Commit Graph

57 Commits

Author SHA1 Message Date
Gabor Horvath 9fdcae7c81 [analyzer] Do not cache out on some shared implicit AST nodes
Some AST nodes which stands for implicit initialization is shared. The analyzer
will do the same evaluation on the same nodes resulting in the same state. The
analyzer will "cache out", i.e. it thinks that it visited an already existing
node in the exploded graph. This is not true in this case and we lose coverage.
Since these nodes do not really require any processing from the analyzer
we just omit them from the CFG.

Differential Revision: https://reviews.llvm.org/D71371
2019-12-11 17:15:12 -08:00
Richard Smith 7ed5fb2d22 Add missing temporary materialization conversion on left-hand side of .
in some member function calls.

Specifically, when calling a conversion function, we would fail to
create the AST node representing materialization of the class object.

llvm-svn: 338135
2018-07-27 17:13:18 +00:00
Artem Dergachev d18639bd13 [CFG] [analyzer] Simplify lifetime-extended temporary construction contexts.
When a temporary object is materialized and through that obtain lifetime that
is longer than the duration of the full-expression, it does not require a
temporary object destructor; it will be destroyed in a different manner.

Therefore it's not necessary to include CXXBindTemporaryExpr into the
construction context for such temporary in the CFG only to make clients
throw it away.

Differential Revision: https://reviews.llvm.org/D47667

llvm-svn: 335798
2018-06-28 00:18:52 +00:00
Artem Dergachev ff267df0de [CFG] [analyzer] Add construction contexts that explain pre-C++17 copy elision.
Before C++17 copy elision was optional, even if the elidable copy/move
constructor had arbitrary side effects. The elidable constructor is present
in the AST, but marked as elidable.

In these cases CFG now contains additional information that allows its clients
to figure out if a temporary object is only being constructed so that to pass
it to an elidable constructor. If so, it includes a reference to the elidable
constructor's construction context, so that the client could elide the
elidable constructor and construct the object directly at its final destination.

Differential Revision: https://reviews.llvm.org/D47616

llvm-svn: 335795
2018-06-28 00:04:54 +00:00
Alexander Kornienko a61d4c959a Remove explicit cfg-temporary-dtors=true
Summary:
Remove explicit -analyzer-config cfg-temporary-dtors=true in analyzer tests,
since this option defaults to true since r326461.

Reviewers: NoQ

Reviewed By: NoQ

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D46393

llvm-svn: 331520
2018-05-04 14:13:14 +00:00
Artem Dergachev 9d3a7d8b2b [CFG] [analyzer] Avoid modeling C++17 constructors that aren't fully supported.
Not enough work has been done so far to ensure correctness of construction
contexts in the CFG when C++17 copy elision is in effect, so for now we
should drop construction contexts in the CFG and in the analyzer when
they seem different from what we support anyway.

This includes initializations with conditional operators and return values
across multiple stack frames.

Differential Revision: https://reviews.llvm.org/D44854

llvm-svn: 328893
2018-03-30 19:21:18 +00:00
Artem Dergachev 54ed6428b4 [CFG] [analyzer] Don't add construction context to a return-by-reference call.
Call expressions that return objects by an lvalue reference or an rvalue
reference have a value type in the AST but wear an auxiliary flag of being an
lvalue or an xvalue respectively.

Use the helper method for obtaining the actual return type of the function.

Fixes a crash.

Differential Revision: https://reviews.llvm.org/D44273

llvm-svn: 327352
2018-03-12 23:52:36 +00:00
Artem Dergachev 1527dec139 [CFG] [analyzer] Add construction context to C++ return-by-value call elements.
This patch adds a new CFGStmt sub-class, CFGCXXRecordTypedCall, which replaces
the regular CFGStmt for the respective CallExpr whenever the CFG has additional
information to provide regarding the lifetime of the returned value.

This additional call site information is represented by a ConstructionContext
(which was previously used for CFGConstructor elements) that provides references
to CXXBindTemporaryExpr and MaterializeTemporaryExpr that surround the call.

This corresponds to the common C++ calling convention solution of providing
the target address for constructing the return value as an auxiliary implicit
argument during function call.

One of the use cases for such extra context at the call site would be to perform
any sort of inter-procedural analysis over the CFG that involves functions
returning objects by value. In this case the elidable constructor at the return
site would construct the object explained by the context at the call site, and
its lifetime would also be managed by the caller, not the callee.

The extra context would also be useful for properly handling the return-value
temporary at the call site, even if the callee is not being analyzed
inter-procedurally.

Differential Revision: https://reviews.llvm.org/D44120

llvm-svn: 327343
2018-03-12 23:12:40 +00:00
Artem Dergachev a6d91d5b30 [CFG] Provide construction contexts for temporaries in conditional operators.
When a lifetime-extended temporary is on a branch of a conditional operator,
materialization of such temporary occurs after the condition is resolved.

This change allows us to understand, by including the MaterializeTemporaryExpr
in the construction context, the target for temporary materialization in such
cases.

Differential Revision: https://reviews.llvm.org/D43483

llvm-svn: 326019
2018-02-24 03:10:15 +00:00
Artem Dergachev 8cc55e9f16 [CFG] Provide construction contexts for temporaries bound to const references.
In order to bind a temporary to a const lvalue reference, a no-op cast is added
to make the temporary itself const, and only then the reference is taken
(materialized). Skip the no-op cast when looking for the construction context.

Differential Revision: https://reviews.llvm.org/D43481

llvm-svn: 326016
2018-02-24 02:07:50 +00:00
Artem Dergachev f43ac4c9ac [CFG] Provide construction contexts for lifetime-extended temporaries.
When constructing a temporary that is going to be lifetime-extended through a
MaterializeTemporaryExpr later, CFG elements for the respective constructor
can now be queried to obtain the reference to that MaterializeTemporaryExpr
and therefore gain information about lifetime extension.

This may produce multi-layered construction contexts when information about
both temporary destruction and lifetime extension is available.

Differential Revision: https://reviews.llvm.org/D43477

llvm-svn: 326014
2018-02-24 02:00:30 +00:00
Artem Dergachev 1f68d9d39e [CFG] Provide construction contexts for temproary objects.
Constructors of C++ temporary objects that have destructors now can be queried
to discover that they're indeed constructing temporary objects.

The respective CXXBindTemporaryExpr, which is also repsonsible for destroying
the temporary at the end of full-expression, is now available at the
construction site in the CFG. This is all the context we need to provide for
temporary objects that are not lifetime extended. For lifetime-extended
temporaries, more context is necessary.

Differential Revision: https://reviews.llvm.org/D43056

llvm-svn: 325210
2018-02-15 03:13:36 +00:00
Artem Dergachev 9ac2e11385 [CFG] Provide construction contexts for return value constructors.
When the current function returns a C++ object by value, CFG elements for
constructors that construct the return values can now be queried to discover
that they're indeed participating in construction of the respective return value
at the respective return statement.

Differential Revision: https://reviews.llvm.org/D42875

llvm-svn: 324952
2018-02-12 22:36:36 +00:00
Artem Dergachev 08225bbed4 [CFG] Provide construction contexts when constructors have cleanups.
Now that we make it possible to query the CFG constructor element to find
information about the construction site, possible cleanup work represented by
ExprWithCleanups should not prevent us from providing this information.

This allows us to have a correct construction context for variables initialized
"by value" via elidable copy-constructors, such as 'i' in

  iterator i = vector.begin();

Differential Revision: https://reviews.llvm.org/D42719

llvm-svn: 324798
2018-02-10 02:46:14 +00:00
Richard Smith 72db888389 PR35039: Materialize temporary objects before wrapping them in an
OpaqueValueExpr in a GNU binary conditional expression.

It's not meaningful for a non-materialized temporary object to be used as a
common subexpression of multiple expressions.

llvm-svn: 316836
2017-10-28 18:59:51 +00:00
Dominic Chen 184c6242fa Reland 4: [analyzer] NFC: Update test infrastructure to support multiple constraint managers
Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952.

Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin

Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits

Differential Revision: https://reviews.llvm.org/D30373

llvm-svn: 296895
2017-03-03 18:02:02 +00:00
Dominic Chen 09d66f7528 Revert "Reland 3: [analyzer] NFC: Update test infrastructure to support multiple constraint managers"
This reverts commit ea36f1406e1f36bf456c3f3929839b024128e468.

llvm-svn: 296841
2017-03-02 23:30:53 +00:00
Dominic Chen feaf9ff5ee Reland 3: [analyzer] NFC: Update test infrastructure to support multiple constraint managers
Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952.

Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin

Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits

Differential Revision: https://reviews.llvm.org/D30373

llvm-svn: 296837
2017-03-02 23:05:45 +00:00
Dominic Chen 4a90bf8c3f Revert "Reland 2: [analyzer] NFC: Update test infrastructure to support multiple constraint managers"
This reverts commit f93343c099fff646a2314cc7f4925833708298b1.

llvm-svn: 296836
2017-03-02 22:58:06 +00:00
Dominic Chen 1cb0256a3c Reland 2: [analyzer] NFC: Update test infrastructure to support multiple constraint managers
Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952.

Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin

Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits

Differential Revision: https://reviews.llvm.org/D30373

llvm-svn: 296835
2017-03-02 22:45:24 +00:00
Dominic Chen 00355a51d0 Revert "Reland: [analyzer] NFC: Update test infrastructure to support multiple constraint managers"
This reverts commit 1b28d0b10e1c8feccb971abb6ef7a18bee589830.

llvm-svn: 296422
2017-02-28 01:50:23 +00:00
Dominic Chen 59cd893320 Reland: [analyzer] NFC: Update test infrastructure to support multiple constraint managers
Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952.

Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin

Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits

Differential Revision: https://reviews.llvm.org/D30373

llvm-svn: 296414
2017-02-28 00:02:36 +00:00
Dominic Chen 8589e10c30 Revert "[analyzer] NFC: Update test infrastructure to support multiple constraint managers"
This reverts commit 8e7780b9e59ddaad1800baf533058d2c064d4787.

llvm-svn: 296317
2017-02-27 03:29:25 +00:00
Dominic Chen 02064a3076 [analyzer] NFC: Update test infrastructure to support multiple constraint managers
Summary: Replace calls to %clang/%clang_cc1 with %clang_analyze_cc1 when invoking static analyzer, and perform runtime substitution to select the appropriate constraint manager, per D28952.

Reviewers: xazax.hun, NoQ, zaks.anna, dcoughlin

Subscribers: mgorny, rgov, mikhail.ramalho, a.sidorin, cfe-commits

Differential Revision: https://reviews.llvm.org/D30373

llvm-svn: 296312
2017-02-27 02:36:15 +00:00
Richard Smith 4baaa5ab52 DR616, and part of P0135R1: member access (or pointer-to-member access) on a
temporary produces an xvalue, not a prvalue. Support this by materializing the
temporary prior to performing the member access.

llvm-svn: 288563
2016-12-03 01:14:32 +00:00
Richard Smith 301bc21fd0 Make Sema::getPrintingPolicy less ridiculously expensive. This used to perform
an identifier table lookup, *and* copy the LangOptions (including various
std::vector<std::string>s). Twice. We call this function once each time we start
parsing a declaration specifier sequence, and once for each call to Sema::Diag.

This reduces the compile time for a sample .c file from the linux kernel by 20%.

llvm-svn: 270009
2016-05-19 01:39:10 +00:00
Charles Li 430db1e717 [Tests] Modified Lit Tests to be C++11 compatibile
This 2nd patch should not change the test results, but it is useful if clang's
default C++ language is ever changed from gnu++98.

llvm-svn: 246183
2015-08-27 18:49:15 +00:00
Manuel Klimek b5616c9f8d Re-applying r214962.
Changes to the original patch:
- model the CFG for temporary destructors in conditional operators so that
  the destructors of the true and false branch are always exclusive. This
  is necessary because we must not have impossible paths for the path
  based analysis to work.
- add multiple regression tests with ternary operators

Original description:
Fix modelling of non-lifetime-extended temporary destructors in the
analyzer.

Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 215096
2014-08-07 10:42:17 +00:00
Rui Ueyama a89f9c8fdb Revert "Fix modelling of non-lifetime-extended temporary destructors in the analyzer."
This reverts commit r214962 because after the change the
following code doesn't compile with -Wreturn-type -Werror.

  #include <cstdlib>

  class NoReturn {
  public:
    ~NoReturn() __attribute__((noreturn)) { exit(1); }
  };

  int check() {
    true ? NoReturn() : NoReturn();
  }

llvm-svn: 214998
2014-08-06 22:01:54 +00:00
Manuel Klimek d9b4ad6e1f Fix modelling of non-lifetime-extended temporary destructors in the analyzer.
1. Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 214962
2014-08-06 12:45:51 +00:00
Manuel Klimek 75f34c1386 Fix handling of condition variables in the face of temp dtors.
The assignment needs to be before the destruction of the temporary.
This patch calls out to addStmt, which invokes VisitDeclStmt, which has
all the correct logic for handling temporaries.

llvm-svn: 207985
2014-05-05 18:21:06 +00:00
Jordan Rose 398fb00e1e [analyzer] Fix a CFG printing bug.
Also, add several destructor-related tests. Most of them don't work yet, but it's
good to have them recorded.

Patch by Alex McCarthy!

llvm-svn: 205326
2014-04-01 16:39:33 +00:00
Ted Kremenek fcc1417fad Fix CFG bug where the 'isTemporaryDtorsBranch' bit was silently lost for terminators.
llvm-svn: 203335
2014-03-08 02:22:29 +00:00
Benjamin Kramer 00e8a1915a Reapply "Pretty Printer: Fix printing of conversion operator decls and calls."
There were many additional tests that had the bad behavior baked in.

llvm-svn: 202174
2014-02-25 18:03:55 +00:00
Nico Rieck 40ec9188b6 Remove useless XPASS
llvm-svn: 201478
2014-02-16 07:29:55 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
Jordan Rose 7b982b30c0 Revert "[analyzer] Add very limited support for temporary destructors"
The analyzer doesn't currently expect CFG blocks with terminators to be
empty, but this can happen when generating conditional destructors for
a complex logical expression, such as (a && (b || Temp{})). Moreover,
the branch conditions for these expressions are not persisted in the
state. Even for handling noreturn destructors this needs more work.

This reverts r186498.

llvm-svn: 186925
2013-07-23 02:15:11 +00:00
Pavel Labath 9ced602cc6 [analyzer] Add very limited support for temporary destructors
Summary:
This patch enables ExprEndgine to reason about temporary object destructors.
However, these destructor calls are never inlined, since this feature is still
broken. Still, this is sufficient to properly handle noreturn temporary
destructors and close bug #15599. I have also enabled the cfg-temporary-dtors
analyzer option by default.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1131

llvm-svn: 186498
2013-07-17 08:33:58 +00:00
Ted Kremenek 8ae67871b4 Change subexpressions to be visited in the CFG from left-to-right.
This is a more natural order of evaluation, and it is very important
for visualization in the static analyzer.  Within Xcode, the arrows
will not jump from right to left, which looks very visually jarring.
It also provides a more natural location for dataflow-based diagnostics.

Along the way, we found a case in the analyzer diagnostics where we
needed to indicate that a variable was "captured" by a block.

-fsyntax-only timings on sqlite3.c show no visible performance change,
although this is just one test case.

Fixes <rdar://problem/13016513>

llvm-svn: 174447
2013-02-05 22:00:19 +00:00
Dmitri Gribenko 7146930591 Comment parsing: actually check for a block command after "\param x"
This fixes PR15068.

llvm-svn: 173539
2013-01-26 00:36:14 +00:00
Dmitri Gribenko c9f860d124 Remove useless 'XPASS: *' from tests
llvm-svn: 173511
2013-01-25 22:20:24 +00:00
Jordan Rose 1e0e4001c8 [analyzer] For now, don't inline C++ standard library functions.
This is a (heavy-handed) solution to PR13724 -- until we know we can do
a good job inlining the STL, it's best to be consistent and not generate
more false positives than we did before. We can selectively whitelist
certain parts of the 'std' namespace that are known to be safe.

This is controlled by analyzer config option 'c++-stdlib-inlining', which
can be set to "true" or "false".

This commit also adds control for whether or not to inline any templated
functions (member or non-member), under the config option
'c++-template-inlining'. This option is currently on by default.

llvm-svn: 163548
2012-09-10 21:27:35 +00:00
Jordan Rose 6d671cc34a [analyzer] Always include destructors in the analysis CFG.
While destructors will continue to not be inlined (unless the analyzer
config option 'c++-inlining' is set to 'destructors'), leaving them out
of the CFG is an incomplete model of the behavior of an object, and
can cause false positive warnings (like PR13751, now working).

Destructors for temporaries are still not on by default, since
(a) we haven't actually checked this code to be sure it's fully correct
    (in particular, we probably need to be very careful with regard to
    lifetime-extension when a temporary is bound to a reference,
    C++11 [class.temporary]p5), and
(b) ExprEngine doesn't actually do anything when it sees a temporary
    destructor in the CFG -- not even invalidate the object region.

To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer
config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which
controlled all implicit destructors, has been removed.

llvm-svn: 163264
2012-09-05 22:55:23 +00:00
Jordan Rose a765bac7a1 [analyzer] Turn -cfg-add-initializers on by default, and remove the flag.
llvm-svn: 161060
2012-07-31 18:04:59 +00:00
Ted Kremenek b50e716bac Refine CFG so that '&&' and '||' don't lead to extra confluence points when used in a branch, but
instead push the terminator for the branch down into the basic blocks of the subexpressions of '&&' and '||'
respectively.  This eliminates some artifical control-flow from the CFG and results in a more
compact CFG.

Note that this patch only alters the branches 'while', 'if' and 'for'.  This was complex enough for
one patch.  The remaining branches (e.g., do...while) can be handled in a separate patch, but they
weren't immediately tackled because they were less important.

It is possible that this patch introduces some subtle bugs, particularly w.r.t. to destructor placement.
I've tried to audit these changes, but it is also known that the destructor logic needs some refinement
in the area of '||' and '&&' regardless (i.e., their are known bugs).

llvm-svn: 160218
2012-07-14 05:04:10 +00:00
Zhongxing Xu f0cb43f561 Add elidable CXXConstructExpr as block-level expr. It converts an lvalue to a rvalue, which is a useful step during AST evaluation.
llvm-svn: 147918
2012-01-11 02:39:07 +00:00
Ted Kremenek 72be32af88 Colorize and condense CFG pretty-printing.
llvm-svn: 147203
2011-12-22 23:33:52 +00:00
Ted Kremenek f551f326fc Per an offline conversation with John McCall, have StmtPrinter actually print out the source expression for OpaqueValueExpr.
llvm-svn: 145524
2011-11-30 22:08:08 +00:00
Abramo Bagnara b0cf297654 Added missing ImplicitCastExpr around conversion operator call.
llvm-svn: 144850
2011-11-16 22:46:05 +00:00
Ted Kremenek 04268232df Per discussion with John McCall, don't add OpaqueValueExprs to the CFG.
llvm-svn: 143766
2011-11-05 00:10:15 +00:00