Commit Graph

905 Commits

Author SHA1 Message Date
Ted Kremenek e9a5bcf17e Change RetainCountChecker to eagerly "escape" retained objects when they are
assigned to a struct.  This is fallout from inlining results, which expose
far more patterns where people stuff CF objects into structs and pass them
around (and we can reason about it).  The problem is that we don't have
a general way to detect when values have escaped, so as an intermediate step
we need to eagerly prune out such tracking.

Fixes <rdar://problem/11104566>.

llvm-svn: 153489
2012-03-27 01:12:45 +00:00
Anna Zaks a651c4099d [analyzer] Malloc: Allow a pointer to escape through OSAtomicEnqueue.
llvm-svn: 153453
2012-03-26 18:18:39 +00:00
Jordy Rose 21ff76e916 [analyzer] Tighten up the realloc() failure path note generation...make sure we get the right realloc()!
llvm-svn: 153370
2012-03-24 03:15:09 +00:00
Jordy Rose 43a9af7352 [analyzer] Restart path diagnostic generation if any of the visitors change the report configuration while walking the path.
This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type.

Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior.

llvm-svn: 153369
2012-03-24 03:03:29 +00:00
Jordy Rose f78877e99a [analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able to reset diagnostic generation.
llvm-svn: 153368
2012-03-24 02:45:35 +00:00
Ted Kremenek 161046edab Avoid applying retain/release effects twice in RetainCountChecker when a function call was inlined (i.e., we do not need to apply summaries in such cases).
llvm-svn: 153309
2012-03-23 06:26:56 +00:00
Anton Yartsev edb062887f corrected check::EndOfTranslationUnit checker name and added 'const' to declaration
llvm-svn: 153302
2012-03-23 02:43:24 +00:00
Ted Kremenek 30de950bba Fix static analyzer crash on code taking the address of a field. Fixes PR 11146.
llvm-svn: 153283
2012-03-22 21:42:31 +00:00
Anna Zaks a407b59ce8 [analyzer] Add the stat for the number of successfully explored paths.
llvm-svn: 153281
2012-03-22 21:06:06 +00:00
Anna Zaks 06bf78c242 [analyzer] Add stats useful for coverage investigations.
llvm-svn: 153280
2012-03-22 21:06:03 +00:00
Anna Zaks 395c0dd70e [analyzer] Add inlining awareness to the block coverage computation
(Stats Checker).

llvm-svn: 153279
2012-03-22 21:05:57 +00:00
Ted Kremenek 40c13431aa "Teach" RetainCountChecker about dispatch_set_context, which can indirectly free its argument later. Fixes <rdar://problem/11059275>.
llvm-svn: 153244
2012-03-22 06:29:41 +00:00
Anna Zaks 9fe8098e29 [analyzer] Malloc: drop symbols captured by blocks.
llvm-svn: 153232
2012-03-22 00:57:20 +00:00
Benjamin Kramer c25c5e0ba2 Remove unused variable, fix indentation.
llvm-svn: 153220
2012-03-21 21:03:48 +00:00
Anna Zaks fc2e153444 [analyzer] Malloc: Utter the name of the leaked variable.
Specifically, we use the last store of the leaked symbol in the leak diagnostic.
(No support for struct fields since the malloc checker doesn't track those
yet.)

+ Infrastructure to track the regions used in store evaluations.
This approach is more precise than iterating the store to
obtain the region bound to the symbol, which is used in RetainCount
checker. The region corresponds to what is uttered in the code in the
last store and we do not rely on the store implementation to support
this functionality.

llvm-svn: 153212
2012-03-21 19:45:08 +00:00
Anna Zaks 6797d6ee23 [analyser] Factor out FindUniqueBinding from RetainCount checker.
So that others could use it as well. No functionality change.

llvm-svn: 153211
2012-03-21 19:45:01 +00:00
Jordy Rose bf38f20e79 [analyzer] Mark a failed-realloc's result as an interesting symbol between the realloc call and the null check, so we get nicer path notes. Fixes a regression introduced by the diagnostic pruning added in r152361.
This is accomplished by calling markInteresting /during/ path diagnostic generation, and as such relies on deterministic ordering of BugReporterVisitors -- namely, that BugReporterVisitors are run in /reverse/ order from how they are added. (Right now that's a consequence of storing visitors in an ImmutableList, where new items are added to the front.) It's a little hacky, but it works for now.

I think this is the best we can do without storing the relation between the old and new symbols, and that would be a hit whether or not there ends up being an error.

llvm-svn: 153010
2012-03-18 07:43:35 +00:00
Jordy Rose 61c974b492 [analyzer] Use a FoldingSet to cache simple RetainSummary instances, rather than explicitly keeping DoNothing and StopTracking summaries and nothing else.
I tried to test the effects of this change on memory usage and run time, but what I saw on retain-release.m was indistinguishable from noise (debug and release builds). Even so, some caveman profiling showed 101 cache hits that we would have generated new summaries for before (i.e. not default or stop summaries), and the more code we analyze, the more memory we should save.

Maybe we should have a standard project for benchmarking the retain count checker's memory and time?

llvm-svn: 153007
2012-03-18 01:26:10 +00:00
Jordy Rose 35e71c771d [analyzer] Unify retain-count summary generation for class and instance methods. No functionality change.
llvm-svn: 153001
2012-03-17 21:13:07 +00:00
Jordy Rose 7063883e8c [analyzer] Remove duplicate work on deriving method behavior. No functionality change.
The cocoa::deriveNamingConventions helper is just using method families anyway now, and the way RetainSummaryTemplate works means we're allocating an extra summary for every method with a relevant family.

Also, fix RetainSummaryTemplate to do the right thing w/r/t annotating an /existing/ summary. This was probably the real cause of <rdar://problem/10824732> and the fix in r152448.

llvm-svn: 152998
2012-03-17 19:53:04 +00:00
NAKAMURA Takumi 3ec7c4574f StaticAnalyzer: Fix abuse of StringRef in r152962.
llvm-svn: 152982
2012-03-17 13:06:05 +00:00
Jordy Rose 78373e505d [analyzer] Don't claim an object was returned with +1 retain count before counting autoreleases. Fixes PR10376.
(Also, 80-column violations.)

llvm-svn: 152976
2012-03-17 05:49:15 +00:00
Anna Zaks a7f457a5ea [analyzer] Shorten the stack hint diagnostic.
Do not display the standard "Returning from 'foo'", when a stack hint is
available.

llvm-svn: 152964
2012-03-16 23:44:28 +00:00
Anna Zaks cba4f298c6 [analyzer] Create symbol-aware stack hints (building upon r152837).
The symbol-aware stack hint combines the checker-provided message
with the information about how the symbol was passed to the callee: as
a parameter or a return value.

For malloc, the generated messages look like this :
"Returning from 'foo'; released memory via 1st parameter"
"Returning from 'foo'; allocated memory via 1st parameter"
"Returning from 'foo'; allocated memory returned"
"Returning from 'foo'; reallocation of 1st parameter failed"


(We are yet to handle cases when the symbol is a field in a struct or
an array element.)

llvm-svn: 152962
2012-03-16 23:24:20 +00:00
Anna Zaks 180e4aa246 [analyzer] +Comments
llvm-svn: 152961
2012-03-16 23:24:16 +00:00
Anna Zaks bbea3e7780 [analyzer] Add a statistic for the number of times we reach the max
number of steps in the work list.

llvm-svn: 152960
2012-03-16 23:24:13 +00:00
Ted Kremenek b1279b5c47 Fix analyzer crash on analyzing 'catch' with no condition variable.
llvm-svn: 152900
2012-03-16 05:58:15 +00:00
Jordy Rose 735724fb1e [analyzer] If a metadata symbol is interesting, its region is interesting as well.
llvm-svn: 152868
2012-03-15 22:45:29 +00:00
Jordy Rose 01b59cd87a [analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ expressions with a "base object", because the CFG is now linearized.
The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway.

llvm-svn: 152856
2012-03-15 21:46:47 +00:00
Anna Zaks 1ff57d57e8 [analyzer] Allow checkers to supply call stack diagnostic hints for the
BugVisitor DiagnosticPieces.

When checkers create a DiagnosticPieceEvent, they can supply an extra
string, which will be concatenated with the call exit message for every
call on the stack between the diagnostic event and the final bug report.
(This is a simple version, which could be/will be further enhanced.)

For example, this is used in Malloc checker to produce the ",
which allocated memory" in the following example:

static char *malloc_wrapper() { // 2. Entered call from 'use'
    return malloc(12);    // 3. Memory is allocated
}

void use() {
    char *v;
    v = malloc_wrapper(); // 1. Calling 'malloc_wrappers'
        // 4. Returning from 'malloc_wrapper', which allocated memory
}                         // 5. Memory is never released; potential
memory leak

llvm-svn: 152837
2012-03-15 21:13:02 +00:00
Matt Beaumont-Gay be84d85905 '#if 0' out a variable that's only used in other preprocessor-disabled code.
(Why are we keeping all of this code around anyway? Say the word and I'll
start swinging the delete hammer.)

llvm-svn: 152749
2012-03-14 23:12:42 +00:00
Anna Zaks d4e9059fe0 [analyzer] Diagnostics: Supply Caller information even if the bug occurs
in the callee.

llvm-svn: 152734
2012-03-14 18:58:28 +00:00
Erik Verbruggen 5923cbd27b [Analyser] Remove unnecessary recursive visits for ExprWithCleanups and
MaterializeTemporaryExpr.

llvm-svn: 152730
2012-03-14 18:01:43 +00:00
Erik Verbruggen fe66dd624d [Analyser] Removes more recursive visitations in ExprEngine that are no
longer needed as the CFG is fully linearized.

llvm-svn: 152720
2012-03-14 15:38:55 +00:00
Anna Zaks 9ff686239a [analyser] Refactor shouldInline logic into a helper.
llvm-svn: 152677
2012-03-13 22:15:58 +00:00
Anna Zaks 6e5b48a6b4 [analyzer] Call enter/exit diagnostic should refer to caller/callee,
respectively.

llvm-svn: 152676
2012-03-13 22:15:55 +00:00
Anna Zaks 943c680605 [analyzer] Change the order in which we analyze the functions under
inlining to be the reverse of their declaration.

This optimizes running time under inlining up to 20% since we do not
re-analyze the utility functions which are usually defined first in the
translation unit if they have already been analyzed while inlined into
the root functions.

llvm-svn: 152653
2012-03-13 19:32:19 +00:00
Anna Zaks ca70ed53da [analyzer] Use BFS over call graph when analysing functions.
BFS should give slightly better performance. Ex: Suppose, we have two
roots R1 and R2. A callee function C is reachable through both. However,
C is not inlined when analyzing R1 due to inline stack depth limit. With
DFS, C will be analyzed as top level even though it would be analyzed as
inlined through R2. On the other hand, BFS could avoid analyzing C as
top level.

llvm-svn: 152652
2012-03-13 19:32:13 +00:00
Anna Zaks 32da47b9a1 [analyzer] Refactor CallGraph to use Recursive AST visitor when
collecting function Decls.

llvm-svn: 152651
2012-03-13 19:32:08 +00:00
Anna Zaks 1418951405 [analyzer] Use recursive AST visitor to drive simple visitation order in
AnalysisConsumer.

As a result:
 - We now analyze the C++ methods which are defined within the
class body. These were completely skipped before.

- Ensure that AST checkers are called on functions in the
order they are defined in the Translation unit.

llvm-svn: 152650
2012-03-13 19:32:00 +00:00
Anna Zaks aa19abe978 [analyzer] Minor: factor out logic for determining if we should skip a
function.

llvm-svn: 152649
2012-03-13 19:31:54 +00:00
Anna Zaks e756ce0c5d [analyzer] Move the check for parser errors out of the loop over Decls.
llvm-svn: 152648
2012-03-13 19:31:47 +00:00
Ted Kremenek e6aac4e888 Add new analyzer diagnostic mode where plists can have bugs that span multiple files.
llvm-svn: 152586
2012-03-12 23:14:53 +00:00
Ted Kremenek 487cdbfdb0 [analyzer] Include inlining call stack depth in plist output.
llvm-svn: 152584
2012-03-12 22:10:57 +00:00
David Blaikie bbafb8a745 Unify naming of LangOptions variable/get function across the Clang stack (Lex to AST).
The member variable is always "LangOpts" and the member function is always "getLangOpts".

Reviewed by Chris Lattner

llvm-svn: 152536
2012-03-11 07:00:24 +00:00
Jordy Rose f80b2cced7 [analyzer] Replace a static helper with existing logic. No functionality change.
llvm-svn: 152521
2012-03-11 00:08:24 +00:00
John McCall 113bee0536 Remove BlockDeclRefExpr and introduce a bit on DeclRefExpr to
track whether the referenced declaration comes from an enclosing
local context.  I'm amenable to suggestions about the exact meaning
of this bit.

llvm-svn: 152491
2012-03-10 09:33:50 +00:00
Ted Kremenek 8fdb59f979 [analyzer] fix regression in analyzer of NOT actually aborting on Stmts it doesn't understand. We registered
as aborted, but didn't treat such cases as sinks in the ExplodedGraph.

Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly).

Fixes: <rdar://problem/10892489>
llvm-svn: 152468
2012-03-10 01:34:17 +00:00
Ted Kremenek 33be12003f Teach RetainCountChecker about mixing method families with explicit annotations. Fixes <rdar://problem/10824732>.
llvm-svn: 152448
2012-03-09 23:34:08 +00:00
Anna Zaks 394d07ea88 [analyzer] Add support for NoRedundancy inlining mode.
We do not reanalyze a function, which has already been analyzed as an
inlined callee. As per PRELIMINARY testing, this gives over
50% run time reduction on some benchmarks without decreasing of the
number of bugs found.

Turning the mode on by default.

llvm-svn: 152440
2012-03-09 21:14:01 +00:00