Ted Kremenek
a5bf9cb4be
When we have a binary expression 'int operator symbol', properly rewrite this as
...
'symbol operator-reverse int'. This patch is a combination of code from
Zhongxing Xu and myself (Zhongxing noticed this bug for the cases of
relational operators).
llvm-svn: 56351
2008-09-19 17:31:13 +00:00
Zhongxing Xu
a8e88ecda6
Add an omitted case for AssumeSymInt.
...
llvm-svn: 56334
2008-09-19 06:07:59 +00:00
Ted Kremenek
a417c0e80a
Add panic function "__assert_fail".
...
llvm-svn: 56327
2008-09-19 02:30:47 +00:00
Ted Kremenek
6a1a334b6c
Register the implicit null-dereferenced object as a notable symbol.
...
llvm-svn: 56319
2008-09-18 23:23:19 +00:00
Ted Kremenek
b42f482c91
Implement second part of PR 2600: NSError** parameter may be null, and should be checked before being dereferenced.
...
llvm-svn: 56318
2008-09-18 23:09:54 +00:00
Ted Kremenek
f0673e4eb6
Change implementation of NSError** coding-style check to be invoked at the end of the retain/release analysis.
...
llvm-svn: 56312
2008-09-18 21:25:13 +00:00
Ted Kremenek
fc3abeb1e5
Implemented one of the checks requested in PR 2600:
...
"Method accepting NSError** argument should have non-void return value to indicate that an error occurred."
Test case written, but the header needs to be delta-debugged reduced. Will commit shortly.
llvm-svn: 56297
2008-09-18 06:33:41 +00:00
Ted Kremenek
8782716c4a
Minor pass-sensitivity improvement:
...
if we know that 'len != 0' and know that 'i == 0' then we know that
'i < len' must evaluate to true and cannot evaluate to false
llvm-svn: 56260
2008-09-16 23:24:45 +00:00
Ted Kremenek
0ecb53a421
ProgramPoint now takes the space of two pointers instead of one. This change was
...
motivated because it became clear that the number of subclasses of ProgramPoint
would expand and we ran out of bits to represent a pointer variant. As a plus of
this change, BlockEdge program points can now be represented explicitly without
using a cache of CFGBlock* pairs in CFG.
llvm-svn: 56245
2008-09-16 18:44:52 +00:00
Ted Kremenek
2d470fc0ba
Patch by Csaba Hruska!
...
"Here is a patch what replaces std::ostream with llvm::raw_ostream. This patch
covers the AST library, but ignores Analysis lib."
llvm-svn: 56185
2008-09-13 05:16:45 +00:00
Ted Kremenek
ef2b3a71bb
Add missing spaces in path diagnostics.
...
llvm-svn: 56166
2008-09-12 18:17:46 +00:00
Ted Kremenek
1b9e10390b
Store: (static analyzer)
...
- Change definition of store::Region and store::Binding (once again) to make
them real classes that just wrap pointers. This makes them more strictly
typed, and allows specific implementations of Regions/Bindings to just
subclass them.
- minor renamings to RegionExtent and its subclasses
- added a bunch of doxygen comments
StoreManager: (static analyzer)
- added 'iterBindings', an iteration method for iterating over the bindings of a
store. It that takes a callback object (acting like a poor man's closure).
- added 'getRVal' version for store::Binding. Will potentially phase the other
versions of GetRVal in StoreManager out.
- reimplemented 'getBindings' to be non-virtual and to use 'iterBindings'
BasicStoreManager: (static analyzer)
- implemented 'iterBindings' for BasicStoreManager
llvm-svn: 55688
2008-09-03 03:06:11 +00:00
Daniel Dunbar
c62cf79290
Add newline at end of file.
...
llvm-svn: 55559
2008-08-30 02:06:22 +00:00
Zhongxing Xu
4c23963de8
Added LLVM comment header.
...
llvm-svn: 55537
2008-08-29 15:09:12 +00:00
Zhongxing Xu
c1bd3a5f8b
Migrate the rest symbolic analysis stuff to BasicConstraintManager.
...
llvm-svn: 55536
2008-08-29 14:52:36 +00:00
Ted Kremenek
5043680da4
Remove dead method.
...
llvm-svn: 55526
2008-08-29 03:55:31 +00:00
Ted Kremenek
c83e755d78
Added "getBindings" and "BindingAsString" to GRStateManager and StoreManager.
...
Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of
making assumptions about the Store (removed dependence on GRState::vb_iterator).
llvm-svn: 55522
2008-08-29 00:47:32 +00:00
Ted Kremenek
5909059524
Remove BasicStore.h (migrated function prototype for CreateBasicStore() to Store.h)
...
llvm-svn: 55519
2008-08-28 23:39:42 +00:00
Ted Kremenek
75d2ac956f
Remove Regions.h and Regions.cpp, since we are now using an even more abstract representation of "memory regions" in the static analyzer.
...
llvm-svn: 55515
2008-08-28 23:32:43 +00:00
Ted Kremenek
e91874f71f
Make store "Regions" and "Bindings" more abstract instead of concrete variants.
...
Their precise semantics will be implemented by a specific StoreManager.
Use function pointer to create the StoreManager in GRStateManager. This matches how we create ConstraintsManager.
llvm-svn: 55514
2008-08-28 23:31:31 +00:00
Ted Kremenek
f1b9209a34
Fixed analyzer caching bug involving the transfer function for loads.
...
llvm-svn: 55494
2008-08-28 18:43:46 +00:00
Ted Kremenek
b45e6b91c6
Fixed analyzer caching bug in DeclStmt.
...
llvm-svn: 55487
2008-08-28 18:34:26 +00:00
Ted Kremenek
b5ef37f28e
Make the destructor of ConstraintManager virtual.
...
llvm-svn: 55448
2008-08-27 23:13:01 +00:00
Zhongxing Xu
f71b5f39bb
Refactor Assume logic into a separate class ConstraintManager.
...
llvm-svn: 55412
2008-08-27 14:03:33 +00:00
Ted Kremenek
912c28444f
Added "Auditor" interface for auditing the construction of ExplodedGraphs.
...
llvm-svn: 55403
2008-08-27 01:56:11 +00:00
Ted Kremenek
6f7c419308
Make implementation of ExplodedNodeImpl::addPredecessor out-of-line.
...
llvm-svn: 55402
2008-08-27 01:27:52 +00:00
Ted Kremenek
af665820e4
Remove default value for 'Pred' argument to GRCoreEngineImpl::GenerateNode().
...
llvm-svn: 55392
2008-08-26 22:34:23 +00:00
Ted Kremenek
2a2c875b9c
Added 'extents' for Regions.
...
Added 'getExtent()' to StoreManager.
Implemented 'getExtent()' for BasicStoreManager.
llvm-svn: 55321
2008-08-25 19:33:03 +00:00
Chris Lattner
a2e25e5e72
adjust to changes in various APIs from LLVM. We can't print
...
an APInt directly to an ostream now, so add some hacks. It would
be better to switch all of the bugreport (and friends) stuff over
to raw_ostream.
llvm-svn: 55264
2008-08-23 22:23:37 +00:00
Ted Kremenek
4e7713c04d
Simplify interface to Store::AddDecl
...
llvm-svn: 55213
2008-08-23 00:50:55 +00:00
Zhongxing Xu
614f6a060d
Modify comments.
...
llvm-svn: 55150
2008-08-21 23:00:21 +00:00
Zhongxing Xu
d95495f601
Move the handling of DeclStmt from GRExprEngine to BasicStoreManager.
...
llvm-svn: 55144
2008-08-21 22:34:01 +00:00
Ted Kremenek
e5edbdd4ee
Patch by Zhongxing Xu:
...
This patch moves some code in GRStateManager::RemoveDeadBindings() to EnvironmentManager::RemoveDeadBindings().
llvm-svn: 55064
2008-08-20 17:08:29 +00:00
Ted Kremenek
eb38fde5e5
Patch by Zhongxing Xu: We should set back the modified ConstEq map.
...
llvm-svn: 55060
2008-08-20 16:59:15 +00:00
Ted Kremenek
19edd216f2
Move store pretty-printing logic inside of StoreManager (previously in GRState).
...
llvm-svn: 55013
2008-08-19 22:24:03 +00:00
Ted Kremenek
67102b281e
Patch by Zhongxing Xu!
...
This patch extends BasicStoreManager::getInitialStore() to include code that symbolicates input variables.
It also removes redundant handling of ImplicitParamDecl, since it is a subclass of VarDecl.
llvm-svn: 54993
2008-08-19 16:51:45 +00:00
Argyrios Kyrtzidis
3bab3d21f9
Add ExplicitCastExpr to replace the current CastExpr, and have ImplicitCastExpr and ExplicitCastExpr derive from a common base class (CastExpr):
...
Expr
-> CastExpr
-> ExplicitCastExpr
-> ImplicitCastExpr
llvm-svn: 54955
2008-08-18 23:01:59 +00:00
Chris Lattner
5d1cfa1229
various updates to match r54873 on mainline.
...
llvm-svn: 54874
2008-08-17 07:19:51 +00:00
Ted Kremenek
87aab6c771
Migrate the retain/release checker to not manage the RefBindings::Factory object
...
directly, but instead have GRStateManager manage it.
llvm-svn: 54862
2008-08-17 03:20:02 +00:00
Ted Kremenek
90d488f724
Migrate GRState::ConstEqTy (map used from tracking constants for symbols) to use the generic data map instead.
...
llvm-svn: 54860
2008-08-17 03:10:22 +00:00
Ted Kremenek
edd9a18050
Added GRStateTrait.h, which includes boilerplate code for creating specializations of GRStateTrait<>.
...
Modified GRStateTrait<ConstNotEq> in GRState to use the boilerplate in GRStateTrait<> for ImmutableMaps.
llvm-svn: 54859
2008-08-17 02:59:30 +00:00
Nick Lewycky
0fb45f60d5
It's spelt "uninitialized".
...
llvm-svn: 54848
2008-08-16 17:46:53 +00:00
Ted Kremenek
ceba6ead45
GRState:
...
- Remove ConstNotEq from GRState/GRStateManager (!= tracking uses GDM instead).
- GRStateManager now can book-keep "contexts" (e.g., factory objects) for uses
with data elements stored into the GDM.
- Refactor pretty-printing of states to use GRState::Printer objects
exclusively. This removed a huge amount of pretty-printing logic from
GRExprEngine.
CFRefCount
- Simplified some API calls based on refinements to the GDM api.
llvm-svn: 54835
2008-08-16 00:49:49 +00:00
Ted Kremenek
c7138bb0a7
Default initialize only pointers and integer types (for now).
...
llvm-svn: 54798
2008-08-14 22:11:13 +00:00
Ted Kremenek
db7dd9cd15
Migrated retain/release checker to use the Generic Data Map in GRState (instead
...
of using CheckerState).
Removed CheckerState from GRState.
Added class GRStateRef which wraps GRState* and GRStateManager*. This is handy
for generating new states with a single handle.
Added member template set/get functions to GRStateRef/GRState/GRStateManager for
accessing the Generic Data Map.
llvm-svn: 54788
2008-08-14 21:16:54 +00:00
Ted Kremenek
16306107cf
Renamed GRState::CheckerStatePrinter to GRState::Printer.
...
Updated checker state printer interface to allow transfer functions to return an arbitrary number of GRState::Printers.
llvm-svn: 54762
2008-08-13 21:24:49 +00:00
Ted Kremenek
0e7d96c370
Rename ValueState.h -> GRState.h
...
Rename ValueState.cpp -> GRState.cpp
llvm-svn: 54722
2008-08-13 04:28:02 +00:00
Ted Kremenek
5ab5a1b578
Rename ValueState -> GRState.
...
Rename ValueStateManager -> GRStateManager.
llvm-svn: 54721
2008-08-13 04:27:00 +00:00
Ted Kremenek
dccd9883c4
Initialize tracked local variables to undefined.
...
llvm-svn: 54716
2008-08-13 03:28:04 +00:00
Ted Kremenek
3f91f037a7
Fix memory leak found by Sam Bishop: delete WList in the dstor of GRCoreEngineImpl.
...
llvm-svn: 54714
2008-08-13 03:10:52 +00:00
Ted Kremenek
27fb019038
Added GenericDataMap as a component of ValueState.
...
llvm-svn: 54704
2008-08-12 21:49:24 +00:00
Ted Kremenek
9551ab6c8c
More cleanups. Add missing #include.
...
llvm-svn: 54699
2008-08-12 20:41:56 +00:00
Ted Kremenek
3f13f598ce
More summary generation refactoring.
...
llvm-svn: 54696
2008-08-12 18:48:50 +00:00
Ted Kremenek
050b91cd28
Add variadic addInstMethSummary() and refactored addPanicSummary() to use this method. (code reduction).
...
Misc. cleanups.
llvm-svn: 54694
2008-08-12 18:30:56 +00:00
Daniel Dunbar
6e8aa537f8
More #include cleaning
...
- Drop {Decl.h,DeclObjC.h,IdentifierTable.h} from Expr.h
- Moved Sema::getCurMethodDecl() out of line (dependent on
ObjCMethodDecl via dyn_cast).
llvm-svn: 54629
2008-08-11 05:35:13 +00:00
Nico Weber
4c3116437c
* Remove isInSystemHeader() from DiagClient, move it to SourceManager
...
* Move FormatError() from TextDiagnostic up to DiagClient, remove now
empty class TextDiagnostic
* Make DiagClient optional for Diagnostic
This fixes the following problems:
* -html-diags (and probably others) does now output the same set of
warnings as console clang does
* nothing crashes if one forgets to call setHeaderSearch() on
TextDiagnostic
* some code duplication is removed
llvm-svn: 54620
2008-08-10 19:59:06 +00:00
Chris Lattner
6307f19726
rename PreDefinedExpr -> PredefinedExpr
...
llvm-svn: 54605
2008-08-10 01:53:14 +00:00
Ted Kremenek
4455a9d378
Added FIXME.
...
llvm-svn: 54568
2008-08-09 00:41:45 +00:00
Ted Kremenek
0216b83d94
Don't use Expr::isIntegerConstantExpr just to check if a pointer value is initialize to NULL.
...
llvm-svn: 54563
2008-08-09 00:05:14 +00:00
Ted Kremenek
4b1327960d
Added AssumeSymGT, AssumeSymGE, AssumeSymLT, AssumeSymLE to add some minor improvements to path-sensitivity. Right now we basically treat 'x > y' and 'x < y' as implying 'x != y', but this restriction will only inevitably apply to our must rudimentary value tracking component (we'll implement more advanced value reasoning later).
...
llvm-svn: 54493
2008-08-07 22:30:22 +00:00
Ted Kremenek
18391f432b
Don't flag any dead stores for variables marked unused.
...
llvm-svn: 54492
2008-08-07 22:28:30 +00:00
Ted Kremenek
4f8792b616
Added decl_iterator to DeclStmt to provide an abstract interface to iterate over the ScopedDecls of a DeclStmt.
...
Updated a few clients of DeclStmt::getNextDeclarator() to use decl_iterator instead. Will update other clients after additional testing.
llvm-svn: 54368
2008-08-05 20:46:55 +00:00
Ted Kremenek
9512c122fa
Change 'dead store (++/--)' to 'dead increment'
...
llvm-svn: 54268
2008-08-02 18:19:48 +00:00
Ted Kremenek
a7045d663d
Enhanced path-sensitive return-of-stack-address check to print out the name of the variable whose address was returned.
...
llvm-svn: 54253
2008-07-31 20:31:27 +00:00
Ted Kremenek
a8b8ce499a
Add range highlighting for path-sensitive return-of-stack-address check.
...
llvm-svn: 54219
2008-07-30 17:49:12 +00:00
Chris Lattner
3f6cd0bc76
remove some unneeded calls to getCanonicalType
...
llvm-svn: 54106
2008-07-26 22:36:27 +00:00
Chris Lattner
574dee6cac
change more instances of QualType::getCanonicalType to call
...
ASTContext::getCanonicalType instead (PR2189)
llvm-svn: 54105
2008-07-26 22:17:49 +00:00
Ted Kremenek
d074ce47b6
Have the UnusedIvar check skip ivars with setters/getters created by @synthesize.
...
llvm-svn: 54050
2008-07-25 20:28:02 +00:00
Ted Kremenek
83ec24501e
Remove call to isSEL and isSEL itself since the call is dead (isObjCObjectPointerType() will never return true for selectors).
...
llvm-svn: 54034
2008-07-25 18:17:35 +00:00
Ted Kremenek
2483730e3f
Only warn about missing/incomplete -dealloc implementations when a class contains a non-SEL, non-IBOutlet ivar that references an ObjC object.
...
llvm-svn: 54024
2008-07-25 17:04:49 +00:00
Ted Kremenek
092ec76923
Don't emit 'dead initialization' warnings for variables marked 'unused'.
...
This fixes PR 2573: http://llvm.org/bugs/show_bug.cgi?id=2573
llvm-svn: 54009
2008-07-25 04:47:34 +00:00
Ted Kremenek
5eb536b74c
Use ASTContext::isObjCObjectPointerType() to check if an ivar is a reference to an Objective-C object.
...
llvm-svn: 53999
2008-07-24 23:59:07 +00:00
Ted Kremenek
9e9afb552c
Correctly handle NSAssertionHandle -handleFailureInMethod:object:file:lineNumber:description:
...
This fixes: http://llvm.org/bugs/show_bug.cgi?id=2593
llvm-svn: 53993
2008-07-24 18:47:16 +00:00
Ted Kremenek
0e60b7588a
Don't issue a missing +dealloc warning for classes that just contain SEL ivars.
...
This fixes PR 2592: http://llvm.org/bugs/show_bug.cgi?id=2592
llvm-svn: 53987
2008-07-24 17:45:56 +00:00
Ted Kremenek
87b16f4258
Issue dead store warnings for preincrements involved in a subexpression.
...
llvm-svn: 53983
2008-07-24 17:01:17 +00:00
Ted Kremenek
9572cae92b
Don't flag dead stores when the result of a preincrement/predecrement is used in an enclosing expression.
...
llvm-svn: 53964
2008-07-23 22:19:56 +00:00
Ted Kremenek
ecc851bb6e
Further refine dead store checking to distinguish between dead stores and dead increments.
...
llvm-svn: 53960
2008-07-23 21:16:38 +00:00
Ted Kremenek
46abc7db6b
Properly skip IBOutlets when checking for unused ivars.
...
Refine the error message of unused ivars.
Added test case.
llvm-svn: 53957
2008-07-23 18:21:36 +00:00
Ted Kremenek
6b6a4b6446
Ivar access mode ObjCIvarDecl::None == ObjCIvarDecl::Protected, not private.
...
llvm-svn: 53953
2008-07-23 17:14:39 +00:00
Ted Kremenek
3b28f4911c
Add prototype implementation of unused ivar check.
...
llvm-svn: 53942
2008-07-23 00:45:26 +00:00
Ted Kremenek
1f352db96a
Moved registration of basic path-sensitive checks from GRSimpleVals.cpp to GRExprEngineInternalChecks.cpp.
...
llvm-svn: 53909
2008-07-22 16:21:24 +00:00
Ted Kremenek
6bb53303e1
Rename file.
...
llvm-svn: 53906
2008-07-22 14:41:47 +00:00
Ted Kremenek
98f6e582f2
Added path-sensitive checking for null pointer values passed to function arguments marked nonnull.
...
This implements <rdar://problem/6069935>
llvm-svn: 53891
2008-07-22 00:46:16 +00:00
Ted Kremenek
f41b1c45fa
"currentHandler" is a nullary selector
...
llvm-svn: 53763
2008-07-18 18:14:26 +00:00
Ted Kremenek
f7faa42c6c
Fix caching bug.
...
llvm-svn: 53759
2008-07-18 17:39:56 +00:00
Ted Kremenek
3b2294c7e6
Add panic support for NSAssertionHandler.
...
llvm-svn: 53758
2008-07-18 17:24:20 +00:00
Ted Kremenek
d785465167
Add panic function.
...
llvm-svn: 53755
2008-07-18 16:28:33 +00:00
Ted Kremenek
36f6b04295
Fix 80 col violation
...
llvm-svn: 53754
2008-07-18 15:59:33 +00:00
Ted Kremenek
b1c91bfc45
Fix regression by explicitly checking if we are negating a SymIntConstantVal.
...
llvm-svn: 53753
2008-07-18 15:54:51 +00:00
Ted Kremenek
6a62d908c3
Improve path-sensitivity when using the logical not operator.
...
llvm-svn: 53752
2008-07-18 15:46:06 +00:00
Ted Kremenek
91614e6fe6
Renamed deterministic EvalBinOp to DetermEvalBinOpNN. This name mangling is unfortunately needed because virtual methods with the same name can be hidden by subclasses.
...
llvm-svn: 53751
2008-07-18 15:27:58 +00:00
Ted Kremenek
8d6b42e096
Created ValueStateSet class to manage the creation of multiple states by a method.
...
Modified the new EvalBinOpNN to generate states instead of nodes. This is a much simpler interface and is what clients will want to do.
llvm-svn: 53750
2008-07-18 05:53:58 +00:00
Ted Kremenek
e330aacbed
Update signature of EvalAssume.
...
llvm-svn: 53745
2008-07-17 23:33:10 +00:00
Ted Kremenek
9c32a1ecf5
Move GRTransferFunc* into ValueStateManager, and move the assumption logic there as well.
...
llvm-svn: 53743
2008-07-17 23:15:45 +00:00
Ted Kremenek
a79d9a9c79
Remove redundant logic.
...
llvm-svn: 53740
2008-07-17 21:36:43 +00:00
Ted Kremenek
bc9118b165
Begin major changes to EvalXXX methods in GRTransferFuncs. Currently some of the methods only return an RVal; we want them to be able to create an arbitrary number of states.
...
llvm-svn: 53739
2008-07-17 21:27:31 +00:00
Ted Kremenek
88a6b7fa80
Moved RemoveDeadBindings logic for the contents of 'Store' to a virtual RemoveDeadBindings method in StoreManager.
...
llvm-svn: 53726
2008-07-17 18:38:48 +00:00
Ted Kremenek
ae543148bc
Fix regression introduced by http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20080714/006514.html .
...
The regression was the casts from integers to pointers where not being handled: they would just return UnknownVal. This would greatly decrease path-sensitivity.
llvm-svn: 53659
2008-07-16 00:23:49 +00:00
Ted Kremenek
f46dddac5b
Fix transfer function logic in GRSimpleVals for integer casts: only support casts from integers to integers.
...
This fixes a crash reported by Anders Carlsson!
llvm-svn: 53649
2008-07-15 23:17:54 +00:00
Ted Kremenek
ed1f72b67c
For the MissingDealloc check, don't treat IBOutlet ivars as being needed to be released
...
llvm-svn: 53647
2008-07-15 23:04:27 +00:00
Ted Kremenek
81bfc074c9
Distinguish between dead stores and dead initializations.
...
llvm-svn: 53628
2008-07-15 18:06:32 +00:00
Ted Kremenek
176e2c519d
isRetain() and isRelease() now only returns true if "Retain"/"Release" appears in the suffix of a function's name.
...
llvm-svn: 53621
2008-07-15 17:43:41 +00:00
Ted Kremenek
fa89e2f09c
Support retain/release tracking for CoreGraphics (CGxxxRef) objects.
...
llvm-svn: 53617
2008-07-15 16:50:12 +00:00
Ted Kremenek
c18255d80f
Refactor Dead Stores error reporting to use the simplified BugReporter::EmitBasicReport interface.
...
llvm-svn: 53573
2008-07-14 20:56:04 +00:00
Ted Kremenek
0255531dd3
Added method "EmitBasicReport" to BugReporter to simplify the emission of simple bug diagnostics.
...
Refactored error reporting in CheckObjCDealloc and CheckObjCInstMethSignature to use this new bug reporting interface (major code simplification).
llvm-svn: 53560
2008-07-14 17:40:50 +00:00
Ted Kremenek
e5b5953672
Tidy up error message.
...
llvm-svn: 53493
2008-07-11 23:17:01 +00:00
Ted Kremenek
3bfb314c25
Add new check: -check-objc-methodsigs. This check scans methods in
...
ObjCImplementationDecls and sees if a ancestor class defines a method with the
same selector but with a different type signature. Right now it just compares
return types, and mainly looks at differences in primitive values. The checking
will be expanded in the future.
llvm-svn: 53482
2008-07-11 22:40:47 +00:00
Ted Kremenek
aced3ad4b8
Fix comment.
...
llvm-svn: 53473
2008-07-11 20:53:14 +00:00
Ted Kremenek
c50e1a196e
Refactored auditor interface within GRExprEngine and GRCoreEngine to use a "batch auditor" to dispatch to specialized auditors instead of having a separate vector for each audited Expr*. This not only provides a much cleaner implementation, but also allows us to install auditors for any expression.
...
llvm-svn: 53464
2008-07-11 18:37:32 +00:00
Ted Kremenek
a7b8ffb05b
Refactored most of the "Store" piece of ValueState into a Store type. The
...
current store implementation is now encapsulated by BasicStore.
These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.
llvm-svn: 53423
2008-07-10 22:03:41 +00:00
Ted Kremenek
976d1e0ea8
Remove unused class AnnotatedPath.
...
llvm-svn: 53413
2008-07-10 17:25:03 +00:00
Ted Kremenek
ad4a7e4a69
Move some environment methods from ValueState/ValueStateManager to Environment/EnvironmentManager.
...
llvm-svn: 53412
2008-07-10 17:19:18 +00:00
Ted Kremenek
5f996d5a06
Remove getParentMap() from GRExprEngine.
...
llvm-svn: 53343
2008-07-09 19:46:42 +00:00
Ted Kremenek
ae529271e8
Fix PR2519: correctly handle CFDictionaryCreate.
...
llvm-svn: 53334
2008-07-09 18:11:16 +00:00
Ted Kremenek
852ed373aa
Initial work on splitting the ValueState into an Environment, Store, and
...
Constraints. These concepts are already present in the current ValueState, but
the implementation is monolothic. Making ValueState more modular opens up new
design choices for customizing the analysis engine.
In the context of the analysis engine, the "Environment" is the binding between
Expr* (expressions) and intermediate symbolic values (RValues).
llvm-svn: 53252
2008-07-08 21:46:56 +00:00
Ted Kremenek
4963d1144f
Updated clients of ImmutableMap::SlimFind to use ImmutableMap::lookup instead.
...
llvm-svn: 53172
2008-07-07 16:21:19 +00:00
Ted Kremenek
37a2c0d5d1
Do not emit a "missing -dealloc" warning if a class contains no ivars that are pointers.
...
This patch aims to address some of the concerns of PR 2517: http://llvm.org/bugs/show_bug.cgi?id=2517
llvm-svn: 53168
2008-07-07 06:36:08 +00:00
Ted Kremenek
4d85146e6d
Use conjured symbols for variables whose values are invalidated when
...
passed-by-reference to a function. This allows us to build up constraints for
their new values and restore some lost path-sensitivity. This addresses a few
false positives since in Adium.
llvm-svn: 53125
2008-07-03 23:26:32 +00:00
Ted Kremenek
8044046efb
Fix a bug in the dead stores checker reported in the following email:
...
http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-July/002157.html
Essentially the observer mechanism in LiveVariables was observing block-level
expressions multiple times, leading to a case where the dead store checker could
see a value as dead when it was really live.
llvm-svn: 53115
2008-07-03 22:25:27 +00:00
Ted Kremenek
68b117fca4
Skip the "-dealloc" check if a ObjC class contains no ivars.
...
llvm-svn: 53100
2008-07-03 15:37:02 +00:00
Ted Kremenek
e66ca6f35a
For the -dealloc checker, check the LangOptions to determine whether or not the code is compiled with GC.
...
llvm-svn: 53098
2008-07-03 14:35:01 +00:00
Ted Kremenek
1d3c797c90
Have BugReporter::getCFG and BugReporter::getLiveVariables returns pointers instead of references, because they can both fail
...
on functions we cannot construct full CFGs for yet.
llvm-svn: 53081
2008-07-03 05:26:14 +00:00
Ted Kremenek
0e7d25233e
Added static analysis check to see if a subclass of NSObject implements -dealloc, and whether or not that implementation calls [super dealloc].
...
llvm-svn: 53075
2008-07-03 04:29:21 +00:00
Ted Kremenek
c7efb536d5
Unify the code path for the Dead Stores checker to always use the BugReporter interface.
...
llvm-svn: 53054
2008-07-02 23:16:33 +00:00
Ted Kremenek
b1d0118a1a
Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
...
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.
llvm-svn: 53048
2008-07-02 21:24:01 +00:00
Ted Kremenek
125d4a3b2d
GRExprEngine now expects the LiveVariables information to be provided by its creator.
...
This allows an optimization in AnalysisConsumer where the same LiveVariables information is used between multiple analyses.
llvm-svn: 53046
2008-07-02 20:13:38 +00:00
Ted Kremenek
d8ca1f6dd9
Added version of CheckDeadStores that accepts a client-provided LiveVariables object.
...
Modified the DeadStores logic in AnalysisConsumer.cpp to use the LiveVariables object created by the AnalysisManager.
llvm-svn: 53043
2008-07-02 18:39:20 +00:00
Ted Kremenek
ab54e51b38
Unlike NSWindow objects, NSPanel objects initially do not have self-ownership.
...
llvm-svn: 52963
2008-07-01 17:21:27 +00:00
Ted Kremenek
bc6d850088
Temporarily treat "Autorelease" as "StopTracking". This is the original behavior.
...
llvm-svn: 52940
2008-07-01 00:01:02 +00:00
Ted Kremenek
a0e071c861
Added "Autorelease" ArgEffect to better simulate "autorelease" messages. Right
...
now this does the same thing as "MayEscape", but more functionality will go in
here shortly.
llvm-svn: 52904
2008-06-30 16:57:41 +00:00
Ted Kremenek
cf1ab19086
Added a simple static analysis check to look for improper uses of CFCreateNumber.
...
llvm-svn: 52799
2008-06-26 23:59:48 +00:00
Ted Kremenek
3185c9c9cd
CF ref checker:
...
Tracked objects now have their type information tracked with them.
Enhanced summaries for ObjC methods to include the type information of the receiver.
Used the enhanced summaries to support the idiom that NSWindow owns itself (it sends a release message to itself upon close).
Added some comments.
Did some cleanups with the checker logic using operator overloading (reduced redundant code which I was concerned about being the source of bugs).
llvm-svn: 52741
2008-06-25 21:21:56 +00:00
Ted Kremenek
f890bfe0ff
Remove unneeded method arguments.
...
llvm-svn: 52668
2008-06-24 03:56:45 +00:00
Ted Kremenek
b1d1329ac7
Cache ObjC summaries by IdentifierInfo*, not by ObjCInterfaceDecl.
...
llvm-svn: 52667
2008-06-24 03:49:48 +00:00
Ted Kremenek
0cfc16100b
Added ObjCSummaryCache, a new summary cache object to cache summaries for Objective-C methods. Instead of mapping from Selectors -> Summaries, we will now map from (ObjCInterfaceDecl*,Selectors) -> Summaries. This will allow more nuanced summary generation. This patch just swaps in the new data structure; the rest of the code works as before by allowing the ObjCInterfaceDecl* to be null.
...
llvm-svn: 52653
2008-06-23 23:30:29 +00:00
Ted Kremenek
ea736c5d02
Rename summary methods for "instance methods" to "class methods" (the names got screwed up). No functionality change.
...
llvm-svn: 52650
2008-06-23 22:21:20 +00:00
Ted Kremenek
ab4a8b5213
The CF retain/release checker now assumes that allocations do not fail. Eventually we will add a flag to the driver to enable allocation failures (documented as a FIXME).
...
llvm-svn: 52632
2008-06-23 18:02:52 +00:00
Ted Kremenek
c9cea053ba
When using the dead-stores checker with the BugReporter class, properly capture the diagnostic associated with a specific warning and emit it.
...
llvm-svn: 52565
2008-06-20 23:13:39 +00:00
Ted Kremenek
34a691734e
Modified the dead stores checker to...
...
1) Check if a dead store appears as a subexpression. For such cases, we emit
a verbose diagnostic so that users aren't confused. This addresses:
<rdar://problem/5968508> checker gives misleading report for dead store in loop
2) Don't emit a dead store warning when assigning a null value to a pointer.
This is a common form of defensive programming. We may wish to make
this an option to the the checker one day.
This addresses the feature request in the following email:
http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-June/001978.html
llvm-svn: 52555
2008-06-20 21:45:25 +00:00
Ted Kremenek
46c82ab994
Introduce initial transfer function support for __imag__ and __real__. We don't
...
have complex RValues yet, so this logic is only fully implemented when __imag__
and __real__ are used on non-complex types.
llvm-svn: 52501
2008-06-19 17:55:38 +00:00
Ted Kremenek
9a935fbdeb
Added a new ProgramPoint: PostPurgeDeadSymbols. This new program point distinguishes between the cases when we just evaluated the transfer function of a Stmt* (PostStmt) or performed a load (PostLoad). This solves a caching bug observed in a recent bug report.
...
llvm-svn: 52443
2008-06-18 05:34:07 +00:00
Ted Kremenek
3802fedfe4
Fix non-termination bug reported by Thomas Clement!
...
llvm-svn: 52426
2008-06-17 19:14:06 +00:00
Chris Lattner
5696e7badf
Change self/_cmd to be instances of ImplicitParamDecl instead of ParmVarDecl.
...
Patch by David Chisnall!
llvm-svn: 52422
2008-06-17 18:05:57 +00:00
Ted Kremenek
08e171183f
This patch is motivated by numerous strict-aliasing warnings when compiling
...
clang as a Release build.
The big change is that all AST nodes (subclasses of Stmt) whose children are
Expr* store their children as Stmt* or arrays of Stmt*. This is to remove
strict-aliasing warnings when using StmtIterator. None of the interfaces of any
of the classes have changed (except those with arg_iterators, see below), as the
accessor methods introduce the needed casts (via cast<>). While this extra
casting may seem cumbersome, it actually adds some important sanity checks
throughout the codebase, as clients using StmtIterator can potentially overwrite
children that are expected to be Expr* with Stmt* (that aren't Expr*). The casts
provide extra sanity checks that are operational in debug builds to catch
invariant violations such as these.
For classes that have arg_iterators (e.g., CallExpr), the definition of
arg_iterator has been replaced. Instead of it being Expr**, it is an actual
class (called ExprIterator) that wraps a Stmt**, and provides the necessary
operators for iteration. The nice thing about this class is that it also uses
cast<> to type-checking, which introduces extra sanity checks throughout the
codebase that are useful for debugging.
A few of the CodeGen functions that use arg_iterator (especially from
OverloadExpr) have been modified to take begin and end iterators instead of a
base Expr** and the number of arguments. This matches more with the abstraction
of iteration. This still needs to be cleaned up a little bit, as clients expect
that ExprIterator is a RandomAccessIterator (which we may or may not wish to
allow for efficiency of representation).
This is a fairly large patch. It passes the tests (except CodeGen/bitfield.c,
which was already broken) on both a Debug and Release build, but it should
obviously be reviewed.
llvm-svn: 52378
2008-06-17 02:43:46 +00:00
Ted Kremenek
0b6b0e7157
Teach the CF retain checker about "_init" methods. Fixes: <rdar://problem/5956379>
...
llvm-svn: 51872
2008-06-02 17:14:13 +00:00
Steve Naroff
021ca18bb5
- Move ObjC Expresssion AST's from Expr.h => ExprObjC.h
...
- #include ExprObjC.h in many places
llvm-svn: 51703
2008-05-29 21:12:08 +00:00
Ted Kremenek
b91ef1b62b
Prototyped support in the BugReporter to emit diagnostics of the form "p now aliases q".
...
llvm-svn: 51453
2008-05-22 23:45:19 +00:00
Ted Kremenek
1df2f3a1f5
Expand retain/release checker to consider methods/function calls that cause a
...
tracked object to "escape": it's reference count might be incremented by the
called function, thus causing an object's lifetime to extend beyond when the
local reference count is decremented to 0.
This addresses: <rdar://problem/5933215>
llvm-svn: 51433
2008-05-22 17:31:13 +00:00
Ted Kremenek
a4010c698c
Don't use ostringstream (pulling in <sstream>) when creating the dead store diagnostic (simply not needed).
...
llvm-svn: 51432
2008-05-22 16:28:24 +00:00
Ted Kremenek
91f035cda7
Improve dead stores diagnostics to include the variable name.
...
llvm-svn: 51395
2008-05-21 22:59:16 +00:00
Ted Kremenek
b120ff1b95
Fixed bug in the transfer function for dereferences: the loaded value from EvalLoad should bind to the UnaryOperator*, not its subexpression.
...
Added test case to exercise this fix when checking for uses of uninitialized values.
Patch by Zhongxing Xu!
llvm-svn: 51377
2008-05-21 15:48:33 +00:00
Nuno Lopes
652eaab03c
fix warning with gcc 4.1 (ptr to bool convertion)
...
llvm-svn: 51324
2008-05-20 17:33:56 +00:00
Ted Kremenek
d727220d1a
Micro-optimization when checking for panic functions.
...
llvm-svn: 51214
2008-05-17 00:42:01 +00:00
Ted Kremenek
c8081b4e16
Fix 80 col violation.
...
llvm-svn: 51213
2008-05-17 00:40:45 +00:00
Ted Kremenek
0e76583574
Added panic function _XCAssertionFailureHandler.
...
llvm-svn: 51212
2008-05-17 00:33:23 +00:00
Ted Kremenek
c812b23ce8
Cache leaks by the allocation site, not the leak location.
...
llvm-svn: 51198
2008-05-16 18:33:44 +00:00
Ted Kremenek
590abd363e
Partitioned BugTypeCachedLocation::isCached() into two methods: one that accepts and ExplodedNode, and the other that accepts a ProgramPoint. The default behavior is to cache bug reports by the
...
location they occur (the end node). Subclasses can override this behavior by providing a different ProgramPoint.
llvm-svn: 51197
2008-05-16 18:33:14 +00:00
Ted Kremenek
a0055a8ef5
Support StringLiteralVal when comparing LVal types.
...
llvm-svn: 50979
2008-05-12 17:41:30 +00:00
Ted Kremenek
acdde6f099
Rename IsPointerType to LVal::IsLValType, and update CFRefCount::EvalSummary to use IsLValType when conjuring symbols for return values (this fixes a bug with an assertion firing in the analyzer when two qualified objective-c types were compared).
...
llvm-svn: 50924
2008-05-09 23:45:33 +00:00
Ted Kremenek
bcdb46830b
Added support for "drain".
...
llvm-svn: 50831
2008-05-07 21:17:39 +00:00
Ted Kremenek
f958ec50c0
Expand the CF retain checker to allow the Create/Get rule to apply to any
...
function that returns a CFxxxRef, not just functions whose name begins with
CF. This implements <rdar://problem/5917879>.
Added test case for this feature.
Updated calls to CStrInCStrNoCase to swap their arguments, per compatibility
with strcasestr.
llvm-svn: 50829
2008-05-07 20:06:41 +00:00
Ted Kremenek
fcf060fd2f
Flip order of arguments to CStrInStrNoCase.
...
llvm-svn: 50824
2008-05-07 18:57:30 +00:00
Ted Kremenek
b6cbf28d82
Use llvm::CStrInCStrNoCase instead of strcasestr, since the latter is not portable.
...
Correctly check if the result of CStrInCStrNoCase is NULL to generate summaries; before we were inverting the condition.
llvm-svn: 50822
2008-05-07 18:36:45 +00:00
Ted Kremenek
89bd0fc27d
copy-paste: NS types are not typedefs.
...
llvm-svn: 50817
2008-05-07 17:35:41 +00:00
Ted Kremenek
7bf9dc773c
Do not treat **instance** methods "copyWithZone:" and "mutableCopyWithZone:" from NSObject as allocators.
...
llvm-svn: 50802
2008-05-07 05:34:45 +00:00
Ted Kremenek
9930bd8c4f
Be less promiscuous with generating summaries for "new", "copy", "create".
...
llvm-svn: 50798
2008-05-07 04:25:59 +00:00
Ted Kremenek
08eb30f193
Added auto-summary generation for createXXX, copyXXX, newXXX methods.
...
llvm-svn: 50795
2008-05-07 03:45:05 +00:00
Ted Kremenek
aec1811c6c
Don't report leaks for autoreleased objects.
...
llvm-svn: 50777
2008-05-06 23:07:13 +00:00
Ted Kremenek
767d0742c7
More comments.
...
"#if 0" out some assumptions when auto-generating method summaries.
llvm-svn: 50772
2008-05-06 21:26:51 +00:00
Ted Kremenek
10427bdbb9
Experiment with not converting bug names to lower case.
...
llvm-svn: 50753
2008-05-06 18:11:36 +00:00
Ted Kremenek
8bcc1bd3d5
More refactorings in GeneratePathDiagnostic: use ExecutionContinues to display
...
"Execution continues..." message, which does a better job at handling corner cases.
llvm-svn: 50751
2008-05-06 18:11:09 +00:00
Ted Kremenek
cb2e636606
Generate "stop" summaries for selectors involving receivers whose type is not NSxxxx.
...
llvm-svn: 50721
2008-05-06 15:44:25 +00:00
Ted Kremenek
68f463b88e
Use strncmp correctly.
...
llvm-svn: 50715
2008-05-06 06:17:42 +00:00
Ted Kremenek
5f478e9a0a
Make string comparison legible and remove buffer overrun introduced by typo.
...
llvm-svn: 50714
2008-05-06 06:09:09 +00:00
Ted Kremenek
2f08fedec1
String comparison cleanups.
...
Added test case.
llvm-svn: 50711
2008-05-06 04:28:05 +00:00
Ted Kremenek
041d02201f
Fix logic error in string processing.
...
llvm-svn: 50710
2008-05-06 04:21:38 +00:00
Ted Kremenek
c9f4948bba
Remove assertion.
...
llvm-svn: 50709
2008-05-06 04:21:10 +00:00
Ted Kremenek
015c3561ad
Use EvalSummary to process message expressions, thereby unifying the checker
...
logic for function calls and message expressions.
Use the following heuristic to infer "allocating" instance methods:
[ClassName classWithXXX] allocates an object
Update testcase to reflect this heuristic.
llvm-svn: 50708
2008-05-06 04:20:12 +00:00
Ted Kremenek
821537ecdb
Added receiver effects to EvalSummary.
...
llvm-svn: 50700
2008-05-06 02:41:27 +00:00
Ted Kremenek
b0862dca6c
Expand summaries to include "Receiver" effects.
...
llvm-svn: 50697
2008-05-06 02:26:56 +00:00
Ted Kremenek
be7c56ed78
Added initialization code to generate initial set of ObjC method summaries (non-instance methods).
...
llvm-svn: 50690
2008-05-06 00:38:54 +00:00
Ted Kremenek
0806f910d4
Added code to generate initial set of summaries for instance methods.
...
llvm-svn: 50689
2008-05-06 00:30:21 +00:00
Ted Kremenek
3d1e972275
Add summary generation for "initXXX" methods.
...
llvm-svn: 50684
2008-05-05 23:55:01 +00:00
Ted Kremenek
046845e842
Make CF retain diagnostics more succinct.
...
In a leak's "name", indicate GC or non-GC bugs.
llvm-svn: 50680
2008-05-05 23:16:31 +00:00
Ted Kremenek
f15cd14a3d
Emit dead store warnings for ++ and -- operators.
...
llvm-svn: 50679
2008-05-05 23:12:21 +00:00
Ted Kremenek
00daccdd2a
Initial work on refactoring the CFRefCount checker so that it is more
...
generic and handles reference counts for NSObjects.
llvm-svn: 50674
2008-05-05 22:11:16 +00:00
Ted Kremenek
627c3074dd
Improve leak diagnostics to not report a leak on the same line where
...
the object was last used. This can be confusing to users.
For example:
// 'y' is leaked
x = foo(y);
instead:
x = foo(y);
// 'y' is leaked
llvm-svn: 50661
2008-05-05 18:50:19 +00:00
Ted Kremenek
3917b82e85
Improved leak diagnostics.
...
llvm-svn: 50657
2008-05-05 17:53:17 +00:00
Ted Kremenek
875db81301
Minor refactorings/cleanups in CF retain checker and added support for NSMakeCollectable.
...
Added test case for NSMakeCollectable.
llvm-svn: 50653
2008-05-05 16:51:50 +00:00
Ted Kremenek
db04a9e967
When reporting branch conditions that evaluate to an uninitialized value,
...
highlight the most nested subexpression that appears most responsible (giving
the user better diagnostic feedback).
Updated test cases to illustrate this feature.
Implements: <rdar://problem/5880443>
llvm-svn: 50647
2008-05-05 15:56:53 +00:00
Ted Kremenek
a5e2df015a
Rename member variable.
...
llvm-svn: 50597
2008-05-02 23:21:21 +00:00
Ted Kremenek
983be7cee6
Improved diagnostics for leaks: now we report which variable was leaked.
...
llvm-svn: 50588
2008-05-02 20:53:50 +00:00
Ted Kremenek
789942cfda
When running the reference count checker twice (GC and non-GC mode), only emit
...
basic warnings (dead stores, null dereferences) on the first pass.
llvm-svn: 50584
2008-05-02 18:01:49 +00:00
Ted Kremenek
bb7386aff5
Really noreturn on exceptions.
...
llvm-svn: 50579
2008-05-02 17:12:56 +00:00
Ted Kremenek
63d76df236
Fix copy-paste bug.
...
llvm-svn: 50557
2008-05-01 23:38:35 +00:00
Ted Kremenek
2722f36465
Remove no longer valid assertion.
...
llvm-svn: 50556
2008-05-01 23:28:56 +00:00
Ted Kremenek
1097b4c61f
Added line number diagnostics to indicate the allocation site of the leaked object.
...
llvm-svn: 50553
2008-05-01 23:13:35 +00:00
Ted Kremenek
fabfb4677d
Do not highlight bogus ranges for leaks.
...
llvm-svn: 50549
2008-05-01 22:50:36 +00:00
Ted Kremenek
8a56b06b5c
Correctly invalidate reference count state when passing objects by reference in message expressions we don't understand.
...
llvm-svn: 50541
2008-05-01 21:31:50 +00:00
Ted Kremenek
7f824734e0
Added temporary fix for Obj-C exception handling in the static analyzer: treat these as panic functions.
...
llvm-svn: 50535
2008-05-01 18:33:28 +00:00
Ted Kremenek
f0b0f2edfe
Renamed static method.
...
llvm-svn: 50533
2008-05-01 18:31:44 +00:00
Ted Kremenek
b99d01269a
Added __assert_rtn to list of panic functions.
...
llvm-svn: 50530
2008-05-01 17:52:49 +00:00
Ted Kremenek
ed36e4b9a4
Added ziperr as a panic function. Eventually inter-procedural analysis
...
should catch this one easily.
llvm-svn: 50526
2008-05-01 15:55:59 +00:00
Ted Kremenek
9f696852c4
When processing "release", "retain", and "autorelease" messages return the
...
lval passed as an argument.
Fix: Inverted diagnostic messages.
llvm-svn: 50513
2008-05-01 04:02:04 +00:00
Ted Kremenek
4828aa3152
Added support for "autorelease" message in CF ref. count checker.
...
llvm-svn: 50512
2008-05-01 02:18:37 +00:00
Ted Kremenek
b0f87c48cb
added preliminary diagnostics in scan-build results to denote whether
...
a CF memory leak occurred with GC enabled, etc.
llvm-svn: 50507
2008-04-30 23:47:44 +00:00
Ted Kremenek
f20e2285c9
More cleanups with ObjCQualifiedIdType in the static analyzer.
...
llvm-svn: 50503
2008-04-30 22:48:21 +00:00
Ted Kremenek
a16dacb6aa
Add placeholder code in the static analyzer for MemberExprs involving struct temporaries.
...
llvm-svn: 50502
2008-04-30 22:17:15 +00:00
Ted Kremenek
ca67cab1e8
Add workaround for __builtin_offsetof in the static analyzer.
...
llvm-svn: 50500
2008-04-30 21:45:55 +00:00
Ted Kremenek
99057462aa
Provide SizeOfAlignTypeExpr workaround in the static analyzer for taking the sizeof of a ObjCInterfaceType.
...
llvm-svn: 50499
2008-04-30 21:31:12 +00:00
Ted Kremenek
e0e8b535cf
Support implicit casts from pointers to references.
...
llvm-svn: 50498
2008-04-30 21:10:19 +00:00
Ted Kremenek
84dea154fc
When creating LVals for array entries, canonicalize entries with a 0 index.
...
llvm-svn: 50497
2008-04-30 21:05:35 +00:00
Ted Kremenek
20d8006e93
Teach more of the static analyzer about ObjCQualifiedIdType.
...
llvm-svn: 50494
2008-04-30 20:17:27 +00:00
Ted Kremenek
0940b99e3b
Teach the static analysis engine about ObjCQualifiedIdType.
...
llvm-svn: 50493
2008-04-30 20:01:29 +00:00
Ted Kremenek
5ce35cc514
Add conjured symbols for decl initializations.
...
Add db_error as panic function.
llvm-svn: 50489
2008-04-30 17:54:04 +00:00
Ted Kremenek
39a736f723
Handle lval::ArrayOffset and lval::FieldOffset in EvalNE and EvalEQ.
...
llvm-svn: 50486
2008-04-30 16:07:22 +00:00
Ted Kremenek
5cc9e60a5f
Invalidate old subexpression bindings when binding UnknownVal.
...
llvm-svn: 50466
2008-04-30 04:23:07 +00:00
Ted Kremenek
9700bd42f0
Simplify RemoveDeadBindings.
...
llvm-svn: 50458
2008-04-29 23:58:03 +00:00
Ted Kremenek
10246e8bfa
Add lval::ArrayOffset, which represent the locations of entries in an array.
...
llvm-svn: 50453
2008-04-29 23:24:44 +00:00
Ted Kremenek
0d2ccffa83
Added lval::FieldOffset, which represents symbolic lvalues for field offsets from other Lvalues.
...
This removes the failure in null-deref-ps.c (test suite).
llvm-svn: 50449
2008-04-29 22:17:41 +00:00
Ted Kremenek
fa5a3d0fe7
Major rewrite/refactoring of static analysis engine. We now use
...
EvalStore/EvalLoad to handle all loads/stores from symbolic memory, allowing us
to do checks for null dereferences, etc., at any arbitrary load/store (these
were missed checks before). This also resulted in some major cleanups, some
conceptual, and others just in the structure of the code.
This temporarily introduces a regression in the test suite (null-deref-ps.c)
before I add a new LVal type for structure fields.
llvm-svn: 50443
2008-04-29 21:04:26 +00:00
Ted Kremenek
a374ea9a35
Update typestate logic to support GC-mode.
...
llvm-svn: 50396
2008-04-29 05:44:10 +00:00
Ted Kremenek
4b7ca776cf
Implement semantics of CFMakeCollectable for the CF-reference count checker.
...
llvm-svn: 50395
2008-04-29 05:33:51 +00:00
Ted Kremenek
4d1f422c6f
Provide the option to run the CF-retain checker in GC enabled mode.
...
The transfer functions for the checker don't do anything special yet in GC mode.
llvm-svn: 50394
2008-04-29 05:13:59 +00:00
Argyrios Kyrtzidis
fa2d2f2886
Make assertions for all addresses passed to ProgramPoint that they have at least an 8-byte alignment.
...
llvm-svn: 50310
2008-04-26 15:19:51 +00:00
Ted Kremenek
dd38e0bd0d
Fix bug in BugReporter where we didn't handle emitting diagnostics for
...
empty CFGBlocks that only contained a terminator.
Added improved diagnostics for break and continue statements and default branches in switch statements.
This fixes <rdar://problem/5889244>.
llvm-svn: 50286
2008-04-25 19:01:27 +00:00
Ted Kremenek
99131c9f5a
Handle dereferences of function pointers (which return a handle to the function).
...
llvm-svn: 50246
2008-04-25 01:56:50 +00:00
Ted Kremenek
2e5092320e
Don't abort on GetRVal when the LVal is a StringLiteralVal.
...
llvm-svn: 50245
2008-04-25 01:45:38 +00:00
Ted Kremenek
4dd412e022
Don't emit empty strings for path diagnostics when taking the default branch of a switch statement that has no label.
...
llvm-svn: 50242
2008-04-25 01:29:56 +00:00
Ted Kremenek
ecbdf75049
Do a better job at computing dead symbols.
...
Implemented support for better localized leaks in the CF reference count checker.
Now leaks should be flagged close to where they occur.
This should implement the desired functionality in <rdar://problem/5879592>, although the diagnostics still need to be improved.
llvm-svn: 50241
2008-04-25 01:25:15 +00:00
Ted Kremenek
b0daf2f6f5
Add preliminary support for flagging leaks around when they happen (doesn't work yet).
...
llvm-svn: 50237
2008-04-24 23:57:27 +00:00
Ted Kremenek
ae8014cb7e
More boilerplate for handling specialized-transfer function logic for dead symbols.
...
llvm-svn: 50233
2008-04-24 23:35:58 +00:00
Ted Kremenek
3812b7676c
Added initial boilerplate in GRExprEngine to allow checker-specific transfer
...
function logic to act when symbols become dead.
llvm-svn: 50221
2008-04-24 18:31:42 +00:00
Ted Kremenek
f7141597e8
CF reference count checker: handle variadic functions that allocate CF objects.
...
This fixes <rdar://problem/5886141>.
Part of this change resulted in creating sparser summaries. I also added
some more comments and did some minor code cleanups.
llvm-svn: 50214
2008-04-24 17:22:33 +00:00
Ted Kremenek
21bf6006b0
For case statements involving enums, BugReporter now generates PathDiagnostics
...
that say that we are jumping to "case a" instead of "case 0".
This is a feature implementation for <rdar://problem/5880430>.
llvm-svn: 50197
2008-04-23 23:35:07 +00:00
Ted Kremenek
05e6267466
Fix minor regression in bug report generation.
...
llvm-svn: 50195
2008-04-23 23:04:32 +00:00
Ted Kremenek
f26bc55b9a
When building PathDiagnostics for bug reports, generate a trimmed ExplodedGraph with a single path that BugReport objects can safely walk and introspect.
...
llvm-svn: 50194
2008-04-23 23:02:12 +00:00
Ted Kremenek
dd43aeee54
Fixed: <rdar://problem/5881148>
...
Problem:
In the recently refactored VisitDeref (which processes dereferences), we
were incorrectly skipping the node just generated for the subexpression
of the dereference. This was a horrible regression.
llvm-svn: 50176
2008-04-23 20:12:28 +00:00
Ted Kremenek
d2419a0730
Remove false path where the default branch in a switch statement would
...
always be taken even if it was not feasible.
llvm-svn: 50132
2008-04-23 05:03:18 +00:00
Ted Kremenek
ef9af73887
Added panic function "assfail".
...
llvm-svn: 50119
2008-04-23 00:41:25 +00:00
Ted Kremenek
0224ac57e0
For default branches in switch statements with no default label, print out
...
the line we are going to.
llvm-svn: 50113
2008-04-22 22:29:46 +00:00
Ted Kremenek
3b42715930
Rewrote VisitDeclStmt to properly handle initializers that can do anything.
...
llvm-svn: 50112
2008-04-22 22:25:27 +00:00
Ted Kremenek
c79c0591d6
Added lval type (and tracking) for StringLiterals.
...
llvm-svn: 50109
2008-04-22 21:39:21 +00:00
Ted Kremenek
eccf3e5821
Added "nonlval::LValAsInteger" to represent abstract LVals casted to integers, allowing us to track lvals when they are casted back to pointers.
...
llvm-svn: 50108
2008-04-22 21:10:18 +00:00
Ted Kremenek
9718c9e8ee
PathDiagnosticClients now retain ownership of passed PathDiagnostics, requiring
...
them to not be stack-allocated.
HTMLDiagnostics now batches PathDiagnostics before emitting HTML in its dtor.
This is a workaround for a problem when we trampled the Preprocessor state
when highlighting macros (sometimes resulting in an assertion failure).
llvm-svn: 50102
2008-04-22 16:15:03 +00:00
Argyrios Kyrtzidis
901a4e406b
Use back() instead of end()-1
...
llvm-svn: 50098
2008-04-22 07:37:18 +00:00
Ted Kremenek
80f2c111bd
Added panic function "dtrace_assfail".
...
llvm-svn: 50091
2008-04-22 06:09:33 +00:00
Ted Kremenek
a2cca7dbdf
Hardcode "Assert" as a no-return function (panic).
...
llvm-svn: 50089
2008-04-22 05:37:33 +00:00
Ted Kremenek
da5cdda248
Added null-dereference check for ArraySubscriptExpr.
...
llvm-svn: 50083
2008-04-22 04:56:29 +00:00
Ted Kremenek
38213f9573
Added support for detected bad dereferences involving MemberExprs, e.g. x->f where "x" is NULL.
...
llvm-svn: 50071
2008-04-21 23:43:38 +00:00