Commit Graph

560 Commits

Author SHA1 Message Date
Ted Kremenek a5bf9cb4be When we have a binary expression 'int operator symbol', properly rewrite this as
'symbol operator-reverse int'. This patch is a combination of code from
Zhongxing Xu and myself (Zhongxing noticed this bug for the cases of
relational operators).

llvm-svn: 56351
2008-09-19 17:31:13 +00:00
Zhongxing Xu a8e88ecda6 Add an omitted case for AssumeSymInt.
llvm-svn: 56334
2008-09-19 06:07:59 +00:00
Ted Kremenek a417c0e80a Add panic function "__assert_fail".
llvm-svn: 56327
2008-09-19 02:30:47 +00:00
Ted Kremenek 6a1a334b6c Register the implicit null-dereferenced object as a notable symbol.
llvm-svn: 56319
2008-09-18 23:23:19 +00:00
Ted Kremenek b42f482c91 Implement second part of PR 2600: NSError** parameter may be null, and should be checked before being dereferenced.
llvm-svn: 56318
2008-09-18 23:09:54 +00:00
Ted Kremenek f0673e4eb6 Change implementation of NSError** coding-style check to be invoked at the end of the retain/release analysis.
llvm-svn: 56312
2008-09-18 21:25:13 +00:00
Ted Kremenek fc3abeb1e5 Implemented one of the checks requested in PR 2600:
"Method accepting NSError** argument should have non-void return value to indicate that an error occurred."

Test case written, but the header needs to be delta-debugged reduced.  Will commit shortly.

llvm-svn: 56297
2008-09-18 06:33:41 +00:00
Ted Kremenek 8782716c4a Minor pass-sensitivity improvement:
if we know that 'len != 0' and know that 'i == 0' then we know that
  'i < len' must evaluate to true and cannot evaluate to false

llvm-svn: 56260
2008-09-16 23:24:45 +00:00
Ted Kremenek 0ecb53a421 ProgramPoint now takes the space of two pointers instead of one. This change was
motivated because it became clear that the number of subclasses of ProgramPoint
would expand and we ran out of bits to represent a pointer variant. As a plus of
this change, BlockEdge program points can now be represented explicitly without
using a cache of CFGBlock* pairs in CFG.

llvm-svn: 56245
2008-09-16 18:44:52 +00:00
Ted Kremenek 2d470fc0ba Patch by Csaba Hruska!
"Here is a patch what replaces std::ostream with llvm::raw_ostream. This patch
covers the AST library, but ignores Analysis lib."

llvm-svn: 56185
2008-09-13 05:16:45 +00:00
Ted Kremenek ef2b3a71bb Add missing spaces in path diagnostics.
llvm-svn: 56166
2008-09-12 18:17:46 +00:00
Ted Kremenek 1b9e10390b Store: (static analyzer)
- Change definition of store::Region and store::Binding (once again) to make
  them real classes that just wrap pointers. This makes them more strictly
  typed, and allows specific implementations of Regions/Bindings to just
  subclass them.
- minor renamings to RegionExtent and its subclasses
- added a bunch of doxygen comments

StoreManager: (static analyzer)
- added 'iterBindings', an iteration method for iterating over the bindings of a
  store. It that takes a callback object (acting like a poor man's closure).
- added 'getRVal' version for store::Binding. Will potentially phase the other
  versions of GetRVal in StoreManager out.
- reimplemented 'getBindings' to be non-virtual and to use 'iterBindings'

BasicStoreManager: (static analyzer)
- implemented 'iterBindings' for BasicStoreManager

llvm-svn: 55688
2008-09-03 03:06:11 +00:00
Daniel Dunbar c62cf79290 Add newline at end of file.
llvm-svn: 55559
2008-08-30 02:06:22 +00:00
Zhongxing Xu 4c23963de8 Added LLVM comment header.
llvm-svn: 55537
2008-08-29 15:09:12 +00:00
Zhongxing Xu c1bd3a5f8b Migrate the rest symbolic analysis stuff to BasicConstraintManager.
llvm-svn: 55536
2008-08-29 14:52:36 +00:00
Ted Kremenek 5043680da4 Remove dead method.
llvm-svn: 55526
2008-08-29 03:55:31 +00:00
Ted Kremenek c83e755d78 Added "getBindings" and "BindingAsString" to GRStateManager and StoreManager.
Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of
making assumptions about the Store (removed dependence on GRState::vb_iterator).

llvm-svn: 55522
2008-08-29 00:47:32 +00:00
Ted Kremenek 5909059524 Remove BasicStore.h (migrated function prototype for CreateBasicStore() to Store.h)
llvm-svn: 55519
2008-08-28 23:39:42 +00:00
Ted Kremenek 75d2ac956f Remove Regions.h and Regions.cpp, since we are now using an even more abstract representation of "memory regions" in the static analyzer.
llvm-svn: 55515
2008-08-28 23:32:43 +00:00
Ted Kremenek e91874f71f Make store "Regions" and "Bindings" more abstract instead of concrete variants.
Their precise semantics will be implemented by a specific StoreManager.

Use function pointer to create the StoreManager in GRStateManager.  This matches how we create ConstraintsManager.

llvm-svn: 55514
2008-08-28 23:31:31 +00:00
Ted Kremenek f1b9209a34 Fixed analyzer caching bug involving the transfer function for loads.
llvm-svn: 55494
2008-08-28 18:43:46 +00:00
Ted Kremenek b45e6b91c6 Fixed analyzer caching bug in DeclStmt.
llvm-svn: 55487
2008-08-28 18:34:26 +00:00
Ted Kremenek b5ef37f28e Make the destructor of ConstraintManager virtual.
llvm-svn: 55448
2008-08-27 23:13:01 +00:00
Zhongxing Xu f71b5f39bb Refactor Assume logic into a separate class ConstraintManager.
llvm-svn: 55412
2008-08-27 14:03:33 +00:00
Ted Kremenek 912c28444f Added "Auditor" interface for auditing the construction of ExplodedGraphs.
llvm-svn: 55403
2008-08-27 01:56:11 +00:00
Ted Kremenek 6f7c419308 Make implementation of ExplodedNodeImpl::addPredecessor out-of-line.
llvm-svn: 55402
2008-08-27 01:27:52 +00:00
Ted Kremenek af665820e4 Remove default value for 'Pred' argument to GRCoreEngineImpl::GenerateNode().
llvm-svn: 55392
2008-08-26 22:34:23 +00:00
Ted Kremenek 2a2c875b9c Added 'extents' for Regions.
Added 'getExtent()' to StoreManager.
Implemented 'getExtent()' for BasicStoreManager.

llvm-svn: 55321
2008-08-25 19:33:03 +00:00
Chris Lattner a2e25e5e72 adjust to changes in various APIs from LLVM. We can't print
an APInt directly to an ostream now, so add some hacks.  It would
be better to switch all of the bugreport (and friends) stuff over
to raw_ostream.

llvm-svn: 55264
2008-08-23 22:23:37 +00:00
Ted Kremenek 4e7713c04d Simplify interface to Store::AddDecl
llvm-svn: 55213
2008-08-23 00:50:55 +00:00
Zhongxing Xu 614f6a060d Modify comments.
llvm-svn: 55150
2008-08-21 23:00:21 +00:00
Zhongxing Xu d95495f601 Move the handling of DeclStmt from GRExprEngine to BasicStoreManager.
llvm-svn: 55144
2008-08-21 22:34:01 +00:00
Ted Kremenek e5edbdd4ee Patch by Zhongxing Xu:
This patch moves some code in GRStateManager::RemoveDeadBindings() to EnvironmentManager::RemoveDeadBindings().

llvm-svn: 55064
2008-08-20 17:08:29 +00:00
Ted Kremenek eb38fde5e5 Patch by Zhongxing Xu: We should set back the modified ConstEq map.
llvm-svn: 55060
2008-08-20 16:59:15 +00:00
Ted Kremenek 19edd216f2 Move store pretty-printing logic inside of StoreManager (previously in GRState).
llvm-svn: 55013
2008-08-19 22:24:03 +00:00
Ted Kremenek 67102b281e Patch by Zhongxing Xu!
This patch extends BasicStoreManager::getInitialStore() to include code that symbolicates input variables.
It also removes redundant handling of ImplicitParamDecl, since it is a subclass of VarDecl.

llvm-svn: 54993
2008-08-19 16:51:45 +00:00
Argyrios Kyrtzidis 3bab3d21f9 Add ExplicitCastExpr to replace the current CastExpr, and have ImplicitCastExpr and ExplicitCastExpr derive from a common base class (CastExpr):
Expr
  -> CastExpr
     -> ExplicitCastExpr
     -> ImplicitCastExpr 

llvm-svn: 54955
2008-08-18 23:01:59 +00:00
Chris Lattner 5d1cfa1229 various updates to match r54873 on mainline.
llvm-svn: 54874
2008-08-17 07:19:51 +00:00
Ted Kremenek 87aab6c771 Migrate the retain/release checker to not manage the RefBindings::Factory object
directly, but instead have GRStateManager manage it.

llvm-svn: 54862
2008-08-17 03:20:02 +00:00
Ted Kremenek 90d488f724 Migrate GRState::ConstEqTy (map used from tracking constants for symbols) to use the generic data map instead.
llvm-svn: 54860
2008-08-17 03:10:22 +00:00
Ted Kremenek edd9a18050 Added GRStateTrait.h, which includes boilerplate code for creating specializations of GRStateTrait<>.
Modified GRStateTrait<ConstNotEq> in GRState to use the boilerplate in GRStateTrait<> for ImmutableMaps.

llvm-svn: 54859
2008-08-17 02:59:30 +00:00
Nick Lewycky 0fb45f60d5 It's spelt "uninitialized".
llvm-svn: 54848
2008-08-16 17:46:53 +00:00
Ted Kremenek ceba6ead45 GRState:
- Remove ConstNotEq from GRState/GRStateManager (!= tracking uses GDM instead).
- GRStateManager now can book-keep "contexts" (e.g., factory objects) for uses
  with data elements stored into the GDM.
- Refactor pretty-printing of states to use GRState::Printer objects
  exclusively. This removed a huge amount of pretty-printing logic from
  GRExprEngine.

CFRefCount
- Simplified some API calls based on refinements to the GDM api.

llvm-svn: 54835
2008-08-16 00:49:49 +00:00
Ted Kremenek c7138bb0a7 Default initialize only pointers and integer types (for now).
llvm-svn: 54798
2008-08-14 22:11:13 +00:00
Ted Kremenek db7dd9cd15 Migrated retain/release checker to use the Generic Data Map in GRState (instead
of using CheckerState).

Removed CheckerState from GRState.

Added class GRStateRef which wraps GRState* and GRStateManager*. This is handy
for generating new states with a single handle.

Added member template set/get functions to GRStateRef/GRState/GRStateManager for
accessing the Generic Data Map.

llvm-svn: 54788
2008-08-14 21:16:54 +00:00
Ted Kremenek 16306107cf Renamed GRState::CheckerStatePrinter to GRState::Printer.
Updated checker state printer interface to allow transfer functions to return an arbitrary number of GRState::Printers.

llvm-svn: 54762
2008-08-13 21:24:49 +00:00
Ted Kremenek 0e7d96c370 Rename ValueState.h -> GRState.h
Rename ValueState.cpp -> GRState.cpp

llvm-svn: 54722
2008-08-13 04:28:02 +00:00
Ted Kremenek 5ab5a1b578 Rename ValueState -> GRState.
Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721
2008-08-13 04:27:00 +00:00
Ted Kremenek dccd9883c4 Initialize tracked local variables to undefined.
llvm-svn: 54716
2008-08-13 03:28:04 +00:00
Ted Kremenek 3f91f037a7 Fix memory leak found by Sam Bishop: delete WList in the dstor of GRCoreEngineImpl.
llvm-svn: 54714
2008-08-13 03:10:52 +00:00
Ted Kremenek 27fb019038 Added GenericDataMap as a component of ValueState.
llvm-svn: 54704
2008-08-12 21:49:24 +00:00
Ted Kremenek 9551ab6c8c More cleanups. Add missing #include.
llvm-svn: 54699
2008-08-12 20:41:56 +00:00
Ted Kremenek 3f13f598ce More summary generation refactoring.
llvm-svn: 54696
2008-08-12 18:48:50 +00:00
Ted Kremenek 050b91cd28 Add variadic addInstMethSummary() and refactored addPanicSummary() to use this method. (code reduction).
Misc. cleanups.

llvm-svn: 54694
2008-08-12 18:30:56 +00:00
Daniel Dunbar 6e8aa537f8 More #include cleaning
- Drop {Decl.h,DeclObjC.h,IdentifierTable.h} from Expr.h
 - Moved Sema::getCurMethodDecl() out of line (dependent on
   ObjCMethodDecl via dyn_cast).

llvm-svn: 54629
2008-08-11 05:35:13 +00:00
Nico Weber 4c3116437c * Remove isInSystemHeader() from DiagClient, move it to SourceManager
* Move FormatError() from TextDiagnostic up to DiagClient, remove now  
  empty class TextDiagnostic
* Make DiagClient optional for Diagnostic

This fixes the following problems:

* -html-diags (and probably others) does now output the same set of  
  warnings as console clang does
* nothing crashes if one forgets to call setHeaderSearch() on  
  TextDiagnostic
* some code duplication is removed

llvm-svn: 54620
2008-08-10 19:59:06 +00:00
Chris Lattner 6307f19726 rename PreDefinedExpr -> PredefinedExpr
llvm-svn: 54605
2008-08-10 01:53:14 +00:00
Ted Kremenek 4455a9d378 Added FIXME.
llvm-svn: 54568
2008-08-09 00:41:45 +00:00
Ted Kremenek 0216b83d94 Don't use Expr::isIntegerConstantExpr just to check if a pointer value is initialize to NULL.
llvm-svn: 54563
2008-08-09 00:05:14 +00:00
Ted Kremenek 4b1327960d Added AssumeSymGT, AssumeSymGE, AssumeSymLT, AssumeSymLE to add some minor improvements to path-sensitivity. Right now we basically treat 'x > y' and 'x < y' as implying 'x != y', but this restriction will only inevitably apply to our must rudimentary value tracking component (we'll implement more advanced value reasoning later).
llvm-svn: 54493
2008-08-07 22:30:22 +00:00
Ted Kremenek 18391f432b Don't flag any dead stores for variables marked unused.
llvm-svn: 54492
2008-08-07 22:28:30 +00:00
Ted Kremenek 4f8792b616 Added decl_iterator to DeclStmt to provide an abstract interface to iterate over the ScopedDecls of a DeclStmt.
Updated a few clients of DeclStmt::getNextDeclarator() to use decl_iterator instead.  Will update other clients after additional testing.

llvm-svn: 54368
2008-08-05 20:46:55 +00:00
Ted Kremenek 9512c122fa Change 'dead store (++/--)' to 'dead increment'
llvm-svn: 54268
2008-08-02 18:19:48 +00:00
Ted Kremenek a7045d663d Enhanced path-sensitive return-of-stack-address check to print out the name of the variable whose address was returned.
llvm-svn: 54253
2008-07-31 20:31:27 +00:00
Ted Kremenek a8b8ce499a Add range highlighting for path-sensitive return-of-stack-address check.
llvm-svn: 54219
2008-07-30 17:49:12 +00:00
Chris Lattner 3f6cd0bc76 remove some unneeded calls to getCanonicalType
llvm-svn: 54106
2008-07-26 22:36:27 +00:00
Chris Lattner 574dee6cac change more instances of QualType::getCanonicalType to call
ASTContext::getCanonicalType instead (PR2189)

llvm-svn: 54105
2008-07-26 22:17:49 +00:00
Ted Kremenek d074ce47b6 Have the UnusedIvar check skip ivars with setters/getters created by @synthesize.
llvm-svn: 54050
2008-07-25 20:28:02 +00:00
Ted Kremenek 83ec24501e Remove call to isSEL and isSEL itself since the call is dead (isObjCObjectPointerType() will never return true for selectors).
llvm-svn: 54034
2008-07-25 18:17:35 +00:00
Ted Kremenek 2483730e3f Only warn about missing/incomplete -dealloc implementations when a class contains a non-SEL, non-IBOutlet ivar that references an ObjC object.
llvm-svn: 54024
2008-07-25 17:04:49 +00:00
Ted Kremenek 092ec76923 Don't emit 'dead initialization' warnings for variables marked 'unused'.
This fixes PR 2573: http://llvm.org/bugs/show_bug.cgi?id=2573

llvm-svn: 54009
2008-07-25 04:47:34 +00:00
Ted Kremenek 5eb536b74c Use ASTContext::isObjCObjectPointerType() to check if an ivar is a reference to an Objective-C object.
llvm-svn: 53999
2008-07-24 23:59:07 +00:00
Ted Kremenek 9e9afb552c Correctly handle NSAssertionHandle -handleFailureInMethod:object:file:lineNumber:description:
This fixes: http://llvm.org/bugs/show_bug.cgi?id=2593

llvm-svn: 53993
2008-07-24 18:47:16 +00:00
Ted Kremenek 0e60b7588a Don't issue a missing +dealloc warning for classes that just contain SEL ivars.
This fixes PR 2592: http://llvm.org/bugs/show_bug.cgi?id=2592

llvm-svn: 53987
2008-07-24 17:45:56 +00:00
Ted Kremenek 87b16f4258 Issue dead store warnings for preincrements involved in a subexpression.
llvm-svn: 53983
2008-07-24 17:01:17 +00:00
Ted Kremenek 9572cae92b Don't flag dead stores when the result of a preincrement/predecrement is used in an enclosing expression.
llvm-svn: 53964
2008-07-23 22:19:56 +00:00
Ted Kremenek ecc851bb6e Further refine dead store checking to distinguish between dead stores and dead increments.
llvm-svn: 53960
2008-07-23 21:16:38 +00:00
Ted Kremenek 46abc7db6b Properly skip IBOutlets when checking for unused ivars.
Refine the error message of unused ivars.
Added test case.

llvm-svn: 53957
2008-07-23 18:21:36 +00:00
Ted Kremenek 6b6a4b6446 Ivar access mode ObjCIvarDecl::None == ObjCIvarDecl::Protected, not private.
llvm-svn: 53953
2008-07-23 17:14:39 +00:00
Ted Kremenek 3b28f4911c Add prototype implementation of unused ivar check.
llvm-svn: 53942
2008-07-23 00:45:26 +00:00
Ted Kremenek 1f352db96a Moved registration of basic path-sensitive checks from GRSimpleVals.cpp to GRExprEngineInternalChecks.cpp.
llvm-svn: 53909
2008-07-22 16:21:24 +00:00
Ted Kremenek 6bb53303e1 Rename file.
llvm-svn: 53906
2008-07-22 14:41:47 +00:00
Ted Kremenek 98f6e582f2 Added path-sensitive checking for null pointer values passed to function arguments marked nonnull.
This implements <rdar://problem/6069935>

llvm-svn: 53891
2008-07-22 00:46:16 +00:00
Ted Kremenek f41b1c45fa "currentHandler" is a nullary selector
llvm-svn: 53763
2008-07-18 18:14:26 +00:00
Ted Kremenek f7faa42c6c Fix caching bug.
llvm-svn: 53759
2008-07-18 17:39:56 +00:00
Ted Kremenek 3b2294c7e6 Add panic support for NSAssertionHandler.
llvm-svn: 53758
2008-07-18 17:24:20 +00:00
Ted Kremenek d785465167 Add panic function.
llvm-svn: 53755
2008-07-18 16:28:33 +00:00
Ted Kremenek 36f6b04295 Fix 80 col violation
llvm-svn: 53754
2008-07-18 15:59:33 +00:00
Ted Kremenek b1c91bfc45 Fix regression by explicitly checking if we are negating a SymIntConstantVal.
llvm-svn: 53753
2008-07-18 15:54:51 +00:00
Ted Kremenek 6a62d908c3 Improve path-sensitivity when using the logical not operator.
llvm-svn: 53752
2008-07-18 15:46:06 +00:00
Ted Kremenek 91614e6fe6 Renamed deterministic EvalBinOp to DetermEvalBinOpNN. This name mangling is unfortunately needed because virtual methods with the same name can be hidden by subclasses.
llvm-svn: 53751
2008-07-18 15:27:58 +00:00
Ted Kremenek 8d6b42e096 Created ValueStateSet class to manage the creation of multiple states by a method.
Modified the new EvalBinOpNN to generate states instead of nodes.  This is a much simpler interface and is what clients will want to do.

llvm-svn: 53750
2008-07-18 05:53:58 +00:00
Ted Kremenek e330aacbed Update signature of EvalAssume.
llvm-svn: 53745
2008-07-17 23:33:10 +00:00
Ted Kremenek 9c32a1ecf5 Move GRTransferFunc* into ValueStateManager, and move the assumption logic there as well.
llvm-svn: 53743
2008-07-17 23:15:45 +00:00
Ted Kremenek a79d9a9c79 Remove redundant logic.
llvm-svn: 53740
2008-07-17 21:36:43 +00:00
Ted Kremenek bc9118b165 Begin major changes to EvalXXX methods in GRTransferFuncs. Currently some of the methods only return an RVal; we want them to be able to create an arbitrary number of states.
llvm-svn: 53739
2008-07-17 21:27:31 +00:00
Ted Kremenek 88a6b7fa80 Moved RemoveDeadBindings logic for the contents of 'Store' to a virtual RemoveDeadBindings method in StoreManager.
llvm-svn: 53726
2008-07-17 18:38:48 +00:00
Ted Kremenek ae543148bc Fix regression introduced by http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20080714/006514.html.
The regression was the casts from integers to pointers where not being handled: they would just return UnknownVal.  This would greatly decrease path-sensitivity.

llvm-svn: 53659
2008-07-16 00:23:49 +00:00
Ted Kremenek f46dddac5b Fix transfer function logic in GRSimpleVals for integer casts: only support casts from integers to integers.
This fixes a crash reported by Anders Carlsson!

llvm-svn: 53649
2008-07-15 23:17:54 +00:00
Ted Kremenek ed1f72b67c For the MissingDealloc check, don't treat IBOutlet ivars as being needed to be released
llvm-svn: 53647
2008-07-15 23:04:27 +00:00
Ted Kremenek 81bfc074c9 Distinguish between dead stores and dead initializations.
llvm-svn: 53628
2008-07-15 18:06:32 +00:00
Ted Kremenek 176e2c519d isRetain() and isRelease() now only returns true if "Retain"/"Release" appears in the suffix of a function's name.
llvm-svn: 53621
2008-07-15 17:43:41 +00:00
Ted Kremenek fa89e2f09c Support retain/release tracking for CoreGraphics (CGxxxRef) objects.
llvm-svn: 53617
2008-07-15 16:50:12 +00:00
Ted Kremenek c18255d80f Refactor Dead Stores error reporting to use the simplified BugReporter::EmitBasicReport interface.
llvm-svn: 53573
2008-07-14 20:56:04 +00:00
Ted Kremenek 0255531dd3 Added method "EmitBasicReport" to BugReporter to simplify the emission of simple bug diagnostics.
Refactored error reporting in CheckObjCDealloc and CheckObjCInstMethSignature to use this new bug reporting interface (major code simplification).

llvm-svn: 53560
2008-07-14 17:40:50 +00:00
Ted Kremenek e5b5953672 Tidy up error message.
llvm-svn: 53493
2008-07-11 23:17:01 +00:00
Ted Kremenek 3bfb314c25 Add new check: -check-objc-methodsigs. This check scans methods in
ObjCImplementationDecls and sees if a ancestor class defines a method with the
same selector but with a different type signature. Right now it just compares
return types, and mainly looks at differences in primitive values. The checking
will be expanded in the future.

llvm-svn: 53482
2008-07-11 22:40:47 +00:00
Ted Kremenek aced3ad4b8 Fix comment.
llvm-svn: 53473
2008-07-11 20:53:14 +00:00
Ted Kremenek c50e1a196e Refactored auditor interface within GRExprEngine and GRCoreEngine to use a "batch auditor" to dispatch to specialized auditors instead of having a separate vector for each audited Expr*. This not only provides a much cleaner implementation, but also allows us to install auditors for any expression.
llvm-svn: 53464
2008-07-11 18:37:32 +00:00
Ted Kremenek a7b8ffb05b Refactored most of the "Store" piece of ValueState into a Store type. The
current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423
2008-07-10 22:03:41 +00:00
Ted Kremenek 976d1e0ea8 Remove unused class AnnotatedPath.
llvm-svn: 53413
2008-07-10 17:25:03 +00:00
Ted Kremenek ad4a7e4a69 Move some environment methods from ValueState/ValueStateManager to Environment/EnvironmentManager.
llvm-svn: 53412
2008-07-10 17:19:18 +00:00
Ted Kremenek 5f996d5a06 Remove getParentMap() from GRExprEngine.
llvm-svn: 53343
2008-07-09 19:46:42 +00:00
Ted Kremenek ae529271e8 Fix PR2519: correctly handle CFDictionaryCreate.
llvm-svn: 53334
2008-07-09 18:11:16 +00:00
Ted Kremenek 852ed373aa Initial work on splitting the ValueState into an Environment, Store, and
Constraints. These concepts are already present in the current ValueState, but
the implementation is monolothic. Making ValueState more modular opens up new
design choices for customizing the analysis engine.

In the context of the analysis engine, the "Environment" is the binding between
Expr* (expressions) and intermediate symbolic values (RValues).

llvm-svn: 53252
2008-07-08 21:46:56 +00:00
Ted Kremenek 4963d1144f Updated clients of ImmutableMap::SlimFind to use ImmutableMap::lookup instead.
llvm-svn: 53172
2008-07-07 16:21:19 +00:00
Ted Kremenek 37a2c0d5d1 Do not emit a "missing -dealloc" warning if a class contains no ivars that are pointers.
This patch aims to address some of the concerns of PR 2517: http://llvm.org/bugs/show_bug.cgi?id=2517

llvm-svn: 53168
2008-07-07 06:36:08 +00:00
Ted Kremenek 4d85146e6d Use conjured symbols for variables whose values are invalidated when
passed-by-reference to a function. This allows us to build up constraints for
their new values and restore some lost path-sensitivity. This addresses a few
false positives since in Adium.

llvm-svn: 53125
2008-07-03 23:26:32 +00:00
Ted Kremenek 8044046efb Fix a bug in the dead stores checker reported in the following email:
http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-July/002157.html

Essentially the observer mechanism in LiveVariables was observing block-level
expressions multiple times, leading to a case where the dead store checker could
see a value as dead when it was really live.

llvm-svn: 53115
2008-07-03 22:25:27 +00:00
Ted Kremenek 68b117fca4 Skip the "-dealloc" check if a ObjC class contains no ivars.
llvm-svn: 53100
2008-07-03 15:37:02 +00:00
Ted Kremenek e66ca6f35a For the -dealloc checker, check the LangOptions to determine whether or not the code is compiled with GC.
llvm-svn: 53098
2008-07-03 14:35:01 +00:00
Ted Kremenek 1d3c797c90 Have BugReporter::getCFG and BugReporter::getLiveVariables returns pointers instead of references, because they can both fail
on functions we cannot construct full CFGs for yet.

llvm-svn: 53081
2008-07-03 05:26:14 +00:00
Ted Kremenek 0e7d25233e Added static analysis check to see if a subclass of NSObject implements -dealloc, and whether or not that implementation calls [super dealloc].
llvm-svn: 53075
2008-07-03 04:29:21 +00:00
Ted Kremenek c7efb536d5 Unify the code path for the Dead Stores checker to always use the BugReporter interface.
llvm-svn: 53054
2008-07-02 23:16:33 +00:00
Ted Kremenek b1d0118a1a Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.

llvm-svn: 53048
2008-07-02 21:24:01 +00:00
Ted Kremenek 125d4a3b2d GRExprEngine now expects the LiveVariables information to be provided by its creator.
This allows an optimization in AnalysisConsumer where the same LiveVariables information is used between multiple analyses.

llvm-svn: 53046
2008-07-02 20:13:38 +00:00
Ted Kremenek d8ca1f6dd9 Added version of CheckDeadStores that accepts a client-provided LiveVariables object.
Modified the DeadStores logic in AnalysisConsumer.cpp to use the LiveVariables object created by the AnalysisManager.

llvm-svn: 53043
2008-07-02 18:39:20 +00:00
Ted Kremenek ab54e51b38 Unlike NSWindow objects, NSPanel objects initially do not have self-ownership.
llvm-svn: 52963
2008-07-01 17:21:27 +00:00
Ted Kremenek bc6d850088 Temporarily treat "Autorelease" as "StopTracking". This is the original behavior.
llvm-svn: 52940
2008-07-01 00:01:02 +00:00
Ted Kremenek a0e071c861 Added "Autorelease" ArgEffect to better simulate "autorelease" messages. Right
now this does the same thing as "MayEscape", but more functionality will go in
here shortly.

llvm-svn: 52904
2008-06-30 16:57:41 +00:00
Ted Kremenek cf1ab19086 Added a simple static analysis check to look for improper uses of CFCreateNumber.
llvm-svn: 52799
2008-06-26 23:59:48 +00:00
Ted Kremenek 3185c9c9cd CF ref checker:
Tracked objects now have their type information tracked with them.

Enhanced summaries for ObjC methods to include the type information of the receiver.

Used the enhanced summaries to support the idiom that NSWindow owns itself (it sends a release message to itself upon close).

Added some comments.

Did some cleanups with the checker logic using operator overloading (reduced redundant code which I was concerned about being the source of bugs).

llvm-svn: 52741
2008-06-25 21:21:56 +00:00
Ted Kremenek f890bfe0ff Remove unneeded method arguments.
llvm-svn: 52668
2008-06-24 03:56:45 +00:00
Ted Kremenek b1d1329ac7 Cache ObjC summaries by IdentifierInfo*, not by ObjCInterfaceDecl.
llvm-svn: 52667
2008-06-24 03:49:48 +00:00
Ted Kremenek 0cfc16100b Added ObjCSummaryCache, a new summary cache object to cache summaries for Objective-C methods. Instead of mapping from Selectors -> Summaries, we will now map from (ObjCInterfaceDecl*,Selectors) -> Summaries. This will allow more nuanced summary generation. This patch just swaps in the new data structure; the rest of the code works as before by allowing the ObjCInterfaceDecl* to be null.
llvm-svn: 52653
2008-06-23 23:30:29 +00:00
Ted Kremenek ea736c5d02 Rename summary methods for "instance methods" to "class methods" (the names got screwed up). No functionality change.
llvm-svn: 52650
2008-06-23 22:21:20 +00:00
Ted Kremenek ab4a8b5213 The CF retain/release checker now assumes that allocations do not fail. Eventually we will add a flag to the driver to enable allocation failures (documented as a FIXME).
llvm-svn: 52632
2008-06-23 18:02:52 +00:00
Ted Kremenek c9cea053ba When using the dead-stores checker with the BugReporter class, properly capture the diagnostic associated with a specific warning and emit it.
llvm-svn: 52565
2008-06-20 23:13:39 +00:00
Ted Kremenek 34a691734e Modified the dead stores checker to...
1) Check if a dead store appears as a subexpression.  For such cases, we emit
   a verbose diagnostic so that users aren't confused.  This addresses:
   
   <rdar://problem/5968508> checker gives misleading report for dead store in loop
   
2) Don't emit a dead store warning when assigning a null value to a pointer.
   This is a common form of defensive programming.  We may wish to make
   this an option to the the checker one day.
   
   This addresses the feature request in the following email:
   
   http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-June/001978.html

llvm-svn: 52555
2008-06-20 21:45:25 +00:00
Ted Kremenek 46c82ab994 Introduce initial transfer function support for __imag__ and __real__. We don't
have complex RValues yet, so this logic is only fully implemented when __imag__
and __real__ are used on non-complex types.

llvm-svn: 52501
2008-06-19 17:55:38 +00:00
Ted Kremenek 9a935fbdeb Added a new ProgramPoint: PostPurgeDeadSymbols. This new program point distinguishes between the cases when we just evaluated the transfer function of a Stmt* (PostStmt) or performed a load (PostLoad). This solves a caching bug observed in a recent bug report.
llvm-svn: 52443
2008-06-18 05:34:07 +00:00
Ted Kremenek 3802fedfe4 Fix non-termination bug reported by Thomas Clement!
llvm-svn: 52426
2008-06-17 19:14:06 +00:00
Chris Lattner 5696e7badf Change self/_cmd to be instances of ImplicitParamDecl instead of ParmVarDecl.
Patch by David Chisnall!

llvm-svn: 52422
2008-06-17 18:05:57 +00:00
Ted Kremenek 08e171183f This patch is motivated by numerous strict-aliasing warnings when compiling
clang as a Release build.

The big change is that all AST nodes (subclasses of Stmt) whose children are
Expr* store their children as Stmt* or arrays of Stmt*. This is to remove
strict-aliasing warnings when using StmtIterator. None of the interfaces of any
of the classes have changed (except those with arg_iterators, see below), as the
accessor methods introduce the needed casts (via cast<>). While this extra
casting may seem cumbersome, it actually adds some important sanity checks
throughout the codebase, as clients using StmtIterator can potentially overwrite
children that are expected to be Expr* with Stmt* (that aren't Expr*). The casts
provide extra sanity checks that are operational in debug builds to catch
invariant violations such as these.

For classes that have arg_iterators (e.g., CallExpr), the definition of
arg_iterator has been replaced. Instead of it being Expr**, it is an actual
class (called ExprIterator) that wraps a Stmt**, and provides the necessary
operators for iteration. The nice thing about this class is that it also uses
cast<> to type-checking, which introduces extra sanity checks throughout the
codebase that are useful for debugging.

A few of the CodeGen functions that use arg_iterator (especially from
OverloadExpr) have been modified to take begin and end iterators instead of a
base Expr** and the number of arguments. This matches more with the abstraction
of iteration. This still needs to be cleaned up a little bit, as clients expect
that ExprIterator is a RandomAccessIterator (which we may or may not wish to
allow for efficiency of representation).

This is a fairly large patch. It passes the tests (except CodeGen/bitfield.c,
which was already broken) on both a Debug and Release build, but it should
obviously be reviewed.

llvm-svn: 52378
2008-06-17 02:43:46 +00:00
Ted Kremenek 0b6b0e7157 Teach the CF retain checker about "_init" methods. Fixes: <rdar://problem/5956379>
llvm-svn: 51872
2008-06-02 17:14:13 +00:00
Steve Naroff 021ca18bb5 - Move ObjC Expresssion AST's from Expr.h => ExprObjC.h
- #include ExprObjC.h in many places

llvm-svn: 51703
2008-05-29 21:12:08 +00:00
Ted Kremenek b91ef1b62b Prototyped support in the BugReporter to emit diagnostics of the form "p now aliases q".
llvm-svn: 51453
2008-05-22 23:45:19 +00:00
Ted Kremenek 1df2f3a1f5 Expand retain/release checker to consider methods/function calls that cause a
tracked object to "escape": it's reference count might be incremented by the
called function, thus causing an object's lifetime to extend beyond when the
local reference count is decremented to 0.

This addresses: <rdar://problem/5933215>

llvm-svn: 51433
2008-05-22 17:31:13 +00:00
Ted Kremenek a4010c698c Don't use ostringstream (pulling in <sstream>) when creating the dead store diagnostic (simply not needed).
llvm-svn: 51432
2008-05-22 16:28:24 +00:00
Ted Kremenek 91f035cda7 Improve dead stores diagnostics to include the variable name.
llvm-svn: 51395
2008-05-21 22:59:16 +00:00
Ted Kremenek b120ff1b95 Fixed bug in the transfer function for dereferences: the loaded value from EvalLoad should bind to the UnaryOperator*, not its subexpression.
Added test case to exercise this fix when checking for uses of uninitialized values.

Patch by Zhongxing Xu!

llvm-svn: 51377
2008-05-21 15:48:33 +00:00
Nuno Lopes 652eaab03c fix warning with gcc 4.1 (ptr to bool convertion)
llvm-svn: 51324
2008-05-20 17:33:56 +00:00
Ted Kremenek d727220d1a Micro-optimization when checking for panic functions.
llvm-svn: 51214
2008-05-17 00:42:01 +00:00
Ted Kremenek c8081b4e16 Fix 80 col violation.
llvm-svn: 51213
2008-05-17 00:40:45 +00:00
Ted Kremenek 0e76583574 Added panic function _XCAssertionFailureHandler.
llvm-svn: 51212
2008-05-17 00:33:23 +00:00
Ted Kremenek c812b23ce8 Cache leaks by the allocation site, not the leak location.
llvm-svn: 51198
2008-05-16 18:33:44 +00:00
Ted Kremenek 590abd363e Partitioned BugTypeCachedLocation::isCached() into two methods: one that accepts and ExplodedNode, and the other that accepts a ProgramPoint. The default behavior is to cache bug reports by the
location they occur (the end node).  Subclasses can override this behavior by providing a different ProgramPoint.

llvm-svn: 51197
2008-05-16 18:33:14 +00:00
Ted Kremenek a0055a8ef5 Support StringLiteralVal when comparing LVal types.
llvm-svn: 50979
2008-05-12 17:41:30 +00:00
Ted Kremenek acdde6f099 Rename IsPointerType to LVal::IsLValType, and update CFRefCount::EvalSummary to use IsLValType when conjuring symbols for return values (this fixes a bug with an assertion firing in the analyzer when two qualified objective-c types were compared).
llvm-svn: 50924
2008-05-09 23:45:33 +00:00
Ted Kremenek bcdb46830b Added support for "drain".
llvm-svn: 50831
2008-05-07 21:17:39 +00:00
Ted Kremenek f958ec50c0 Expand the CF retain checker to allow the Create/Get rule to apply to any
function that returns a CFxxxRef, not just functions whose name begins with
CF.  This implements <rdar://problem/5917879>.

Added test case for this feature.

Updated calls to CStrInCStrNoCase to swap their arguments, per compatibility
with strcasestr.

llvm-svn: 50829
2008-05-07 20:06:41 +00:00
Ted Kremenek fcf060fd2f Flip order of arguments to CStrInStrNoCase.
llvm-svn: 50824
2008-05-07 18:57:30 +00:00
Ted Kremenek b6cbf28d82 Use llvm::CStrInCStrNoCase instead of strcasestr, since the latter is not portable.
Correctly check if the result of CStrInCStrNoCase is NULL to generate summaries; before we were inverting the condition.

llvm-svn: 50822
2008-05-07 18:36:45 +00:00
Ted Kremenek 89bd0fc27d copy-paste: NS types are not typedefs.
llvm-svn: 50817
2008-05-07 17:35:41 +00:00
Ted Kremenek 7bf9dc773c Do not treat **instance** methods "copyWithZone:" and "mutableCopyWithZone:" from NSObject as allocators.
llvm-svn: 50802
2008-05-07 05:34:45 +00:00
Ted Kremenek 9930bd8c4f Be less promiscuous with generating summaries for "new", "copy", "create".
llvm-svn: 50798
2008-05-07 04:25:59 +00:00
Ted Kremenek 08eb30f193 Added auto-summary generation for createXXX, copyXXX, newXXX methods.
llvm-svn: 50795
2008-05-07 03:45:05 +00:00
Ted Kremenek aec1811c6c Don't report leaks for autoreleased objects.
llvm-svn: 50777
2008-05-06 23:07:13 +00:00
Ted Kremenek 767d0742c7 More comments.
"#if 0" out some assumptions when auto-generating method summaries.

llvm-svn: 50772
2008-05-06 21:26:51 +00:00
Ted Kremenek 10427bdbb9 Experiment with not converting bug names to lower case.
llvm-svn: 50753
2008-05-06 18:11:36 +00:00
Ted Kremenek 8bcc1bd3d5 More refactorings in GeneratePathDiagnostic: use ExecutionContinues to display
"Execution continues..." message, which does a better job at handling corner cases.

llvm-svn: 50751
2008-05-06 18:11:09 +00:00
Ted Kremenek cb2e636606 Generate "stop" summaries for selectors involving receivers whose type is not NSxxxx.
llvm-svn: 50721
2008-05-06 15:44:25 +00:00
Ted Kremenek 68f463b88e Use strncmp correctly.
llvm-svn: 50715
2008-05-06 06:17:42 +00:00
Ted Kremenek 5f478e9a0a Make string comparison legible and remove buffer overrun introduced by typo.
llvm-svn: 50714
2008-05-06 06:09:09 +00:00
Ted Kremenek 2f08fedec1 String comparison cleanups.
Added test case.

llvm-svn: 50711
2008-05-06 04:28:05 +00:00
Ted Kremenek 041d02201f Fix logic error in string processing.
llvm-svn: 50710
2008-05-06 04:21:38 +00:00
Ted Kremenek c9f4948bba Remove assertion.
llvm-svn: 50709
2008-05-06 04:21:10 +00:00
Ted Kremenek 015c3561ad Use EvalSummary to process message expressions, thereby unifying the checker
logic for function calls and message expressions.

Use the following heuristic to infer "allocating" instance methods:

  [ClassName classWithXXX]  allocates an object
  
Update testcase to reflect this heuristic.

llvm-svn: 50708
2008-05-06 04:20:12 +00:00
Ted Kremenek 821537ecdb Added receiver effects to EvalSummary.
llvm-svn: 50700
2008-05-06 02:41:27 +00:00
Ted Kremenek b0862dca6c Expand summaries to include "Receiver" effects.
llvm-svn: 50697
2008-05-06 02:26:56 +00:00
Ted Kremenek be7c56ed78 Added initialization code to generate initial set of ObjC method summaries (non-instance methods).
llvm-svn: 50690
2008-05-06 00:38:54 +00:00
Ted Kremenek 0806f910d4 Added code to generate initial set of summaries for instance methods.
llvm-svn: 50689
2008-05-06 00:30:21 +00:00
Ted Kremenek 3d1e972275 Add summary generation for "initXXX" methods.
llvm-svn: 50684
2008-05-05 23:55:01 +00:00
Ted Kremenek 046845e842 Make CF retain diagnostics more succinct.
In a leak's "name", indicate GC or non-GC bugs.

llvm-svn: 50680
2008-05-05 23:16:31 +00:00
Ted Kremenek f15cd14a3d Emit dead store warnings for ++ and -- operators.
llvm-svn: 50679
2008-05-05 23:12:21 +00:00
Ted Kremenek 00daccdd2a Initial work on refactoring the CFRefCount checker so that it is more
generic and handles reference counts for NSObjects.

llvm-svn: 50674
2008-05-05 22:11:16 +00:00
Ted Kremenek 627c3074dd Improve leak diagnostics to not report a leak on the same line where
the object was last used.  This can be confusing to users.

For example:

 // 'y' is leaked
x = foo(y);

instead:

x = foo(y);
  // 'y' is leaked

llvm-svn: 50661
2008-05-05 18:50:19 +00:00
Ted Kremenek 3917b82e85 Improved leak diagnostics.
llvm-svn: 50657
2008-05-05 17:53:17 +00:00
Ted Kremenek 875db81301 Minor refactorings/cleanups in CF retain checker and added support for NSMakeCollectable.
Added test case for NSMakeCollectable.

llvm-svn: 50653
2008-05-05 16:51:50 +00:00
Ted Kremenek db04a9e967 When reporting branch conditions that evaluate to an uninitialized value,
highlight the most nested subexpression that appears most responsible (giving
the user better diagnostic feedback).

Updated test cases to illustrate this feature.

Implements: <rdar://problem/5880443>
llvm-svn: 50647
2008-05-05 15:56:53 +00:00
Ted Kremenek a5e2df015a Rename member variable.
llvm-svn: 50597
2008-05-02 23:21:21 +00:00
Ted Kremenek 983be7cee6 Improved diagnostics for leaks: now we report which variable was leaked.
llvm-svn: 50588
2008-05-02 20:53:50 +00:00
Ted Kremenek 789942cfda When running the reference count checker twice (GC and non-GC mode), only emit
basic warnings (dead stores, null dereferences) on the first pass.

llvm-svn: 50584
2008-05-02 18:01:49 +00:00
Ted Kremenek bb7386aff5 Really noreturn on exceptions.
llvm-svn: 50579
2008-05-02 17:12:56 +00:00
Ted Kremenek 63d76df236 Fix copy-paste bug.
llvm-svn: 50557
2008-05-01 23:38:35 +00:00
Ted Kremenek 2722f36465 Remove no longer valid assertion.
llvm-svn: 50556
2008-05-01 23:28:56 +00:00
Ted Kremenek 1097b4c61f Added line number diagnostics to indicate the allocation site of the leaked object.
llvm-svn: 50553
2008-05-01 23:13:35 +00:00
Ted Kremenek fabfb4677d Do not highlight bogus ranges for leaks.
llvm-svn: 50549
2008-05-01 22:50:36 +00:00
Ted Kremenek 8a56b06b5c Correctly invalidate reference count state when passing objects by reference in message expressions we don't understand.
llvm-svn: 50541
2008-05-01 21:31:50 +00:00
Ted Kremenek 7f824734e0 Added temporary fix for Obj-C exception handling in the static analyzer: treat these as panic functions.
llvm-svn: 50535
2008-05-01 18:33:28 +00:00
Ted Kremenek f0b0f2edfe Renamed static method.
llvm-svn: 50533
2008-05-01 18:31:44 +00:00
Ted Kremenek b99d01269a Added __assert_rtn to list of panic functions.
llvm-svn: 50530
2008-05-01 17:52:49 +00:00
Ted Kremenek ed36e4b9a4 Added ziperr as a panic function. Eventually inter-procedural analysis
should catch this one easily.

llvm-svn: 50526
2008-05-01 15:55:59 +00:00
Ted Kremenek 9f696852c4 When processing "release", "retain", and "autorelease" messages return the
lval passed as an argument.

Fix: Inverted diagnostic messages.
llvm-svn: 50513
2008-05-01 04:02:04 +00:00
Ted Kremenek 4828aa3152 Added support for "autorelease" message in CF ref. count checker.
llvm-svn: 50512
2008-05-01 02:18:37 +00:00
Ted Kremenek b0f87c48cb added preliminary diagnostics in scan-build results to denote whether
a CF memory leak occurred with GC enabled, etc.

llvm-svn: 50507
2008-04-30 23:47:44 +00:00
Ted Kremenek f20e2285c9 More cleanups with ObjCQualifiedIdType in the static analyzer.
llvm-svn: 50503
2008-04-30 22:48:21 +00:00
Ted Kremenek a16dacb6aa Add placeholder code in the static analyzer for MemberExprs involving struct temporaries.
llvm-svn: 50502
2008-04-30 22:17:15 +00:00
Ted Kremenek ca67cab1e8 Add workaround for __builtin_offsetof in the static analyzer.
llvm-svn: 50500
2008-04-30 21:45:55 +00:00
Ted Kremenek 99057462aa Provide SizeOfAlignTypeExpr workaround in the static analyzer for taking the sizeof of a ObjCInterfaceType.
llvm-svn: 50499
2008-04-30 21:31:12 +00:00
Ted Kremenek e0e8b535cf Support implicit casts from pointers to references.
llvm-svn: 50498
2008-04-30 21:10:19 +00:00
Ted Kremenek 84dea154fc When creating LVals for array entries, canonicalize entries with a 0 index.
llvm-svn: 50497
2008-04-30 21:05:35 +00:00
Ted Kremenek 20d8006e93 Teach more of the static analyzer about ObjCQualifiedIdType.
llvm-svn: 50494
2008-04-30 20:17:27 +00:00
Ted Kremenek 0940b99e3b Teach the static analysis engine about ObjCQualifiedIdType.
llvm-svn: 50493
2008-04-30 20:01:29 +00:00
Ted Kremenek 5ce35cc514 Add conjured symbols for decl initializations.
Add db_error as panic function.

llvm-svn: 50489
2008-04-30 17:54:04 +00:00
Ted Kremenek 39a736f723 Handle lval::ArrayOffset and lval::FieldOffset in EvalNE and EvalEQ.
llvm-svn: 50486
2008-04-30 16:07:22 +00:00
Ted Kremenek 5cc9e60a5f Invalidate old subexpression bindings when binding UnknownVal.
llvm-svn: 50466
2008-04-30 04:23:07 +00:00
Ted Kremenek 9700bd42f0 Simplify RemoveDeadBindings.
llvm-svn: 50458
2008-04-29 23:58:03 +00:00
Ted Kremenek 10246e8bfa Add lval::ArrayOffset, which represent the locations of entries in an array.
llvm-svn: 50453
2008-04-29 23:24:44 +00:00
Ted Kremenek 0d2ccffa83 Added lval::FieldOffset, which represents symbolic lvalues for field offsets from other Lvalues.
This removes the failure in null-deref-ps.c (test suite).

llvm-svn: 50449
2008-04-29 22:17:41 +00:00
Ted Kremenek fa5a3d0fe7 Major rewrite/refactoring of static analysis engine. We now use
EvalStore/EvalLoad to handle all loads/stores from symbolic memory, allowing us
to do checks for null dereferences, etc., at any arbitrary load/store (these
were missed checks before). This also resulted in some major cleanups, some
conceptual, and others just in the structure of the code.

This temporarily introduces a regression in the test suite (null-deref-ps.c)
before I add a new LVal type for structure fields.

llvm-svn: 50443
2008-04-29 21:04:26 +00:00
Ted Kremenek a374ea9a35 Update typestate logic to support GC-mode.
llvm-svn: 50396
2008-04-29 05:44:10 +00:00
Ted Kremenek 4b7ca776cf Implement semantics of CFMakeCollectable for the CF-reference count checker.
llvm-svn: 50395
2008-04-29 05:33:51 +00:00
Ted Kremenek 4d1f422c6f Provide the option to run the CF-retain checker in GC enabled mode.
The transfer functions for the checker don't do anything special yet in GC mode.

llvm-svn: 50394
2008-04-29 05:13:59 +00:00
Argyrios Kyrtzidis fa2d2f2886 Make assertions for all addresses passed to ProgramPoint that they have at least an 8-byte alignment.
llvm-svn: 50310
2008-04-26 15:19:51 +00:00
Ted Kremenek dd38e0bd0d Fix bug in BugReporter where we didn't handle emitting diagnostics for
empty CFGBlocks that only contained a terminator.

Added improved diagnostics for break and continue statements and default branches in switch statements.

This fixes <rdar://problem/5889244>.

llvm-svn: 50286
2008-04-25 19:01:27 +00:00
Ted Kremenek 99131c9f5a Handle dereferences of function pointers (which return a handle to the function).
llvm-svn: 50246
2008-04-25 01:56:50 +00:00
Ted Kremenek 2e5092320e Don't abort on GetRVal when the LVal is a StringLiteralVal.
llvm-svn: 50245
2008-04-25 01:45:38 +00:00
Ted Kremenek 4dd412e022 Don't emit empty strings for path diagnostics when taking the default branch of a switch statement that has no label.
llvm-svn: 50242
2008-04-25 01:29:56 +00:00
Ted Kremenek ecbdf75049 Do a better job at computing dead symbols.
Implemented support for better localized leaks in the CF reference count checker.
Now leaks should be flagged close to where they occur.

This should implement the desired functionality in <rdar://problem/5879592>, although the diagnostics still need to be improved.

llvm-svn: 50241
2008-04-25 01:25:15 +00:00
Ted Kremenek b0daf2f6f5 Add preliminary support for flagging leaks around when they happen (doesn't work yet).
llvm-svn: 50237
2008-04-24 23:57:27 +00:00
Ted Kremenek ae8014cb7e More boilerplate for handling specialized-transfer function logic for dead symbols.
llvm-svn: 50233
2008-04-24 23:35:58 +00:00
Ted Kremenek 3812b7676c Added initial boilerplate in GRExprEngine to allow checker-specific transfer
function logic to act when symbols become dead.

llvm-svn: 50221
2008-04-24 18:31:42 +00:00
Ted Kremenek f7141597e8 CF reference count checker: handle variadic functions that allocate CF objects.
This fixes <rdar://problem/5886141>.

Part of this change resulted in creating sparser summaries.  I also added
some more comments and did some minor code cleanups.

llvm-svn: 50214
2008-04-24 17:22:33 +00:00
Ted Kremenek 21bf6006b0 For case statements involving enums, BugReporter now generates PathDiagnostics
that say that we are jumping to "case a" instead of "case 0".

This is a feature implementation for <rdar://problem/5880430>.

llvm-svn: 50197
2008-04-23 23:35:07 +00:00
Ted Kremenek 05e6267466 Fix minor regression in bug report generation.
llvm-svn: 50195
2008-04-23 23:04:32 +00:00
Ted Kremenek f26bc55b9a When building PathDiagnostics for bug reports, generate a trimmed ExplodedGraph with a single path that BugReport objects can safely walk and introspect.
llvm-svn: 50194
2008-04-23 23:02:12 +00:00
Ted Kremenek dd43aeee54 Fixed: <rdar://problem/5881148>
Problem:

In the recently refactored VisitDeref (which processes dereferences), we
were incorrectly skipping the node just generated for the subexpression
of the dereference.  This was a horrible regression.

llvm-svn: 50176
2008-04-23 20:12:28 +00:00
Ted Kremenek d2419a0730 Remove false path where the default branch in a switch statement would
always be taken even if it was not feasible.

llvm-svn: 50132
2008-04-23 05:03:18 +00:00
Ted Kremenek ef9af73887 Added panic function "assfail".
llvm-svn: 50119
2008-04-23 00:41:25 +00:00
Ted Kremenek 0224ac57e0 For default branches in switch statements with no default label, print out
the line we are going to.

llvm-svn: 50113
2008-04-22 22:29:46 +00:00
Ted Kremenek 3b42715930 Rewrote VisitDeclStmt to properly handle initializers that can do anything.
llvm-svn: 50112
2008-04-22 22:25:27 +00:00
Ted Kremenek c79c0591d6 Added lval type (and tracking) for StringLiterals.
llvm-svn: 50109
2008-04-22 21:39:21 +00:00
Ted Kremenek eccf3e5821 Added "nonlval::LValAsInteger" to represent abstract LVals casted to integers, allowing us to track lvals when they are casted back to pointers.
llvm-svn: 50108
2008-04-22 21:10:18 +00:00
Ted Kremenek 9718c9e8ee PathDiagnosticClients now retain ownership of passed PathDiagnostics, requiring
them to not be stack-allocated.

HTMLDiagnostics now batches PathDiagnostics before emitting HTML in its dtor.
This is a workaround for a problem when we trampled the Preprocessor state
when highlighting macros (sometimes resulting in an assertion failure).

llvm-svn: 50102
2008-04-22 16:15:03 +00:00
Argyrios Kyrtzidis 901a4e406b Use back() instead of end()-1
llvm-svn: 50098
2008-04-22 07:37:18 +00:00
Ted Kremenek 80f2c111bd Added panic function "dtrace_assfail".
llvm-svn: 50091
2008-04-22 06:09:33 +00:00
Ted Kremenek a2cca7dbdf Hardcode "Assert" as a no-return function (panic).
llvm-svn: 50089
2008-04-22 05:37:33 +00:00
Ted Kremenek da5cdda248 Added null-dereference check for ArraySubscriptExpr.
llvm-svn: 50083
2008-04-22 04:56:29 +00:00
Ted Kremenek 38213f9573 Added support for detected bad dereferences involving MemberExprs, e.g. x->f where "x" is NULL.
llvm-svn: 50071
2008-04-21 23:43:38 +00:00