Commit Graph

2899 Commits

Author SHA1 Message Date
Artem Dergachev 1f68d9d39e [CFG] Provide construction contexts for temproary objects.
Constructors of C++ temporary objects that have destructors now can be queried
to discover that they're indeed constructing temporary objects.

The respective CXXBindTemporaryExpr, which is also repsonsible for destroying
the temporary at the end of full-expression, is now available at the
construction site in the CFG. This is all the context we need to provide for
temporary objects that are not lifetime extended. For lifetime-extended
temporaries, more context is necessary.

Differential Revision: https://reviews.llvm.org/D43056

llvm-svn: 325210
2018-02-15 03:13:36 +00:00
Nico Weber 758fbacea5 Teach Wreturn-type, Wunreachable-code, and alpha.deadcode.UnreachableCode to treat __assume(0) like __builtin_unreachable.
Fixes PR29134.
https://reviews.llvm.org/D43221

llvm-svn: 325052
2018-02-13 21:31:47 +00:00
Artem Dergachev 9ac2e11385 [CFG] Provide construction contexts for return value constructors.
When the current function returns a C++ object by value, CFG elements for
constructors that construct the return values can now be queried to discover
that they're indeed participating in construction of the respective return value
at the respective return statement.

Differential Revision: https://reviews.llvm.org/D42875

llvm-svn: 324952
2018-02-12 22:36:36 +00:00
Artem Dergachev 08225bbed4 [CFG] Provide construction contexts when constructors have cleanups.
Now that we make it possible to query the CFG constructor element to find
information about the construction site, possible cleanup work represented by
ExprWithCleanups should not prevent us from providing this information.

This allows us to have a correct construction context for variables initialized
"by value" via elidable copy-constructors, such as 'i' in

  iterator i = vector.begin();

Differential Revision: https://reviews.llvm.org/D42719

llvm-svn: 324798
2018-02-10 02:46:14 +00:00
Artem Dergachev 5a281bba40 [CFG] Add construction context for constructor initializers.
CFG elements for constructors of fields and base classes that are being
initialized before the body of the whole-class constructor starts can now be
queried to discover that they're indeed participating in initialization of their
respective fields or bases before the whole-class constructor kicks in.

CFG construction contexts are now capable of representing CXXCtorInitializer
triggers, which aren't considered to be statements in the Clang AST.

Differential Revision: https://reviews.llvm.org/D42700

llvm-svn: 324796
2018-02-10 02:18:04 +00:00
Artem Dergachev 5fc10337a2 [CFG] Add construction context for simple variable declarations.
Constructors of simple variables now can be queried to discover that they're
constructing into simple variables.

Differential Revision: https://reviews.llvm.org/D42699

llvm-svn: 324794
2018-02-10 01:55:23 +00:00
Artem Dergachev 675d6f4df2 [CFG] Squash an unused variable introduced in r324668.
Found by -Werror buildbot.

llvm-svn: 324697
2018-02-09 01:43:26 +00:00
Artem Dergachev 41ffb30716 [CFG] Add extra context to C++ constructor statement elements.
This patch adds a new CFGStmt sub-class, CFGConstructor, which replaces
the regular CFGStmt with CXXConstructExpr in it whenever the CFG has additional
information to provide regarding what sort of object is being constructed.

It is useful for figuring out what memory is initialized in client of the
CFG such as the Static Analyzer, which do not operate by recursive AST
traversal, but instead rely on the CFG to provide all the information when they
need it. Otherwise, the statement that triggers the construction and defines
what memory is being initialized would normally occur after the
construct-expression, and the client would need to peek to the next CFG element
or use statement parent map to understand the necessary facts about
the construct-expression.

As a proof of concept, CFGConstructors are added for new-expressions
and the respective test cases are provided to demonstrate how it works.

For now, the only additional data contained in the CFGConstructor element is
the "trigger statement", such as new-expression, which is the parent of the
constructor. It will be significantly expanded in later commits. The additional
data is organized as an auxiliary structure - the "construction context",
which is allocated separately from the CFGElement.

Differential Revision: https://reviews.llvm.org/D42672

llvm-svn: 324668
2018-02-08 22:58:15 +00:00
Artem Dergachev be07303569 [analyzer] Self-debug: Dump environment frame-by-frame.
It makes it easier to discriminate between values of similar expressions
in different stack frames.

It also makes the separate backtrace section in ExplodedGraph dumps redundant.

Differential Revision: https://reviews.llvm.org/D42552

llvm-svn: 324660
2018-02-08 22:24:38 +00:00
George Karpenkov 59202324a5 [analyzer] Fix yet-another-crash in body-farming std::call_once
Crash occurs when parameters to the callback and to std::call_once
mismatch, and C++ is supposed to auto-construct an argument.

Filed by Alexander Kornienko in
https://bugs.llvm.org/show_bug.cgi?id=36149

rdar://37034403

Differential Revision: https://reviews.llvm.org/D42777

llvm-svn: 324046
2018-02-02 01:44:07 +00:00
Malcolm Parsons 51d3fb045e Fix typos of occurred and occurrence
llvm-svn: 323316
2018-01-24 10:26:09 +00:00
Richard Smith e97654b2f2 Handle scoped_lockable objects being returned by value in C++17.
In C++17, guaranteed copy elision means that there isn't necessarily a
constructor call when a local variable is initialized by a function call that
returns a scoped_lockable by value. In order to model the effects of
initializing a local variable with a function call returning a scoped_lockable,
pretend that the move constructor was invoked within the caller at the point of
return.

llvm-svn: 322316
2018-01-11 22:13:57 +00:00
Aaron Ballman a503855906 Track in the AST whether the operand to a UnaryOperator can overflow and then use that logic when evaluating constant expressions and emitting codegen.
llvm-svn: 322074
2018-01-09 13:07:03 +00:00
Benjamin Kramer 0742090e3d [AST] Inline CompoundStmt contents into the parent allocation.
Saves a pointer on every CompoundStmt.

llvm-svn: 321429
2017-12-24 16:24:20 +00:00
Benjamin Kramer acfa339e15 Refactor overridden methods iteration to avoid double lookups.
Convert most uses to range-for loops. No functionality change intended.

llvm-svn: 320954
2017-12-17 23:52:45 +00:00
Richard Smith c70f1d63f8 [c++20] P0515R3: Parsing support and basic AST construction for operator <=>.
Adding the new enumerator forced a bunch more changes into this patch than I
would have liked. The -Wtautological-compare warning was extended to properly
check the new comparison operator, clang-format needed updating because it uses
precedence levels as weights for determining where to break lines (and several
operators increased their precedence levels with this change), thread-safety
analysis needed changes to build its own IL properly for the new operator.

All "real" semantic checking for this operator has been deferred to a future
patch. For now, we use the relational comparison rules and arbitrarily give
the builtin form of the operator a return type of 'void'.

llvm-svn: 320707
2017-12-14 15:16:18 +00:00
Eugene Zelenko 38c70521ff [Analysis] Fix some Clang-tidy modernize and Include What You Use warnings; other minor fixes (NFC).
llvm-svn: 320091
2017-12-07 21:55:09 +00:00
Devin Coughlin cc5915a5e1 [analyzer] Teach RetainCountChecker about CoreMedia APIs
Teach the retain-count checker that CoreMedia reference types use
CoreFoundation-style reference counting. This enables the checker
to catch leaks and over releases of those types.

rdar://problem/33599757

llvm-svn: 318979
2017-11-25 14:57:42 +00:00
Aleksei Sidorin 124f5de841 [Analyzer] Stable iteration on indirect goto LabelDecl's to avoid non-determinism (attempt 2)
CFG wass built in non-deterministic order due to the fact that indirect
goto labels' declarations (LabelDecl's) are stored in the llvm::SmallSet
container. LabelDecl's are pointers, whose order is not deterministic,
and llvm::SmallSet sorts them by their non-deterministic addresses after
"small" container is exceeded. This leads to non-deterministic processing
of the elements of the container.

The fix is to use llvm::SmallSetVector that was designed to have
deterministic iteration order.

Patch by Ilya Palachev!

Differential Revision: https://reviews.llvm.org/D40073

llvm-svn: 318754
2017-11-21 11:27:47 +00:00
Devin Coughlin 046833e5fb [analyzer] Model correct dispatch_once() 'done' value in BodyFarm
The analyzer's BodyFarm models dispatch_once() by comparing the passed-in
predicate against a known 'done' value. If the predicate does not have that
value, the model updates the predicate to have that value and executes the
passed in block.

Unfortunately, the current model uses the wrong 'done' value: 1 instead of ~0.
This interferes with libdispatch's static inline function _dispatch_once(),
which enables a fast path if the block has already been executed. That function
uses __builtin_assume() to tell the compiler that the done flag is set to ~0 on
exit. When r302880 added modeling of __builtin_assume(), this caused the
analyzer to assume 1 == ~0. This in turn caused the analyzer to never explore any code after a call to dispatch_once().

This patch regains the missing coverage by updating BodyFarm to use the correct
'done' value.

rdar://problem/34413048

Differential Revision: https://reviews.llvm.org/D39691

llvm-svn: 317516
2017-11-06 22:12:19 +00:00
George Karpenkov 0354483013 [analyzer] do not crash on libcxx03 call_once implementation
Addresses https://bugs.llvm.org/show_bug.cgi?id=35075, rdar://35230961

Differential Revision: https://reviews.llvm.org/D39518

llvm-svn: 317293
2017-11-03 00:36:03 +00:00
George Karpenkov 050b53b311 [analyzer] Removing unused stored field.
llvm-svn: 317070
2017-11-01 02:29:04 +00:00
George Karpenkov ed017b634c [Analyzer] Use value storage for BodyFarm
Differential Revision: https://reviews.llvm.org/D39428

llvm-svn: 317065
2017-11-01 01:36:01 +00:00
George Karpenkov 134d8473ef [Analyzer] Give more descriptive name to BdyFrm field.
Discussion at: https://reviews.llvm.org/D39220

llvm-svn: 316617
2017-10-25 21:49:41 +00:00
George Karpenkov a132938295 [Analyzer] Remove spaces inside comments mentioning the parameter name,
to aid clang-tidy comprehension.
Requested by @alexfh in https://reviews.llvm.org/D39015

llvm-svn: 316539
2017-10-25 00:03:45 +00:00
George Karpenkov 506ecbb946 [Analyzer] Store BodyFarm in std::unique_ptr
Differential Revision: https://reviews.llvm.org/D39220

llvm-svn: 316536
2017-10-24 23:53:19 +00:00
George Karpenkov 0501f97cef [Analyzer] Fix for the memory leak: fix typo in if-statement.
llvm-svn: 316403
2017-10-24 01:09:43 +00:00
George Karpenkov 98e81cd3be [Analyzer] Handle implicit function reference in bodyfarming std::call_once
Differential Revision: https://reviews.llvm.org/D39201

llvm-svn: 316402
2017-10-24 00:13:18 +00:00
George Karpenkov 3d64d6ee54 [Analyzer] Do not use static storage to for implementations created in BodyFarm.cpp
Differential Revision: https://reviews.llvm.org/D39208

llvm-svn: 316400
2017-10-23 23:59:52 +00:00
George Karpenkov bd4254c692 [Analyzer] Correctly handle parameters passed by reference when bodyfarming std::call_once
Explicitly not supporting functor objects.

Differential Revision: https://reviews.llvm.org/D39031

llvm-svn: 316249
2017-10-20 23:29:59 +00:00
George Karpenkov b2a60c6a9b [Analyzer] Always use non-reference types when creating expressions in BodyFarm.
Remove an option to use a reference type (on by default!) since a
non-reference type is always needed for creating expressions, functions
with multiple boolean parameters are very hard to use, and in general it
was just a booby trap for further crashes.
Furthermore, generalize call_once test case to fix some of the crashes mentioned
https://bugs.llvm.org/show_bug.cgi?id=34869
Also removes std::call_once crash.

Differential Revision: https://reviews.llvm.org/D39015

llvm-svn: 316041
2017-10-17 22:28:18 +00:00
George Karpenkov c928e1f595 [Analyzer] Support bodyfarming libstdc++ implementation of std::call_once.
Differential Revision: https://reviews.llvm.org/D38810

llvm-svn: 315508
2017-10-11 20:53:01 +00:00
George Karpenkov 8b53f7ca6d [Analyzer] Do not segfault on unexpected call_once implementation
Fixes https://bugs.llvm.org/show_bug.cgi?id=34869

Differential Revision: https://reviews.llvm.org/D38702

llvm-svn: 315250
2017-10-09 23:20:46 +00:00
George Karpenkov 6dda6712cc [Analyzer] Avoid copy and modifying passed reference in BodyFarm::create_call_once
Differential Revision: https://reviews.llvm.org/D38475

llvm-svn: 314722
2017-10-02 21:01:46 +00:00
Davide Italiano 4c1d2256ff [Analysis] Remove unused makeLvalueToRValue variant.
llvm-svn: 314605
2017-09-30 21:49:15 +00:00
George Karpenkov 657a5896b1 [Analyzer] Synthesize function body for std::call_once
Differential Revision: https://reviews.llvm.org/D37840

llvm-svn: 314571
2017-09-30 00:03:22 +00:00
Alexander Shaposhnikov 195b25cf3c [clang] Add getUnsignedPointerDiffType method
C11 standard refers to the unsigned counterpart of the type ptrdiff_t 
in the paragraph 7.21.6.1p7 where it defines the format specifier %tu.
In Clang (in PrintfFormatString.cpp, lines 508-510) there is a FIXME for this case,
in particular, Clang didn't diagnose %tu issues at all, i.e.
it didn't emit any warnings on the code printf("%tu", 3.14).
In this diff we add a method getUnsignedPointerDiffType for getting the corresponding type
similarly to how it's already done in the other analogous cases (size_t, ssize_t, ptrdiff_t etc)
and fix -Wformat diagnostics for %tu plus the emitted fix-it as well.

Test plan: make check-all

Differential revision: https://reviews.llvm.org/D38270

llvm-svn: 314470
2017-09-28 23:11:31 +00:00
Nico Weber b688d131f0 Consolidate std::move() detection code. No behavior change.
llvm-svn: 314427
2017-09-28 16:16:39 +00:00
Sjoerd Meijer cc623ad071 Recommit "Add _Float16 as a C/C++ source language type"
This is a recommit of r312781; in some build configurations
variable names are omitted, so changed the new regression
test accordingly.

llvm-svn: 312794
2017-09-08 15:15:00 +00:00
Sjoerd Meijer 9aeedde7ff Revert "Add _Float16 as a C/C++ source language type"
The clang-with-lto-ubuntu bot didn't like the new regression
test, revert while I investigate the issue.

llvm-svn: 312784
2017-09-08 10:20:52 +00:00
Sjoerd Meijer ab36f33db8 Add _Float16 as a C/C++ source language type
This adds _Float16 as a source language type, which is a 16-bit floating point
type defined in C11 extension ISO/IEC TS 18661-3.

In follow up patches documentation and more tests will be added.

Differential Revision: https://reviews.llvm.org/D33719

llvm-svn: 312781
2017-09-08 09:42:32 +00:00
George Karpenkov 50657f6bd6 [CSA] [NFC] Move AnalysisContext.h to AnalysisDeclContext.h
The implementation is in AnalysisDeclContext.cpp and the class is called
AnalysisDeclContext.

Making those match up has numerous benefits, including:

 - Easier jump from header to/from implementation.
 - Easily identify filename from class.

Differential Revision: https://reviews.llvm.org/D37500

llvm-svn: 312671
2017-09-06 21:45:03 +00:00
Johannes Altmanninger 1509da083a [AST] Add TableGen for StmtDataCollectors
Summary:
This adds an option "-gen-clang-data-collectors" to the Clang TableGen
that is used to generate StmtDataCollectors.inc.

Reviewers: arphaman, teemperor!

Subscribers: mgorny, cfe-commits

Differential Revision: https://reviews.llvm.org/D37383

llvm-svn: 312634
2017-09-06 13:20:51 +00:00
Raphael Isemann 785e8161ad [analyzer] MinComplexityConstraint now early exits and only does one macro stack lookup
Summary:
This patch contains performance improvements for the `MinComplexityConstraint`. It reduces the constraint time when running on the SQLite codebase by around 43% (from 0.085s down to 0.049s).

The patch is essentially doing two things:

* It introduces a possibility for the complexity value to early exit when reaching the limit we were checking for. This means that once we noticed that the current clone is larger than the limit the user has set, we instantly exit and no longer traverse the tree or do further expensive lookups in the macro stack.

* It also removes half of the macro stack lookups we do so far. Previously we always checked the start and the end location of a Stmt for macros, which was only a middle way between checking all locations of the Stmt and just checking one location. In practice I rarely found cases where it really matters if we check start/end or just the start of a statement as code with lots of macros that somehow just produce half a statement are very rare.

Reviewers: NoQ

Subscribers: cfe-commits, xazax.hun, v.g.vassilev

Differential Revision: https://reviews.llvm.org/D34361

llvm-svn: 312440
2017-09-03 13:45:33 +00:00
Benjamin Kramer 0b94bfc709 std::function -> llvm::function_ref. NFC.
llvm-svn: 312336
2017-09-01 16:51:51 +00:00
Raphael Isemann 70686a1590 [analyzer] Performance optimizations for the CloneChecker
Summary:
This patch  aims at optimizing the CloneChecker for larger programs. Before this
patch we took around 102 seconds to analyze sqlite3 with a complexity value of
50. After this patch we now take 2.1 seconds to analyze sqlite3.

The biggest performance optimization is that we now put the constraint for group
size before the constraint for the complexity. The group size constraint is much
faster in comparison to the complexity constraint as it only does a simple
integer comparison. The complexity constraint on the other hand actually
traverses each Stmt and even checks the macro stack, so it is obviously not able
to handle larger amounts of incoming clones. The new order filters out all the
single-clone groups that the type II constraint generates in a faster way before
passing the fewer remaining clones to the complexity constraint. This reduced
runtime by around 95%.

The other change is that we also delay the verification part of the type II
clones back in the chain of constraints. This required to split up the
constraint into two parts - a verification and a hash constraint (which is also
making it more similar to the original design of the clone detection algorithm).
The reasoning for this is the same as before: The verification constraint has to
traverse many statements and shouldn't be at the start of the constraint chain.
However, as the type II hashing has to be the first step in our algorithm, we
have no other choice but split this constrain into two different ones. Now our
group size and complexity constrains filter out a chunk of the clones before
they reach the slow verification step, which reduces the runtime by around 8%.

I also kept the full type II constraint around - that now just calls it's two
sub-constraints - in case someone doesn't care about the performance benefits
of doing this.

Reviewers: NoQ

Reviewed By: NoQ

Subscribers: klimek, v.g.vassilev, xazax.hun, cfe-commits

Differential Revision: https://reviews.llvm.org/D34182

llvm-svn: 312222
2017-08-31 07:10:46 +00:00
Johannes Altmanninger 1a2676924a [analyzer] Make StmtDataCollector customizable
Summary:
This moves the data collection macro calls for Stmt nodes
to lib/AST/StmtDataCollectors.inc

Users can subclass ConstStmtVisitor and include StmtDataCollectors.inc
to define visitor methods for each Stmt subclass. This makes it also
possible to customize the visit methods as exemplified in
lib/Analysis/CloneDetection.cpp.

Move helper methods for data collection to a new module,
AST/DataCollection.

Add data collection for DeclRefExpr, MemberExpr and some literals.

Reviewers: arphaman, teemperor!

Subscribers: mgorny, xazax.hun, cfe-commits

Differential Revision: https://reviews.llvm.org/D36664

llvm-svn: 311569
2017-08-23 16:28:26 +00:00
Nico Weber 699670e764 Implement CFG construction for __try / __except / __leave.
This makes -Wunreachable-code work for programs containing SEH (except for
__finally, which is still missing for now).

__try is modeled like try (but simpler since it can only have a single __except
or __finally), __except is fairly similar to catch (but simpler, since it can't
contain declarations). __leave is implemented similarly to break / continue.

Use the existing addTryDispatchBlock infrastructure (which
FindUnreachableCode() in ReachableCode.cpp uses via cfg->try_blocks_begin()) to
mark things in the __except blocks as reachable.

Re-use TryTerminatedBlock. This means we add EH edges from calls to the __try
block, but not from all other statements. While this is incomplete, it matches
LLVM's SEH codegen support. Also, in practice, BuildOpts.AddEHEdges is always
false in practice from what I can tell, so we never even insert the call EH
edges either.

https://reviews.llvm.org/D36914

llvm-svn: 311561
2017-08-23 15:33:16 +00:00
Peter Szecsi 999a25ff72 [CFG] Add LoopExit information to CFG
This patch introduces a new CFG element CFGLoopExit that indicate when a loop
ends. It does not deal with returnStmts yet (left it as a TODO).
It hidden behind a new analyzer-config flag called cfg-loopexit (false by
default).
Test cases added.

The main purpose of this patch right know is to make loop unrolling and loop
widening easier and more efficient. However, this information can be useful for
future improvements in the StaticAnalyzer core too.

Differential Revision: https://reviews.llvm.org/D35668

llvm-svn: 311235
2017-08-19 11:19:16 +00:00
Josh Gao ec1369ed6e Reland "Thread Safety Analysis: fix assert_capability."
Delete the test that was broken by rL309725, and add it back in a
follow up commit. Also, improve the tests a bit.

Reviewers: delesley, aaron.ballman

Differential Revision: https://reviews.llvm.org/D36237

llvm-svn: 310402
2017-08-08 19:44:34 +00:00