Commit Graph

3441 Commits

Author SHA1 Message Date
Artem Dergachev fcf107d411 [analyzer] Teach CallEvent about C++17 aligned operator new().
In C++17, when class C has large alignment value, a special case of
overload resolution rule kicks in for expression new C that causes the aligned
version of operator new() to be called. The aligned new has two arguments:
size and alignment. However, the new-expression has only one "argument":
the construct-expression for C(). This causes a false positive in
core.CallAndMessage's check for matching number of arguments and number
of parameters.

Update CXXAllocatorCall, which is a CallEvent sub-class for operator new calls
within new-expressions, so that the number of arguments always matched
the number of parameters.

rdar://problem/44738501

Differential Revision: https://reviews.llvm.org/D52957

llvm-svn: 344539
2018-10-15 17:53:18 +00:00
Artem Dergachev 65b4d7ddd9 [analyzer] NFC: RetainCountChecker: Don't dump() symbols into program point tags.
We don't need a separate node for every symbol, because whenever the first
symbol leaks, a bug is emitted, the analysis is sinked, and the checker
callback immediately returns due to State variable turning into null,
so we never get to see the second leaking symbol.

Additionally, we are no longer able to break normal analysis while experimenting
with debug dumps.

Differential Revision: https://reviews.llvm.org/D52804

llvm-svn: 344538
2018-10-15 17:47:56 +00:00
Leonard Chan 99bda375a1 [Fixed Point Arithmetic] FixedPointCast
This patch is a part of https://reviews.llvm.org/D48456 in an attempt to
split them up. This contains the code for casting between fixed point types
and other fixed point types.

The method for converting between fixed point types is based off the convert()
method in APFixedPoint.

Differential Revision: https://reviews.llvm.org/D50616

llvm-svn: 344530
2018-10-15 16:07:02 +00:00
Benjamin Kramer c55e997556 Move some helpers from the global namespace into anonymous ones.
llvm-svn: 344468
2018-10-13 22:18:22 +00:00
Enrico Steffinlongo 11b6cedb8e [analyzer] Improved cmake configuration for Z3
Summary:
Enhanced support for Z3 in the cmake configuration of clang; now it is possible to specify any arbitrary Z3 install prefix (CLANG_ANALYZER_Z3_PREFIX) to cmake with lib (or bin) and include folders. Before the patch only in cmake default locations
were searched (https://cmake.org/cmake/help/v3.4/command/find_path.html).

Specifying any CLANG_ANALYZER_Z3_PREFIX will force also CLANG_ANALYZER_BUILD_Z3 to ON.

Removed also Z3 4.5 version requirement since it was not checked, and now Clang works with Z3 4.7

Reviewers: NoQ, george.karpenkov, mikhail.ramalho

Reviewed By: george.karpenkov

Subscribers: rnkovacs, NoQ, esteffin, george.karpenkov, delcypher, ddcc, mgorny, xazax.hun, szepet, a.sidorin, Szelethus

Tags: #clang

Differential Revision: https://reviews.llvm.org/D50818

llvm-svn: 344464
2018-10-13 19:45:48 +00:00
Enrico Steffinlongo a72a15a5c7 [analyzer] Small SMT API improvement
Summary: Removed const qualifier from reset method of SMTSolver and Z3Solver objects.

Reviewers: mikhail.ramalho, george.karpenkov, NoQ, ddcc

Reviewed By: NoQ

Subscribers: xazax.hun, szepet, a.sidorin, Szelethus

Differential Revision: https://reviews.llvm.org/D52031

llvm-svn: 344463
2018-10-13 19:42:10 +00:00
Sam McCall 5da4d75877 Remove top-level using declaration from header files, as these aliases leak.
Reviewers: ilya-biryukov

Subscribers: arphaman, cfe-commits

Differential Revision: https://reviews.llvm.org/D53135

llvm-svn: 344337
2018-10-12 12:21:29 +00:00
George Karpenkov fd6ccd83cd [analyzer] Fix a bug in unexplored_first_location_queue iteration order.
Pointed out by Artem in post-commit review for https://reviews.llvm.org/D53058

llvm-svn: 344322
2018-10-12 00:52:13 +00:00
George Karpenkov d1dd5c3a88 [analyzer] Experiment with an iteration order only based on location, and not using the stack frame
Differential Revision: https://reviews.llvm.org/D53058

llvm-svn: 344313
2018-10-11 22:59:59 +00:00
George Karpenkov ca7a23e761 [analyzer] Avoid unneeded invalidation in RetainCountChecker
Differential Revision: https://reviews.llvm.org/D53168

llvm-svn: 344312
2018-10-11 22:59:38 +00:00
George Karpenkov 41dc8de6ae [analyzer] Retain count checker for OSObject: recognize OSDynamicCast
For now, tresting the cast as a no-op, and disregarding the case where
the output becomes null due to the type mismatch.

rdar://45174557

Differential Revision: https://reviews.llvm.org/D53156

llvm-svn: 344311
2018-10-11 22:59:16 +00:00
Eric Liu 480a5075ad Revert "[Lex] TokenConcatenation now takes const Preprocessor"
This reverts commit r344262. This was an unintentional commit.

llvm-svn: 344267
2018-10-11 17:50:04 +00:00
Eric Liu c8ae649658 [Lex] TokenConcatenation now takes const Preprocessor
Differential Revision: https://reviews.llvm.org/D52502

llvm-svn: 344262
2018-10-11 17:35:29 +00:00
Kristof Umann 8e5328b6f0 [analyzer][UninitializedObjectChecker] Reports Loc fields pointing to themselves
I've added a new functionality, the checker is now able to
detect and report fields pointing to themselves. I figured
this would fit well into the checker as there's no reason
for a pointer to point to itself instead of being nullptr.

Differential Revision: https://reviews.llvm.org/D51305

llvm-svn: 344242
2018-10-11 11:58:53 +00:00
Gabor Horvath d1fd93ceea [analyzer] Support Reinitializes attribute in MisusedMovedObject check
Differential Revision: https://reviews.llvm.org/D52983

llvm-svn: 344017
2018-10-09 07:28:57 +00:00
George Karpenkov 0550dac3ed [analyzer] Do not crash if the assumption added in TrustNonNullChecker is enough to make the state unfeasible
rdar://43541814

Differential Revision: https://reviews.llvm.org/D52848

llvm-svn: 343735
2018-10-03 22:31:09 +00:00
Artem Dergachev d807f9065b [analyzer] Fix symbol discovery in nonloc::LocAsInteger values.
Doesn't do much despite sounding quite bad, but fixes an exotic test case where
liveness of a nonloc::LocAsInteger array index is now evaluated correctly.

Differential Revision: https://reviews.llvm.org/D52667

llvm-svn: 343631
2018-10-02 20:48:12 +00:00
Kristof Umann 40271e4fde [analyzer][NFC] Refactor functions in PlistDiagnostics to take AnalyzerOptions as parameter
I intend to add a new flag macro-expnasions-as-events, and unfortunately
I'll only be able to convert the macro piece into an event one once I'm
about to emit it, due to the lack of an avaible Preprocessor object in
the BugReporter.

Differential Revision: https://reviews.llvm.org/D52787

llvm-svn: 343620
2018-10-02 19:27:34 +00:00
Mikhail R. Gadelha 32ce136e80 [analyzer] Improvements to the SMT API
Summary:
Several improvements in preparation for the new backends.

Refactoring:

- Removed duplicated methods `fromBoolean`, `fromAPSInt`, `fromInt` and `fromAPFloat`. The methods `mkBoolean`, `mkBitvector` and `mkFloat` are now used instead.
- The names of the functions that convert BVs to FPs were swapped (`mkSBVtoFP`, `mkUBVtoFP`, `mkFPtoSBV`, `mkFPtoUBV`).
- Added a couple of comments in function calls.

Crosscheck encoding:

- Changed how constraints are encoded in the refutation manager so it doesn't start with (false OR ...). This change introduces one duplicated line (see file `BugReporterVisitors.cpp`, the `SMTConv::getRangeExpr is called twice, so I can remove this change if the duplication is a problem.

Reviewers: george.karpenkov, NoQ

Reviewed By: george.karpenkov

Subscribers: xazax.hun, szepet, a.sidorin, Szelethus

Differential Revision: https://reviews.llvm.org/D52365

llvm-svn: 343581
2018-10-02 12:55:48 +00:00
Eric Liu b9e17124ea Revert untintentionally commited changes
llvm-svn: 343574
2018-10-02 10:28:54 +00:00
Eric Liu 09c34d77e0 [Lex] TokenConcatenation now takes const Preprocessor
Differential Revision: https://reviews.llvm.org/D52502

llvm-svn: 343573
2018-10-02 10:28:50 +00:00
Kristof Umann 4f9fdba4f6 [analyzer][NFC] Refactor functions in PlistDiagnostics to take Preproc as parameter
This is patch is a preparation for the proposed inclusion of macro expansions in the plist output.

Differential Revision: https://reviews.llvm.org/D52735

llvm-svn: 343511
2018-10-01 18:11:51 +00:00
George Karpenkov c82d457db5 [analyzer] [NFC] Remove unused parameters, as found by -Wunused-parameter
Differential Revision: https://reviews.llvm.org/D52640

llvm-svn: 343353
2018-09-28 18:49:41 +00:00
George Karpenkov c704f4fbd0 [analyzer] Provide an option to dump generated exploded graphs to a given file.
Dumping graphs instead of opening them is often very useful,
e.g. for transfer or converting to SVG.

Basic sanity check for generated exploded graphs.

Differential Revision: https://reviews.llvm.org/D52637

llvm-svn: 343352
2018-09-28 18:49:21 +00:00
George Karpenkov 6d229be5ec [analyzer] Hotfix for the bug in exploded graph printing
llvm-svn: 343276
2018-09-27 22:31:13 +00:00
George Karpenkov 2b7682d1b4 [analyzer] Highlight nodes which have error reports in them in red in exploded graph
Differential Revision: https://reviews.llvm.org/D52584

llvm-svn: 343239
2018-09-27 17:26:41 +00:00
Kristof Umann e4f81ec366 Revert untintentionally commited changes
llvm-svn: 343205
2018-09-27 12:46:37 +00:00
Kristof Umann b416dbfb04 [Lex] TokenConcatenation now takes const Preprocessor
Differential Revision: https://reviews.llvm.org/D52502

llvm-svn: 343204
2018-09-27 12:40:16 +00:00
George Karpenkov 27ec210fbd [analyzer] [NFC] Move the code for dumping the program point to ProgramPoint
So we can dump them outside of viewing the exploded grpah.

Differential Revision: https://reviews.llvm.org/D52583

llvm-svn: 343160
2018-09-27 01:46:18 +00:00
George Karpenkov 4b9bb7cebb [analyzer] [NFC] Heavy refactoring of trackNullOrUndefValue
Differential Revision: https://reviews.llvm.org/D52519

llvm-svn: 343159
2018-09-27 01:45:57 +00:00
Fangrui Song 55fab260ca llvm::sort(C.begin(), C.end(), ...) -> llvm::sort(C, ...)
Summary: The convenience wrapper in STLExtras is available since rL342102.

Reviewers: rsmith, #clang, dblaikie

Reviewed By: rsmith, #clang

Subscribers: mgrang, arphaman, kadircet, cfe-commits

Differential Revision: https://reviews.llvm.org/D52576

llvm-svn: 343147
2018-09-26 22:16:28 +00:00
Simon Pilgrim 8d5f101e94 Removed extra semicolon to fix Wpedantic. (NFCI).
llvm-svn: 343085
2018-09-26 09:12:55 +00:00
Artem Dergachev 69ece336b8 [analyzer] Fix a crash on casting symbolic pointers to derived classes.
Commit r340984 causes a crash when a pointer to a completely unrelated type
UnrelatedT (eg., opaque struct pattern) is being casted from base class BaseT to
derived class DerivedT, which results in an ill-formed region
Derived{SymRegion{$<UnrelatedT x>}, DerivedT}.

Differential Revision: https://reviews.llvm.org/D52189

llvm-svn: 343051
2018-09-26 00:17:14 +00:00
Artem Dergachev e527df03c4 [analyzer] Add a testing facility for testing relationships between symbols.
Tests introduced in r329780 was disabled in r342317 because these tests
were accidentally testing dump infrastructure, when all they cared about was
how symbols relate to each other. So when dump infrastructure changed,
tests became annoying to maintain.

Add a new feature to ExprInspection: clang_analyzer_denote() and
clang_analyzer_explain(). The former adds a notation to a symbol, the latter
expresses another symbol in terms of previously denoted symbols.

It's currently a bit wonky - doesn't print parentheses and only supports
denoting atomic symbols. But it's even more readable that way.

Differential Revision: https://reviews.llvm.org/D52133

llvm-svn: 343048
2018-09-25 23:50:53 +00:00
Artem Dergachev 0b7fdca640 [analyzer] NFC: CallDescription: Improve array management.
Combine the two constructor overrides into a single ArrayRef constructor
to allow easier brace initializations and simplify how the respective field
is used internally.

Differential Revision: https://reviews.llvm.org/D51390

llvm-svn: 343037
2018-09-25 22:13:31 +00:00
Artem Dergachev 579cf90367 [analyzer] NFC: Legalize state manager factory injection.
When a checker maintains a program state trait that isn't a simple list/set/map, but is a combination of multiple lists/sets/maps (eg., a multimap - which may be implemented as a map from something to set of something), ProgramStateManager only contains the factory for the trait itself. All auxiliary lists/sets/maps need a factory to be provided by the checker, which is annoying.

So far two checkers wanted a multimap, and both decided to trick the
ProgramStateManager into keeping the auxiliary factory within itself
by pretending that it's some sort of trait they're interested in,
but then never using this trait but only using the factory.

Make this trick legal. Define a convenient macro.

One thing that becomes apparent once all pieces are put together is that
these two checkers are in fact using the same factory, because the type that
identifies it, ImmutableMap<const MemRegion *, ImmutableSet<SymbolRef>>,
is the same. This situation is different from two checkers registering similar
primitive traits.

Differential Revision: https://reviews.llvm.org/D51388

llvm-svn: 343035
2018-09-25 22:10:12 +00:00
George Karpenkov 2a6deeb928 [analyzer] Prevent crashes in FindLastStoreBRVisitor
This patch is a band-aid. A proper solution would be too change
trackNullOrUndefValue to only try to dereference the pointer when it is
relevant to the problem.

Differential Revision: https://reviews.llvm.org/D52435

llvm-svn: 342920
2018-09-24 21:20:30 +00:00
Kristof Umann 82eeca363a [analyzer][UninitializedObjectChecker] Using the new const methods of ImmutableList
Differential Revision: https://reviews.llvm.org/D51886

llvm-svn: 342834
2018-09-23 09:16:27 +00:00
David Carlier 75cb0dd5ed [CStringSyntaxChecker] Check strlcat sizeof check
Assuming strlcat is used with strlcpy we check as we can if the last argument does not equal os not larger than the buffer.
Advising the proper usual pattern.

Reviewers: george.karpenkov, NoQ, MaskRay

Reviewed By: MaskRay

Differential Revision: https://reviews.llvm.org/D49722

llvm-svn: 342832
2018-09-23 08:30:17 +00:00
George Karpenkov 04553e530f [analyzer] Process state in checkEndFunction in RetainCountChecker
Modify the RetainCountChecker to perform state "adjustments" in
checkEndFunction, as performing work in PreStmt<ReturnStmt> does not
work with destructors.
The previous version made an implicit assumption that no code runs
after the return statement is executed.

rdar://43945028

Differential Revision: https://reviews.llvm.org/D52338

llvm-svn: 342770
2018-09-21 20:37:20 +00:00
George Karpenkov 200e809dbd [analyzer] Highlight sink nodes in red
Differential Revision: https://reviews.llvm.org/D52337

llvm-svn: 342769
2018-09-21 20:37:01 +00:00
George Karpenkov 33e5a15896 [analyzer] Associate diagnostics created in checkEndFunction with a return statement, if possible
If not possible, use the last line of the declaration, as before.

Differential Revision: https://reviews.llvm.org/D52326

llvm-svn: 342768
2018-09-21 20:36:41 +00:00
George Karpenkov 6babf2ae16 [analyzer] [NFC] Prefer make_unique over "new"
Differential Revision: https://reviews.llvm.org/D52336

llvm-svn: 342767
2018-09-21 20:36:21 +00:00
George Karpenkov a31c224bb4 [analyzer] Fix bug in isInevitablySinking
If the non-sink report is generated at the exit node, it will be
suppressed by the current functionality in isInevitablySinking, as it
only checks the successors of the block, but not the block itself.

The bug shows up in RetainCountChecker checks.

Differential Revision: https://reviews.llvm.org/D52284

llvm-svn: 342766
2018-09-21 20:36:01 +00:00
George Karpenkov 649e013241 [analyzer] [NFC] Dead code removal
Differential Revision: https://reviews.llvm.org/D52269

llvm-svn: 342765
2018-09-21 20:35:39 +00:00
George Karpenkov 8639c5d565 [analyzer] ExplodedGraph printing fixes
Fixes a number of issues:

 - Global variables are not used for communication
 - Trait should be defined on a graph, not on a node
 - Defining the trait on a graph allows us to use a correct allocator,
   no longer crashing while printing trimmed graphs

Differential Revision: https://reviews.llvm.org/D52183

llvm-svn: 342413
2018-09-17 20:46:53 +00:00
George Karpenkov 64c431c900 [analyzer] Further printing improvements: use declarations,
skip pointers whenever redundant, use unique prefixes.

Differential Revision: https://reviews.llvm.org/D52114

llvm-svn: 342316
2018-09-15 02:34:45 +00:00
George Karpenkov 6bde7a015f [analyzer] Generate and use stable identifiers for LocationContext
Those are not created in the allocator.
Since they are created fairly rarely, a counter overhead should not
affect the memory consumption.

Differential Revision: https://reviews.llvm.org/D51827

llvm-svn: 342314
2018-09-15 02:03:36 +00:00
George Karpenkov fc042f95e2 [analyzer] Dump reproducible identifiers for statements in exploded graph in store
Differential Revision: https://reviews.llvm.org/D51826

llvm-svn: 342313
2018-09-15 02:03:17 +00:00
George Karpenkov 141b448ee9 [analyzer] Use correct end-of-line character when printing statements for exploded graph
Prevents bad centering.

Differential Revision: https://reviews.llvm.org/D51825

llvm-svn: 342312
2018-09-15 02:02:56 +00:00