Commit Graph

27 Commits

Author SHA1 Message Date
Chris Lattner 3dd48bd169 "I see dead code". IdempotentOperationChecker::isTruncationExtensionAssignment
should probably be removed if it has no purpose, but I just #if'd it out
in case it's usefulIdempotentOperationChecker::isTruncationExtensionAssignment
should probably be removed if it has no purpose, but I just #if'd it out
in case it's useful

llvm-svn: 112949
2010-09-03 04:34:38 +00:00
Ted Kremenek 07343c02be For GRExprEngine::EvalBind() (and called visitors), unifiy StoreE and AssignE. Now StoreE (const Stmt*) represents the expression where the store took place, which is the assignment expression if it takes place in an assignment. This removes some conceptual dissidence as well as removes an extra parameter from the Checker::PreVisitBind() visitor. It also improves ranges and source location information in analyzer diagnostics.
llvm-svn: 112789
2010-09-02 00:56:20 +00:00
John McCall e302792b61 GCC didn't care for my attempt at API compatibility, so brute-force everything
to the new constants.

llvm-svn: 112047
2010-08-25 11:45:40 +00:00
Alexis Hunt dcfba7b35b Generate Attr subclasses with TableGen.
Now all classes derived from Attr are generated from TableGen.
Additionally, Attr* is no longer its own linked list; SmallVectors or
Attr* are used. The accompanying LLVM commit contains the updates to
TableGen necessary for this.

Some other notes about newly-generated attribute classes:

 - The constructor arguments are a SourceLocation and a Context&,
   followed by the attributes arguments in the order that they were
   defined in Attr.td

 - Every argument in Attr.td has an appropriate accessor named getFoo,
   and there are sometimes a few extra ones (such as to get the length
   of a variadic argument).

Additionally, specific_attr_iterator has been introduced, which will
iterate over an AttrVec, but only over attributes of a certain type. It
can be accessed through either Decl::specific_attr_begin/end or
the global functions of the same name.

llvm-svn: 111455
2010-08-18 23:23:40 +00:00
Jordy Rose 8258499f42 Remove dead malloc symbols from the symbol-state map.
llvm-svn: 111353
2010-08-18 04:33:47 +00:00
Jordy Rose bc80329f1f Use RegionStateTy everywhere we mean ImmutableMap<SymbolRef, RefState>
llvm-svn: 111351
2010-08-18 04:26:59 +00:00
Zhongxing Xu a66d1694f4 Generate a node instead of a sink. A leak is not a fatal error.
llvm-svn: 111217
2010-08-17 00:36:37 +00:00
Zhongxing Xu bce831f7e0 Implement MallocChecker::EvalDeadSymbols() with the new API. This time we
iterate over symbols being tracked, instead of symbols being dead.

llvm-svn: 111097
2010-08-15 08:19:57 +00:00
Jordy Rose 5af0e3cbba Remove OwnershipAttr::Kind, since it's essentially redundant with attr::Kind the way it's being used. Also fix isa<OwnershipAttr> support, break more-than-80-char lines, and other miscellaneous ownership attr cleanup.
llvm-svn: 110908
2010-08-12 08:54:03 +00:00
Ted Kremenek 0bbf24d579 Fix 80 col. violations.
llvm-svn: 110473
2010-08-06 21:12:55 +00:00
Ted Kremenek 63dc1f4694 Nest variable declaration into into 'if' condition, thus restricting the scope of the variable and condensing the code.
llvm-svn: 110472
2010-08-06 21:12:53 +00:00
Ted Kremenek b0c67c85db Use 'GenerateNode()' instead of 'GenerateSink()' when reporting a leak. A leak is not a hard enough bug to stop analyzing a path.
llvm-svn: 110471
2010-08-06 21:12:49 +00:00
Jordy Rose c36df4d0b7 Change the checker callback cache in GRExprEngine to be more compact (and IMHO a little easier to understand), and add the same sort of caching for EvalAssume (tied for least-used callback), mostly as proof-of-concept.
Before we go further with these, we should figure out a way to reuse the visit-and-cache code in CheckerVisit.

llvm-svn: 110191
2010-08-04 07:10:57 +00:00
Ted Kremenek d21139a34f After a lengthy design discussion, add support for "ownership attributes" for malloc/free checking. Patch by Andrew McGregor!
llvm-svn: 109939
2010-07-31 01:52:11 +00:00
Jordy Rose 674bd55f02 Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.
Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577
2010-07-04 00:00:41 +00:00
Ted Kremenek bd862711fd Fix PR 7475 by enhancing the static analyzer to also invalidate bindings for non-static global variables
when calling a function/method whose impact on global variables we cannot accurately estimate.
This change introduces two new MemSpaceRegions that divide up the memory space of globals, and causes
RegionStore and BasicStore to consult a binding to the NonStaticGlobalsMemSpaceRegion when lazily
determining the value of a global.

llvm-svn: 107423
2010-07-01 20:16:50 +00:00
Jordy Rose f7488ec6dc Add an ivar to SymbolReaper for the current statement, and then stop passing the current statement around everywhere. Preparation for symbolic extents.
llvm-svn: 107422
2010-07-01 20:09:55 +00:00
Jordy Rose 954238366b Code cleanup: remove explicit flush() in favor of using the ostream's str()
llvm-svn: 105657
2010-06-08 22:59:01 +00:00
Jordy Rose 3597b21f20 Catch free()s on non-regions and regions known to be not from malloc(), by checking the symbol type and memory space.
llvm-svn: 105547
2010-06-07 19:32:37 +00:00
Zhongxing Xu 527ff6d1dc Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.

llvm-svn: 105264
2010-06-01 03:01:33 +00:00
Zhongxing Xu 6e8417c0e5 Relax an assertion. Various cases could lead to non-symbol values.
llvm-svn: 103707
2010-05-13 08:26:32 +00:00
Benjamin Kramer c048322523 Checker: random include cleanup.
llvm-svn: 99731
2010-03-27 21:19:47 +00:00
Zhongxing Xu 1bb6a1a593 Add use-after-free check to MallocChecker.
llvm-svn: 98136
2010-03-10 04:58:55 +00:00
Zhongxing Xu be36ecbb60 Fix pr6293. If ptr is NULL, no operation is preformed.
llvm-svn: 96154
2010-02-14 06:49:48 +00:00
Ted Kremenek 57f0989c16 Revert 95541.
llvm-svn: 95545
2010-02-08 16:18:51 +00:00
Zhongxing Xu 500f49fe25 Rename: GRState::getSVal(Stmt*) => getExprVal(),
GRState::getSVal(MemRegion*) => Load().

llvm-svn: 95541
2010-02-08 09:30:02 +00:00
Ted Kremenek d6b8708643 Split libAnalysis into two libraries: libAnalysis and libChecker.
(1) libAnalysis is a generic analysis library that can be used by
    Sema.  It defines the CFG, basic dataflow analysis primitives, and
    inexpensive flow-sensitive analyses (e.g. LiveVariables).

(2) libChecker contains the guts of the static analyzer, incuding the
    path-sensitive analysis engine and domain-specific checks.

Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.

This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker.  More changes pending.  :)

This change also exposed a layering violation between AnalysisContext
and MemRegion.  BlockInvocationContext shouldn't explicitly know about
BlockDataRegions.  For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet).  We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.

llvm-svn: 94406
2010-01-25 04:41:41 +00:00