Commit Graph

2805 Commits

Author SHA1 Message Date
Daniel Marjamaki 1149166bb9 [analyzer] Fix crash in CastToStruct when there is no record definition
This crash was reported in https://bugs.llvm.org//show_bug.cgi?id=31173

Differential Revision: https://reviews.llvm.org/D28297

llvm-svn: 295545
2017-02-18 11:18:57 +00:00
Gabor Horvath 3b008536f3 [analyzer] Fix an assertion fail in CStringSyntaxChecker.
Differential Revision: https://reviews.llvm.org/D29384

llvm-svn: 293874
2017-02-02 08:20:54 +00:00
Sam McCall 93590e09d5 In VirtualCallChecker, handle indirect calls
Summary:
In VirtualCallChecker, handle indirect calls.

getDirectCallee() can be nullptr, and dyn_cast(nullptr) is UB

Reviewers: bkramer

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D29303

llvm-svn: 293604
2017-01-31 05:23:20 +00:00
Artem Dergachev 12caf8e1e6 [analyzer] Consider function call arguments while building CallGraph.
Function call can appear in the arguments of another function call, eg.:

  foo(bar());

This patch adds support for such cases.

Patch by Ivan Sidorenko!

Differential revision: https://reviews.llvm.org/D28905

llvm-svn: 293280
2017-01-27 12:14:56 +00:00
Michal Gorny 638ac70a92 [test] Port clang tests to canonicalized booleans
Use the new llvm_canonicalize_cmake_booleans() function to canonicalize
booleans for lit tests. Replace the duplicate ENABLE_CLANG* variables
used to hold canonicalized values with in-place canonicalization. Use
implicit logic in Python code to avoid overrelying on exact 0/1 values.

Differential Revision: https://reviews.llvm.org/D28529

llvm-svn: 293052
2017-01-25 13:11:45 +00:00
Artem Dergachev 55705955ce [analyzer] Fix MacOSXAPIChecker fp with static locals seen from nested blocks.
This is an attempt to avoid new false positives caused by the reverted r292800,
however the scope of the fix is significantly reduced - some variables are still
in incorrect memory spaces.

Relevant test cases added.

rdar://problem/30105546
rdar://problem/30156693
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 293043
2017-01-25 10:21:45 +00:00
Devin Coughlin e1a5630213 Revert "[analyzer] Fix memory space of static locals seen from nested blocks."
This reverts commit r292800.

It is causing null pointer dereference false positives when a block that
captures a static local is evaluated at the top level.

llvm-svn: 292874
2017-01-24 02:10:59 +00:00
Artem Dergachev 01728fbbc0 [analyzer] Fix memory space of static locals seen from nested blocks.
When a block within a function accesses a function's static local variable,
this local is captured by reference rather than copied to the heap.

Therefore this variable's memory space is known: StaticGlobalSpaceRegion.
Used to be UnknownSpaceRegion, same as for stack locals.

Fixes a false positive in MacOSXAPIChecker.

rdar://problem/30105546
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 292800
2017-01-23 16:57:11 +00:00
Anna Zaks dcfc191404 [analyzer] Support inlining of '[self classMethod]' and '[[self class] classMethod]'
Differential Revision: https://reviews.llvm.org/D28495

llvm-svn: 291867
2017-01-13 00:50:47 +00:00
Anna Zaks 14b1af5dcd [analyzer] Fix false positives in Keychain API checker
The checker has several false positives that this patch addresses:
- Do not check if the return status has been compared to error (or no error) at the time when leaks are reported since the status symbol might no longer be alive. Instead, pattern match on the assume and stop tracking allocated symbols on error paths.
- The checker used to report error when an unknown symbol was freed. This could lead to false positives, let's not repot those. This leads to loss of coverage in double frees.
- Do not enforce that we should only call free if we are sure that error was not returned and the pointer is not null. That warning is too noisy and we received several false positive reports about it. (I removed: "Only call free if a valid (non-NULL) buffer was returned")
- Use !isDead instead of isLive in leak reporting. Otherwise, we report leaks for objects we loose track of. This change triggered change #1.

This also adds checker specific dump to the state.

Differential Revision: https://reviews.llvm.org/D28330

llvm-svn: 291866
2017-01-13 00:50:41 +00:00
Artem Dergachev c9affb0dbd [analyzer] Avoid a crash in DereferenceChecker on string literal initializers.
A hotfix for pr31592 that fixes the crash but not the root cause of the problem.
We need to update the analyzer engine further to account for AST changes
introduced in r289618. At the moment we're erroneously performing a redundant
lvalue-to-rvalue cast in this scenario, and squashing the rvalue of the object
bound to the reference into the reference itself.

rdar://problem/28832541

llvm-svn: 291754
2017-01-12 09:46:16 +00:00
Devin Coughlin aac894feba [analyzer] Fix crash in body farm for getter without implicit self.
Fix a crash in body farm when synthesizing a getter for a property
synthesized for a property declared in a protocol on a class extension
that shadows a declaration of the property in a category.

In this case, Sema doesn't fill in the implicit 'self' parameter for the getter
in the category, which leads to a crash when trying to synthesize the getter
for it.

To avoid the crash, skip getter synthesis in body farm if the self parameter is
not filled int.

rdar://problem/29938138

llvm-svn: 291635
2017-01-11 01:02:34 +00:00
Devin Coughlin dc9834f912 [analyzer] Treat pointers to static member functions as function pointers
Sema treats pointers to static member functions as having function pointer
type, so treat treat them as function pointer values in the analyzer as well.
This prevents an assertion failure in SValBuilder::evalBinOp caused by code
that expects function pointers to be Locs (in contrast, PointerToMember values
are nonlocs).

Differential Revision: https://reviews.llvm.org/D28033

llvm-svn: 291581
2017-01-10 18:49:27 +00:00
Gabor Horvath 3d57457298 [analyzer] Add checker for iterators dereferenced beyond their range.
Patch by: Adam Balogh!

Differential Revision: https://reviews.llvm.org/D25660

llvm-svn: 291430
2017-01-09 09:52:32 +00:00
Anton Yartsev 5ac3720620 Fix for PR15623 (corrected r290413 reverted at 290415). The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290505
2016-12-25 00:57:51 +00:00
Anton Yartsev b2a5eb87f8 Revert changes made by r290413 until regression is fixed.
llvm-svn: 290415
2016-12-23 04:09:18 +00:00
Anton Yartsev 1a2a9e3087 Fix for PR15623. The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290413
2016-12-23 03:31:00 +00:00
Devin Coughlin e17f621529 [analyzer] Update GTestChecker to tighten API detection
Update the GTestChecker to tighten up the API detection and make it
cleaner in response to post-commit feedback. Also add tests for when
temporary destructors are enabled to make sure we get the expected behavior
when inlining constructors for temporaries.

llvm-svn: 290352
2016-12-22 17:52:57 +00:00
Artem Dergachev 0e0a8b4d85 [analyzer] Improve suppress-on-sink behavior in incomplete analyses.
Warnings with suppress-on-sink are discarded during FlushReports when
BugReporter notices that all paths in ExplodedGraph that pass through the
warning eventually run into a sink node.

However, suppress-on-sink fails to filter out false positives when the analysis
terminates too early - by running into analyzer limits, such as block count
limits or graph size limits - and the interruption hits the narrow window
between throwing the leak report and reaching the no-return function call. In
such case the report is there, however suppression-on-sink doesn't work, because
the sink node was never constructed in the incomplete ExplodedGraph.

This patch implements a very partial solution: also suppress reports thrown
against a statement-node that corresponds to a statement that belongs to a
no-return block of the CFG.

rdar://problem/28832541

Differential Revision: https://reviews.llvm.org/D28023

llvm-svn: 290341
2016-12-22 14:48:52 +00:00
Devin Coughlin 8beac28564 [analyzer] Add checker modeling gtest APIs.
gtest is a widely-used unit-testing API. It provides macros for unit test
assertions:

  ASSERT_TRUE(p != nullptr);

that expand into an if statement that constructs an object representing
the result of the assertion and returns when the assertion is false:

  if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr))
      ;
  else
    return ...;

Unfortunately, the analyzer does not model the effect of the constructor
precisely because (1) the copy constructor implementation is missing from the
the header (so it can't be inlined) and (2) the boolean-argument constructor
is constructed into a temporary (so the analyzer decides not to inline it since
it doesn't reliably call temporary destructors right now).

This results in false positives because the analyzer does not realize that the
the assertion must hold along the non-return path.

This commit addresses the false positives by explicitly modeling the effects
of the two un-inlined constructors on the AssertionResult state.

I've added a new package, "apiModeling", for these kinds of checkers that
model APIs but don't emit any diagnostics. I envision all the checkers in
this package always being on by default.

This addresses the false positives reported in PR30936.

Differential Revision: https://reviews.llvm.org/D27773

rdar://problem/22705813

llvm-svn: 290143
2016-12-19 22:50:31 +00:00
Devin Coughlin 5b1ee2fad9 [analyzer] Add sink after construction of temporary with no-return destructor.
The analyzer's CFG currently doesn't have nodes for calls to temporary
destructors. This causes the analyzer to explore infeasible paths in which
a no-return destructor would have stopped exploration and so results in false
positives when no-return destructors are used to implement assertions.

To mitigate these false positives, this patch stops generates a sink after
evaluating a constructor on a temporary object that has a no-return destructor.
This results in a loss of coverage because the time at which the destructor is
called may be after the time of construction (especially for lifetime-extended
temporaries).

This addresses PR15599.

rdar://problem/29131566

llvm-svn: 290140
2016-12-19 22:23:22 +00:00
Devin Coughlin aa0fd76be3 [analyzer] UnixAPIChecker: Don't diagnose for functions in C++ namespaces
Update the UnixAPIChecker to not diagnose for calls to functions that
are declared in C++ namespaces. This avoids false positives when a
namespaced function has the same name as a Unix API.

This address PR28331.

llvm-svn: 290023
2016-12-17 01:08:17 +00:00
Devin Coughlin 74810145b0 [analyzer] Extend UnixAPIChecker open() checks to handle openat().
The openat() API has similar constraints to the open() API -- it just takes
an extra parameter.

rdar://problem/29526458

llvm-svn: 290005
2016-12-16 23:31:56 +00:00
Devin Coughlin e3b75ded98 [analyzer] Fix crash in MallocChecker.
Fix a crash in the MallocChecker when the extent size for the argument
to new[] is not known.

A patch by Abramo Bagnara and Dániel Krupp!

https://reviews.llvm.org/D27849

Differential Revision: https://reviews.llvm.org/D27849

llvm-svn: 289970
2016-12-16 18:41:40 +00:00
Artem Dergachev 85c9211043 [analyzer] Add another exception for Qt in MallocChecker
Treat pointers passed to QObject::connectImpl() as escaping.

rdar://problem/29550440

Differential Revision: https://reviews.llvm.org/D27717

llvm-svn: 289939
2016-12-16 12:21:55 +00:00
Anna Zaks 44cdeb1da2 [analyzer] Teach the analyzer that pointers can escape into __cxa_demangle
This fixes a reported false positive in the malloc checker.

Differential Revision: https://reviews.llvm.org/D27599

llvm-svn: 289886
2016-12-15 22:55:18 +00:00
Anna Zaks 6d4e76b988 [analyzer] Refine the diagnostics in the nullability checker to differentiate between nil and null
This is a big deal for ObjC, where nullability annotations are extensively
used. I've also changed "Null" -> "null" and removed "is" as this is the
pattern that Sema is using.

Differential Revision: https://reviews.llvm.org/D27600

llvm-svn: 289885
2016-12-15 22:55:15 +00:00
Anna Zaks 40c74c6d22 [analyzer] Refer to macro names in diagnostics for macros representing a literal
When a macro expending to a literal is used in a comparison, use the macro name
in the diagnostic rather than the literal. This improves readability of path
notes.

Added tests for various macro literals that could occur. Only BOOl, Int, and
NULL tests have changed behavior with this patch.

Differential Revision: https://reviews.llvm.org/D27726

llvm-svn: 289884
2016-12-15 22:55:11 +00:00
Anna Zaks 232ecfdf9c [analyzer] Include type name in Retain Count Checker diagnostics
The more detailed diagnostic will make identifying which object the
diagnostics refer to easier.

Differential Revision: https://reviews.llvm.org/D27740

llvm-svn: 289883
2016-12-15 22:55:03 +00:00
Devin Coughlin 64c01f7bef [analyzer] Add a new SVal to support pointer-to-member operations.
Add a new type of NonLoc SVal for C++ pointer-to-member operations. This SVal
supports both pointers to member functions and pointers to member data.

A patch by Kirill Romanenkov!

Differential Revision: https://reviews.llvm.org/D25475

llvm-svn: 289873
2016-12-15 21:27:06 +00:00
Artem Dergachev e69d2e47e5 [analyzer] Detect ObjC properties that are both (copy) and Mutable.
When an Objective-C property has a (copy) attribute, the default setter
for this property performs a -copy on the object assigned.

Calling -copy on a mutable NS object such as NSMutableString etc.
produces an immutable object, NSString in our example.
Hence the getter becomes type-incorrect.

rdar://problem/21022397

Differential Revision: https://reviews.llvm.org/D27535

llvm-svn: 289554
2016-12-13 17:19:18 +00:00
Devin Coughlin 3e5f0474ca [analyzer] Improve VirtualCallChecker diagnostics and move into optin package.
The VirtualCallChecker is in alpha because its interprocedural diagnostics
represent the call path textually in the diagnostic message rather than with a
path sensitive diagnostic.

This patch turns off the AST-based interprocedural analysis in the checker so
that no call path is needed and improves with diagnostic text. With these
changes, the checker is ready to be moved into the optin package.

Ultimately the right fix is to rewrite this checker to be path sensitive -- but
there is still value in enabling the checker for intraprocedural analysis only
The interprocedural mode can be re-enabled with an -analyzer-config flag.

Differential Revision: https://reviews.llvm.org/D26768

llvm-svn: 289309
2016-12-10 01:16:09 +00:00
Artem Dergachev a4e2541a70 [analyzer] Add dispatch_data_create as a special case in RetainCountChecker.
This function receives a callback block. The analyzer suspects that this block
may be used to take care of releasing the libdispatch object returned from
the function. In fact, it doesn't - it only releases the raw data buffer.
Inform the analyzer about that. Fixes the resulting false negatives.

rdar://problem/22280098

Differential Revision: https://reviews.llvm.org/D27409

llvm-svn: 289047
2016-12-08 14:05:48 +00:00
Artem Dergachev d69e01297f [analyzer] pr31226: Disable CastSizeChecker in C++ because it's not quite ready.
Avoids a crash and a related false positive.

Investigation by Daniel Krupp!

llvm-svn: 288914
2016-12-07 16:12:26 +00:00
Dominic Chen 0dd2306538 [analyzer] Print type for SymbolRegionValues when dumping to stream
Reviewers: NoQ, dcoughlin, zaks.anna

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D27365

llvm-svn: 288696
2016-12-05 20:30:11 +00:00
Devin Coughlin ab139a9e79 [analyzer] ObjCGenerics: Warn only on mismatch for invariant type parameters
On a method call, the ObjCGenerics checker uses the type tracked by
DynamicTypePropagation for the receiver to to infer substituted parmeter types
for the called methods and warns when the argument type does not match the
parameter.

Unfortunately, using the tracked type can result in false positives when the
receiver has a non-invariant type parameter and has been intentionally upcast.
For example, becaue NSArray's type parameter is covaraint, the following code
is perfectly safe:

NSArray<NSString *> *allStrings = ...
NSDate *date = ...;
NSArray<NSObject *> *allObjects = allStrings;
NSArray<NSObject *> *moreObjects = [allObjects arrayByAddingObject:date];

but the checker currently warns that the date parameter is not an NSString *.

To avoid this kind of false positive, the checker will now only warn when
the class defining the called method has only invariant type parameters.

rdar://problem/28803951

llvm-svn: 288677
2016-12-05 16:28:47 +00:00
Richard Smith b3189a1802 DR1213: element access on an array xvalue or prvalue produces an xvalue. In the
latter case, a temporary array object is materialized, and can be
lifetime-extended by binding a reference to the member access. Likewise, in an
array-to-pointer decay, an rvalue array is materialized before being converted
into a pointer.

This caused IR generation to stop treating file-scope array compound literals
as having static storage duration in some cases in C++; that has been rectified
by modeling such a compound literal as an lvalue. This also improves clang's
compatibility with GCC for those cases.

llvm-svn: 288654
2016-12-05 07:49:14 +00:00
Richard Smith 4baaa5ab52 DR616, and part of P0135R1: member access (or pointer-to-member access) on a
temporary produces an xvalue, not a prvalue. Support this by materializing the
temporary prior to performing the member access.

llvm-svn: 288563
2016-12-03 01:14:32 +00:00
Dominic Chen 1a154e082c [analyzer] Drop explicit mention of range constraint solver
Summary: The basic constraint solver was dropped in rL162384, leaving the range constraint solver as the default and only constraint solver. Explicitly specifying it is unnecessary, and makes it difficult to test with other solver backends.

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26694

llvm-svn: 288372
2016-12-01 17:06:39 +00:00
Artem Dergachev 28ee2d1b09 [analyzer] Construct temporary objects of correct types, destroy them properly.
When constructing a temporary object region, which represents the result of
MaterializeTemporaryExpr, track down the sub-expression for which the temporary
is necessary with a trick similar to the approach used in CodeGen, namely
by using Expr::skipRValueSubobjectAdjustments().

Then, create the temporary object region with type of that sub-expression.
That type would propagate further in a path-sensitive manner.

During destruction of lifetime-extened temporaries, consult the type of
the temporary object region, rather than the type of the lifetime-extending
variable, in order to call the correct destructor (fixes pr17001) and,
at least, not to crash by trying to call a destructor of a plain type
(fixes pr19539).

rdar://problem/29131302
rdar://problem/29131576

Differential Revision: https://reviews.llvm.org/D26839

llvm-svn: 288263
2016-11-30 19:02:44 +00:00
Artem Dergachev 7b75e3266c [analyzer] SValExplainer: Support ObjC ivars and __block variables.
Additionally, explain the difference between normal and heap-based
symbolic regions.

llvm-svn: 288260
2016-11-30 18:26:43 +00:00
Artem Dergachev 30ed5467a4 [analyzer] Minor fixes and improvements to debug.ExprInspection
- Fix the bug with transition handling in ExprInspectionChecker's
  checkDeadSymbols implementation.

- Test this bug by adding a new function clang_analyzer_numTimesReached() to
  catch number of passes through the code, which should be handy for testing
  against unintended state splits.

- Add two more functions should help debugging issues quickly without running
  the debugger or dumping exploded graphs - clang_analyzer_dump() which dump()s
  an SVal argument to a warning message, and clang_analyzer_printState(), which
  dump()s the current program state to stderr.

Differential Revision: https://reviews.llvm.org/D26835

llvm-svn: 288257
2016-11-30 17:57:18 +00:00
Artem Dergachev 22e28f4078 [analyzer] Fix a crash on accessing a field within a literal-initialized union.
Because in case of unions we currently default-bind compound values in the
store, this quick fix avoids the crash for this case.

Patch by Ilya Palachev and independently by Alexander Shaposhnikov!

Differential Revision: https://reviews.llvm.org/D26442

llvm-svn: 287618
2016-11-22 04:29:23 +00:00
Devin Coughlin 8693adfd46 [analyzer] Add check for when block is called with too few arguments.
The CallAndMessageChecker has an existing check for when a function pointer
is called with too few arguments. Extend this logic to handle the block
case, as well. While we're at it, do a drive-by grammar correction
("less" --> "fewer") on the diagnostic text.

llvm-svn: 287001
2016-11-15 18:40:46 +00:00
Devin Coughlin e4224cc9f7 [analyzer] Fix crash in NullabilityChecker calling block with too few arguments
Fix a crash when checking parameter nullability on a block invocation
with fewer arguments than the block declaration requires.

rdar://problem/29237566

llvm-svn: 286901
2016-11-14 22:46:02 +00:00
Devin Coughlin 8fa568d761 [analyzer] Update 'Automated' to 'Automatic' from r286694.
ARC is 'Automatic Reference Counting' and not 'Automated Reference Counting'.

llvm-svn: 286700
2016-11-12 01:50:04 +00:00
Devin Coughlin 3dc29a52c7 [analyzer] Fix copy-pasta in NullableReturnedFromNonnullChecker checker name.
The name of the NullableReturnedFromNonnullChecker in Checkers.td
was accidentally "NullablePassedToNonnull", which made it impossible
to explicitly turn the checker on.

rdar://problem/28354459

llvm-svn: 286697
2016-11-12 01:23:01 +00:00
Devin Coughlin d1fe08b8a9 [analyzer] Improve misleading RetainCountChcker diagnostic under ARC
Under automated reference counting the analyzer treats a methods -- even those
starting with  'copy' and friends -- as returning an unowned value. This is
because ownership of CoreFoundation objects must be transferred to ARC
with __bridge_transfer or CFBridgingRelease() before being returned as
ARC-managed bridged objects.

Unfortunately this could lead to a poor diagnostic inside copy methods under
ARC where the analyzer would complain about a leak of a returned CF value inside
a method "whose name does not start with 'copy'" -- even though the name did
start with 'copy'.

This commit improves the diagnostic under ARC to say inside a method "returned
from a method managed by Automated Reference Counting".

rdar://problem/28849667

llvm-svn: 286694
2016-11-12 01:03:06 +00:00
Devin Coughlin e477a0e5ec [analyzer] Teach RetainCountChecker about VTCompressionSessionEncodeFrame()
The context argument passed to VideoToolbox's
VTCompressionSessionEncodeFrame() function is ultimately passed to a callback
supplied when creating the compression session and so may be freed by that
callback.  To suppress false positives in this case, teach the retain count
checker to stop tracking that argument.

This isn't suppressed by the usual callback context mechanism because the call
to VTCompressionSessionEncodeFrame() doesn't include the callback itself.

rdar://problem/27685213

llvm-svn: 286633
2016-11-11 21:31:38 +00:00
Serge Pavlov a67a4d2f3c Make output of -ast-print a valid C++ code.
Output generated by option -ast-print looks like C/C++ code, and it
really is for plain C. For C++ the produced output was not valid C++
code, but the differences were small. With this change the output
is fixed and can be compiled. Tests are changed so that output produced
by -ast-print is compiled again with the same flags and both outputs are
compared.

Option -ast-print is extensively used in clang tests but it itself
was tested poorly, existing tests only checked that compiler did not
crash. There are unit tests in file DeclPrinterTest.cpp, but they test
only terse output mode.

Differential Revision: https://reviews.llvm.org/D26452

llvm-svn: 286439
2016-11-10 08:49:37 +00:00
Artem Dergachev 47fec16cd1 [analyzer] StdLibraryFunctions: provide platform-specific function summaries.
Because standard functions can be defined differently on different platforms,
this commit introduces a method for constructing summaries with multiple
variants, whichever matches better. It is also useful for supporting overloads.

Differential Revision: https://reviews.llvm.org/D25940

llvm-svn: 285852
2016-11-02 19:35:20 +00:00
Devin Coughlin 05c03845e7 [analyzer] Fix capitalization in ObjCSuperDealloc checker diagnostic.
Change "use of 'self'..." to "Use of 'self'...". The convention is to
start diagnostics with a capital letter.

rdar://problem/28322494

llvm-svn: 285759
2016-11-01 22:16:39 +00:00
Artem Dergachev 75f9d3ac7e [analyzer] Allow undefined values in performTrivialCopy.
Reading from a garbage pointer should be modeled as garbage,
and performTrivialCopy should be able to deal with any SVal input.

Patch by Ilya Palachev!

Differential Revision: https://reviews.llvm.org/D25727

llvm-svn: 285640
2016-10-31 21:11:20 +00:00
Artem Dergachev a21df23fd8 [analyzer] MacOSXAPIChecker: Improve warnings for __block vars in dispatch_once.
The checker already warns for __block-storage variables being used as a
dispatch_once() predicate, however it refers to them as local which is not quite
accurate, so we fix that.

Differential Revision: https://reviews.llvm.org/D26159

llvm-svn: 285637
2016-10-31 21:04:54 +00:00
Artem Dergachev aacc03c918 [analyzer] MacOSXAPIChecker: Disallow dispatch_once_t in ivars and heap.
Unlike global/static variables, calloc etc. functions that allocate ObjC
objects behave differently in terms of memory barriers, and hacks that make
dispatch_once as fast as it possibly could be start failing.

Differential Revision: https://reviews.llvm.org/D25909

llvm-svn: 285605
2016-10-31 17:27:26 +00:00
Artem Dergachev e14d881808 [analyzer] NumberObjectConversion: support more types, misc updates.
Support CFNumberRef and OSNumber objects, which may also be accidentally
converted to plain integers or booleans.

Enable explicit boolean casts by default in non-pedantic mode.

Improve handling for warnings inside macros.

Improve error messages.

Differential Revision: https://reviews.llvm.org/D25731

llvm-svn: 285533
2016-10-31 03:08:48 +00:00
Anna Zaks 5b2b39065c [analyzer] Report CFNumberGetValue API misuse
This patch contains 2 improvements to the CFNumber checker:
 - Checking of CFNumberGetValue misuse.
 - Treating all CFNumber API misuse errors as non-fatal. (Previously we treated errors that could cause uninitialized memory as syncs and the truncation errors as non-fatal.)

This implements a subset of functionality from https://reviews.llvm.org/D17954.

Differential Revision: https://reviews.llvm.org/D25876

llvm-svn: 285253
2016-10-26 22:51:47 +00:00
Artem Dergachev a7609fbb64 [analyzer] Fix an ARM buildbot after r284960.
I guess we should always specify triples in all analyzer tests, regardless.

llvm-svn: 284969
2016-10-24 12:54:27 +00:00
Artem Dergachev bba497fb65 [analyzer] Add StdLibraryFunctions checker.
This checker does not emit reports, however it influences the analysis
by providing complete summaries for, or otherwise improving modeling of,
various standard library functions.

This should reduce the number of infeasible paths explored during analysis.
The custom function summary format used in this checker is superior to
body farms by causing less unnecessary state splits,
which would result in better analysis performance.

Differential Revision: https://reviews.llvm.org/D20811

llvm-svn: 284960
2016-10-24 09:41:38 +00:00
Reid Kleckner 2e1538f282 Remove 24 instances of 'REQUIRES: shell'
Tests fall into one of the following categories:

- The requirement was unnecessary

- Additional quoting was required for backslashes in paths (see "sed -e
  's/\\/\\\\/g'") in the sanitizer tests.

- OpenMP used 'REQUIRES: shell' as a proxy for the test failing on
  Windows. Those tests fail there reliably, so use XFAIL instead.

I tried not to remove shell requirements that were added to suppress
flaky test failures, but if I screwed up, we can add it back as needed.

llvm-svn: 284793
2016-10-20 23:11:45 +00:00
Daniel Marjamaki fa1bf447d9 alpha.core.UnreachableCode - don't warn about unreachable code inside macro
In macros, 'do {...} while (0)' is often used. Don't warn about the condition 0 when it is unreachable.

Differential Revision: https://reviews.llvm.org/D25606

llvm-svn: 284477
2016-10-18 13:16:53 +00:00
Artem Dergachev 940c770d27 [analyzer] Add NumberObjectConversion checker.
When dealing with objects that represent numbers, such as Objective-C NSNumber,
the language provides little protection from accidentally interpreting
the value of a pointer to such object as the value of the number represented
by the object. Results of such mis-interpretation may be unexpected.

The checker attempts to fill this gap in cases when the code is obviously
incorrect.

With "Pedantic" option enabled, this checker enforces a coding style to
completely prevent errors of this kind (off by default).

Differential Revision: https://reviews.llvm.org/D22968

llvm-svn: 284473
2016-10-18 11:06:28 +00:00
Richard Smith 391fb8662a [c++1z] Include "noexcept" in builtin function types where appropriate. Fixes
an assertion failure looking up a matching ::operator delete for
__builtin_operator_delete.

llvm-svn: 284458
2016-10-18 07:13:55 +00:00
Devin Coughlin 684d19d879 Revert "Revert "[analyzer] Make MallocChecker more robust against custom redeclarations""
This reverts commit r284340 to reapply r284335. The bot breakage was due to
an unrelated change in the polybench test suite.

llvm-svn: 284351
2016-10-16 22:19:03 +00:00
Devin Coughlin eeb8d20db4 Revert "[analyzer] Make MallocChecker more robust against custom redeclarations"
This reverts commit r284335.

It appears to be causing test-suite compile-time and execution-time
performance measurements to take longer than expected on several bots.
This is surprising, because r284335 is a static-analyzer-only change.

llvm-svn: 284340
2016-10-16 19:26:07 +00:00
Devin Coughlin 62ce463a35 [analyzer] Make MallocChecker more robust against custom redeclarations
Add additional checking to MallocChecker to avoid crashing when memory
routines have unexpected numbers of arguments. You wouldn't expect to see much
of this in normal code (-Wincompatible-library-redeclaration warns on this),
but, for example, CMake tests can generate these.

This is PR30616.

rdar://problem/28631974

llvm-svn: 284335
2016-10-16 17:26:06 +00:00
Devin Coughlin 4fba10c394 Revert "[analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker""
Revert:
r283662: [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker"
r283660: [analyzer] Fix build error after r283660 - remove constexpr strings.

It was causing an internal build bot to fail. It looks like in some cases
adding an extra note can cause scan-build plist output to drop a diagnostic
altogether.

llvm-svn: 284317
2016-10-16 00:30:08 +00:00
Devin Coughlin 0bd37a1a36 [analyzer] DeallocChecker: Don't warn about directly-set IBOutlet ivars on macOS
On macOS (but not iOS), if an ObjC property has no setter, the nib-loading code
for an IBOutlet is documented as directly setting the backing ivar without
retaining the value -- even if the property is 'retain'.

This resulted in false positives from the DeallocChecker for code that did not
release such ivars in -dealloc.

To avoid these false positives, treat IBOutlet ivars that back a property
without a setter as having an unknown release requirement in macOS.

rdar://problem/28507353

llvm-svn: 284084
2016-10-12 23:57:05 +00:00
Artem Dergachev 4eca0de7b7 [analyzer] Re-apply r283094 "Improve CloneChecker diagnostics"
The parent commit (r283092) was reverted before and now finally landed.

llvm-svn: 283661
2016-10-08 10:54:30 +00:00
Artem Dergachev 46209e1dd0 [analyzer] Re-apply r283093 "Add extra notes to ObjCDeallocChecker"
The parent commit (r283092) was reverted before and now finally landed.

llvm-svn: 283660
2016-10-08 10:53:00 +00:00
Daniel Marjamaki d99ebc03f4 [analyzer] Don't merge different return nodes in ExplodedGraph
Returns when calling an inline function should not be merged in the ExplodedGraph unless they are same.

Differential Revision: https://reviews.llvm.org/D25326

llvm-svn: 283554
2016-10-07 14:21:08 +00:00
Anton Yartsev 0509d047f4 [analyzer] Add explanation why analyzer report is not generated (fix for PR12421).
Currently if the path diagnostic consumer (e.g HTMLDiagnostics and PlistDiagnostics) do not support cross file diagnostics then the path diagnostic report is silently omitted in the case of cross file diagnostics. The patch adds a little verbosity to Clang in this case.
The patch also adds help entry for the "--analyzer-output" driver option.

llvm-svn: 283499
2016-10-06 21:42:21 +00:00
Richard Smith 0511d23aeb PR22924, PR22845, some of CWG1464: When checking the initializer for an array
new expression, distinguish between the case of a constant and non-constant
initializer. In the former case, if the bound is erroneous (too many
initializer elements, bound is negative, or allocated size overflows), reject,
and take the bound into account when determining whether we need to
default-construct any elements. In the remanining cases, move the logic to
check for default-constructibility of trailing elements into the initialization
code rather than inventing a bogus array bound, to cope with cases where the
number of initialized elements is not the same as the number of initializer
list elements (this can happen due to string literal initialization or brace
elision).

This also fixes rejects-valid and crash-on-valid errors when initializing a
new'd array of character type from a braced string literal.

llvm-svn: 283406
2016-10-05 22:41:02 +00:00
Artem Dergachev 9cb5614c29 [analyzer] Improve "Assuming..." diagnostic pieces for logical operators.
Logical short-circuit operators now act like other branch conditions.

If the symbolic value of the left-hand side is not known to be true or false
(based on the previous execution path), the "Assuming" event piece is added
in order to explain that the analyzer is adding a new assumption.

Additionally, when the assumption is made against the right-hand side of
the logical operator (i.e. when the operator itself acts as a condition
in another CFG terminator), the "Assuming..." piece is written out for the
right-hand side of the operator rather than for the whole operator.
This allows expression-specific diagnostic message text to be constructed.

Differential Revision: https://reviews.llvm.org/D25092

llvm-svn: 283302
2016-10-05 08:28:25 +00:00
Artem Dergachev 0c33406aaa [analyzer] Add "Assuming..." diagnostic pieces for unsupported conditions.
In the analyzer's path-sensitive reports, when a report goes through a branch
and the branch condition cannot be decided to be definitely true or false
(based on the previous execution path), an event piece is added that tells the
user that a new assumption is added upon the symbolic value of the branch
condition. For example, "Assuming 'a' is equal to 3".

The text of the assumption is hand-crafted in various manners depending on
the AST expression. If the AST expression is too complex and the text of
the assumption fails to be constructed, the event piece is omitted.
This causes loss of information and misunderstanding of the report.

Do not omit the event piece even if the expression is too complex;
add a piece with a generic text instead.

Differential Revision: https://reviews.llvm.org/D23300

llvm-svn: 283301
2016-10-05 08:19:49 +00:00
Vitaly Buka 1a8d52d1ae Revert "[analyzer] Improve CloneChecker diagnostics" as its depends on reverted r283092
This reverts commit r283094.

llvm-svn: 283182
2016-10-04 02:40:35 +00:00
Vitaly Buka b3814f6f38 Revert "[analyzer] Add extra notes to ObjCDeallocChecker" as its depends on reverted r283092
This reverts commit r283093.

llvm-svn: 283181
2016-10-04 02:36:58 +00:00
Daniel Marjamaki fd1b3814b3 [StaticAnalyser] Add test case to ensure that unreachable code is found.
https://reviews.llvm.org/D24905

llvm-svn: 283096
2016-10-03 09:45:35 +00:00
Daniel Marjamaki 042a3c5a2d [StaticAnalyzer] Fix UnreachableCode false positives.
When there is 'do { } while (0);' in the code the ExplodedGraph and UnoptimizedCFG did not match.

Differential Revision: https://reviews.llvm.org/D24759

llvm-svn: 283095
2016-10-03 08:28:51 +00:00
Artem Dergachev c87d2a613e [analyzer] Improve CloneChecker diagnostics
Highlight code clones referenced by the warning message with the help of
the extra notes feature recently introduced in r283092.

Change warning text to more clang-ish. Remove suggestions from the copy-paste
error checker diagnostics, because currently our suggestions are strictly 50%
wrong (we do not know which of the two code clones contains the error), and
for that reason we should not sound as if we're actually suggesting this.
Hopefully a better solution would bring them back.

Make sure the suspicious clone pair structure always mentions
the correct variable for the second clone.

Differential Revision: https://reviews.llvm.org/D24916

llvm-svn: 283094
2016-10-03 08:11:50 +00:00
Artem Dergachev 918602df8d [analyzer] Add extra notes to ObjCDeallocChecker
The report is now highlighting instance variables and properties
referenced by the warning message with the help of the
extra notes feature recently introduced in r283092.

Differential Revision: https://reviews.llvm.org/D24915

llvm-svn: 283093
2016-10-03 08:03:51 +00:00
Daniel Marjamaki 2593b402ce [StaticAnalyzer] Fix false positives for vardecls that are technically unreachable but they are needed.
Example:

    switch (x) {
      int a;  // <- This is unreachable but needed
    case 1:
      a = ...

Differential Revision: https://reviews.llvm.org/D24905

llvm-svn: 282574
2016-09-28 10:39:53 +00:00
Daniel Marjamaki 13264ebea4 [analyzer] Improve CastToStruct checker so it can also detect widening casts of struct data
Example:

struct AB {
  int A;
  int B;
};

struct ABC {
  int A;
  int B;
  int C;
};

void f() {
  struct AB Data;
  struct ABC *P = (struct ABC *)&Data;
}

Differential Revision: https://reviews.llvm.org/D23508

llvm-svn: 282411
2016-09-26 15:17:18 +00:00
Alexander Shaposhnikov a1fead293f [analyzer] Fix crash in RetainCountChecker::checkEndFunction
The class BodyFarm creates bodies for
OSAtomicCompareAndSwap*, objc_atomicCompareAndSwap*, dispatch_sync*, dispatch_once*
and for them the flag isBodyAutosynthesized is set to true.

This diff
1. makes AnalysisConsumer::HandleCode skip the autosynthesized code
2. replaces assert(LCtx->getParent()) in RetainCountChecker::checkEndFunction
by assert(!LCtx->inTopFrame()) (minor cleanup)

Test plan: make -j8 check-clang-analysis

Differential revision: https://reviews.llvm.org/D24792

llvm-svn: 282293
2016-09-23 20:49:01 +00:00
Anna Zaks c154f7bc37 [analyzer] Add a checker that detects blocks in critical sections
This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock.

Example:

mutex_t m;

void f() {
  sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked]
  // do some work
}

void foobar() {
  lock(m);
  f();
  unlock(m);
}

A patch by zdtorok (Zoltán Dániel Török)!

Differential Revision: https://reviews.llvm.org/D21506

llvm-svn: 282011
2016-09-20 20:28:50 +00:00
Gabor Horvath 7304027c6d [analyzer] Calculate extent size for memory regions allocated by new expression.
ArrayBoundChecker did not detect out of bounds memory access errors in case an
array was allocated by the new expression. This patch resolves this issue.

Patch by Daniel Krupp!

Differential Revision: https://reviews.llvm.org/D24307

llvm-svn: 281934
2016-09-19 20:39:52 +00:00
Alexander Shaposhnikov 6956d29034 [analyzer] Fix ExprEngine::VisitMemberExpr
AST may contain intermediate ParenExpr nodes
between MemberExpr and ArrayToPointerDecay.
This diff adjusts the check in ExprEngine::VisitMemberExpr accordingly.
Test plan: make -j8 check-clang-analysis

Differential revision: https://reviews.llvm.org/D24484

llvm-svn: 281373
2016-09-13 19:17:20 +00:00
Aleksei Sidorin 29afb1937b [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>
This patch also introduces AnalysisOrderChecker which is intended for testing
of callback call correctness.

Differential Revision: https://reviews.llvm.org/D23804

llvm-svn: 280367
2016-09-01 13:55:38 +00:00
Aleksei Sidorin e1beaf1ee7 [analyzer] Add more FileIDs to PlistDiagnostic map to avoid assertion
Some FileIDs that may be used by PlistDiagnostics were not added while building
a list of pieces. This caused assertion violation in GetFID() function.
This patch adds some missing FileIDs to avoid the assertion. It also contains
small refactoring of PlistDiagnostics::FlushDiagnosticsImpl().

Patch by Aleksei Sidorin, Ilya Palachev.

Differential Revision: https://reviews.llvm.org/D22090

llvm-svn: 280360
2016-09-01 12:25:16 +00:00
Richard Smith 53851923d5 Fix all tests under test/CXX (and test/Analysis) to pass if clang's default
C++ language standard is not C++98.

llvm-svn: 280309
2016-08-31 23:24:08 +00:00
Devin Coughlin 184996bbb4 [analyzer] Use lazily created buffer in EmptyLocalizationContextChecker
Fix a crash when relexing the underlying memory buffer to find incorrect
arguments to NSLocalizedString(). With precompiled headers, the raw
buffer may be NULL. Instead, use the source manager to get the buffer,
which will lazily create the buffer for precompiled headers.

rdar://problem/27429091

llvm-svn: 280174
2016-08-30 23:07:14 +00:00
Artem Dergachev 5f94b089e9 [analyzer] Fix CloneDetector crash on calling methods of class templates.
If a call expression represents a method call of a class template,
and the method itself isn't templated, then the method may be considered
to be a template instantiation without template specialization arguments.

No longer crash when we could not find template specialization arguments.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D23780

llvm-svn: 279529
2016-08-23 16:42:00 +00:00
Gabor Horvath b59b27040e Reapply "[analyzer] Added valist related checkers."
Differential Revision: https://reviews.llvm.org/D15227

llvm-svn: 279427
2016-08-22 11:21:30 +00:00
Gabor Horvath 855ad82e05 [analyzer] Correctly add assumptions based on array bounds.
Also simplify the constraints generated by the checker. 

Differential Revision: https://reviews.llvm.org/D23112

llvm-svn: 279425
2016-08-22 10:07:32 +00:00
Artem Dergachev 51b9a0e8e8 [analyzer] Make CloneDetector consider macro expansions.
So far macro-generated code was treated by the CloneDetector as normal code.
This caused that some macros where reported as false-positive clones because
large chunks of code coming from otherwise concise macro expansions were treated
as copy-pasted code.

This patch ensures that macros are treated in the same way as literals/function
calls. This prevents macros that expand into multiple statements
from being reported as clones.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D23316

llvm-svn: 279367
2016-08-20 10:06:59 +00:00
Artem Dergachev 5183888813 [analyzer] Make CloneDetector consider template arguments.
For example, code samples `isa<Stmt>(S)' and `isa<Expr>(S)'
are no longer considered to be clones.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D23555

llvm-svn: 279366
2016-08-20 09:57:21 +00:00
Devin Coughlin 719238b7d3 [analyzer] Weaken assertion in trackNullOrUndefValue()
We should ignore paren casts when making sure that the semantic expression
in a PseudoObjectExpr for an ObjC getter is a message send.

This has no other intended functionality change.

Adding a test for this exposed an interesting issue in another test case
that only manifests under ARC. trackNullOrUndefValue() is not properly
suppressing for nil values that are the result of nil propagation from a nil
receiver when the nil is returned from a function. I've added a FIXME for that
missing suppression.

rdar://problem/27290568

llvm-svn: 279181
2016-08-19 01:05:31 +00:00
Artem Dergachev 2fc1985db3 [analyzer] Teach CloneDetector to find clones that look like copy-paste errors.
The original clone checker tries to find copy-pasted code that is exactly
identical to the original code, up to minor details.

As an example, if the copy-pasted code has all references to variable 'a'
replaced with references to variable 'b', it is still considered to be
an exact clone.

The new check finds copy-pasted code in which exactly one variable seems
out of place compared to the original code, which likely indicates
a copy-paste error (a variable was forgotten to be renamed in one place).

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D23314

llvm-svn: 279056
2016-08-18 12:29:41 +00:00
Gabor Horvath 2402dd1e82 revert [analyzer] Added valist related checkers.
llvm-svn: 279043
2016-08-18 09:13:37 +00:00
Gabor Horvath 56e8aa535b [analyzer] Added valist related checkers.
Differential Revision: https://reviews.llvm.org/D15227

llvm-svn: 279041
2016-08-18 08:43:26 +00:00
Artem Dergachev 002981baca [analyzer] Add a checker for loss of sign or precision in integral casts.
This new checker tries to find execution paths on which implicit integral casts
cause definite loss of information: a certainly-negative integer is converted
to an unsigned integer, or an integer is definitely truncated to fit into
a smaller type.

Being implicit, such casts are likely to produce unexpected results.

Patch by Daniel Marjamäki!

Differential Revision: https://reviews.llvm.org/D13126

llvm-svn: 278941
2016-08-17 16:02:45 +00:00
Artem Dergachev cbce96c3af [analyzer] Add LocationContext information to SymbolMetadata.
Like SymbolConjured, SymbolMetadata also needs to be uniquely
identified by the moment of its birth.

Such moments are coded by the (Statement, LocationContext, Block count) triples.
Each such triple represents the moment of analyzing a statement with a certain
call backtrace, with corresponding CFG block having been entered a given amount
of times during analysis of the current code body.

The LocationContext information was accidentally omitted for SymbolMetadata,
which leads to reincarnation of SymbolMetadata upon re-entering a code body
with a different backtrace; the new symbol is incorrectly unified with
the old symbol, which leads to unsound assumptions.

Patch by Alexey Sidorin!

Differential Revision: https://reviews.llvm.org/D21978

llvm-svn: 278937
2016-08-17 15:37:52 +00:00
Saleem Abdulrasool b9250475ea StaticAnalyzer: Report found fields order in PaddingChecker
Report the found fields order in PaddingChecker.

Patch by Alexander Shaposhnikov!

llvm-svn: 278730
2016-08-15 20:16:13 +00:00
Devin Coughlin 81cc38cf9a [analyzer] Teach RetainCountChecker about CVFooRetain
Change the retain count checker to treat CoreFoundation-style "CV"-prefixed
reference types from CoreVideo similarly to CoreGraphics types. With this
change, we treat CVFooRetain() on a CVFooRef type as a retain. CVFooRelease()
APIs are annotated as consuming their parameter, so this change prevents false
positives about incorrect decrements of reference counts.

<rdar://problem/27116090>

llvm-svn: 278382
2016-08-11 18:41:29 +00:00
Artem Dergachev cad151491e [analyzer] Fix a crash in CloneDetector when calling functions by pointers.
CallExpr may have a null direct callee when the callee function is not
known in compile-time. Do not try to take callee name in this case.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D23320

llvm-svn: 278238
2016-08-10 16:25:16 +00:00
Artem Dergachev 6a76a1639f [analyzer] Change -analyze-function to accept qualified names.
Both -analyze-function and -analyzer-display-progress now share the same
convention for naming functions, which allows discriminating between
methods with the same name in different classes, C++ overloads, and also
presents Objective-C instance and class methods in the convenient notation.

This also allows looking up the name for the particular function you're trying
to restrict analysis to in the -analyzer-display-progress output,
in case it was not instantly obvious.

Differential Revision: https://reviews.llvm.org/D22856

llvm-svn: 278018
2016-08-08 16:01:02 +00:00
Gabor Horvath c430990d0b [analyzer] Command line option to show enabled checker list.
This patch adds a command line option to list the checkers that were enabled
by analyzer-checker and not disabled by -analyzer-disable-checker.

It can be very useful to debug long command lines when it is not immediately
apparent which checkers are turned on and which checkers are turned off.

Differential Revision: https://reviews.llvm.org/D23060

llvm-svn: 278006
2016-08-08 13:41:04 +00:00
Gabor Horvath 44583ce65a [analyzer] Model base to derived casts more precisely.
Dynamic casts are handled relatively well by the static analyzer.
BaseToDerived casts however are treated conservatively. This can cause some
false positives with the NewDeleteLeaks checker.

This patch alters the behavior of BaseToDerived casts. In case a dynamic cast
would succeed use the same semantics. Otherwise fall back to the conservative
approach.

Differential Revision: https://reviews.llvm.org/D23014

llvm-svn: 277989
2016-08-08 09:22:59 +00:00
Artem Dergachev 7a0088bbae [analyzer] Make CloneDetector recognize different variable patterns.
CloneDetector should be able to detect clones with renamed variables.
However, if variables are referenced multiple times around the code sample,
the usage patterns need to be recognized.

For example, (x < y ? y : x) and (y < x ? y : x) are no longer clones,
however (a < b ? b : a) is still a clone of the former.

Variable patterns are computed and compared during a separate filtering pass.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D22982

llvm-svn: 277757
2016-08-04 19:37:00 +00:00
Artem Dergachev 7a7004a999 [analyzer] Hotfix for buildbot failure due to unspecified triple in r277449
If a target triple is not specified, the default host triple is used,
which is not good for compiling inline assembler code.

Patch by Raphael Isemann!

llvm-svn: 277473
2016-08-02 15:16:06 +00:00
Artem Dergachev 78692ea590 [analyzer] Respect statement-specific data in CloneDetection.
So far the CloneDetector only respected the kind of each statement when
searching for clones. This patch refines the way the CloneDetector collects data
from each statement by providing methods for each statement kind,
that will read the kind-specific attributes.

For example, statements 'a < b' and 'a > b' are no longer considered to be
clones, because they are different in operation code, which is an attribute
specific to the BinaryOperator statement kind.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D22514

llvm-svn: 277449
2016-08-02 12:21:09 +00:00
Artem Dergachev ba816326f3 [analyzer] Add basic capabilities to detect source code clones.
This patch adds the CloneDetector class which allows searching source code
for clones.

For every statement or group of statements within a compound statement,
CloneDetector computes a hash value, and finds clones by detecting
identical hash values.

This initial patch only provides a simple hashing mechanism
that hashes the kind of each sub-statement.

This patch also adds CloneChecker - a simple static analyzer checker
that uses CloneDetector to report copy-pasted code.

Patch by Raphael Isemann!

Differential Revision: https://reviews.llvm.org/D20795

llvm-svn: 276782
2016-07-26 18:13:12 +00:00
Devin Coughlin f57f90dfd1 [analyzer] Add checker modeling potential C++ self-assignment
This checker checks copy and move assignment operators whether they are
protected against self-assignment. Since C++ core guidelines discourages
explicit checking for `&rhs==this` in general we take a different approach: in
top-frame analysis we branch the exploded graph for two cases, where &rhs==this
and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the
work. It is important that we check all copy and move assignment operator in top
frame even if we checked them already since self-assignments may happen
undetected even in the same translation unit (e.g. using random indices for an
array what may or may not be the same).

This reapplies r275820 after fixing a string-lifetime issue discovered by the
bots.

A patch by Ádám Balogh!

Differential Revision: https://reviews.llvm.org/D19311

llvm-svn: 276365
2016-07-21 23:42:31 +00:00
Devin Coughlin d2387432bb Revert "[analyzer] Add checker modeling potential C++ self-assignment"
This reverts commit r275820. It is failing on the bots.

llvm-svn: 275880
2016-07-18 18:57:50 +00:00
Devin Coughlin eea0737a34 [analyzer] Add checker modeling potential C++ self-assignment
This checker checks copy and move assignment operators whether they are
protected against self-assignment. Since C++ core guidelines discourages
explicit checking for `&rhs==this` in general we take a different approach: in
top-frame analysis we branch the exploded graph for two cases, where &rhs==this
and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the
work. It is important that we check all copy and move assignment operator in top
frame even if we checked them already since self-assignments may happen
undetected even in the same translation unit (e.g. using random indices for an
array what may or may not be the same).

A patch by Ádám Balogh!

Differential Revision: https://reviews.llvm.org/D19311

llvm-svn: 275820
2016-07-18 17:23:30 +00:00
Devin Coughlin cad622742e [analyzer] Add rudimentary handling of AtomicExpr.
This proposed patch adds crude handling of atomics to the static analyzer.
Rather than ignore AtomicExprs, as we now do, this patch causes the analyzer
to escape the arguments. This is imprecise -- and we should model the
expressions fully in the future -- but it is less wrong than ignoring their
effects altogether.

This is rdar://problem/25353187

Differential Revision: http://reviews.llvm.org/D21667

llvm-svn: 274816
2016-07-08 00:53:18 +00:00
Devin Coughlin 0a53fdf00c [analyzer] Suppress false positives in std::shared_ptr
The analyzer does not model C++ temporary destructors completely and so
reports false alarms about leaks of memory allocated by the internals of
shared_ptr:

  std::shared_ptr<int> p(new int(1));
  p = nullptr; // 'Potential leak of memory pointed to by field __cntrl_'

This patch suppresses all diagnostics where the end of the path is inside
a method in std::shared_ptr.

It also reorganizes the tests for suppressions in the C++ standard library
to use a separate simulated header for library functions with bugs
that were deliberately inserted to test suppression. This will prevent
other tests from using these as models.

rdar://problem/23652766

llvm-svn: 274691
2016-07-06 21:52:55 +00:00
Stephan Bergmann bf95fff9bd DeadStoresChecker: Don't warn about dead stores into volatile variables
llvm-svn: 273689
2016-06-24 16:26:43 +00:00
Devin Coughlin 9d5057cce5 [analyzer] Teach ObjCDeallocChecker about XCTestCase
Like with SenTestCase, subclasses of XCTestCase follow a "tear down" idiom to
release instance variables and so typically do not release ivars in -dealloc.
This commit applies the existing special casing for SenTestCase to XCTestCase
as well.

rdar://problem/25884696

llvm-svn: 273441
2016-06-22 17:03:10 +00:00
Devin Coughlin 803ee03117 [analyzer] Teach trackNullOrUndefValue() about class property accessors.
Teach trackNullOrUndefValue() how to properly look through PseudoObjectExprs
to find the underlying semantic method call for property getters. This fixes a
crash when looking through class property getters that I introduced in r265839.

rdar://problem/26796666

llvm-svn: 273340
2016-06-22 00:20:00 +00:00
Devin Coughlin 160f19cdda [analyzer] Add checker to verify the correct usage of the MPI API
This commit adds a static analysis checker to verify the correct usage of the MPI API in C
and C++. This version updates the reverted r271981 to fix a memory corruption found by the
ASan bots.

Three path-sensitive checks are included:
- Double nonblocking: Double request usage by nonblocking calls without intermediate wait
- Missing wait: Nonblocking call without matching wait.
- Unmatched wait: Waiting for a request that was never used by a nonblocking call

Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker

A patch by Alexander Droste!

Reviewers: zaks.anna, dcoughlin

Differential Revision: http://reviews.llvm.org/D21081

llvm-svn: 272529
2016-06-13 03:22:41 +00:00
Devin Coughlin fd6d0821eb Revert "[analyzer] Reapply r271907 (2nd try)."
Even with the fix in r271981, ASan is finding a stack use after return.

This reverts commits r271977 and r271981.

llvm-svn: 271984
2016-06-07 05:37:02 +00:00
Devin Coughlin cc1fb35705 [analyzer] Reapply r271907 (2nd try).
Second try at reapplying
"[analyzer] Add checker for correct usage of MPI API in C and C++."

Special thanks to Dan Liew for helping test the fix for the template
specialization compiler error with gcc.

The original patch is by Alexander Droste!

Differential Revision: http://reviews.llvm.org/D12761

llvm-svn: 271977
2016-06-07 04:23:08 +00:00
Devin Coughlin 917a42d8b5 Revert "Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++.""
This reverts commit r271914. It is still breaking bots.

llvm-svn: 271920
2016-06-06 18:29:43 +00:00
Devin Coughlin 8027409be4 Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++."
Reapply r271907 with a fix for the compiler error with gcc about specializing
clang::ento::ProgramStateTrait in a different namespace.

Differential Revision: http://reviews.llvm.org/D12761

llvm-svn: 271914
2016-06-06 18:08:35 +00:00
Devin Coughlin cc73e62ebe Revert "[analyzer] Add checker for correct usage of MPI API in C and C++."
This reverts commit r271907. It broke a bunch of bots with compile errors
about specializations in different namespaces.

llvm-svn: 271909
2016-06-06 17:01:08 +00:00
Devin Coughlin 83ccd1a994 [analyzer] Add checker for correct usage of MPI API in C and C++.
This commit adds a static analysis checker to check for the correct usage of the
MPI API in C and C++.

3 path-sensitive checks are included:

- Double nonblocking: Double request usage by nonblocking calls
  without intermediate wait.
- Missing wait: Nonblocking call without matching wait.
- Unmatched wait: Waiting for a request that was never used by a
  nonblocking call.

Examples of how to use the checker can be found
at https://github.com/0ax1/MPI-Checker

Reviewers: zaks.anna

A patch by Alexander Droste!

Differential Revision: http://reviews.llvm.org/D12761

llvm-svn: 271907
2016-06-06 16:47:16 +00:00
Sean Eveson c24501dd13 [Analyzer] Correct stack address escape diagnostic
Summary:
Leaking a stack address via a static variable refers to it in the diagnostic as a 'global'. This patch corrects the diagnostic for static variables.


Patch by Phil Camp, SN Systems

Reviewers: dcoughlin, zaks.anna

Subscribers: xazax.hun, cfe-commits

Differential Revision: http://reviews.llvm.org/D19866

Patch by Phil Camp

llvm-svn: 270849
2016-05-26 14:02:17 +00:00
Anton Yartsev 8a88b90817 [analyzer] Fix for PR23790 : constrain return value of strcmp() rather than returning a concrete value.
The function strcmp() can return any value, not just {-1,0,1} : "The strcmp(const char *s1, const char *s2) function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by s1 is greater than, equal to, or less than the string pointed to by s2." [C11 7.24.4.2p3]
https://llvm.org/bugs/show_bug.cgi?id=23790
http://reviews.llvm.org/D16317

llvm-svn: 270154
2016-05-19 23:03:49 +00:00
Richard Smith 301bc21fd0 Make Sema::getPrintingPolicy less ridiculously expensive. This used to perform
an identifier table lookup, *and* copy the LangOptions (including various
std::vector<std::string>s). Twice. We call this function once each time we start
parsing a declaration specifier sequence, and once for each call to Sema::Diag.

This reduces the compile time for a sample .c file from the linux kernel by 20%.

llvm-svn: 270009
2016-05-19 01:39:10 +00:00
Devin Coughlin c1bfafd309 [analyzer] Fix crash in ObjCGenericsChecker
Fix a crash in the generics checker where DynamicTypePropagation tries
to get the superclass of a root class.

This is a spot-fix for a deeper issue where the checker makes assumptions
that may not hold about subtyping between the symbolically-tracked type of
a value and the compile-time types of a cast on that value.

I've added a TODO to address the underlying issue.

rdar://problem/26086914

llvm-svn: 269227
2016-05-11 20:28:41 +00:00
Devin Coughlin 3d066e13d7 [analyzer] Add tests for Objective-C class properties
Add basic tests to ensure the analyzer has support for class properties. This
is a test-only change.

rdar://problem/25256807

llvm-svn: 268773
2016-05-06 18:24:50 +00:00
Devin Coughlin 97dc0c8c29 [analyzer] Add path note for localizability checker.
Add a path note indicating the location of the non-localized string
literal in NonLocalizedStringChecker.

rdar://problem/25981525

llvm-svn: 267924
2016-04-28 19:44:40 +00:00
Artem Dergachev 70247e69b1 [analyzer] Let TK_PreserveContents span across the whole base region.
If an address of a field is passed through a const pointer,
the whole structure's base region should receive the
TK_PreserveContents trait and avoid invalidation.

Additionally, include a few FIXME tests shown up during testing.

Differential Revision: http://reviews.llvm.org/D19057

llvm-svn: 267413
2016-04-25 14:44:25 +00:00
Devin Coughlin 4ac12425ba [analyzer] Nullability: Suppress diagnostic on bind with cast.
Update the nullability checker to allow an explicit cast to nonnull to
suppress a warning on an assignment of nil to a nonnull:

id _Nonnull x = (id _Nonnull)nil; // no-warning

This suppression as already possible for diagnostics on returns and
function/method arguments.

rdar://problem/25381178

llvm-svn: 266219
2016-04-13 17:59:24 +00:00
Devin Coughlin b2d2a018d6 [analyzer] Nullability: Treat nil _Nonnull ivar as invariant violation.
Treat a _Nonnull ivar that is nil as an invariant violation in a similar
fashion to how a nil _Nonnull parameter is treated as a precondition violation.

This avoids warning on defensive returns of nil on defensive internal
checks, such as the following common idiom:

@class InternalImplementation
@interface PublicClass {
  InternalImplementation * _Nonnull _internal;
}
-(id _Nonnull)foo;
@end

@implementation PublicClass
-(id _Nonnull)foo {
  if (!_internal)
    return nil; // no-warning

  return [_internal foo];
}
@end

rdar://problem/24485171

llvm-svn: 266157
2016-04-13 00:41:54 +00:00
Devin Coughlin 49bd58f1eb [analyzer] Nullability: Suppress return diagnostics in inlined functions.
The nullability checker can sometimes miss detecting nullability precondition
violations in inlined functions because the binding for the parameter
that violated the precondition becomes dead before the return:

int * _Nonnull callee(int * _Nonnull p2) {
  if (!p2)
    // p2 becomes dead here, so binding removed.
    return 0; // warning here because value stored in p2 is symbolic.
  else
   return p2;
}

int *caller(int * _Nonnull p1) {
  return callee(p1);
}

The fix, which is quite blunt, is to not warn about null returns in inlined
methods/functions. This won’t lose much coverage for ObjC because the analyzer
always analyzes each ObjC method at the top level in addition to inlined. It
*will* lose coverage for C — but there aren’t that many codebases with C
nullability annotations.

rdar://problem/25615050

llvm-svn: 266109
2016-04-12 19:29:52 +00:00
Devin Coughlin b40d14f3d5 [analyzer] Fix assertion in ReturnVisitor for body-farm synthesized getters
Don't emit a path note marking the return site if the return statement does not
have a valid location. This fixes an assertion failure I introduced in r265839.

llvm-svn: 266031
2016-04-12 00:53:26 +00:00
Devin Coughlin ebaa56bb26 [analyzer] Teach trackNullOrUndefValue about calls to property accessors.
Teach trackNullOrUndefValue() how to look through PseudoObjectExprs to find
the underlying method call for property getters. This makes over-suppression
of 'return nil' in getters consistent with the similar over-suppression for
method and function calls.

rdar://problem/24437252

llvm-svn: 265839
2016-04-08 19:59:16 +00:00
Devin Coughlin c239dd1349 [analyzer] Prefer accessor method in extension over category in CallEvent.
In ObjCMethodCall:getRuntimeDefinition(), if the method is an accessor in a
category, and it doesn't have a self declaration, first try to find the method
in a class extension. This works around a bug in Sema where multiple accessors
are synthesized for properties in class extensions that are redeclared in a
category. The implicit parameters are not filled in for the method on the
category, which causes a crash when trying to synthesize a getter for the
property in BodyFarm. The Sema bug is tracked as rdar://problem/25481164.

rdar://problem/25056531

llvm-svn: 265103
2016-04-01 03:24:13 +00:00
Devin Coughlin 7646ebe6f9 [analyzer] Use BodyFarm-synthesized body even when actual body available.
Change body autosynthesis to use the BodyFarm-synthesized body even when
an actual body exists. This enables the analyzer to use the simpler,
analyzer-provided body to model the behavior of the function rather than trying
to understand the actual body. Further, this makes the analyzer robust against
changes in headers that expose the implementations of those bodies.

rdar://problem/25145950

llvm-svn: 264687
2016-03-28 23:55:58 +00:00
Devin Coughlin 77942db0b8 [analyzer] Nullability: Don't warn along paths where null returned from non-null.
Change the nullability checker to not warn along paths where null is returned from
a method with a non-null return type, even when the diagnostic for this return
has been suppressed. This prevents warning from methods with non-null return types
that inline methods that themselves return nil but that suppressed the diagnostic.

Also change the PreconditionViolated state component to be called "InvariantViolated"
because it is set when a post-condition is violated, as well.

rdar://problem/25393539

llvm-svn: 264647
2016-03-28 20:30:25 +00:00
Devin Coughlin b8076292ab [analyzer] Add CIFIlter modeling to DeallocChecker.
The -dealloc method in CIFilter is highly unusual in that it will release
instance variables belonging to its *subclasses* if the variable name
starts with "input" or backs a property whose name starts with "input".
Subclasses should not release these ivars in their own -dealloc method --
doing so could result in an over release.

Before this commit, the DeallocChecker would warn about missing releases for
such "input" properties -- which could cause users of the analyzer to add
over releases to silence the warning.

To avoid this, DeallocChecker now treats CIFilter "input-prefixed" ivars
as MustNotReleaseDirectly and so will not require a release. Further, it
will now warn when such an ivar is directly released in -dealloc.

rdar://problem/25364901

llvm-svn: 264463
2016-03-25 21:18:22 +00:00
Anna Zaks 30d4668774 [analyzer] Fix missed leak from MSVC specific allocation functions
Add the wide character strdup variants (wcsdup, _wcsdup) and the MSVC
version of alloca (_alloca) and other differently named function used
by the Malloc checker.

A patch by Alexander Riccio!

Differential Revision: http://reviews.llvm.org/D17688

llvm-svn: 262894
2016-03-08 01:21:51 +00:00
Richard Smith 4f902c7ecc P0188R1: add support for standard [[fallthrough]] attribute. This is almost
exactly the same as clang's existing [[clang::fallthrough]] attribute, which
has been updated to have the same semantics. The one significant difference
is that [[fallthrough]] is ill-formed if it's not used immediately before a
switch label (even when -Wimplicit-fallthrough is disabled). To support that,
we now build a CFG of any function that uses a '[[fallthrough]];' statement
to check.

In passing, fix some bugs with our support for statement attributes -- in
particular, diagnose their use on declarations, rather than asserting.

llvm-svn: 262881
2016-03-08 00:32:55 +00:00
Devin Coughlin a1d9d75a88 [analyzer] Nullability: add option to not report on calls to system headers.
Add an -analyzer-config 'nullability:NoDiagnoseCallsToSystemHeaders' option to
the nullability checker. When enabled, this option causes the analyzer to not
report about passing null/nullable values to functions and methods declared
in system headers.

This option is motivated by the observation that large projects may have many
nullability warnings. These projects may find warnings about nullability
annotations that they have explicitly added themselves higher priority to fix
than warnings on calls to system libraries.

llvm-svn: 262763
2016-03-05 01:32:43 +00:00
Devin Coughlin a604679897 [analyzer] Add diagnostic in ObjCDeallocChecker for use of -dealloc instead of -release.
In dealloc methods, the analyzer now warns when -dealloc is called directly on
a synthesized retain/copy ivar instead of -release. This is intended to find mistakes of
the form:

- (void)dealloc {
  [_ivar dealloc]; // Mistaken call to -dealloc instead of -release

  [super dealloc];
}

rdar://problem/16227989

llvm-svn: 262729
2016-03-04 18:09:58 +00:00
Devin Coughlin 578a20a82e [analyzer] ObjCDeallocChecker: Only check for nil-out when type is retainable.
This fixes a crash when setting a property of struct type in -dealloc.

llvm-svn: 262659
2016-03-03 21:38:39 +00:00
Devin Coughlin 2b2f8996ce [analyzer] Move ObjCSuperDeallocChecker out of the alpha package.
It will now be on by default on Darwin.

rdar://problem/6953275

llvm-svn: 262526
2016-03-02 22:01:03 +00:00
Devin Coughlin 2b77c4603d [analyzer] Move ObjCDeallocChecker out of the alpha package.
It will now be on by default on Darwin.

rdar://problem/6927496

llvm-svn: 262524
2016-03-02 21:50:54 +00:00
Devin Coughlin dce8d8b3f1 [analyzer] Fix capitalization in ObjCSuperDeallocChecker diagnostic.
llvm-svn: 262520
2016-03-02 21:22:48 +00:00
Devin Coughlin 6d0c8a036e [analyzer] Update CheckObjCDealloc diagnostic for missing -dealloc.
Update the diagnostic for classes missing -dealloc to mention an instance
variable that needs to be released.

llvm-svn: 262277
2016-03-01 00:39:04 +00:00
Devin Coughlin 093594938b [analyzer] Teach CheckObjCDealloc about Block_release().
It now treats Block_release(b) as a release in addition to [b release].

llvm-svn: 262272
2016-02-29 23:57:10 +00:00
Devin Coughlin 3fc67e47e5 [analyzer] Don't treat calls to system headers as escaping in CheckObjCDealloc.
This prevents false negatives when a -dealloc method, for example, removes itself as
as an observer with [[NSNotificationCenter defaultCenter] removeObserver:self]. It is
unlikely that passing 'self' to a system header method will release 'self''s instance
variables, so this is unlikely to produce false positives.

A challenge here is that while CheckObjCDealloc no longer treats these calls as
escaping, the rest of the analyzer still does. In particular, this means that loads
from the same instance variable before and after a call to a system header will
result in different symbols being loaded by the region store. To account for this,
the checker now treats different ivar symbols with the same instance and ivar decl as
the same for the purpose of release checking and more eagerly removes a release
requirement when an instance variable is assumed to be nil. This was not needed before
because when an ivar escaped its release requirement was always removed -- now the
requirement is not removed for calls to system headers.

llvm-svn: 262261
2016-02-29 21:44:08 +00:00
Devin Coughlin 896dffe752 [analyzer] Shorten ObjcSuperDeallocChecker diagnostics.
Change "use of 'self' after it has been freed with call to [super dealloc]" to
"use of 'self' after it has been deallocated" and "use of instance variable
'_ivar' after the instance has been freed with call to [super dealloc]" to
"use of instance variable '_ivar' after 'self' has been deallocated".

llvm-svn: 261945
2016-02-26 00:47:42 +00:00
Devin Coughlin 591991c86f [analyzer] Warn on use of 'self' after call to to [super dealloc].
Referring to 'self' after a call to [super dealloc] is a use-after-free in
Objective-C because NSObject's -dealloc frees the memory pointed to by self.
This patch extends the ObjCSuperDeallocChecker to catch this error.

rdar://problem/6953275

Differential Revision: http://reviews.llvm.org/D17528

llvm-svn: 261935
2016-02-25 23:36:52 +00:00
Devin Coughlin ad9f53e959 [analyzer] Reapply r261917 with a fix.
This reapplies "[analyzer] Make ObjCDeallocChecker path sensitive." (r261917)
with a fix for an error on some bots about specializing a template
from another namespace.

llvm-svn: 261929
2016-02-25 21:15:16 +00:00
Devin Coughlin ea02bba5a1 Revert "[analyzer] Make ObjCDeallocChecker path sensitive."
This reverts commit r261917. It broke the bots.

llvm-svn: 261921
2016-02-25 19:13:43 +00:00
Devin Coughlin 88691c1fcb [analyzer] Make ObjCDeallocChecker path sensitive.
Convert the ObjCDeallocChecker to be path sensitive. The primary
motivation for this change is to prevent false positives when -dealloc calls
helper invalidation methods to release instance variables, but it additionally
improves precision when -dealloc contains control flow. It also reduces the need
for pattern matching. The check for missing -dealloc methods remains AST-based.

Part of rdar://problem/6927496

Differential Revision: http://reviews.llvm.org/D17511

llvm-svn: 261917
2016-02-25 18:55:24 +00:00
Devin Coughlin c289b74bd6 [analyzer] Find ObjC 'self' decl even when block captures local named 'self'.
When looking up the 'self' decl in block captures, make sure to find the actual
self declaration even when the block captures a local variable named 'self'.

rdar://problem/24751280

llvm-svn: 261703
2016-02-23 22:26:04 +00:00
Gabor Horvath d1abcf799e [analyzer] Improve pointer arithmetic checker.
This patch is intended to improve pointer arithmetic checker.
From now on it only warns when the pointer arithmetic is likely to cause an
error. For example when the pointer points to a single object, or an array of
derived types.

Differential Revision: http://reviews.llvm.org/D14203

llvm-svn: 261632
2016-02-23 12:34:39 +00:00
Devin Coughlin eb6673cfed [analyzer] Detect duplicate [super dealloc] calls
Add an alpha path checker that warns about duplicate calls to [super dealloc].
This will form the foundation of a checker that will detect uses of
'self' after calling [super dealloc].

Part of rdar://problem/6953275.

Based on a patch by David Kilzer!

Differential Revision: http://reviews.llvm.org/D5238

llvm-svn: 261545
2016-02-22 17:56:24 +00:00
Devin Coughlin 8d922aa746 [analyzer] Add checker callback for beginning of function.
Add a checker callback that is called when the analyzer starts analyzing a
function either at the top level or when inlined. This will be used by a
follow-on patch making the DeallocChecker path sensitive.

Differential Revision: http://reviews.llvm.org/D17418

llvm-svn: 261293
2016-02-19 01:35:10 +00:00
Devin Coughlin 069a1073dd [analyzer] Improve modeling of ObjC synthesized property setters.
When modeling a call to a setter for a property that is synthesized to be
backed by an instance variable, don't invalidate the entire instance
but rather only the storage for the updated instance variable itself.

This still doesn't model the effect of the setter completely. It doesn't
bind the set value to the ivar storage location because doing so would cause
the set value to escape, removing valuable diagnostics about potential
leaks of the value from the retain count checker.

llvm-svn: 261243
2016-02-18 19:13:30 +00:00
Devin Coughlin 982c42da64 [analyzer] Improve pattern matching in ObjCDealloc checker.
Look through PseudoObjectExpr and OpaqueValueExprs when scanning for
release-like operations. This commit also adds additional tests in anticipation
of re-writing this as a path-sensitive checker.

llvm-svn: 260608
2016-02-11 22:13:20 +00:00
Devin Coughlin 480a0c00ca [analyzer] Avoid crash when attempting to evaluate binary operation on LazyCompoundVal.
Instead, return UnknownValue if either operand is a nonloc::LazyCompoundVal. This is a
spot fix for PR 24951.

rdar://problem/23682244

llvm-svn: 260066
2016-02-08 00:28:24 +00:00
Devin Coughlin 9165df129e [analyzer] Invalidate destination of std::copy() and std::copy_backward().
Now that the libcpp implementations of these methods has a branch that doesn't call
memmove(), the analyzer needs to invalidate the destination for these methods explicitly.

rdar://problem/23575656

llvm-svn: 260043
2016-02-07 16:55:44 +00:00
Devin Coughlin 38e0e2970c [analyzer] DeallocChecker: Don't warn on release of readonly assign property in dealloc.
It is common for the ivars for read-only assign properties to always be stored retained,
so don't warn for a release in dealloc for the ivar backing these properties.

llvm-svn: 259998
2016-02-06 17:17:32 +00:00
Devin Coughlin 084e363517 [analyzer] Suppress localization diagnostics in debug classes and methods.
If the class or method name case-insensitively contains the term "debug",
suppress warnings about string constants flowing to user-facing UI APIs.

llvm-svn: 259875
2016-02-05 04:22:15 +00:00
Yury Gribov 0826bf2211 Forgot to remove file in previous commit.
llvm-svn: 259647
2016-02-03 13:36:31 +00:00
Yury Gribov 8f7d8b6c32 [analyzer] AnalysisConsumer: print fully-qualified function name while displaying progress
-analyzer-display progress option prints only function names which may be ambiguous. This patch forces AnalysisConsumer to print fully-qualified function names.
Patch by Alex Sidorin!

Differential Revision: http://reviews.llvm.org/D16804

llvm-svn: 259646
2016-02-03 13:35:33 +00:00
Artem Dergachev f8d0f18fac [analyzer] Use a wider integer type for an array index.
Avoids unexpected overflows while performing pointer arithmetics in 64-bit code.
Moreover, neither PointerDiffType nor 'int' can be used as a common array index
type because arrays may have size (and indexes) more than PTRDIFF_MAX but less
than SIZE_MAX.

Patch by Aleksei Sidorin!

Differential Revision: http://reviews.llvm.org/D16063

llvm-svn: 259345
2016-02-01 09:29:17 +00:00
Devin Coughlin 4be27d4db9 [analyzer] Make suppression of macro defensive checks work with -analyzer-eagerly-assume.
This is the default for the analyzer but the flag is added by the driver so
our suppression tests didn't cover this case.

llvm-svn: 259288
2016-01-30 01:59:33 +00:00
Devin Coughlin 07c451fa4a [analyzer] Suppress null reports from defensive checks in function-like macros.
We already do this for case splits introduced as a result of defensive null
checks in functions and methods, so do the same for function-like macros.

rdar://problem/19640441

llvm-svn: 259222
2016-01-29 18:47:13 +00:00
Anna Zaks ad9e7ea6d7 [analyzer] Improve Nullability checker diagnostics
- Include the position of the argument on which the nullability is violated
- Differentiate between a 'method' and a 'function' in the message wording
- Test for the error message text in the tests
- Fix a bug with setting 'IsDirectDereference' which resulted in regular dereferences assumed to have call context.

llvm-svn: 259221
2016-01-29 18:43:15 +00:00
Devin Coughlin de21767a4d [analyzer] Suppress nullability warnings in copy, mutableCopy, and init families.
There are multiple, common idioms of defensive nil-checks in copy,
mutableCopy, and init methods in ObjC. The analyzer doesn't currently have the
capability to distinguish these idioms from true positives, so suppress all
warnings about returns in those families. This is a pretty blunt suppression
that we should improve later.

rdar://problem/24395811

llvm-svn: 259099
2016-01-28 22:23:34 +00:00
Devin Coughlin 3075134739 [analyzer] ObjCDeallocChecker: Only operate on classes with retained properties.
Previously the ObjC Dealloc Checker only checked classes with ivars, not
retained properties, which caused three bugs:

- False positive warnings about a missing -dealloc method in classes with only
ivars.
- Missing warnings about a missing -dealloc method on classes with only
properties.
- Missing warnings about an over-released or under-released ivar associated with
a retained property in classes with only properties.

The fix is to check only classes with at least one retained synthesized
property.

This also exposed a bug when reporting an over-released or under-released
property that did not contain a synthesize statement. The checker tried to
associate the warning with an @synthesize statement that did not exist, which
caused an assertion failure in debug builds. The fix is to fall back to the
@property statement in this case.

A patch by David Kilzer!

Part of rdar://problem/6927496

Differential Revision: http://reviews.llvm.org/D5023

llvm-svn: 258896
2016-01-27 01:41:58 +00:00
Devin Coughlin b7e810bdc1 [analyzer] Body farm: Look for property ivar in shadowing readwrite property.
After r251874, readonly properties that are shadowed by a readwrite property
in a class extension no longer have an instance variable, which caused the body
farm to not synthesize getters. Now, if a readonly property does not have an
instance variable look for a shadowing property and try to get the instance
variable from there.

rdar://problem/24060091

llvm-svn: 258886
2016-01-26 23:58:48 +00:00
Devin Coughlin 4a330201ff [analyzer] Suppress nullability warning for defensive super initializer idiom.
A common idiom in Objective-C initializers is for a defensive nil-check on the
result of a call to a super initializer:
  if (self = [super init]) {
     ...
  }
  return self;

To avoid warning on this idiom, the nullability checker now suppress diagnostics
for returns of nil on syntactic 'return self' even in initializers with non-null
return types.

llvm-svn: 258461
2016-01-22 01:01:11 +00:00
Devin Coughlin 5a3843e506 [analyzer] Nullability: Look through implicit casts when suppressing warnings on return.
In r256567 I changed the nullability checker to suppress warnings about returning a null
value from a function/method with a non-null return type when the type of the returned
expression is itself nonnull. This enables the programmer to silence nullability warnings
by casting to _Nonnull:

  return (SomeObject * _Nonnull)nil;

Unfortunately, under ObjC automated reference counting, Sema adds implicit casts to
_Nonnull to return expressions of nullable or unspecified types in functions with
non-null function/method return types. With r256567, these casts cause all nullability
warnings for returns of reference-counted types to be suppressed under ARC, leading to
false negatives.

This commit updates the nullability checker to look through implicit casts before
determining the type of the returned expression. It also updates the tests to turn on
ARC for the nullability_nullonly.mm testfile and adds a new testfile to test when ARC
is turned off.

rdar://problem/24200117

llvm-svn: 258061
2016-01-18 18:53:33 +00:00
Artem Dergachev 91c45e8f46 [analyzer] Fix an off-by-one in evalIntegralCast()
Make sure that we do not add SymbolCast at the very boundary of
the range in which the cast would not certainly happen.

Differential Revision: http://reviews.llvm.org/D16178

llvm-svn: 258039
2016-01-18 10:17:16 +00:00
Devin Coughlin 851da71c8f [analyzer] Check for return of nil in ObjC methods with nonnull return type.
Update NullabilityChecker so that it checks return statements in ObjC methods.
Previously it was returning early because methods do not have a function type.

Also update detection of violated parameter _Nonnull preconditions to handle
ObjC methods.

rdar://problem/24200560

llvm-svn: 257938
2016-01-15 21:35:40 +00:00
Artem Dergachev 895242f9fb [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion, v2.
Provide separate visitor templates for the three hierarchies, and also
the `FullSValVisitor' class, which is a union of all three visitors.

Additionally, add a particular example visitor, `SValExplainer', in order to
test the visitor templates. This visitor is capable of explaining the SVal,
SymExpr, or MemRegion in a natural language.

Compared to the reverted r257605, this fixes the test that used to fail
on some triples, and fixes build failure under -fmodules.

Differential Revision: http://reviews.llvm.org/D15448

llvm-svn: 257893
2016-01-15 15:22:05 +00:00
Artem Dergachev 26ec8acc84 Revert "[analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion."
This reverts commit r257605.

The test fails on architectures that use unsigned int as size_t.
SymbolManager.h fails with compile errors on some platforms.

llvm-svn: 257608
2016-01-13 15:52:25 +00:00
Artem Dergachev beb02b5b8f [analyzer] Provide .def-files and visitors for SVal/SymExpr/MemRegion.
Provide separate visitor templates for the three hierarchies, and also
the `FullSValVisitor' class, which is a union of all three visitors.

Additionally, add a particular example visitor, `SValExplainer', in order to
test the visitor templates. This visitor is capable of explaining the SVal,
SymExpr, or MemRegion in a natural language.

Differential Revision: http://reviews.llvm.org/D15448

llvm-svn: 257605
2016-01-13 15:13:48 +00:00
Pierre Gousseau bdd9da14d6 [analyzer] Fix RangeConstraintManager's pinning of single value ranges.
This fix a bug in RangeSet::pin causing single value ranges to be considered non conventionally ordered.

Differential Revision: http://reviews.llvm.org/D12901

llvm-svn: 257467
2016-01-12 10:40:45 +00:00
Pierre Gousseau e961b445ad [analyzer] Evaluate integral casts as cast symbols if truncations are detected.
The current workaround for truncations not being modelled is that the evaluation of integer to integer casts are simply bypassed and so the original symbol is used as the new casted symbol (cf SimpleSValBuilder::evalCastFromNonLoc).
This lead to the issue described in PR25078, as the RangeConstraintManager associates ranges with symbols.

The new evalIntegralCast method added by this patch wont bypass the cast if it finds the range of the symbol to be greater than the maximum value of the target type.

The fix to RangeSet::pin mentioned in the initial review will be committed separately.

Differential Revision: http://reviews.llvm.org/D12901

llvm-svn: 257464
2016-01-12 10:07:56 +00:00
Yury Gribov 054873b0be AnalysisConsumer: use canonical decl for both lookup and store of
visited decls.

Due to redeclarations, the function may have different declarations used
in CallExpr and in the definition. However, we need to use a unique
declaration for both store and lookup in VisitedCallees. This patch
fixes issues with analysis in topological order. A simple test is
included.

Patch by Alex Sidorin!

Differential Revision: http://reviews.llvm.org/D15410

llvm-svn: 257318
2016-01-11 09:38:48 +00:00
Anna Zaks 03f483353c [analyzer] Fix false warning about memory leak for QApplication::postEvent
According to Qt documentation Qt takes care of memory allocated for QEvent:
http://doc.qt.io/qt-4.8/qcoreapplication.html#postEvent

A patch by Evgeniy Dushistov!

Differential Revision: http://reviews.llvm.org/D14170

llvm-svn: 256887
2016-01-06 00:32:56 +00:00
Anna Zaks ac4c8a639c [analyzer] Suppress reports coming from std::__independent_bits_engine
The analyzer reports a shift by a negative value in the constructor. The bug can
be easily triggered by calling std::random_shuffle on a vector
(<rdar://problem/19658126>).

(The shift by a negative value is reported because __w0_ gets constrained to
63 by the conditions along the path:__w0_ < _WDt && __w0_ >= _WDt-1,
where _WDt is 64. In normal execution, __w0_ is not 63, it is 1 and there is
no overflow. The path is infeasible, but the analyzer does not know about that.)

llvm-svn: 256886
2016-01-06 00:32:52 +00:00
Anna Zaks c9f16fe48c [analyzer] Don't report null dereferences on address_space annotated memory
llvm-svn: 256885
2016-01-06 00:32:49 +00:00
Devin Coughlin 3369867aa7 [analyzer] Handle another Android assert function.
Android's assert can call both the __assert and __assert2 functions under the cover, but
the NoReturnFunctionChecker does not handle the latter. This commit fixes that.

A patch by Yury Gribov!

Differential Revision: http://reviews.llvm.org/D15810

llvm-svn: 256605
2015-12-30 00:08:59 +00:00
Devin Coughlin 3ab8b2e7d4 [analyzer] Suppress nullability warning for _Nonnull locals zero-initialized by ObjC ARC.
Prevent the analyzer from warning when a _Nonnnull local variable is implicitly
zero-initialized because of Objective-C automated reference counting. This avoids false
positives in cases where a _Nonnull local variable cannot be initialized with an
initialization expression, such as:
  NSString * _Nonnull s; // no-warning
  @autoreleasepool {
    s = ...;
  }

The nullability checker will still warn when a _Nonnull local variable is explicitly
initialized with nil.

This suppression introduces the potential for false negatives if the local variable
is used before it is assigned a _Nonnull value. Based on a discussion with Anna Zaks,
Jordan Rose, and John McCall, I've added a FIXME to treat implicitly zero-initialized
_Nonnull locals as uninitialized in Sema's UninitializedValues analysis to avoid these
false negatives.

rdar://problem/23522311

llvm-svn: 256603
2015-12-29 23:44:19 +00:00
Devin Coughlin 755baa4050 [analyzer] Nullability: allow cast to _Nonnull to suppress warning about returning nil.
The nullability checker currently allows casts to suppress warnings when a nil
literal is passed as an argument to a parameter annotated as _Nonnull:

  foo((NSString * _Nonnull)nil); // no-warning

It does so by suppressing the diagnostic when the *type* of the argument expression
is _Nonnull -- even when the symbolic value returned is known to be nil.

This commit updates the nullability checker to similarly honor such casts in the analogous
scenario when nil is returned from a function with a _Nonnull return type:

  return (NSString * _Nonnull)nil; // no-warning

This commit also normalizes variable naming between the parameter and return cases and
adds several tests demonstrating the limitations of this suppression mechanism (such as
when nil is cast to _Nonnull and then stored into a local variable without a nullability
qualifier). These tests are marked with FIXMEs.

rdar://problem/23176782

llvm-svn: 256567
2015-12-29 17:40:49 +00:00
Devin Coughlin 412c0af2b8 [analyzer] Better detect when C++ object was constructed into existing region.
When the analyzer evaluates a CXXConstructExpr, it looks ahead in the CFG for
the current block to detect what region the object should be constructed into.
If the constructor was directly constructed into a local variable or field
region then there is no need to explicitly bind the constructed value to
the local or field when analyzing the DeclStmt or CXXCtorInitializer that
called the constructor.

Unfortunately, there were situations in which the CXXConstructExpr was
constructed into a temporary region but when evaluating the corresponding
DeclStmt or CXXCtorInitializer the analyzer assumed the object was constructed
into the local or field. This led to spurious warnings about uninitialized
values (PR25777).

To avoid these false positives, this commit factors out the logic for
determining when a CXXConstructExpr will be directly constructed into existing
storage, adds the inverse logic to detect when the corresponding later bind can
be safely skipped, and adds assertions to make sure these two checks are in
sync.

rdar://problem/21947725

llvm-svn: 255859
2015-12-17 00:28:33 +00:00
NAKAMURA Takumi b4a6884844 clang/test/Analysis/padding_c.c: Suppress a test incompatible to i686-linux.
error: 'warning' diagnostics expected but not seen:
    File clang/test/Analysis/padding_c.c Line 194 (directive at clang/test/Analysis/padding_c.c:193): Excessive padding in 'struct DefaultAttrAlign'
  1 error generated.

llvm-svn: 255636
2015-12-15 09:37:01 +00:00
Ben Craig 97c191c473 [PATCH] Adding checker to detect excess padding in records
The intent of this checker is to generate a report for any class / structure
that could reduce its padding by reordering the fields.  This results in a very
noisy checker.  To reduce the noise, this checker will currently only warn when
the number of bytes over "optimal" is more than 24.  This value is configurable
with -analyzer-config performance.Padding:AllowedPad=N.  Small values of
AllowedPad have the potential to generate hundreds of reports, and gigabytes
of HTML reports.

The checker searches for padding violations in two main ways.  First, it goes
record by record.  A report is generated if the fields could be reordered in a
way that reduces the padding by more than AllowedPad bytes.  Second, the
checker will generate a report if an array will cause more than AllowedPad
padding bytes to be generated.

The record checker currently skips many ABI specific cases.  Classes with base
classes are skipped because base class tail padding is ABI specific.  Bitfields
are just plain hard, and duplicating that code seems like a bad idea.  VLAs are
both uncommon and non-trivial to fix.

The array checker isn't very thorough right now.  It only checks to see if the
element type's fields could be reordered, and it doesn't recursively check to
see if any of the fields' fields could be reordered.  At some point in the
future, it would be nice if "arrays" could also look at array new usages and
malloc patterns that appear to be creating arrays.

llvm-svn: 255545
2015-12-14 21:38:59 +00:00
Artem Dergachev 733e71b73b [analyzer] Fix symbolic element index lifetime.
SymbolReaper was destroying the symbol too early when it was referenced only
from an index SVal of a live ElementRegion.

In order to test certain aspects of this patch, extend the debug.ExprInspection
checker to allow testing SymbolReaper in a direct manner.

Differential Revision: http://reviews.llvm.org/D12726

llvm-svn: 255236
2015-12-10 09:28:06 +00:00
Devin Coughlin 7bdca8b24f [analyzer] Fix crash when lambda captures a variable-length array.
When a C++ lambda captures a variable-length array, it creates a capture
field to store the size of the array. The initialization expression for this
capture is null, which led the analyzer to crash when initializing the field.
To avoid this, use the size expression from the VLA type to determine the
initialization value.

rdar://problem/23748072

llvm-svn: 254962
2015-12-07 23:01:53 +00:00
Devin Coughlin 46089867de [analyzer] Fix MemRegion crash casting non-struct to derived struct (PR25426).
This commit prevents MemRegion::getAsOffset() from crashing when the analyzed
program casts a symbolic region of a non-record type to some derived type and
then attempts to access a field of the base type.

rdar://problem/23458069

llvm-svn: 254806
2015-12-05 00:22:36 +00:00
Gabor Horvath e86cb2e822 [analyzer] Improve modelling of nullptr_t in the analyzer. Fix PR25414.
Differential Revision: http://reviews.llvm.org/D15007

llvm-svn: 254718
2015-12-04 15:02:30 +00:00
Devin Coughlin ebeed88078 [analyzer] Support inlining lambda-converted blocks.
clang converts C++ lambdas to blocks with an implicit user-defined conversion
operator method on the lambda record. This method returns a block that captures a copy
of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda
records's call operator method on the lambda captured by the block.

llvm-svn: 254702
2015-12-04 05:00:36 +00:00
Devin Coughlin dfde655461 [analyzer] Suppress stack address escape on CK_CopyAndAutoreleaseBlockObject.
Don't warn about addresses of stack-allocated blocks escaping if the block
region was cast with CK_CopyAndAutoreleaseBlockObject. These casts, which
are introduced in the implicit conversion operator for lambda-to-block
conversions, cause the block to be copied to the heap -- so the warning is
spurious.

llvm-svn: 254639
2015-12-03 19:41:24 +00:00
Gabor Horvath fe2c0ff942 [analyzer] Fix IssueHash generation.
Differential Revision: http://reviews.llvm.org/D14919 

Original patch by: Gyorgy Orban!

llvm-svn: 254394
2015-12-01 09:00:41 +00:00
Devin Coughlin 2c2c3cb3d0 [analyzer] Add tests for generalized lambda capture (C++14). NFC.
Add tests demonstrating that the analyzer supports generalized lambda capture. This
support falls out naturally from the work Gábor Horváth did adding C++11 lambdas to
the analyzer.

llvm-svn: 254114
2015-11-26 00:11:23 +00:00
Devin Coughlin b6029b7ef4 [analyzer] Include block capture copy expressions in the CFG.
This prevents spurious dead store warnings when a C++ lambda is casted to a block.

I've also added several tests documenting our still-incomplete support for lambda-to-block
casts.

rdar://problem/22236293

llvm-svn: 254107
2015-11-25 22:35:37 +00:00
Devin Coughlin c1986638a7 [analyzer] Pass value expression for inlined defensive checks when binding null to nonnull.
The nullability checker was not suppressing false positives resulting from
inlined defensive checks when null was bound to a nonnull variable because it
was passing the entire bind statement rather than the value expression to
trackNullOrUndefValue().

This commit changes that checker to synactically match on the bind statement to
extract the value expression so it can be passed to trackNullOrUndefValue().

rdar://problem/23575439

llvm-svn: 254007
2015-11-24 19:15:11 +00:00
Devin Coughlin c7315b3ebf [analyzer] DeadStoresChecker: Treat locals captured by reference in C++ lambdas as escaped.
The analyzer currently reports dead store false positives when a local variable
is captured by reference in a C++ lambda.

For example:

  int local = 0; auto lambda = [&local]() {
    local++;
  };
  local = 7; // False Positive: Value stored to 'local' is never read
  lambda();

In this case, the assignment setting `local` to 7 is not a dead store because
the called lambda will later read that assigned value.

This commit silences this source of false positives by treating locals captured
by reference in C++ lambdas as escaped, similarly to how the DeadStoresChecker
deals with locals whose address is taken.

rdar://problem/22165179

llvm-svn: 253630
2015-11-20 01:53:44 +00:00
Anna Zaks 61fcb521fa [analyzer] Improve modeling of static initializers.
Conversions between unrelated pointer types (e.g. char * and void *) involve
bitcasts which were not properly modeled in case of static initializers. The
patch fixes this problem.

The problem was originally spotted by Artem Dergachev. Patched by Yuri Gribov!

Differential Revision: http://reviews.llvm.org/D14652

llvm-svn: 253532
2015-11-19 01:25:28 +00:00
Devin Coughlin 6e644abd46 [analyzer] Skip checking blocks in dependent contexts.
Since we don't check functions in dependent contexts, we should skip blocks
in those contexts as well. This avoids an assertion failure when the
DeadStoresChecker attempts to evaluate an array subscript expression with
a dependent name type.

rdar://problem/23564220

llvm-svn: 253516
2015-11-18 22:46:52 +00:00
Devin Coughlin 1d4058322d [analyzer] Handle calling ObjC super method from inside C++ lambda.
When calling a ObjC method on super from inside a C++ lambda, look at the
captures to find "self". This mirrors how the analyzer handles calling super in
an ObjC block and fixes an assertion failure.

rdar://problem/23550077

llvm-svn: 253176
2015-11-15 17:48:22 +00:00
Devin Coughlin e69b043088 [analyzer] Refer to capture field to determine if capture is reference.
The analyzer incorrectly treats captures as references if either the original
captured variable is a reference or the variable is captured by reference.
This causes the analyzer to crash when capturing a reference type by copy
(PR24914). Fix this by refering solely to the capture field to determine when a
DeclRefExpr for a lambda capture should be treated as a reference type.

https://llvm.org/bugs/show_bug.cgi?id=24914
rdar://problem/23524412

llvm-svn: 253157
2015-11-15 03:07:17 +00:00
Matthias Gehre 09a134eca3 CFG: Delay creating Dtors for CompoundStmts which end in ReturnStmt
Summary:
VisitReturnStmt would create a new block with including Dtors, so the Dtors created
in VisitCompoundStmts would be in an unreachable block.

Example:

struct S {
  ~S();
};

void f()
{
  S s;
  return;
}

void g()
{
  S s;
}

Before this patch, f has one additional unreachable block containing just the
destructor of S. With this patch, both f and g have the same blocks.

Reviewers: krememek

Subscribers: cfe-commits

Differential Revision: http://reviews.llvm.org/D13973

llvm-svn: 253107
2015-11-14 00:36:50 +00:00
Anna Zaks de14eb5b4e [static analyzer] Don't flag nil storage into NSMutableDictionary.
This is now allowed and has the behavior of removing the mapping.

llvm-svn: 252679
2015-11-11 00:49:22 +00:00
Devin Coughlin 9c76869bc3 [analyzer] Fix assertion failure invalidating on const member function calls (PR25392).
We now return early when the 'this' value cannot be converted to a MemRegion.

llvm-svn: 252506
2015-11-09 19:50:29 +00:00
Petar Jovanovic 73d1044abe Fix __builtin_signbit for ppcf128 type
Function__builtin_signbit returns wrong value for type ppcf128 on big endian
machines. This patch fixes how value is generated in that case.

Patch by Aleksandar Beserminji.

Differential Revision: http://reviews.llvm.org/D14149

llvm-svn: 252307
2015-11-06 14:52:46 +00:00
Yury Gribov 22b4164e7d [analyzer] Add VforkChecker to find unsafe code in vforked process.
This checker looks for unsafe constructs in vforked process:
function calls (excluding whitelist), memory write and returns.
This was originally motivated by a vfork-related bug in xtables package.

Patch by Yury Gribov.

Differential revision: http://reviews.llvm.org/D14014

llvm-svn: 252285
2015-11-06 11:16:31 +00:00
Devin Coughlin e949add687 [analyzer] Update RegionStoreManager::getBinding to handle BlockDataRegions
Update RegionStoreManager::getBinding() to return UnknownVal when trying to get
the binding for a BlockDataRegion. Previously, getBinding() would try to cast the
BlockDataRegion to a TypedValueRegion and crash. This happened when a block
was passed as a parameter to an inlined function for which
StackHintGeneratorForSymbol::getMessage() tried to generate a stack hint message.

rdar://problem/21291971

llvm-svn: 252185
2015-11-05 18:56:42 +00:00
Devin Coughlin 0500c70beb [analyzer] Add 'optin' checker package and move localizability checkers into it.
This commit creates a new 'optin' top-level checker package and moves several of
the localizability checkers into it.

This package is for checkers that are not alpha and that would normally be on by
default but where the driver does not have enough information to determine when
they are applicable. The localizability checkers fit this criterion because the
driver cannot determine whether a project is localized or not -- this is best
determined at the IDE or build-system level.

This new package is *not* intended for checkers that are too noisy to be on by
default.

The hierarchy under 'optin' mirrors that in 'alpha': checkers under 'optin'
should be organized in the hierarchy they would have had if they were truly top
level (e.g., optin.osx.cocoa.MyOptInChecker).

Differential Revision: http://reviews.llvm.org/D14303

llvm-svn: 252080
2015-11-04 21:33:41 +00:00
Devin Coughlin 6bc780ccc0 [analyzer] Move the ObjCGenericsChecker out of the alpha package.
It is now in the osx.cocoa package and so will be on by default for Apple
toolchains.

llvm-svn: 251966
2015-11-03 19:38:03 +00:00
Sean Eveson 70eece21c2 Reapply r251621 "[Analyzer] Widening loops which do not exit"
It was not the cause of the build bot failure.

llvm-svn: 251702
2015-10-30 15:23:57 +00:00
Sean Eveson 4c7b3bf6ba Revert r251621 "[Analyzer] Widening loops which do not exit" (bot failure)
Seems to be causing clang-cmake-mips build bot to fail (timeout)

http://lab.llvm.org:8011/builders/clang-cmake-mips/builds/10299

llvm-svn: 251697
2015-10-30 11:13:07 +00:00
Sean Eveson 83390e45b3 [Analyzer] Widening loops which do not exit
Summary:
Dear All,

We have been looking at the following problem, where any code after the constant bound loop is not analyzed because of the limit on how many times the same block is visited, as described in bugzillas #7638 and #23438. This problem is of interest to us because we have identified significant bugs that the checkers are not locating. We have been discussing a solution involving ranges as a longer term project, but I would like to propose a patch to improve the current implementation.

Example issue:
```
for (int i = 0; i < 1000; ++i) {...something...}
int *p = 0;
*p = 0xDEADBEEF;
```

The proposal is to go through the first and last iterations of the loop. The patch creates an exploded node for the approximate last iteration of constant bound loops, before the max loop limit / block visit limit is reached. It does this by identifying the variable in the loop condition and finding the value which is “one away” from the loop being false. For example, if the condition is (x < 10), then an exploded node is created where the value of x is 9. Evaluating the loop body with x = 9 will then result in the analysis continuing after the loop, providing x is incremented.

The patch passes all the tests, with some modifications to coverage.c, in order to make the ‘function_which_gives_up’ continue to give up, since the changes allowed the analysis to progress past the loop.

This patch does introduce possible false positives, as a result of not knowing the state of variables which might be modified in the loop. I believe that, as a user, I would rather have false positives after loops than do no analysis at all. I understand this may not be the common opinion and am interested in hearing your views. There are also issues regarding break statements, which are not considered. A more advanced implementation of this approach might be able to consider other conditions in the loop, which would allow paths leading to breaks to be analyzed.

Lastly, I have performed a study on large code bases and I think there is little benefit in having “max-loop” default to 4 with the patch. For variable bound loops this tends to result in duplicated analysis after the loop, and it makes little difference to any constant bound loop which will do more than a few iterations. It might be beneficial to lower the default to 2, especially for the shallow analysis setting.

Please let me know your opinions on this approach to processing constant bound loops and the patch itself.

Regards,

Sean Eveson
SN Systems - Sony Computer Entertainment Group

Reviewers: jordan_rose, krememek, xazax.hun, zaks.anna, dcoughlin

Subscribers: krememek, xazax.hun, cfe-commits

Differential Revision: http://reviews.llvm.org/D12358

llvm-svn: 251621
2015-10-29 10:04:41 +00:00
Anna Zaks fe1eca5169 [analyzer] Assume escape is possible through system functions taking void*
The analyzer assumes that system functions will not free memory or modify the
arguments in other ways, so we assume that arguments do not escape when
those are called. However, this may lead to false positive leak errors. For
example, in code like this where the pointers added to the rb_tree are freed
later on:

		struct alarm_event *e = calloc(1, sizeof(*e));
<snip>

		rb_tree_insert_node(&alarm_tree, e);

Add a heuristic to assume that calls to system functions taking void*
arguments allow for pointer escape.

llvm-svn: 251449
2015-10-27 20:19:45 +00:00
Gabor Horvath ba7d9071fe [analyzer] Fix lambdas that are capturing constants.
llvm-svn: 251407
2015-10-27 13:46:39 +00:00
Gabor Horvath 244d27149a [analyzer] Fix another crash when analyzing lambda functions.
llvm-svn: 251404
2015-10-27 12:36:26 +00:00
Gabor Horvath 2f929b4093 [analyzer] Added a missing test case for r251289.
llvm-svn: 251313
2015-10-26 17:42:14 +00:00
Gabor Horvath b89658f649 Attempt to fix build bot test failures.
llvm-svn: 251014
2015-10-22 13:23:18 +00:00
Gabor Horvath efec16307c [analyzer] Bug identification
This patch adds hashes to the plist and html output to be able to identfy bugs
for suppressing false positives or diff results against a baseline. This hash
aims to be resilient for code evolution and is usable to identify bugs in two
different snapshots of the same software. One missing piece however is a 
permanent unique identifier of the checker that produces the warning. Once that
issue is resolved, the hashes generated are going to change. Until that point
this feature is marked experimental, but it is suitable for early adoption.

Differential Revision: http://reviews.llvm.org/D10305 

Original patch by: Bence Babati!

llvm-svn: 251011
2015-10-22 11:53:04 +00:00
Devin Coughlin 4f770dee54 [analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606)
Prevent invalidation of `this' when a method is const; fixing PR 21606.

A patch by Sean Eveson!

Differential Revision: http://reviews.llvm.org/D13099

llvm-svn: 250237
2015-10-13 22:20:52 +00:00
David Majnemer c10b8381f7 Update tests touched by r249656
These test updates almost exclusively around the change in behavior
around enum: enums without a definition are considered incomplete except
when targeting MSVC ABIs.  Since these tests are interested in the
'incomplete-enum' behavior, restrict them to %itanium_abi_triple.

llvm-svn: 249660
2015-10-08 06:31:22 +00:00
Devin Coughlin 0da2e93345 [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire region.
Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size
array fields. With this change, instead of invalidating the entire containing region the
analyzer now invalidates only offsets for the array itself when it can show that the
memcpy stays within the bounds of the array.

This addresses false positive memory leak warnings of the kind reported by
krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954

(This is the second attempt, now with assertion failures resolved.)

A patch by Pierre Gousseau!

Differential Revision: http://reviews.llvm.org/D12571

llvm-svn: 248516
2015-09-24 16:52:56 +00:00
NAKAMURA Takumi 0cc61b2d30 clang/test/Analysis/malloc-overflow2.c: Appease 32-bit targets.
size_t is not unsigned long for targeting i686 (and Windows x64).

llvm-svn: 248458
2015-09-24 02:49:00 +00:00
Devin Coughlin 683dfd3124 [analyzer] Discard malloc-overflow bug-report when a known size is malloc'ed.
This patch ignores malloc-overflow bug in two cases:
Case1:
x = a/b; where n < b
malloc (x*n); Then x*n will not overflow.

Case2:
x = a; // when 'a' is a known value.
malloc (x*n);

Also replaced isa with dyn_cast.

Reject multiplication by zero cases in MallocOverflowSecurityChecker
Currently MallocOverflowSecurityChecker does not catch cases like:
malloc(n * 0 * sizeof(int));

This patch rejects such cases.

Two test cases added. malloc-overflow2.c has an example inspired from a code
in linux kernel where the current checker flags a warning while it should not.

A patch by Aditya Kumar!

Differential Revision: http://reviews.llvm.org/D9924

llvm-svn: 248446
2015-09-23 23:27:55 +00:00
Devin Coughlin 9f21f68bfe [analyzer] Improve localizability checks for iOS / OS X.
Various improvements to the localization checker:
* Adjusted copy to be consistent with diagnostic text in other Apple
  API checkers.
* Added in ~150 UIKit / AppKit methods that require localized strings in
  UnlocalizedStringsChecker.
* UnlocalizedStringChecker now checks for UI methods up the class hierarchy and
  UI methods that conform for a certain Objective-C protocol.
* Added in alpha version of PluralMisuseChecker and some regression tests. False
  positives are still not ideal.

(This is the second attempt, with the memory issues on Linux resolved.)

A patch by Kulpreet Chilana!

Differential Revision: http://reviews.llvm.org/D12417

llvm-svn: 248432
2015-09-23 21:43:21 +00:00
Devin Coughlin 749de2355c Revert "[analyzer] Improve localizability checks for iOS / OS X."
This reverts commit r248350. The pluralization checks are failing on some bots.

llvm-svn: 248351
2015-09-23 00:17:52 +00:00
Devin Coughlin ab58314357 [analyzer] Improve localizability checks for iOS / OS X.
Various improvements to the localization checker:
* Adjusted copy to be consistent with diagnostic text in other Apple
  API checkers.
* Added in ~150 UIKit / AppKit methods that require localized strings in
  UnlocalizedStringsChecker.
* UnlocalizedStringChecker now checks for UI methods up the class hierarchy and
  UI methods that conform for a certain Objective-C protocol.
* Added in alpha version of PluralMisuseChecker and some regression tests. False
  positives are still not ideal.

A patch by Kulpreet Chilana!

Differential Revision: http://reviews.llvm.org/D12417

llvm-svn: 248350
2015-09-22 23:58:04 +00:00
Devin Coughlin 8177173757 [analyzer] Make realloc(ptr, 0) handling equivalent to malloc(0).
Currently realloc(ptr, 0) is treated as free() which seems to be not correct. C
standard (N1570) establishes equivalent behavior for malloc(0) and realloc(ptr,
0): "7.22.3 Memory management functions calloc, malloc, realloc: If the size of
the space requested is zero, the behavior is implementation-defined: either a
null pointer is  returned, or the behavior is as if the size were some nonzero
value, except that the returned pointer shall not be used to access an object."
The patch equalizes the processing of malloc(0) and realloc(ptr,0). The patch
also enables unix.Malloc checker to detect references to zero-allocated memory
returned by realloc(ptr,0) ("Use of zero-allocated memory" warning).

A patch by Антон Ярцев!

Differential Revision: http://reviews.llvm.org/D9040

llvm-svn: 248336
2015-09-22 22:47:14 +00:00
Devin Coughlin eb538abfbd [analyzer] Create one state for a range switch case instead of multiple.
This fixes PR16833, in which the analyzer was using large amounts of memory
for switch statements with large case ranges.

rdar://problem/14685772

A patch by Aleksei Sidorin!

Differential Revision: http://reviews.llvm.org/D5102

llvm-svn: 248318
2015-09-22 20:31:19 +00:00
Ismail Pazarbasi d60db64e7d Analyzer: Teach analyzer how to handle TypeTraitExpr
Summary:
`TypeTraitExpr`s are not supported by the ExprEngine today. Analyzer
creates a sink, and aborts the block. Therefore, certain bugs that
involve type traits intrinsics cannot be detected (see PR24710).

This patch creates boolean `SVal`s for `TypeTraitExpr`s, which are
evaluated by the compiler.

Test within the patch is a summary of PR24710.

Reviewers: zaks.anna, dcoughlin, krememek

Subscribers: cfe-commits

Differential Revision: http://reviews.llvm.org/D12482

llvm-svn: 248314
2015-09-22 19:33:15 +00:00
Gabor Horvath 659842d0fc [Static Analyzer] Fixed a false positive case in DynamicTypeChecker when dealing with forward declarations.
llvm-svn: 248065
2015-09-18 23:38:57 +00:00
Ismail Pazarbasi d347e7a920 Analyzer: Fix a crasher in UbigraphViz
Summary:
Name `Out` refers to the parameter. It is moved into the member `Out`
in ctor-init. Dereferencing null pointer will crash clang, if user
passes '-analyzer-viz-egraph-ubigraph' argument.

Reviewers: zaks.anna, krememek

Subscribers: cfe-commits

Differential Revision: http://reviews.llvm.org/D12119

llvm-svn: 248050
2015-09-18 21:54:47 +00:00
Gabor Horvath dce40c518d [Static Analyzer] General type checker based on dynamic type information.
Differential Revision: http://reviews.llvm.org/D12973

llvm-svn: 248041
2015-09-18 21:15:37 +00:00
Gabor Horvath c4b28a8f74 [analyzer] A fix for substraction of an integer from a pointer.
Patch by Artem Dergachev!

Differential Revision: http://reviews.llvm.org/D12725

llvm-svn: 248021
2015-09-18 19:13:22 +00:00
Gabor Horvath 6165d31a83 [Static Analyzer] Use generics related information to infer dynamic types.
Differential Revision: http://reviews.llvm.org/D12916

llvm-svn: 248002
2015-09-18 16:43:27 +00:00
Gabor Horvath 3ef9ef2227 [Static Analyzer] Generics Checker: When an ObjC method returns a specialized object, track it properly.
Differential Revision: http://reviews.llvm.org/D12889

llvm-svn: 247861
2015-09-16 22:44:36 +00:00
Devin Coughlin e39bd407ba [analyzer] Add generateErrorNode() APIs to CheckerContext.
The analyzer trims unnecessary nodes from the exploded graph before reporting
path diagnostics. However, in some cases it can trim all nodes (including the
error node), leading to an assertion failure (see
https://llvm.org/bugs/show_bug.cgi?id=24184).

This commit addresses the issue by adding two new APIs to CheckerContext to
explicitly create error nodes. Unless the client provides a custom tag, these
APIs tag the node with the checker's tag -- preventing it from being trimmed.
The generateErrorNode() method creates a sink error node, while
generateNonFatalErrorNode() creates an error node for a path that should
continue being explored.

The intent is that one of these two methods should be used whenever a checker
creates an error node.

This commit updates the checkers to use these APIs. These APIs
(unlike addTransition() and generateSink()) do not take an explicit Pred node.
This is because there are not any error nodes in the checkers that were created
with an explicit different than the default (the CheckerContext's Pred node).

It also changes generateSink() to require state and pred nodes (previously
these were optional) to reduce confusion.

Additionally, there were several cases where checkers did check whether a
generated node could be null; we now explicitly check for null in these places.

This commit also includes a test case written by Ying Yi as part of
http://reviews.llvm.org/D12163 (that patch originally addressed this issue but
was reverted because it introduced false positive regressions).

Differential Revision: http://reviews.llvm.org/D12780

llvm-svn: 247859
2015-09-16 22:03:05 +00:00
Gabor Horvath 6864cbced6 [Static Analyzer] Added an XFAIL test for inlining when the type inference involves generic types.
llvm-svn: 247739
2015-09-15 23:14:01 +00:00
Devin Coughlin ca5ab2b0d4 [analyzer] Skip Pre/Post handlers for ObjC calls when receiver is nil.
In Objective-C, method calls with nil receivers are essentially no-ops. They
do not fault (although the returned value may be garbage depending on the
declared return type and architecture). Programmers are aware of this
behavior and will complain about a false alarm when the analyzer
diagnoses API violations for method calls when the receiver is known to
be nil.

Rather than require each individual checker to be aware of this behavior
and suppress a warning when the receiver is nil, this commit
changes ExprEngineObjC so that VisitObjCMessage skips calling checker
pre/post handlers when the receiver is definitely nil. Instead, it adds a
new event, ObjCMessageNil, that is only called in that case.

The CallAndMessageChecker explicitly cares about this case, so I've changed it
to add a callback for ObjCMessageNil and moved the logic in PreObjCMessage
that handles nil receivers to the new callback.

rdar://problem/18092611

Differential Revision: http://reviews.llvm.org/D12123

llvm-svn: 247653
2015-09-15 01:13:53 +00:00
Gabor Horvath dfedc0f884 [Static Analyzer] Moving nullability checkers out of alpha.
llvm-svn: 247595
2015-09-14 18:48:55 +00:00