Commit Graph

71 Commits

Author SHA1 Message Date
Ted Kremenek 988805c81e Change LLVMConventionsChecker to accept an entire translation unit instead
of operating on each code decl.  This exposes two flaws in AnalysisConsumer
that should eventually be fixed:

(1) It is not possible to associate multiple "actions" with a single
    command line argument.  This will require the notion of an
	"analysis" group, and possibly tablegen support.  (although eventually
    we want to support dynamically loading analyses as well)

(2) AnalysisConsumer may not actually be scanning the declarations in namespaces.
    We'll experiment first in LLVMConventionsChecker before changing the
    behavior in AnalysisConsumer.

llvm-svn: 96183
2010-02-14 19:09:05 +00:00
Ted Kremenek 39df94b00d Rework translation unit actions to actually take an entire translation unit
as imput.

llvm-svn: 96182
2010-02-14 19:08:51 +00:00
Ted Kremenek 184b3383bf Add new static analyzer for checking LLVM coding conventions: -analyzer-check-llvm-conventions
Currently these checks are intended to be largely syntactical, but may get more
sophisticated over time.

As an initial foray into this brave new world, emit a static analyzer warning
when binding a temporary 'std::string' to an 'llvm::StringRef' where the
lifetime of the 'std::string' does not outlive the 'llvm::StringRef'.

llvm-svn: 96147
2010-02-14 02:45:18 +00:00
Ted Kremenek eff72bb134 Two changes to AnalysisConsumer::HandleTopLevelSingleDecl():
(1) Since CXXMethodDecl subclasses FunctionDecl (and CXXDestructorDecl 
and CXXConversion subclass CXXMethodDecl), refactor switch statement 
to handle them all in one spot.

(2) Use 'DeclarationName::getAsString()' to handle all functions that
don't have simple identifiers (fixing a null dereference when scanning
for specific functions).

llvm-svn: 96146
2010-02-14 02:44:52 +00:00
Ted Kremenek 2f2692f8ca Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.
llvm-svn: 95348
2010-02-05 02:06:54 +00:00
Ted Kremenek 6296e0990b Move 'LocalCheckers.h' to the 'Checkers' subdirectory.
llvm-svn: 94609
2010-01-26 22:59:55 +00:00
Ted Kremenek fe0fc40c3b Move BugReporter.h, PathDiagnostic.h, and BugType.h to 'include/Checker/BugReporter'
llvm-svn: 94428
2010-01-25 17:10:22 +00:00
Ted Kremenek d6b8708643 Split libAnalysis into two libraries: libAnalysis and libChecker.
(1) libAnalysis is a generic analysis library that can be used by
    Sema.  It defines the CFG, basic dataflow analysis primitives, and
    inexpensive flow-sensitive analyses (e.g. LiveVariables).

(2) libChecker contains the guts of the static analyzer, incuding the
    path-sensitive analysis engine and domain-specific checks.

Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.

This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker.  More changes pending.  :)

This change also exposed a layering violation between AnalysisContext
and MemRegion.  BlockInvocationContext shouldn't explicitly know about
BlockDataRegions.  For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet).  We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.

llvm-svn: 94406
2010-01-25 04:41:41 +00:00
Mike Stump 06c1d87d14 Also handle CXXConstructor, CXXDestructor and CXXConversion in CFG
printing.

llvm-svn: 93968
2010-01-20 02:28:05 +00:00
Mike Stump 281d6d7745 Use the llvm coding convention for indentation for switch.
llvm-svn: 93966
2010-01-20 02:03:14 +00:00
Ted Kremenek de8e7447b6 Remove references to 'Checker' and 'GRTransferFuncs' from
GRStateManager.  Having these references was an abstraction violation,
as they really should only be known about GRExprEngine.

This change required adding a new 'ProcessAssume' callback in
GRSubEngine.  GRExprEngine implements this callback by calling
'EvalAssume' on all registered Checker objects as well as the
registered GRTransferFunc object.

llvm-svn: 92549
2010-01-05 00:15:18 +00:00
Zhongxing Xu b0e15df36b Let constraint manager inform checkers that some assumption logic has happend.
Add new states for symbolic regions tracked by malloc checker. This enables us
to do malloc checking more accurately. See test case.

Based on Lei Zhang's patch and discussion.

llvm-svn: 92342
2009-12-31 06:13:07 +00:00
Zhongxing Xu 4629e92e78 Remove an duplicated #include.
llvm-svn: 92306
2009-12-30 06:48:20 +00:00
Zhongxing Xu d803cc51af Register call inliner as the last checker.
llvm-svn: 91992
2009-12-23 09:15:19 +00:00
Zhongxing Xu 2923046ec4 Migrate the call inliner to the Checker interface.
llvm-svn: 91991
2009-12-23 08:56:18 +00:00
Zhongxing Xu 686b8458f4 Expose C++ methods to GRExprEngine.
llvm-svn: 91506
2009-12-16 05:29:59 +00:00
Zhongxing Xu 765f3e4f35 Add comments.
llvm-svn: 91430
2009-12-15 09:32:42 +00:00
Zhongxing Xu 950978a44b Remove displayProgress parameter.
llvm-svn: 91429
2009-12-15 09:09:49 +00:00
Ted Kremenek 752ecd8818 We should only scan for nested blocks if we are analyzing the body of a function/method.
llvm-svn: 91196
2009-12-12 01:04:14 +00:00
Ted Kremenek 06ba78d07d Fix crash in DisplayFunction(). ObjCInterfaceDecls can also get passed to this function, but we don't want to display them.
llvm-svn: 90944
2009-12-09 03:45:19 +00:00
Ted Kremenek 6818991d71 Add clang-cc option '-analyzer-opt-analyze-nested-blocks' to treat block literals as an entry point for analyzer checks.
llvm-svn: 90810
2009-12-07 22:06:12 +00:00
Benjamin Kramer 16634c2c5a Remove VISIBILITY_HIDDEN from anonymous namespaces in libFrontend.
llvm-svn: 90033
2009-11-28 10:07:24 +00:00
Ted Kremenek de820039b6 Call GRExprEngine::setTransferFunctions() after registering all Checkers. This allows GRTransferFuncs::RegisterChecks() to always be called after all checkers have been registered.
llvm-svn: 89887
2009-11-25 21:58:39 +00:00
Ted Kremenek 916061f613 Consolidate logic in ActionInlineCall by having it call ActionGRExprEngine instead of replicating most of its logic (and missing pieces).
llvm-svn: 89886
2009-11-25 21:55:23 +00:00
Ted Kremenek d0fe8047dd Make RegisterInternalChecks() part of GRExprEngine's private implementation by making it a static function within GRExprEngine.cpp.
llvm-svn: 89884
2009-11-25 21:51:20 +00:00
Ted Kremenek efb5003f95 Register internal checks with GRExprEngine when it is constructed, not manually in AnalysisConsumer.cpp.
llvm-svn: 89883
2009-11-25 21:45:48 +00:00
Douglas Gregor 120f6a6675 Silence some warnings produced by Clang, and add a missing header
llvm-svn: 89051
2009-11-17 06:14:37 +00:00
Ted Kremenek 4ef13f8ac9 Add clang-cc option "--analyzer-experimental-internal-checks". This
option enables new "internal" checks that will eventually be turned on
by default but still require broader testing.

llvm-svn: 88671
2009-11-13 18:46:29 +00:00
Ted Kremenek aedb7434c8 Add clang-cc option "-analyzer-experimental-checks" to enable experimental path-sensitive checks. The idea is to separate "barely working" or "skunkworks" checks from ones that should always run. Later we need more fine-grain checker control.
llvm-svn: 87053
2009-11-13 01:15:47 +00:00
Chandler Carruth 5375309250 Move the ManagerRegistry to the Analysis library to resolve the layering violation.
llvm-svn: 86863
2009-11-11 19:10:59 +00:00
Ted Kremenek 55d59bf785 Fix display of "ANALYZE" statements in AnalysisConsumer by correctly resetting the flag indicating that the current Decl* has not yet been displayed. Also move this out of AnalysisManager, since AnalysisManager should not handle text output to the user.
llvm-svn: 86812
2009-11-11 06:28:42 +00:00
Zhongxing Xu b0a05f7ca1 Add a checker for CWE-467: Use of sizeof() on a Pointer Type.
llvm-svn: 86464
2009-11-08 13:10:34 +00:00
Daniel Dunbar b5f2025b77 Convert CreateAnalysisConsumer and friends to just take a const Preprocessor&, and simplify.
llvm-svn: 86112
2009-11-05 02:41:58 +00:00
Ted Kremenek 5e86044ec4 Acting on Daniel's nagging, remove PathDiagnosticClientFactory() and
migrate work in the destructors of PathDiagnosticClients from their
destructors to FlushReports().  The destructors now currently call
FlushReports(); this will be fixed in a subsequent patch.

llvm-svn: 86108
2009-11-05 02:09:23 +00:00
Daniel Dunbar d0ba0e6108 Kill PreprocessorFactory, which was both morally repugnant and totally unused.
llvm-svn: 86076
2009-11-04 23:56:25 +00:00
Daniel Dunbar 1e6add1fbb Remove unused header.
llvm-svn: 85828
2009-11-02 22:11:26 +00:00
Ted Kremenek d45ff6cced Add destructor and cleanup code to LocationContext (fixing some leaks). Along the way, have
AnalysisManager periodically cleanup its AnalysisContextManager and LocationContextManager objects,
as they don't need to forever retain all the CFGs ever created when analyzing a file.

llvm-svn: 84684
2009-10-20 21:39:41 +00:00
Daniel Dunbar 07d0785dbb PR5218: Replace IdentifierInfo::getName with StringRef version, now that clients
are updated.

llvm-svn: 84447
2009-10-18 21:17:35 +00:00
Ted Kremenek 9a4e5663d2 Hoist some branches in AnalysisManager::HandleTranslationUnit so we
avoid scanning for an "entry point" FunctionDecl if we (a) have no
translation unit actions and (b) no entry point function has been
specified.

llvm-svn: 82846
2009-09-26 04:15:09 +00:00
Ted Kremenek 1e7f988f5e Fix regression introduced by r82198 that caused functions/methods with invalid CFGs to get analyzed.
llvm-svn: 82297
2009-09-18 22:29:35 +00:00
Ted Kremenek 82f7f9c080 Introduce caching of diagnostics in BugReporter. This provides extra
pruning of diagnostics that may be emitted multiple times.  This is
accomplished by adding FoldingSet profiling support to PathDiagnostic,
and then having BugReporter record what diagnostics have been issued.

This was motived to a serious bug introduced by moving the
'divide-by-zero' checking outside of GRExprEngine into a separate
'Checker' class.  When analyzing code using the '-fobjc-gc' option, a
given function would be analyzed twice, but the second time various
"internal checks" would be disabled to avoid emitting multiple
diagnostics (e.g., "null dereference") for the same issue.  The
problem is that such checks also effect path pruning and don't just
emit diagnostics.  This resulted in an assertion failure involving a
real divide-by-zero in some analyzed code where we would get an
assertion failure in APInt because the 'DivZero' check was disabled
and didn't prune the logic that resulted in the divide-by-zero in the
analyzer.

The implemented solution is somewhat of a hack, and may not perform
extremely well.  This will need to be cleaned up over time.

As a regression test, 'misc-ps.m' has been modified so that its tests
are run using -fobjc-gc to test this diagnostic pruning behavior.

llvm-svn: 82198
2009-09-18 05:37:41 +00:00
Zhongxing Xu dc299bc481 Start to add a new transfer function that inlines callee. To be continued.
llvm-svn: 81501
2009-09-11 04:13:42 +00:00
Zhongxing Xu 7e3431b5cf Make AnalysisManager stateless. Now other analyzer components only depends on
local node information.

llvm-svn: 81433
2009-09-10 05:44:00 +00:00
Mike Stump 11289f4280 Remove tabs, and whitespace cleanups.
llvm-svn: 81346
2009-09-09 15:08:12 +00:00
Dan Gohman a98e0e73de Update clang for raw_fd_ostream no longer requiring F_Force.
llvm-svn: 79991
2009-08-25 15:36:09 +00:00
Zhongxing Xu 342950efc5 Remove CodeDecl and CFG from GRExprEngine and GRStateManager.
Now AnalysisManager is the only place we can get CodeDecl.
This leads to an API change: GRState::bindExpr() now takes the CFG argument.

llvm-svn: 79980
2009-08-25 06:51:30 +00:00
Chris Lattner 3441b4f77e API changes to match llvm ToT.
llvm-svn: 79868
2009-08-23 22:45:33 +00:00
Benjamin Kramer 89b422c118 Replace cerr with errs().
llvm-svn: 79854
2009-08-23 12:08:50 +00:00
Chris Lattner 84cffc22d4 adjust for raw_fd_ostream api change.
llvm-svn: 79809
2009-08-23 02:59:41 +00:00
Zhongxing Xu 6be1a4e832 Tie the local check NSErrorCheck to a Decl to pave the way
to untie the ExplodedGraph from a specific Decl.

llvm-svn: 79588
2009-08-21 02:18:44 +00:00