Commit Graph

3909 Commits

Author SHA1 Message Date
Artem Dergachev ee92f12fd1 [analyzer] NFC: Rename GRBugReporter to PathSensitiveBugReporter.
The GR prefix is super ancient.

llvm-svn: 369320
2019-08-20 02:15:50 +00:00
Artem Dergachev 48786cf8d3 [analyzer] NFC: Drop support for extra text attached to bug reports.
It was introduced in 2011 but never used since then.

llvm-svn: 369319
2019-08-20 02:15:47 +00:00
Kristof Umann 032e1fdcd4 [analyzer] Turn an assert into an if condition
Shocker, turns out that terminator conditions that are binary operators
aren't always logical operators.

llvm-svn: 369195
2019-08-17 16:49:54 +00:00
Csaba Dabis a079a42708 [analyzer] Analysis: Silence checkers
Summary:
This patch introduces a new `analyzer-config` configuration:
`-analyzer-config silence-checkers`
which could be used to silence the given checkers.

It accepts a semicolon separated list, packed into quotation marks, e.g:
`-analyzer-config silence-checkers="core.DivideZero;core.NullDereference"`

It could be used to "disable" core checkers, so they model the analysis as
before, just if some of them are too noisy it prevents to emit reports.

This patch also adds support for that new option to the scan-build.
Passing the option `-disable-checker core.DivideZero` to the scan-build
will be transferred to `-analyzer-config silence-checkers=core.DivideZero`.

Reviewed By: NoQ, Szelethus

Differential Revision: https://reviews.llvm.org/D66042

llvm-svn: 369078
2019-08-16 01:53:14 +00:00
Kristof Umann a1aef90bdd [analyzer] Warn about -analyzer-configs being meant for development purposes only
This is more of a temporary fix, long term, we should convert AnalyzerOptions.def
into the universally beloved (*coughs*) TableGen format, where they can more
easily be separated into developer-only, alpha, and user-facing configs.

Differential Revision: https://reviews.llvm.org/D66261

llvm-svn: 368980
2019-08-15 08:53:16 +00:00
Jonas Devlieghere 2b3d49b610 [Clang] Migrate llvm::make_unique to std::make_unique
Now that we've moved to C++14, we no longer need the llvm::make_unique
implementation from STLExtras.h. This patch is a mechanical replacement
of (hopefully) all the llvm::make_unique instances across the monorepo.

Differential revision: https://reviews.llvm.org/D66259

llvm-svn: 368942
2019-08-14 23:04:18 +00:00
Kristof Umann dd53bdbfde [analyzer][CFG] Don't track the condition of asserts
Well, what is says on the tin I guess!

Some more changes:

* Move isInevitablySinking() from BugReporter.cpp to CFGBlock's interface
* Rename and move findBlockForNode() from BugReporter.cpp to
ExplodedNode::getCFGBlock()

Differential Revision: https://reviews.llvm.org/D65287

llvm-svn: 368836
2019-08-14 12:20:08 +00:00
Kristof Umann 967583bc08 [analyzer] Note last writes to a condition only in a nested stackframe
Exactly what it says on the tin! The comments in the code detail this a
little more too.

Differential Revision: https://reviews.llvm.org/D64272

llvm-svn: 368817
2019-08-14 09:39:38 +00:00
Haojian Wu ec25edc17a Fix the -Wunused-variable warning.
llvm-svn: 368808
2019-08-14 08:20:42 +00:00
Alex Langford 21872bc9bf [analyzer] Don't delete TaintConfig copy constructor
Summary:
Explicitly deleting the copy constructor makes compiling the function
`ento::registerGenericTaintChecker` difficult with some compilers. When we
construct an `llvm::Optional<TaintConfig>`, the optional is constructed with a
const TaintConfig reference which it then uses to invoke the deleted TaintConfig
copy constructor.

I've observered this failing with clang 3.8 on Ubuntu 16.04.

Reviewers: compnerd, Szelethus, boga95, NoQ, alexshap

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, llvm-commits, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D66192

llvm-svn: 368779
2019-08-14 01:09:07 +00:00
Kristof Umann 3f7c66d551 [analyzer][NFC] Prepare visitors for different tracking kinds
When we're tracking a variable that is responsible for a null pointer
dereference or some other sinister programming error, we of course would like to
gather as much information why we think that the variable has that specific
value as possible. However, the newly introduced condition tracking shows that
tracking all values this thoroughly could easily cause an intolerable growth in
the bug report's length.

There are a variety of heuristics we discussed on the mailing list[1] to combat
this, all of them requiring to differentiate in between tracking a "regular
value" and a "condition".

This patch introduces the new `bugreporter::TrackingKind` enum, adds it to
several visitors as a non-optional argument, and moves some functions around to
make the code a little more coherent.

[1] http://lists.llvm.org/pipermail/cfe-dev/2019-June/062613.html

Differential Revision: https://reviews.llvm.org/D64270

llvm-svn: 368777
2019-08-14 00:48:57 +00:00
Kristof Umann 0df9c8c578 [analyzer] Track the right hand side of the last store regardless of its value
Summary:
The following code snippet taken from D64271#1572188 has an issue: namely,
because `flag`'s value isn't undef or a concrete int, it isn't being tracked.

int flag;
bool coin();

void foo() {
  flag = coin();
}

void test() {
  int *x = 0;
  int local_flag;
  flag = 1;

  foo();
  local_flag = flag;
  if (local_flag)
    x = new int;

  foo();
  local_flag = flag;
  if (local_flag)
    *x = 5;
}

This, in my opinion, makes no sense, other values may be interesting too.
Originally added by rC185608.

Differential Revision: https://reviews.llvm.org/D64287

llvm-svn: 368773
2019-08-13 23:48:10 +00:00
Kristof Umann 46929df723 [analyzer] Prune calls to functions with linear CFGs that return a non-zero constrained value
During the evaluation of D62883, I noticed a bunch of totally
meaningless notes with the pattern of "Calling 'A'" -> "Returning value"
-> "Returning from 'A'", which added no value to the report at all.

This patch (not only affecting tracked conditions mind you) prunes
diagnostic messages to functions that return a value not constrained to
be 0, and are also linear.

Differential Revision: https://reviews.llvm.org/D64232

llvm-svn: 368771
2019-08-13 23:22:33 +00:00
Kristof Umann e1117addd6 [analyzer][NFC] Make sure that the BugReport is not modified during the construction of non-visitor pieces
I feel this is kinda important, because in a followup patch I'm adding different
kinds of interestingness, and propagating the correct kind in BugReporter.cpp is
just one less thing to worry about.

Differential Revision: https://reviews.llvm.org/D65578

llvm-svn: 368755
2019-08-13 22:03:08 +00:00
Kristof Umann 6c1b19ac9e [analyzer][NFC] Refactoring BugReporter.cpp P6.: Completely get rid of interestingness propagation
Apparently this does literally nothing.

When you think about this, it makes sense. If something is really important,
we're tracking it anyways, and that system is sophisticated enough to mark
actually interesting statements as such. I wouldn't say that it's even likely
that subexpressions are also interesting (array[10 - x + x]), so I guess even
if this produced any effects, its probably undesirable.

Differential Revision: https://reviews.llvm.org/D65487

llvm-svn: 368752
2019-08-13 21:48:17 +00:00
Kristof Umann edb788592d [analyzer][NFC] Address inlines of D65484
llvm-svn: 368745
2019-08-13 20:42:48 +00:00
Kristof Umann f9d75bede8 [analyzer][NFC] Refactoring BugReporter.cpp P5.: Compact mile long function invocations into objects
In D65379, I briefly described the construction of bug paths from an
ExplodedGraph. This patch is about refactoring the code processing the bug path
into a bug report.

A part of finding a valid bug report was running all visitors on the bug path,
so we already have a (possibly empty) set of diagnostics for each ExplodedNode
in it.
Then, for each diagnostic consumer, we construct non-visitor diagnostic pieces.

* We first construct the final diagnostic piece (the warning), then
* We start ascending the bug path from the error node's predecessor (since the
error node itself was used to construct the warning event). For each node
  * We check the location (whether its a CallEnter, CallExit) etc. We simultaneously
  keep track of where we are with the execution by pushing CallStack when we see a
  CallExit (keep in mind that everything is happening in reverse!), popping it
  when we find a CallEnter, compacting them into a single PathDiagnosticCallEvent.

void f() {
  bar();
}

void g() {
  f();
  error(); // warning
}

=== The bug path ===

(root) -> f's CallEnter -> bar() -> f's CallExit -> (error node)

=== Constructed report ===

  f's CallEnter -> bar() -> f's CallExit
           ^               /
            \             V
(root) --->  f's CallEvent --> (error node)

  * We also keep track of different PathPieces different location contexts
  * (CallEvent::path in the above example has f's LocationContext, while the
  CallEvent itself is in g's context) in a LocationContextMap object. Construct
  whatever piece, if any, is needed for the note.
  * If we need to generate edges (or arrows) do so. Make sure to also connect
  these pieces with the ones that visitors emitted.
  * Clean up the constructed PathDiagnostic by making arrows nicer, pruning
  function calls, etc.

So I complained about mile long function invocations with seemingly the same
parameters being passed around. This problem, as I see it, a natural candidate
for creating classes and tying them all together.

I tried very hard to make the implementation feel natural, like, rolling off the
tongue. I introduced 2 new classes: PathDiagnosticBuilder (I mean, I kept the
name but changed almost everything in it) contains every contextual information
(owns the bug path, the diagnostics constructed but the visitors, the BugReport
itself, etc) needed for constructing a PathDiagnostic object, and is pretty much
completely immutable. BugReportContruct is the object containing every
non-contextual information (the PathDiagnostic object we're constructing, the
current location in the bug path, the location context map and the call stack I
meantioned earlier), and is passed around all over the place as a single entity
instead of who knows how many parameters.

I tried to used constness, asserts, limiting visibility of fields to my
advantage to clean up the code big time and dramatically improve safety. Also,
whenever I found the code difficult to understand, I added comments and/or
examples.

Here's a complete list of changes and my design philosophy behind it:

* Instead of construcing a ReportInfo object (added by D65379) after finding a
valid bug report, simply return an optional PathDiagnosticBuilder object straight
away. Move findValidReport into the class as a static method. I find
GRBugReporter::generatePathDiagnostics a joy to look at now.
* Rename generatePathDiagnosticForConsumer to generate (maybe not needed, but
felt that way in the moment) and moved it to PathDiagnosticBuilder. If we don't
need to generate diagnostics, bail out straight away, like we always should have.
After that, construct a BugReportConstruct object, leaving the rest of the logic
untouched.
* Move all static methods that would use contextual information into
PathDiagnosticBuilder, reduce their parameter count drastically by simply
passing around a BugReportConstruct object.
* Glance at the code I removed: Could you tell what the original
PathDiagnosticBuilder::LC object was for? It took a gooood long while for me to
realize that nothing really. It is always equal with the LocationContext
associated with our current position in the bug path. Remove it completely.
* The original code contains the following expression quite a bit:
LCM[&PD.getActivePath()], so what does it mean? I said that we collect the
contexts associated with different PathPieces, but why would we ever modify that,
shouldn't it be set? Well, theoretically yes, but in the implementation, the
address of PathDiagnostic::getActivePath doesn't change if we move to an outer,
previously unexplored function. Add both descriptive method names and
explanations to BugReportConstruct to help on this.
* Add plenty of asserts, both for safety and as a poor man's documentation.

Differential Revision: https://reviews.llvm.org/D65484

llvm-svn: 368737
2019-08-13 19:01:33 +00:00
Kristof Umann fc76d8551f [analyzer][NFC] Refactoring BugReporter.cpp P4.: If it can be const, make it const
When I'm new to a file/codebase, I personally find C++'s strong static type
system to be a great aid. BugReporter.cpp is still painful to read however:
function calls are made with mile long parameter lists, seemingly all of them
taken with a non-const reference/pointer. This patch fixes nothing but this:
make a few things const, and hammer it until it compiles.

Differential Revision: https://reviews.llvm.org/D65382

llvm-svn: 368735
2019-08-13 18:48:08 +00:00
Kristof Umann 6d716ef181 [analyzer][NFC] Refactoring BugReporter.cpp P3.: std::shared_pointer<PathDiagnosticPiece> -> PathDiagnosticPieceRef
find clang/ -type f -exec sed -i 's/std::shared_ptr<PathDiagnosticPiece>/PathDiagnosticPieceRef/g' {} \;
git diff -U3 --no-color HEAD^ | clang-format-diff-6.0 -p1 -i

Just as C++ is meant to be refactored, right?

Differential Revision: https://reviews.llvm.org/D65381

llvm-svn: 368717
2019-08-13 16:45:48 +00:00
Kristof Umann ed9cc40794 [analyzer][NFC] Refactoring BugReporter.cpp P2.: Clean up the construction of bug paths and finding a valid report
This patch refactors the utility functions and classes around the construction
of a bug path.

At a very high level, this consists of 3 steps:

* For all BugReports in the same BugReportEquivClass, collect all their error
nodes in a set. With that set, create a new, trimmed ExplodedGraph whose leafs
are all error nodes.
* Until a valid report is found, construct a bug path, which is yet another
ExplodedGraph, that is linear from a given error node to the root of the graph.
* Run all visitors on the constructed bug path. If in this process the report
got invalidated, start over from step 2.

Now, to the changes within this patch:

* Do not allow the invalidation of BugReports up to the point where the trimmed
graph is constructed. Checkers shouldn't add bug reports that are known to be
invalid, and should use visitors and argue about the entirety of the bug path if
needed.
* Do not calculate indices. I may be biased, but I personally find code like
this horrible. I'd like to point you to one of the comments in the original code:

SmallVector<const ExplodedNode *, 32> errorNodes;
for (const auto I : bugReports) {
  if (I->isValid()) {
    HasValid = true;
    errorNodes.push_back(I->getErrorNode());
  } else {
    // Keep the errorNodes list in sync with the bugReports list.
    errorNodes.push_back(nullptr);
  }
}

Not on my watch. Instead, use a far easier to follow trick: store a pointer to
the BugReport in question, not an index to it.

* Add range iterators to ExplodedGraph's successors and predecessors, and a
visitor range to BugReporter.
* Rename TrimmedGraph to BugPathGetter. Because that is what it has always been:
no sane graph type should store an iterator-like state, or have an interface not
exposing a single graph-like functionalities.
* Rename ReportGraph to BugPathInfo, because it is only a linear path with some
other context.
* Instead of having both and out and in parameter (which I think isn't ever
excusable unless we use the out-param for caching), return a record object with
descriptive getter methods.
* Where descriptive names weren't sufficient, compliment the code with comments.

Differential Revision: https://reviews.llvm.org/D65379

llvm-svn: 368694
2019-08-13 13:56:12 +00:00
Kristof Umann b9bd6ebe1d [analyzer][NFC] Refactoring BugReporter.cpp P1.: Store interesting symbols/regions in a simple set
The goal of this refactoring effort was to better understand how interestingness
was propagated in BugReporter.cpp, which eventually turned out to be a dead end,
but with such a twist, I wouldn't even want to spoil it ahead of time. However,
I did get to learn a lot about how things are working in there.

In these series of patches, as well as cleaning up the code big time, I invite
you to study how BugReporter.cpp operates, and discuss how we could design this
file to reduce the horrible mess that it is.

This patch reverts a great part of rC162028, which holds the title "Allow
multiple PathDiagnosticConsumers to be used with a BugReporter at the same
time.". This, however doesn't imply that there's any need for multiple "layers"
or stacks of interesting symbols and regions, quite the contrary, I would argue
that we would like to generate the same amount of information for all output
types, and only process them differently.

Differential Revision: https://reviews.llvm.org/D65378

llvm-svn: 368689
2019-08-13 13:09:48 +00:00
Csaba Dabis cf229d5752 [analyzer] CastValueChecker: Model castAs(), getAs()
Summary: Thanks to Kristóf Umann for the great idea!

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D65889

llvm-svn: 368383
2019-08-09 02:24:42 +00:00
Csaba Dabis 124ef7fce4 [analyzer] ConditionBRVisitor: Fix HTML PathDiagnosticPopUpPieces
Summary:
A condition could be a multi-line expression where we create the highlight
in separated chunks. PathDiagnosticPopUpPiece is not made for that purpose,
it cannot be added to multiple lines because we have only one ending part
which contains all the notes. So that it cannot have multiple endings and
therefore this patch narrows down the ranges of the highlight to the given
interesting variable of the condition. It prevents HTML-breaking injections.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D65663

llvm-svn: 368382
2019-08-09 02:20:44 +00:00
Rainer Orth 09d890d728 Move LangStandard*, InputKind::Language to Basic
This patch is a prerequisite for using LangStandard from Driver in
https://reviews.llvm.org/D64793.

It moves LangStandard* and InputKind::Language to Basic.  It is mostly
mechanical, with only a few changes of note:

- enum Language has been changed into enum class Language : uint8_t to
  avoid a clash between OpenCL in enum Language and OpenCL in enum
  LangFeatures and not to increase the size of class InputKind.

- Now that getLangStandardForName, which is currently unused, also checks
  both canonical and alias names, I've introduced a helper getLangKind
  which factors out a code pattern already used 3 times.

The patch has been tested on x86_64-pc-solaris2.11, sparcv9-sun-solaris2.11,
and x86_64-pc-linux-gnu.

There's a companion patch for lldb which uses LangStandard.h
(https://reviews.llvm.org/D65717).

While polly includes isl which in turn uses InputKind::C, that part of the
code isn't even built inside the llvm tree.  I've posted a patch to allow
for both InputKind::C and Language::C upstream
(https://groups.google.com/forum/#!topic/isl-development/6oEvNWOSQFE).

Differential Revision: https://reviews.llvm.org/D65562

llvm-svn: 367864
2019-08-05 13:59:26 +00:00
Adam Balogh 8557f17d88 [Analyzer] Iterator Checkers - Fix for Crash on Iterator Differences
Iterators differences were mistakenly handled as random decrements which
causes an assertion. This patch fixes this.

llvm-svn: 367802
2019-08-05 06:45:41 +00:00
Fangrui Song d9b948b6eb Rename F_{None,Text,Append} to OF_{None,Text,Append}. NFC
F_{None,Text,Append} are kept for compatibility since r334221.

llvm-svn: 367800
2019-08-05 05:43:48 +00:00
Csaba Dabis 7740c6d643 [analyzer] StackFrameContext: Add NodeBuilderContext::blockCount() to its profile
Summary:
It allows discriminating between stack frames of the same call that is
called multiple times in a loop.

Thanks to Artem Dergachev for the great idea!

Reviewed By: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D65587

llvm-svn: 367608
2019-08-01 20:41:13 +00:00
Gabor Borsik 2c8098374b Buildbot fix for r367190
llvm-svn: 367193
2019-07-28 14:57:41 +00:00
Gabor Borsik 4bde15fe1e [analyzer] Add yaml parser to GenericTaintChecker
While we implemented taint propagation rules for several
builtin/standard functions, there's a natural desire for users to add
such rules to custom functions.

A series of patches will implement an option that allows users to
annotate their functions with taint propagation rules through a YAML
file. This one adds parsing of the configuration file, which may be
specified in the commands line with the analyzer config:
alpha.security.taint.TaintPropagation:Config. The configuration may
contain propagation rules, filter functions (remove taint) and sink
functions (give a warning if it gets a tainted value).

I also added a new header for future checkers to conveniently read YAML
files as checker options.

Differential Revision: https://reviews.llvm.org/D59555

llvm-svn: 367190
2019-07-28 13:38:04 +00:00
Balazs Keri aeac909329 [CrossTU] Fix plist macro expansion if macro in other file.
Summary:
When cross TU analysis is used it is possible that a macro expansion
is generated for a macro that is defined (and used) in other than
the main translation unit. To get the expansion for it the source
location in the original source file and original preprocessor
is needed.

Reviewers: martong, xazax.hun, Szelethus, ilya-biryukov

Reviewed By: Szelethus

Subscribers: mgorny, NoQ, ilya-biryukov, rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64638

llvm-svn: 367006
2019-07-25 10:53:22 +00:00
Balazs Keri 739a93558f PlistDiagnostics Fix for compile warning (NFC).
llvm-svn: 366792
2019-07-23 10:21:42 +00:00
Balazs Keri 32f220c5fb [CrossTU] Added CTU argument to diagnostic consumer create fn.
Summary:
The PListDiagnosticConsumer needs a new CTU parameter that is passed
through the create functions.

Reviewers: NoQ, Szelethus, xazax.hun, martong

Reviewed By: Szelethus

Subscribers: rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64635

llvm-svn: 366782
2019-07-23 07:04:20 +00:00
Fangrui Song 1a1af4392a [analyzer] Fix -Wunused-function in NDEBUG builds with #ifdef LLVM_DUMP_METHOD
llvm-svn: 366663
2019-07-22 04:14:09 +00:00
Csaba Dabis 68983321cc [analyzer] MallocChecker: Prevent Integer Set Library false positives
Summary:
Integer Set Library using retain-count based allocation which is not
modeled in MallocChecker.

Reviewed By: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64680

llvm-svn: 366391
2019-07-18 00:03:55 +00:00
Rui Ueyama 49a3ad21d6 Fix parameter name comments using clang-tidy. NFC.
This patch applies clang-tidy's bugprone-argument-comment tool
to LLVM, clang and lld source trees. Here is how I created this
patch:

$ git clone https://github.com/llvm/llvm-project.git
$ cd llvm-project
$ mkdir build
$ cd build
$ cmake -GNinja -DCMAKE_BUILD_TYPE=Debug \
    -DLLVM_ENABLE_PROJECTS='clang;lld;clang-tools-extra' \
    -DCMAKE_EXPORT_COMPILE_COMMANDS=On -DLLVM_ENABLE_LLD=On \
    -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ../llvm
$ ninja
$ parallel clang-tidy -checks='-*,bugprone-argument-comment' \
    -config='{CheckOptions: [{key: StrictMode, value: 1}]}' -fix \
    ::: ../llvm/lib/**/*.{cpp,h} ../clang/lib/**/*.{cpp,h} ../lld/**/*.{cpp,h}

llvm-svn: 366177
2019-07-16 04:46:31 +00:00
Fangrui Song 90e95bb289 Delete dead stores
llvm-svn: 365901
2019-07-12 14:04:34 +00:00
Csaba Dabis e856c0465d [analyzer] CastValueChecker: Remove a dump()
Summary: Fix a nit.
llvm-svn: 365590
2019-07-10 00:50:01 +00:00
Csaba Dabis 693936ab8f [analyzer] CastValueChecker: Model casts
Summary:
It models the LLVM casts:
- `cast<>`
- `dyn_cast<>`
- `cast_or_null<>`
- `dyn_cast_or_null<>`

It has a very basic support without checking the `classof()` function.

(It reapplies the reverted 'llvm-svn: 365582' patch with proper test file.)

Reviewed By: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64374

llvm-svn: 365585
2019-07-10 00:20:03 +00:00
Csaba Dabis 6a29680efb Revert "[analyzer] CastValueChecker: Model casts"
This reverts commit 27cf666443.

llvm-svn: 365584
2019-07-09 23:47:09 +00:00
Csaba Dabis 27cf666443 [analyzer] CastValueChecker: Model casts
Summary:
It models the LLVM casts:
- `cast<>`
- `dyn_cast<>`
- `cast_or_null<>`
- `dyn_cast_or_null<>`

It has a very basic support without checking the `classof()` function.

Reviewed By: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64374

llvm-svn: 365582
2019-07-09 23:33:23 +00:00
Kristof Umann b55745606f [analyzer] Add a debug analyzer config to place an event for each tracked condition
Differential Revision: https://reviews.llvm.org/D63642

llvm-svn: 365208
2019-07-05 14:00:08 +00:00
Kristof Umann 258e5e457a [analyzer] Track terminator conditions on which a tracked expression depends
This patch is a major part of my GSoC project, aimed to improve the bug
reports of the analyzer.

TL;DR: Help the analyzer understand that some conditions are important,
and should be explained better. If an CFGBlock is a control dependency
of a block where an expression value is tracked, explain the condition
expression better by tracking it.

if (A) // let's explain why we believe A to be true
  10 / x; // division by zero

This is an experimental feature, and can be enabled by the
off-by-default analyzer configuration "track-conditions".

In detail:

This idea was inspired by the program slicing algorithm. Essentially,
two things are used to produce a program slice (a subset of the program
relevant to a (statement, variable) pair): data and control
dependencies. The bug path (the linear path in the ExplodedGraph that leads
from the beginning of the analysis to the error node) enables to
analyzer to argue about data dependencies with relative ease.

Control dependencies are a different slice of the cake entirely.

Just because we reached a branch during symbolic execution, it
doesn't mean that that particular branch has any effect on whether the
bug would've occured. This means that we can't simply rely on the bug
path to gather control dependencies.

In previous patches, LLVM's IDFCalculator, which works on a control flow
graph rather than the ExplodedGraph was generalized to solve this issue.
We use this information to heuristically guess that the value of a tracked
expression depends greatly on it's control dependencies, and start
tracking them as well.

After plenty of evaluations this was seen as great idea, but still
lacking refinements (we should have different descriptions about a
conditions value), hence it's off-by-default.

Differential Revision: https://reviews.llvm.org/D62883

llvm-svn: 365207
2019-07-05 13:29:54 +00:00
Kristof Umann 5e17ee1e35 [analyzer][IDF] Add a control dependency calculator + a new debug checker
I intend to improve the analyzer's bug reports by tracking condition
expressions.

01 bool b = messyComputation();
02 int i = 0;
03 if (b) // control dependency of the bug site, let's explain why we assume val
04        // to be true
05   10 / i; // warn: division by zero

I'll detail this heuristic in the followup patch, strictly related to this one
however:

* Create the new ControlDependencyCalculator class that uses llvm::IDFCalculator
  to (lazily) calculate control dependencies for Clang's CFG.
* A new debug checker debug.DumpControlDependencies is added for lit tests
* Add unittests

Differential Revision: https://reviews.llvm.org/D62619

llvm-svn: 365197
2019-07-05 12:17:44 +00:00
Gabor Marton e712295f11 [CTU] Add support for virtual functions
Reviewers: Szelethus, xazax.hun

Subscribers: rnkovacs, dkrupp, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63920

llvm-svn: 365133
2019-07-04 11:39:00 +00:00
Csaba Dabis 57835bcfbd [analyzer] ReturnValueChecker: Model the guaranteed boolean return value of function calls
Summary: It models the known LLVM methods paired with their class.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: dschuff, aheejin, mgorny, szepet, rnkovacs, a.sidorin,
             mikhail.ramalho, donat.nagy, dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63915

llvm-svn: 365103
2019-07-04 00:50:50 +00:00
Kristof Umann 71a9dc39e4 [analyzer][Dominator] Add post dominators to CFG + a new debug checker
Transform clang::DominatorTree to be able to also calculate post dominators.

* Tidy up the documentation
* Make it clang::DominatorTree template class (similarly to how
  llvm::DominatorTreeBase works), rename it to clang::CFGDominatorTreeImpl
* Clang's dominator tree is now called clang::CFGDomTree
* Clang's brand new post dominator tree is called clang::CFGPostDomTree
* Add a lot of asserts to the dump() function
* Create a new checker to test the functionality

Differential Revision: https://reviews.llvm.org/D62551

llvm-svn: 365028
2019-07-03 11:39:12 +00:00
Fangrui Song 7264a474b7 Change std::{lower,upper}_bound to llvm::{lower,upper}_bound or llvm::partition_point. NFC
llvm-svn: 365006
2019-07-03 08:13:17 +00:00
Artem Dergachev ab758ba128 [analyzer] exploded-graph-rewriter: Implement bug nodes and sink nodes.
Add a label to nodes that have a bug report attached or on which
the analysis was generally interrupted.

Fix printing has_report and implement printing is_sink in the graph dumper.

Differential Revision: https://reviews.llvm.org/D64110

llvm-svn: 364992
2019-07-03 01:26:41 +00:00
Erik Pilkington eee944e7f9 [C++2a] Add __builtin_bit_cast, used to implement std::bit_cast
This commit adds a new builtin, __builtin_bit_cast(T, v), which performs a
bit_cast from a value v to a type T. This expression can be evaluated at
compile time under specific circumstances.

The compile time evaluation currently doesn't support bit-fields, but I'm
planning on fixing this in a follow up (some of the logic for figuring this out
is in CodeGen). I'm also planning follow-ups for supporting some more esoteric
types that the constexpr evaluator supports, as well as extending
__builtin_memcpy constexpr evaluation to use the same infrastructure.

rdar://44987528

Differential revision: https://reviews.llvm.org/D62825

llvm-svn: 364954
2019-07-02 18:28:13 +00:00
Nathan Huckleberry 121401425d [analyzer] Support kfree in MallocChecker
Summary:
kmalloc is freed with kfree in the linux kernel. kmalloc support was
added in r204832, but kfree was not. Adding kfree fixes incorrectly
detected memory leaks.

Reviewers: NoQ, nickdesaulniers, dcoughlin, Szelethus

Reviewed By: NoQ, Szelethus

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64030

llvm-svn: 364875
2019-07-01 23:29:10 +00:00
Artem Dergachev ceb639dbee [analyzer] Fix invalidation when returning into a ctor initializer.
Due to RVO the target region of a function that returns an object by
value isn't necessarily a temporary object region; it may be an
arbitrary memory region. In particular, it may be a field of a bigger
object.

Make sure we don't invalidate the bigger object when said function is
evaluated conservatively.

Differential Revision: https://reviews.llvm.org/D63968

llvm-svn: 364870
2019-07-01 23:02:18 +00:00
Artem Dergachev 512f4838c4 [analyzer] NonnullGlobalConstants: Don't be confused by a _Nonnull attribute.
The NonnullGlobalConstants checker models the rule "it doesn't make sense
to make a constant global pointer and initialize it to null"; it makes sure
that whatever it's initialized with is known to be non-null.

Ironically, annotating the type of the pointer as _Nonnull breaks the checker.

Fix handling of the _Nonnull annotation so that it was instead one more reason
to believe that the value is non-null.

Differential Revision: https://reviews.llvm.org/D63956

llvm-svn: 364869
2019-07-01 23:02:14 +00:00
Artem Dergachev 35fdec1b54 [analyzer] CStringChecker: Modernize to use CallDescriptions.
This patch uses the new CDF_MaybeBuiltin flag to handle C library functions.
It's mostly an NFC/refactoring pass, but it does fix a bug in handling memset()
when it expands to __builtin___memset_chk() because the latter has
one more argument and memset() handling code was trying to match
the exact number of arguments. Now the code is deduplicated and there's
less room for mistakes.

Differential Revision: https://reviews.llvm.org/D62557

llvm-svn: 364868
2019-07-01 23:02:10 +00:00
Artem Dergachev f301096f51 [analyzer] NFC: CallDescription: Implement describing C library functions.
When matching C standard library functions in the checker, it's easy to forget
that they are often implemented as macros that are expanded to builtins.

Such builtins would have a different name, so matching the callee identifier
would fail, or may sometimes have more arguments than expected, so matching
the exact number of arguments would fail, but this is fine as long as we have
all the arguments that we need in their respective places.

This patch adds a set of flags to the CallDescription class so that to handle
various special matching rules, and adds the first flag into this set,
which enables a more fuzzy matching for functions that
may be implemented as compiler builtins.

Differential Revision: https://reviews.llvm.org/D62556

llvm-svn: 364867
2019-07-01 23:02:07 +00:00
Artem Dergachev ec8e95640f [analyzer] NFC: Add a convenient CallDescriptionMap class.
It encapsulates the procedure of figuring out whether a call event
corresponds to a function that's modeled by a checker.

Checker developers no longer need to worry about performance of
lookups into their own custom maps.

Add unittests - which finally test CallDescription itself as well.

Differential Revision: https://reviews.llvm.org/D62441

llvm-svn: 364866
2019-07-01 23:02:03 +00:00
Nathan Huckleberry 13fde7a89a [analyzer] Fix clang-tidy crash on GCCAsmStmt
Summary:
Added entry in switch statement to recognize GCCAsmStmt
as a possible block terminator.

Handling to build CFG using GCCAsmStmt was already implemented.

Reviewers: nickdesaulniers, george.karpenkov, NoQ

Reviewed By: nickdesaulniers, NoQ

Subscribers: xbolva00, tmroeder, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63533

llvm-svn: 364605
2019-06-27 22:46:40 +00:00
Csaba Dabis 0cdd13c05a [analyzer] print() JSONify: Create pointers
Summary: -

Reviewers: NoQ

Reviewed By: NoQ

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63726

llvm-svn: 364271
2019-06-25 03:17:55 +00:00
Artem Dergachev c48be7fc1c [analyzer] Add more timers for performance profiling.
The -analyzer-stats flag now allows you to find out how much time was spent
on AST-based analysis and on path-sensitive analysis and, separately,
on bug visitors, as they're occasionally a performance problem on their own.

The total timer wasn't useful because there's anyway a total time printed out.
Remove it.

Differential Revision: https://reviews.llvm.org/D63227

llvm-svn: 364266
2019-06-25 02:16:47 +00:00
Richard Smith 7939ba08ab [cxx2a] P1236R1: the validity of a left shift does not depend on the
value of the LHS operand.

llvm-svn: 364265
2019-06-25 01:45:26 +00:00
Csaba Dabis 49885b1245 [analyzer] ExprEngine: Escape pointers in bitwise operations
Summary:
After evaluation it would be an Unknown value and tracking would be lost.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63720

llvm-svn: 364259
2019-06-25 00:44:33 +00:00
Csaba Dabis 906d494b6e [analyzer] Fix JSON dumps for ExplodedNodes
Summary:
- Now we could see the `has_report` property in `trim-egraph` mode.
- This patch also removes the trailing comma after each node.

Reviewers: NoQ

Reviewed By: NoQ

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63436

llvm-svn: 364193
2019-06-24 16:06:44 +00:00
Artem Dergachev 5c287f751a [analyzer] DeadStores: Update the crude suppression for files generated by IIG.
They changed the comments that we were looking for.

llvm-svn: 363995
2019-06-20 22:29:40 +00:00
Artem Dergachev b50d167358 [analyzer] exploded-graph-rewriter: Fix escaping StringRegions.
Quotes around StringRegions are now escaped and unescaped correctly,
producing valid JSON.

Additionally, add a forgotten escape for Store values.

Differential Revision: https://reviews.llvm.org/D63519

llvm-svn: 363897
2019-06-19 23:33:55 +00:00
Artem Dergachev 064c8c689a [analyzer] Fix JSON dumps for store clusters.
Include a unique pointer so that it was possible to figure out if it's
the same cluster in different program states. This allows comparing
dumps of different states against each other.

Differential Revision: https://reviews.llvm.org/D63362

llvm-svn: 363896
2019-06-19 23:33:51 +00:00
Artem Dergachev f9f6cdb1a8 [analyzer] Fix JSON dumps for location contexts.
Location context ID is a property of the location context, not of an item
within it. It's useful to know the id even when there are no items
in the context, eg. for the purposes of figuring out how did contents
of the Environment for the same location context changed across states.

Differential Revision: https://reviews.llvm.org/D62754

llvm-svn: 363895
2019-06-19 23:33:48 +00:00
Artem Dergachev 3bb7b2ec7f [analyzer] Fix JSON dumps for dynamic type information.
They're now valid JSON.

Differential Revision: https://reviews.llvm.org/D62716

llvm-svn: 363894
2019-06-19 23:33:45 +00:00
Artem Dergachev 44820630df [analyzer] NFC: Change evalCall() to provide a CallEvent.
This changes the checker callback signature to use the modern, easy to
use interface. Additionally, this unblocks future work on allowing
checkers to implement evalCall() for calls that don't correspond to any
call-expression or require additional information that's only available
as part of the CallEvent, such as C++ constructors and destructors.

Differential Revision: https://reviews.llvm.org/D62440

llvm-svn: 363893
2019-06-19 23:33:42 +00:00
Artem Dergachev 3707b05211 [analyzer] DeadStores: Add a crude suppression files generated by DriverKit IIG.
IIG is a replacement for MIG in DriverKit: IIG is autogenerating C++ code.
Suppress dead store warnings on such code, as the tool seems to be producing
them regularly, and the users of IIG are not in position to address these
warnings, as they don't control the autogenerated code. IIG-generated code
is identified by looking at the comments at the top of the file.

Differential Revision: https://reviews.llvm.org/D63118

llvm-svn: 363892
2019-06-19 23:33:39 +00:00
Hubert Tong 64b60df99f [analyzer] SARIF: Add EOF newline; replace diff_sarif
Summary:
This patch applies a change similar to rC363069, but for SARIF files.

The `%diff_sarif` lit substitution invokes `diff` with a non-portable
`-I` option. The intended effect can be achieved by normalizing the
inputs to `diff` beforehand. Such normalization can be done with
`grep -Ev`, which is also used by other tests.

Additionally, this patch updates the SARIF output to have a newline at
the end of the file. This makes it so that the SARIF file qualifies as a
POSIX text file, which increases the consumability of the generated file
in relation to various tools.

Reviewers: NoQ, sfertile, xingxue, jasonliu, daltenty, aaron.ballman

Reviewed By: aaron.ballman

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, jsji, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62952

llvm-svn: 363822
2019-06-19 15:27:35 +00:00
Kristof Umann e20b388e2f [analyzer] Push correct version of 'Track indices of arrays'
Messed up the commit, oops.

llvm-svn: 363512
2019-06-16 15:41:25 +00:00
Kristof Umann 33b46a6df0 [analyzer] Track indices of arrays
Often times, when an ArraySubscriptExpr was reported as null or
undefined, the bug report was difficult to understand, because the
analyzer explained why arr[i] has that value, but didn't realize that in
fact i's value is very important as well. This patch fixes this by
tracking the indices of arrays.

Differential Revision: https://reviews.llvm.org/D63080

llvm-svn: 363510
2019-06-16 14:52:56 +00:00
Kristof Umann 9ff09d49da [analyzer][NFC] Tease apart and clang-format NoStoreFuncVisitor
Make several methods static functions
Move non-trivial methods out-of-line
Add a divider
Turn non-obvious autos into Optional<RegionVector>
clang-format affected lines

Differential Revision: https://reviews.llvm.org/D63086

llvm-svn: 363509
2019-06-16 14:09:11 +00:00
Csaba Dabis 077f13c612 [analyzer] ReturnVisitor: Bypass everything to see inlined calls
Summary:
When we traversed backwards on ExplodedNodes to see where processed the
given statement we `break` too early. With the current approach we do not
miss the CallExitEnd ProgramPoint which stands for an inlined call.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62926

llvm-svn: 363491
2019-06-15 10:05:49 +00:00
Richard Smith 27252a1f95 PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of type
nullptr_t does not access memory.

We now reuse CK_NullToPointer to represent a conversion from a glvalue
of type nullptr_t to a prvalue of nullptr_t where necessary.

This reinstates r363337, reverted in r363352.

llvm-svn: 363429
2019-06-14 17:46:38 +00:00
Nico Weber 3d02b895ed Revert 363295, it caused PR42276. Also revert follow-ups 363337, 363340.
Revert 363340 "Remove unused SK_LValueToRValue initialization step."
Revert 363337 "PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of type"
Revert 363295 "C++ DR712 and others: handle non-odr-use resulting from an lvalue-to-rvalue conversion applied to a member access or similar not-quite-trivial lvalue expression."

llvm-svn: 363352
2019-06-14 04:05:17 +00:00
Richard Smith 0476d069e3 PR23833, DR2140: an lvalue-to-rvalue conversion on a glvalue of type
nullptr_t does not access memory.

We now reuse CK_NullToPointer to represent a conversion from a glvalue
of type nullptr_t to a prvalue of nullptr_t where necessary.

This reinstates r345562, reverted in r346065, now that CodeGen's
handling of non-odr-used variables has been fixed.

llvm-svn: 363337
2019-06-13 23:31:04 +00:00
Hubert Tong 9df9cbafce [PlistSupport] Produce a newline to end plist output files
Summary:
As suggested in the review of D62949, this patch updates the plist
output to have a newline at the end of the file. This makes it so that
the plist output file qualifies as a POSIX text file, which increases
the consumability of the generated plist file in relation to various
tools.

Reviewers: NoQ, sfertile, xingxue, jasonliu, daltenty

Reviewed By: NoQ, xingxue

Subscribers: jsji, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D63041

llvm-svn: 362992
2019-06-10 22:30:57 +00:00
Kristof Umann 4cc6d72bb4 [analyzer][NFC] Add dividers to BugReporterVisitors.cpp
Some minor formatting to make the file more readable.
Added //===----------===// around the implementation of class methods
and divided anonymous namespaces as per
https://llvm.org/docs/CodingStandards.html#anonymous-namespaces

llvm-svn: 362887
2019-06-08 20:25:39 +00:00
Keno Fischer 6f48c07620 [analyzer] Add werror flag for analyzer warnings
Summary:
We're using the clang static analyzer together with a number of
custom analyses in our CI system to ensure that certain invariants
are statiesfied for by the code every commit. Unfortunately, there
currently doesn't seem to be a good way to determine whether any
analyzer warnings were emitted, other than parsing clang's output
(or using scan-build, which then in turn parses clang's output).
As a simpler mechanism, simply add a `-analyzer-werror` flag to CC1
that causes the analyzer to emit its warnings as errors instead.
I briefly tried to have this be `Werror=analyzer` and make it go
through that machinery instead, but that seemed more trouble than
it was worth in terms of conflicting with options to the actual build
and special cases that would be required to circumvent the analyzers
usual attempts to quiet non-analyzer warnings. This is simple and it
works well.

Reviewed-By: NoQ, Szelethusw
Differential Revision: https://reviews.llvm.org/D62885

llvm-svn: 362855
2019-06-07 23:34:00 +00:00
Csaba Dabis 84cfca0f2b [analyzer] PathDiagnosticPopUpPiece: working with CharSourceRange
Summary: Sometimes we are at character boundaries so past the token-range.
llvm-svn: 362632
2019-06-05 18:55:39 +00:00
Csaba Dabis 4595f01b06 [analyzer] print() JSONify: ExplodedNode revision
Summary: Revert node-ID removal.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp,
             cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62658

llvm-svn: 362249
2019-05-31 17:54:12 +00:00
Csaba Dabis 74c5fac3bb [analyzer] Remove EndPath function as it is dead code
Summary: -

Reviewers: george.karpenkov

Reviewed By: george.karpenkov

Subscribers: baloghadamsoftware, cfe-commits, xazax.hun, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D53720

llvm-svn: 362030
2019-05-29 20:47:27 +00:00
Csaba Dabis 2e896b8b39 [analyzer] ConditionBRVisitor: Boolean support
Summary: -

Reviewers: NoQ, george.karpenkov

Reviewed By: NoQ, george.karpenkov

Subscribers: cfe-commits, xazax.hun, baloghadamsoftware, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D58207

llvm-svn: 362027
2019-05-29 20:34:29 +00:00
Csaba Dabis d1f0ec3f64 [analyzer] ConditionBRVisitor: MemberExpr support
Summary: -

Reviewers: NoQ, george.karpenkov

Reviewed By: NoQ

Subscribers: cfe-commits, xazax.hun, baloghadamsoftware, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D58206

llvm-svn: 362026
2019-05-29 20:29:02 +00:00
Csaba Dabis 9942a996d9 [analyzer] ConditionBRVisitor: Remove duplicated code
Summary: -

Reviewers: NoQ, george.karpenkov

Reviewed By: NoQ

Subscribers: cfe-commits, xazax.hun, baloghadamsoftware, szepet, a.sidorin,
             mikhail.ramalho, Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D58199

llvm-svn: 362025
2019-05-29 20:18:07 +00:00
Csaba Dabis 4b0184b2d3 [analyzer] ConditionBRVisitor: Enhance to write out more information
Summary:
Add extra messages to the bug report to inform the user why the analyzer
`Taking true/false branch`.

Reviewers: NoQ, george.karpenkov

Reviewed By: NoQ

Subscribers: gerazo, gsd, dkrupp, whisperity, baloghadamsoftware, xazax.hun,
             eraman, szepet, a.sidorin, mikhail.ramalho, Szelethus,
             donat.nagy, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D53076

llvm-svn: 362020
2019-05-29 20:06:09 +00:00
Csaba Dabis 1d7ca67769 [analyzer] [NFC] PathDiagnostic: Create PathDiagnosticPopUpPiece
Summary:
This new piece is similar to our macro expansion printing in HTML reports:
On mouse-hover event it pops up on variables. Similar to note pieces it
supports `plist` diagnostics as well.

It is optional, on by default: `add-pop-up-notes=true`.

Extra: In HTML reports `background-color: LemonChiffon` was too light,
changed to `PaleGoldenRod`.

Reviewers: NoQ, alexfh

Reviewed By: NoQ

Subscribers: cfe-commits, gerazo, gsd, george.karpenkov, alexfh, xazax.hun,
             baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho,
             Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D60670

llvm-svn: 362014
2019-05-29 19:21:59 +00:00
Csaba Dabis 8a88d6aaaa [analyzer] print() JSONify: SVal implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: cfe-commits, szepet, rnkovacs, a.sidorin, mikhail.ramalho,
             Szelethus, donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62497

llvm-svn: 362008
2019-05-29 18:38:52 +00:00
Haojian Wu 5feead5752 Fix an unused-variable error.
llvm-svn: 362005
2019-05-29 18:36:54 +00:00
Csaba Dabis 9ee26c8d5f [analyzer][AST] print() JSONify: Stmt implementation
Summary:
This patch also adds a function called `JsonFormat()` which:
- Flattens the string so removes the new-lines.
- Escapes double quotes.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: cfe-commits, szepet, rnkovacs, a.sidorin, mikhail.ramalho,
             donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62494

llvm-svn: 362000
2019-05-29 18:17:18 +00:00
Csaba Dabis 13e491cca5 [analyzer] print() JSONify: getNodeLabel implementation
Summary: This patch also rewrites the ProgramPoint printing.

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: cfe-commits, szepet, rnkovacs, a.sidorin, mikhail.ramalho,
             donat.nagy, dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62346

llvm-svn: 361997
2019-05-29 18:05:53 +00:00
Csaba Dabis df0a42127c [analyzer] print() JSONify: Program state implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62087

llvm-svn: 361983
2019-05-29 16:22:21 +00:00
Csaba Dabis b7ca72a113 [analyzer] print() JSONify: Checker messages implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62086

llvm-svn: 361982
2019-05-29 16:02:33 +00:00
Csaba Dabis 35e54eb31e [analyzer] print() JSONify: Constructing objects implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62085

llvm-svn: 361980
2019-05-29 15:58:26 +00:00
Csaba Dabis 32981637ce [analyzer] print() JSONify: Type information implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62083

llvm-svn: 361979
2019-05-29 15:53:12 +00:00
Csaba Dabis 5df5eb8816 [analyzer] print() JSONify: Constraints implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62082

llvm-svn: 361978
2019-05-29 15:43:26 +00:00
Csaba Dabis 9ce3746604 [analyzer] print() JSONify: Environment implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D62081

llvm-svn: 361976
2019-05-29 15:36:58 +00:00
Csaba Dabis 124cba0b81 [analyzer] print() JSONify: Store implementation
Summary: -

Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus

Reviewed By: NoQ

Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy,
             dkrupp

Tags: #clang

Differential Revision: https://reviews.llvm.org/D61912

llvm-svn: 361972
2019-05-29 15:25:19 +00:00
Adam Balogh 9ed4b316d1 [Analyzer] Replace `CXXSelfAssignmentBRVisitor` with `NoteTags`
The `cplusplus.SelfAssignment` checker has a visitor that is added
to every `BugReport` to mark the to branch of the self assignment
operator with e.g. `rhs == *this` and `rhs != *this`. With the new
`NoteTag` feature this visitor is not needed anymore. Instead the
checker itself marks the two branches using the `NoteTag`s.

Differential Revision: https://reviews.llvm.org/D62479

llvm-svn: 361818
2019-05-28 13:07:09 +00:00
Artem Dergachev ef0aab3138 [analyzer] Add a prunable note for skipping vbase inits in subclasses.
When initialization of virtual base classes is skipped, we now tell the user
about it, because this aspect of C++ isn't very well-known.

The implementation is based on the new "note tags" feature (r358781).
In order to make use of it, allow note tags to produce prunable notes,
and move the note tag factory to CoreEngine.

Differential Revision: https://reviews.llvm.org/D61817

llvm-svn: 361682
2019-05-24 23:37:11 +00:00