Commit Graph

1466 Commits

Author SHA1 Message Date
Ted Kremenek 3d84c96dd3 Remove dead assignment dominated by a call to llvm_unreachable().
llvm-svn: 204375
2014-03-20 18:47:50 +00:00
Ted Kremenek 03a3d74ff2 [analyzer] Fix a bad bug in reversePropagateInterstingSymbols() where only one subexpression of BinaryOperator would be explored.
llvm-svn: 204374
2014-03-20 18:47:47 +00:00
Craig Topper fb6b25b5e4 [C++11] Add 'override' keyword to virtual methods that override their base class.
llvm-svn: 203999
2014-03-15 04:29:04 +00:00
Aaron Ballman 574705ed7f [C++11] Replacing CXXRecordDecl iterators bases_begin() and bases_end() with iterator_range bases(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203803
2014-03-13 15:41:46 +00:00
Anton Yartsev fe50df6983 [analyzer] Eliminate memory leak in BugReporter::emitReport()
llvm-svn: 203507
2014-03-10 22:35:02 +00:00
Benjamin Kramer 3f755aa7a8 [C++11] Avoid implicit conversion of ArrayRef to std::vector and use move semantics where appropriate.
llvm-svn: 203477
2014-03-10 17:55:02 +00:00
Ahmed Charles dfca6f97bc [C++11] Replace OwningPtr include with <memory>.
llvm-svn: 203389
2014-03-09 11:36:40 +00:00
Aaron Ballman e8a8baef44 [C++11] Replacing RecordDecl iterators field_begin() and field_end() with iterator_range fields(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 203355
2014-03-08 20:12:42 +00:00
Ahmed Charles b89843299a Replace OwningPtr with std::unique_ptr.
This compiles cleanly with lldb/lld/clang-tools-extra/llvm.

llvm-svn: 203279
2014-03-07 20:03:18 +00:00
Ahmed Charles 9a16beb8bc Change OwningPtr::take() to OwningPtr::release().
This is a precursor to moving to std::unique_ptr.

llvm-svn: 203275
2014-03-07 19:33:25 +00:00
Ted Kremenek d8c64f573d Remove dead return in BugReporter (found via -Wunreachable-code).
llvm-svn: 203077
2014-03-06 05:37:28 +00:00
Benjamin Kramer a741b8c451 [C++11] Simplify compare operators with std::tie.
No functionality change.

llvm-svn: 202755
2014-03-03 20:26:46 +00:00
Benjamin Kramer 867ea1d426 [C++11] Replace llvm::tie with std::tie.
llvm-svn: 202639
2014-03-02 13:01:17 +00:00
Benjamin Kramer 167e999be9 [C++11] Replace llvm::next and llvm::prior with std::next and std::prev.
llvm-svn: 202635
2014-03-02 12:20:24 +00:00
Chandler Carruth c72d9b33af [C++11] Switch from the llvm_move macro to directly calling std::move.
llvm-svn: 202611
2014-03-02 04:02:40 +00:00
Benjamin Kramer bbdd7640e8 [C++11] Replace verbose functors with succinct lambdas
No functionality change.

llvm-svn: 202590
2014-03-01 14:48:57 +00:00
Anton Yartsev 68a172ca16 [analyzer] Fix for PR18394.
Additional conditions that prevent useful nodes before call from being reclaimed.

llvm-svn: 202553
2014-02-28 22:29:48 +00:00
Alexey Bataev 1b59ab5683 [OPENMP] First changes for Parsing and Sema for 'omp simd' directive support
llvm-svn: 202360
2014-02-27 08:29:12 +00:00
NAKAMURA Takumi 9698686505 [CMake] Use LINK_LIBS instead of target_link_libraries().
llvm-svn: 202238
2014-02-26 06:41:29 +00:00
Rafael Espindola 4fbd373815 Update for llvm api change.
llvm-svn: 202053
2014-02-24 18:20:21 +00:00
Rafael Espindola 04a13befd8 Don't assume that F_None is the default. It is about to change.
llvm-svn: 202040
2014-02-24 15:06:52 +00:00
NAKAMURA Takumi 7da9487dd4 [CMake] Get rid of explicit dependencies to include/clang/*.inc and introduce CLANG_TABLEGEN_TARGETS.
This does;
  - clang_tablegen() adds each tblgen'd target to global property CLANG_TABLEGEN_TARGETS as list.
  - List of targets is added to LLVM_COMMON_DEPENDS.
  - all clang libraries and targets depend on generated headers.

You might wonder this would be regression, but in fact, this is little loss.
  - Almost all of clang libraries depend on tblgen'd files and clang-tblgen.
  - clang-tblgen may cause short stall-out but doesn't cause unconditional rebuild.
  - Each library's dependencies to tblgen'd files might vary along headers' structure.
    It made hard to track and update *really optimal* dependencies.

Each dependency to intrinsics_gen and ClangSACheckers is left as DEPENDS.

llvm-svn: 201842
2014-02-21 07:59:59 +00:00
Reid Kleckner 588c937228 Use llvm::DeleteContainerSeconds when possible
llvm-svn: 201739
2014-02-19 23:44:52 +00:00
Anton Yartsev 6a61922239 [analyzer] Improved checker naming in CFG dump.
This implements FIXME from Checker.cpp (FIXME: We want to return the package + name of the checker here.) and replaces hardcoded checker names with the new ones obtained via getCheckName().getName().

llvm-svn: 201525
2014-02-17 18:25:34 +00:00
Rafael Espindola ea2519c37b Use simpler version of llvm::sys::fs::create_directories.
llvm-svn: 201290
2014-02-13 04:08:44 +00:00
Alexander Kornienko 4aca9b1cd8 Expose the name of the checker producing each diagnostic message.
Summary:
In clang-tidy we'd like to know the name of the checker producing each
diagnostic message. PathDiagnostic has BugType and Category fields, which are
both arbitrary human-readable strings, but we need to know the exact name of the
checker in the form that can be used in the CheckersControlList option to
enable/disable the specific checker.

This patch adds the CheckName field to the CheckerBase class, and sets it in
the CheckerManager::registerChecker() method, which gets them from the
CheckerRegistry.

Checkers that implement multiple checks have to store the names of each check
in the respective registerXXXChecker method.

Reviewers: jordan_rose, krememek

Reviewed By: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2557

llvm-svn: 201186
2014-02-11 21:49:21 +00:00
Jordan Rose 8b808d64af [analyzer] Inline C++ operator new when c++-inline-allocators is turned on.
This will let us stage in the modeling of operator new. The -analyzer-config
opton 'c++-inline-allocators' is currently off by default.

Patch by Karthik Bhat!

llvm-svn: 201122
2014-02-11 02:21:06 +00:00
Jordan Rose c7d0acaf34 [analyzer] Just silence all warnings coming out of std::basic_string.
This means always walking the whole call stack for the end path node, but
we'll assume that's always fairly tractable.

<rdar://problem/15952973>

llvm-svn: 200980
2014-02-07 17:35:04 +00:00
Alp Toker 314cc81b8c Rename getResultType() on function and method declarations to getReturnType()
A return type is the declared or deduced part of the function type specified in
the declaration.

A result type is the (potentially adjusted) type of the value of an expression
that calls the function.

Rule of thumb:

  * Declarations have return types and parameters.
  * Expressions have result types and arguments.

llvm-svn: 200082
2014-01-25 16:55:45 +00:00
Alp Toker 48047f5d75 PlistSupport: Eliminate duplicated EmitLocation() and EmitRange() functions
llvm-svn: 200077
2014-01-25 14:38:41 +00:00
Alp Toker bdbcfbf160 PlistSupport: Unify ARCMigrate / StaticAnalyzer plist writers
Reduces the ARCMT migrator plist writer down to a single function,
arcmt::writeARCDiagsToPlist() which shares supporting functions with the
analyzer plist writer.

llvm-svn: 200075
2014-01-25 11:14:41 +00:00
Ted Kremenek 2ff160046b Change CallEvent to use ArrayRef<> interface to get formal parameters of callee.
llvm-svn: 199472
2014-01-17 07:15:31 +00:00
Jordan Rose 2be02a7848 [analyzer] Shitfing a constant value by its bit width is undefined.
Citation: C++11 [expr.shift]p1 (and the equivalent text in C11).

This fixes PR18073, but the right thing to do (as noted in the FIXME) is to
have a real checker for too-large shifts.

llvm-svn: 199405
2014-01-16 18:02:23 +00:00
Jordan Rose 2a833ca575 [analyzer] BlockCall shouldn't really be an AnyFunctionCall.
Per discussion with Anna a /long/ time ago, it was way too easy to misuse
BlockCall: because it inherited from AnyFunctionCall (through SimpleCall),
getDecl() was constrained to return a FunctionDecl, and you had to call
getBlockDecl() instead. This goes against the whole point of CallEvent
(to abstract over different ways to invoke bodies of code).

Now, BlockCall just inherits directly from CallEvent. There's a bit of
duplication in getting things out of the origin expression (which is still
known to be a CallExpr), but nothing significant.

llvm-svn: 199321
2014-01-15 17:25:15 +00:00
Jordan Rose c9176072e6 [analyzer] Add a CFG node for the allocator call in a C++ 'new' expression.
In an expression like "new (a, b) Foo(x, y)", two things happen:
- Memory is allocated by calling a function named 'operator new'.
- The memory is initialized using the constructor for 'Foo'.

Currently the analyzer only models the second event, though it has special
cases for both the default and placement forms of operator new. This patch
is the first step towards properly modeling both events: it changes the CFG
so that the above expression now generates the following elements.

1. a
2. b
3. (CFGNewAllocator)
4. x
5. y
6. Foo::Foo

The analyzer currently ignores the CFGNewAllocator element, but the next
step is to treat that as a call like any other.

The CFGNewAllocator element is not added to the CFG for analysis-based
warnings, since none of them take advantage of it yet.

llvm-svn: 199123
2014-01-13 17:59:19 +00:00
Jordan Rose 1a866cd54b [analyzer] Model getters of known-@synthesized Objective-C properties.
...by synthesizing their body to be "return self->_prop;", with an extra
nudge to RetainCountChecker to still treat the value as +0 if we have no
other information.

This doesn't handle weak properties, but that's mostly correct anyway,
since they can go to nil at any time. This also doesn't apply to properties
whose implementations we can't see, since they may not be backed by an
ivar at all. And finally, this doesn't handle properties of C++ class type,
because we can't invoke the copy constructor. (Sema has actually done this
work already, but the AST it synthesizes is one the analyzer doesn't quite
handle -- it has an rvalue DeclRefExpr.)

Modeling setters is likely to be more difficult (since it requires
handling strong/copy), but not impossible.

<rdar://problem/11956898>

llvm-svn: 198953
2014-01-10 20:06:06 +00:00
Jordan Rose 656fdd55dd [analyzer] Warn about double-delete in C++ at the second delete...
...rather somewhere in the destructor when we try to access something and
realize the object has already been deleted. This is necessary because
the destructor is processed before the 'delete' itself.

Patch by Karthik Bhat!

llvm-svn: 198779
2014-01-08 18:46:55 +00:00
Jordan Rose 514f935411 [analyzer] Pointers escape into +[NSValue valueWithPointer:]...
...even though the argument is declared "const void *", because this is
just a way to pass pointers around as objects. (Though NSData is often
a better one.)

PR18262

llvm-svn: 198710
2014-01-07 21:39:48 +00:00
Chandler Carruth 5553d0d4ca Sort all the #include lines with LLVM's utils/sort_includes.py which
encodes the canonical rules for LLVM's style. I noticed this had drifted
quite a bit when cleaning up LLVM, so wanted to clean up Clang as well.

llvm-svn: 198686
2014-01-07 11:51:46 +00:00
Alp Toker ef6b007dc5 Only mark dump() function definitions 'used' in debug builds
This has the dual effect of (1) enabling more dead-stripping in release builds
and (2) ensuring that debug helper functions aren't stripped away in debug
builds, as they're intended to be called from the debugger.

Note that the attribute is applied to definitions rather than declarations in
headers going forward because it's now conditional on NDEBUG:

  /// \brief Mark debug helper function definitions like dump() that should not be
  /// stripped from debug builds.

Requires corresponding macro added in LLVM r198456.

llvm-svn: 198489
2014-01-04 13:47:14 +00:00
Aaron Ballman b190f974c9 Fixed a FIXME; created a print method for Selectors that accepts a raw_ostream, and started using it in places it made sense.
No functional changes intended, just API cleanliness.

llvm-svn: 198428
2014-01-03 17:59:55 +00:00
Alp Toker 95e7ff2ed1 Eliminate UnaryTypeTraitExpr
Remove UnaryTypeTraitExpr and switch all remaining type trait related handling
over to TypeTraitExpr.

The UTT/BTT/TT enum prefix and evaluation code is retained pending further
cleanup.

This is part of the ongoing work to unify type traits following the removal of
BinaryTypeTraitExpr in r197273.

llvm-svn: 198271
2014-01-01 05:57:51 +00:00
Jordan Rose 7ae3362458 [analyzer] Always use 'bool' as the SValBuilder condition type in C++.
We have assertions for this, but a few edge cases had snuck through where
we were still unconditionally using 'int'.

<rdar://problem/15703011>

llvm-svn: 197733
2013-12-19 22:32:39 +00:00
Aaron Ballman 9ead1243a5 Replacing calls to getAttr with calls to hasAttr for clarity. No functional change intended -- this only replaces Boolean uses of getAttr.
llvm-svn: 197648
2013-12-19 02:39:40 +00:00
Alp Toker cbb9034e2a Eliminate BinaryTypeTraitExpr
There's nothing special about type traits accepting two arguments.

This commit eliminates BinaryTypeTraitExpr and switches all related handling
over to TypeTraitExpr.

Also fixes a CodeGen failure with variadic type traits appearing in a
non-constant expression.

The BTT/TT prefix and evaluation code is retained as-is for now but will soon
be further cleaned up.

This is part of the ongoing work to unify type traits.

llvm-svn: 197273
2013-12-13 20:49:58 +00:00
Jordan Rose 6d03fdb6a4 [analyzer] Add checker callbacks for MemberExpr and UnaryExprOrTypeTraitExpr.
Found by Arthur Yoo!

llvm-svn: 197059
2013-12-11 17:58:10 +00:00
David Tweed e1468322eb Add front-end infrastructure now address space casts are in LLVM IR.
With the introduction of explicit address space casts into LLVM, there's
a need to provide a new cast kind the front-end can create for C/OpenCL/CUDA
and code to produce address space casts from those kinds when appropriate.

Patch by Michele Scandale!

llvm-svn: 197036
2013-12-11 13:39:46 +00:00
Jordan Rose 60bd88d341 [analyzer] Extend IdenticalExprChecker to check ternary operator results.
Warn if both result expressions of a ternary operator (? :) are the same.
Because only one of them will be executed, this warning will fire even if
the expressions have side effects.

Patch by Anders Rönnholm and Per Viberg!

llvm-svn: 196937
2013-12-10 18:18:06 +00:00
NAKAMURA Takumi ebde2aef9f [CMake] clang/lib: Prune redundant dependencies.
llvm-svn: 196864
2013-12-10 02:36:22 +00:00
NAKAMURA Takumi 65d42bcc2b [CMake] clang/lib: Satisfy dependencies to add *actually used* libraries on target_link_libraries() and LLVM_LINK_COMPONENTS.
I will prune redundant dependencies later.

llvm-svn: 196800
2013-12-09 19:04:43 +00:00
Anna Zaks cf8d2165ff Revert "[analyzer] Refactor conditional expression evaluating code"
This reverts commit r189090.

The original patch introduced regressions (see the added live-variables.* tests). The patch depends on the correctness of live variable analyses, which are not computed correctly. I've opened PR18159 to track the proper resolution to this problem.

The patch was a stepping block to r189746. This is why part of the patch reverts temporary destructor tests that started crashing. The temporary destructors feature is disabled by default.

llvm-svn: 196593
2013-12-06 18:56:29 +00:00
Alp Toker f6a24ce40f Fix a tranche of comment, test and doc typos
llvm-svn: 196510
2013-12-05 16:25:25 +00:00
Alp Toker d473363876 Correct hyphenations in comments and assert messages
This patch tries to avoid unrelated changes other than fixing a few
hyphen-related ambiguities in nearby lines.

llvm-svn: 196466
2013-12-05 04:47:09 +00:00
Alp Toker 965f882588 Remove a whole lot of unused variables
There are about 30 removed in this patch, generated by a new FixIt I haven't
got round to submitting yet.

llvm-svn: 195814
2013-11-27 05:22:15 +00:00
Anna Zaks d2a807d831 [analyzer] Fix an infinite recursion in region invalidation by adding block count to the BlockDataRegion.
llvm-svn: 195174
2013-11-20 00:11:42 +00:00
Jordan Rose 4c56c22634 [analyzer] Silence warnings coming from allocators used by std::basic_string.
This is similar to r194004: because we can't reason about the data structure
invariants of std::basic_string, the analyzer decides it's possible for an
allocator to be used to deallocate the string's inline storage. Just ignore
this by walking up the stack, skipping past methods in classes with
"allocator" in the name, and seeing if we reach std::basic_string that way.

PR17866

llvm-svn: 194764
2013-11-15 02:11:19 +00:00
Jordan Rose 11288ce34c [analyzer] Include bug column numbers in HTML output (in a comment).
This has no effect on user-visible output, but can be used by post-processing
tools that work with the generated HTML, rather than using CmpRuns.py's
interface to work with plists.

Patch by György Orbán!

llvm-svn: 194763
2013-11-15 02:11:11 +00:00
Jordan Rose 236dbd25e7 [analyzer] Specialize "loop executed 0 times" for for-in and for-range loops.
The path note that says "Loop body executed 0 times" has been changed to
"Loop body skipped when range is empty" for C++11 for-range loops, and to
"Loop body skipped when collection is empty" for Objective-C for-in loops.

Part of <rdar://problem/14992886>

llvm-svn: 194234
2013-11-08 01:15:30 +00:00
Anna Zaks 830d2f7701 [analyzer] Suppress warnings coming out of std::basic_string.
The analyzer cannot reason about the internal invariances of the data structure (radar://15194597).

llvm-svn: 194004
2013-11-04 19:13:03 +00:00
Jordan Rose 1417a7b174 [analyzer] Don't crash when a path goes through a 'delete' destructor call.
This was just left unimplemnted from r191381; the fix is to report this call
location as the location of the 'delete' expr.

PR17746

llvm-svn: 193783
2013-10-31 18:41:15 +00:00
Jordan Rose e692cfa330 [analyzer] Don't emit an "Assuming x is <OP> y" if it's not a comparison op.
We could certainly be more precise in many of our diagnostics, but before we
were printing "Assuming x is && y", which is just ridiculous.

<rdar://problem/15167979>

llvm-svn: 193455
2013-10-26 01:16:26 +00:00
Jordan Rose bb61c8cc73 [analyzer] Generate a LazyCompoundVal when loading from a union-typed region.
This ensures that variables accessible through a union are invalidated when
the union value is passed to a function. We still don't fully handle union
values, but this should at least quiet some false positives.

PR16596

llvm-svn: 193265
2013-10-23 20:08:55 +00:00
Jordan Rose ac07c8dae7 [analyzer] Don't draw edges to C++11 in-class member initializers.
Since these aren't lexically in the constructor, drawing arrows would
be a horrible jump across the body of the class. We could still do
better here by skipping over unimportant initializers, but this at least
keeps everything within the body of the constructor.

<rdar://problem/14960554>

llvm-svn: 192818
2013-10-16 17:45:35 +00:00
Jordan Rose 42b4248f05 [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.
No functionality change.

llvm-svn: 192114
2013-10-07 17:16:59 +00:00
Jordan Rose 6feda28756 [analyzer] Replace bug category magic strings with shared constants, take 2.
Re-commit r191910 (reverted in r191936) with layering violation fixed, by
moving the bug categories to StaticAnalyzerCore instead of ...Checkers.

llvm-svn: 191937
2013-10-04 00:25:24 +00:00
Jordan Rose 3553bb384b [analyzer] Make inlining decisions based on the callee being variadic.
...rather than trying to figure it out from the call site, and having
people complain that we guessed wrong and that a prototype-less call is
the same as a variadic call on their system. More importantly, fix a
crash when there's no decl at the call site (though we could have just
returned a default value).

<rdar://problem/15037033>

llvm-svn: 191599
2013-09-28 02:04:19 +00:00
Jordan Rose a63d1dbddf [analyzer] Allow pre/post-statement checkers for UnaryOperator.
Found by Arthur Yoo.

llvm-svn: 191532
2013-09-27 16:47:52 +00:00
Jordan Rose 1ccc43d50e [analyzer] Handle destructors for the argument to C++ 'delete'.
Now that the CFG includes nodes for the destructors in a delete-expression,
process them in the analyzer using the same common destructor interface
currently used for local, member, and base destructors. Also, check for when
the value is known to be null, in which case no destructor is actually run.

This does not yet handle destructors for deleted /arrays/, which may need
more CFG work. It also causes a slight regression in the location of
double delete warnings; the double delete is detected at the destructor
call, which is implicit, and so is reported on the first access within the
destructor instead of at the 'delete' statement. This will be fixed soon.

Patch by Karthik Bhat!

llvm-svn: 191381
2013-09-25 16:06:17 +00:00
NAKAMURA Takumi 64b1292bc2 StaticAnalyzer/Core/RegionStore.cpp: Prune one last "\param IsConst", as fixup to r191342. [-Wdocumentation]
llvm-svn: 191360
2013-09-25 08:17:20 +00:00
Anton Yartsev 424ad95fa7 [analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future.
With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters.

This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker.

llvm-svn: 191342
2013-09-24 23:47:29 +00:00
Jordan Rose 5770c038fe [analyzer] Use getParentIgnoreParenCasts instead of doing it by hand.
Apart from being more compact and already implemented, this also handles the
case where the parent is null. (It does also ignore all casts, not just
implicit ones, but this is more efficient to test and in the case we care
about---a message in a PseudoObjectExpr---there should only be implicit casts
anyway.

This should fix our internal buildbot.

llvm-svn: 191094
2013-09-20 16:51:50 +00:00
Jordan Rose 36bc6b4559 [analyzer] Don't even try to convert floats to booleans for now.
We now have symbols with floating-point type to make sure that
(double)x == (double)x comes out true, but we still can't do much with
these. For now, don't even bother trying to create a floating-point zero
value; just give up on conversion to bool.

PR14634, C++ edition.

llvm-svn: 190953
2013-09-18 18:58:58 +00:00
Hal Finkel c4d7c82c7f Add the intrinsic __builtin_convertvector
LLVM supports applying conversion instructions to vectors of the same number of
elements (fptrunc, fptosi, etc.) but there had been no way for a Clang user to
cause such instructions to be generated when using builtin vector types.

C-style casting on vectors is already defined in terms of bitcasts, and so
cannot be used for these conversions as well (without leading to a very
confusing set of semantics). As a result, this adds a __builtin_convertvector
intrinsic (patterned after the OpenCL __builtin_astype intrinsic). This is
intended to aid the creation of vector intrinsic headers that create generic IR
instead of target-dependent intrinsics (in other words, this is a generic
_mm_cvtepi32_ps). As noted in the documentation, the action of
__builtin_convertvector is defined in terms of the action of a C-style cast on
each vector element.

llvm-svn: 190915
2013-09-18 03:29:45 +00:00
Anna Zaks 226a56fa1d [analyzer] More reliably detect property accessors.
This has a side effect of preventing a crash, which occurs because we get a
property getter declaration, which is overriding but is declared inside
@protocol. Will file a bug about this inconsistency internally. Getting a
small test case is very challenging.

llvm-svn: 190836
2013-09-17 01:30:57 +00:00
Jordan Rose cb7b7eaff0 [analyzer] Run post-stmt checks for DeclStmt.
No tests because no in-tree checkers use this, but that shouldn't stop
out-of-tree checkers.

Found by Aemon Cannon!

llvm-svn: 190650
2013-09-13 00:44:47 +00:00
Jordan Rose 9519ff59ec [analyzer] Handle zeroing constructors for fields of structs with empty bases.
RegionStore tries to protect against accidentally initializing the same
region twice, but it doesn't take subregions into account very well. If
the outer region being initialized is a struct with an empty base class,
the offset of the first field in the struct will be 0. When we initialize
the base class, we may invalidate the contents of the struct by providing
a default value of Unknown (or some new symbol). We then go to initialize
the member with a zeroing constructor, only to find that the region at
that offset in the struct already has a value. The best we can do here is
to invalidate that value and continue; neither the old default value nor
the new 0 is correct for the entire struct after the member constructor call.

The correct solution for this is to track region extents in the store.

<rdar://problem/14914316>

llvm-svn: 190530
2013-09-11 16:46:50 +00:00
Jordan Rose d2f4079db9 Add an implicit dtor CFG node just before C++ 'delete' expressions.
This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

  1. <expr>
  2. [B1.1]->~Foo() (Implicit destructor)
  3. delete [B1.1]

Patch by Karthik Bhat!

llvm-svn: 189828
2013-09-03 17:00:57 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
Jordan Rose e600025528 [analyzer] Treat the rvalue of a forward-declared struct as Unknown.
This will never happen in the analyzed code code, but can happen for checkers
that over-eagerly dereference pointers without checking that it's safe.
UnknownVal is a harmless enough value to get back.

Fixes an issue added in r189590, caught by our internal buildbot.

llvm-svn: 189688
2013-08-30 19:17:26 +00:00
Pavel Labath 2c65dfaab5 [analyzer] Fix handling of "empty" structs with base classes
Summary:
RegionStoreManager had an optimization which replaces references to empty
structs with UnknownVal. Unfortunately, this check didn't take into account
possible field members in base classes.

To address this, I changed this test to "is empty and has no base classes". I
don't consider it worth the trouble to go through base classes and check if all
of them are empty.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1547

llvm-svn: 189590
2013-08-29 16:06:04 +00:00
Jordan Rose acd080b956 [analyzer] Add support for testing the presence of weak functions.
When casting the address of a FunctionTextRegion to bool, or when adding
constraints to such an address, use a stand-in symbol to represent the
presence or absence of the function if the function is weakly linked.
This is groundwork for possible simple availability testing checks, and
can already catch mistakes involving inverted null checks for
weakly-linked functions.

Currently, the implementation reuses the "extent" symbols, originally created
for tracking the size of a malloc region. Since FunctionTextRegions cannot
be dereferenced, the extent symbol will never be used for anything else.
Still, this probably deserves a refactoring in the future.

This patch does not attempt to support testing the presence of weak
/variables/ (global variables), which would likely require much more of
a change and a generalization of "region structure metadata", like the
current "extents", vs. "region contents metadata", like CStringChecker's
"string length".

Patch by Richard <tarka.t.otter@googlemail.com>!

llvm-svn: 189492
2013-08-28 17:07:04 +00:00
Pavel Labath fce1b03ee7 [analyzer] Assume new returns non-null even under -fno-exceptions
Summary:
-fno-exceptions does not implicitly attach a nothrow specifier to every operator
new. Even in this mode, non-nothrow new must not return a null pointer. Failure
to allocate memory can be signalled by other means, or just by killing the
program. This behaviour is consistent with the compiler - even with
-fno-exceptions, the generated code never tests for null (and would segfault if
the opeator actually happened to return null).

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1528

llvm-svn: 189452
2013-08-28 08:04:08 +00:00
Robert Wilhelm 25284cc95b Use pop_back_val() instead of both back() and pop_back().
No functionality change intended.

llvm-svn: 189112
2013-08-23 16:11:15 +00:00
Pavel Labath 02b64d46a0 [analyzer] Refactor conditional expression evaluating code
Summary:
Instead of digging through the ExplodedGraph, to figure out which edge brought
us here, I compute the value of conditional expression by looking at the
sub-expression values.

To do this, I needed to change the liveness algorithm a bit -- now, the full
conditional expression also depends on all atomic sub-expressions, not only the
outermost ones.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1340

llvm-svn: 189090
2013-08-23 07:19:22 +00:00
Eli Friedman 5ba37d5282 Split isFromMainFile into two functions.
Basically, isInMainFile considers line markers, and isWrittenInMainFile
doesn't.  Distinguishing between the two is useful when dealing with
files which are preprocessed files or rewritten with -frewrite-includes
(so we don't, for example, print useless warnings).

llvm-svn: 188968
2013-08-22 00:27:10 +00:00
Pavel Labath 71bb987997 [analyzer] Fix inefficiency in dead symbol removal
Summary:
ScanReachableSymbols uses a "visited" set to avoid scanning the same object
twice. However, it did not use the optimization for LazyCompoundVal objects,
which resulted in exponential complexity for long chains of temporary objects.
Adding this resulted in a decrease of analysis time from >3h to 3 seconds for
some files.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1398

llvm-svn: 188677
2013-08-19 15:23:34 +00:00
Benjamin Kramer 91c9867049 Replace some DenseMap keys with simpler structures that don't need another DenseMapInfo specialization.
llvm-svn: 188580
2013-08-16 21:57:06 +00:00
Jordan Rose 367843a04c [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.
This once again restores notes to following their associated warnings
in -analyzer-output=text mode. (This is still only intended for use as a
debugging aid.)

One twist is that the warning locations in "regular" analysis output modes
(plist, multi-file-plist, html, and plist-html) are reported at a different
location on the command line than in the output file, since the command
line has no path context. This commit makes -analyzer-output=text behave
like a normal output format, which means that the *command line output
will be different* in -analyzer-text mode. Again, since -analyzer-text is
a debugging aid and lo-fi stand-in for a regular output mode, this change
makes sense.

Along the way, remove a few pieces of stale code related to the path
diagnostic consumers.

llvm-svn: 188514
2013-08-16 01:06:30 +00:00
Pavel Labath 375e18e32c [analyzer] Enable usage of temporaries in InitListExprs
Summary:
ExprEngine had code which specificaly disabled using CXXTempObjectRegions in
InitListExprs. This was a hack put in r168757 to silence a false positive.

The underlying problem seems to have been fixed in the mean time, as removing
this code doesn't seem to break anything. Therefore I propose to remove it and
solve PR16629 in the process.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1325

llvm-svn: 188059
2013-08-09 07:46:29 +00:00
Jordan Rose 74ef34f2be [analyzer] Clarify that r187624 is a hack and should be fixed better later.
Tracked by <rdar://problem/14648821>.

llvm-svn: 187729
2013-08-05 16:02:02 +00:00
Jordan Rose 5fbe7f9766 [analyzer] Silently drop all reports within synthesized bodies.
Much of our diagnostic machinery is set up to assume that the report
end path location is valid. Moreover, the user may be quite confused
when something goes wrong in our BodyFarm-synthesized function bodies,
which may be simplified or modified from the real implementations.
Rather than try to make this all work somehow, just drop the report so
that we don't try to go on with an invalid source location.

Note that we still handle reports whose /paths/ go through invalid
locations, just not those that are reported in one.

We do have to be careful not to lose warnings because of this.
The impetus for this change was an autorelease being processed within
the synthesized body, and there may be other possible issues that are
worth reporting in some way. We'll take these as they come, however.

<rdar://problem/14611722>

llvm-svn: 187624
2013-08-01 22:16:30 +00:00
Aaron Ballman a5e9c5b865 Using the function pointer instead of the function type; this allows us to re-enable a warning in MSVC by default.
llvm-svn: 187292
2013-07-27 03:34:50 +00:00
Pavel Labath cf878bbe65 [analyzer] Fix FP warnings when binding a temporary to a local static variable
Summary:
When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

llvm-svn: 187196
2013-07-26 11:50:42 +00:00
Jordan Rose a7e7e7a2f6 [analyzer] Remove dead optimization for MaterializeTemporaryExpr.
Previously, we tried to avoid creating new temporary object regions if
the value to be materialized itself came from a temporary object region.
However, once we became more strict about lvalues vs. rvalues (months
ago), this optimization became dead code, because the input to this
function will always be an rvalue (i.e. a symbolic value or compound
value rather than a region, at least for structs).

This would be a nice optimization to keep, but removing it makes it
simpler to reason about temporary regions.

llvm-svn: 187160
2013-07-25 22:32:35 +00:00
Jordan Rose 783b11b5df [analyzer] Weaken assertion to account for pointer-to-integer casts.
PR16690

llvm-svn: 187132
2013-07-25 17:22:02 +00:00
Jordan Rose 316cdda54b [analyzer] Enable pseudo-destructor expressions.
These are cases where a scalar type is "destructed", usually due to
template instantiation (e.g. "obj.~T()", where 'T' is 'int'). This has
no actual effect and the analyzer should just skip over it.

llvm-svn: 186927
2013-07-23 02:15:20 +00:00
Jordan Rose 7b982b30c0 Revert "[analyzer] Add very limited support for temporary destructors"
The analyzer doesn't currently expect CFG blocks with terminators to be
empty, but this can happen when generating conditional destructors for
a complex logical expression, such as (a && (b || Temp{})). Moreover,
the branch conditions for these expressions are not persisted in the
state. Even for handling noreturn destructors this needs more work.

This reverts r186498.

llvm-svn: 186925
2013-07-23 02:15:11 +00:00
Alexey Bataev 5ec3eb11fc OpenMP: basic support for #pragma omp parallel
llvm-svn: 186647
2013-07-19 03:13:43 +00:00
Jordan Rose e9c57229f9 [analyzer] Include analysis stack in crash traces.
Sample output:

0.     Program arguments: ...
1.     <eof> parser at end of file
2.     While analyzing stack:
       #0 void inlined()
       #1 void test()
3.     crash-trace.c:6:3: Error evaluating statement

llvm-svn: 186639
2013-07-19 00:59:08 +00:00
Jordan Rose 5f6c173e7c [analyzer] Handle C++11 member initializer expressions.
Previously, we would simply abort the path when we saw a default member
initialization; now, we actually attempt to evaluate it. Like default
arguments, the contents of these expressions are not actually part of the
current function, so we fall back to constant evaluation.

llvm-svn: 186521
2013-07-17 17:16:42 +00:00
Jordan Rose 5fded08403 [analyzer] Handle C string default values for const char * arguments.
Previously, SValBuilder knew how to evaluate StringLiterals, but couldn't
handle an array-to-pointer decay for constant values. Additionally,
RegionStore was being too strict about loading from an array, refusing to
return a 'char' value from a 'const char' array. Both of these have been
fixed.

llvm-svn: 186520
2013-07-17 17:16:38 +00:00
Jordan Rose 05b2f98d89 [analyzer] Treat std::initializer_list as opaque rather than aborting.
Previously, the use of a std::initializer_list (actually, a
CXXStdInitializerListExpr) would cause the analyzer to give up on the rest
of the path. Now, it just uses an opaque symbolic value for the
initializer_list and continues on.

At some point in the future we can add proper support for initializer_list,
with access to the elements in the InitListExpr.

<rdar://problem/14340207>

llvm-svn: 186519
2013-07-17 17:16:33 +00:00
Pavel Labath 9ced602cc6 [analyzer] Add very limited support for temporary destructors
Summary:
This patch enables ExprEndgine to reason about temporary object destructors.
However, these destructor calls are never inlined, since this feature is still
broken. Still, this is sufficient to properly handle noreturn temporary
destructors and close bug #15599. I have also enabled the cfg-temporary-dtors
analyzer option by default.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1131

llvm-svn: 186498
2013-07-17 08:33:58 +00:00
Craig Topper f59ba9f545 Fix formatting. No functional change.
llvm-svn: 186437
2013-07-16 18:27:27 +00:00
Craig Topper 694ddc73ea Add 'const' qualifiers to static const char* variables.
llvm-svn: 186383
2013-07-16 05:03:10 +00:00
Jordan Rose 6444653a06 [analyzer] Remove bogus assert: in C++11, 'new' can do list-initialization.
Previously, we asserted that whenever 'new' did not include a constructor
call, the type must be a non-record type. In C++11, however, uniform
initialization syntax (braces) allow 'new' to construct records with
list-initialization: "new Point{1, 2}".

Removing this assertion should be perfectly safe; the code here matches
what VisitDeclStmt does for regions allocated on the stack.

<rdar://problem/14403437>

llvm-svn: 186028
2013-07-10 19:14:10 +00:00
Anna Zaks e0ad10404d [analyzer] Fixup for r185609: actually do suppress warnings coming out of std::list.
list is the name of a class, not a namespace. Change the test as well - the previous
version did not test properly.

Fixes radar://14317928.

llvm-svn: 185898
2013-07-09 01:55:00 +00:00
Rafael Espindola 18627115f4 Use llvm::sys::fs::createUniqueFile.
Include a test that clang now produces output files with permissions matching
the umask.

llvm-svn: 185727
2013-07-05 21:13:58 +00:00
Rafael Espindola e4ffbdf349 Fix PR16547.
We should not be asking unique_file to prepend the system temporary directory
when creating the html report. Unfortunately I don't think we can test this
with the current infrastructure since unique_file ignores MakeAbsolute if the
directory is already absolute and the paths provided by lit are.

I will take a quick look at making this api a bit less error prone.

llvm-svn: 185707
2013-07-05 15:05:40 +00:00
Craig Topper 2341c0d3b2 Use SmallVectorImpl instead of SmallVector for iterators and references to avoid specifying the vector size unnecessarily.
llvm-svn: 185610
2013-07-04 03:08:24 +00:00
Anna Zaks a42fb525e4 [analyzer] Suppress reports reported in std::list
The motivation is to suppresses false use-after-free reports that occur when calling
std::list::pop_front() or std::list::pop_back() twice. The analyzer does not
reason about the internal invariants of the list implementation, so just do not report
any of warnings in std::list.

Fixes radar://14317928.

llvm-svn: 185609
2013-07-04 02:38:10 +00:00
Anna Zaks 5673b6567a [analyzer] Make sure that inlined defensive checks work on div by zero.
This suppresses a false positive in std::hash_map.
Fixes  radar://14255587.

llvm-svn: 185608
2013-07-04 02:38:06 +00:00
Jordan Rose 00deddb6d8 [analyzer] Pointers-to-members are (currently) Locs, not NonLocs.
While we don't model pointers-to-members besides "null" and "non-null",
we were using Loc symbols for valid pointers and NonLoc integers for the
null case. This hit the assert committed in r185401.

Fixed by using a true (Loc) null for null member pointers.

llvm-svn: 185444
2013-07-02 16:50:24 +00:00
Pavel Labath 868bebf844 Teach static analyzer about AttributedStmts
Summary:
Static analyzer used to abort when encountering AttributedStmts, because it
asserted that the statements should not appear in the CFG. This is however not
the case, since at least the clang::fallthrough annotation makes it through.

This commit simply makes the analyzer ignore the statement attributes.

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1030

llvm-svn: 185417
2013-07-02 09:38:48 +00:00
Jordan Rose 686df32216 [analyzer] Explicitly disallow mixed Loc-NonLoc comparisons.
The one bit of code that was using this is gone, and neither C nor C++
actually allows this. Add an assertion and remove dead code.

Found by Matthew Dempsky!

llvm-svn: 185401
2013-07-02 01:37:40 +00:00
Jordan Rose b8e286548c [analyzer] Handle zeroing CXXConstructExprs.
Re-apply r184511, reverted in r184561, with the trivial default constructor
fast path removed -- it turned out not to be necessary here.

Certain expressions can cause a constructor invocation to zero-initialize
its object even if the constructor itself does no initialization. The
analyzer now handles that before evaluating the call to the constructor,
using the same "default binding" mechanism that calloc() uses, rather
than simply ignoring the zero-initialization flag.

<rdar://problem/14212563>

llvm-svn: 184815
2013-06-25 01:56:08 +00:00
Jordan Rose b3b976f061 [analyzer] Don't initialize virtual base classes more than once.
In order to make sure virtual base classes are always initialized once,
the AST contains initializers for the base class in /all/ of its
descendents, not just the immediate descendents. However, at runtime,
the most-derived object is responsible for initializing all the virtual
base classes; all the other initializers will be ignored.

The analyzer now checks to see if it's being called from another base
constructor, and if so does not perform virtual base initialization.

<rdar://problem/14236851>

llvm-svn: 184814
2013-06-25 01:55:59 +00:00
Jordan Rose e83cb0922b Revert "[analyzer] Handle zeroing CXXConstructExprs."
Per review from Anna, this really should have been two commits, and besides
it's causing problems on our internal buildbot. Reverting until these have
been worked out.

This reverts r184511 / 98123284826bb4ce422775563ff1a01580ec5766.

llvm-svn: 184561
2013-06-21 16:30:32 +00:00
Jordan Rose 4ace1a74c0 [analyzer] Handle zeroing CXXConstructExprs.
Certain expressions can cause a constructor invocation to zero-initialize
its object even if the constructor itself does no initialization. The
analyzer now handles that before evaluating the call to the constructor,
using the same "default binding" mechanism that calloc() uses, rather
than simply ignoring the zero-initialization flag.

As a bonus, trivial default constructors are now no longer inlined; they
are instead processed explicitly by ExprEngine. This has a (positive)
effect on the generated path edges: they no longer stop at a default
constructor call unless there's a user-provided implementation.

<rdar://problem/14212563>

llvm-svn: 184511
2013-06-21 00:59:00 +00:00
Pavel Labath cb0b876b39 Fix static analyzer crash when casting from an incomplete type
Summary:
When doing a reinterpret+dynamic cast from an incomplete type, the analyzer
would crash (bug #16308). This fix makes the dynamic cast evaluator ignore
incomplete types, as they can never be used in a dynamic_cast. Also adding a
regression test.

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1006

llvm-svn: 184403
2013-06-20 07:45:01 +00:00
Pavel Labath 963f91b3a2 Fix a crash in the static analyzer (bug #16307)
Summary:
When processing a call to a function, which got passed less arguments than it
expects, the analyzer would crash.

I've also added a test for that and a analyzer warning which detects these
cases.

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D994

llvm-svn: 184288
2013-06-19 08:19:56 +00:00
Anna Zaks d60a41d941 [analyzer] Do not create a CompoundVal for lvalue InitListExprs.
These should be treated like scalars. This fixes a crash reported in radar://14164698.

llvm-svn: 184257
2013-06-18 23:16:20 +00:00
Reid Kleckner 2ab0ac5360 [AST] Don't include RecursiveASTVisitor.h in ASTContext.h
The untemplated implementation of getParents() doesn't need to be in a
header file.

RecursiveASTVisitor.h is full of repeated macro expansion.  Moving this
include to ASTContext.cpp speeds up compilation of
LambdaMangleContext.cpp, a small C++ file with few includes, from 3.7s
to 2.8s for me locally.  I haven't measured a full build, but it can't
hurt.

I had to fix a few static analyzer files that were depending on
transitive includes of C++ AST headers.

Reviewers: rsmith, klimek

Differential Revision: http://llvm-reviews.chandlerc.com/D982

llvm-svn: 184075
2013-06-17 12:56:08 +00:00
Richard Smith cc1b96d356 PR12086, PR15117
Introduce CXXStdInitializerListExpr node, representing the implicit
construction of a std::initializer_list<T> object from its underlying array.
The AST representation of such an expression goes from an InitListExpr with a
flag set, to a CXXStdInitializerListExpr containing a MaterializeTemporaryExpr
containing an InitListExpr (possibly wrapped in a CXXBindTemporaryExpr).

This more detailed representation has several advantages, the most important of
which is that the new MaterializeTemporaryExpr allows us to directly model
lifetime extension of the underlying temporary array. Using that, this patch
*drastically* simplifies the IR generation of this construct, provides IR
generation support for nested global initializer_list objects, fixes several
bugs where the destructors for the underlying array would accidentally not get
invoked, and provides constant expression evaluation support for
std::initializer_list objects.

llvm-svn: 183872
2013-06-12 22:31:48 +00:00
Benjamin Kramer fbf914ceb0 Port HTMLDiagnostics to PathV2. No intended functionality change.
llvm-svn: 183849
2013-06-12 18:13:05 +00:00
Rafael Espindola be5138885d Include PathV1.h in files that use it.
This is preparation for replacing Path.h with PathV2.h.

llvm-svn: 183781
2013-06-11 19:59:07 +00:00
Anna Zaks 22895473af [analyzer; alternate edges] Fix the edge locations in presence of macros.
We drew the diagnostic edges to wrong statements in cases the note was on a macro.
The fix is simple, but seems to work just fine for a whole bunch of test cases (plist-macros.cpp).

Also, removes an unnecessary edge in edges-new.mm, when function signature starts with a macro.

llvm-svn: 183599
2013-06-08 00:29:24 +00:00
Anna Zaks de2ae19cf6 [analyzer] Address Jordan’s code review for r183451
llvm-svn: 183455
2013-06-06 22:32:11 +00:00
Anna Zaks b1b95d9409 [analyzer] Ensure that pieces with invalid locations always get removed from the BugReport
The function in which we were doing it used to be conditionalized. Add a new unconditional
cleanup step.

This fixes PR16227 (radar://14073870) - a crash when generating html output for one of the test files.

llvm-svn: 183451
2013-06-06 22:02:58 +00:00
Anna Zaks 496312a364 [analyzer] fixup the comment
llvm-svn: 183450
2013-06-06 22:02:55 +00:00
Jordan Rose cf10ea8cb2 [analyzer; new edges] Simplify edges in a C++11 for-range loop.
Previously our edges were completely broken here; now, the final result
is a very simple set of edges in most cases: one up to the "for" keyword
for context, and one into the body of the loop. This matches the behavior
for ObjC for-in loops.

In the AST, however, CXXForRangeStmts are handled very differently from
ObjCForCollectionStmts. Since they are specified in terms of equivalent
statements in the C++ standard, we actually have implicit AST nodes for
all of the semantic statements. This makes evaluation very easy, but
diagnostic locations a bit trickier. Fortunately, the problem can be
generally defined away by marking all of the implicit statements as
part of the top-level for-range statement.

One of the implicit statements in a for-range statement is the declaration
of implicit iterators __begin and __end. The CFG synthesizes two
separate DeclStmts to match each of these decls, but until now these
synthetic DeclStmts weren't in the function's ParentMap. Now, the CFG
keeps track of its synthetic statements, and the AnalysisDeclContext will
make sure to add them to the ParentMap.

<rdar://problem/14038483>

llvm-svn: 183449
2013-06-06 21:53:45 +00:00
Jordan Rose d2f8a6a993 [analyzer] Improve debug output for PathDiagnosticPieces.
You can now dump a single PathDiagnosticPiece or PathDiagnosticLocation.

llvm-svn: 183367
2013-06-06 01:57:19 +00:00
Anna Zaks 148974d678 [analyzer] Fix a crash that occurs when processing an rvalue array.
When processing ArrayToPointerDecay, we expect the array to be a location, not a LazyCompoundVal.
Special case the rvalue arrays by using a location to represent them. This case is handled similarly
elsewhere in the code.

Fixes PR16206.

llvm-svn: 183359
2013-06-06 00:19:36 +00:00
Jordan Rose 7a8bd94365 [analyzer; new edges] Don't crash if the top-level entry edge is missing.
We previously asserted that there was a top-level function entry edge, but
if the function decl's location is invalid (or within a macro) this edge
might not exist. Change the assertion to an actual check, and don't drop
the first path piece if it doesn't match.

<rdar://problem/14070304>

llvm-svn: 183358
2013-06-06 00:12:41 +00:00
Jordan Rose b67b7b201f [analyzer; new edges] Ignore self-edges, not all edges with the same location.
The edge optimizer needs to see edges for, say, implicit casts (which have
the same source location as their operand) to uniformly simplify the
entire path. However, we still don't want to produce edges from a statement
to /itself/, which could occur when two nodes in a row have the same
statement location.

This necessitated moving the check for redundant notes to after edge
optimization, since the check relies on notes being adjacent in the path.

<rdar://problem/14061675>

llvm-svn: 183357
2013-06-06 00:12:37 +00:00
Jordan Rose 5e2b3a30a0 [analyzer] Enable the new edge algorithm by default.
...but don't yet migrate over the existing plist tests. Some of these
would be trivial to migrate; others could use a bit of inspection first.
In any case, though, the new edge algorithm seems to have proven itself,
and we'd like more coverage (and more usage) of it going forwards.

llvm-svn: 183165
2013-06-03 23:00:19 +00:00
Jordan Rose 7ce598aeee [analyzer; new edges] Omit subexpression back-edges that span multiple lines.
A.1 -> A -> B
becomes
A.1 -> B

This only applies if there's an edge from a subexpression to its parent
expression, and that is immediately followed by another edge from the
parent expression to a subsequent expression. Normally this is useful for
bringing the edges back to the left side of the code, but when the
subexpression is on a different line the backedge ends up looking strange,
and may even obscure code. In these cases, it's better to just continue
to the next top-level statement.

llvm-svn: 183164
2013-06-03 23:00:09 +00:00
Jordan Rose 5f16849b34 [analyzer; new edges] Don't eliminate subexpr edge cycles if the line is long.
Specifically, if the line is over 80 characters, or if the top-level
statement spans mulitple lines, we should preserve sub-expression edges
even if they form a simple cycle as described in the last commit, because
it's harder to infer what's going on than it is for shorter lines.

llvm-svn: 183163
2013-06-03 23:00:05 +00:00
Jordan Rose 8c54b44fb3 [analyzer; new edges] Eliminate "cycle edges" for a single subexpression.
Generating context arrows can result in quite a few arrows surrounding a
relatively simple expression, often containing only a single path note.

|
1 +--2---+
v/       v
auto m = new m // 3 (the path note)
|\       |
5 +--4---+
v

Note also that 5 and 1 are two ends of the "same" arrow, i.e. they go from
event to event. 3 is not an arrow but the path note itself.

Now, if we see a pair of edges like 2 and 4---where 4 is the reverse of 2
and there is optionally a single path note between them---we will
eliminate /both/ edges. Anything more complicated will be left as is
(more edges involved, an inlined call, etc).

The next commit will refine this to preserve the arrows in a larger
expression, so that we don't lose all context.

llvm-svn: 183162
2013-06-03 23:00:00 +00:00
Jordan Rose 06e800727e [analyzer; new edges] Improve enclosing contexts for logical expressions.
The old edge builder didn't have a notion of nested statement contexts,
so there was no special treatment of a logical operator inside an if
(or inside another logical operator). The new edge builder always tries
to establish the full context up to the top-level statement, so it's
important to know how much context has been established already rather
than just checking the innermost context.

This restores some of the old behavior for the old edge generation:
the context of a logical operator's non-controlling expression is the
subexpression in the old edge algorithm, but the entire operator
expression in the new algorithm.

llvm-svn: 183160
2013-06-03 22:59:53 +00:00
Jordan Rose b1db073dac [analyzer; new edges] Include context for edges to sub-expressions.
The current edge-generation algorithm sometimes creates edges from a
top-level statement A to a sub-expression B.1 that's not at the start of B.
This creates a "swoosh" effect where the arrow is drawn on top of the
text at the start of B. In these cases, the results are clearer if we see
an edge from A to B, then another one from B to B.1.

Admittedly, this does create a /lot/ of arrows, some of which merely hop
into a subexpression and then out again for a single note. The next commit
will eliminate these if the subexpression is simple enough.

This updates and reuses some of the infrastructure from the old edge-
generation algorithm to find the "enclosing statement" context for a
given expression. One change in particular marks the context of the
LHS or RHS of a logical binary operator (&&, ||) as the entire operator
expression, rather than the subexpression itself. This matches our behavior
for ?:, and allows us to handle nested context information.

<rdar://problem/13902816>

llvm-svn: 183159
2013-06-03 22:59:48 +00:00
Jordan Rose c892bb04ca [analyzer; new edges] Include a top-level function entry edge while optimizing.
Although we don't want to show a function entry edge for a top-level path,
having it makes optimizing edges a little more uniform.

This does not affect any edges now, but will affect context edge generation
(next commit).

llvm-svn: 183158
2013-06-03 22:59:45 +00:00
Ted Kremenek 7c6b4084dd [analyzer; new edges] add simplifySimpleBranches() to reduce edges for branches.
In many cases, the edge from the "if" to the condition, followed by an edge from the branch condition to the target code, is uninteresting.

In such cases, we should fold the two edges into one from the "if" to the target.

This also applies to loops.

Implements <rdar://problem/14034763>.

llvm-svn: 183018
2013-05-31 16:56:54 +00:00
Ted Kremenek 263595f4f3 [analyzer; new edges] in splitBranchConditionEdges() do not check that predecessor edge has source in the same lexical scope as the target branch.
Fixes <rdar://problem/14031292>.

llvm-svn: 182987
2013-05-31 06:11:17 +00:00
Ted Kremenek d59fbca225 [analyzer;alternate arrows] Rename 'adjustBranchEdges' to 'splitBranchConditionEdges'.
llvm-svn: 182986
2013-05-31 06:11:11 +00:00
Jordan Rose ca0ecb61e1 Revert "[analyzer; alternate edges] don't add an edge incoming from the start of a function"
...and make this work correctly in the current codebase.

After living on this for a while, it turns out to look very strange for
inlined functions that have only a single statement, and somewhat strange
for inlined functions in general (since they are still conceptually in the
middle of the path, and there is a function-entry path note).

It's worth noting that this only affects inlined functions; in the new
arrow generation algorithm, the top-level function still starts at the
first real statement in the function body, not the enclosing CompoundStmt.

This reverts r182078 / dbfa950abe0e55b173286a306ee620eff5f72ea.

llvm-svn: 182963
2013-05-30 21:30:17 +00:00
Jordan Rose 278d9de314 [analyzer] Don't crash if a block's signature just has the return type.
It is okay to declare a block without an argument list: ^ {} or ^void {}.
In these cases, the BlockDecl's signature-as-written will just contain
the return type, rather than the entire function type. It is unclear if
this is intentional, but the analyzer shouldn't crash because of it.

<rdar://problem/14018351>

llvm-svn: 182948
2013-05-30 18:14:27 +00:00
Jordan Rose 543bdd1237 [analyzer; new edges] In for(;;), use the ForStmt itself for loop notes.
Most loop notes (like "entering loop body") are attached to the condition
expression guarding a loop or its equivalent. For loops may not have a
condition expression, though. Rather than crashing, just use the entire
ForStmt as the location. This is probably the best we can do.

<rdar://problem/14016063>

llvm-svn: 182904
2013-05-30 01:05:58 +00:00
Jordan Rose 1bd1927a14 [analyzer] Accept references to variables declared "extern void" (C only).
In C, 'void' is treated like any other incomplete type, and though it is
never completed, you can cast the address of a void-typed variable to do
something useful. (In C++ it's illegal to declare a variable with void type.)

Previously we asserted on this code; now we just treat it like any other
incomplete type.

And speaking of incomplete types, we don't know their extent. Actually
check that in TypedValueRegion::getExtent, though that's not being used
by any checkers that are on by default.

llvm-svn: 182880
2013-05-29 20:50:34 +00:00
Anna Zaks 5416ab0156 [analyzer] Use the expression’s type instead of region’s type in ArrayToPointer decay evaluation
This gives slightly better precision, specifically, in cases where a non-typed region represents the array
or when the type is a non-array type, which can happen when an array is a result of a reinterpret_cast.

llvm-svn: 182810
2013-05-28 23:24:01 +00:00