Commit Graph

16 Commits

Author SHA1 Message Date
Richard Trieu f7432755d0 Add -Wtautological-undefined-compare and -Wundefined-bool-conversion warnings
to detect underfined behavior involving pointers.

llvm-svn: 210372
2014-06-06 21:39:26 +00:00
Pavel Labath cf878bbe65 [analyzer] Fix FP warnings when binding a temporary to a local static variable
Summary:
When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

llvm-svn: 187196
2013-07-26 11:50:42 +00:00
Jordan Rose dc16628c93 Re-apply "[analyzer] Model casts to bool differently from other numbers."
This doesn't appear to be the cause of the slowdown. I'll have to try a
manual bisect to see if there's really anything there, or if it's just
the bot itself taking on additional load. Meanwhile, this change helps
with correctness.

This changes an assertion and adds a test case, then re-applies r180638,
which was reverted in r180714.

<rdar://problem/13296133> and PR15863

llvm-svn: 180864
2013-05-01 18:19:59 +00:00
Jordan Rose 49f888bbab Revert "[analyzer] Model casts to bool differently from other numbers."
This seems to be causing quite a slowdown on our internal analyzer bot,
and I'm not sure why. Needs further investigation.

This reverts r180638 / 9e161ea981f22ae017b6af09d660bfc3ddf16a09.

llvm-svn: 180714
2013-04-29 17:23:03 +00:00
Jordan Rose 9661c1d18a [analyzer] Model casts to bool differently from other numbers.
Casts to bool (and _Bool) are equivalent to checks against zero,
not truncations to 1 bit or 8 bits.

This improved reasoning does cause a change in the behavior of the alpha
BoolAssignment checker. Previously, this checker complained about statements
like "bool x = y" if 'y' was known not to be 0 or 1. Now it does not, since
that conversion is well-defined. It's hard to say what the "best" behavior
here is: this conversion is safe, but might be better written as an explicit
comparison against zero.

More usefully, besides improving our model of booleans, this fixes spurious
warnings when returning the address of a local variable cast to bool.

<rdar://problem/13296133>

llvm-svn: 180638
2013-04-26 21:42:55 +00:00
Jordan Rose 5772f82d1e [analyzer] Make sure a materialized temporary matches its bindings.
This is a follow-up to r175830, which made sure a temporary object region
created for, say, a struct rvalue matched up with the initial bindings
being stored into it. This does the same for the case in which the AST
actually tells us that we need to create a temporary via a
MaterializeObjectExpr. I've unified the two code paths and moved a static
helper function onto ExprEngine.

This also caused a bit of test churn, causing us to go back to describing
temporary regions without a 'const' qualifier. This seems acceptable; it's
our behavior from a few months ago.

<rdar://problem/13265460> (part 2)

llvm-svn: 175854
2013-02-22 01:51:15 +00:00
Ted Kremenek a3bb2b6044 Fix regression in modeling assignments of an address of a variable to itself. Fixes <rdar://problem/13226577>.
llvm-svn: 175852
2013-02-22 01:39:26 +00:00
Hans Wennborg d799a2b3b9 Better wording for reference self-initialization warning.
llvm-svn: 162198
2012-08-20 08:52:22 +00:00
Hans Wennborg e1fdb059c6 Warn about self-initialization of references.
Initializing a reference with itself, e.g. "int &a = a;" seems like a
very bad idea.

llvm-svn: 162093
2012-08-17 10:12:33 +00:00
Argyrios Kyrtzidis b4015e1877 When going through references to check if the function returns the address
of a local variable, make sure we don't infinitely recurse when the
reference binds to itself.

e.g:

int* func() {
    int& i = i;    // assign non-exist variable to a reference which has same name.
    return &i;    // return pointer
}

rdar://11345441

llvm-svn: 155856
2012-04-30 23:23:55 +00:00
Ted Kremenek 2a14c695eb Fix LiveVariables analysis bug with MaterializeTemporaryExpr and fix handling in ExprEngine. Fixes <rdar://problem/10201666>.
llvm-svn: 140956
2011-10-02 00:54:48 +00:00
Jeffrey Yasskin 0e9cdbbb06 Handle CXXTempObjectRegion in StackAddrEscapeChecker.
Also convert stack-addr-ps.cpp to use the analyzer instead of just Sema, now
that it doesn't crash, and extract the stack-block test into another file since
it errors, and that prevents the analyzer from running.

llvm-svn: 138613
2011-08-26 00:41:31 +00:00
Argyrios Kyrtzidis e72f7154f1 Follow through references to catch returned stack addresses, local blocks, label addresses or references to temporaries, e.g:
const int& g2() {
  int s1;
  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
  return s2; // expected-warning {{reference to stack memory associated with local variable 's1' returned}}
}

llvm-svn: 120483
2010-11-30 22:57:32 +00:00
Argyrios Kyrtzidis 091d97c709 Revert r120331 since it causes spurious warnings and a possible assertion hit when self-host.
llvm-svn: 120351
2010-11-29 23:42:03 +00:00
Argyrios Kyrtzidis 569cad9734 Emit warnings if we are returning a reference to a local temporary.
The issue was brought to our attention by Matthieu Monrocq.

llvm-svn: 120331
2010-11-29 22:32:08 +00:00
Ted Kremenek b786156b01 Teach SemaChecking::CheckReturnStackAddr about ImplicitCastExprs that convert values to an lvalue. This allows us to warn (again) about returning references to stack variables. (fixes PR 7812).
llvm-svn: 110242
2010-08-04 20:01:07 +00:00