Commit Graph

1745 Commits

Author SHA1 Message Date
Artem Dergachev cbd7cd8360 [analyzer] Improve subscripting null arrays for catching null dereferences.
Array-to-pointer cast now works correctly when the pointer to the array
is concrete, eg. null, which allows further symbolic calculations involving
such values.

Inlined defensive checks are now detected correctly when the resulting null
symbol is being array-subscripted before dereference.

Differential Revision: https://reviews.llvm.org/D32291

llvm-svn: 301251
2017-04-24 20:55:07 +00:00
Artem Dergachev 37de888867 [analyzer] Improve suppression for inlined defensive checks before operator &.
Null dereferences are suppressed if the lvalue was constrained to 0 for the
first time inside a sub-function that was inlined during analysis, because
such constraint is a valid defensive check that does not, by itself,
indicate that null pointer case is anyhow special for the caller.

If further operations on the lvalue are performed, the symbolic lvalue is
collapsed to concrete null pointer, and we need to track where does the null
pointer come from.

Improve such tracking for lvalue operations involving operator &.

rdar://problem/27876009

Differential Revision: https://reviews.llvm.org/D31982

llvm-svn: 301224
2017-04-24 19:30:33 +00:00
Alexander Shaposhnikov 015da3534a [analyzer] Fix assert in ExprEngine::processSwitch
This diff replaces getTypeSize(CondE->getType())) 
with getIntWidth(CondE->getType())) in ExprEngine::processSwitch.
These calls are not equivalent for bool, see ASTContext.cpp
Add a test case.

Test plan:
make check-clang-analysis
make check-clang

Differential revision: https://reviews.llvm.org/D32328

llvm-svn: 300936
2017-04-21 01:05:26 +00:00
Artem Dergachev 6dd11048f5 [analyzer] Enforce super-region classes for various memory regions.
We now check the type of the super-region pointer for most SubRegion classes
in compile time; some checks are run-time though.

This is an API-breaking change (we now require explicit casts to specific region
sub-classes), but in practice very few checkers are affected.

Differential Revision: https://reviews.llvm.org/D26838

llvm-svn: 300189
2017-04-13 09:56:07 +00:00
Artem Dergachev b3241f41b2 [analyzer] Add numerous assertions to SVal, SymExpr, and MemRegion classes.
Clean up vtable anchors (remove anchors for regions that have regular
out-of-line virtual methods, add anchors for regions that don't have those).

Fix private/public methods (all constructors should now be private for leaf
classes, protected for abstract classes).

No functional change intended, only extra sanity checks and cleanups.

Differential Revision: https://reviews.llvm.org/D26837

llvm-svn: 300187
2017-04-13 09:48:05 +00:00
Artem Dergachev 12294f8d2e [analyzer] Simplify values in binary operations a bit more aggressively.
SValBuilder tries to constant-fold symbols in the left-hand side of the symbolic
expression whenever it fails to evaluate the expression directly. However, it
only constant-folds them when they are atomic expressions, not when they are
complicated expressions themselves. This patch adds recursive constant-folding
to the left-hand side subexpression (there's a lack of symmetry because we're
trying to have symbols on the left and constants on the right). As an example,
we'd now be able to handle operations similar to "$x + 1 < $y", when $x is
constrained to a constant.

rdar://problem/31354676

Differential Revision: https://reviews.llvm.org/D31886

llvm-svn: 300178
2017-04-13 07:20:04 +00:00
Alexander Shaposhnikov 5f24c12dc4 [analyzer] Add a check for IvarRegion in getExtraInvalidatedValues
This diff adds a defensive check in getExtraInvalidatedValues
for the case when there are no regions for the ivar associated with
a property. Corresponding test case added.

Test plan:
make check-clang
make check-clang-analysis

llvm-svn: 300114
2017-04-12 22:00:13 +00:00
Dominic Chen 08f943c563 [analyzer] Add new Z3 constraint manager backend
Summary: Implement new Z3 constraint manager backend.

Reviewers: zaks.anna, dcoughlin, NoQ, xazax.hun

Subscribers: mgorny, cfe-commits

Differential Revision: https://reviews.llvm.org/D28952

llvm-svn: 299463
2017-04-04 19:52:25 +00:00
Simon Pilgrim 2c51880a82 Spelling mistakes in comments. NFCI. (PR27635)
llvm-svn: 299083
2017-03-30 14:13:19 +00:00
Artem Dergachev 7333a9ea11 [analyzer] Fix symbolication for unknown unary increment/decrement results.
If the value is known, but we cannot increment it, conjure a symbol to
represent the result of the operation based on the operator expression,
not on the sub-expression.

In particular, no longer crash on comparing a result of a LocAsInteger increment
to a constant integer.

rdar://problem/31067356

Differential Revision: https://reviews.llvm.org/D31289

llvm-svn: 298927
2017-03-28 15:57:12 +00:00
Artem Dergachev 647804a84a [analyzer] When creating a temporary object, properly copy the value into it.
Adjustments should be considered properly; we should copy the unadjusted object
over the whole temporary base region. If the unadjusted object is no longer
available in the Environment, invalidate the temporary base region, and then
copy the adjusted object into the adjusted sub-region of the temporary region.

This fixes a regression introduced by r288263, that caused various
false positives, due to copying only adjusted object into the adjusted region;
the rest of the base region therefore remained undefined.
Before r288263, the adjusted value was copied over the unadjusted region,
which is incorrect, but accidentally worked better due to how region store
disregards compound value bindings to non-base regions.

An additional test machinery is introduced to make sure that despite making
two binds, we only notify checkers once for both of them, without exposing
the partially copied objects.

This fix is a hack over a hack. The proper fix would be to model C++ temporaries
in the CFG, and after that dealing with adjustments would no longer be
necessary, and the values we need would no longer disappear from the
Environment.

rdar://problem/30658168

Differential Revision: https://reviews.llvm.org/D30534

llvm-svn: 298924
2017-03-28 15:43:26 +00:00
Anna Zaks ae4772140f [analyzer] Turn suppress-c++-stdlib on by default
We have several reports of false positives coming from libc++. For example,
there are reports of false positives in std::regex, std::wcout, and also
a bunch of issues are reported in https://reviews.llvm.org/D30593. In many
cases, the analyzer trips over the complex libc++ code invariants. Let's turn
off the reports coming from these headers until we can re-evalate the support.

We can turn this back on once we individually suppress all known false
positives and perform deeper evaluation on large codebases that use libc++.
We'd also need to commit to doing these evaluations regularly as libc++
headers change.

Differential Revision: https://reviews.llvm.org/D30798

llvm-svn: 297429
2017-03-10 00:33:19 +00:00
Anna Zaks 12d0c8d662 [analyzer] Extend taint propagation and checking to support LazyCompoundVal
A patch by Vlad Tsyrklevich!

Differential Revision: https://reviews.llvm.org/D28445

llvm-svn: 297326
2017-03-09 00:01:16 +00:00
Eric Fiselier 20f25cb6df [coroutines] Add DependentCoawaitExpr and fix re-building CoroutineBodyStmt.
Summary:
The changes contained in this patch are:

1. Defines a new AST node `CoawaitDependentExpr` for representing co_await expressions while the promise type is still dependent.
2. Correctly detect and transform the 'co_await' operand to  `p.await_transform(<expr>)`  when possible.
3. Change the initial/final suspend points to build during the initial parse, so they have the correct operator co_await lookup results.
4.  Fix transformation of the CoroutineBodyStmt so that it doesn't re-build the final/initial suspends.


@rsmith: This change is a little big, but it's not trivial for me to split it up. Please let me know if you would prefer this submitted as multiple patches.



Reviewers: rsmith, GorNishanov

Reviewed By: rsmith

Subscribers: ABataev, rsmith, mehdi_amini, cfe-commits

Differential Revision: https://reviews.llvm.org/D26057

llvm-svn: 297093
2017-03-06 23:38:15 +00:00
Aleksei Sidorin f82a63277a [Analyzer] Terminate analysis on OpenMP code instead of assertion crash
* ExprEngine assumes that OpenMP statements should never appear in CFG.
  However, current CFG doesn't know anything about OpenMP and passes
  such statements as CFG nodes causing "UNREACHABLE executed!" crashes.
  Since there is no OpenMP implementation in ExprEngine or CFG,
  we stop the analysis on OpenMP statements to avoid crashes.

This fixes PR31835.

Differential Revision: https://reviews.llvm.org/D30565

llvm-svn: 296884
2017-03-03 16:58:53 +00:00
Devin Coughlin bfa8e28dbb [analyzer] pr32088: Don't destroy the temporary if its initializer causes return.
In the following code involving GNU statement-expression extension:
  struct S {
    ~S();
  };

  void foo() {
    const S &x = ({ return; S(); });
  }
function 'foo()' returns before reference x is initialized. We shouldn't call
the destructor for the temporary object lifetime-extended by 'x' in this case,
because the object never gets constructed in the first place.

The real problem is probably in the CFG somewhere, so this is a quick-and-dirty
hotfix rather than the perfect solution.

A patch by Artem Dergachev!

rdar://problem/30759076

Differential Revision: https://reviews.llvm.org/D30499

llvm-svn: 296646
2017-03-01 17:48:39 +00:00
Dominic Chen 9bc02cee8d [analyzer] Refactor and simplify SimpleConstraintManager
Summary: SimpleConstraintManager is difficult to use, and makes assumptions about capabilities of the constraint manager. This patch refactors out those portions into a new RangedConstraintManager, and also fixes some issues with camel case, formatting, and confusing naming.

Reviewers: zaks.anna, dcoughlin

Subscribers: mgorny, xazax.hun, NoQ, rgov, cfe-commits

Differential Revision: https://reviews.llvm.org/D26061

llvm-svn: 296242
2017-02-25 04:51:31 +00:00
Gabor Horvath 562f3ccf3e [analyzer] Proper caching in CallDescription objects.
During the review of D29567 it turned out the caching in CallDescription is not implemented properly. In case an identifier does not exist in a translation unit, repeated identifier lookups will be done which might have bad impact on the performance. This patch guarantees that the lookup is only executed once. Moreover this patch fixes a corner case when the identifier of CallDescription does not exist in the translation unit and the called function does not have an identifier (e.g.: overloaded operator in C++).

Differential Revision: https://reviews.llvm.org/D29884

llvm-svn: 295186
2017-02-15 15:35:56 +00:00
Artem Dergachev 55705955ce [analyzer] Fix MacOSXAPIChecker fp with static locals seen from nested blocks.
This is an attempt to avoid new false positives caused by the reverted r292800,
however the scope of the fix is significantly reduced - some variables are still
in incorrect memory spaces.

Relevant test cases added.

rdar://problem/30105546
rdar://problem/30156693
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 293043
2017-01-25 10:21:45 +00:00
Devin Coughlin e1a5630213 Revert "[analyzer] Fix memory space of static locals seen from nested blocks."
This reverts commit r292800.

It is causing null pointer dereference false positives when a block that
captures a static local is evaluated at the top level.

llvm-svn: 292874
2017-01-24 02:10:59 +00:00
Artem Dergachev 01728fbbc0 [analyzer] Fix memory space of static locals seen from nested blocks.
When a block within a function accesses a function's static local variable,
this local is captured by reference rather than copied to the heap.

Therefore this variable's memory space is known: StaticGlobalSpaceRegion.
Used to be UnknownSpaceRegion, same as for stack locals.

Fixes a false positive in MacOSXAPIChecker.

rdar://problem/30105546
Differential revision: https://reviews.llvm.org/D28946

llvm-svn: 292800
2017-01-23 16:57:11 +00:00
Anna Zaks b570195c3a [analyzer] Add LocationContext as a parameter to checkRegionChanges
This patch adds LocationContext to checkRegionChanges and removes
wantsRegionChangeUpdate as it was unused.

A patch by Krzysztof Wiśniewski!

Differential Revision: https://reviews.llvm.org/D27090

llvm-svn: 291869
2017-01-13 00:50:57 +00:00
Anna Zaks dcfc191404 [analyzer] Support inlining of '[self classMethod]' and '[[self class] classMethod]'
Differential Revision: https://reviews.llvm.org/D28495

llvm-svn: 291867
2017-01-13 00:50:47 +00:00
Artem Dergachev 1d4fb84d82 [analyzer] Don't dereference the array value when binding it to a reference.
This replaces the hack in r291754, which was fixing pr31592, which was
caused by r291754, with a more appropriate solution.

rdar://problem/28832541
Differential revision: https://reviews.llvm.org/D28602

llvm-svn: 291781
2017-01-12 18:00:03 +00:00
Devin Coughlin dc9834f912 [analyzer] Treat pointers to static member functions as function pointers
Sema treats pointers to static member functions as having function pointer
type, so treat treat them as function pointer values in the analyzer as well.
This prevents an assertion failure in SValBuilder::evalBinOp caused by code
that expects function pointers to be Locs (in contrast, PointerToMember values
are nonlocs).

Differential Revision: https://reviews.llvm.org/D28033

llvm-svn: 291581
2017-01-10 18:49:27 +00:00
Kelvin Li da68118729 [OpenMP] Sema and parsing for 'target teams distribute simd’ pragma
This patch is to implement sema and parsing for 'target teams distribute simd’ pragma.
    
Differential Revision: https://reviews.llvm.org/D28252

llvm-svn: 291579
2017-01-10 18:08:18 +00:00
Gabor Horvath 3d57457298 [analyzer] Add checker for iterators dereferenced beyond their range.
Patch by: Adam Balogh!

Differential Revision: https://reviews.llvm.org/D25660

llvm-svn: 291430
2017-01-09 09:52:32 +00:00
David Blaikie 0a0c275ffd Migrate PathDiagnosticPiece to std::shared_ptr
Simplifies and makes explicit the memory ownership model rather than
implicitly passing/acquiring ownership.

llvm-svn: 291143
2017-01-05 17:26:53 +00:00
Kelvin Li 1851df563d [OpenMP] Sema and parsing for 'target teams distribute parallel for simd’ pragma
This patch is to implement sema and parsing for 'target teams distribute parallel for simd’ pragma.

Differential Revision: https://reviews.llvm.org/D28202

llvm-svn: 290862
2017-01-03 05:23:48 +00:00
Kelvin Li 80e8f56284 [OpenMP] Sema and parsing for 'target teams distribute parallel for’ pragma
This patch is to implement sema and parsing for 'target teams distribute parallel for’ pragma.

Differential Revision: https://reviews.llvm.org/D28160

llvm-svn: 290725
2016-12-29 22:16:30 +00:00
Kelvin Li 83c451e998 [OpenMP] Sema and parsing for 'target teams distribute' pragma
This patch is to implement sema and parsing for 'target teams distribute' pragma.

Differential Revision: https://reviews.llvm.org/D28015

llvm-svn: 290508
2016-12-25 04:52:54 +00:00
Anton Yartsev 5ac3720620 Fix for PR15623 (corrected r290413 reverted at 290415). The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290505
2016-12-25 00:57:51 +00:00
Egor Churaev 89831421af Fix problems in "[OpenCL] Enabling the usage of CLK_NULL_QUEUE as compare operand."
Summary: Fixed warnings in commit: https://reviews.llvm.org/rL290171

Reviewers: djasper, Anastasia

Subscribers: yaxunl, cfe-commits, bader

Differential Revision: https://reviews.llvm.org/D27981

llvm-svn: 290431
2016-12-23 14:55:49 +00:00
Anton Yartsev b2a5eb87f8 Revert changes made by r290413 until regression is fixed.
llvm-svn: 290415
2016-12-23 04:09:18 +00:00
Anton Yartsev 1a2a9e3087 Fix for PR15623. The patch eliminates unwanted ProgramState checker data propagation from an operand of the logical operation to operation result.
The patch also simplifies an assume of a constraint of the form: "(exp comparison_op expr) != 0" to true into an assume of "exp comparison_op expr" to true. (And similarly, an assume of the form "(exp comparison_op expr) == 0" to true as an assume of exp comparison_op expr to false.) which improves precision overall.
https://reviews.llvm.org/D22862

llvm-svn: 290413
2016-12-23 03:31:00 +00:00
Artem Dergachev 0e0a8b4d85 [analyzer] Improve suppress-on-sink behavior in incomplete analyses.
Warnings with suppress-on-sink are discarded during FlushReports when
BugReporter notices that all paths in ExplodedGraph that pass through the
warning eventually run into a sink node.

However, suppress-on-sink fails to filter out false positives when the analysis
terminates too early - by running into analyzer limits, such as block count
limits or graph size limits - and the interruption hits the narrow window
between throwing the leak report and reaching the no-return function call. In
such case the report is there, however suppression-on-sink doesn't work, because
the sink node was never constructed in the incomplete ExplodedGraph.

This patch implements a very partial solution: also suppress reports thrown
against a statement-node that corresponds to a statement that belongs to a
no-return block of the CFG.

rdar://problem/28832541

Differential Revision: https://reviews.llvm.org/D28023

llvm-svn: 290341
2016-12-22 14:48:52 +00:00
Devin Coughlin 5b1ee2fad9 [analyzer] Add sink after construction of temporary with no-return destructor.
The analyzer's CFG currently doesn't have nodes for calls to temporary
destructors. This causes the analyzer to explore infeasible paths in which
a no-return destructor would have stopped exploration and so results in false
positives when no-return destructors are used to implement assertions.

To mitigate these false positives, this patch stops generates a sink after
evaluating a constructor on a temporary object that has a no-return destructor.
This results in a loss of coverage because the time at which the destructor is
called may be after the time of construction (especially for lifetime-extended
temporaries).

This addresses PR15599.

rdar://problem/29131566

llvm-svn: 290140
2016-12-19 22:23:22 +00:00
Kelvin Li bf594a5600 [OpenMP] Sema and parsing for 'target teams' pragma
This patch is to implement sema and parsing for 'target teams' pragma.

Differential Revision: https://reviews.llvm.org/D27818

llvm-svn: 290038
2016-12-17 05:48:59 +00:00
Anna Zaks 44cdeb1da2 [analyzer] Teach the analyzer that pointers can escape into __cxa_demangle
This fixes a reported false positive in the malloc checker.

Differential Revision: https://reviews.llvm.org/D27599

llvm-svn: 289886
2016-12-15 22:55:18 +00:00
Anna Zaks 40c74c6d22 [analyzer] Refer to macro names in diagnostics for macros representing a literal
When a macro expending to a literal is used in a comparison, use the macro name
in the diagnostic rather than the literal. This improves readability of path
notes.

Added tests for various macro literals that could occur. Only BOOl, Int, and
NULL tests have changed behavior with this patch.

Differential Revision: https://reviews.llvm.org/D27726

llvm-svn: 289884
2016-12-15 22:55:11 +00:00
Devin Coughlin 64c01f7bef [analyzer] Add a new SVal to support pointer-to-member operations.
Add a new type of NonLoc SVal for C++ pointer-to-member operations. This SVal
supports both pointers to member functions and pointers to member data.

A patch by Kirill Romanenkov!

Differential Revision: https://reviews.llvm.org/D25475

llvm-svn: 289873
2016-12-15 21:27:06 +00:00
Richard Smith 30e304e2a6 Remove custom handling of array copies in lambda by-value array capture and
copy constructors of classes with array members, instead using
ArrayInitLoopExpr to represent the initialization loop.

This exposed a bug in the static analyzer where it was unable to differentiate
between zero-initialized and unknown array values, which has also been fixed
here.

llvm-svn: 289618
2016-12-14 00:03:17 +00:00
Dominic Chen c7772add11 [analyzer] Run clang-format and fix style
Summary: Split out formatting and style changes from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26691

llvm-svn: 289511
2016-12-13 01:40:41 +00:00
Richard Smith 410306bf6e Add two new AST nodes to represent initialization of an array in terms of
initialization of each array element:

 * ArrayInitLoopExpr is a prvalue of array type with two subexpressions:
   a common expression (an OpaqueValueExpr) that represents the up-front
   computation of the source of the initialization, and a subexpression
   representing a per-element initializer
 * ArrayInitIndexExpr is a prvalue of type size_t representing the current
   position in the loop

This will be used to replace the creation of explicit index variables in lambda
capture of arrays and copy/move construction of classes with array elements,
and also C++17 structured bindings of arrays by value (which inexplicably allow
copying an array by value, unlike all of C++'s other array declarations).

No uses of these nodes are introduced by this change, however.

llvm-svn: 289413
2016-12-12 02:53:20 +00:00
Kelvin Li 7ade93f5e2 [OpenMP] Sema and parsing for 'teams distribute parallel for' pragma
This patch is to implement sema and parsing for 'teams distribute parallel for' pragma.
    
Differential Revision: https://reviews.llvm.org/D27345

llvm-svn: 289179
2016-12-09 03:24:30 +00:00
Dominic Chen 0dd2306538 [analyzer] Print type for SymbolRegionValues when dumping to stream
Reviewers: NoQ, dcoughlin, zaks.anna

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D27365

llvm-svn: 288696
2016-12-05 20:30:11 +00:00
Richard Smith b3189a1802 DR1213: element access on an array xvalue or prvalue produces an xvalue. In the
latter case, a temporary array object is materialized, and can be
lifetime-extended by binding a reference to the member access. Likewise, in an
array-to-pointer decay, an rvalue array is materialized before being converted
into a pointer.

This caused IR generation to stop treating file-scope array compound literals
as having static storage duration in some cases in C++; that has been rectified
by modeling such a compound literal as an lvalue. This also improves clang's
compatibility with GCC for those cases.

llvm-svn: 288654
2016-12-05 07:49:14 +00:00
Kelvin Li 579e41ced2 [OpenMP] Sema and parsing for 'teams distribute parallel for simd' pragma
This patch is to implement sema and parsing for 'teams distribute parallel for simd' pragma.

Differential Revision: https://reviews.llvm.org/D27084

llvm-svn: 288294
2016-11-30 23:51:03 +00:00
Artem Dergachev 28ee2d1b09 [analyzer] Construct temporary objects of correct types, destroy them properly.
When constructing a temporary object region, which represents the result of
MaterializeTemporaryExpr, track down the sub-expression for which the temporary
is necessary with a trick similar to the approach used in CodeGen, namely
by using Expr::skipRValueSubobjectAdjustments().

Then, create the temporary object region with type of that sub-expression.
That type would propagate further in a path-sensitive manner.

During destruction of lifetime-extened temporaries, consult the type of
the temporary object region, rather than the type of the lifetime-extending
variable, in order to call the correct destructor (fixes pr17001) and,
at least, not to crash by trying to call a destructor of a plain type
(fixes pr19539).

rdar://problem/29131302
rdar://problem/29131576

Differential Revision: https://reviews.llvm.org/D26839

llvm-svn: 288263
2016-11-30 19:02:44 +00:00
Artem Dergachev 22e28f4078 [analyzer] Fix a crash on accessing a field within a literal-initialized union.
Because in case of unions we currently default-bind compound values in the
store, this quick fix avoids the crash for this case.

Patch by Ilya Palachev and independently by Alexander Shaposhnikov!

Differential Revision: https://reviews.llvm.org/D26442

llvm-svn: 287618
2016-11-22 04:29:23 +00:00
Dominic Chen c8629bd35a [analyzer] Refactor recursive symbol reachability check to use symbol_iterator
Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26773

llvm-svn: 287380
2016-11-18 21:07:03 +00:00
Anna Zaks 1485992eb3 [analyzer] Remove unused check::RegionChanges::wantsRegionChangeUpdate callback
Remove the check::RegionChanges::wantsRegionChangeUpdate callback as it is no
longer used (since checkPointerEscape has been added).

A patch by Krzysztof Wiśniewski!

Differential Revision: https://reviews.llvm.org/D26759

llvm-svn: 287175
2016-11-16 22:59:01 +00:00
Dominic Chen 3f8c3fa72f [analyzer] Rename assumeWithinInclusiveRange*()
Summary: The name is slightly confusing, since the constraint is not necessarily within the range unless `Assumption` is true. Split out renaming for ConstraintManager.h from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26644

llvm-svn: 286927
2016-11-15 01:54:41 +00:00
Dominic Chen e3733bc53e [analyzer] Minor optimization: avoid setting state if unchanged
Summary: Split out optimization from D26061

Reviewers: zaks.anna, dcoughlin

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D26642

llvm-svn: 286925
2016-11-15 01:40:58 +00:00
Alexander Kornienko 8df2a62ae6 Add a method to get the list of registered static analyzer checkers.
Summary:
This provides a better interface for clang-tidy and encapsulates the knowledge
about experimental checkers instead of leaving this to the clients.

Reviewers: zaks.anna

Subscribers: a.sidorin, NoQ, dcoughlin, cfe-commits

Differential Revision: https://reviews.llvm.org/D26310

llvm-svn: 286218
2016-11-08 07:23:32 +00:00
Artem Dergachev 75f9d3ac7e [analyzer] Allow undefined values in performTrivialCopy.
Reading from a garbage pointer should be modeled as garbage,
and performTrivialCopy should be able to deal with any SVal input.

Patch by Ilya Palachev!

Differential Revision: https://reviews.llvm.org/D25727

llvm-svn: 285640
2016-10-31 21:11:20 +00:00
Artem Dergachev aacc03c918 [analyzer] MacOSXAPIChecker: Disallow dispatch_once_t in ivars and heap.
Unlike global/static variables, calloc etc. functions that allocate ObjC
objects behave differently in terms of memory barriers, and hacks that make
dispatch_once as fast as it possibly could be start failing.

Differential Revision: https://reviews.llvm.org/D25909

llvm-svn: 285605
2016-10-31 17:27:26 +00:00
Kelvin Li 4e325f77a9 Re-apply patch r279045.
llvm-svn: 285066
2016-10-25 12:50:55 +00:00
Artem Dergachev b1991c5fa7 [analyzer] Re-apply r283092, attempt no.4, chunk no.4 (last)
The problem that caused the msvc crash has been indentified and fixed
in the previous commit. This patch contains the rest of r283092.

llvm-svn: 283584
2016-10-07 19:25:10 +00:00
Nirav Dave 2620d22b2b Silence Warning. NFC.
llvm-svn: 283583
2016-10-07 19:11:33 +00:00
Artem Dergachev 8b70c4e529 [analyzer] Re-apply r283092, attempt no.4, a small chunk.
Define PathDiagnosticNotePiece. The next commit would be able to address the
BugReport class code that is pointed to by the msvc crash message.

llvm-svn: 283566
2016-10-07 15:23:02 +00:00
Daniel Marjamaki d99ebc03f4 [analyzer] Don't merge different return nodes in ExplodedGraph
Returns when calling an inline function should not be merged in the ExplodedGraph unless they are same.

Differential Revision: https://reviews.llvm.org/D25326

llvm-svn: 283554
2016-10-07 14:21:08 +00:00
Artem Dergachev 5d9278ef00 Revert "[analyzer] Try to re-apply r283092 "Extend bug reports with extra notes"
Vector of smart pointers wasn't the thing that caused msvc crash.

llvm-svn: 283537
2016-10-07 10:56:44 +00:00
Artem Dergachev fc36b586fb [analyzer] Try to re-apply r283092 "Extend bug reports with extra notes"
Replace SmallVector<IntrusiveRefCntPtr> with a vector of plain pointers.
Would insignificantly increase memory usage.

llvm-svn: 283536
2016-10-07 10:44:09 +00:00
Anton Yartsev 0509d047f4 [analyzer] Add explanation why analyzer report is not generated (fix for PR12421).
Currently if the path diagnostic consumer (e.g HTMLDiagnostics and PlistDiagnostics) do not support cross file diagnostics then the path diagnostic report is silently omitted in the case of cross file diagnostics. The patch adds a little verbosity to Clang in this case.
The patch also adds help entry for the "--analyzer-output" driver option.

llvm-svn: 283499
2016-10-06 21:42:21 +00:00
Artem Dergachev 602e625622 [analyzer] Squash a compile error in r283301.
The constexpr string literal trick isn't supported in MSVC2013.

llvm-svn: 283303
2016-10-05 08:47:31 +00:00
Artem Dergachev 9cb5614c29 [analyzer] Improve "Assuming..." diagnostic pieces for logical operators.
Logical short-circuit operators now act like other branch conditions.

If the symbolic value of the left-hand side is not known to be true or false
(based on the previous execution path), the "Assuming" event piece is added
in order to explain that the analyzer is adding a new assumption.

Additionally, when the assumption is made against the right-hand side of
the logical operator (i.e. when the operator itself acts as a condition
in another CFG terminator), the "Assuming..." piece is written out for the
right-hand side of the operator rather than for the whole operator.
This allows expression-specific diagnostic message text to be constructed.

Differential Revision: https://reviews.llvm.org/D25092

llvm-svn: 283302
2016-10-05 08:28:25 +00:00
Artem Dergachev 0c33406aaa [analyzer] Add "Assuming..." diagnostic pieces for unsupported conditions.
In the analyzer's path-sensitive reports, when a report goes through a branch
and the branch condition cannot be decided to be definitely true or false
(based on the previous execution path), an event piece is added that tells the
user that a new assumption is added upon the symbolic value of the branch
condition. For example, "Assuming 'a' is equal to 3".

The text of the assumption is hand-crafted in various manners depending on
the AST expression. If the AST expression is too complex and the text of
the assumption fails to be constructed, the event piece is omitted.
This causes loss of information and misunderstanding of the report.

Do not omit the event piece even if the expression is too complex;
add a piece with a generic text instead.

Differential Revision: https://reviews.llvm.org/D23300

llvm-svn: 283301
2016-10-05 08:19:49 +00:00
Anna Zaks fb859a934a [analyzer] Add PostStmt callback for ArraySubscriptExpr
A patch by Jan Smets!

Differential Revision: https://reviews.llvm.org/D25009

llvm-svn: 283253
2016-10-04 20:49:31 +00:00
Vitaly Buka 20efb97ff3 Revert "[analyzer] Extend bug reports with extra notes" to fix Windows bot.
This reverts commit r283092.

llvm-svn: 283180
2016-10-04 02:19:17 +00:00
Artem Dergachev 9dceb11b2f [analyzer] Extend bug reports with extra notes
These diagnostics are separate from the path-sensitive engine's path notes,
and can be added manually on top of path-sensitive or path-insensitive reports.

The new note diagnostics would appear as note:-diagnostic on console and
as blue bubbles in scan-build. In plist files they currently do not appear,
because format needs to be discussed with plist file users.

The analyzer option "-analyzer-config notes-as-events=true" would convert
notes to normal path notes, and put them at the beginning of the path.
This is a temporary hack to show the new notes in plist files.

A few checkers would be updated in subsequent commits,
including tests for this new feature.

Differential Revision: https://reviews.llvm.org/D24278

llvm-svn: 283092
2016-10-03 07:58:26 +00:00
Alexander Shaposhnikov 6956d29034 [analyzer] Fix ExprEngine::VisitMemberExpr
AST may contain intermediate ParenExpr nodes
between MemberExpr and ArrayToPointerDecay.
This diff adjusts the check in ExprEngine::VisitMemberExpr accordingly.
Test plan: make -j8 check-clang-analysis

Differential revision: https://reviews.llvm.org/D24484

llvm-svn: 281373
2016-09-13 19:17:20 +00:00
Aleksei Sidorin 29afb1937b [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>
This patch also introduces AnalysisOrderChecker which is intended for testing
of callback call correctness.

Differential Revision: https://reviews.llvm.org/D23804

llvm-svn: 280367
2016-09-01 13:55:38 +00:00
Aleksei Sidorin e1beaf1ee7 [analyzer] Add more FileIDs to PlistDiagnostic map to avoid assertion
Some FileIDs that may be used by PlistDiagnostics were not added while building
a list of pieces. This caused assertion violation in GetFID() function.
This patch adds some missing FileIDs to avoid the assertion. It also contains
small refactoring of PlistDiagnostics::FlushDiagnosticsImpl().

Patch by Aleksei Sidorin, Ilya Palachev.

Differential Revision: https://reviews.llvm.org/D22090

llvm-svn: 280360
2016-09-01 12:25:16 +00:00
Aleksei Sidorin 689457659b [analyzer][test commit] ExprEngine.cpp: Remove training whitespace; NFC
llvm-svn: 280352
2016-09-01 11:11:46 +00:00
Devin Coughlin 719238b7d3 [analyzer] Weaken assertion in trackNullOrUndefValue()
We should ignore paren casts when making sure that the semantic expression
in a PseudoObjectExpr for an ObjC getter is a message send.

This has no other intended functionality change.

Adding a test for this exposed an interesting issue in another test case
that only manifests under ARC. trackNullOrUndefValue() is not properly
suppressing for nil values that are the result of nil propagation from a nil
receiver when the nil is returned from a function. I've added a FIXME for that
missing suppression.

rdar://problem/27290568

llvm-svn: 279181
2016-08-19 01:05:31 +00:00
Diana Picus 8b44bbc077 Revert "[OpenMP] Sema and parsing for 'teams distribute simd’ pragma"
This reverts commit r279003 as it breaks some of our buildbots (e.g.
clang-cmake-aarch64-quick, clang-x86_64-linux-selfhost-modules).

The error is in OpenMP/teams_distribute_simd_ast_print.cpp:
clang: /home/buildslave/buildslave/clang-cmake-aarch64-quick/llvm/include/llvm/ADT/DenseMap.h:527:
bool llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::LookupBucketFor(const LookupKeyT&, const BucketT*&) const
[with LookupKeyT = clang::Stmt*; DerivedT = llvm::DenseMap<clang::Stmt*, long unsigned int>;
      KeyT = clang::Stmt*; ValueT = long unsigned int;
      KeyInfoT = llvm::DenseMapInfo<clang::Stmt*>;
      BucketT = llvm::detail::DenseMapPair<clang::Stmt*, long unsigned int>]:
Assertion `!KeyInfoT::isEqual(Val, EmptyKey) && !KeyInfoT::isEqual(Val, TombstoneKey) &&
"Empty/Tombstone value shouldn't be inserted into map!"' failed.

llvm-svn: 279045
2016-08-18 09:25:07 +00:00
Kelvin Li 0e3bde8216 [OpenMP] Sema and parsing for 'teams distribute simd’ pragma
This patch is to implement sema and parsing for 'teams distribute simd’ pragma.

This patch is originated by Carlo Bertolli.

Differential Revision: https://reviews.llvm.org/D23528

llvm-svn: 279003
2016-08-17 23:13:03 +00:00
Artem Dergachev cbce96c3af [analyzer] Add LocationContext information to SymbolMetadata.
Like SymbolConjured, SymbolMetadata also needs to be uniquely
identified by the moment of its birth.

Such moments are coded by the (Statement, LocationContext, Block count) triples.
Each such triple represents the moment of analyzing a statement with a certain
call backtrace, with corresponding CFG block having been entered a given amount
of times during analysis of the current code body.

The LocationContext information was accidentally omitted for SymbolMetadata,
which leads to reincarnation of SymbolMetadata upon re-entering a code body
with a different backtrace; the new symbol is incorrectly unified with
the old symbol, which leads to unsound assumptions.

Patch by Alexey Sidorin!

Differential Revision: https://reviews.llvm.org/D21978

llvm-svn: 278937
2016-08-17 15:37:52 +00:00
Gabor Horvath c430990d0b [analyzer] Command line option to show enabled checker list.
This patch adds a command line option to list the checkers that were enabled
by analyzer-checker and not disabled by -analyzer-disable-checker.

It can be very useful to debug long command lines when it is not immediately
apparent which checkers are turned on and which checkers are turned off.

Differential Revision: https://reviews.llvm.org/D23060

llvm-svn: 278006
2016-08-08 13:41:04 +00:00
Gabor Horvath 44583ce65a [analyzer] Model base to derived casts more precisely.
Dynamic casts are handled relatively well by the static analyzer.
BaseToDerived casts however are treated conservatively. This can cause some
false positives with the NewDeleteLeaks checker.

This patch alters the behavior of BaseToDerived casts. In case a dynamic cast
would succeed use the same semantics. Otherwise fall back to the conservative
approach.

Differential Revision: https://reviews.llvm.org/D23014

llvm-svn: 277989
2016-08-08 09:22:59 +00:00
Benjamin Kramer 5251494969 [StaticAnalyzer] Remove dead code.
llvm-svn: 277917
2016-08-06 11:20:59 +00:00
Kelvin Li 0253287633 [OpenMP] Sema and parsing for 'teams distribute' pragma
This patch is to implement sema and parsing for 'teams distribute' pragma.

Differential Revision: https://reviews.llvm.org/D23189

llvm-svn: 277818
2016-08-05 14:37:37 +00:00
Yaxun Liu 0bc4b2d337 [OpenCL] Generate opaque type for sampler_t and function call for the initializer
Currently Clang use int32 to represent sampler_t, which have been a source of issue for some backends, because in some backends sampler_t cannot be represented by int32. They have to depend on kernel argument metadata and use IPA to find the sampler arguments and global variables and transform them to target specific sampler type.

This patch uses opaque pointer type opencl.sampler_t* for sampler_t. For each use of file-scope sampler variable, it generates a function call of __translate_sampler_initializer. For each initialization of function-scope sampler variable, it generates a function call of __translate_sampler_initializer.

Each builtin library can implement its own __translate_sampler_initializer(). Since the real sampler type tends to be architecture dependent, allowing it to be initialized by a library function simplifies backend design. A typical implementation of __translate_sampler_initializer could be a table lookup of real sampler literal values. Since its argument is always a literal, the returned pointer is known at compile time and easily optimized to finally become some literal values directly put into image read instructions.

This patch is partially based on Alexey Sotkin's work in Khronos Clang (3d4eec6162).

Differential Revision: https://reviews.llvm.org/D21567

llvm-svn: 277024
2016-07-28 19:26:30 +00:00
Artem Dergachev 7929bf22fb [analyzer] Pring LocationContext in ExplodedGraph dumps.
Remove some FIXMEs in the surrounding code,
which have been addressed long time ago
by introducing checker-specific tags.

Differential Revision: https://reviews.llvm.org/D22622

llvm-svn: 276557
2016-07-24 08:15:58 +00:00
Devin Coughlin f57f90dfd1 [analyzer] Add checker modeling potential C++ self-assignment
This checker checks copy and move assignment operators whether they are
protected against self-assignment. Since C++ core guidelines discourages
explicit checking for `&rhs==this` in general we take a different approach: in
top-frame analysis we branch the exploded graph for two cases, where &rhs==this
and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the
work. It is important that we check all copy and move assignment operator in top
frame even if we checked them already since self-assignments may happen
undetected even in the same translation unit (e.g. using random indices for an
array what may or may not be the same).

This reapplies r275820 after fixing a string-lifetime issue discovered by the
bots.

A patch by Ádám Balogh!

Differential Revision: https://reviews.llvm.org/D19311

llvm-svn: 276365
2016-07-21 23:42:31 +00:00
Kelvin Li 986330c190 [OpenMP] Sema and parsing for 'target simd' pragma
This patch is to implement sema and parsing for 'target simd' pragma.

Differential Revision: https://reviews.llvm.org/D22479

llvm-svn: 276203
2016-07-20 22:57:10 +00:00
Mehdi Amini 9670f847b8 [NFC] Header cleanup
Summary: Removed unused headers, replaced some headers with forward class declarations

Patch by: Eugene <claprix@yandex.ru>

Differential Revision: https://reviews.llvm.org/D20100

llvm-svn: 275882
2016-07-18 19:02:11 +00:00
Devin Coughlin d2387432bb Revert "[analyzer] Add checker modeling potential C++ self-assignment"
This reverts commit r275820. It is failing on the bots.

llvm-svn: 275880
2016-07-18 18:57:50 +00:00
Devin Coughlin eea0737a34 [analyzer] Add checker modeling potential C++ self-assignment
This checker checks copy and move assignment operators whether they are
protected against self-assignment. Since C++ core guidelines discourages
explicit checking for `&rhs==this` in general we take a different approach: in
top-frame analysis we branch the exploded graph for two cases, where &rhs==this
and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the
work. It is important that we check all copy and move assignment operator in top
frame even if we checked them already since self-assignments may happen
undetected even in the same translation unit (e.g. using random indices for an
array what may or may not be the same).

A patch by Ádám Balogh!

Differential Revision: https://reviews.llvm.org/D19311

llvm-svn: 275820
2016-07-18 17:23:30 +00:00
Erik Pilkington 29099ded0c [ObjC] Implement @available in the Parser and AST
This patch adds a new AST node: ObjCAvailabilityCheckExpr, and teaches the
Parser and Sema to generate it. This node represents an availability check of
the form:

  @available(macos 10.10, *);

Which will eventually compile to a runtime check of the host's OS version. This
is the first patch of the feature I proposed here:
http://lists.llvm.org/pipermail/cfe-dev/2016-July/049851.html

Differential Revision: https://reviews.llvm.org/D22171

llvm-svn: 275654
2016-07-16 00:35:23 +00:00
Kelvin Li a579b9196c [OpenMP] Sema and parsing for 'target parallel for simd' pragma
This patch is to implement sema and parsing for 'target parallel for simd' pragma.

Differential Revision: http://reviews.llvm.org/D22096

llvm-svn: 275365
2016-07-14 02:54:56 +00:00
Devin Coughlin cad622742e [analyzer] Add rudimentary handling of AtomicExpr.
This proposed patch adds crude handling of atomics to the static analyzer.
Rather than ignore AtomicExprs, as we now do, this patch causes the analyzer
to escape the arguments. This is imprecise -- and we should model the
expressions fully in the future -- but it is less wrong than ignoring their
effects altogether.

This is rdar://problem/25353187

Differential Revision: http://reviews.llvm.org/D21667

llvm-svn: 274816
2016-07-08 00:53:18 +00:00
Devin Coughlin 0a53fdf00c [analyzer] Suppress false positives in std::shared_ptr
The analyzer does not model C++ temporary destructors completely and so
reports false alarms about leaks of memory allocated by the internals of
shared_ptr:

  std::shared_ptr<int> p(new int(1));
  p = nullptr; // 'Potential leak of memory pointed to by field __cntrl_'

This patch suppresses all diagnostics where the end of the path is inside
a method in std::shared_ptr.

It also reorganizes the tests for suppressions in the C++ standard library
to use a separate simulated header for library functions with bugs
that were deliberately inserted to test suppression. This will prevent
other tests from using these as models.

rdar://problem/23652766

llvm-svn: 274691
2016-07-06 21:52:55 +00:00
Kelvin Li 787f3fcc6b [OpenMP] Sema and parsing for 'distribute simd' pragma
Summary: This patch is an implementation of sema and parsing for the OpenMP composite pragma 'distribute simd'.

Differential Revision: http://reviews.llvm.org/D22007

llvm-svn: 274604
2016-07-06 04:45:38 +00:00
Kelvin Li 4a39add05e [OpenMP] Sema and parse for 'distribute parallel for simd'
Summary: This patch is an implementation of sema and parsing for the OpenMP composite pragma 'distribute parallel for simd'.

Differential Revision: http://reviews.llvm.org/D21977

llvm-svn: 274530
2016-07-05 05:00:15 +00:00
Richard Smith 5179eb7821 P0136R1, DR1573, DR1645, DR1715, DR1736, DR1903, DR1941, DR1959, DR1991:
Replace inheriting constructors implementation with new approach, voted into
C++ last year as a DR against C++11.

Instead of synthesizing a set of derived class constructors for each inherited
base class constructor, we make the constructors of the base class visible to
constructor lookup in the derived class, using the normal rules for
using-declarations.

For constructors, UsingShadowDecl now has a ConstructorUsingShadowDecl derived
class that tracks the requisite additional information. We create shadow
constructors (not found by name lookup) in the derived class to model the
actual initialization, and have a new expression node,
CXXInheritedCtorInitExpr, to model the initialization of a base class from such
a constructor. (This initialization is special because it performs real perfect
forwarding of arguments.)

In cases where argument forwarding is not possible (for inalloca calls,
variadic calls, and calls with callee parameter cleanup), the shadow inheriting
constructor is not emitted and instead we directly emit the initialization code
into the caller of the inherited constructor.

Note that this new model is not perfectly compatible with the old model in some
corner cases. In particular:
 * if B inherits a private constructor from A, and C uses that constructor to
   construct a B, then we previously required that A befriends B and B
   befriends C, but the new rules require A to befriend C directly, and
 * if a derived class has its own constructors (and so its implicit default
   constructor is suppressed), it may still inherit a default constructor from
   a base class

llvm-svn: 274049
2016-06-28 19:03:57 +00:00
Carlo Bertolli 9925f15661 Resubmission of http://reviews.llvm.org/D21564 after fixes.
[OpenMP] Initial implementation of parse and sema for composite pragma 'distribute parallel for'

This patch is an initial implementation for #distribute parallel for.
The main differences that affect other pragmas are:

The implementation of 'distribute parallel for' requires blocking of the associated loop, where blocks are "distributed" to different teams and iterations within each block are scheduled to parallel threads within each team. To implement blocking, sema creates two additional worksharing directive fields that are used to pass the team assigned block lower and upper bounds through the outlined function resulting from 'parallel'. In this way, scheduling for 'for' to threads can use those bounds.
As a consequence of blocking, the stride of 'distribute' is not 1 but it is equal to the blocking size. This is returned by the runtime and sema prepares a DistIncrExpr variable to hold that value.
As a consequence of blocking, the global upper bound (EnsureUpperBound) expression of the 'for' is not the original loop upper bound (e.g. in for(i = 0 ; i < N; i++) this is 'N') but it is the team-assigned block upper bound. Sema creates a new expression holding the calculation of the actual upper bound for 'for' as UB = min(UB, PrevUB), where UB is the loop upper bound, and PrevUB is the team-assigned block upper bound.

llvm-svn: 273884
2016-06-27 14:55:37 +00:00
Carlo Bertolli b8503d5399 Revert r273705
[OpenMP] Initial implementation of parse and sema for composite pragma 'distribute parallel for'

llvm-svn: 273709
2016-06-24 19:20:02 +00:00
Carlo Bertolli e77d6e0e4d [OpenMP] Initial implementation of parse and sema for composite pragma 'distribute parallel for'
http://reviews.llvm.org/D21564

This patch is an initial implementation for #distribute parallel for.
The main differences that affect other pragmas are:

The implementation of 'distribute parallel for' requires blocking of the associated loop, where blocks are "distributed" to different teams and iterations within each block are scheduled to parallel threads within each team. To implement blocking, sema creates two additional worksharing directive fields that are used to pass the team assigned block lower and upper bounds through the outlined function resulting from 'parallel'. In this way, scheduling for 'for' to threads can use those bounds.
As a consequence of blocking, the stride of 'distribute' is not 1 but it is equal to the blocking size. This is returned by the runtime and sema prepares a DistIncrExpr variable to hold that value.
As a consequence of blocking, the global upper bound (EnsureUpperBound) expression of the 'for' is not the original loop upper bound (e.g. in for(i = 0 ; i < N; i++) this is 'N') but it is the team-assigned block upper bound. Sema creates a new expression holding the calculation of the actual upper bound for 'for' as UB = min(UB, PrevUB), where UB is the loop upper bound, and PrevUB is the team-assigned block upper bound.

llvm-svn: 273705
2016-06-24 18:53:35 +00:00