simplified or modified from the real implementations.
Rather than try to make this all work somehow, just drop the report so
that we don't try to go on with an invalid source location.

Note that we still handle reports whose /paths/ go through invalid
locations, just not those that are reported in one.

We do have to be careful not to lose warnings because of this.
The impetus for this change was an autorelease being processed within
the synthesized body, and there may be other possible issues that are
worth reporting in some way. We'll take these as they come, however.

<rdar://problem/14611722>

llvm-svn: 187624
2013-08-01 22:16:30 +00:00
Pavel Labath e4e308625a Fix tests on targets that don't support thread_local
This also reverts r187197.

llvm-svn: 187199
2013-07-26 12:50:30 +00:00
Rafael Espindola 81d648827f Add a triple. Should fix the windows bots.
llvm-svn: 187197
2013-07-26 12:40:55 +00:00
Pavel Labath cf878bbe65 [analyzer] Fix FP warnings when binding a temporary to a local static variable
Summary:
When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

llvm-svn: 187196
2013-07-26 11:50:42 +00:00
Jordan Rose e15a8a49c4 [analyzer] Add regression test for the crash in PR16664.
This goes with r186925, which reverted Pavel's commit in r186498.

Also, add a correctness test for the future.

llvm-svn: 187133
2013-07-25 17:22:05 +00:00
Jordan Rose 783b11b5df [analyzer] Weaken assertion to account for pointer-to-integer casts.
PR16690

llvm-svn: 187132
2013-07-25 17:22:02 +00:00
Jordan Rose 9b3d2c0260 Remove line number from test/Analysis/crash-trace.c.
...and hopefully, finally, unbreak buildbots.

llvm-svn: 186953
2013-07-23 16:12:18 +00:00
Jordan Rose 440ab0e2ae Mark test/Analysis/crash-trace.c as requiring crash recovery.
This plus Rafael's fix at r186943 should keep all the buildbots happy.

llvm-svn: 186950
2013-07-23 16:02:54 +00:00
Rafael Espindola b914b58e9c Run %clang_cc1, it is the one that actually crashes.
llvm-svn: 186943
2013-07-23 15:02:28 +00:00
Jordan Rose 316cdda54b [analyzer] Enable pseudo-destructor expressions.
These are cases where a scalar type is "destructed", usually due to
template instantiation (e.g. "obj.~T()", where 'T' is 'int'). This has
no actual effect and the analyzer should just skip over it.

llvm-svn: 186927
2013-07-23 02:15:20 +00:00
Jordan Rose a45ffe17c7 [analyzer] Add test for crash tracing (r186639)
llvm-svn: 186926
2013-07-23 02:15:16 +00:00
Jordan Rose 7b982b30c0 Revert "[analyzer] Add very limited support for temporary destructors"
The analyzer doesn't currently expect CFG blocks with terminators to be
empty, but this can happen when generating conditional destructors for
a complex logical expression, such as (a && (b || Temp{})). Moreover,
the branch conditions for these expressions are not persisted in the
state. Even for handling noreturn destructors this needs more work.

This reverts r186498.

llvm-svn: 186925
2013-07-23 02:15:11 +00:00
Jordan Rose 5f6c173e7c [analyzer] Handle C++11 member initializer expressions.
Previously, we would simply abort the path when we saw a default member
initialization; now, we actually attempt to evaluate it. Like default
arguments, the contents of these expressions are not actually part of the
current function, so we fall back to constant evaluation.

llvm-svn: 186521
2013-07-17 17:16:42 +00:00
Jordan Rose 5fded08403 [analyzer] Handle C string default values for const char * arguments.
Previously, SValBuilder knew how to evaluate StringLiterals, but couldn't
handle an array-to-pointer decay for constant values. Additionally,
RegionStore was being too strict about loading from an array, refusing to
return a 'char' value from a 'const char' array. Both of these have been
fixed.

llvm-svn: 186520
2013-07-17 17:16:38 +00:00
Jordan Rose 05b2f98d89 [analyzer] Treat std::initializer_list as opaque rather than aborting.
Previously, the use of a std::initializer_list (actually, a
CXXStdInitializerListExpr) would cause the analyzer to give up on the rest
of the path. Now, it just uses an opaque symbolic value for the
initializer_list and continues on.

At some point in the future we can add proper support for initializer_list,
with access to the elements in the InitListExpr.

<rdar://problem/14340207>

llvm-svn: 186519
2013-07-17 17:16:33 +00:00