Commit Graph

11 Commits

Author SHA1 Message Date
Ted Kremenek 868dbda367 [analyzer] do not warn about returning stack-allocated memory when it comes from an ancestor stack frame.
llvm-svn: 151964
2012-03-03 01:22:03 +00:00
Ted Kremenek 3d3aea9374 [analyzer] fix inlining's handling of mapping actual to formal arguments and limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths.
llvm-svn: 148036
2012-01-12 19:25:46 +00:00
Ted Kremenek 3f406ba4bf Remove '#if 0' from ExprEngine::InlineCall(), and start fresh by wiring up inlining for straight C calls.
My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders
and re-evaluating how C++ calls are handled in the CFG.  The hope is to turn inlining "on-by-default" as soon as possible
with a core set of things working well, and then expand over time.

llvm-svn: 147904
2012-01-11 01:06:27 +00:00
Ted Kremenek 98a24e37c5 Begin reworking static analyzer support for C++ method calls. The current logic was divorced
from how we process ordinary function calls, had a tremendous about of redundancy, and relied
strictly on inlining behavior (which was incomplete) to provide semantics instead of falling
back to the conservative analysis we use for C functions.  This is a significant step into
making C++ analyzer support more useful.

llvm-svn: 128557
2011-03-30 17:41:19 +00:00
Argyrios Kyrtzidis 9eb02dfa89 [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
llvm-svn: 126676
2011-02-28 19:49:42 +00:00
Argyrios Kyrtzidis 2c49ec7f1d [analyzer] Migrate NSErrorChecker and DereferenceChecker to CheckerV2.
They cooperate in that NSErrorChecker listens for ImplicitNullDerefEvent events that
DereferenceChecker can dispatch.
ImplicitNullDerefEvent is when we dereferenced a location that may be null.

llvm-svn: 126659
2011-02-28 17:36:18 +00:00
Ted Kremenek 95d874fa5d Teach RegionStore::EnterStackFrame() to handle
the case where the called function has fewer
formal arguments than actual arguments.  This
fixes a crash in the analyzer when doing
function call inlining.

Patch by Zhenbo Xu!

llvm-svn: 123458
2011-01-14 20:29:43 +00:00
Zhongxing Xu 1a56a488ed Turn -analyzer-inline-call on for C functions. This also fixed a bug that
after inlining post-call checking shouldn't be done.

llvm-svn: 103161
2010-05-06 03:38:27 +00:00
Zhongxing Xu 685a1d818d Refactor the AnalysisConsumer to analyze functions after the whole
translation unit is parsed. This enables us to inline some calls when still
analyzing one function at a time.

Actions are classified into Function, CXXMethod, ObjCMethod, 
ObjCImplementation.

This does not hurt performance much. The analysis time for sqlite3.c:

before:
real    17m52.440s
user    17m49.460s
sys    0m2.010s

after:
real    18m0.500s
user    17m56.900s
sys    0m2.330s

DisplayProgress option is broken now. -inine-call action is removed. It
will be reenabled in another form, perhaps as an indenpendant option.

llvm-svn: 102689
2010-04-30 04:14:20 +00:00
Ted Kremenek bb6f5af4a4 Tweak null dereference diagnostics to give clearer diagnostics when
a null dereference results from a field access.

llvm-svn: 99236
2010-03-23 01:11:38 +00:00
Zhongxing Xu e334bb1a66 Add test case for inlining call analysis.
llvm-svn: 97300
2010-02-27 02:44:37 +00:00