Commit Graph

371 Commits

Author SHA1 Message Date
Ted Kremenek dd51f7cca2 Remove stale FIXME.
llvm-svn: 86595
2009-11-09 21:56:44 +00:00
Zhongxing Xu f06c684a33 Add checker for CWE-588: Attempt to Access Child of a Non-structure Pointer.
llvm-svn: 86529
2009-11-09 08:07:38 +00:00
Ted Kremenek ae3361de2d Remove Checker::CheckType() (and instead using CheckerVisitor::PreVisitDeclStmt()), and refactor VLASizeChecker to have only one Checker subclass (not two) and to not use the node builders directly (and instead use the newer CheckerContext).
llvm-svn: 86329
2009-11-07 03:56:57 +00:00
Ted Kremenek bee01e5b61 static analyzer: refactor checking logic for returning the address of a stack variable or a garbage
value into their own respective subclasses of Checker (and put them in .cpp files where their
implementation details are hidden from GRExprEngine).

llvm-svn: 86215
2009-11-06 02:24:13 +00:00
Ted Kremenek 209e31b883 Modify GRExprEngine::EvalBind() to take both a "store expression" and
an "assign expression", representing the expressions where the value
binding occurs and the assignment takes place respectively.  These are
largely syntactic clues for better error reporting.

llvm-svn: 86084
2009-11-05 00:42:23 +00:00
Ted Kremenek ef910047b2 Catch uses of undefined values when they are used in assignment, thus catching such bugs closer to the source.
llvm-svn: 86003
2009-11-04 04:24:16 +00:00
Ted Kremenek b006b82daf Refactor StoreManager::BindDecl() to take a VarRegion* instead of a VarDecl*, and modify GRExprEngine::EvalBind() to handle decl initialization as well. This paves the way for adding "checker" visitation in EvalBind().
llvm-svn: 85983
2009-11-04 00:09:15 +00:00
Ted Kremenek 0fbbb0877d Change GRTransferFuncs::RegisterChecks() to take a GRExprEngine& instead of a BugReporter&. This paves the way for pulling some of the retain/release checker into a "Checker" class.
llvm-svn: 85971
2009-11-03 23:30:34 +00:00
Zhongxing Xu 27fee83ec4 Pull VLA size checker into its own files.
Split it to two checkers, one for undefined size, 
the other for zero size, so that we don't need to query the size
when emitting the bug report.

llvm-svn: 85895
2009-11-03 12:13:38 +00:00
Ted Kremenek 18c7ceee16 Implement: <rdar://problem/6250216> Warn against using -[NSAutoreleasePool release] in GC mode
llvm-svn: 85887
2009-11-03 08:03:59 +00:00
Ted Kremenek fac290d359 Remove GRExprEngine::CheckerVisitLocation(). It was only called in one place, so we inlined it in to GRExprEngine::EvalLocation().
llvm-svn: 85838
2009-11-02 23:19:29 +00:00
Ted Kremenek 5c2040b182 Tighten computation of ExprVal using ?: expression. No functionality change.
llvm-svn: 85618
2009-10-30 22:01:29 +00:00
Ted Kremenek 6f2a705a24 Make checkers run in deterministic order.
llvm-svn: 85597
2009-10-30 17:47:32 +00:00
Zhongxing Xu b9eda67380 Fix PR5316: make assignment expressions can be visited as lvalue. Then we
can get the correct base lvalue.
Revert r85578.

llvm-svn: 85579
2009-10-30 07:19:39 +00:00
Ted Kremenek e96a30a531 Handle loading of field values from LazyCompoundVals in GRExprEngine::VisitMemberExpr().
This fixes the crash reported in PR 5316.

llvm-svn: 85578
2009-10-30 05:48:30 +00:00
Zhongxing Xu 6b8bfb376b Move NullDeref and UndefDeref into their own checker.
Add a CheckLocation() interface to Checker.
Now ImplicitNullDeref nodes are cached in NullDerefChecker.
More cleanups follow.

llvm-svn: 85471
2009-10-29 02:09:30 +00:00
Douglas Gregor f7b87cb529 [llvm up]
Switch a few ugly switch-on-string-literal constructs to use the new
llvm::StringSwitch.

llvm-svn: 85461
2009-10-29 00:41:01 +00:00
Zhongxing Xu b7945461cb 'error' is usually used as a noreturn function. This can suppress some false
warnings. Eventually we need a way to import externally defined functions
summaries.

llvm-svn: 85092
2009-10-26 05:18:31 +00:00
Douglas Gregor 4bd90e53c2 Eliminate QualifiedDeclRefExpr, which captured the notion of a
qualified reference to a declaration that is not a non-static data
member or non-static member function, e.g., 

  namespace N { int i; }
  int j = N::i;

Instead, extend DeclRefExpr to optionally store the qualifier. Most
clients won't see or care about the difference (since
QualifierDeclRefExpr inherited DeclRefExpr). However, this reduces the
number of top-level expression types that clients need to cope with,
brings the implementation of DeclRefExpr into line with MemberExpr,
and simplifies and unifies our handling of declaration references.

Extended DeclRefExpr to (optionally) store explicitly-specified
template arguments. This occurs when naming a declaration via a
template-id (which will be stored in a TemplateIdRefExpr) that,
following template argument deduction and (possibly) overload
resolution, is replaced with a DeclRefExpr that refers to a template
specialization but maintains the template arguments as written.

llvm-svn: 84962
2009-10-23 18:54:35 +00:00
Zhongxing Xu 2ebee13ff2 Simplify some code. No functionality change.
llvm-svn: 84757
2009-10-21 11:42:22 +00:00
Daniel Dunbar 07d0785dbb PR5218: Replace IdentifierInfo::getName with StringRef version, now that clients
are updated.

llvm-svn: 84447
2009-10-18 21:17:35 +00:00
Daniel Dunbar 70e7eadd15 Move misc clients to IdentifierInfo StringRef API.
- strcmp -> ==
 - OS.write(II->getName() ...) -> OS << II->getNameStr()
 - Avoid std::string concatenation
 - Use getNameStr().str() when an std::string is really needed.

llvm-svn: 84437
2009-10-18 20:26:27 +00:00
Daniel Dunbar 2c422dc9ca Move clients to use IdentifierInfo::getNameStart() instead of getName()
llvm-svn: 84436
2009-10-18 20:26:12 +00:00
Zhongxing Xu 9eb2706101 Remove dead code.
llvm-svn: 84073
2009-10-14 05:07:51 +00:00
Zhongxing Xu 7d6387bb24 * Remove unused GRState* parameter
* Make all Base value the last argument.

llvm-svn: 84071
2009-10-14 03:33:08 +00:00
Ted Kremenek 8ec5771dcb Fix: <rdar://problem/7275774> Static analyzer warns about NULL pointer when
adding assert

This fix required a few changes:

SimpleSValuator:
- Eagerly replace a symbolic value with its constant value in EvalBinOpNN
  when it is constrained to a constant.  This allows us to better constant fold
  values along a path.
- Handle trivial case of '<', '>' comparison of pointers when the two pointers
  are exactly the same.

RegionStoreManager:

llvm-svn: 83358
2009-10-06 01:39:48 +00:00
Ted Kremenek e41b81e9ab Fix:
<rdar://problem/6914474> checker doesn't realize that variable might
have been assigned if a pointer to that variable was passed to another
function via a structure

The problem here was the RegionStoreManager::InvalidateRegion didn't
invalidate the bindings of invalidated regions.  This required a
rewrite of this method using a worklist.

As part of this fix, changed ValueManager::getConjuredSymbolVal() to
require a 'void*' SymbolTag argument.  This tag is used to
differentiate two different symbols created at the same location.

llvm-svn: 82920
2009-09-27 20:45:21 +00:00
Ted Kremenek 1624a4784a Fix PR 4988 by removing an invalid assertion (a function can be referenced in
GRExprEngine::VisitDeclRefExpr without 'asLValue' being true).

llvm-svn: 82598
2009-09-23 01:30:01 +00:00
Ted Kremenek 3003001a86 Fix: <rdar://problem/7242006> [RegionStore] compound literal assignment with floats not honored
llvm-svn: 82575
2009-09-22 21:19:14 +00:00
John McCall 9dd450bb78 Change all the Type::getAsFoo() methods to specializations of Type::getAs().
Several of the existing methods were identical to their respective
specializations, and so have been removed entirely.  Several more 'leaf'
optimizations were introduced.

The getAsFoo() methods which imposed extra conditions, like
getAsObjCInterfacePointerType(), have been left in place.

llvm-svn: 82501
2009-09-21 23:43:11 +00:00
Ted Kremenek 6879beda08 Remove ImplicitBadDivides/ExplicitBadDivides node sets. This checking is now down by a 'Checker' and not build into GRExprEngine.
llvm-svn: 82017
2009-09-16 06:03:39 +00:00
Ted Kremenek b66229464e Per feedback from Eli, recognize in the transfer function logic for
__builtin_offsetof in the static analyzer that __builtin_offsetof is
not guaranteed to return an integer constant.  We will need to shore
this up later, but now at least we have correct support for when this
*is* an integer constant.

llvm-svn: 81830
2009-09-15 04:19:09 +00:00
Ted Kremenek 27347135dd Add static analyzer transfer function support for __builtin_offsetof.
llvm-svn: 81820
2009-09-15 00:40:32 +00:00
Douglas Gregor 15fc956ca0 Remove unnecessary ASTContext parameter from FunctionDecl::isBuiltinID
llvm-svn: 81590
2009-09-12 00:22:50 +00:00
Ted Kremenek 7020eae076 Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a way
to statically type various methods in SValuator/GRState as required either a
defined value or a defined-but-possibly-unknown value. This leads to various
logic cleanups in GRExprEngine, and lets the compiler enforce via type checking
our assumptions about what symbolic values are possibly undefined and what are
not.

Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values.

llvm-svn: 81579
2009-09-11 22:07:28 +00:00
Zhongxing Xu 7e3431b5cf Make AnalysisManager stateless. Now other analyzer components only depends on
local node information.

llvm-svn: 81433
2009-09-10 05:44:00 +00:00
Ted Kremenek 84c6f0a1e6 Implement: <rdar://problem/7185647> [RegionStore] 'self' cannot be NULL upon entry to a method
Here we implement this as a precondition within GRExprEngine, even though it is
related to how BasicStoreManager and RegionStoreManager model 'self'
differently. Putting this as a high-level precondition is more general, which is
why it isn't in RegionStore.cpp.

llvm-svn: 81378
2009-09-09 20:36:12 +00:00
Mike Stump 11289f4280 Remove tabs, and whitespace cleanups.
llvm-svn: 81346
2009-09-09 15:08:12 +00:00
Zhongxing Xu 1309a852d3 pass the correct predecessor node.
llvm-svn: 81066
2009-09-05 06:46:12 +00:00
Zhongxing Xu 88f07cd49c Refactor builtin function evaluation code into its own function.
llvm-svn: 81061
2009-09-05 05:00:57 +00:00
Zhongxing Xu bfb000f337 move the check into MarkNoReturnFunction.
llvm-svn: 80980
2009-09-04 02:17:35 +00:00
Zhongxing Xu 1748d8a43d Extract mark-no-return-function code into a function.
llvm-svn: 80979
2009-09-04 02:13:36 +00:00
Ted Kremenek 17a0296a09 Fix 80 column violations.
llvm-svn: 80873
2009-09-03 03:02:58 +00:00
Zhongxing Xu 6e4232c79c Refactor the check for bad divide into a checker.
Also fix a checker context bug: the Dst set is not always empty initially. 
Because in GRExprEngine::CheckerVisit(), *CurrSet is used repeatedly. 
So we removed the Dst.empty() condition in ~CheckerContext() when deciding
whether to do autotransision.

llvm-svn: 80786
2009-09-02 13:26:26 +00:00
Zhongxing Xu 79affb7b94 Refactor bad callee check into a Checker.
Now bad callee is checked as a PreVisit to the CallExpr.

llvm-svn: 80771
2009-09-02 08:10:35 +00:00
Douglas Gregor f405d7e6f1 Eliminate CXXAdornedMemberExpr entirely. Instead, optionally allocate
space within the MemberExpr for the nested-name-specifier and its
source range. We'll do the same thing with explicitly-specified
template arguments, assuming I don't flip-flop again.

llvm-svn: 80642
2009-08-31 23:41:50 +00:00
Douglas Gregor 96ee789d33 Rename CXXQualifiedMemberExpr -> CXXAdornedMemberExpr, since we will
also be adding explicit template arguments as an additional
"adornment". No functionality change.

llvm-svn: 80628
2009-08-31 21:41:48 +00:00
Zhongxing Xu 6fd66d4588 Refactor undefined argument checking into a Checker.
llvm-svn: 80417
2009-08-29 02:11:01 +00:00
Ted Kremenek 1d5f2f3546 Rename 'bindExpr' to 'BindExpr'.
llvm-svn: 80294
2009-08-27 22:17:37 +00:00
Zhongxing Xu 3ca89b9f20 Remove a unused member variable. Instead query the option from AnalysisManager.
llvm-svn: 80226
2009-08-27 06:55:26 +00:00