Commit Graph

298 Commits

Author SHA1 Message Date
Ted Kremenek ac7c7240f0 Fix PR 4594 by refactoring almost all casting logic from GRExprEngine::VisitCast
to SValuator::EvalCast. In the process, the StoreManagers now use this new cast
machinery, and the hack in GRExprEngine::EvalBind to handle implicit casts
involving OSAtomicCompareAndSwap and friends has been removed (and replaced with
logic closer to the logic specific to those functions).

llvm-svn: 76641
2009-07-21 21:03:30 +00:00
Ted Kremenek 77f7fc5e85 Enhance GRExprEngine::EvalBind to handle some implicit casts from nonlocs to
locs and vis versa.

llvm-svn: 76483
2009-07-20 21:43:20 +00:00
Ted Kremenek a1f9c7fb3b Add FIXME.
llvm-svn: 76466
2009-07-20 20:38:59 +00:00
Ted Kremenek af9f362840 Enhance GRBranchNodeBuilderImpl (part of GRCoreEngine) to understand the case
where the true or false CFGBlock* for a branch could be NULL. This will handle
the case where we can determine during CFG construction that a branch is
infeasible.

llvm-svn: 76450
2009-07-20 18:44:36 +00:00
Ted Kremenek fc311292da Fix caching bug revealed by analyzing ClamAV using RegionStore.
llvm-svn: 76262
2009-07-17 23:48:26 +00:00
Ted Kremenek 8a286fbdb9 Per offline discussion with Steve Naroff, add back Type::getAsXXXType() methods
until Doug Gregor's Type smart pointer code lands (or more discussion occurs).
These methods just call the new Type::getAs<XXX> methods, so we still have
reduced implementation redundancy. Having explicit getAsXXXType() methods makes
it easier to set breakpoints in the debugger.

llvm-svn: 76193
2009-07-17 17:50:17 +00:00
Ted Kremenek e3fb4b6524 Add member template 'Type::getAs<T>', which converts a Type* to a respective T*.
This method is intended to eventually replace the individual
Type::getAsXXXType<> methods.

The motivation behind this change is twofold:

1) Reduce redundant implementations of Type::getAsXXXType() methods. Most of
them are basically copy-and-paste.

2) By centralizing the implementation of the getAs<Type> logic we can more
smoothly move over to Doug Gregor's proposed canonical type smart pointer
scheme.

Along with this patch:

a) Removed 'Type::getAsPointerType()'; now clients use getAs<PointerType>.
b) Removed 'Type::getAsBlockPointerTypE()'; now clients use getAs<BlockPointerType>.

llvm-svn: 76098
2009-07-16 19:58:26 +00:00
Ted Kremenek f267a15c8d Two changes:
(1) Moved the SValuator object from GRExprEngine to ValueManager.  This
   allows ValueManager to use the SValuator when creating SVals.

(2) Added ValueManager::makeArrayIndex() and
    ValueManager::convertToArrayIndex(), two SVal creation methods
    that will help RegionStoreManager always have a consistent set of
    SVals with the same integer size and type when reasoning about
    array indices.

llvm-svn: 75882
2009-07-16 01:32:00 +00:00
Zhongxing Xu 170e816eff Instead of recovering from a wrong invalidation, this patch aims to
invalidate the region correctly. It uses the cast-to type to invalidate 
the region when available. To avoid invalid cast-to type like 'void*' or 'id',
region store now only records non-generic casts of regions.

llvm-svn: 75580
2009-07-14 01:12:46 +00:00
Ted Kremenek da03e8443e Handle insidious corner case exposed by RegionStoreManager when handling void* values that are bound
to symbolic regions and then treated like integers.

llvm-svn: 75356
2009-07-11 04:38:49 +00:00
Argyrios Kyrtzidis b4b64ca752 Remove the ASTContext parameter from the attribute-related methods of Decl.
The implementations of these methods can Use Decl::getASTContext() to get the ASTContext.

This commit touches a lot of files since call sites for these methods are everywhere.
I used pre-tokenized "carbon.h" and "cocoa.h" headers to do some timings, and there was no real time difference between before the commit and after it.

llvm-svn: 74501
2009-06-30 02:34:44 +00:00
Chris Lattner c61089a6c2 Key decisions about 'bool' vs '_Bool' to be based on a new flag in langoptions.
This is simple enough, but then I thought it would be nice to make PrintingPolicy
get a LangOptions so that various things can key off "bool" and "C++" independently.
This spiraled out of control.  There are many fixme's, but I think things are slightly
better than they were before.

One thing that can be improved: CFG should probably have an ASTContext pointer in it,
which would simplify its clients.

llvm-svn: 74493
2009-06-30 01:26:17 +00:00
Ted Kremenek bb597cdfc2 Remove '#include <sstream>' from libAnalysis.
llvm-svn: 74245
2009-06-26 00:43:22 +00:00
Ted Kremenek 1642bdaaa5 Introduce a new concept to the static analyzer: SValuator.
GRTransferFuncs had the conflated role of both constructing SVals (symbolic
expressions) as well as handling checker-specific logic. Now SValuator has the
role of constructing SVals from expressions and GRTransferFuncs just handles
checker-specific logic. The motivation is by separating these two concepts we
will be able to much more easily create richer constraint-generating logic
without coupling it to the main checker transfer function logic.

We now have one implementation of SValuator: SimpleSValuator.

SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals
(which is removed in this patch). This includes the logic for EvalBinOp,
EvalCast, etc. Because SValuator has a narrower role than the old
GRTransferFuncs, the interfaces are much simpler, and so is the implementation
of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of
SVal-related logic in GRSimpleVals and cleaned it up while moving it over to
SimpleSValuator.

As a consequence of removing GRSimpleVals, there is no longer a
'-checker-simple' option. The '-checker-cfref' did everything that option did
but also ran the retain/release checker. Of course a user may not always wish to
run the retain/release checker, nor do we wish core analysis logic buried in the
checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp
to separate out these pieces into the core analysis engine.

llvm-svn: 74229
2009-06-26 00:05:51 +00:00
Ted Kremenek 799bb6e178 Remove uses of std::ostream from libAnalysis.
llvm-svn: 74136
2009-06-24 23:06:47 +00:00
Owen Anderson 4d9e93c420 Update for LLVM API changes.
llvm-svn: 74085
2009-06-24 17:37:55 +00:00
Ted Kremenek 8cf2021012 Remove GRStateManager::getRegion/getSelfRegion().
llvm-svn: 74006
2009-06-23 21:37:46 +00:00
Ted Kremenek 7df5691d2d Remove GRStateManager::BindLoc() and GRStateManager::Unbind().
llvm-svn: 73996
2009-06-23 20:38:51 +00:00
Ted Kremenek 59ee3f5079 Remove GRStateManager::BindDecl() and GRStateManager::BindDeclWithInit().
llvm-svn: 73995
2009-06-23 20:27:53 +00:00
Ted Kremenek 404b132dc0 Move 'hasStackStorage()' and 'hasHeapStorage()' from MemRegionManager to MemRegion.
llvm-svn: 73973
2009-06-23 18:05:21 +00:00
Zhongxing Xu 7718ae4701 Move all factory methods from SVal to ValueManager. API cleanup!
llvm-svn: 73954
2009-06-23 09:02:15 +00:00
Zhongxing Xu d09b5205ef ValueManager::makeNonLoc -> ValueManager::makeIntVal
Clean up code with ValueManager.

llvm-svn: 73951
2009-06-23 06:13:19 +00:00
Ted Kremenek c55f0cdaa0 Remove more GetSVal/GetLValue methods in GRExprEngine/GRState, instead
preferring to use their replacements in GRState. This further unifies the code
paths for such logic and leads to some code reduction.

llvm-svn: 73771
2009-06-19 17:10:32 +00:00
Ted Kremenek 095f1a9848 Move clients over from using GRStateManager::BindXXX and friends to
GRState->bindXXX and friends (and constify some arguments along the way).

llvm-svn: 73740
2009-06-18 23:58:37 +00:00
Ted Kremenek f9906843b7 libAnalysis:
- Remove the 'isFeasible' flag from all uses of 'Assume'.
- Remove the 'Assume' methods from GRStateManager.  Now the only way to
  create a new GRState with an assumption is to use the new 'assume' methods
  in GRState.

llvm-svn: 73731
2009-06-18 22:57:13 +00:00
Douglas Gregor 78bd61f661 Move the static DeclAttrs map into ASTContext. Fixes <rdar://problem/6983177>.
llvm-svn: 73702
2009-06-18 16:11:24 +00:00
Ted Kremenek d93c6e3fd6 Remove more dependencies on GRStateRef. As a consequence, we can now
pretty-print a GRState object anywhere it is referenced (instead of
needing a GRStateRef of a GRStateManager handy).

llvm-svn: 73669
2009-06-18 01:23:53 +00:00
Chris Lattner 15ba94987a Sink the BuiltinInfo object from ASTContext into the
preprocessor and initialize it early in clang-cc.  This
ensures that __has_builtin works in all modes, not just
when ASTContext is around.

llvm-svn: 73319
2009-06-14 01:54:56 +00:00
Zhongxing Xu a7907608fb * API change: we need to pass GRState to GRExprEngine::EvalBinOp() because
RegionStore needs to know the type of alloca region. 
* RegionStoreManager::EvalBinOp() now converts the alloca region to its first
  element region, as what is done to symbolic region.

llvm-svn: 72164
2009-05-20 09:00:16 +00:00
Zhongxing Xu 34d04b3ca9 As discussed with Ted, rename TypedRegion::getObjectType() to
TypedRegion::getValueType().

llvm-svn: 71321
2009-05-09 03:57:34 +00:00
Zhongxing Xu 8038f7b30f rename: MemRegion:
RValueType => ObjectType
 LValueType => LocationType

No functionality change.

llvm-svn: 71304
2009-05-09 00:50:33 +00:00
Ted Kremenek a6e08327c0 analyzer: Add ProgramPoint 'PostLValue' just to distinguish (for
analysis introspection) when we computed an lvalue.  This shouldn't
effect the current analysis results in any way.

llvm-svn: 71169
2009-05-07 18:27:16 +00:00
Ted Kremenek 02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Chris Lattner f0b64d73a8 split ObjC and C++ Statements out into their own headers.
llvm-svn: 70105
2009-04-26 01:32:48 +00:00
Ted Kremenek 9c03f68206 Fix PR 4033: the analyzer shouldn't crash on computed gotos involving symbolic
target addresses.

llvm-svn: 69900
2009-04-23 17:49:43 +00:00
Ted Kremenek fe95afd0bc Fix crash reported in PR 3991. The analyzer doesn't reason about ObjCKVCExpr.
llvm-svn: 69754
2009-04-21 23:53:32 +00:00
Ted Kremenek 35f875c136 Fix: <rdar://problem/6777209> false Dereference of null pointer in loop: pointer increment/decrement preserves non-nullness
When the StoreManager doesn't reason well about pointer-arithmetic, propagate
the non-nullness constraint on a pointer value when performing pointer
arithmetic uisng ++/--.

llvm-svn: 69741
2009-04-21 22:38:05 +00:00
Zhongxing Xu ac1294318d get a CodeTextRegion when visiting FunctionDecl reference.
get FunctionDecl with more general utility method.

llvm-svn: 69570
2009-04-20 05:24:46 +00:00
Ted Kremenek 4531be138c Add analyzer support for objc_atomicCompareAndSwap()
llvm-svn: 68849
2009-04-11 00:54:13 +00:00
Ted Kremenek df24000d24 Implement analyzer support for OSCompareAndSwap. This required pushing "tagged"
ProgramPoints all the way through to GRCoreEngine.

NSString.m now fails with RegionStoreManager because of the void** cast.
Disabling use of region store for that test for now.

llvm-svn: 68845
2009-04-11 00:11:10 +00:00
Zhongxing Xu dadf250598 Finally nuke loc::SymbolVal.
llvm-svn: 68771
2009-04-10 06:06:13 +00:00
Ted Kremenek 5054663daa Fix: <rdar://problem/6776949> Branch condition evaluates to an uninitialized value (argc is guaranteed to be >= 1)
The analyzer now adds the precondition that the first argument of 'main' is > 0.

llvm-svn: 68757
2009-04-10 00:59:50 +00:00
Ted Kremenek 40f4ee74fd Implement attribute "analyzer_noreturn" (<rdar://problem/6777003>). This allows
clients of the analyzer to designate custom assertion routines as "noreturn"
functions from the analyzer's perspective but not the compiler's.

llvm-svn: 68746
2009-04-10 00:01:14 +00:00
Ted Kremenek f2489ea043 - Move ownership of MemRegionManager into ValueManager.
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly
simplifies the calling interface to clients.

llvm-svn: 68731
2009-04-09 22:22:44 +00:00
Ted Kremenek f8cb51c20e Remove SVal::MakeZero and replace it with ValueManager::makeZeroVal.
llvm-svn: 68711
2009-04-09 16:46:55 +00:00
Zhongxing Xu 783cd82487 clean up code with new API.
llvm-svn: 68700
2009-04-09 07:01:16 +00:00
Zhongxing Xu 726876b385 clean up code with new API.
llvm-svn: 68699
2009-04-09 06:56:25 +00:00
Zhongxing Xu 2945210d71 clean up code with new API.
llvm-svn: 68698
2009-04-09 06:53:24 +00:00
Zhongxing Xu c48eb32872 stop using loc::SymbolVal.
llvm-svn: 68697
2009-04-09 06:49:52 +00:00
Ted Kremenek 2f3b0dbff4 Fix a null pointer dereference error due to state caching in a loop involving
sending a message to a nil receiver.

llvm-svn: 68686
2009-04-09 06:02:06 +00:00