Commit Graph

43 Commits

Author SHA1 Message Date
David Blaikie 2d7c57ec1d Remove the ref/value inconsistency in filter_decl_iterator.
filter_decl_iterator had a weird mismatch where both op* and op-> returned T*
making it difficult to generalize this filtering behavior into a reusable
library of any kind.

This change errs on the side of value, making op-> return T* and op* return
T&.

(reviewed by Richard Smith)

llvm-svn: 155808
2012-04-30 02:36:29 +00:00
Ted Kremenek 468365b6be [analyzer] check lazy bindings in RegionStore first before looking for default values. Fixes <rdar://problem/11269741>.
llvm-svn: 155615
2012-04-26 05:08:26 +00:00
Anna Zaks 02ecae9282 [analyzer] dynamic_cast: Better model cast from a reference.
Generate a sink when the dynamic_cast from a reference fails to
represent a thrown exception.

llvm-svn: 154438
2012-04-10 21:29:03 +00:00
Anna Zaks 3bc6809ecb [analyzer] Add support for C++ dynamic_cast.
Simulate the C++ dynamic_cast in the analyzer.

llvm-svn: 154434
2012-04-10 20:59:00 +00:00
Ted Kremenek b75f4e5e9b Fix another false positive in RegionStore involving doing loads from symbolic offsets. We still don't
properly reason about such accesses, but we shouldn't emit bogus "uninitialized value" warnings
either.  Fixes <rdar://problem/11127008>.

llvm-svn: 153913
2012-04-03 00:03:34 +00:00
Ted Kremenek d519cae8aa Have conjured symbols depend on LocationContext, to add context sensitivity for functions called more than once.
llvm-svn: 150849
2012-02-17 23:13:45 +00:00
Dylan Noblesmith e27789991d Basic: import OwningPtr<> into clang namespace
llvm-svn: 149798
2012-02-05 02:12:40 +00:00
Ted Kremenek 49b1e38e4b Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.
At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

llvm-svn: 149081
2012-01-26 21:29:00 +00:00
David Blaikie ca043229c7 Refactor variables unused under non-assert builds.
llvm-svn: 148229
2012-01-16 05:16:03 +00:00
Anna Zaks 6228130099 [analyzer] RegionStoreManager::getBinding() should not crash when
looking up value at a CodeTextRegion even when the type is not provided.

llvm-svn: 148079
2012-01-13 00:56:48 +00:00
Ted Kremenek 3d3aea9374 [analyzer] fix inlining's handling of mapping actual to formal arguments and limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths.
llvm-svn: 148036
2012-01-12 19:25:46 +00:00
Anna Zaks 95f332112f [analyzer] Rename Store::Retrieve() -> getBinding().
+ all the other Retrieve..() methods + a comment for ElementRegion.

llvm-svn: 148011
2012-01-12 02:22:40 +00:00
Ted Kremenek 632e3b7ee2 [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining.  Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back.  There are also potential performance implications
of enlarging the Environment.  Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment.  This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

llvm-svn: 147688
2012-01-06 22:09:28 +00:00
Anna Zaks 8158ef0dec [analyzer] Be less pessimistic about invalidation of global variables
as a result of a call.

Problem:
Global variables, which come in from system libraries should not be
invalidated by all calls. Also, non-system globals should not be
invalidated by system calls.

Solution:
The following solution to invalidation of globals seems flexible enough
for taint (does not invalidate stdin) and should not lead to too
many false positives. We split globals into 3 classes:

* immutable - values are preserved by calls (unless the specific
global is passed in as a parameter):
     A :  Most system globals and const scalars

* invalidated by functions defined in system headers:
     B: errno

* invalidated by all other functions (note, these functions may in
turn contain system calls):
     B: errno
     C: all other globals (which are not in A nor B)

llvm-svn: 147569
2012-01-04 23:54:01 +00:00
Anna Zaks ee1a43533b [analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use it
for finding dependent symbols for taint.

llvm-svn: 145986
2011-12-06 23:12:33 +00:00
Anna Zaks c25efccc8b [analyzer] Propagate taint through NonLoc to NonLoc casts.
- Created a new SymExpr type - SymbolCast.
 - SymbolCast is created when we don't know how to simplify a NonLoc to
NonLoc casts.
 - A bit of code refactoring: introduced dispatchCast to have better
code reuse, remove a goto.
 - Updated the test case to showcase the new taint flow.

llvm-svn: 145985
2011-12-06 23:12:27 +00:00
Ted Kremenek cfe4ff9725 Relax RegionStore to allow loads from CodeTextRegions. Apparently you can actually write code that does this. This seems worthy of a checker, but the StoreManager should handle the memory abstraction without crashing. Fixes PR 11450.
llvm-svn: 145424
2011-11-29 19:39:29 +00:00
Jim Goodnow II 8d21fc8239 Fixed crash with initializer lists and unnamed bitfields in the RegionStore
Manager. Added test to ensure proper binding of initialized values.
This patch fixes PR11249.

llvm-svn: 144831
2011-11-16 20:29:27 +00:00
Ted Kremenek 731607fab2 [analyzer;Regionstore] handle loads from StringLiteral elements for StringLiterals representing wide strings. Fixes PR 11294.
llvm-svn: 144563
2011-11-14 20:05:54 +00:00
John McCall f937c023bf Rename TagDecl::isDefinition -> isCompleteDefinition
for better self-documenting code, since the semantics
are subtly different from getDefinition().

llvm-svn: 141355
2011-10-07 06:10:15 +00:00
David Blaikie aa347f9392 Removing a bunch of dead returns/breaks after llvm_unreachables.
llvm-svn: 140407
2011-09-23 20:26:49 +00:00
David Blaikie 83d382b1ca Switch assert(0/false) llvm_unreachable.
llvm-svn: 140367
2011-09-23 05:06:16 +00:00
Jordy Rose 1fad663126 [analyzer] Change the check::RegionChanges callback to include the regions explicitly requested for invalidation.
Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well.

Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming).

llvm-svn: 138716
2011-08-27 22:51:26 +00:00
Ted Kremenek 001fd5b498 Rename GRState to ProgramState, and cleanup some code formatting along the way.
llvm-svn: 137665
2011-08-15 22:09:50 +00:00
Ted Kremenek 5ef32dbf2a Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.
llvm-svn: 137537
2011-08-12 23:37:29 +00:00
Ted Kremenek 8df44b2632 [analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can separate TypedRegions that implement getValueType() from those that don't.
Patch by Olaf Krzikalla!

llvm-svn: 137498
2011-08-12 20:02:48 +00:00
Ted Kremenek c91ca30b4c [analyzer] Change SymbolReaper to store region roots implied by the Environment, allowing it be queried when
determining if symbols derived from regions are still live.

llvm-svn: 137005
2011-08-06 00:29:57 +00:00
Ted Kremenek ae16d1cc67 [analyzer] Add StoreManager::includedInBindings() to to query whether a region is used in any bindings.
llvm-svn: 136416
2011-07-28 23:07:46 +00:00
Ted Kremenek 6b1a761f3e [analyzer] Add safety checking in RegionStoreManager for string literal underruns.
llvm-svn: 136415
2011-07-28 23:07:43 +00:00
Chris Lattner 0e62c1cc0b remove unneeded llvm:: namespace qualifiers on some core types now that LLVM.h imports
them into the clang namespace.

llvm-svn: 135852
2011-07-23 10:55:15 +00:00
Jordy Rose 4d3c1511ac [analyzer] Use UnknownVal when default-initializing arrays whose element types we don't model, to distinguish them from uninitialized arrays (PR10163).
llvm-svn: 133937
2011-06-27 20:36:38 +00:00
Ted Kremenek f377cb82f9 Teach RegionStore not to symbolic array values whose indices it cannot reason about.
llvm-svn: 131702
2011-05-19 23:37:58 +00:00
Ted Kremenek aa181174e7 Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.
llvm-svn: 130711
2011-05-02 19:42:42 +00:00
Ted Kremenek 4f939da02d RegionStoreManager::invalidateRegions: treat classes the same as structs.
llvm-svn: 129333
2011-04-12 00:44:31 +00:00
Ted Kremenek 850d35be16 Fix RegionStore bug when doing a field load whose parent is also a field assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522.
llvm-svn: 128783
2011-04-03 04:09:15 +00:00
Ted Kremenek 3e5ad5932e Tweak RegionStore's handling of lazy compound values to use the 'Default' versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without
invalidating the entire binding.  Fixes PR 9455.

llvm-svn: 127796
2011-03-17 03:51:51 +00:00
Ted Kremenek 4bb6c6b37e static analyzer: Fix use-after-free bug in RegionStore involving LazyCompoundValueData not reference counting Store objects.
llvm-svn: 127288
2011-03-08 23:18:00 +00:00
Ted Kremenek fda3687515 Add 'StoreRef' smart pointer to allow more fine-grain memory lifetime control of Store objects.
This yields a minor memory reduction (for larger functions) on Sqlite at the cost of slightly
higher memory usage on some functions because of the increased size of GRState (which can be optimized).

I expect the real memory savings from this enhancement will come when we aggressively
canabilize more of the ExplodedGraph.

llvm-svn: 126012
2011-02-19 01:59:33 +00:00
Zhanyong Wan 85a203ebdd Makes most methods in SVals.h conform to the naming guide. Reviewed
by kremenek.

llvm-svn: 125687
2011-02-16 21:13:32 +00:00
Ted Kremenek 7b3f290d61 Remove RegionStoreManager::evalBinOp(), which is now handled by the SValBuilder.
llvm-svn: 125396
2011-02-11 19:48:19 +00:00
Ted Kremenek eddeba0dae Rename 'InvalidateRegions()' to 'invalidateRegions()'.
llvm-svn: 125395
2011-02-11 19:48:15 +00:00
Ted Kremenek f8cbac4b91 Split 'include/clang/StaticAnalyzer' into 'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'.
This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries.

llvm-svn: 125251
2011-02-10 01:03:03 +00:00
Argyrios Kyrtzidis fa0734ec4f [analyzer] Move the files in lib/StaticAnalyzer to lib/StaticAnalyzer/Core.
Eventually there will also be a lib/StaticAnalyzer/Frontend that will handle initialization and checker registration.
Yet another library to avoid cyclic dependencies between Core and Checkers.

llvm-svn: 125124
2011-02-08 22:30:36 +00:00