Commit Graph

1099 Commits

Author SHA1 Message Date
Jordan Rose 45d71a2715 [analyzer] Fix a bug in IdenticalExprChecker concerning while loops.
Somehow both Daniel and I missed the fact that while loops are only identical
if they have identical bodies.

Patch by Daniel Fahlgren!

llvm-svn: 201829
2014-02-21 00:18:31 +00:00
Jordan Rose 94008121fa [analyzer] Extend IdenticalExprChecker to check logical and bitwise expressions.
IdenticalExprChecker now warns if any expressions in a logical or bitwise
chain (&&, ||, &, |, or ^) are the same. Unlike the previous patch, this
actually checks all subexpressions against each other (an O(N^2) operation,
but N is likely to be small).

Patch by Daniel Fahlgren!

llvm-svn: 201702
2014-02-19 17:44:16 +00:00
Jordan Rose 70e7e8718e [analyzer] Extend IdenticalExprChecker to check the two branches of an if.
This extends the checks for identical expressions to handle identical
statements, and compares the consequent and alternative ("then" and "else")
branches of an if-statement to see if they are identical, treating a single
statement surrounded by braces as equivalent to one without braces.

This does /not/ check subsequent branches in an if/else chain, let alone
branches that are not consecutive. This may improve in a future patch, but
it would certainly take more work.

Patch by Daniel Fahlgren!

llvm-svn: 201701
2014-02-19 17:44:11 +00:00
Ted Kremenek 8dd916d6b1 [analyzer] Move checker alpha.osx.cocoa.MissingSuperCall out of alpha category.
llvm-svn: 201640
2014-02-19 05:28:39 +00:00
Jordan Rose 97d2c9cae7 [analyzer] Teach CastSizeChecker about flexible array members.
...as well as fake flexible array members: structs that end in arrays with
length 0 or 1.

Patch by Daniel Fahlgren!

llvm-svn: 201583
2014-02-18 17:06:30 +00:00
Anton Yartsev 6a61922239 [analyzer] Improved checker naming in CFG dump.
This implements FIXME from Checker.cpp (FIXME: We want to return the package + name of the checker here.) and replaces hardcoded checker names with the new ones obtained via getCheckName().getName().

llvm-svn: 201525
2014-02-17 18:25:34 +00:00
Alexander Kornienko 4aca9b1cd8 Expose the name of the checker producing each diagnostic message.
Summary:
In clang-tidy we'd like to know the name of the checker producing each
diagnostic message. PathDiagnostic has BugType and Category fields, which are
both arbitrary human-readable strings, but we need to know the exact name of the
checker in the form that can be used in the CheckersControlList option to
enable/disable the specific checker.

This patch adds the CheckName field to the CheckerBase class, and sets it in
the CheckerManager::registerChecker() method, which gets them from the
CheckerRegistry.

Checkers that implement multiple checks have to store the names of each check
in the respective registerXXXChecker method.

Reviewers: jordan_rose, krememek

Reviewed By: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2557

llvm-svn: 201186
2014-02-11 21:49:21 +00:00
Jordan Rose 4393aa7efb [analyzer] Objective-C object literals are always non-nil.
<rdar://problem/15999214>

llvm-svn: 201007
2014-02-08 00:04:14 +00:00
NAKAMURA Takumi 413496f89b [CMake] Prune stray entries in add_dependencies(). target_link_libraries() implies it.
llvm-svn: 200531
2014-01-31 11:19:04 +00:00
Alp Toker 314cc81b8c Rename getResultType() on function and method declarations to getReturnType()
A return type is the declared or deduced part of the function type specified in
the declaration.

A result type is the (potentially adjusted) type of the value of an expression
that calls the function.

Rule of thumb:

  * Declarations have return types and parameters.
  * Expressions have result types and arguments.

llvm-svn: 200082
2014-01-25 16:55:45 +00:00
Jordan Rose 6adadb9bc2 [analyzer] Future-proof MallocChecker CFG dumping.
Now we'll get a warning if we miss a case. Refinement of r199800.

llvm-svn: 199868
2014-01-23 03:59:01 +00:00
Anton Yartsev fee669054f [analyzer] The patch prevents the analyzer from crashing during CFG dump.
llvm-svn: 199800
2014-01-22 13:19:48 +00:00
Alp Toker 9cacbabd33 Rename FunctionProtoType accessors from 'arguments' to 'parameters'
Fix a perennial source of confusion in the clang type system: Declarations and
function prototypes have parameters to which arguments are supplied, so calling
these 'arguments' was a stretch even in C mode, let alone C++ where default
arguments, templates and overloading make the distinction important to get
right.

Readability win across the board, especially in the casting, ADL and
overloading implementations which make a lot more sense at a glance now.

Will keep an eye on the builders and update dependent projects shortly.

No functional change.

llvm-svn: 199686
2014-01-20 20:26:09 +00:00
Ted Kremenek 115c3f7a36 [analyzer] Fix incorrect spelling of 'pthread_rwlock_trywrlock'. Patch by Jean Baptiste Noblot.
llvm-svn: 199499
2014-01-17 16:06:43 +00:00
Ted Kremenek f0ae7d0201 [analyzer] Teach NonNullParamChecker about 'nonnull' attributes on parameters.
llvm-svn: 199473
2014-01-17 07:15:35 +00:00
Jordan Rose 2a833ca575 [analyzer] BlockCall shouldn't really be an AnyFunctionCall.
Per discussion with Anna a /long/ time ago, it was way too easy to misuse
BlockCall: because it inherited from AnyFunctionCall (through SimpleCall),
getDecl() was constrained to return a FunctionDecl, and you had to call
getBlockDecl() instead. This goes against the whole point of CallEvent
(to abstract over different ways to invoke bodies of code).

Now, BlockCall just inherits directly from CallEvent. There's a bit of
duplication in getting things out of the origin expression (which is still
known to be a CallExpr), but nothing significant.

llvm-svn: 199321
2014-01-15 17:25:15 +00:00
Jordan Rose e02e96a69f [analyzer] Print function name when dumping its CFG.
This allows us to use CHECK-LABEL to ensure that we're checking the right CFG.

Debugging change only.

llvm-svn: 199320
2014-01-15 17:25:05 +00:00
Ted Kremenek 0f83390540 Teach DeadStoresChecker about attribute objc_precise_lifetime.
llvm-svn: 199277
2014-01-15 00:59:23 +00:00
Jordan Rose 1a866cd54b [analyzer] Model getters of known-@synthesized Objective-C properties.
...by synthesizing their body to be "return self->_prop;", with an extra
nudge to RetainCountChecker to still treat the value as +0 if we have no
other information.

This doesn't handle weak properties, but that's mostly correct anyway,
since they can go to nil at any time. This also doesn't apply to properties
whose implementations we can't see, since they may not be backed by an
ivar at all. And finally, this doesn't handle properties of C++ class type,
because we can't invoke the copy constructor. (Sema has actually done this
work already, but the AST it synthesizes is one the analyzer doesn't quite
handle -- it has an rvalue DeclRefExpr.)

Modeling setters is likely to be more difficult (since it requires
handling strong/copy), but not impossible.

<rdar://problem/11956898>

llvm-svn: 198953
2014-01-10 20:06:06 +00:00
Jordan Rose 656fdd55dd [analyzer] Warn about double-delete in C++ at the second delete...
...rather somewhere in the destructor when we try to access something and
realize the object has already been deleted. This is necessary because
the destructor is processed before the 'delete' itself.

Patch by Karthik Bhat!

llvm-svn: 198779
2014-01-08 18:46:55 +00:00
Jordan Rose 514f935411 [analyzer] Pointers escape into +[NSValue valueWithPointer:]...
...even though the argument is declared "const void *", because this is
just a way to pass pointers around as objects. (Though NSData is often
a better one.)

PR18262

llvm-svn: 198710
2014-01-07 21:39:48 +00:00
Jordan Rose 6ad4cb4eca [analyzer] Remove unused ARCNotOwnedSymbol retain count return effect.
RetainCountChecker has to track returned object values to know if they are
retained or not. Under ARC, even methods that return +1 are tracked by the
system and should be treated as +0. However, this effect behaves exactly
like NotOwned(ObjC), i.e. a generic Objective-C method that actually returns
+0, so we don't need a special case for it.

No functionality change.

llvm-svn: 198709
2014-01-07 21:39:41 +00:00
Chandler Carruth 5553d0d4ca Sort all the #include lines with LLVM's utils/sort_includes.py which
encodes the canonical rules for LLVM's style. I noticed this had drifted
quite a bit when cleaning up LLVM, so wanted to clean up Clang as well.

llvm-svn: 198686
2014-01-07 11:51:46 +00:00
Alp Toker ef6b007dc5 Only mark dump() function definitions 'used' in debug builds
This has the dual effect of (1) enabling more dead-stripping in release builds
and (2) ensuring that debug helper functions aren't stripped away in debug
builds, as they're intended to be called from the debugger.

Note that the attribute is applied to definitions rather than declarations in
headers going forward because it's now conditional on NDEBUG:

  /// \brief Mark debug helper function definitions like dump() that should not be
  /// stripped from debug builds.

Requires corresponding macro added in LLVM r198456.

llvm-svn: 198489
2014-01-04 13:47:14 +00:00
Ted Kremenek 776409286b [analyzer] Remove IdempotentOperations checker.
This checker has not been updated to work with interprocedural analysis,
and actually contains both logical correctness issues but also
memory bugs.  We can resuscitate it from version control once there
is focused interest in making it a real viable checker again.

llvm-svn: 198476
2014-01-04 05:52:11 +00:00
Aaron Ballman b190f974c9 Fixed a FIXME; created a print method for Selectors that accepts a raw_ostream, and started using it in places it made sense.
No functional changes intended, just API cleanliness.

llvm-svn: 198428
2014-01-03 17:59:55 +00:00
Ted Kremenek 9b12e72376 [analyzer] Don't track return value of NSNull +null for retain/release tracking.
Fixes <rdar://problem/12858915>.

llvm-svn: 198388
2014-01-03 01:19:28 +00:00
Aaron Ballman 2ef6a435f4 Fixing a compile error that recently started happening for me in MSVC 2013. CFGTerminator has an explicit conversion to bool operator that we can make use of instead of using == 0.
llvm-svn: 198175
2013-12-29 18:59:54 +00:00
Alp Toker a724cff01b Rename isBuiltinCall() to getBuiltinCallee()
This better describes what the function does.

Cleanup only.

llvm-svn: 198127
2013-12-28 21:59:02 +00:00
Aaron Ballman 9ead1243a5 Replacing calls to getAttr with calls to hasAttr for clarity. No functional change intended -- this only replaces Boolean uses of getAttr.
llvm-svn: 197648
2013-12-19 02:39:40 +00:00
Alp Toker cbb9034e2a Eliminate BinaryTypeTraitExpr
There's nothing special about type traits accepting two arguments.

This commit eliminates BinaryTypeTraitExpr and switches all related handling
over to TypeTraitExpr.

Also fixes a CodeGen failure with variadic type traits appearing in a
non-constant expression.

The BTT/TT prefix and evaluation code is retained as-is for now but will soon
be further cleaned up.

This is part of the ongoing work to unify type traits.

llvm-svn: 197273
2013-12-13 20:49:58 +00:00
Jordan Rose 6f2f39006b [analyzer] Misc. tidying in IdenticalExprChecker.
Some things I missed when this first went in.

llvm-svn: 196938
2013-12-10 18:18:10 +00:00
Jordan Rose 60bd88d341 [analyzer] Extend IdenticalExprChecker to check ternary operator results.
Warn if both result expressions of a ternary operator (? :) are the same.
Because only one of them will be executed, this warning will fire even if
the expressions have side effects.

Patch by Anders Rönnholm and Per Viberg!

llvm-svn: 196937
2013-12-10 18:18:06 +00:00
NAKAMURA Takumi 65d42bcc2b [CMake] clang/lib: Satisfy dependencies to add *actually used* libraries on target_link_libraries() and LLVM_LINK_COMPONENTS.
I will prune redundant dependencies later.

llvm-svn: 196800
2013-12-09 19:04:43 +00:00
Alp Toker f6a24ce40f Fix a tranche of comment, test and doc typos
llvm-svn: 196510
2013-12-05 16:25:25 +00:00
Alp Toker 5faf0c00dc Correct a user-visible static analyzer message typo
llvm-svn: 196062
2013-12-02 03:50:25 +00:00
Alp Toker 965f882588 Remove a whole lot of unused variables
There are about 30 removed in this patch, generated by a new FixIt I haven't
got round to submitting yet.

llvm-svn: 195814
2013-11-27 05:22:15 +00:00
Richard Smith 852e9ce3dd Remove 'DistinctSpellings' support from Attr.td and change its only user to
look at the attribute spelling instead. The 'ownership_*' attributes should
probably be split into separate *Attr classes, but that's more than I wanted to
do here.

llvm-svn: 195805
2013-11-27 01:46:48 +00:00
Anton Yartsev 968c60a554 [analyzer] Better modeling of memcpy by the CStringChecker (PR16731).
New rules of invalidation/escape of the source buffer of memcpy: the source buffer contents is invalidated and escape while the source buffer region itself is neither invalidated, nor escape.
In the current modeling of memcpy the information about allocation state of regions, accessible through the source buffer, is not copied to the destination buffer and we can not track the allocation state of those regions anymore. So we invalidate/escape the source buffer indirect regions in anticipation of their being invalidated for real later. This eliminates false-positive leaks reported by the unix.Malloc and alpha.cplusplus.NewDeleteLeaks checkers for the cases like

char *f() {
  void *x = malloc(47);
  char *a;
  memcpy(&a, &x, sizeof a);
  return a;
}

llvm-svn: 194953
2013-11-17 09:18:48 +00:00
Jordan Rose dba2692865 [analyzer] Treat MSVC's _wassert as noreturn.
This makes sure the analyzer actually honors assert() in an MSVC project.

Patch by Anders Montonen!

llvm-svn: 194716
2013-11-14 17:55:00 +00:00
Benjamin Kramer e8a2c18bc7 Move classes into anonymous namespaces.
llvm-svn: 194706
2013-11-14 15:46:10 +00:00
Jordan Rose 5650bcb18e Revert 'Tweak ContainerNonEmptyMap with "int" instead of "bool"'.
I've added the missing ImutProfileInfo [sic] specialization for bool,
so this patch on r194235 is no longer needed.

This reverts r194244 / 2baea2887dfcf023c8e3560e5d4713c42eed7b6b.

llvm-svn: 194265
2013-11-08 17:23:33 +00:00
NAKAMURA Takumi d23177a27e StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp: Tweak ContainerNonEmptyMap with "int" instead of "bool", to appease building since r194235.
In ADT/ImmutableSet, ImutProfileInfo<bool> cannot be matched to ImutProfileInteger.
I didn't have idea it'd the right way if PROFILE_INTEGER_INFO(bool) could be added there.

llvm-svn: 194244
2013-11-08 04:00:53 +00:00
Jordan Rose 51327f9237 [analyzer] Add IdenticalExprChecker, to find copy-pasted code.
This syntactic checker looks for expressions on both sides of comparison
operators that are structurally the same. As a special case, the
floating-point idiom "x != x" for "isnan(x)" is left alone.

Currently this only checks comparison operators, but in the future we could
extend this to include logical operators or chained if-conditionals.

Checker by Per Viberg!

llvm-svn: 194236
2013-11-08 01:15:39 +00:00
Jordan Rose 1a4ae202c7 [analyzer] Track whether an ObjC for-in loop had zero iterations.
An Objective-C for-in loop will have zero iterations if the collection is
empty. Previously, we could only detect this case if the program asked for
the collection's -count /before/ the for-in loop. Now, the analyzer
distinguishes for-in loops that had zero iterations from those with at
least one, and can use this information to constrain the result of calling
-count after the loop.

In order to make this actually useful, teach the checker that methods on
NSArray, NSDictionary, and the other immutable collection classes don't
change the count.

<rdar://problem/14992886>

llvm-svn: 194235
2013-11-08 01:15:35 +00:00
Anna Zaks 3d46ac66d8 [analyzer] Track the count of NSOrderedSet similarly to other fast enumerations.
llvm-svn: 194005
2013-11-04 19:13:08 +00:00
NAKAMURA Takumi a67c9c32aa StaticAnalyzer/Checkers/DynamicTypePropagation.cpp: Fix in comments. 80-col and an utf8 char.
llvm-svn: 193513
2013-10-28 04:14:33 +00:00
Benjamin Kramer 1d5d634c82 Forgot some references to misspelled enums.
llvm-svn: 193047
2013-10-20 11:53:20 +00:00
Benjamin Kramer 2501f14197 Miscellaneous speling fixes.
llvm-svn: 193046
2013-10-20 11:47:15 +00:00
Jordan Rose 42b4248f05 [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.
No functionality change.

llvm-svn: 192114
2013-10-07 17:16:59 +00:00
Jordan Rose 7741132f47 [analyzer] RetainCountChecker: add support for CFAutorelease.
<rdar://problems/13710586&13710643>

llvm-svn: 192113
2013-10-07 17:16:52 +00:00
Jordan Rose 6feda28756 [analyzer] Replace bug category magic strings with shared constants, take 2.
Re-commit r191910 (reverted in r191936) with layering violation fixed, by
moving the bug categories to StaticAnalyzerCore instead of ...Checkers.

llvm-svn: 191937
2013-10-04 00:25:24 +00:00
Richard Smith 25d8e737d8 Temporarily revert r191910 until the layering violation can be fixed.
llvm-svn: 191936
2013-10-03 23:38:02 +00:00
Jordan Rose 761ee868a5 [analyzer] Replace bug category magic strings with shared constants.
One small functionality change is to bring the sizeof-pointer checker in
line with the other checkers by making its category be "Logic error"
instead of just "Logic". There should be no other functionality changes.

Patch by Daniel Marjamäki!

llvm-svn: 191910
2013-10-03 16:57:20 +00:00
Jordan Rose 9db2d9adef [analyzer] Add new debug helper clang_analyzer_warnIfReached.
This will emit a warning if a call to clang_analyzer_warnIfReached is
executed, printing REACHABLE. This is a more explicit way to declare
expected reachability than using clang_analyzer_eval or triggering
a bug (divide-by-zero or null dereference), and unlike the former will
work the same in inlined functions and top-level functions. Like the
other debug helpers, it is part of the debug.ExprInspection checker.

Patch by Jared Grubb!

llvm-svn: 191909
2013-10-03 16:57:03 +00:00
Jordan Rose 44e066c72a [analyzer] Add missing return after function pointer null check.
Also add some tests that there is actually a message and that the bug is
actually a hard error. This actually behaved correctly before, because:

- addTransition() doesn't actually add a transition if the new state is null;
  it assumes you want to propagate the predecessor forward and does nothing.
- generateSink() is called in order to emit a bug report.
- If at least one new node has been generated, the predecessor node is /not/
  propagated forward.

But now it's spelled out explicitly.

Found by Richard Mazorodze, who's working on a patch that may require this.

llvm-svn: 191805
2013-10-02 01:20:28 +00:00
Jordan Rose 1ccc43d50e [analyzer] Handle destructors for the argument to C++ 'delete'.
Now that the CFG includes nodes for the destructors in a delete-expression,
process them in the analyzer using the same common destructor interface
currently used for local, member, and base destructors. Also, check for when
the value is known to be null, in which case no destructor is actually run.

This does not yet handle destructors for deleted /arrays/, which may need
more CFG work. It also causes a slight regression in the location of
double delete warnings; the double delete is detected at the destructor
call, which is implicit, and so is reported on the first access within the
destructor instead of at the 'delete' statement. This will be fixed soon.

Patch by Karthik Bhat!

llvm-svn: 191381
2013-09-25 16:06:17 +00:00
Benjamin Kramer 04bf187e12 Fix array_pod_sort predicates after LLVM change.
llvm-svn: 191176
2013-09-22 14:10:29 +00:00
Benjamin Kramer 402f807d9d array_pod_sort loses some type safety, better use the right types.
llvm-svn: 191174
2013-09-22 12:53:24 +00:00
Benjamin Kramer a92b80f8a0 Rewrite a cold use of std::sort to array_pod_sort.
No functionality change.

llvm-svn: 191173
2013-09-22 12:41:24 +00:00
Anna Zaks fb05094b52 [analyzer] Stop tracking the objects with attribute cleanup in the RetainCountChecker.
This suppresses false positive leaks. We stop tracking a value if it is assigned to a variable declared with a cleanup attribute.

llvm-svn: 190835
2013-09-17 00:53:28 +00:00
Anton Yartsev f5bcccee76 New message for cases when ownership is taken:
"+method_name: cannot take ownership of memory allocated by 'new'."
instead of the old
"Memory allocated by 'new' should be deallocated by 'delete', not +method_name"

llvm-svn: 190800
2013-09-16 17:51:25 +00:00
Cameron Esfahani 556d91e2c3 Clean up some Triple usage in clang.
llvm-svn: 190737
2013-09-14 01:09:11 +00:00
Jordan Rose 3ea5886d14 Fix two incorrect comments.
Patch by Jared Grubb!

llvm-svn: 190652
2013-09-13 00:45:22 +00:00
Eli Friedman 4f0409aae5 Get rid of unused isPodLike definition.
llvm-svn: 190463
2013-09-11 00:37:10 +00:00
Aaron Ballman f58070baed Switched FormatAttr to using an IdentifierArgument instead of a StringArgument since that is a more accurate modeling.
llvm-svn: 189851
2013-09-03 21:02:22 +00:00
Robert Wilhelm 25284cc95b Use pop_back_val() instead of both back() and pop_back().
No functionality change intended.

llvm-svn: 189112
2013-08-23 16:11:15 +00:00
Jordan Rose 95cdf9d603 [analyzer] Don't run unreachable code checker on inlined functions.
This is still an alpha checker, but we use it in certain tests to make sure
something is not being executed.

This should fix the buildbots.

llvm-svn: 188682
2013-08-19 17:03:12 +00:00
Jordan Rose 60619a639b [analyzer] Assume that strings are no longer than SIZE_MAX/4.
This keeps the analyzer from making silly assumptions, like thinking
strlen(foo)+1 could wrap around to 0. This fixes PR16558.

Patch by Karthik Bhat!

llvm-svn: 188680
2013-08-19 16:27:34 +00:00
Jordan Rose 5374c07ab9 Omit arguments of __builtin_object_size from the CFG.
This builtin does not actually evaluate its arguments for side effects,
so we shouldn't include them in the CFG. In the analyzer, rely on the
constant expression evaluator to get the proper semantics, at least for
now. (In the future, we could get ambitious and try to provide path-
sensitive size values.)

In theory, this does pose a problem for liveness analysis: a variable can
be used within the __builtin_object_size argument expression but not show
up as live. However, it is very unlikely that such a value would be used
to compute the object size and not used to access the object in some way.

<rdar://problem/14760817>

llvm-svn: 188679
2013-08-19 16:27:28 +00:00
Ted Kremenek e19529b3d8 Use the number of parameters in the actual method or function to determine the CallEffects size.
llvm-svn: 188587
2013-08-16 23:14:22 +00:00
Benjamin Kramer ab3838ab98 RetainCountChecker: Replace some loops with std:: algorithms.
llvm-svn: 188581
2013-08-16 21:57:14 +00:00
Ted Kremenek 63234c1bbd Revert r188574. Turns out it isn't needed.
llvm-svn: 188578
2013-08-16 21:54:22 +00:00
Fariborz Jahanian 36362016d3 Need summary info. about arguments to
CF functions coming from static analyzer API.

llvm-svn: 188574
2013-08-16 20:23:36 +00:00
Jordan Rose 2f8b0229cb [analyzer] If realloc fails on an escaped region, that region doesn't leak.
When a region is realloc()ed, MallocChecker records whether it was known
to be allocated or not. If it is, and the reallocation fails, the original
region has to be freed. Previously, when an allocated region escaped,
MallocChecker completely stopped tracking it, so a failed reallocation
still (correctly) wouldn't require freeing the original region. Recently,
however, MallocChecker started tracking escaped symbols, so that if it were
freed we could check that the deallocator matched the allocator. This
broke the reallocation model for whether or not a symbol was allocated.

Now, MallocChecker will actually check if a symbol is owned, and only
require freeing after a failed reallocation if it was owned before.

PR16730

llvm-svn: 188468
2013-08-15 17:22:06 +00:00
Ted Kremenek 71c080f625 [static analyzer] add a simple "CallEffects" API to query the retain count semantics of a method.
This is intended to be a simplified API, whose internals are
deliberately less efficient for the purpose of a simplified interface,
for use with clients that want to query the analyzer's heuristics for
determining retain count semantics.

There are no immediate clients, but it is intended to be used
by the ObjC modernizer.

llvm-svn: 188433
2013-08-14 23:41:49 +00:00
Ted Kremenek 243c08585b [static analyzer] Factor out ArgEffect and RetEffect into public header file.
This is a WIP change to allow other clients to query the retain count
heuristics of the static analyzer.

llvm-svn: 188432
2013-08-14 23:41:46 +00:00
Benjamin Kramer 27bc504285 DirectIvarAssignment: Replace vtable'd objects with simple functions.
Avoids unnecessary static constructors.

llvm-svn: 188083
2013-08-09 17:17:42 +00:00
Jordan Rose 867b185e63 [analyzer] Warn when using 'delete' on an uninitialized variable.
Patch by Karthik Bhat, modified slightly by me.

llvm-svn: 188043
2013-08-09 00:55:47 +00:00
Jordan Rose 54533f73a8 Eliminate CXXConstructorDecl::IsImplicitlyDefined.
This field is just IsDefaulted && !IsDeleted; in all places it's used,
a simple check for isDefaulted() is superior anyway, and we were forgetting
to set it in a few cases.

Also eliminate CXXDestructorDecl::IsImplicitlyDefined, for the same reasons.

No intended functionality change.

llvm-svn: 187891
2013-08-07 16:16:48 +00:00
Jordan Rose 7699e4a50b [analyzer] Don't process autorelease counts in synthesized function bodies.
We process autorelease counts when we exit functions, but if there's an
issue in a synthesized body the report will get dropped. Just skip the
processing for now and let it get handled when the caller gets around to
processing autoreleases.

(This is still suboptimal: objects autoreleased in the caller context
should never be warned about when exiting a callee context, synthesized
or not.)

Second half of <rdar://problem/14611722>

llvm-svn: 187625
2013-08-01 22:16:36 +00:00
Eli Friedman 75807f239e Make IgnoreParens() look through ChooseExprs.
This is the same way GenericSelectionExpr works, and it's generally a
more consistent approach.

A large part of this patch is devoted to caching the value of the condition
of a ChooseExpr; it's needed to avoid threading an ASTContext into
IgnoreParens().

Fixes <rdar://problem/14438917>.

llvm-svn: 186738
2013-07-20 00:40:58 +00:00
Jordan Rose e9c57229f9 [analyzer] Include analysis stack in crash traces.
Sample output:

0.     Program arguments: ...
1.     <eof> parser at end of file
2.     While analyzing stack:
       #0 void inlined()
       #1 void test()
3.     crash-trace.c:6:3: Error evaluating statement

llvm-svn: 186639
2013-07-19 00:59:08 +00:00
Craig Topper d6d31aceea Add 'static' and 'const' qualifiers to some arrays of strings.
llvm-svn: 186314
2013-07-15 08:24:27 +00:00
Jordan Rose 78cd51b2ee [analyzer] Add support for __builtin_addressof.
...so we don't regress on std::addressof.

llvm-svn: 186140
2013-07-12 00:26:14 +00:00
Craig Topper 2341c0d3b2 Use SmallVectorImpl instead of SmallVector for iterators and references to avoid specifying the vector size unnecessarily.
llvm-svn: 185610
2013-07-04 03:08:24 +00:00
Pavel Labath f77e736844 [analyzer] Improve handling of noreturn destructors
Summary:
The analyzer incorrectly handled noreturn destructors which were hidden inside
function calls. This happened because NoReturnFunctionChecker only listened for
PostStmt events, which are not executed for destructor calls. I've changed it to
listen to PostCall events, which should catch both cases.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1056

llvm-svn: 185522
2013-07-03 08:23:49 +00:00
Eli Friedman 57d1f1c8a5 Use getAs<> where appropriate on QualTypes instead of using dyn_cast.
llvm-svn: 184775
2013-06-24 18:47:11 +00:00
Anna Zaks 7925e3db63 [analyzer] Add a debug checker that prints Exploded Graph
Add a debug checker that is useful to understand how the ExplodedGraph is
built; it can be triggered using the following command:

 clang -cc1 -analyze -analyzer-checker=debug.ViewExplodedGraph my_program.c

A patch by Béatrice Creusillet!

llvm-svn: 184768
2013-06-24 18:12:12 +00:00
Reid Kleckner 7f62b95480 Check the canonical parameter type with getAs<>() in a static checker
This will prevent breakage when I introduce the DecayedType sugar node.

llvm-svn: 184755
2013-06-24 16:56:16 +00:00
Anna Zaks 27982c70fc [analyzer] Use output form collections’ count to decide if ObjC for loop should be entered
This fixes false positives by allowing us to know that a loop is always entered if
the collection count method returns a positive value and vice versa.

Addresses radar://14169391.

llvm-svn: 184618
2013-06-22 00:23:26 +00:00
Pavel Labath 963f91b3a2 Fix a crash in the static analyzer (bug #16307)
Summary:
When processing a call to a function, which got passed less arguments than it
expects, the analyzer would crash.

I've also added a test for that and a analyzer warning which detects these
cases.

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D994

llvm-svn: 184288
2013-06-19 08:19:56 +00:00
Anna Zaks 0325646705 [analyzer] Do not report uninitialized value warnings inside swap functions.
This silences warnings that could occur when one is swapping partially initialized structs. We suppress
not only the assignments of uninitialized members, but any values inside swap because swap could
potentially be used as a subroutine to swap class members.

This silences a warning from std::try::function::swap() on partially initialized objects.

llvm-svn: 184256
2013-06-18 23:16:15 +00:00
Reid Kleckner 2ab0ac5360 [AST] Don't include RecursiveASTVisitor.h in ASTContext.h
The untemplated implementation of getParents() doesn't need to be in a
header file.

RecursiveASTVisitor.h is full of repeated macro expansion.  Moving this
include to ASTContext.cpp speeds up compilation of
LambdaMangleContext.cpp, a small C++ file with few includes, from 3.7s
to 2.8s for me locally.  I haven't measured a full build, but it can't
hurt.

I had to fix a few static analyzer files that were depending on
transitive includes of C++ AST headers.

Reviewers: rsmith, klimek

Differential Revision: http://llvm-reviews.chandlerc.com/D982

llvm-svn: 184075
2013-06-17 12:56:08 +00:00
Pavel Labath 7e18009a7a Fix memory corruption in CStringChecker
Summary:
"register" functions for the checker were caching the checker objects in a
static variable. This caused problems when the function is called with a
different CheckerManager.

Reviewers: klimek

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D955

llvm-svn: 183823
2013-06-12 07:45:04 +00:00
Anna Zaks 8ebeb643fd [analyzer] Minor fixups to r183062
Based on feedback from Jordan.

llvm-svn: 183600
2013-06-08 00:29:29 +00:00
Anna Zaks a4bc5e1201 [analyzer] Malloc checker should only escape the receiver when “[O init..]” is called.
Jordan has pointed out that it is valuable to warn in cases when the arguments to init escape.
For example, NSData initWithBytes id not going to free the memory.

llvm-svn: 183062
2013-05-31 23:47:32 +00:00
Anna Zaks 737926ba6c [analyzer] Fix a false positive reported on rare strange code, which happens to be in JSONKit
llvm-svn: 183055
2013-05-31 22:39:13 +00:00
Duncan Sands f3dcb68d76 Fix comment type pointed out by Kim Gräsman.
llvm-svn: 182702
2013-05-25 02:22:10 +00:00
Duncan Sands 7d1e660b03 Fix comment typo pointed out by maslen on IRC.
llvm-svn: 182642
2013-05-24 13:41:43 +00:00
Jordan Rose a7f94ce8a3 Remove unused, awkward CFGStmtVisitor and subclasses.
This class is a StmtVisitor that distinguishes between block-level and
non-block-level statements in a CFG. However, it does so using a hard-coded
idea of which statements might be block-level, which probably isn't accurate
anymore. The only implementer of the CFGStmtVisitor hierarchy was the
analyzer's DeadStoresChecker, and the analyzer creates a linearized CFG
anyway (every non-trivial statement is a block-level statement).

This also allows us to remove the block-expr map ("BlkExprMap"), which
mapped statements to positions in the CFG. Apart from having a helper type
that really should have just been Optional<unsigned>, it was only being
used to ask /if/ a particular expression was block-level, for traversal
purposes in CFGStmtVisitor.

llvm-svn: 181945
2013-05-15 23:22:55 +00:00
Anna Zaks 6afa8f1609 [analyzer] Refactor: address Jordan’s code review of r181738.
(Modifying the checker to record that the values are no longer nil will be done separately.)

llvm-svn: 181744
2013-05-13 23:49:51 +00:00
Anna Zaks bb2a2c865f [analyzer] Warn about nil elements/keys/values in array and dictionary literals.
llvm-svn: 181738
2013-05-13 21:48:20 +00:00
Anna Zaks 4063fa1cdc [analyzer] Assume [NSNull null] does not return nil.
llvm-svn: 181616
2013-05-10 18:04:46 +00:00
Jordan Rose 757fbb0b14 [analyzer] Indirect invalidation counts as an escape for leak checkers.
Consider this example:

  char *p = malloc(sizeof(char));
  systemFunction(&p);
  free(p);

In this case, when we call systemFunction, we know (because it's a system
function) that it won't free 'p'. However, we /don't/ know whether or not
it will /change/ 'p', so the analyzer is forced to invalidate 'p', wiping
out any bindings it contains. But now the malloc'd region looks like a
leak, since there are no more bindings pointing to it, and we'll get a
spurious leak warning.

The fix for this is to notice when something is becoming inaccessible due
to invalidation (i.e. an imperfect model, as opposed to being explicitly
overwritten) and stop tracking it at that point. Currently, the best way
to determine this for a call is the "indirect escape" pointer-escape kind.

In practice, all the patch does is take the "system functions don't free
memory" special case and limit it to direct parameters, i.e. just the
arguments to a call and not other regions accessible to them. This is a
conservative change that should only cause us to escape regions more
eagerly, which means fewer leak warnings.

This isn't perfect for several reasons, the main one being that this
example is treated the same as the one above:

  char **p = malloc(sizeof(char *));
  systemFunction(p + 1);
  // leak

Currently, "addresses accessible by offsets of the starting region" and
"addresses accessible through bindings of the starting region" are both
considered "indirect" regions, hence this uniform treatment.

Another issue is our longstanding problem of not distinguishing const and
non-const bindings; if in the first example systemFunction's parameter were
a char * const *, we should know that the function will not overwrite 'p',
and thus we can safely report the leak.

<rdar://problem/13758386>

llvm-svn: 181607
2013-05-10 17:07:16 +00:00
Jordan Rose b147918252 [analyzer] RetainCountChecker: don't track through xpc_connection_set_context.
It is unfortunate that we have to mark these exceptions in multiple places.
This was already in CallEvent. I suppose it does let us be more precise
about saying /which/ arguments have their retain counts invalidated -- the
connection's is still valid even though the context object's isn't -- but
we're not tracking the retain count of XPC objects anyway.

<rdar://problem/13783514>

llvm-svn: 180904
2013-05-02 01:51:40 +00:00
Jordan Rose 9de821ebfd [analyzer] An ObjC for-in loop runs 0 times if the collection is nil.
In an Objective-C for-in loop "for (id element in collection) {}", the loop
will run 0 times if the collection is nil. This is because the for-in loop
is implemented using a protocol method that returns 0 when there are no
elements to iterate, and messages to nil will result in a 0 return value.

At some point we may want to actually model this message send, but for now
we may as well get the nil case correct, and avoid the false positives that
would come with this case.

<rdar://problem/13744632>

llvm-svn: 180639
2013-04-26 21:43:01 +00:00
Anna Zaks 144579e299 [analyzer] Teach DeadStoreChecker to look though BO_Comma and disregard the LHS.
llvm-svn: 180579
2013-04-25 21:52:35 +00:00
Anna Zaks 99394bbd02 [analyzer] Fix a crash in RetainCountChecker - we should not rely on CallEnter::getCallExpr to return non-NULL
We get a CallEnter with a null expression, when processing a destructor. All other users of
CallEnter::getCallExpr work fine with null as return value.

(Addresses PR15832, Thanks to Jordan for reducing the test case!)

llvm-svn: 180234
2013-04-25 00:41:32 +00:00
Anna Zaks 7712f38978 [analyzer] IvarInvalidation: correctly handle cases where only partial invalidators exist
- If only partial invalidators exist and there are no full invalidators in @implementation, report every ivar that has
not been invalidated. (Previously, we reported the first Ivar in the list, which could actually have been invalidated
by a partial invalidator. The code assumed you cannot have only partial invalidators.)

- Do not report missing invalidation method declaration if a partial invalidation method declaration exists.

llvm-svn: 180170
2013-04-24 02:49:16 +00:00
Anna Zaks 404028798f [analyzer] Set the allocation site to be the uniqueing location for retain count checker leaks.
The uniqueing location is the location which is part of the hash used to determine if two reports are
the same. This is used by the CmpRuns.py script to compare two analyzer runs and determine which
warnings are new.

llvm-svn: 180166
2013-04-23 23:57:50 +00:00
Jordan Rose 7467f06533 [analyzer] RetainCountChecker: Clean up path notes for autorelease.
No functionality change.

<rdar://problem/13710586>

llvm-svn: 180075
2013-04-23 01:42:25 +00:00
Jordan Rose 6e3cf2ba85 [analyzer] Model strsep(), particularly that it returns its input.
This handles the false positive leak warning in PR15374, and also serves
as a basic model for the strsep() function.

llvm-svn: 180069
2013-04-22 23:18:42 +00:00
Jordan Rose 3437669ca9 [analyzer] Type information from C++ new expressions is perfect.
This improves our handling of dynamic_cast and devirtualization for
objects allocated by 'new'.

llvm-svn: 180051
2013-04-22 21:36:44 +00:00
Jordan Rose add14263ea [analyzer] Don't warn for returning void expressions in void blocks.
This was slightly tricky because BlockDecls don't currently store an
inferred return type. However, we can rely on the fact that blocks with
inferred return types will have return statements that match the inferred
type.

<rdar://problem/13665798>

llvm-svn: 179699
2013-04-17 18:03:48 +00:00
Ted Kremenek 8671acba95 [analyzer] Add experimental option "leak-diagnostics-reference-allocation".
This is an opt-in tweak for leak diagnostics to reference the allocation
site if the diagnostic consumer only wants a pithy amount of information,
and not the entire path.

This is a strawman enhancement that I expect to see some experimentation
with over the next week, and can go away if we don't want it.

Currently it is only used by RetainCountChecker, but could be used
by MallocChecker if and when we decide this should stay in.

llvm-svn: 179634
2013-04-16 21:44:22 +00:00
Ted Kremenek eb5f089ce1 Properly sort list.
llvm-svn: 179627
2013-04-16 21:10:09 +00:00
Anna Zaks e4cfcd4e41 [analyzer] Improve the malloc checker stack hint message
llvm-svn: 179580
2013-04-16 00:22:55 +00:00
Anton Yartsev 7af0aa86dd [analyzer] Enable NewDelete checker if NewDeleteLeaks checker is enabled.
llvm-svn: 179428
2013-04-12 23:25:40 +00:00
Anton Yartsev c92f2c5899 [analyzer] Makes NewDeleteLeaks checker work independently from NewDelete.
llvm-svn: 179410
2013-04-12 20:48:49 +00:00
Anna Zaks 6cea7d9e5e [analyzer]Print field region even when the base region is not printable
llvm-svn: 179395
2013-04-12 18:40:21 +00:00
Jordan Rose 73b75e01bf [analyzer] Fix grammar in comment.
By Adam Schnitzer!

llvm-svn: 179352
2013-04-12 00:44:24 +00:00
Anton Yartsev 1e2bc9b53b [analyzer] Refactoring: better doxygen comment; renaming isTrackedFamily to isTrackedByCurrentChecker
llvm-svn: 179242
2013-04-11 00:05:20 +00:00
Anna Zaks 07804ef87e [analyzer] Address Jordan’s review of r179219
llvm-svn: 179235
2013-04-10 22:56:33 +00:00
Anna Zaks 3f303be636 [analyzer] Address Jordan’s code review of r 179221
llvm-svn: 179234
2013-04-10 22:56:30 +00:00
Anton Yartsev cb2ccd6b79 [analyzer] Switched to checkPreCall interface for detecting usage after free.
Now the check is also applied to arguments for Objective-C method calls and to 'this' pointer.

llvm-svn: 179230
2013-04-10 22:21:41 +00:00
Anna Zaks 60d98befe8 [analyzer] Fix a crash in SyntaxCString checker when given a custom strncat.
Fixes PR13476

llvm-svn: 179228
2013-04-10 22:06:29 +00:00
Anna Zaks e51362e7f7 [analyzer] When reporting a leak in RetainCount checker due to an early exit from init, step into init.
The heuristic here (proposed by Jordan) is that, usually, if a leak is due to an early exit from init, the allocation site will be
a call to alloc. Note that in other cases init resets self to [super init], which becomes the allocation site of the object.

llvm-svn: 179221
2013-04-10 21:42:06 +00:00
Anna Zaks 7c19abeba6 [analyzer] Cleanup leak warnings: do not print the names of variables from other functions.
llvm-svn: 179219
2013-04-10 21:42:02 +00:00
Jordan Rose 61e221f68d [analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().
Previously, the analyzer used isIntegerType() everywhere, which uses the C
definition of "integer". The C++ predicate with the same behavior is
isIntegerOrUnscopedEnumerationType().

However, the analyzer is /really/ using this to ask if it's some sort of
"integrally representable" type, i.e. it should include C++11 scoped
enumerations as well. hasIntegerRepresentation() sounds like the right
predicate, but that includes vectors, which the analyzer represents by its
elements.

This commit audits all uses of isIntegerType() and replaces them with the
general isIntegerOrEnumerationType(), except in some specific cases where
it makes sense to exclude scoped enumerations, or any enumerations. These
cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>()
plus BuiltinType::isInteger().

isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and
include/clang/StaticAnalysis. :-)

Fixes real assertion failures. PR15703 / <rdar://problem/12350701>

llvm-svn: 179081
2013-04-09 02:30:33 +00:00
Anna Zaks 93a21a8cfe [analyzer] Keep tracking the pointer after the escape to more aggressively report mismatched deallocator
Test that the path notes do not change. I don’t think we should print a note on escape.

Also, I’ve removed a check that assumed that the family stored in the RefStete could be
AF_None and added an assert in the constructor.

llvm-svn: 179075
2013-04-09 00:30:28 +00:00
Ted Kremenek e06df46f3f Tweak warning text for nil value in ObjC container warning.
llvm-svn: 179034
2013-04-08 18:09:16 +00:00
Anna Zaks a1de8567fc [analyzer] Shorten the malloc checker’s leak message
As per Ted’s suggestion!

llvm-svn: 178938
2013-04-06 00:41:36 +00:00
Anna Zaks 4d1e30471d [analyzer] Reword error messages for nil keys and values of NSMutableDictionary.
llvm-svn: 178935
2013-04-05 23:50:18 +00:00
Anton Yartsev 030bcdd9e8 [analyzer] Eliminates all the cases with unknown family.
Now treat AF_None family as impossible in isTrackedFamily()

llvm-svn: 178899
2013-04-05 19:08:04 +00:00
Jordan Rose 10ad081fc6 [analyzer] Re-enable cplusplus.NewDelete (but not NewDeleteLeaks).
As mentioned in the previous commit message, the use-after-free and
double-free warnings for 'delete' are worth enabling even while the
leak warnings still have false positives.

llvm-svn: 178891
2013-04-05 17:55:07 +00:00
Jordan Rose 26330563f2 [analyzer] Split new/delete checker into use-after-free and leaks parts.
This splits the leak-checking part of alpha.cplusplus.NewDelete into a
separate user-level checker, alpha.cplusplus.NewDeleteLeaks. All the
difficult false positives we've seen with the new/delete checker have been
spurious leak warnings; the use-after-free warnings and mismatched
deallocator warnings, while rare, have always been valid.

<rdar://problem/6194569>

llvm-svn: 178890
2013-04-05 17:55:00 +00:00
Anton Yartsev f0593d67a7 [analyzer] Path notes for the MismatchedDeallocator checker.
llvm-svn: 178862
2013-04-05 11:25:10 +00:00
Anton Yartsev 6e49925622 [analyzer] Check allocation family more precise.
The statement passed to isTrackedFamily() might be a user defined function calling malloc; in this case we got AF_NONE family for this function.
Now the allocation family is derived from Sym, that holds a family of a real allocator.

This commit is also a movement towards getting rid of tracking memory allocating by unknown means.

llvm-svn: 178834
2013-04-05 02:25:02 +00:00
Anton Yartsev 2f91004b64 [analyzer] Corrected the switch statement.
llvm-svn: 178831
2013-04-05 02:12:04 +00:00
Anton Yartsev 717aa0eac2 [analyzer] Fully-covered switch for families in isTrackedFamily()
llvm-svn: 178820
2013-04-05 00:31:02 +00:00
Anton Yartsev e3377fbca2 [analyzer] Reduced the unwanted correlations between checkers living inside MallocChecker.cpp
This fixes an issue pointed to by Jordan: if unix.Malloc and unix.MismatchedDeallocator are both on, then we end up still tracking leaks of memory allocated by new.
Moved the guards right before emitting the bug reports to unify and simplify the logic of handling of multiple checkers. Now all the checkers perform their checks regardless of if they were enabled, or not, and it is decided just before the emitting of the report, if it should be emitted. (idea from Anna).

Additional changes: 
improved test coverage for checker correlations;
refactoring: BadDealloc -> MismatchedDealloc

llvm-svn: 178814
2013-04-04 23:46:29 +00:00
Jordan Rose 3903247e48 [analyzer] RetainCountChecker: refactor annotation handling.
...and add a new test case.

I thought this was broken, but it isn't; refactoring and reformatting anyway
so that I don't make the same mistake again. No functionality change.

llvm-svn: 178799
2013-04-04 22:31:48 +00:00
Anna Zaks 8ef07e5181 [analyzer] Rename “Mac OS X API”, “Mac OS API” -> “API Misuse (Apple)”
As they are relevant on both Mac and iOS.

llvm-svn: 178687
2013-04-03 19:28:22 +00:00
Anna Zaks c610bcacde [analyzer] Warn when nil receiver results in forming null reference
This also allows us to ensure IDC/return null suppression gets triggered in such cases.

llvm-svn: 178686
2013-04-03 19:28:19 +00:00
Jordan Rose bc74eb1c90 [analyzer] Better model for copying of array fields in implicit copy ctors.
- Find the correct region to represent the first array element when
  constructing a CXXConstructorCall.
- If the array is trivial, model the copy with a primitive load/store.
- Don't warn about the "uninitialized" subscript in the AST -- we don't use
  the helper variable that Sema provides.

<rdar://problem/13091608>

llvm-svn: 178602
2013-04-03 01:39:08 +00:00
Anton Yartsev 01acbcebbb [analyzer] Moving cplusplus.NewDelete to alpha.* for now.
llvm-svn: 178529
2013-04-02 05:59:24 +00:00
Anna Zaks 4b04e66c4f [analyzer] Document existence of ConstPointerEscape.
llvm-svn: 178311
2013-03-28 23:15:32 +00:00
Anna Zaks 333481b90b [analyzer] Add support for escape of const pointers and use it to allow “newed” pointers to escape
Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works
for const pointers passed as a top level parameter into a function. We need to differentiate the const
pointers escape from regular escape since the content pointed by const pointer will not change;
if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers.

This should suppress several false positives reported by the NewDelete checker on llvm codebase.

llvm-svn: 178310
2013-03-28 23:15:29 +00:00
Anna Zaks 05fb371efc [analyzer] Apply the suppression rules to the nil receiver only if the value participates in the computation of the nil we warn about.
We should only suppress a bug report if the IDCed or null returned nil value is directly related to the value we are warning about. This was
not the case for nil receivers - we would suppress a bug report that had an IDCed nil receiver on the path regardless of how it’s
related to the warning.

1) Thread EnableNullFPSuppression parameter through the visitors to differentiate between tracking the value which
is directly responsible for the bug and other values that visitors are tracking (ex: general tracking of nil receivers).
2) in trackNullOrUndef specifically address the case when a value of the message send is nil due to the receiver being nil.

llvm-svn: 178309
2013-03-28 23:15:22 +00:00
Ted Kremenek db70b5295e Use early return in printing logic. Minor cleanup.
llvm-svn: 178264
2013-03-28 18:43:18 +00:00
Eric Christopher 06cbed4121 Fix order of initialization warning.
llvm-svn: 178255
2013-03-28 18:22:58 +00:00
Anton Yartsev 0578959981 [analyzer] These implements unix.MismatchedDeallocatorChecker checker.
+ Improved display names for allocators and deallocators

The checker checks if a deallocation function matches allocation one. ('free' for 'malloc', 'delete' for 'new' etc.)

llvm-svn: 178250
2013-03-28 17:05:19 +00:00
Anton Yartsev 8b662704dc [analyzer] For now assume all standard global 'operator new' functions allocate memory in heap.
+ Improved test coverage for cplusplus.NewDelete checker.

llvm-svn: 178244
2013-03-28 16:10:38 +00:00
Anna Zaks 22fa6ecc14 [analyzer] Ensure that the node NilReceiverBRVisitor is looking for is not reclaimed
The visitor should look for the PreStmt node as the receiver is nil in the PreStmt and this is the node. Also, tag the nil
receiver nodes with a special tag for consistency.

llvm-svn: 178152
2013-03-27 17:35:58 +00:00
Anna Zaks bd8f60d6d1 [analyzer] Make sure IDC works for ‘NSContainer value/key is nil’ checks.
Register the nil tracking visitors with the region and refactor trackNullOrUndefValue a bit.

Also adds the cast and paren stripping before checking if the value is an OpaqueValueExpr
or ExprWithCleanups.

llvm-svn: 178093
2013-03-26 23:58:49 +00:00
Anton Yartsev 13df03624b [analyzer] Adds cplusplus.NewDelete checker that check for memory leaks, double free, and use-after-free problems of memory managed by new/delete.
llvm-svn: 177849
2013-03-25 01:35:45 +00:00
Anna Zaks 130df4b0a4 [analyzer] Warn when a nil key or value are passed to NSMutableDictionary and ensure it works with subscripting.
llvm-svn: 177789
2013-03-23 00:39:21 +00:00
Jordan Rose e4bdb1016e [analyzer] Print return values from debug.DumpCalls checker.
Debug utility only, no functionality change.

llvm-svn: 177649
2013-03-21 18:16:59 +00:00
Anna Zaks 6457ad2335 [analyzer] Warn when a ‘nil’ object is added to NSArray or NSMutableArray.
llvm-svn: 177318
2013-03-18 20:46:56 +00:00
Anna Zaks 0e4513b030 [analyzer] Address a TODO in the StreamChecker; otherwise the output is non-deterministic.
llvm-svn: 177207
2013-03-15 23:34:31 +00:00
Anton Yartsev 6c2af43991 [analyzer] fixed the logic changed by r176949
llvm-svn: 176956
2013-03-13 17:07:32 +00:00
Anton Yartsev 59ed15b052 Refactoring:
+ Individual Report* method for each bug type
+ Comment improved: missing non-trivial alloca() case annotated
+ 'range' parameter of ReportBadFree() capitalized
+ 'SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol();' shorten to 'SymbolRef Sym = C.getSVal(A).getAsSymbol();'

llvm-svn: 176949
2013-03-13 14:39:10 +00:00
Anna Zaks ef89339986 [analyzer] Rename AttrNonNullChecker -> NonNullParamChecker
llvm-svn: 176755
2013-03-09 03:23:14 +00:00
Jordan Rose 613f3c0022 [analyzer] Be more consistent about Objective-C methods that free memory.
Previously, MallocChecker's pointer escape check and its post-call state
update for Objective-C method calls had a fair amount duplicated logic
and not-entirely-consistent checks. This commit restructures all this to
be more consistent and possibly allow us to be more aggressive in warning
about double-frees.

New policy (applies to system header methods only):
(1) If this is a method we know about, model it as taking/holding ownership
    of the passed-in buffer.
  (1a) ...unless there's a "freeWhenDone:" parameter with a zero (NO) value.
(2) If there's a "freeWhenDone:" parameter (but it's not a method we know
    about), treat the buffer as escaping if the value is non-zero (YES) and
    non-escaping if it's zero (NO).
(3) If the first selector piece ends with "NoCopy" (but it's not a method we
    know about and there's no "freeWhenDone:" parameter), treat the buffer
    as escaping.

The reason that (2) and (3) don't explicitly model the ownership transfer is
because we can't be sure that they will actually free the memory using free(),
and we wouldn't want to emit a spurious "mismatched allocator" warning
(coming in Anton's upcoming patch). In the future, we may have an idea of a
"generic deallocation", i.e. we assume that the deallocator is correct but
still continue tracking the region so that we can warn about double-frees.

Patch by Anton Yartsev, with modifications from me.

llvm-svn: 176744
2013-03-09 00:59:10 +00:00
Anna Zaks 9e0da9e070 [analyzer] Warn on passing a reference to null pointer as an argument in a call
Warn about null pointer dereference earlier when a reference to a null pointer is
passed in a call. The idea is that even though the standard might allow this, reporting
the issue earlier is better for diagnostics (the error is reported closer to the place where
the pointer was set to NULL). This also simplifies analyzer’s diagnostic logic, which has
to track “where the null came from”. As a consequence, some of our null pointer
warning suppression mechanisms started triggering more often.

TODO: Change the name of the file and class to reflect the new check.
llvm-svn: 176612
2013-03-07 03:02:36 +00:00
Jordan Rose b41977f852 [analyzer] Check for returning null references in ReturnUndefChecker.
Officially in the C++ standard, a null reference cannot exist. However,
it's still very easy to create one:

int &getNullRef() {
  int *p = 0;
  return *p;
}

We already check that binds to reference regions don't create null references.
This patch checks that we don't create null references by returning, either.

<rdar://problem/13364378>

llvm-svn: 176601
2013-03-07 01:23:25 +00:00
Anna Zaks 23c85ed52b [analyzer] Pass the correct Expr to the bug reporter visitors when dealing with CompoundLiteralExpr
This allows us to trigger the IDC visitor in the added test case.

llvm-svn: 176577
2013-03-06 20:26:02 +00:00
Jordan Rose 85707b28e8 [analyzer] Don't let cf_audited_transfer override CFRetain semantics.
We weren't treating a cf_audited_transfer CFRetain as returning +1 because
its name doesn't contain "Create" or "Copy". Oops! Fortunately, the
standard definitions of these functions are not marked audited.

<rdar://problem/13339601>

llvm-svn: 176463
2013-03-04 23:21:32 +00:00
Jordan Rose c948709cda [analyzer] StackAddrEscapeChecker: strip qualifiers from temporary types.
With the new support for trivial copy constructors, we are not always
consistent about whether a CXXTempObjectRegion gets reused or created
from scratch, which affects whether qualifiers are preserved. However,
we probably don't care anyway.

This also switches to using the current PrintingPolicy for the type,
which means C++ types don't get a spurious 'struct' prefix anymore.

llvm-svn: 176068
2013-02-26 01:21:21 +00:00
Anna Zaks ba34272321 [analyzer] Restrict ObjC type inference to methods that have related result type.
This addresses a case when we inline a wrong method due to incorrect
dynamic type inference. Specifically, when user code contains a method from init
family, which creates an instance of another class.

Use hasRelatedResultType() to find out if our inference rules should be triggered.

llvm-svn: 176054
2013-02-25 22:10:34 +00:00
Ted Kremenek 9625048278 [analyzer] tracking stores/constraints now works for ObjC ivars or struct fields.
This required more changes than I originally expected:

- ObjCIvarRegion implements "canPrintPretty" et al
- DereferenceChecker indicates the null pointer source is an ivar
- bugreporter::trackNullOrUndefValue() uses an alternate algorithm
  to compute the location region to track by scouring the ExplodedGraph.
  This allows us to get the actual MemRegion for variables, ivars,
  fields, etc.  We only hand construct a VarRegion for C++ references.
- ExplodedGraph no longer drops nodes for expressions that are marked
  'lvalue'.  This is to facilitate the logic in the previous bullet.
  This may lead to a slight increase in size in the ExplodedGraph,
  which I have not measured, but it is likely not to be a big deal.

I have validated each of the changed plist output.

Fixes <rdar://problem/12114812>

llvm-svn: 175988
2013-02-24 07:21:01 +00:00
Ted Kremenek e3cf171730 Add "KnownSVal" to represent SVals that cannot be UnknownSVal.
This provides a few sundry cleanups, and allows us to provide
a compile-time check for a case that was a runtime assertion.

llvm-svn: 175987
2013-02-24 07:20:53 +00:00
David Blaikie 00be69ab5c Remove the CFGElement "Invalid" state.
Use Optional<CFG*> where invalid states were needed previously. In the one case
where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy
CFGAutomaticObjDtor.

Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek
and Doug Gregor.

Post commit code review feedback on r175796 by Ted Kremenek.

llvm-svn: 175938
2013-02-23 00:29:34 +00:00
David Blaikie 3cbec0f73d Add back implicitly dropped const.
(found due to incoming improvements to llvm::cast machinery that will error on
this sort of mistake)

llvm-svn: 175817
2013-02-21 22:37:44 +00:00
David Blaikie 87396b9b08 Replace ProgramPoint llvm::cast support to be well-defined.
See r175462 for another example/more details.

llvm-svn: 175812
2013-02-21 22:23:56 +00:00
David Blaikie 2a01f5d426 Replace CFGElement llvm::cast support to be well-defined.
See r175462 for another example/more details.

llvm-svn: 175796
2013-02-21 20:58:29 +00:00
David Blaikie 3a3c4e0f84 Avoid implicit conversions of Optional<T> to bool.
This is a precursor to making Optional<T>'s operator bool 'explicit' when
building Clang & LLVM as C++11.

llvm-svn: 175722
2013-02-21 06:05:05 +00:00
David Blaikie 7a30dc53c5 Use None rather than Optional<T>() where possible.
llvm-svn: 175705
2013-02-21 01:47:18 +00:00
David Blaikie 05785d1622 Include llvm::Optional in clang/Basic/LLVM.h
Post-commit CR feedback from Jordan Rose regarding r175594.

llvm-svn: 175679
2013-02-20 22:23:23 +00:00
David Blaikie e359f3caee Remove redundant Optional type in favor of llvm::Optional
llvm-svn: 175678
2013-02-20 22:23:03 +00:00
David Blaikie 2fdacbc5b0 Replace SVal llvm::cast support to be well-defined.
See r175462 for another example/more details.

llvm-svn: 175594
2013-02-20 05:52:05 +00:00
Ted Kremenek 3e05be9de3 Disable dead stores checker for template instantations. Fixes <rdar://problem/13213575>.
llvm-svn: 175425
2013-02-18 07:18:28 +00:00
Fariborz Jahanian aedaaa4f35 objective-C: synthesize properties in order of their
declarations to synthesize their ivars in similar
determinstic order so they are laid out in
a determinstic order. // rdar://13192366

llvm-svn: 175214
2013-02-14 22:33:34 +00:00
Jordan Rose 4938f276a5 Remove some stray uses of <ctype.h> functions.
These are causing assertions on some MSVC builds.

llvm-svn: 174805
2013-02-09 10:09:43 +00:00
Anna Zaks 7811c3efd5 [analyzer] Invalidation checker: move the "missing implementation" check
The missing definition check should be in the same category as the
missing ivar validation - in this case, the intent is to invalidate in
the given class, as described in the declaration, but the implementation
does not perform the invalidation. Whereas the MissingInvalidationMethod
checker checks the cases where the method intention is not to
invalidate. The second checker has potential to have a much higher false
positive rate.

llvm-svn: 174787
2013-02-09 01:09:27 +00:00
Anna Zaks 0d8779cb79 [analyzer] Move DefaultBool so that all checkers can share it.
llvm-svn: 174782
2013-02-08 23:55:50 +00:00
Anna Zaks 91a5fdf83a [analyzer] Split IvarInvalidation into two checkers
Separate the checking for the missing invalidation methods into a
separate checker so that it can be turned on/off independently.

llvm-svn: 174781
2013-02-08 23:55:47 +00:00
Anna Zaks 470543bb2b [analyzer] IvarInvalidation: refactor, pull out the diagnostic printing
llvm-svn: 174780
2013-02-08 23:55:45 +00:00
Anna Zaks a5096f6f51 [analyzer] IvarInvalidation: add annotation for partial invalidation
The new annotation allows having methods that only partially invalidate
IVars and might not be called from the invalidation methods directly
(instead, are guaranteed to be called before the invalidation occurs).
The checker is going to trust the programmer to call the partial
invalidation method before the invalidator.This is common in cases when
partial object tear down happens before the death of the object.

llvm-svn: 174779
2013-02-08 23:55:43 +00:00
Anna Zaks c89ad07d39 [analyzer] Report bugs when freeing memory with offset pointer
The malloc checker will now catch the case when a previously malloc'ed
region is freed, but the pointer passed to free does not point to the
start of the allocated memory. For example:

int *p1 = malloc(sizeof(int));
p1++;
free(p1); // warn

From the "memory.LeakPtrValChanged enhancement to unix.Malloc" entry
in the list of potential checkers.

A patch by Branden Archer!

llvm-svn: 174678
2013-02-07 23:05:47 +00:00
Anna Zaks acdc13cb00 [analyzer] Add pointer escape type param to checkPointerEscape callback
The checkPointerEscape callback previously did not specify how a
pointer escaped. This change includes an enum which describes the
different ways a pointer may escape. This enum is passed to the
checkPointerEscape callback when a pointer escapes. If the escape
is due to a function call, the call is passed. This changes
previous behavior where the call is passed as NULL if the escape
was due to indirectly invalidating the region the pointer referenced.

A patch by Branden Archer!

llvm-svn: 174677
2013-02-07 23:05:43 +00:00
Anna Zaks a8bcc65819 [analyzer]RetainCount: Fix an autorelease related false positive.
The Cnt variable is adjusted (incremented) for simplification of
checking logic. The increment should not be stored in the state.

llvm-svn: 174104
2013-01-31 22:36:17 +00:00
Jordan Rose 95bf3b0a6c [analyzer] Don't track autorelease pools created by +new.
This matches our behavior for autorelease pools created by +alloc. Some
people like to create autorelease pools in one method and release them
somewhere else.

If you want safe autorelease pool semantics, use the new ARC-compatible
syntax: @autoreleasepool { ... }

<rdar://problem/13121353>

llvm-svn: 174096
2013-01-31 22:06:02 +00:00
Jordan Rose aea020f04e [analyzer] Track null object lvalues back through C++ method calls.
The expression 'a->b.c()' contains a call to the 'c' method of 'a->b'.
We emit an error if 'a' is NULL, but previously didn't actually track
the null value back through the 'a->b' expression, which caused us to
miss important false-positive-suppression cases, including
<rdar://problem/12676053>.

llvm-svn: 173547
2013-01-26 01:28:23 +00:00
Jordan Rose c362edad85 [analyzer] bugreporter::getDerefExpr now takes a Stmt, not an ExplodedNode.
This allows it to be used in places where the interesting statement
doesn't match up with the current node. No functionality change.

llvm-svn: 173546
2013-01-26 01:28:19 +00:00
Ted Kremenek 5b4500b43a Add missing null check. Not sure why my tests passed before.
llvm-svn: 173292
2013-01-23 21:12:49 +00:00
Ted Kremenek 54cd3c6811 Honor attribute 'analyzer_noreturn' on Objective-C methods.
This isn't likely a full solution, but it catches the common cases
and can be refined over time.

Fixes <rdar://problem/11634353>.

llvm-svn: 173291
2013-01-23 21:00:27 +00:00
Anna Zaks 0e9c94199c [analyzer] DirectIvarAssignment: allow suppression annotation on Ivars.
llvm-svn: 172766
2013-01-17 23:24:58 +00:00
Richard Smith 10876ef571 Implement C++11 semantics for [[noreturn]] attribute. This required splitting
it apart from [[gnu::noreturn]] / __attribute__((noreturn)), since their
semantics are not equivalent (for instance, we treat [[gnu::noreturn]] as
affecting the function type, whereas [[noreturn]] does not).

llvm-svn: 172691
2013-01-17 01:30:42 +00:00