Commit Graph

137 Commits

Author SHA1 Message Date
Ted Kremenek 843c53828f RegionStore/BasicStore: do not return UndefinedVal for accesses to concrete addresses; instead return UnknownVal. This
leads it up to checkers (e.g., DereferenceChecker) to guard against illegal accesses (e.g., null dereferences).

Fixes PR 5272 and <rdar://problem/6839683>.

llvm-svn: 118852
2010-11-11 23:10:10 +00:00
Ted Kremenek 6348dac7a0 Fix lazy symbolication bug in RegionStore involving fields of global variables. When invalidated, the entire
globals memory space gets assigned a symbolic value, but that value was not being used for lazy symbolication
of fields of globals.  This could result in cases where bogus null dereferences were being reported.

Fixes PR 8440.

llvm-svn: 117336
2010-10-26 00:06:17 +00:00
Ted Kremenek c07d8353e1 Add check for UnknownVals for mutexes in ObjCAtSyncChecker. Fixes crash reported in PR 8458.
llvm-svn: 117300
2010-10-25 20:20:56 +00:00
Ted Kremenek c5644e1b97 Tweak the ObjCAtSyncChecker to assume that a mutex is non-nil after checking that it is
nil.  Otherwise we can get false paths where a second @synchronized using the mutex
can have a bogus warning.  Fixes <rdar://problem/8578650>.

llvm-svn: 117016
2010-10-21 15:38:55 +00:00
Argyrios Kyrtzidis 40cec8326c Revert r114316, -Wunused-value enabled by default was intended.
llvm-svn: 114318
2010-09-19 23:03:35 +00:00
Argyrios Kyrtzidis 3698bf1c6d Make -Wunused-value off by default, matching GCC. Fixes rdar://7126194.
llvm-svn: 114316
2010-09-19 21:21:44 +00:00
Ted Kremenek 7b31a61d10 Relax assertion in CFG builder when processing ForStmts. This fixes an assertion failure
on code containing GNU statement expressions reported in PR 8141.

llvm-svn: 113953
2010-09-15 07:01:20 +00:00
Ted Kremenek 0a3f523614 Polish diagnostics for null dereferences via ObjC ivar accesses. Finishes up <rdar://problem/6352035>.
llvm-svn: 113612
2010-09-10 20:20:49 +00:00
Ted Kremenek e495c99055 Implement: <rdar://problem/6351970> rule request: warn if @synchronized mutex can be nil
llvm-svn: 113573
2010-09-10 03:05:40 +00:00
Ted Kremenek 5cdaeaaa1d Clean up obtuse wording of checker diagnostic of using an uninitialized value in a function call.
Fixes: <rdar://problem/8409480> “warning: Pass-by-value argument in function call is undefined” message can be improved
llvm-svn: 113554
2010-09-09 22:51:55 +00:00
Ted Kremenek 5ebb6156d8 Include test case for <rdar://problem/5880430>.
llvm-svn: 113458
2010-09-09 00:40:43 +00:00
Anders Carlsson af7534f084 Get rid of the "functions declared 'noreturn' should have a 'void' result type" warning.
The rationale behind this is that it is normal for callback functions to have a non-void return type
and it should still be possible to mark them noreturn. (JavaScriptCore is a good example of this).

llvm-svn: 112918
2010-09-03 00:25:02 +00:00
Ted Kremenek 026cb58a44 Don't assert in CastSizeChecker when the casted-to pointee is an incomplete type. Fixes PR 8050.
llvm-svn: 112738
2010-09-01 20:35:38 +00:00
Tom Care 9026d4b488 Adjusted the semantics of assign checking in IdempotentOperationChecker
- Fixed a regression where assigning '0' would be reported
- Changed the way self assignments are filtered to allow constant testing
- Added a test case for assign ops
- Fixed one test case where a function pointer was not considered constant
- Fixed test cases relating to 0 assignment

llvm-svn: 112501
2010-08-30 19:25:43 +00:00
Tom Care 71cc9d886a Added checking of (x == x) and (x != x) to IdempotentOperationChecker and updated test cases flagged by it.
llvm-svn: 112313
2010-08-27 22:50:47 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 036223bdcf Fix horrible GRExprEngine bug where switch statements with no 'case:' statements would cause the path to get prematurely aborted. Fixes <rdar://problem/8360854>.
llvm-svn: 112233
2010-08-26 22:19:33 +00:00
Ted Kremenek 50e0105f1c Add warning for functions/blocks that have attribute 'noreturn' but return a non-void result. (<rdar://problem/7562925>)
llvm-svn: 111492
2010-08-19 00:52:13 +00:00
Jordy Rose c6c0fc9164 Allow EvalBinOpNN to handle expressions of the form $a+$b if $b can be reduced to a constant.
llvm-svn: 110592
2010-08-09 20:31:57 +00:00
John McCall a95172baa0 Only run the jump-checker if there's a branch-protected scope *and* there's
a switch or goto somewhere in the function.  Indirect gotos trigger the
jump-checker regardless, because the conditions there are slightly more
elaborate and it's too marginal a case to be worth optimizing.

Turns off the jump-checker in a lot of cases in C++.  rdar://problem/7702918

llvm-svn: 109962
2010-08-01 00:26:45 +00:00
Ted Kremenek 83b598c14f Finesse 'idempotent operations' analyzer issues to include the opcode of the binary operator for clearer error reporting. Also remove the 'Idempotent operation' prefix in messages; it's redundant since the bug type is the same.
llvm-svn: 109527
2010-07-27 18:49:08 +00:00
Ted Kremenek b32964d02d Fix '<rdar://problem/8202272> __imag passed non-complex should not crash' by removing a bogus assertion.
llvm-svn: 108602
2010-07-17 01:28:55 +00:00
Tom Care 826e6b4023 Improved false positive rate for the idempotent operations checker and moved it into the default path-sensitive analysis options.
- Added checks for static local variables, self assigned parameters, and truncating/extending self assignments
- Removed command line option (now default with --analyze)
- Updated test cases to pass with idempotent operation warnings

llvm-svn: 108550
2010-07-16 20:41:41 +00:00
Chris Lattner 3956106543 implement PR7569, warning about assignment to null, which
people seem to write when they want a deterministic trap.
Suggest instead that they use a volatile pointer or 
__builtin_trap.

llvm-svn: 107756
2010-07-07 06:14:23 +00:00
Ted Kremenek bd862711fd Fix PR 7475 by enhancing the static analyzer to also invalidate bindings for non-static global variables
when calling a function/method whose impact on global variables we cannot accurately estimate.
This change introduces two new MemSpaceRegions that divide up the memory space of globals, and causes
RegionStore and BasicStore to consult a binding to the NonStaticGlobalsMemSpaceRegion when lazily
determining the value of a global.

llvm-svn: 107423
2010-07-01 20:16:50 +00:00
Jordy Rose 7f8ea4d677 Implicitly compare symbolic expressions to zero when they're being used as constraints. Part of PR7491.
llvm-svn: 106972
2010-06-27 01:20:56 +00:00
Ted Kremenek 4c721bf892 Change AnalysisConsumer to analyze functions created by instantiantiating a macro. Fixes PR 7361.
llvm-svn: 105984
2010-06-15 00:55:40 +00:00
Ted Kremenek 34ddec630c Predefine the '__clang_analyzer__' macro when using '-analyze'.
llvm-svn: 104742
2010-05-26 21:36:54 +00:00
Ted Kremenek ecc31c93c2 Don't add a null successor to a CFGBlock when the contents of an @synchronized statement is empty.
Fixes <rdar://problem/7979430>.

llvm-svn: 103717
2010-05-13 16:38:08 +00:00
Ted Kremenek 989da5eeff Fix CFG crasher involving statement expressions reported in PR 6938.
llvm-svn: 102576
2010-04-29 01:10:26 +00:00
Ted Kremenek 499b4e3387 Fix lookup of fields from lazy bindings to check if the region is
NULL, not the store, to determine if a lookup succeeded.  The store
can be null if it contained no bindings.  This fixes a false positive
reported to me by a user of the analyzer.

llvm-svn: 95679
2010-02-09 19:11:53 +00:00
Ted Kremenek bdfcacbe8f Also teach RegionStore::RetrieveVar() to handle 'static' pointers that are implicitly initialized to NULL.
llvm-svn: 95479
2010-02-06 04:04:46 +00:00
Ted Kremenek 30fe9ecac2 Fix regression in RegionStore (from BasicStore) where static variables were not treated as being implicitly initialized to 0 (and instead were getting symbolicated).
llvm-svn: 95478
2010-02-06 03:57:59 +00:00
Ted Kremenek 2f2692f8ca Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.
llvm-svn: 95348
2010-02-05 02:06:54 +00:00
Ted Kremenek 49f878524c Specially handle casts to 'void' in AdjustedReturnValueChecker.
llvm-svn: 95287
2010-02-04 04:18:55 +00:00
Ted Kremenek 1e3b95580c static analyzer: handle casts of a function to a function pointer with
a different return type.  While we don't emit any errors (yet), at
least we avoid cases where we might crash because of an assertion
failure later on (when the return type differs from what is expected).

llvm-svn: 95268
2010-02-04 00:47:48 +00:00
Ted Kremenek d960564b76 Fix regression in RegionStore due to recent changes in
RegionStoreManager::InvalidateRegions() by adjusting the worklist to
iterate over BindingKeys instead of MemRegions.  We also only need to
do the actual invalidation work on base regions, and for non-base
regions just blow away their bindings.

llvm-svn: 95200
2010-02-03 04:16:00 +00:00
Ted Kremenek 416b923786 Explicitly check for casts to double or complex types instead of possibly asserting in SValuator.
llvm-svn: 95128
2010-02-02 21:11:40 +00:00
Ted Kremenek fab459fc95 Fix bug in GRExprEngine::VisitSizeOfAlignOfExpr() where we do not add
'Pred' to 'Dst' for cases we currently don't handle.  This fixes
<rdar://problem/7593875>.

llvm-svn: 95048
2010-02-02 02:01:51 +00:00
Mike Stump 0978af83b3 Insulate these from changes to the default for -Wunreachable-code.
llvm-svn: 94326
2010-01-23 20:12:18 +00:00
Zhongxing Xu 7872d4df93 Add test case.
llvm-svn: 93874
2010-01-19 12:11:55 +00:00
Ted Kremenek d74cc397c8 Teach BugReporter to "escape" the occurance of '%' characters in diagnostic messages when emitted results to the standard Diagnostics output. Fixes PR 6033.
llvm-svn: 93507
2010-01-15 07:56:51 +00:00
Chris Lattner faa5417264 implement PR6004, warning about divide and remainder by zero.
llvm-svn: 93256
2010-01-12 21:23:57 +00:00
Ted Kremenek ec144538ae Make sure this test case tests analyzing both x86_64 and i386 archs.
llvm-svn: 93133
2010-01-10 22:31:25 +00:00
Chris Lattner f9895c48fd add a bunch of missing prototypes to tests
llvm-svn: 93072
2010-01-09 20:43:19 +00:00
Zhongxing Xu f22afe32f9 Move test case to a more appropriate file.
llvm-svn: 92725
2010-01-05 11:49:21 +00:00
Zhongxing Xu e6a238b1df Add test case.
llvm-svn: 92724
2010-01-05 11:47:58 +00:00
Daniel Dunbar 8fbe78f6fc Update tests to use %clang_cc1 instead of 'clang-cc' or 'clang -cc1'.
- This is designed to make it obvious that %clang_cc1 is a "test variable"
   which is substituted. It is '%clang_cc1' instead of '%clang -cc1' because it
   can be useful to redefine what gets run as 'clang -cc1' (for example, to set
   a default target).

llvm-svn: 91446
2009-12-15 20:14:24 +00:00
Zhongxing Xu 27f686f8ec Replace clang-cc with clang -cc1.
llvm-svn: 91272
2009-12-14 06:34:20 +00:00
Daniel Dunbar 4e7596cc3a Normalize options to use '-FOO' instead of '--FOO'.
llvm-svn: 90071
2009-11-29 09:33:10 +00:00