Commit Graph

1457 Commits

Author SHA1 Message Date
Ted Kremenek 4f335c300a Have divide-by-zero checker not handled undefined denominators. This is handled by the generic checking for undefined operands for BinaryOperators.
llvm-svn: 82019
2009-09-16 06:04:26 +00:00
Ted Kremenek 6879beda08 Remove ImplicitBadDivides/ExplicitBadDivides node sets. This checking is now down by a 'Checker' and not build into GRExprEngine.
llvm-svn: 82017
2009-09-16 06:03:39 +00:00
Ted Kremenek 188f62f1cc Fix static analyzer regression when emitting undefined value warnings
with binary operators.  The result of a binary operator may be
undefined even if its operands are well-defined.

llvm-svn: 81874
2009-09-15 17:43:54 +00:00
Ted Kremenek b66229464e Per feedback from Eli, recognize in the transfer function logic for
__builtin_offsetof in the static analyzer that __builtin_offsetof is
not guaranteed to return an integer constant.  We will need to shore
this up later, but now at least we have correct support for when this
*is* an integer constant.

llvm-svn: 81830
2009-09-15 04:19:09 +00:00
Ted Kremenek 3413f277d0 Fix typo in comment.
llvm-svn: 81825
2009-09-15 03:28:00 +00:00
Ted Kremenek 27347135dd Add static analyzer transfer function support for __builtin_offsetof.
llvm-svn: 81820
2009-09-15 00:40:32 +00:00
Ted Kremenek 4112969df1 Fix: <rdar://problem/5905851> do not report a leak when post-dominated by a call
to a noreturn or panic function

llvm-svn: 81803
2009-09-14 22:01:32 +00:00
Ted Kremenek 37a118520c Implement FIXME: free up BugReportEquivClass objects when deleting BugTypes.
llvm-svn: 81783
2009-09-14 20:40:59 +00:00
Douglas Gregor 15fc956ca0 Remove unnecessary ASTContext parameter from FunctionDecl::isBuiltinID
llvm-svn: 81590
2009-09-12 00:22:50 +00:00
Douglas Gregor e2350a3b97 Eliminate FunctionDecl::getBodyIfAvailable
llvm-svn: 81588
2009-09-12 00:08:48 +00:00
Ted Kremenek 7020eae076 Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a way
to statically type various methods in SValuator/GRState as required either a
defined value or a defined-but-possibly-unknown value. This leads to various
logic cleanups in GRExprEngine, and lets the compiler enforce via type checking
our assumptions about what symbolic values are possibly undefined and what are
not.

Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values.

llvm-svn: 81579
2009-09-11 22:07:28 +00:00
Benjamin Kramer 1618c0113b Update CMakeLists.
llvm-svn: 81519
2009-09-11 11:28:30 +00:00
Zhongxing Xu dc299bc481 Start to add a new transfer function that inlines callee. To be continued.
llvm-svn: 81501
2009-09-11 04:13:42 +00:00
Zhongxing Xu 7e3431b5cf Make AnalysisManager stateless. Now other analyzer components only depends on
local node information.

llvm-svn: 81433
2009-09-10 05:44:00 +00:00
Ted Kremenek 84c6f0a1e6 Implement: <rdar://problem/7185647> [RegionStore] 'self' cannot be NULL upon entry to a method
Here we implement this as a precondition within GRExprEngine, even though it is
related to how BasicStoreManager and RegionStoreManager model 'self'
differently. Putting this as a high-level precondition is more general, which is
why it isn't in RegionStore.cpp.

llvm-svn: 81378
2009-09-09 20:36:12 +00:00
Mike Stump 11289f4280 Remove tabs, and whitespace cleanups.
llvm-svn: 81346
2009-09-09 15:08:12 +00:00
Ted Kremenek b5850f9c80 Fix buffer overflow reported in PR 4903.
llvm-svn: 81092
2009-09-05 17:59:01 +00:00
Zhongxing Xu 1309a852d3 pass the correct predecessor node.
llvm-svn: 81066
2009-09-05 06:46:12 +00:00
Zhongxing Xu d7674a47f9 Do not call FlushReports() in GRBugReporter's dtor. We already call it in
ActionGRExprEngine().

llvm-svn: 81064
2009-09-05 06:06:49 +00:00
Zhongxing Xu 88f07cd49c Refactor builtin function evaluation code into its own function.
llvm-svn: 81061
2009-09-05 05:00:57 +00:00
Zhongxing Xu bfb000f337 move the check into MarkNoReturnFunction.
llvm-svn: 80980
2009-09-04 02:17:35 +00:00
Zhongxing Xu 1748d8a43d Extract mark-no-return-function code into a function.
llvm-svn: 80979
2009-09-04 02:13:36 +00:00
Ted Kremenek 17a0296a09 Fix 80 column violations.
llvm-svn: 80873
2009-09-03 03:02:58 +00:00
Ted Kremenek b117fd9168 Fix regression introduced in r80786 and reported in PR 4867. We should use
'dyn_cast' instead of 'cast' as the denominator value could be UnknownVal (and
is not guaranteed to be a DefinedVal).

llvm-svn: 80869
2009-09-03 01:48:03 +00:00
Zhongxing Xu 677e6a2faf remove a debug output I introduced in the last commit.
llvm-svn: 80865
2009-09-03 01:31:59 +00:00
Zhongxing Xu 6e4232c79c Refactor the check for bad divide into a checker.
Also fix a checker context bug: the Dst set is not always empty initially. 
Because in GRExprEngine::CheckerVisit(), *CurrSet is used repeatedly. 
So we removed the Dst.empty() condition in ~CheckerContext() when deciding
whether to do autotransision.

llvm-svn: 80786
2009-09-02 13:26:26 +00:00
Zhongxing Xu 79affb7b94 Refactor bad callee check into a Checker.
Now bad callee is checked as a PreVisit to the CallExpr.

llvm-svn: 80771
2009-09-02 08:10:35 +00:00
Zhongxing Xu 656b10a1fa Still use BadArg bugtype in the checker. This saves us implement registerInitialVisitors
in the BugReport. 

When all internal bug checking logic are moved to checkers, BuiltinBug will
not reference GRExprEngine, and FlushReports() will be not necessary, since
all bugs are emitted into the equivalent classes immediately.

For now just add a ctor with no arguments.

llvm-svn: 80770
2009-09-02 07:09:39 +00:00
Ted Kremenek cf768cd202 Replace uses of ImmutableSet in SymbolReaper with DenseSet. This was
motivated from Shark profiles that shows that 'markLive' was very
heavy when using --analyzer-store=region.  On my benchmark file, this
reduces the analysis time for --analyzer-store=region from 19.5s to
13.5s and for --analyzer-store=basic from 5.3s to 3.5s.  For the
benchmark file, this is a reduction of about 30% analysis time for
both analysis modes (a huge win).

llvm-svn: 80765
2009-09-02 06:03:18 +00:00
Ted Kremenek ad5a600a24 Implement: <rdar://problem/6337100> CWE-338: Use of cryptographically weak prng
Patch by Geoff Keating!

llvm-svn: 80752
2009-09-02 02:47:41 +00:00
Ted Kremenek 3aff920676 Sentence-case bug category.
llvm-svn: 80644
2009-09-01 00:17:12 +00:00
Douglas Gregor f405d7e6f1 Eliminate CXXAdornedMemberExpr entirely. Instead, optionally allocate
space within the MemberExpr for the nested-name-specifier and its
source range. We'll do the same thing with explicitly-specified
template arguments, assuming I don't flip-flop again.

llvm-svn: 80642
2009-08-31 23:41:50 +00:00
Douglas Gregor 96ee789d33 Rename CXXQualifiedMemberExpr -> CXXAdornedMemberExpr, since we will
also be adding explicit template arguments as an additional
"adornment". No functionality change.

llvm-svn: 80628
2009-08-31 21:41:48 +00:00
Zhongxing Xu 6fd66d4588 Refactor undefined argument checking into a Checker.
llvm-svn: 80417
2009-08-29 02:11:01 +00:00
Ted Kremenek 52ac2b5735 retain/release checker: [CIContext createCGImage...] and friends returned CF
objects that are not automatically garbage collected. This fixes
<rdar://problem/7174400>.

llvm-svn: 80387
2009-08-28 19:52:12 +00:00
Ted Kremenek 198a8c5f95 Use SymbolicRegion instead of CodeTextRegion for symbolic function
pointers.  Most logic cares first about whether or not a region is
symbolic, and second if represents code.  This should fix a series of
silent corner case bugs (as well as simplify a bunch of code).

llvm-svn: 80335
2009-08-28 04:49:15 +00:00
Ted Kremenek aeca0954c2 Use C++ style comments.
llvm-svn: 80320
2009-08-28 00:24:55 +00:00
Ted Kremenek d032fcce5c Implement: <rdar://problem/6337132> CWE-273: Failure to Check Whether Privileges
Were Dropped Successfully

Patch by Geoff Keating!

llvm-svn: 80313
2009-08-28 00:08:09 +00:00
Ted Kremenek ce499c2078 CFG construction: Abort CFG construction when processing a CompoundStmt if any
of its subexpressions resulted in a "bad CFG".

llvm-svn: 80298
2009-08-27 23:16:26 +00:00
Ted Kremenek 1d5f2f3546 Rename 'bindExpr' to 'BindExpr'.
llvm-svn: 80294
2009-08-27 22:17:37 +00:00
Ted Kremenek 0ac724be55 Move the AnalysisContext* from GRState to Environment.
llvm-svn: 80293
2009-08-27 22:15:20 +00:00
Zhongxing Xu 3ca89b9f20 Remove a unused member variable. Instead query the option from AnalysisManager.
llvm-svn: 80226
2009-08-27 06:55:26 +00:00
Ted Kremenek 907a711f60 Simplify 'Environment' to contain only one map from 'const Stmt*' to SVals, greatly simplifying the logic of the analyzer in many places. We now only distinguish between block-level expressions and subexpressions in Environment::RemoveDeadBindings and GRState pretty-printing.
llvm-svn: 80194
2009-08-27 01:39:13 +00:00
Douglas Gregor c190523d7a When a member reference expression includes a qualifier on the member
name, e.g.,
  
  x->Base::f()

retain the qualifier (and its source range information) in a new
subclass of MemberExpr called CXXQualifiedMemberExpr. Provide
construction, transformation, profiling, printing, etc., for this new
expression type.

When a virtual function is called via a qualified name, don't emit a
virtual call. Instead, call that function directly. Mike, could you
add a CodeGen test for this, too?

llvm-svn: 80167
2009-08-26 22:36:53 +00:00
Ted Kremenek c4c48be88e Fix regression in BasicStoreManager caused by implicitly casting loaded values and trying to load/store from arrays. RegionStoreManager already properly handles these cases well; we just need to gracefully not handle this case in BasicStoreManager. This fixes PR 4781.
llvm-svn: 80051
2009-08-25 23:29:04 +00:00
Ted Kremenek d1d6066be8 Handle pointer arithmetic in RegionStoreManager involving Objective-C pointers
when using the non-fragile Objective-C ABI.  This fixes <rdar://problem/7168531>.

llvm-svn: 80047
2009-08-25 22:55:09 +00:00
Ted Kremenek 3ed9543ace Fix crash reported in <rdar://problem/7124210> by "back-porting" some of the
implicit cast logic in RegionStoreManager to BasicStoreManager. This involved
moving CastRetriedVal from RegionStoreManager to StoreManager.

llvm-svn: 80026
2009-08-25 20:51:30 +00:00
Ted Kremenek 3a459dc8c9 Move logic of GRExprEngine::EvalBinOp to SValuator::EvalBinOp.
llvm-svn: 80018
2009-08-25 18:44:25 +00:00
Zhongxing Xu 342950efc5 Remove CodeDecl and CFG from GRExprEngine and GRStateManager.
Now AnalysisManager is the only place we can get CodeDecl.
This leads to an API change: GRState::bindExpr() now takes the CFG argument.

llvm-svn: 79980
2009-08-25 06:51:30 +00:00
Zhongxing Xu 94ec649b33 Remove Decl and CFG from ExplodedGraph. This leads to a series small changes.
llvm-svn: 79973
2009-08-25 03:33:41 +00:00