Commit Graph

2501 Commits

Author SHA1 Message Date
DeLesley Hutchins 8121866bdb Consumed analysis: fix assert failure.
llvm-svn: 193010
2013-10-18 23:11:49 +00:00
DeLesley Hutchins 0bd25897ef Consumed analysis: assume that non-const reference parameters are initially
in the "uknown" state.  Patch by chris.wailes@gmail.com.  Reviewed by delesley.

llvm-svn: 192995
2013-10-18 19:25:18 +00:00
DeLesley Hutchins 11a66c1240 Consumed analysis: All the return_typestate parameter to be attached to the
default constructor.  Patch by chris.wailes@gmail.com, reviewed by delesley.

llvm-svn: 192991
2013-10-18 18:36:21 +00:00
DeLesley Hutchins 6939177cea Consumed analysis: Add param_typestate attribute, which specifies that
function parameters must be in a particular state.  Patch by
chris.wailes@gmail.com.  Reviewed by delesley@google.com.

llvm-svn: 192934
2013-10-17 23:23:53 +00:00
DeLesley Hutchins 36ea1dd4fc Consumed Analysis: Allow parameters that are passed by non-const reference
to be treated as return values, and marked with the "returned_typestate"
attribute.  Patch by chris.wailes@gmail.com; reviewed by delesley@google.com.

llvm-svn: 192932
2013-10-17 22:53:04 +00:00
DeLesley Hutchins 6501320e72 Consumed analysis: fix ICE in handling of loop source locations.
llvm-svn: 192911
2013-10-17 18:19:31 +00:00
DeLesley Hutchins 33a293433f Consumed analysis: replace the consumes attribute with a set_typestate
attribute.  Patch by chris.wailes@gmail.com; reviewed and edited by delesley.

llvm-svn: 192515
2013-10-11 23:03:26 +00:00
DeLesley Hutchins 8d41d99502 Consumed analysis: switch from tests_consumed/unconsumed to a general
tests_typestate attribute.  Patch by chris.wailes@gmail.com.

llvm-svn: 192513
2013-10-11 22:30:48 +00:00
DeLesley Hutchins fbdee4e3c2 Consumed analysis: check destructor calls.
This allows the callable_when attribute to be attached to destructors.
Original patch by chris.wailes@gmail.com, reviewed and edited by delesley.

llvm-svn: 192508
2013-10-11 21:55:33 +00:00
DeLesley Hutchins 3277a6129b Consumed analysis: improve loop handling. The prior version of the analysis
marked all variables as "unknown" at the start of a loop.  The new version
keeps the initial state of variables unchanged, but issues a warning if the
state at the end of the loop is different from the state at the beginning.
This patch will eventually be replaced with a more precise analysis.

Initial patch by chris.wailes@gmail.com.  Reviewed and edited by
delesley@google.com.

llvm-svn: 192314
2013-10-09 18:30:24 +00:00
DeLesley Hutchins 210791a021 Consumed Analysis: Change callable_when so that it can take a list of states
that a function can be called in.  This reduced the total number of annotations
needed and makes writing more complicated behaviour less burdensome.
Patch by chriswails@gmail.com.

llvm-svn: 191983
2013-10-04 21:28:06 +00:00
Benjamin Kramer b8f33f1690 Make sort predicate match the qsort convention.
llvm-svn: 191177
2013-09-22 15:02:02 +00:00
Benjamin Kramer 04bf187e12 Fix array_pod_sort predicates after LLVM change.
llvm-svn: 191176
2013-09-22 14:10:29 +00:00
Richard Smith ba8071ec81 PR16054: Slight strengthening for -Wsometimes-uninitialized: if we use a
variable uninitialized every time we reach its (reachable) declaration, or
every time we call the surrounding function, promote the warning from
-Wmaybe-uninitialized to -Wsometimes-uninitialized.

This is still slightly weaker than desired: we should, in general, warn
if a use is uninitialized the first time it is evaluated.

llvm-svn: 190623
2013-09-12 18:49:10 +00:00
DeLesley Hutchins 85c07d9a93 Fix ICE in consumed analysis when CFG is null.
llvm-svn: 190447
2013-09-10 23:10:10 +00:00
Matt Beaumont-Gay 093f240a73 Fix a crash introduced in r189828.
The predicates in CXXRecordDecl which test various properties of special
members can't be called on incomplete decls.

llvm-svn: 190353
2013-09-09 21:07:58 +00:00
Pavel Labath 921e7650d4 Avoid double edges when constructing CFGs
Summary:
If a noreturn destructor is executed while returning a value from a function,
the resulting CFG has had two edges to the exit block. This crashed the analyzer,
because it expects that blocks with no terminators have only one outgoing edge.
I added code to avoid creating the second edge in this case.

PS: The crashes did not manifest themselves always, as usually the
NoReturnFunctionChecker would stop program evaluation before the analyzer hit
the assertion, but in the case of lifetime extended temporaries, the checker
failed to do that (which is a separate bug in itself).

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1513

llvm-svn: 190125
2013-09-06 08:12:48 +00:00
David Blaikie 16f76d27ae Consumed Analysis: The 'consumable' attribute now takes a identifier specifying the default assumed state for objects of this class
This information is used for return states and pass-by-value parameter
states.

Patch by Chris Wailes.

Review by DeLesley Hutchins and Aaron Ballman.

llvm-svn: 190116
2013-09-06 01:28:43 +00:00
Eric Christopher de156243e1 Fix non-void return warning, and format.
llvm-svn: 189845
2013-09-03 20:43:00 +00:00
DeLesley Hutchins fc368259af Consumed analysis: add return_typestate attribute.
Patch by chris.wailes@gmail.com

Functions can now declare what state the consumable type the are returning will
be in. This is then used on the caller side and checked on the callee side.
Constructors now use this attribute instead of the 'consumes' attribute.

llvm-svn: 189843
2013-09-03 20:11:38 +00:00
Jordan Rose d2f4079db9 Add an implicit dtor CFG node just before C++ 'delete' expressions.
This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

  1. <expr>
  2. [B1.1]->~Foo() (Implicit destructor)
  3. delete [B1.1]

Patch by Karthik Bhat!

llvm-svn: 189828
2013-09-03 17:00:57 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
DeLesley Hutchins 5a715c4f00 Consumed analysis: add 'consumable' class attribute.
Patch by chris.wailes@gmail.com

Adds the 'consumable' attribute that can be attached to classes.  This replaces
the previous method of scanning a class's methods to see if any of them have
consumed analysis attributes attached to them.  If consumed analysis attributes
are attached to methods of a class that isn't marked 'consumable' a warning
is generated.

llvm-svn: 189702
2013-08-30 22:56:34 +00:00
DeLesley Hutchins b570c13574 Consumed analysis: track function parameters.
Patch by chris.wailes@gmail.com.

llvm-svn: 189616
2013-08-29 22:36:05 +00:00
DeLesley Hutchins 7fa60edb47 Consumed analysis: non-const methods no longer transfer an object into an
unknown state.  Patch by chris.wailes@gmail.com.

llvm-svn: 189612
2013-08-29 21:17:25 +00:00
Aaron Ballman a21f4b8ddd Silencing the warning from r189605 in a more conformant manner.
llvm-svn: 189606
2013-08-29 20:36:09 +00:00
Aaron Ballman 130db36d80 Silencing a rather spurious warning from MSVC 11 about not all control paths returning a value (hint: they do).
llvm-svn: 189605
2013-08-29 20:25:14 +00:00
Eric Christopher f8a1baab9d Fix warning about anonymous structs in anonymous unions.
llvm-svn: 189596
2013-08-29 18:00:58 +00:00
DeLesley Hutchins 5533ec5c55 Consumed analysis: improve handling of conditionals.
Patch by chris.wailes@gmail.com.

* The TestedVarsVisitor was folded into the ConsumedStmtVisitor.
* The VarTestResult class was updated to allow these changes.
* The PropagationInfo class was updated for the same reasons.
* Correctly handle short-circuiting of Boolean operations.
* Blocks are now marked as unreachable when we can statically prove we will
  never branch to them.
* Unreachable blocks are skipped by the analysis.

llvm-svn: 189594
2013-08-29 17:26:57 +00:00
DeLesley Hutchins 2445b1212a Consumed analyis: Renamed *PStatus to *PInfo.
The change was made for readability, as the PropagationInfo objects don't
always contain a status.  This is submitted as a separate patch because it
touches a lot of lines and I don't want it cluttering up the next patch.
Patch by chris.wailes@gmail.com.

llvm-svn: 189278
2013-08-26 20:34:59 +00:00
Robert Wilhelm 25284cc95b Use pop_back_val() instead of both back() and pop_back().
No functionality change intended.

llvm-svn: 189112
2013-08-23 16:11:15 +00:00
Pavel Labath 02b64d46a0 [analyzer] Refactor conditional expression evaluating code
Summary:
Instead of digging through the ExplodedGraph, to figure out which edge brought
us here, I compute the value of conditional expression by looking at the
sub-expression values.

To do this, I needed to change the liveness algorithm a bit -- now, the full
conditional expression also depends on all atomic sub-expressions, not only the
outermost ones.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1340

llvm-svn: 189090
2013-08-23 07:19:22 +00:00
DeLesley Hutchins c2ecf0d815 Update to consumed analysis.
Patch by chris.wailes@gmail.com.  The following functionality was added:

* The same functionality is now supported for both CXXOperatorCallExprs and CXXMemberCallExprs.
* Factored out some code in StmtVisitor.
* Removed variables from the state map when their destructors are encountered.
* Started adding documentation for the consumed analysis attributes.

llvm-svn: 189059
2013-08-22 20:44:47 +00:00
David Majnemer a39da8e236 Analysis: Make %I in printf more reasonable, add more tests
llvm-svn: 188992
2013-08-22 07:53:21 +00:00
David Majnemer 3cba495abc Analysis: Add support for MS specific printf format specifiers
Summary: Adds support for %I, %I32 and %I64.

Reviewers: hans, jordan_rose, rnk, majnemer

Reviewed By: majnemer

CC: cfe-commits, cdavis5x

Differential Revision: http://llvm-reviews.chandlerc.com/D1456

llvm-svn: 188937
2013-08-21 21:54:46 +00:00
Jordan Rose 5374c07ab9 Omit arguments of __builtin_object_size from the CFG.
This builtin does not actually evaluate its arguments for side effects,
so we shouldn't include them in the CFG. In the analyzer, rely on the
constant expression evaluator to get the proper semantics, at least for
now. (In the future, we could get ambitious and try to provide path-
sensitive size values.)

In theory, this does pose a problem for liveness analysis: a variable can
be used within the __builtin_object_size argument expression but not show
up as live. However, it is very unlikely that such a value would be used
to compute the object size and not used to access the object in some way.

<rdar://problem/14760817>

llvm-svn: 188679
2013-08-19 16:27:28 +00:00
DeLesley Hutchins 9f5193cf61 Thread Safety Analysis: fix bug when using TryLock with && and || expressions.
llvm-svn: 188505
2013-08-15 23:06:33 +00:00
Eli Friedman 89fe0d5842 Properly track l-paren of a CXXFucntionalCastExpr.
In addition to storing more useful information in the AST, this
fixes a semantic check in template instantiation which checks whether
the l-paren location is valid.

Fixes PR16903.

llvm-svn: 188495
2013-08-15 22:02:56 +00:00
DeLesley Hutchins 16b4ff5c4d Thread safety analysis: move warnings within lock/unlock functions out of beta.
llvm-svn: 188465
2013-08-15 15:31:25 +00:00
Reid Kleckner 6454d0a0fa Silence a warning from MSVC about not returning a value
llvm-svn: 188237
2013-08-13 00:11:59 +00:00
Reid Kleckner e846deae3c Remove Sema includes from Analysis code to fix layering
This moves a header-only class from Sema to Analysis and puts the option
check in Sema.

Patch by Chris Wailes!

llvm-svn: 188230
2013-08-12 23:49:39 +00:00
Hans Wennborg 812a9ec9c2 Speculative build fix for r188206.
The cmake-clang-x86_64 was upset:
error: 'template<class ImplClass, class RetTy> class clang::ConstStmtVisitor' used without template parameters

llvm-svn: 188211
2013-08-12 22:02:09 +00:00
DeLesley Hutchins 48a317663f Patch by Chris Wailes <chris.wailes@gmail.com>.
Reviewed by delesley, dblaikie.

Add the annotations and code needed to support a basic 'consumed' analysis.

Summary:
This new analysis is based on academic literature on linear types.  It tracks
the state of a value, either as unconsumed, consumed, or unknown.  Methods are
then annotated as CallableWhenUnconsumed, and when an annotated method is
called while the value is in the 'consumed' state a warning is issued.  A value
may be tested in the conditional statement of an if-statement; when this occurs
we know the state of the value in the different branches, and this information
is added to our analysis.  The code is still highly experimental, and the names
of annotations or the algorithm may be subject to change.

llvm-svn: 188206
2013-08-12 21:20:55 +00:00
Jordan Rose e9c57229f9 [analyzer] Include analysis stack in crash traces.
Sample output:

0.     Program arguments: ...
1.     <eof> parser at end of file
2.     While analyzing stack:
       #0 void inlined()
       #1 void test()
3.     crash-trace.c:6:3: Error evaluating statement

llvm-svn: 186639
2013-07-19 00:59:08 +00:00
Richard Smith 5a0ef78cd7 Remove bogus VarDecl::extendsLifetimeOfTemporary function and inline it into
its only caller with a FIXME explaining why it's bogus.

llvm-svn: 185109
2013-06-27 21:43:17 +00:00
Aaron Ballman fcd5b7e76e Updating a link in the comments; no functional change.
llvm-svn: 185013
2013-06-26 19:17:19 +00:00
Anna Zaks 56b4975bad [CFG] Set the “loop target” (back edge) for VisitObjCForCollectionStmt loops
Add the back edge info by creating a basic block, marked as loop target. This is
consistent with how other loops are processed, but was omitted from
VisitObjCForCollectionStmt.

llvm-svn: 184617
2013-06-22 00:23:20 +00:00
Jordan Rose cf10ea8cb2 [analyzer; new edges] Simplify edges in a C++11 for-range loop.
Previously our edges were completely broken here; now, the final result
is a very simple set of edges in most cases: one up to the "for" keyword
for context, and one into the body of the loop. This matches the behavior
for ObjC for-in loops.

In the AST, however, CXXForRangeStmts are handled very differently from
ObjCForCollectionStmts. Since they are specified in terms of equivalent
statements in the C++ standard, we actually have implicit AST nodes for
all of the semantic statements. This makes evaluation very easy, but
diagnostic locations a bit trickier. Fortunately, the problem can be
generally defined away by marking all of the implicit statements as
part of the top-level for-range statement.

One of the implicit statements in a for-range statement is the declaration
of implicit iterators __begin and __end. The CFG synthesizes two
separate DeclStmts to match each of these decls, but until now these
synthetic DeclStmts weren't in the function's ParentMap. Now, the CFG
keeps track of its synthetic statements, and the AnalysisDeclContext will
make sure to add them to the ParentMap.

<rdar://problem/14038483>

llvm-svn: 183449
2013-06-06 21:53:45 +00:00
David Majnemer f69ce86048 Analysis: Add a CFG successor to a SwitchStmt if it is both empty and fully covered
Consider the case where a SwitchStmt satisfied isAllEnumCasesCovered()
as well as having no cases at all (i.e. the enum it covers has no
enumerators).

In this case, we should add a successor to repair the CFG.

This fixes PR16212.

llvm-svn: 183237
2013-06-04 17:38:44 +00:00
Jordan Rose 5250b873bb CFG: In a DeclStmt, skip anything that's not a VarDecl.
Neither the compiler nor the analyzer are doing anything with non-VarDecl
decls in the CFG, and having them there creates extra nodes in the
analyzer's path diagnostics. Simplify the CFG (and the path edges) by
simply leaving them out. We can always add interesting decls back in when
they become relevant.

Note that this only affects decls declared in a DeclStmt, and then only
those that appear within a function body.

llvm-svn: 183157
2013-06-03 22:59:41 +00:00