Commit Graph

188 Commits

Author SHA1 Message Date
Ted Kremenek c5ab3a0eab StoreManager::NewCastRegion:
- Refactor logic that creates ElementRegions into a help method 'MakeElementRegion'.
- Fix crash due to not handling StringRegions.  Casts of StringRegions now
  result in a new ElementRegion layered on the original StringRegion.

llvm-svn: 74867
2009-07-06 22:23:45 +00:00
Ted Kremenek eea8c29aa3 Make 'BasicStoreManager' + 'NewCastRegion' testable from the command line using '-analyzer-store=basic-new-cast'.
llvm-svn: 74865
2009-07-06 21:58:46 +00:00
Ted Kremenek 0b0f206efa Fix a horrible CFG bug reported in <rdar://problem/7027684>. The wrong successor
block would get hooked up in some cases when processing empty compound
statements.

llvm-svn: 74743
2009-07-03 00:10:50 +00:00
Ted Kremenek 55e07efeed Add a FIXME to RegionStore, do some minor code cleanup, and get RegionStore to
pass misc-ps.m. Currently RegionStore/BasicStore don't do any special reasoning
about clang-style vectors, so we should return UnknownVal (in all cases) when
accessing their values via an array.

llvm-svn: 74660
2009-07-01 23:19:52 +00:00
Ted Kremenek 3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Ted Kremenek 02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Ted Kremenek 407d81b2cd Add another test case found due to an analyzer regression.
llvm-svn: 70600
2009-05-01 23:35:18 +00:00
Ted Kremenek 9c03f68206 Fix PR 4033: the analyzer shouldn't crash on computed gotos involving symbolic
target addresses.

llvm-svn: 69900
2009-04-23 17:49:43 +00:00
Ted Kremenek 35f875c136 Fix: <rdar://problem/6777209> false Dereference of null pointer in loop: pointer increment/decrement preserves non-nullness
When the StoreManager doesn't reason well about pointer-arithmetic, propagate
the non-nullness constraint on a pointer value when performing pointer
arithmetic uisng ++/--.

llvm-svn: 69741
2009-04-21 22:38:05 +00:00
Ted Kremenek b3b2395520 Split failing test case from misc-ps.m to misc-ps-ranges.m (which tests
functionality specific to RangeConstraintManager).

llvm-svn: 68759
2009-04-10 04:02:38 +00:00
Ted Kremenek 5054663daa Fix: <rdar://problem/6776949> Branch condition evaluates to an uninitialized value (argc is guaranteed to be >= 1)
The analyzer now adds the precondition that the first argument of 'main' is > 0.

llvm-svn: 68757
2009-04-10 00:59:50 +00:00
Ted Kremenek 40f4ee74fd Implement attribute "analyzer_noreturn" (<rdar://problem/6777003>). This allows
clients of the analyzer to designate custom assertion routines as "noreturn"
functions from the analyzer's perspective but not the compiler's.

llvm-svn: 68746
2009-04-10 00:01:14 +00:00
Ted Kremenek 9335fecc2a Update expected warning in test case.
llvm-svn: 68276
2009-04-02 02:52:13 +00:00
Daniel Dunbar a45cf5b6b0 Rename clang to clang-cc.
Tests and drivers updated, still need to shuffle dirs.

llvm-svn: 67602
2009-03-24 02:24:46 +00:00
Ted Kremenek c7fef2ad53 analyzer: Fix embarrassing regression in BasicStore when invalidating struct
values passed-by-reference to unknown functions.

llvm-svn: 67519
2009-03-23 15:42:58 +00:00
Ted Kremenek b36e01d87e Fix crash reported in <rdar://problem/6695527>. We now have
SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of
having BasicStoreManager do it (which wasn't always doing the check
consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in
one centralized place.

llvm-svn: 67245
2009-03-18 22:10:22 +00:00
Ted Kremenek be485b6c7d Fix StmtIterator bug reported in PR 3780 where a VLA within a DeclGroup would
not be consulted for its size expression when operator* was called in the
StmtIterator (this resulted in an assertion failure).

llvm-svn: 66679
2009-03-11 18:17:16 +00:00
Ted Kremenek 0fa538528e Fix PR 3780: In one code path in BasicValueFactory::getValue() we would not
return an unsigned integer for a null pointer value.

llvm-svn: 66630
2009-03-11 02:52:39 +00:00
Ted Kremenek 3f5a85ad06 SimpleConstraintManager doesn't reason about bitwise-constraints on symbolic
values. Indicating this in 'canReasonAbout' allows GRExprEngine to recover
path-sensitivity in some cases.

llvm-svn: 66628
2009-03-11 02:29:48 +00:00
Ted Kremenek fa3d77bc2c Retrofit some basic tracking of ivars (for the current object) into BasicStore.
llvm-svn: 66166
2009-03-05 18:08:28 +00:00
Ted Kremenek cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Ted Kremenek 47c853007e Enhance tests to exercise more combinations of using the RangeConstraintManager with the RegionStoreManager.
llvm-svn: 64788
2009-02-17 19:29:07 +00:00
Ted Kremenek b535181199 Static Analyzer driver/options (partial) cleanup:
- Move all analyzer options logic to AnalysisConsumer.cpp.
- Unified specification of stores/constraints/output to be:
   -analyzer-output=...
   -analyzer-store=...
   -analyzer-constraints=...
  instead of -analyzer-range-constraints, -analyzer-store-basic, etc.
- Updated drivers (ccc-analyzer, scan-builds, new ccc) to obey this new
  interface
- Updated test cases to conform to new driver options

llvm-svn: 64737
2009-02-17 04:27:41 +00:00
Ted Kremenek d25fb7a613 GRExprEngine: Handle empty statement expressions.
llvm-svn: 64541
2009-02-14 05:55:08 +00:00
Ted Kremenek 422d81dcd4 Fix bug in BasicStore::getLValueElement where if the base of an array subscript expression was an ElementRegion we stacked another ElementRegion on top of that.
This fixes PR 3422.

llvm-svn: 63110
2009-01-27 18:29:03 +00:00
Ted Kremenek 556c3709d6 The 'misc-ps.m' test case now passes with RegionStore. One case needed to be split out into 'misc-ps-basic-store.m' and 'misc-ps-region-store.m' because the behavior was different between the two store models (RegionStore flags an additional valid bug).
llvm-svn: 62772
2009-01-22 18:53:15 +00:00
Daniel Dunbar 34fc92fdc2 Add -analyze action to run static analyzer, instead of inferring from
individual checker options.

llvm-svn: 62634
2009-01-20 23:17:32 +00:00
Ted Kremenek 4299d5d2d8 Fix regression in handling sizeof(void) in the static analyzer.
llvm-svn: 61039
2008-12-15 18:51:00 +00:00
Ted Kremenek c28ce29a12 [static analyzer] Extend VLA size checking to look for undefined sizes.
llvm-svn: 60734
2008-12-09 00:44:16 +00:00
Ted Kremenek d7266bf20a Add zero-sized VLA check test case.
llvm-svn: 60731
2008-12-09 00:14:48 +00:00
Chris Lattner 2ca529ce61 instead of forcing blocks on by default, make them default to off, but let
specific targets default them to on.  Default blocks to on on 10.6 and later.
Add a -fblocks option that allows the user to override the target's default.
Use -fblocks in the various testcases that use blocks.

llvm-svn: 60563
2008-12-04 23:20:07 +00:00
Ted Kremenek 16866d6fd8 GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) of vector types. Add explicit checks that when we process integers that they really are scalars.
llvm-svn: 59225
2008-11-13 06:10:40 +00:00
Ted Kremenek 45698bf05f GRExprEngine::VisitInitListExpr:
- Don't crash on vector types.
- Handle typedefs.

llvm-svn: 59220
2008-11-13 05:05:34 +00:00
Ted Kremenek e69a1fa342 Do not crash when performing VisitLValue on union types.
This fixes PR 2948.

llvm-svn: 58148
2008-10-25 20:09:21 +00:00
Ted Kremenek c32ec3a0c4 Further improve path-sensitivity with divide-by-zero checking by assuming that a denominator cannot be zero even when the result of an '/' or '%' expression is unknown.
llvm-svn: 57855
2008-10-20 23:40:25 +00:00
Ted Kremenek e67437f3a9 Added test case inspired by <rdar://6268365>: recover path-sensitivity after compound assignment when the result of the assignment is not known.
llvm-svn: 57852
2008-10-20 23:14:31 +00:00
Ted Kremenek f8d65a30d6 Add support in GRExprEngine for UnaryOperator::AlignOf. This fixes one crash report in PR 2796.
llvm-svn: 57777
2008-10-18 22:20:20 +00:00
Ted Kremenek 63249b6e57 Added test case.
llvm-svn: 56915
2008-10-01 05:05:46 +00:00