Commit Graph

2649 Commits

Author SHA1 Message Date
DeLesley Hutchins 11a66c1240 Consumed analysis: All the return_typestate parameter to be attached to the
default constructor.  Patch by chris.wailes@gmail.com, reviewed by delesley.

llvm-svn: 192991
2013-10-18 18:36:21 +00:00
DeLesley Hutchins 6939177cea Consumed analysis: Add param_typestate attribute, which specifies that
function parameters must be in a particular state.  Patch by
chris.wailes@gmail.com.  Reviewed by delesley@google.com.

llvm-svn: 192934
2013-10-17 23:23:53 +00:00
DeLesley Hutchins 36ea1dd4fc Consumed Analysis: Allow parameters that are passed by non-const reference
to be treated as return values, and marked with the "returned_typestate"
attribute.  Patch by chris.wailes@gmail.com; reviewed by delesley@google.com.

llvm-svn: 192932
2013-10-17 22:53:04 +00:00
DeLesley Hutchins 6501320e72 Consumed analysis: fix ICE in handling of loop source locations.
llvm-svn: 192911
2013-10-17 18:19:31 +00:00
DeLesley Hutchins 33a293433f Consumed analysis: replace the consumes attribute with a set_typestate
attribute.  Patch by chris.wailes@gmail.com; reviewed and edited by delesley.

llvm-svn: 192515
2013-10-11 23:03:26 +00:00
DeLesley Hutchins 8d41d99502 Consumed analysis: switch from tests_consumed/unconsumed to a general
tests_typestate attribute.  Patch by chris.wailes@gmail.com.

llvm-svn: 192513
2013-10-11 22:30:48 +00:00
DeLesley Hutchins fbdee4e3c2 Consumed analysis: check destructor calls.
This allows the callable_when attribute to be attached to destructors.
Original patch by chris.wailes@gmail.com, reviewed and edited by delesley.

llvm-svn: 192508
2013-10-11 21:55:33 +00:00
DeLesley Hutchins 3277a6129b Consumed analysis: improve loop handling. The prior version of the analysis
marked all variables as "unknown" at the start of a loop.  The new version
keeps the initial state of variables unchanged, but issues a warning if the
state at the end of the loop is different from the state at the beginning.
This patch will eventually be replaced with a more precise analysis.

Initial patch by chris.wailes@gmail.com.  Reviewed and edited by
delesley@google.com.

llvm-svn: 192314
2013-10-09 18:30:24 +00:00
DeLesley Hutchins 210791a021 Consumed Analysis: Change callable_when so that it can take a list of states
that a function can be called in.  This reduced the total number of annotations
needed and makes writing more complicated behaviour less burdensome.
Patch by chriswails@gmail.com.

llvm-svn: 191983
2013-10-04 21:28:06 +00:00
Benjamin Kramer b8f33f1690 Make sort predicate match the qsort convention.
llvm-svn: 191177
2013-09-22 15:02:02 +00:00
Benjamin Kramer 04bf187e12 Fix array_pod_sort predicates after LLVM change.
llvm-svn: 191176
2013-09-22 14:10:29 +00:00
Richard Smith ba8071ec81 PR16054: Slight strengthening for -Wsometimes-uninitialized: if we use a
variable uninitialized every time we reach its (reachable) declaration, or
every time we call the surrounding function, promote the warning from
-Wmaybe-uninitialized to -Wsometimes-uninitialized.

This is still slightly weaker than desired: we should, in general, warn
if a use is uninitialized the first time it is evaluated.

llvm-svn: 190623
2013-09-12 18:49:10 +00:00
DeLesley Hutchins 85c07d9a93 Fix ICE in consumed analysis when CFG is null.
llvm-svn: 190447
2013-09-10 23:10:10 +00:00
Matt Beaumont-Gay 093f240a73 Fix a crash introduced in r189828.
The predicates in CXXRecordDecl which test various properties of special
members can't be called on incomplete decls.

llvm-svn: 190353
2013-09-09 21:07:58 +00:00
Pavel Labath 921e7650d4 Avoid double edges when constructing CFGs
Summary:
If a noreturn destructor is executed while returning a value from a function,
the resulting CFG has had two edges to the exit block. This crashed the analyzer,
because it expects that blocks with no terminators have only one outgoing edge.
I added code to avoid creating the second edge in this case.

PS: The crashes did not manifest themselves always, as usually the
NoReturnFunctionChecker would stop program evaluation before the analyzer hit
the assertion, but in the case of lifetime extended temporaries, the checker
failed to do that (which is a separate bug in itself).

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1513

llvm-svn: 190125
2013-09-06 08:12:48 +00:00
David Blaikie 16f76d27ae Consumed Analysis: The 'consumable' attribute now takes a identifier specifying the default assumed state for objects of this class
This information is used for return states and pass-by-value parameter
states.

Patch by Chris Wailes.

Review by DeLesley Hutchins and Aaron Ballman.

llvm-svn: 190116
2013-09-06 01:28:43 +00:00
Eric Christopher de156243e1 Fix non-void return warning, and format.
llvm-svn: 189845
2013-09-03 20:43:00 +00:00
DeLesley Hutchins fc368259af Consumed analysis: add return_typestate attribute.
Patch by chris.wailes@gmail.com

Functions can now declare what state the consumable type the are returning will
be in. This is then used on the caller side and checked on the callee side.
Constructors now use this attribute instead of the 'consumes' attribute.

llvm-svn: 189843
2013-09-03 20:11:38 +00:00
Jordan Rose d2f4079db9 Add an implicit dtor CFG node just before C++ 'delete' expressions.
This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

  1. <expr>
  2. [B1.1]->~Foo() (Implicit destructor)
  3. delete [B1.1]

Patch by Karthik Bhat!

llvm-svn: 189828
2013-09-03 17:00:57 +00:00
Pavel Labath d527cf89e6 [analyzer] Add very limited support for temporary destructors
This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors.  However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

llvm-svn: 189746
2013-09-02 09:09:15 +00:00
DeLesley Hutchins 5a715c4f00 Consumed analysis: add 'consumable' class attribute.
Patch by chris.wailes@gmail.com

Adds the 'consumable' attribute that can be attached to classes.  This replaces
the previous method of scanning a class's methods to see if any of them have
consumed analysis attributes attached to them.  If consumed analysis attributes
are attached to methods of a class that isn't marked 'consumable' a warning
is generated.

llvm-svn: 189702
2013-08-30 22:56:34 +00:00
DeLesley Hutchins b570c13574 Consumed analysis: track function parameters.
Patch by chris.wailes@gmail.com.

llvm-svn: 189616
2013-08-29 22:36:05 +00:00
DeLesley Hutchins 7fa60edb47 Consumed analysis: non-const methods no longer transfer an object into an
unknown state.  Patch by chris.wailes@gmail.com.

llvm-svn: 189612
2013-08-29 21:17:25 +00:00
Aaron Ballman a21f4b8ddd Silencing the warning from r189605 in a more conformant manner.
llvm-svn: 189606
2013-08-29 20:36:09 +00:00
Aaron Ballman 130db36d80 Silencing a rather spurious warning from MSVC 11 about not all control paths returning a value (hint: they do).
llvm-svn: 189605
2013-08-29 20:25:14 +00:00
Eric Christopher f8a1baab9d Fix warning about anonymous structs in anonymous unions.
llvm-svn: 189596
2013-08-29 18:00:58 +00:00
DeLesley Hutchins 5533ec5c55 Consumed analysis: improve handling of conditionals.
Patch by chris.wailes@gmail.com.

* The TestedVarsVisitor was folded into the ConsumedStmtVisitor.
* The VarTestResult class was updated to allow these changes.
* The PropagationInfo class was updated for the same reasons.
* Correctly handle short-circuiting of Boolean operations.
* Blocks are now marked as unreachable when we can statically prove we will
  never branch to them.
* Unreachable blocks are skipped by the analysis.

llvm-svn: 189594
2013-08-29 17:26:57 +00:00
DeLesley Hutchins 2445b1212a Consumed analyis: Renamed *PStatus to *PInfo.
The change was made for readability, as the PropagationInfo objects don't
always contain a status.  This is submitted as a separate patch because it
touches a lot of lines and I don't want it cluttering up the next patch.
Patch by chris.wailes@gmail.com.

llvm-svn: 189278
2013-08-26 20:34:59 +00:00
Robert Wilhelm 25284cc95b Use pop_back_val() instead of both back() and pop_back().
No functionality change intended.

llvm-svn: 189112
2013-08-23 16:11:15 +00:00
Pavel Labath 02b64d46a0 [analyzer] Refactor conditional expression evaluating code
Summary:
Instead of digging through the ExplodedGraph, to figure out which edge brought
us here, I compute the value of conditional expression by looking at the
sub-expression values.

To do this, I needed to change the liveness algorithm a bit -- now, the full
conditional expression also depends on all atomic sub-expressions, not only the
outermost ones.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1340

llvm-svn: 189090
2013-08-23 07:19:22 +00:00
DeLesley Hutchins c2ecf0d815 Update to consumed analysis.
Patch by chris.wailes@gmail.com.  The following functionality was added:

* The same functionality is now supported for both CXXOperatorCallExprs and CXXMemberCallExprs.
* Factored out some code in StmtVisitor.
* Removed variables from the state map when their destructors are encountered.
* Started adding documentation for the consumed analysis attributes.

llvm-svn: 189059
2013-08-22 20:44:47 +00:00
David Majnemer a39da8e236 Analysis: Make %I in printf more reasonable, add more tests
llvm-svn: 188992
2013-08-22 07:53:21 +00:00
David Majnemer 3cba495abc Analysis: Add support for MS specific printf format specifiers
Summary: Adds support for %I, %I32 and %I64.

Reviewers: hans, jordan_rose, rnk, majnemer

Reviewed By: majnemer

CC: cfe-commits, cdavis5x

Differential Revision: http://llvm-reviews.chandlerc.com/D1456

llvm-svn: 188937
2013-08-21 21:54:46 +00:00
Jordan Rose 5374c07ab9 Omit arguments of __builtin_object_size from the CFG.
This builtin does not actually evaluate its arguments for side effects,
so we shouldn't include them in the CFG. In the analyzer, rely on the
constant expression evaluator to get the proper semantics, at least for
now. (In the future, we could get ambitious and try to provide path-
sensitive size values.)

In theory, this does pose a problem for liveness analysis: a variable can
be used within the __builtin_object_size argument expression but not show
up as live. However, it is very unlikely that such a value would be used
to compute the object size and not used to access the object in some way.

<rdar://problem/14760817>

llvm-svn: 188679
2013-08-19 16:27:28 +00:00
DeLesley Hutchins 9f5193cf61 Thread Safety Analysis: fix bug when using TryLock with && and || expressions.
llvm-svn: 188505
2013-08-15 23:06:33 +00:00
Eli Friedman 89fe0d5842 Properly track l-paren of a CXXFucntionalCastExpr.
In addition to storing more useful information in the AST, this
fixes a semantic check in template instantiation which checks whether
the l-paren location is valid.

Fixes PR16903.

llvm-svn: 188495
2013-08-15 22:02:56 +00:00
DeLesley Hutchins 16b4ff5c4d Thread safety analysis: move warnings within lock/unlock functions out of beta.
llvm-svn: 188465
2013-08-15 15:31:25 +00:00
Reid Kleckner 6454d0a0fa Silence a warning from MSVC about not returning a value
llvm-svn: 188237
2013-08-13 00:11:59 +00:00
Reid Kleckner e846deae3c Remove Sema includes from Analysis code to fix layering
This moves a header-only class from Sema to Analysis and puts the option
check in Sema.

Patch by Chris Wailes!

llvm-svn: 188230
2013-08-12 23:49:39 +00:00
Hans Wennborg 812a9ec9c2 Speculative build fix for r188206.
The cmake-clang-x86_64 was upset:
error: 'template<class ImplClass, class RetTy> class clang::ConstStmtVisitor' used without template parameters

llvm-svn: 188211
2013-08-12 22:02:09 +00:00
DeLesley Hutchins 48a317663f Patch by Chris Wailes <chris.wailes@gmail.com>.
Reviewed by delesley, dblaikie.

Add the annotations and code needed to support a basic 'consumed' analysis.

Summary:
This new analysis is based on academic literature on linear types.  It tracks
the state of a value, either as unconsumed, consumed, or unknown.  Methods are
then annotated as CallableWhenUnconsumed, and when an annotated method is
called while the value is in the 'consumed' state a warning is issued.  A value
may be tested in the conditional statement of an if-statement; when this occurs
we know the state of the value in the different branches, and this information
is added to our analysis.  The code is still highly experimental, and the names
of annotations or the algorithm may be subject to change.

llvm-svn: 188206
2013-08-12 21:20:55 +00:00
Jordan Rose e9c57229f9 [analyzer] Include analysis stack in crash traces.
Sample output:

0.     Program arguments: ...
1.     <eof> parser at end of file
2.     While analyzing stack:
       #0 void inlined()
       #1 void test()
3.     crash-trace.c:6:3: Error evaluating statement

llvm-svn: 186639
2013-07-19 00:59:08 +00:00
Richard Smith 5a0ef78cd7 Remove bogus VarDecl::extendsLifetimeOfTemporary function and inline it into
its only caller with a FIXME explaining why it's bogus.

llvm-svn: 185109
2013-06-27 21:43:17 +00:00
Aaron Ballman fcd5b7e76e Updating a link in the comments; no functional change.
llvm-svn: 185013
2013-06-26 19:17:19 +00:00
Anna Zaks 56b4975bad [CFG] Set the “loop target” (back edge) for VisitObjCForCollectionStmt loops
Add the back edge info by creating a basic block, marked as loop target. This is
consistent with how other loops are processed, but was omitted from
VisitObjCForCollectionStmt.

llvm-svn: 184617
2013-06-22 00:23:20 +00:00
Jordan Rose cf10ea8cb2 [analyzer; new edges] Simplify edges in a C++11 for-range loop.
Previously our edges were completely broken here; now, the final result
is a very simple set of edges in most cases: one up to the "for" keyword
for context, and one into the body of the loop. This matches the behavior
for ObjC for-in loops.

In the AST, however, CXXForRangeStmts are handled very differently from
ObjCForCollectionStmts. Since they are specified in terms of equivalent
statements in the C++ standard, we actually have implicit AST nodes for
all of the semantic statements. This makes evaluation very easy, but
diagnostic locations a bit trickier. Fortunately, the problem can be
generally defined away by marking all of the implicit statements as
part of the top-level for-range statement.

One of the implicit statements in a for-range statement is the declaration
of implicit iterators __begin and __end. The CFG synthesizes two
separate DeclStmts to match each of these decls, but until now these
synthetic DeclStmts weren't in the function's ParentMap. Now, the CFG
keeps track of its synthetic statements, and the AnalysisDeclContext will
make sure to add them to the ParentMap.

<rdar://problem/14038483>

llvm-svn: 183449
2013-06-06 21:53:45 +00:00
David Majnemer f69ce86048 Analysis: Add a CFG successor to a SwitchStmt if it is both empty and fully covered
Consider the case where a SwitchStmt satisfied isAllEnumCasesCovered()
as well as having no cases at all (i.e. the enum it covers has no
enumerators).

In this case, we should add a successor to repair the CFG.

This fixes PR16212.

llvm-svn: 183237
2013-06-04 17:38:44 +00:00
Jordan Rose 5250b873bb CFG: In a DeclStmt, skip anything that's not a VarDecl.
Neither the compiler nor the analyzer are doing anything with non-VarDecl
decls in the CFG, and having them there creates extra nodes in the
analyzer's path diagnostics. Simplify the CFG (and the path edges) by
simply leaving them out. We can always add interesting decls back in when
they become relevant.

Note that this only affects decls declared in a DeclStmt, and then only
those that appear within a function body.

llvm-svn: 183157
2013-06-03 22:59:41 +00:00
DeLesley Hutchins 3b2c66bbda Thread safety analysis: fix use after free bug reported by Evgeniy Stepanov.
llvm-svn: 182305
2013-05-20 17:57:55 +00:00
Jordan Rose 433b0f5455 Revert "[analyzer; alternate edges] improve support for edges with PseudoObjectExprs."
Ted and I spent a long time discussing this today and found out that neither
the existing code nor the new code was doing what either of us thought it
was, which is never good. The good news is we found a much simpler way to
fix the motivating test case (an ObjCSubscriptExpr).

This reverts r182083, but pieces of it will come back in subsequent commits.

llvm-svn: 182185
2013-05-18 02:26:50 +00:00
DeLesley Hutchins b682431775 Thread safety analysis: add two new attributes to the thread safety analysis:
assert_exclusive_lock and assert_shared_lock.  These attributes are used to
mark functions that dynamically check (i.e. assert) that a lock is held.

llvm-svn: 182170
2013-05-17 23:02:59 +00:00
Ted Kremenek 35de14540f [analyzer; alternate edges] improve support for edges with PseudoObjectExprs.
This optimizes some spurious edges resulting from PseudoObjectExprs.
This required far more changes than I anticipated.  The current
ParentMap does not record any hierarchy information between
a PseudoObjectExpr and its *semantic* expressions that may be
wrapped in OpaqueValueExprs, which are the expressions actually
laid out in the CFG.  This means the arrow pruning logic could
not map from an expression to its containing PseudoObjectExprs.

To solve this, this patch adds a variant of ParentMap that
returns the "semantic" parentage of expressions (essentially
as they are viewed by the CFG).  This alternate ParentMap is then
used by the arrow reducing logic to identify edges into pseudo
object expressions, and then eliminate them.

llvm-svn: 182083
2013-05-17 09:41:40 +00:00
Jordan Rose a7f94ce8a3 Remove unused, awkward CFGStmtVisitor and subclasses.
This class is a StmtVisitor that distinguishes between block-level and
non-block-level statements in a CFG. However, it does so using a hard-coded
idea of which statements might be block-level, which probably isn't accurate
anymore. The only implementer of the CFGStmtVisitor hierarchy was the
analyzer's DeadStoresChecker, and the analyzer creates a linearized CFG
anyway (every non-trivial statement is a block-level statement).

This also allows us to remove the block-expr map ("BlkExprMap"), which
mapped statements to positions in the CFG. Apart from having a helper type
that really should have just been Optional<unsigned>, it was only being
used to ask /if/ a particular expression was block-level, for traversal
purposes in CFGStmtVisitor.

llvm-svn: 181945
2013-05-15 23:22:55 +00:00
David Blaikie 7d17010db5 Use only explicit bool conversion operator
The most common (non-buggy) case are where such objects are used as
return expressions in bool-returning functions or as boolean function
arguments. In those cases I've used (& added if necessary) a named
function to provide the equivalent (or sometimes negative, depending on
convenient wording) test.

DiagnosticBuilder kept its implicit conversion operator owing to the
prevalent use of it in return statements.

One bug was found in ExprConstant.cpp involving a comparison of two
PointerUnions (PointerUnion did not previously have an operator==, so
instead both operands were converted to bool & then compared). A test
is included in test/SemaCXX/constant-expression-cxx1y.cpp for the fix
(adding operator== to PointerUnion in LLVM).

llvm-svn: 181869
2013-05-15 07:37:26 +00:00
Hans Wennborg 0d81e01916 Add support for __wchar_t in -fms-extensions mode.
MSVC provides __wchar_t. This is the same as the built-in wchar_t type
from C++, but it is also available with -fno-wchar and in C.

The commit changes ASTContext to have two different types for this:

  - WCharTy is the built-in type used for wchar_t in C++ and __wchar_t.

  - WideCharTy is the type of a wide character literal. In C++ this is
    the same as WCharTy, and in C  it is an integer type compatible with
    the type in <stddef.h>.

This fixes PR15815.

llvm-svn: 181587
2013-05-10 10:08:40 +00:00
Dmitri Gribenko 44ebbd5436 Replace ArrayRef<T>() with None, now that we have an implicit ArrayRef constructor from None
Patch by Robert Wilhelm.

llvm-svn: 181139
2013-05-05 00:41:58 +00:00
Richard Smith 852c9db72b C++1y: Allow aggregates to have default initializers.
Add a CXXDefaultInitExpr, analogous to CXXDefaultArgExpr, and use it both in
CXXCtorInitializers and in InitListExprs to represent a default initializer.

There's an additional complication here: because the default initializer can
refer to the initialized object via its 'this' pointer, we need to make sure
that 'this' points to the right thing within the evaluation.

llvm-svn: 179958
2013-04-20 22:23:05 +00:00
DeLesley Hutchins fd374bb3dd Thread safety analysis: turn on checking within lock and unlock functions.
These checks are enabled with the -Wthread-safety-beta flag.

llvm-svn: 179046
2013-04-08 20:11:11 +00:00
DeLesley Hutchins c105ba19e9 Thread safety analysis: Turn on checking for non-scalar types by default.
These were previously enabled as a "beta" feature, but they have now been
extensively tested.

llvm-svn: 178478
2013-04-01 17:47:37 +00:00
Jordan Rose 6fdef11c17 [analyzer] Add debug helper LocationContext::dumpStack().
Sample output:
  #0 void construct(pointer __p, llvm::ImutAVLTree<llvm::ImutContainerInfo<clang::ento::BugType *> > *const &__val)
  #1 void push_back(const value_type &__x)
  #2 void destroy()
  #3 void release()
  #4 void ~ImmutableSet()

llvm-svn: 178400
2013-03-30 01:31:35 +00:00
Ted Kremenek f82d578f9d [cfg] Always guard (when AddStaticInitBranches == true) DeclStmts for static variables, not just ones with explicit initializers
llvm-svn: 178322
2013-03-29 00:42:56 +00:00
Ted Kremenek 338c3aa8d1 Add static analyzer support for conditionally executing static initializers.
llvm-svn: 178318
2013-03-29 00:09:28 +00:00
Ted Kremenek 233c1b0c77 Add configuration plumbing to enable static initializer branching in the CFG for the analyzer.
This setting still isn't enabled yet in the analyzer.  This is
just prep work.

llvm-svn: 178317
2013-03-29 00:09:22 +00:00
Ted Kremenek 0dd8feee93 Add CFG logic to create a conditional branch for modeling static initializers.
This is an optional variant of the CFG.  This allows analyses to model whether
or not a static initializer has run, e.g.:

  static Foo x = bar();

For basic dataflow analysis in Sema we will just assume that the initializer
always runs.  For the static analyzer we can use this branch to accurately
track whether or not initializers are on.

This patch just adds the (opt-in) functionality to the CFG.  The
static analyzer still needs to be modified to adopt this feature.

llvm-svn: 178263
2013-03-28 18:43:15 +00:00
Rafael Espindola 210de57694 Add const in preparation for a simplify_type change in llvm.
llvm-svn: 178146
2013-03-27 15:37:54 +00:00
David Blaikie 00be69ab5c Remove the CFGElement "Invalid" state.
Use Optional<CFG*> where invalid states were needed previously. In the one case
where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy
CFGAutomaticObjDtor.

Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek
and Doug Gregor.

Post commit code review feedback on r175796 by Ted Kremenek.

llvm-svn: 175938
2013-02-23 00:29:34 +00:00
David Blaikie 2a01f5d426 Replace CFGElement llvm::cast support to be well-defined.
See r175462 for another example/more details.

llvm-svn: 175796
2013-02-21 20:58:29 +00:00
David Blaikie 7a30dc53c5 Use None rather than Optional<T>() where possible.
llvm-svn: 175705
2013-02-21 01:47:18 +00:00
David Blaikie 05785d1622 Include llvm::Optional in clang/Basic/LLVM.h
Post-commit CR feedback from Jordan Rose regarding r175594.

llvm-svn: 175679
2013-02-20 22:23:23 +00:00
Jordan Rose a7d03840e6 Excise <cctype> from Clang (except clang-tblgen) in favor of CharInfo.h.
Nearly all of these changes are one-to-one replacements; the few that
aren't have to do with custom identifier validation.

llvm-svn: 174768
2013-02-08 22:30:41 +00:00
Ted Kremenek 7d86b9ce1e Add note why we used a switch.
llvm-svn: 174449
2013-02-05 22:03:14 +00:00
Ted Kremenek 8ae67871b4 Change subexpressions to be visited in the CFG from left-to-right.
This is a more natural order of evaluation, and it is very important
for visualization in the static analyzer.  Within Xcode, the arrows
will not jump from right to left, which looks very visually jarring.
It also provides a more natural location for dataflow-based diagnostics.

Along the way, we found a case in the analyzer diagnostics where we
needed to indicate that a variable was "captured" by a block.

-fsyntax-only timings on sqlite3.c show no visible performance change,
although this is just one test case.

Fixes <rdar://problem/13016513>

llvm-svn: 174447
2013-02-05 22:00:19 +00:00
Anna Zaks 064185a8ce [analyzer] add comment
llvm-svn: 174435
2013-02-05 19:52:26 +00:00
NAKAMURA Takumi cc4aaef0f2 clang/Analysis: Fix r174245, a valgrind error in AnalysisDeclContext::getBody(bool &IsAutosynthesized), to initialize IsAutosynthesized explicitly.
llvm-svn: 174303
2013-02-04 05:06:21 +00:00
Anna Zaks 00c69a597c [analyzer] Always inline functions with bodies generated by BodyFarm.
Inlining these functions is essential for correctness. We often have
cases where we do not inline calls. For example, the shallow mode and
when reanalyzing previously inlined ObjC methods as top level.

llvm-svn: 174245
2013-02-02 00:30:04 +00:00
Ted Kremenek 7ba78c679c -Wuninitialized: warn about uninitialized values resulting from ?: that evaluate to lvalues (in C++).
llvm-svn: 172875
2013-01-19 00:25:06 +00:00
DeLesley Hutchins 9fa426a666 Thread-safety analysis: ignore edges from throw expressions in CFG.
llvm-svn: 172858
2013-01-18 22:15:45 +00:00
Jordan Rose 1eb342920b Format strings: don't ever convert %+d to %lu.
Presumably, if the printf format has the sign explicitly requested, the user
wants to treat the data as signed.

This is a fix-up for r172739, and also includes several test changes that
didn't make it into that commit.

llvm-svn: 172762
2013-01-17 22:34:10 +00:00
Jordan Rose aa7a3b3e75 Format strings: correct signedness if already correcting width (%d,%u).
It is valid to do this:
  printf("%u", (int)x);

But if we see this:
  printf("%lu", (int)x);

...our fixit should suggest %d, not %u.

llvm-svn: 172739
2013-01-17 18:47:16 +00:00
Richard Smith 10876ef571 Implement C++11 semantics for [[noreturn]] attribute. This required splitting
it apart from [[gnu::noreturn]] / __attribute__((noreturn)), since their
semantics are not equivalent (for instance, we treat [[gnu::noreturn]] as
affecting the function type, whereas [[noreturn]] does not).

llvm-svn: 172691
2013-01-17 01:30:42 +00:00
Dmitri Gribenko f857950d39 Remove useless 'llvm::' qualifier from names like StringRef and others that are
brought into 'clang' namespace by clang/Basic/LLVM.h

llvm-svn: 172323
2013-01-12 19:30:44 +00:00
Enea Zaffanella 392291f7dc Test commit.
llvm-svn: 172195
2013-01-11 11:37:08 +00:00
Will Dietz df9a2bbcb1 CFG.cpp: Fix wrapping logic when printing block preds/succs.
First check only wrapped with i==8, second wrapped at i==2,8,18,28,...
This fix restores the intended behavior: i==8,18,28,...

Found with -fsanitize=integer.

llvm-svn: 171718
2013-01-07 09:51:17 +00:00
Richard Smith 2bf7fdb723 s/CPlusPlus0x/CPlusPlus11/g
llvm-svn: 171367
2013-01-02 11:42:31 +00:00
Nico Weber a2a0eb940a ArrayRefize a CompoundStmt constructor.
llvm-svn: 171238
2012-12-29 20:03:39 +00:00
Anna Zaks 4127750ed8 [analyzer] Fix typos.
llvm-svn: 170907
2012-12-21 17:27:04 +00:00
Anna Zaks 1ee76c1bae [analyzer] Re-apply r170826 and make the dumping of the GallGraph
deterministic.

Commit message for r170826:

[analyzer] Traverse the Call Graph in topological order.

Modify the call graph by removing the parentless nodes. Instead all
nodes are children of root to ensure they are all reachable. Remove the
tracking of nodes that are "top level" or global. This information is
not used and can be obtained from the Decls stored inside
CallGraphNodes.

Instead of existing ordering hacks, analyze the functions in topological
order over the Call Graph.

Together with the addition of devirtualizable ObjC message sends and
blocks to the call graph, this gives around 6% performance improvement
on several large ObjC benchmarks.

llvm-svn: 170906
2012-12-21 17:27:01 +00:00
Rafael Espindola e7ec558f25 Revert r170826. The output of
./bin/clang -cc1 -internal-isystem /home/espindola/llvm/build/lib/clang/3.3/include/ -analyze -analyzer-checker=debug.DumpCallGraph /home/espindola/llvm/clang/test/Analysis/debug-CallGraph.c -fblocks

changes in each run.

llvm-svn: 170829
2012-12-21 01:30:23 +00:00
Anna Zaks 77ca7f1bbe [analyzer] Traverse the Call Graph in topological order.
Modify the call graph by removing the parentless nodes. Instead all
nodes are children of root to ensure they are all reachable. Remove the
tracking of nodes that are "top level" or global. This information is
not used and can be obtained from the Decls stored inside
CallGraphNodes.

Instead of existing ordering hacks, analyze the functions in topological
order over the Call Graph.

Together with the addition of devirtualizable ObjC message sends and
blocks to the call graph, this gives around 6% performance improvement
on several large ObjC benchmarks.

llvm-svn: 170826
2012-12-21 01:19:22 +00:00
Anna Zaks 5c32dfc5fb [analyzer] Add blocks and ObjC messages to the call graph.
This paves the road for constructing a better function dependency graph.
If we analyze a function before the functions it calls and inlines,
there is more opportunity for optimization.

Note, we add call edges to the called methods that correspond to
function definitions (declarations with bodies).

llvm-svn: 170825
2012-12-21 01:19:15 +00:00
DeLesley Hutchins 0cfa1a5a1d Thread-safety analysis: check member access on guarded non-primitive types.
llvm-svn: 169669
2012-12-08 03:46:30 +00:00
Ted Kremenek 3e871d8cf6 Use the BlockDecl captures list to infer the direct captures for a BlockDataRegion. Fixes <rdar://problem/12415065>.
We still need to do a recursive walk to determine all static/global variables
referenced by a block, which is needed for region invalidation.

llvm-svn: 169481
2012-12-06 07:17:26 +00:00
Jordan Rose 0e5badd93b Format strings: offer a cast to 'unichar' for %C in Objective-C contexts.
For most cases where a conversion specifier doesn't match an argument,
we usually guess that the conversion specifier is wrong. However, if
the argument is an integer type and the specifier is %C, it's likely
the user really did mean to print the integer as a character.

(This is more common than %c because there is no way to specify a unichar
literal -- you have to write an integer literal, such as '0x2603',
and then cast it to unichar.)

This does not change the behavior of %S, since there are fewer cases
where printing a literal Unicode *string* is necessary, but this could
easily be changed in the future.

<rdar://problem/11982013>

llvm-svn: 169400
2012-12-05 18:44:49 +00:00
Jordan Rose 6aaa87e0d2 Format strings: the correct conversion for 'char' is %c, not %d or %hhd.
We tried to account for 'uint8_t' by saying that /typedefs/ of 'char'
should be corrected as %hhd rather than %c, but the condition was wrong.

llvm-svn: 169397
2012-12-05 18:44:37 +00:00
DeLesley Hutchins f489d2b86c Thread-safety analysis: check locks on method calls, operator=, and
copy constructors.

llvm-svn: 169350
2012-12-05 01:20:45 +00:00
DeLesley Hutchins 5df82f2155 Thread Safety Analysis: refactor to make more methods accept const pointers,
adjust checkAccess.  No change in functionality.

llvm-svn: 169348
2012-12-05 00:52:33 +00:00
Chandler Carruth 3a02247dc9 Sort all of Clang's files under 'lib', and fix up the broken headers
uncovered.

This required manually correcting all of the incorrect main-module
headers I could find, and running the new llvm/utils/sort_includes.py
script over the files.

I also manually added quite a few missing headers that were uncovered by
shuffling the order or moving headers up to be main-module-headers.

llvm-svn: 169237
2012-12-04 09:13:33 +00:00
Benjamin Kramer 444a1304ad Include pruning and general cleanup.
llvm-svn: 169095
2012-12-01 17:12:56 +00:00
Benjamin Kramer ea70eb30a0 Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't pull in all the generated Attr code.
Required to pull some functions out of line, but this shouldn't have a perf impact.
No functionality change.

llvm-svn: 169092
2012-12-01 15:09:41 +00:00
Ted Kremenek 778a6ed358 Further reduce "-fsyntax-only -Wuninitialized" time on sqlite3.c by another 2.5% using intelligent pruning of blocks during the final reporting pass.
llvm-svn: 168257
2012-11-17 07:18:30 +00:00
Ted Kremenek 4431a03928 Switch -Wuninitialized to use a reverse-post order traversal as
an initial baseline for enqueued blocks, but use a simple DFS stack
for propagating changes quickly up back edges.

This provides a 3.5% reduction in -fsyntax-only time on sqlite3.c.

llvm-svn: 168241
2012-11-17 02:00:00 +00:00
Ted Kremenek e6ee671e16 Fix bad CFG construction bug when handling C++ 'try' statements.
This code assigned the last created CFGBlock* to the variable 'Block',
which is a scratch variable which is null'ed out after a block is
completed.  By assigning the last created block to 'Block', we start
editing a completed block, inserting CFGStmts that should be in
another block.  This was the case with 'try'.  The test case that
showed this had a while loop inside a 'try', and the logic before
the while loop was being included as part of the "condition block"
for the loop.  This showed up as a bogus dead store, but could
have lots of implications.

Turns out this bug was replicated a few times within CFG.cpp, so
I went and fixed up those as well.

llvm-svn: 167788
2012-11-13 00:12:13 +00:00
Anna Zaks 44dc91b4df [analyzer] add LocationContext::inTopFrame() helper.
llvm-svn: 167351
2012-11-03 02:54:16 +00:00
Ted Kremenek b9f7aa46dd Fix potential null deference in CFG printer.
llvm-svn: 165836
2012-10-12 22:56:31 +00:00
Ted Kremenek 451c4d51ae Remove dead store.
llvm-svn: 165835
2012-10-12 22:56:26 +00:00
Ted Kremenek 6fdefb5495 Conditionally use an integral cast for BodyFarm support for OSAtomicCompareAndSwap if the return type is not a boolean.
llvm-svn: 165774
2012-10-12 00:18:19 +00:00
Ted Kremenek 089ffd0889 Switch over to BodyFarm implementation of OSAtomicCompareAndSwap and
objc_atomicCompareAndSwap.

llvm-svn: 165743
2012-10-11 20:58:18 +00:00
DeLesley Hutchins 1fe885614d Thread-safety analysis: allow attributes on constructors to refer to 'this'.
llvm-svn: 165339
2012-10-05 22:38:19 +00:00
Lang Hames 5de91cc35f Add FP_CONTRACT support for clang.
Clang will now honor the FP_CONTRACT pragma and emit LLVM
fmuladd intrinsics for expressions of the form A * B + C (when they occur in a
single statement).

llvm-svn: 164989
2012-10-02 04:45:10 +00:00
Benjamin Kramer 5721daae02 Avoid malloc thrashing in the uninitialized value analysis.
- The size of the packed vector is often small, save mallocs using SmallBitVector.
- Copying SmallBitVectors is also cheap, remove a level of indirection.

llvm-svn: 164827
2012-09-28 16:44:29 +00:00
Ted Kremenek 3d0ec38cb4 Add clarifying comment.
llvm-svn: 164557
2012-09-24 21:17:14 +00:00
Ted Kremenek e7ad535e66 Experiment in BodyFarm of structuring AST creation calls in a hierarchy,
so that they visually look like an AST dump.

llvm-svn: 164401
2012-09-21 18:33:56 +00:00
Ted Kremenek f465dc1553 Create helper method in BodyFarm for creating simple assignments.
llvm-svn: 164400
2012-09-21 18:33:54 +00:00
Ted Kremenek dff3553e3c Add helper method in BodyFarm to create unary dereferences.
llvm-svn: 164399
2012-09-21 18:33:52 +00:00
Ted Kremenek ca90ea5ed0 Add helper method to BodyFarm for creating lvalue-to-rvalue conversions.
llvm-svn: 164397
2012-09-21 18:13:27 +00:00
Ted Kremenek 69bcb82c59 Add helper method to BodyFarm for creatinging integral casts.
llvm-svn: 164396
2012-09-21 18:13:23 +00:00
DeLesley Hutchins 10958cae09 Thread-safety analysis: better handling of unreachable blocks. Fixes a bug
where a call to function marked 'noreturn' is followed by unreachable
implicit destructor calls.

llvm-svn: 164394
2012-09-21 17:57:00 +00:00
Ted Kremenek 7241813bd7 Use helper method to create DeclRefExprs in BodyFarm, hopefully allevating
them being correctly constructed.

llvm-svn: 164392
2012-09-21 17:54:35 +00:00
Ted Kremenek 2b5c83ca8f Add some structuring comments. No functionality change.
llvm-svn: 164391
2012-09-21 17:54:32 +00:00
Ted Kremenek d81a4a18b4 Add faux-body support for dispatch_once().
llvm-svn: 164348
2012-09-21 00:52:24 +00:00
Ted Kremenek 14f779c4d6 Implement faux-body-synthesis of well-known functions in the static analyzer when
their implementations are unavailable.  Start by simulating dispatch_sync().

This change is largely a bunch of plumbing around something very simple.  We
use AnalysisDeclContext to conjure up a fake function body (using the
current ASTContext) when one does not exist.  This is controlled
under the analyzer-config option "faux-bodies", which is off by default.

The plumbing in this patch is largely to pass the necessary machinery
around.  CallEvent needs the AnalysisDeclContextManager to get
the function definition, as one may get conjured up lazily.

BugReporter and PathDiagnosticLocation needed to be relaxed to handle
invalid locations, as the conjured body has no real source locations.
We do some primitive recovery in diagnostic generation to generate
some reasonable locations (for arrows and events), but it can be
improved.

llvm-svn: 164339
2012-09-21 00:09:11 +00:00
DeLesley Hutchins fcb0ffa622 Thread-safety analysis: fix bug where shared trylock was treated
as exclusive.

llvm-svn: 164332
2012-09-20 23:14:43 +00:00
DeLesley Hutchins b78aeed26e Thread safety analysis: properly canonicalize calls to virtual methods within
lock expressions.

llvm-svn: 164324
2012-09-20 22:18:02 +00:00
DeLesley Hutchins 132f8f6959 Thread-safety analysis: Fix warning when EXCLUSIVE_LOCKS_REQUIRED
is placed on a function that has no path to the exit block.

llvm-svn: 164244
2012-09-19 19:49:40 +00:00
DeLesley Hutchins a15e1b4f63 Thread-safety analysis: fix ICE when EXCLUSIVE_LOCKS_REQUIRED or
LOCKS_EXCLUDED is used on a method with a name that is is not a simple
identifier.

llvm-svn: 164242
2012-09-19 19:18:29 +00:00
NAKAMURA Takumi 72f05bccc9 clang/lib/Analysis/ObjCNoReturn.cpp: Fix [-Wnewline-eof]
llvm-svn: 163775
2012-09-13 05:53:17 +00:00
Jordan Rose 4c266aa371 Format strings: offer a fixit for Darwin's %D/%U/%O to ISO %d/%u/%o.
<rdar://problem/12061922>

llvm-svn: 163772
2012-09-13 02:11:15 +00:00
Jordan Rose 510260c2bf Format strings: %D, %U, and %O are valid on Darwin (same as %d, %u, %o).
These will warn under -Wformat-non-iso, and will still be rejected
outright on other platforms.

<rdar://problem/12061922>

llvm-svn: 163771
2012-09-13 02:11:03 +00:00
Ted Kremenek edf22edca0 Teach -Wuninitialized to recognize common "noreturn" idioms in
Objective-C related to NSException.

Fixes <rdar://problem/12287498>

I debated whether or not this logic should be sunk into the CFG
itself.  It's not clear if we should, as different analyses may
wish to have different policies.  We can re-evaluate this in the
future.

llvm-svn: 163760
2012-09-13 00:21:35 +00:00
Ted Kremenek 8b3f938697 Refactor logic in ExprEngine for detecting 'noreturn' methods
in NSException to a helper object in libAnalysis that can also
be used by Sema.  Not sure if the predicate name 'isImplicitNoReturn'
is the best one, but we can massage that later.

No functionality change.

llvm-svn: 163759
2012-09-13 00:21:31 +00:00
Ted Kremenek 7979ccf35a Teach -Wuninitialized to recognize __attribute__((analyzer_noreturn))
for halting the propagation of uninitialized value tracking along
a path.  Unlike __attribute__((noreturn)), this attribute (which
is used by clients of the static analyzer) can be used to annotate
functions that essentially never return, but in rare cares may be
allowed to return for (special) debugging purposes.  This attribute
has been shown in reducing false positives in the static analyzer
by pruning false postives, and is equally applicable here.

Handling this attribute in the CFG itself is another option, but
this is not something all clients (e.g., possibly -Wunreachable-code)
would want to see.

Addresses <rdar://problem/12281583>.

llvm-svn: 163681
2012-09-12 05:53:43 +00:00
DeLesley Hutchins 138568b60a Thread-safety analysis: fix bug in expression matching code.
llvm-svn: 163656
2012-09-11 23:04:49 +00:00
Dmitri Gribenko 76bb5cabfa Remove redundant semicolons which are null statements.
llvm-svn: 163546
2012-09-10 21:20:09 +00:00
DeLesley Hutchins 5ff1644e62 Thread-safety analysis: differentiate between two forms of analysis; a precise
analysis that may give false positives because it is confused by aliasing, and
a less precise analysis that has fewer false positives, but may have false
negatives.  The more precise warnings are enabled by -Wthread-safety-precise.
An additional note clarify the warnings in the precise case.

llvm-svn: 163537
2012-09-10 19:58:23 +00:00
Jordan Rose 2f9cc04251 Format strings: suggest %lld instead of %qd and %Ld with -Wformat-non-iso.
As a corollary to the previous commit, even when an extension is
available, we can still offer a fixit to the standard modifier.

llvm-svn: 163453
2012-09-08 04:00:12 +00:00
Jordan Rose 92303592c3 Format strings: %Ld isn't available on Darwin or Windows.
This seems to be a GNU libc extension; we offer a fixit to %lld on
these platforms.

<rdar://problem/11518237>

llvm-svn: 163452
2012-09-08 04:00:03 +00:00
Chad Rosier 37a8563f36 Ampersand goes with identifier.
llvm-svn: 163410
2012-09-07 19:49:55 +00:00
Chad Rosier 78af00f675 Bring buildbots back. Fix scoping issue and coding style from r163397.
llvm-svn: 163403
2012-09-07 18:44:15 +00:00
DeLesley Hutchins a5a00e830a Thread-safety analysis: Add support for selectively turning off warnings
within part of a particular method.

llvm-svn: 163397
2012-09-07 17:34:53 +00:00
Roman Divacky e637711ae0 Dont cast away const needlessly. Found by gcc48 -Wcast-qual.
llvm-svn: 163325
2012-09-06 15:59:27 +00:00
Jordan Rose 6d671cc34a [analyzer] Always include destructors in the analysis CFG.
While destructors will continue to not be inlined (unless the analyzer
config option 'c++-inlining' is set to 'destructors'), leaving them out
of the CFG is an incomplete model of the behavior of an object, and
can cause false positive warnings (like PR13751, now working).

Destructors for temporaries are still not on by default, since
(a) we haven't actually checked this code to be sure it's fully correct
    (in particular, we probably need to be very careful with regard to
    lifetime-extension when a temporary is bound to a reference,
    C++11 [class.temporary]p5), and
(b) ExprEngine doesn't actually do anything when it sees a temporary
    destructor in the CFG -- not even invalidate the object region.

To enable temporary destructors, set the 'cfg-temporary-dtors' analyzer
config option to '1'. The old -cfg-add-implicit-dtors cc1 option, which
controlled all implicit destructors, has been removed.

llvm-svn: 163264
2012-09-05 22:55:23 +00:00
DeLesley Hutchins 93b1b031c1 Thread-safety analysis: bugfix for case where a trylock occurs in an
expression involving temporaries.

llvm-svn: 163237
2012-09-05 20:01:16 +00:00
DeLesley Hutchins f5cf7903d9 Thread-safety analysis: fix handling of LOCK_RETURNED attribute so that the
latest definition of a function is always used when computing lock expressions.

llvm-svn: 163028
2012-08-31 22:09:53 +00:00
DeLesley Hutchins 3c3d57bc16 Thread-safety analysis: fix handling of string constants in mutex
expressions, which should be ignored right now.

llvm-svn: 163026
2012-08-31 21:57:32 +00:00
Ted Kremenek 64fea5fc8f Teach CFG that 'if (x & 0)' and 'if (x * 0)' is an unfeasible branch.
Fixes <rdar://problem/11005770>.

llvm-svn: 162545
2012-08-24 07:42:09 +00:00
Jordan Rose e5d5393efc [analyzer] Support C++ default arguments if they are literal values.
A CXXDefaultArgExpr wraps an Expr owned by a ParmVarDecl belonging to the
called function. In general, ExprEngine and Environment ought to treat this
like a ParenExpr or other transparent wrapper expression, with the inside
expression evaluated first.

However, if we call the same function twice, we'd produce a CFG that contains
the same wrapped expression twice, and we're not set up to handle that. I've
added a FIXME to the CFG builder to come back to that, but meanwhile we can
at least handle expressions that don't need to be explicitly evaluated:
literals. This probably handles many common uses of default parameters:
true/false, null, etc.

Part of PR13385 / <rdar://problem/12156507>

llvm-svn: 162453
2012-08-23 18:10:53 +00:00
Ted Kremenek 78094caa56 Fix an assortment of doxygen comment issues found by -Wdocumentation.
llvm-svn: 162412
2012-08-22 23:50:41 +00:00
Ted Kremenek d94854a42e Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.
Also rename 'getCurrentBlockCounter()' to 'blockCount()'.

This ripples a bunch of code simplifications; mostly aesthetic,
but makes the code a bit tighter.

llvm-svn: 162349
2012-08-22 06:26:15 +00:00
Anna Zaks 23665a1bcf [analyzer] Teach live variable analyzes that super uses self pointer.
llvm-svn: 161822
2012-08-14 00:36:20 +00:00
DeLesley Hutchins 0c90c2bc4b Thread-safety-analysis: adds existential quantification over lock
expressions.  The syntax &MyClass::mutex is interpreted as a
pattern that matches m->mutex for any object m of type MyClass.

llvm-svn: 161691
2012-08-10 20:29:46 +00:00
DeLesley Hutchins 9b1d72f3e3 Thread safety analysis: refactor to support more sophisticated handling
of expressions, and better error messages.

llvm-svn: 161690
2012-08-10 20:19:55 +00:00
DeLesley Hutchins c9776faa4f Refactor thread safety analysis to use a different data structure
to track locksets.  This is in preparation for further changes.

llvm-svn: 161680
2012-08-10 18:39:05 +00:00
Joerg Sonnenberger 42cf26883e Add missing cctype includes.
llvm-svn: 161660
2012-08-10 10:58:18 +00:00
Hans Wennborg abc1e22d65 Properly check length modfiers for %n in format strings.
llvm-svn: 161408
2012-08-07 09:13:19 +00:00
Hans Wennborg b1ab2a84f0 Remove ScanfArgType and bake that logic into ArgType.
This is useful for example for %n in printf, which expects
a pointer to int with the same logic for checking as %d
would have in scanf.

llvm-svn: 161407
2012-08-07 08:59:46 +00:00
Hans Wennborg c3b3da0bb2 Rename analyze_format_string::ArgTypeResult to ArgType
Also remove redundant constructors and unused member functions.

llvm-svn: 161403
2012-08-07 08:11:26 +00:00
Hans Wennborg 16250c7c18 -Wformat: better handling of qualifiers on pointer arguments
Warn about using pointers to const-qualified types as arguments to
scanf. Ignore the volatile qualifier when checking if types match.

llvm-svn: 161052
2012-07-31 16:37:47 +00:00
Hans Wennborg ebcd1c7ca2 Make -Wformat check the argument type for %n.
This makes Clang check that the corresponding argument for "%n" in a
format string is a pointer to int.

llvm-svn: 160966
2012-07-30 17:11:32 +00:00
Hans Wennborg 08574d3559 Make -Wformat walk the typedef chain when looking for size_t, etc.
Clang's -Wformat fix-its currently suggest using "%zu" for values of
type size_t (in C99 or C++11 mode). However, for a type such as
std::vector<T>::size_type, it does not notice that type is actually
typedeffed to size_t, and instead suggests a format for the underlying
type, such as "%lu" or "%u".

This commit makes the format string fix mechanism walk the typedef chain
so that it notices if the type is size_t, even if that isn't "at the
top".

llvm-svn: 160886
2012-07-27 19:17:46 +00:00
NAKAMURA Takumi 836926dbdf clang/lib: [CMake] Update tblgen'd dependencies.
llvm-svn: 160851
2012-07-27 06:18:33 +00:00
NAKAMURA Takumi 075c89bc06 clang/lib: [CMake] Reformat, alphabetize lists.
llvm-svn: 160850
2012-07-27 06:18:12 +00:00
Richard Smith d3b5c90865 Final piece of core issue 1330: delay computing the exception specification of
a defaulted special member function until the exception specification is needed
(using the same criteria used for the delayed instantiation of exception
specifications for function temploids).

EST_Delayed is now EST_Unevaluated (using 1330's terminology), and, like
EST_Uninstantiated, carries a pointer to the FunctionDecl which will be used to
resolve the exception specification.

This is enabled for all C++ modes: it's a little faster in the case where the
exception specification isn't used, allows our C++11-in-C++98 extensions to
work, and is still correct for C++98, since in that mode the computation of the
exception specification can't fail.

The diagnostics here aren't great (in particular, we should include implicit
evaluation of exception specifications for defaulted special members in the
template instantiation backtraces), but they're not much worse than before.

Our approach to the problem of cycles between in-class initializers and the
exception specification for a defaulted default constructor is modified a
little by this change -- we now reject any odr-use of a defaulted default
constructor if that constructor uses an in-class initializer and the use is in
an in-class initialzer which is declared lexically earlier. This is a closer
approximation to the current draft solution in core issue 1351, but isn't an
exact match (but the current draft wording isn't reasonable, so that's to be
expected).

llvm-svn: 160847
2012-07-27 04:22:15 +00:00
Jordan Rose 25bc20f846 [analyzer] Don't crash on implicit statements inside initializers.
Our BugReporter knows how to deal with implicit statements: it looks in
the ParentMap until it finds a parent with a valid location. However, since
initializers are not in the body of a constructor, their sub-expressions are
not in the ParentMap. That was easy enough to fix in AnalysisDeclContext.

...and then even once THAT was fixed, there's still an extra funny case
of Objective-C object pointer fields under ARC, which are initialized with
a top-level ImplicitValueInitExpr. To catch these cases,
PathDiagnosticLocation will now fall back to the start of the current
function if it can't find any other valid SourceLocations. This isn't great,
but it's miles better than a crash.

(All of this is only relevant when constructors and destructors are being
inlined, i.e. under -cfg-add-initializers and -cfg-add-implicit-dtors.)

llvm-svn: 160810
2012-07-26 20:04:30 +00:00
Jordan Rose b3244566f0 [analyzer] Variables with destructors are live until the destructor is run.
Test case in the next commit, which enables destructors under certain
circumstances.

llvm-svn: 160805
2012-07-26 20:04:08 +00:00
Richard Smith f676e45e5f When a && or || appears as the condition of a ?:, perform appropriate
short-circuiting when building the CFG. Also be sure to skip parens before
checking for the && / || special cases. Finally, fix some crashes in CFG
printing in the presence of calls to destructors for array of array of class
type.

llvm-svn: 160691
2012-07-24 21:02:14 +00:00
Sylvestre Ledru 830885ca64 Fix a typo (the the => the)
llvm-svn: 160622
2012-07-23 08:59:39 +00:00
Jordan Rose 8c6c8a98b6 Add a reverse iterator to DeclStmt, and use it when building a CFG.
The CFG creates dummy DeclStmts with one Decl per statement, and it has
to do so from last to first in order to build the graph correctly.

llvm-svn: 160560
2012-07-20 18:50:48 +00:00
Ted Kremenek 6080d32194 Simplify UninitializedValues.cpp by removing logic to handle the previous (imprecise) representation
of '&&' and '||' in the CFG.  This is no longer needed, and greatly simplifies the code.

llvm-svn: 160494
2012-07-19 04:59:05 +00:00
Ted Kremenek 3d6177306b Teach CFG construction about destructors resulting from references to array types. Fixes crash in <rdar://problem/11671507>.
llvm-svn: 160424
2012-07-18 04:57:57 +00:00
Richard Smith b21dd02e61 Uninitialized variables: two little changes:
* Treat compound assignment as a use, at Jordy's request.
 * Always add compound assignments into the CFG, so we can correctly diagnose the use in 'return x += 1;'

llvm-svn: 160334
2012-07-17 01:27:33 +00:00
Richard Smith 6376d1fd9c -Wuninitialized: Split the classification of DeclRefExprs as initialization or
use out of TransferFunctions, and compute it in advance rather than on-the-fly.

This allows us to handle compound assignments with DeclRefExprs on the RHS
correctly, and also makes it trivial to treat const& function parameters as not
initializing the argument. The patch also makes both of those changes.

llvm-svn: 160330
2012-07-17 00:06:14 +00:00
Ted Kremenek b50e716bac Refine CFG so that '&&' and '||' don't lead to extra confluence points when used in a branch, but
instead push the terminator for the branch down into the basic blocks of the subexpressions of '&&' and '||'
respectively.  This eliminates some artifical control-flow from the CFG and results in a more
compact CFG.

Note that this patch only alters the branches 'while', 'if' and 'for'.  This was complex enough for
one patch.  The remaining branches (e.g., do...while) can be handled in a separate patch, but they
weren't immediately tackled because they were less important.

It is possible that this patch introduces some subtle bugs, particularly w.r.t. to destructor placement.
I've tried to audit these changes, but it is also known that the destructor logic needs some refinement
in the area of '||' and '&&' regardless (i.e., their are known bugs).

llvm-svn: 160218
2012-07-14 05:04:10 +00:00
Ted Kremenek a16436f51e Hoist CFG builder logic for '&&' and '||' into helper method. No funcationlity change.
llvm-svn: 160217
2012-07-14 05:04:06 +00:00
Ted Kremenek e86723866d Remove unused method declaration.
llvm-svn: 160216
2012-07-14 05:04:04 +00:00
Ted Kremenek 6f40024d9e Sort prototypes. No functionality change.
llvm-svn: 160215
2012-07-14 05:04:01 +00:00
Richard Smith 130b8d4e97 PR13360: When deciding the earliest point which inevitably leads to an
uninitialized variable use, walk back over branches where we've reached all the
non-null successors, not just cases where we've reached all successors.

llvm-svn: 160206
2012-07-13 23:33:44 +00:00
DeLesley Hutchins 868830f727 Thread safety analysis: impove handling of trylock expressions.
llvm-svn: 160018
2012-07-10 21:47:55 +00:00
Dmitri Gribenko ec92531c29 Implement AST classes for comments, a real parser for Doxygen comments and a
very simple semantic analysis that just builds the AST; minor changes for lexer
to pick up source locations I didn't think about before.

Comments AST is modelled along the ideas of HTML AST: block and inline content.

* Block content is a paragraph or a command that has a paragraph as an argument
  or verbatim command.
* Inline content is placed within some block.  Inline content includes plain
  text, inline commands and HTML as tag soup.

llvm-svn: 159790
2012-07-06 00:28:32 +00:00
DeLesley Hutchins 09bcefcb6d Thread-safety analysis: eliminate false positives in case where the definition
duplicates attributes on the declaration.  Also eliminates a false negative in
ReleasableMutexLock.  Fixing this bug required some refactoring.

llvm-svn: 159780
2012-07-05 21:16:29 +00:00
Benjamin Kramer 4ab984e74b Drop the ASTContext.h include from DeclFriend.h and DeclTemplate.h.
llvm-svn: 159723
2012-07-04 20:19:54 +00:00
Benjamin Kramer 1ea8e092be Drop the ASTContext.h include from Stmt.h and fix up transitive users.
This required moving the ctors for IntegerLiteral and FloatingLiteral out of
line which shouldn't change anything as they are usually called through Create
methods that are already out of line.

ASTContext::Deallocate has been a nop for a long time, drop it from ASTVector
and make it independent from ASTContext.h

Pass the StorageAllocator directly to AccessedEntity so it doesn't need to
have a definition of ASTContext around.

llvm-svn: 159718
2012-07-04 17:04:04 +00:00
DeLesley Hutchins 3a8d6cff14 Thread safety analysis: improve handling of smart pointers.
llvm-svn: 159679
2012-07-03 19:47:18 +00:00
DeLesley Hutchins 0c1da20bf8 Thread Safety Analysis: handle expressions involving temporaries,
e.g. ExprWithCleanups.

llvm-svn: 159674
2012-07-03 18:25:56 +00:00
Richard Smith b721e301df -Wuninitialized: assume that an __attribute__((returns_twice)) function might
initialize any variable. This is extremely conservative, but is sufficient for
now.

llvm-svn: 159620
2012-07-02 23:23:04 +00:00
DeLesley Hutchins ab0d4e6cd8 Thread safety analysis: fixed bug that occurs when very silly people
use scoped_lockable without putting unlock_function on the
destructor.

llvm-svn: 159609
2012-07-02 22:26:29 +00:00
DeLesley Hutchins 6e6dbb7618 Thread safety analysis: fixed incorrect error message at the end of a locks_required function.
llvm-svn: 159607
2012-07-02 22:16:54 +00:00
DeLesley Hutchins 2a15baf968 Thread safety analysis: don't warn in case of duplicate annotation.
llvm-svn: 159606
2012-07-02 22:12:12 +00:00
DeLesley Hutchins c4a6e51596 Thread Safety Analysis: turn off checking within trylock functions.
llvm-svn: 159601
2012-07-02 21:59:24 +00:00
Ted Kremenek de21a1c964 Bail out the LiveVariables analysis when the CFG is very large, as
we are encountering some scalability issues with memory usage.   The
appropriate long term fix is to make the analysis more scalable, but
this will at least prevent the analyzer swapping when
analyzing very large functions.

llvm-svn: 159578
2012-07-02 20:21:52 +00:00
DeLesley Hutchins d162c91b1a Thread safety analysis: support release() function on scoped
lockable objects.

llvm-svn: 159387
2012-06-28 22:42:48 +00:00
DeLesley Hutchins 49979f2e38 Thread safety analysis: implement lock_returned attribute.
llvm-svn: 159152
2012-06-25 18:33:18 +00:00
DeLesley Hutchins ebbf77016d Thread safety analysis: fixes a bug in which locksets are not handled
properly if there is a join point in the control flow graph that involves
a trylock.  Also changes the source locations of some warnings to be
more consistent.

llvm-svn: 159008
2012-06-22 17:07:28 +00:00
Chandler Carruth 28969b4139 Remove a goofy CMake hack and use the standard CMake facilities to
express library-level dependencies within Clang.

This is no more verbose really, and plays nicer with the rest of the
CMake facilities. It should also have no change in functionality.

llvm-svn: 158888
2012-06-21 01:30:21 +00:00
Richard Smith a8d4f229a6 -Wuninitialized bugfix: when entering the scope of a variable with no
initializer, it is uninitialized, even if we may be coming from somewhere where
it was initialized.

llvm-svn: 158611
2012-06-16 23:34:14 +00:00
David Blaikie 40ed29730b Revert Decl's iterators back to pointer value_type rather than reference value_type
In addition, I've made the pointer and reference typedef 'void' rather than T*
just so they can't get misused. I would've omitted them entirely but
std::distance likes them to be there even if it doesn't use them.

This rolls back r155808 and r155869.

Review by Doug Gregor incorporating feedback from Chandler Carruth.

llvm-svn: 158104
2012-06-06 20:45:41 +00:00
Benjamin Kramer d1d76b2da7 Remove unused private member variables found by clang's new -Wunused-private-field.
llvm-svn: 158086
2012-06-06 17:32:50 +00:00
Francois Pichet b27ea02784 Zap the /Za compiler switch from MSVC projects, the option is considered harmful even by Microsoft people and clang won't build using the MSVC 2012 RC if not removed.
Only 1 minor code change was necessary: can't use cdecl as variable name anymore.

llvm-svn: 158063
2012-06-06 12:00:10 +00:00
Jordan Rose 614e72bec7 Make suggestions for mismatched enum arguments to printf/scanf.
llvm-svn: 157962
2012-06-04 22:49:02 +00:00
Jordan Rose 98709985a6 Teach printf/scanf about enums with fixed underlying types.
llvm-svn: 157961
2012-06-04 22:48:57 +00:00
Ted Kremenek c3da376fbc static analyzer: add inlining support for directly called blocks.
llvm-svn: 157833
2012-06-01 20:04:04 +00:00