Commit Graph

56 Commits

Author SHA1 Message Date
Ted Kremenek 58f61ec1de Relax assertion since non-pod C++ classes are not aggregates, but still can appear in this context.
llvm-svn: 106919
2010-06-25 23:51:38 +00:00
Ted Kremenek fe97a1ac65 Add "checker caching" to GRExprEngine::CheckerVisit to progressively build
a winowed list of checkers that actually do something for a given StmtClass.
As the number of checkers grows, this may potentially significantly reduce
the number of checkers called at any one time.  My own measurements show that
for the ~20 registered Checker objects, only ~5 of them respond at any one time
to a give statement.  While this isn't a net performance win right now (there
is a minor slowdown on sqlite.3) this improvement does greatly improve debugging
when stepping through the checkers used to evaluate a given statement.

llvm-svn: 106884
2010-06-25 20:59:31 +00:00
Ted Kremenek 574f304631 Add 'VisitEndAnalysis' callback to Checker class. This callback is called by GRExprEngine
when the worklist algorithm has terminated.  This allows some checkers to do a post-analysis
phase after all paths have been analyzed.

llvm-svn: 106689
2010-06-23 22:08:00 +00:00
Ted Kremenek 55081f9317 Don't assert on C++ casts that are currently not handled by the static analyzer.
Instead, halt the analysis of the current path, which is what we do in GRExprEngine::ProcessStmt
for all other C++ constructs not currently handled by the analyzer.

llvm-svn: 106561
2010-06-22 19:05:10 +00:00
Zhongxing Xu 8225bda0d5 Register CallAndMessageChecker before AttrNonNullChecker. Then we can assume
arguments are not undefined.

llvm-svn: 106083
2010-06-16 05:45:09 +00:00
Zhongxing Xu 1225aacacf Merge StackAddrLeakChecker and ReturnStackAddressChecker.
llvm-svn: 105687
2010-06-09 06:08:24 +00:00
Zhongxing Xu 3b7294777c Add comments.
llvm-svn: 105382
2010-06-03 06:19:01 +00:00
Zhongxing Xu b013b0bc04 Add option '-analyzer-max-loop', which specifies the maximum
number of times the analyzer will go through a loop.

llvm-svn: 104007
2010-05-18 00:28:37 +00:00
John McCall 8b07ec253d Substantially alter the design of the Objective C type AST by introducing
ObjCObjectType, which is basically just a pair of
  one of {primitive-id, primitive-Class, user-defined @class}
with
  a list of protocols.
An ObjCObjectPointerType is therefore just a pointer which always points to
one of these types (possibly sugared).  ObjCInterfaceType is now just a kind
of ObjCObjectType which happens to not carry any protocols.

Alter a rather large number of use sites to use ObjCObjectType instead of
ObjCInterfaceType.  Store an ObjCInterfaceType as a pointer on the decl rather
than hashing them in a FoldingSet.  Remove some number of methods that are no
longer used, at least after this patch.

By simplifying ObjCObjectPointerType, we are now able to easily remove and apply
pointers to Objective-C types, which is crucial for a certain kind of ObjC++
metaprogramming common in WebKit.

llvm-svn: 103870
2010-05-15 11:32:37 +00:00
Douglas Gregor 10dc8aa581 Fixes for compilation with Microsoft Visual Studio 2010, from Steven Watanabe!
llvm-svn: 103458
2010-05-11 06:18:17 +00:00
Zhongxing Xu 1a56a488ed Turn -analyzer-inline-call on for C functions. This also fixed a bug that
after inlining post-call checking shouldn't be done.

llvm-svn: 103161
2010-05-06 03:38:27 +00:00
Douglas Gregor 882211c1da Completely reimplement __builtin_offsetof, based on a patch by Roberto
Amadini.

This change introduces a new expression node type, OffsetOfExpr, that
describes __builtin_offsetof. Previously, __builtin_offsetof was
implemented using a unary operator whose subexpression involved
various synthesized array-subscript and member-reference expressions,
which was ugly and made it very hard to instantiate as a
template. OffsetOfExpr represents the AST more faithfully, with proper
type source information and a more compact representation.

OffsetOfExpr also has support for dependent __builtin_offsetof
expressions; it can be value-dependent, but will never be
type-dependent (like sizeof or alignof). This commit introduces
template instantiation for __builtin_offsetof as well.

There are two major caveats to this patch:

  1) CodeGen cannot handle the case where __builtin_offsetof is not a
  constant expression, so it produces an error. So, to avoid
  regressing in C, we retain the old UnaryOperator-based
  __builtin_offsetof implementation in C while using the shiny new
  OffsetOfExpr implementation in C++. The old implementation can go
  away once we have proper CodeGen support for this case, which we
  expect won't cause much trouble in C++.

  2) __builtin_offsetof doesn't work well with non-POD class types,
  particularly when the designated field is found within a base
  class. I will address this in a subsequent patch.

Fixes PR5880 and a bunch of assertions when building Boost.Python
tests. 

llvm-svn: 102542
2010-04-28 22:16:22 +00:00
Douglas Gregor 8385a06929 Introduce Type::isStructureOrClassType(), which does the obvious
thing. Audit all uses of Type::isStructure(), changing those calls to
isStructureOrClassType() as needed (which is alsmost
everywhere). Fixes the remaining failure in Boost.Utility/Swap.

llvm-svn: 102386
2010-04-26 21:31:17 +00:00
Zhongxing Xu 105dfb5a72 CXXNamedCastExpr is actually an abstract expression.
llvm-svn: 101994
2010-04-21 06:32:25 +00:00
Zhongxing Xu d80755dac2 Add initial support for C++ delete expr.
llvm-svn: 101980
2010-04-21 02:17:31 +00:00
Douglas Gregor 9a12919421 Overhaul the AST representation of Objective-C message send
expressions, to improve source-location information, clarify the
actual receiver of the message, and pave the way for proper C++
support. The ObjCMessageExpr node represents four different kinds of
message sends in a single AST node:

  1) Send to a object instance described by an expression (e.g., [x method:5])
  2) Send to a class described by the class name (e.g., [NSString method:5])
  3) Send to a superclass class (e.g, [super method:5] in class method)
  4) Send to a superclass instance (e.g., [super method:5] in instance method)

Previously these four cases where tangled together. Now, they have
more distinct representations. Specific changes:

  1) Unchanged; the object instance is represented by an Expr*.

  2) Previously stored the ObjCInterfaceDecl* referring to the class
  receiving the message. Now stores a TypeSourceInfo* so that we know
  how the class was spelled. This both maintains typedef information
  and opens the door for more complicated C++ types (e.g., dependent
  types). There was an alternative, unused representation of these
  sends by naming the class via an IdentifierInfo *. In practice, we
  either had an ObjCInterfaceDecl *, from which we would get the
  IdentifierInfo *, or we fell into the case below...

  3) Previously represented by a class message whose IdentifierInfo *
  referred to "super". Sema and CodeGen would use isStr("super") to
  determine if they had a send to super. Now represented as a
  "class super" send, where we have both the location of the "super"
  keyword and the ObjCInterfaceDecl* of the superclass we're
  targetting (statically).

  4) Previously represented by an instance message whose receiver is a
  an ObjCSuperExpr, which Sema and CodeGen would check for via
  isa<ObjCSuperExpr>(). Now represented as an "instance super" send,
  where we have both the location of the "super" keyword and the
  ObjCInterfaceDecl* of the superclass we're targetting
  (statically). Note that ObjCSuperExpr only has one remaining use in
  the AST, which is for "super.prop" references.

The new representation of ObjCMessageExpr is 2 pointers smaller than
the old one, since it combines more storage. It also eliminates a leak
when we loaded message-send expressions from a precompiled header. The
representation also feels much cleaner to me; comments welcome!

This patch attempts to maintain the same semantics we previously had
with Objective-C message sends. In several places, there are massive
changes that boil down to simply replacing a nested-if structure such
as:

  if (message has a receiver expression) {
    // instance message
    if (isa<ObjCSuperExpr>(...)) {
     // send to super
    } else {
     // send to an object
   }
  } else {
    // class message
    if (name->isStr("super")) {
      // class send to super
    } else {
      // send to class
    }
  }

with a switch

  switch (E->getReceiverKind()) {
  case ObjCMessageExpr::SuperInstance: ...
  case ObjCMessageExpr::Instance: ...
  case ObjCMessageExpr::SuperClass: ...
  case ObjCMessageExpr::Class:...
  }

There are quite a few places (particularly in the checkers) where
send-to-super is effectively ignored. I've placed FIXMEs in most of
them, and attempted to address send-to-super in a reasonable way. This
could use some review.

llvm-svn: 101972
2010-04-21 00:45:42 +00:00
Zhongxing Xu 4d4b8d833e Use GetState() to get the possible cleaned state.
llvm-svn: 101867
2010-04-20 04:53:09 +00:00
Zhongxing Xu 6a479bf281 Move all C++ expression evaluation logic into its own file.
llvm-svn: 101772
2010-04-19 12:51:02 +00:00
Zhongxing Xu b6843f5f35 Analyzer: add support for CXXNewExpr.
llvm-svn: 101771
2010-04-19 11:47:28 +00:00
Ted Kremenek 8db54ff1de Fix PR 6844, a regression caused by the introduction of llvm_unreachable for the default
case in GRExprEngine::Visit (in r101129).  Instead, enumerate all Stmt cases and have
no 'default' case in the switch statement.  When we encounter a Stmt we don't handle,
we should explicitly add it to the switch statement.

llvm-svn: 101378
2010-04-15 17:33:31 +00:00
Zhongxing Xu 3fd05096ce Add support for CXXBoolLiteralExpr.
llvm-svn: 101238
2010-04-14 06:29:29 +00:00
Zhongxing Xu 17b33ed0cf Make all cases that we don't handle explicit.
llvm-svn: 101129
2010-04-13 13:15:19 +00:00
Zhongxing Xu b6f02c3d67 Dispatch all C++ cast expr to VisitCast().
llvm-svn: 101128
2010-04-13 12:38:32 +00:00
Zhongxing Xu 920070cfe7 Initial support for visiting CXXMemberCallExpr.
llvm-svn: 100098
2010-04-01 07:58:50 +00:00
Zhongxing Xu 8cea7f6f70 Improve C++ constructor handling.
llvm-svn: 100080
2010-04-01 03:47:27 +00:00
John McCall d9c7c6568e Introduce a new kind of derived-to-base cast which bypasses the need for
null checks, and make sure we elide null checks when accessing base class
members.

llvm-svn: 99963
2010-03-30 23:58:03 +00:00
Ted Kremenek 4be6a75884 Change the analyzer to recognize (but ignore) assignments to isa. Fixes PR 6302.
llvm-svn: 99904
2010-03-30 18:24:54 +00:00
Benjamin Kramer c048322523 Checker: random include cleanup.
llvm-svn: 99731
2010-03-27 21:19:47 +00:00
Zhongxing Xu b6e1c13c36 Add methods to remove a GDM entry.
Instead of setting the ReturnExpr GDM to NULL, remove it.

llvm-svn: 99470
2010-03-25 01:39:39 +00:00
Zhongxing Xu e248dca300 Bind the constructed object value to CXXConstructExpr.
llvm-svn: 99271
2010-03-23 09:13:17 +00:00
Zhongxing Xu bf2f0d74a2 Clear the return expr GDM after using it.
llvm-svn: 99268
2010-03-23 08:09:29 +00:00
Zhongxing Xu 1ff3dcef1f Add a AggExprVisitor class. It contains lots of boiler
plate code for evaluating expressions of C++ class type.

llvm-svn: 99267
2010-03-23 07:32:14 +00:00
Zhongxing Xu 3c0c81a4d4 Since we now may have basicblocks with the same block is in different function,
change the block counter map from unsigned -> unsigned to 
<StackFrameContext*, unsigned> -> unsigned.

llvm-svn: 99255
2010-03-23 05:05:02 +00:00
Zhongxing Xu 03fd76663e Mark CXXThisRegion in the current or parent stack frame context as live so that
their bindings are not removed.

llvm-svn: 98705
2010-03-17 03:35:08 +00:00
Zhongxing Xu 0eb690390d Add VisitCXXContructExpr logic to the analyzer. This still has not fully worked
since RemoveDeadBinding mistakenly remove the binding to CXXThisRegion. 

llvm-svn: 98629
2010-03-16 13:14:16 +00:00
Duncan Sands 7a9ba76825 Remove unused headers.
llvm-svn: 97941
2010-03-08 11:29:03 +00:00
Zhongxing Xu e73584384a Remove reference to AnalysisContext in Environment. We already have LocationContext
information in ExplodedNode.

llvm-svn: 97785
2010-03-05 04:45:36 +00:00
Zhongxing Xu 5cb8d9d40f When profiling Environment, also profile with AnalysisContext*, bacause
we now may have identical states with different analysis context.

Set the right AnalysisContext in state when entering and leaving a callee.

With both of the above changes, we can pass the test case.

llvm-svn: 97724
2010-03-04 09:04:52 +00:00
Ted Kremenek c3c1b10243 Don't conjure a symbol for DeclStmts when the variable is a C++ reference.
llvm-svn: 97590
2010-03-02 21:43:52 +00:00
Zhongxing Xu 5c07584f44 Use a GDM to record the returned expression in the state when VisitReturnStmt.
Use this information to find the returned value and bind it to CallExpr in
ProcessCallExit.
And there is no need to remove dead bindings in ProcessCallExit, because
a. it would clean up the return value bound to CallExpr
b. we still would do it in the next ProcessStmt(), where we would not misclean
   up the return value.

llvm-svn: 97225
2010-02-26 15:43:34 +00:00
Zhongxing Xu d041bc6ff4 Remove derelict GRStmtNodeBuilder::LastNode.
llvm-svn: 97207
2010-02-26 02:38:09 +00:00
Douglas Gregor a2fbc94458 Restore Zhongxing's commits r97122 r97127 r97129 r97131 which were reverted due to a Clang-on-Clang failure
llvm-svn: 97162
2010-02-25 19:01:53 +00:00
Jakob Stoklund Olesen 5a8f9acaa8 Revert patches r97122 r97127 r97129 r97131.
They were breaking clang-x86_64-darwin10-selfhost

llvm-svn: 97138
2010-02-25 15:47:53 +00:00
Zhongxing Xu 9516feac36 Move the dead bindings removal logic from CallInliner to GRExprEngine::ProcessCallExit().
llvm-svn: 97129
2010-02-25 07:36:34 +00:00
Zhongxing Xu 14863610f9 Call inliner improvements:
This patch implements the CallEnter/CallExit idea of Ted.

Add two interfaces to GRSubEngine: ProcessCallEnter, ProcessCallExit.

The CallEnter program point uses caller's location context. The
CallExit program point uses callee's location context.

CallEnter is built by GRStmtNodeBuilder. CallExit is built by
GREndPathNodeBuilder.

llvm-svn: 97122
2010-02-25 06:46:30 +00:00
Ted Kremenek b663ffe5f8 Add MacOSXAPIChecker, a meta checker to include various precondition checks for calls
to various MacOS X functions.  The checks in BasicObjCFoundationChecks.cpp will
gradually be migrated here.

As a first check, check that when 'dispatch_once()' is passed a predicate value
that has non-local storage.

llvm-svn: 97116
2010-02-25 05:44:09 +00:00
Ted Kremenek d55522f02e Add UnixAPIChecker, a meta checker to include various precondition checks for calls
to various unix/posix functions, e.g. 'open()'.

As a first check, check that when 'open()' is passed 'O_CREAT' that it has
a third argument.

llvm-svn: 97086
2010-02-25 00:20:35 +00:00
Ted Kremenek 228639746a Add simpler checker to check if variables captured by a block are uninitialized.
llvm-svn: 96341
2010-02-16 08:33:59 +00:00
Ted Kremenek d51217e968 Convert GRExprEngine's handling of ObjCMessageExprs to use a worklist
to evaluate arguments.

llvm-svn: 96293
2010-02-15 23:02:46 +00:00
Ted Kremenek 57f0989c16 Revert 95541.
llvm-svn: 95545
2010-02-08 16:18:51 +00:00