Commit Graph

10 Commits

Author SHA1 Message Date
Jordy Rose 674bd55f02 Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.
Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577
2010-07-04 00:00:41 +00:00
Jordy Rose dc48471861 Pointers casted as integers still count as locations to SimpleSValuator, so don't crash if we do a funny thing like ((int)ptr)&1. Fixes PR7527.
llvm-svn: 107236
2010-06-30 01:35:20 +00:00
Jordy Rose 61176897ba Pointer comparisons (and pointer-pointer subtraction). Basically filling in SimpleSValuator::EvalBinOpLL().
llvm-svn: 106992
2010-06-28 08:26:15 +00:00
Jordy Rose 79404afc1c When folding additive operations, convert the values to the same type. When assuming relationships, convert the integers to the same type as the symbol, at least for now.
llvm-svn: 106458
2010-06-21 20:15:15 +00:00
Benjamin Kramer 22a544bc82 Add braces to avoid an ambiguous else, fixing a GCC warning.
llvm-svn: 106403
2010-06-20 10:20:36 +00:00
Jordy Rose 895c899142 Adds analyzer support for idempotent and tautological binary operations such as "a*0" and "a+0". This is not very powerful, but does make the analyzer look a little smarter than it actually is.
llvm-svn: 106402
2010-06-20 04:56:29 +00:00
Jordy Rose c0fe8429f2 Fold additive constants, and support comparsions of the form $sym+const1 <> const2
llvm-svn: 106339
2010-06-18 22:49:11 +00:00
Ted Kremenek ef55dd17ec Static analyzer: Don't crash when casting a symbolic region address to a float. Fixes PR 6854.
llvm-svn: 101499
2010-04-16 17:54:33 +00:00
Zhongxing Xu 0d081f373a Remove unused parameter.
llvm-svn: 95364
2010-02-05 05:24:20 +00:00
Ted Kremenek d6b8708643 Split libAnalysis into two libraries: libAnalysis and libChecker.
(1) libAnalysis is a generic analysis library that can be used by
    Sema.  It defines the CFG, basic dataflow analysis primitives, and
    inexpensive flow-sensitive analyses (e.g. LiveVariables).

(2) libChecker contains the guts of the static analyzer, incuding the
    path-sensitive analysis engine and domain-specific checks.

Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.

This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker.  More changes pending.  :)

This change also exposed a layering violation between AnalysisContext
and MemRegion.  BlockInvocationContext shouldn't explicitly know about
BlockDataRegions.  For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet).  We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.

llvm-svn: 94406
2010-01-25 04:41:41 +00:00