Commit Graph

152 Commits

Author SHA1 Message Date
Ted Kremenek a4a57c10da Re-enable the IdempotentOperations checker for --analyze, and put it and the DeadStores checker into the "deadcode" group.
llvm-svn: 127531
2011-03-12 06:14:28 +00:00
Ted Kremenek eff9a7ff91 Teach CFGBuilder to prune trivially unreachable case statements.
llvm-svn: 126797
2011-03-01 23:12:55 +00:00
Argyrios Kyrtzidis 9eb02dfa89 [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
llvm-svn: 126676
2011-02-28 19:49:42 +00:00
Argyrios Kyrtzidis 142dbbfcd8 [analyzer] Migrate NoReturnFunctionChecker to CheckerV2.
llvm-svn: 126613
2011-02-28 01:27:17 +00:00
Argyrios Kyrtzidis 183f0fb4cf [analyzer] Migrate MallocChecker to CheckerV2.
llvm-svn: 126606
2011-02-28 01:26:35 +00:00
Argyrios Kyrtzidis b388f77ad9 [analyzer] Remove '-analyzer-experimental-internal-checks' flag, it doesn't have any checkers associated with it anymore.
llvm-svn: 126440
2011-02-24 21:43:08 +00:00
Argyrios Kyrtzidis c08d89e6c2 Allow passing a list of comma separated checker names to -analyzer-checker, e.g:
-analyzer-checker=cocoa,unix

llvm-svn: 126372
2011-02-24 08:42:20 +00:00
Ted Kremenek d813801384 Fix tiny error in CFG construction for BinaryConditionalOperators, making sure the branch always has two successors. Also teach Environment::getSVal() about OpaqueValueExprs.
This fixes a crash reported in PR9287, and also fixes a false positive involving the value of such ternary
expressions not properly getting propagated.

llvm-svn: 126362
2011-02-24 03:09:15 +00:00
Ted Kremenek 828f631af1 Fix a CFGBuilder bug exposed on convoluted control-flow in the Linux kernel.
llvm-svn: 126149
2011-02-21 22:11:26 +00:00
Argyrios Kyrtzidis a9215281de [analyzer] Use the new registration mechanism on some of the experimental internal checkers:
CastToStructChecker
  FixedAddressChecker
  PointerArithChecker
  PointerSubChecker

llvm-svn: 125612
2011-02-15 22:55:20 +00:00
Argyrios Kyrtzidis b2400924d9 [analyzer] Use the new registration mechanism on the IdempotentOperationChecker.
llvm-svn: 125611
2011-02-15 22:55:14 +00:00
Argyrios Kyrtzidis a6d04d541d [analyzer] Use the new registration mechanism on some of the internal checks. These are:
StackAddrLeakChecker
ObjCAtSyncChecker
UnixAPIChecker
MacOSXAPIChecker

The rest have/create implicit dependencies between checkers and need to be handled differently.

llvm-svn: 125559
2011-02-15 07:42:33 +00:00
Ted Kremenek 6cc8f5d83c Add test case for PR 8646.
llvm-svn: 125401
2011-02-11 20:13:27 +00:00
Ted Kremenek 18fb1665bf Remove invalid assertion from CFG builder. When building the CFG pieces for a ternary '?' expression,
it is possible for the confluence block to only have a single predecessor due to calls to 'noreturn'
functions.  Fixes assertion failure reported in PR 8619.

llvm-svn: 119284
2010-11-15 22:59:22 +00:00
Ted Kremenek db73d599b7 Relax assertion in SValuator so that we don't crash when analyzing a call via a function pointer that
casts the return value to something completely different.  While we need better reasoning here,
we should definately not crash.

llvm-svn: 119177
2010-11-15 20:09:42 +00:00
Ted Kremenek 843c53828f RegionStore/BasicStore: do not return UndefinedVal for accesses to concrete addresses; instead return UnknownVal. This
leads it up to checkers (e.g., DereferenceChecker) to guard against illegal accesses (e.g., null dereferences).

Fixes PR 5272 and <rdar://problem/6839683>.

llvm-svn: 118852
2010-11-11 23:10:10 +00:00
Ted Kremenek 6348dac7a0 Fix lazy symbolication bug in RegionStore involving fields of global variables. When invalidated, the entire
globals memory space gets assigned a symbolic value, but that value was not being used for lazy symbolication
of fields of globals.  This could result in cases where bogus null dereferences were being reported.

Fixes PR 8440.

llvm-svn: 117336
2010-10-26 00:06:17 +00:00
Ted Kremenek c07d8353e1 Add check for UnknownVals for mutexes in ObjCAtSyncChecker. Fixes crash reported in PR 8458.
llvm-svn: 117300
2010-10-25 20:20:56 +00:00
Ted Kremenek c5644e1b97 Tweak the ObjCAtSyncChecker to assume that a mutex is non-nil after checking that it is
nil.  Otherwise we can get false paths where a second @synchronized using the mutex
can have a bogus warning.  Fixes <rdar://problem/8578650>.

llvm-svn: 117016
2010-10-21 15:38:55 +00:00
Argyrios Kyrtzidis 40cec8326c Revert r114316, -Wunused-value enabled by default was intended.
llvm-svn: 114318
2010-09-19 23:03:35 +00:00
Argyrios Kyrtzidis 3698bf1c6d Make -Wunused-value off by default, matching GCC. Fixes rdar://7126194.
llvm-svn: 114316
2010-09-19 21:21:44 +00:00
Ted Kremenek 7b31a61d10 Relax assertion in CFG builder when processing ForStmts. This fixes an assertion failure
on code containing GNU statement expressions reported in PR 8141.

llvm-svn: 113953
2010-09-15 07:01:20 +00:00
Ted Kremenek 0a3f523614 Polish diagnostics for null dereferences via ObjC ivar accesses. Finishes up <rdar://problem/6352035>.
llvm-svn: 113612
2010-09-10 20:20:49 +00:00
Ted Kremenek e495c99055 Implement: <rdar://problem/6351970> rule request: warn if @synchronized mutex can be nil
llvm-svn: 113573
2010-09-10 03:05:40 +00:00
Ted Kremenek 5cdaeaaa1d Clean up obtuse wording of checker diagnostic of using an uninitialized value in a function call.
Fixes: <rdar://problem/8409480> “warning: Pass-by-value argument in function call is undefined” message can be improved
llvm-svn: 113554
2010-09-09 22:51:55 +00:00
Ted Kremenek 5ebb6156d8 Include test case for <rdar://problem/5880430>.
llvm-svn: 113458
2010-09-09 00:40:43 +00:00
Anders Carlsson af7534f084 Get rid of the "functions declared 'noreturn' should have a 'void' result type" warning.
The rationale behind this is that it is normal for callback functions to have a non-void return type
and it should still be possible to mark them noreturn. (JavaScriptCore is a good example of this).

llvm-svn: 112918
2010-09-03 00:25:02 +00:00
Ted Kremenek 026cb58a44 Don't assert in CastSizeChecker when the casted-to pointee is an incomplete type. Fixes PR 8050.
llvm-svn: 112738
2010-09-01 20:35:38 +00:00
Tom Care 9026d4b488 Adjusted the semantics of assign checking in IdempotentOperationChecker
- Fixed a regression where assigning '0' would be reported
- Changed the way self assignments are filtered to allow constant testing
- Added a test case for assign ops
- Fixed one test case where a function pointer was not considered constant
- Fixed test cases relating to 0 assignment

llvm-svn: 112501
2010-08-30 19:25:43 +00:00
Tom Care 71cc9d886a Added checking of (x == x) and (x != x) to IdempotentOperationChecker and updated test cases flagged by it.
llvm-svn: 112313
2010-08-27 22:50:47 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 036223bdcf Fix horrible GRExprEngine bug where switch statements with no 'case:' statements would cause the path to get prematurely aborted. Fixes <rdar://problem/8360854>.
llvm-svn: 112233
2010-08-26 22:19:33 +00:00
Ted Kremenek 50e0105f1c Add warning for functions/blocks that have attribute 'noreturn' but return a non-void result. (<rdar://problem/7562925>)
llvm-svn: 111492
2010-08-19 00:52:13 +00:00
Jordy Rose c6c0fc9164 Allow EvalBinOpNN to handle expressions of the form $a+$b if $b can be reduced to a constant.
llvm-svn: 110592
2010-08-09 20:31:57 +00:00
John McCall a95172baa0 Only run the jump-checker if there's a branch-protected scope *and* there's
a switch or goto somewhere in the function.  Indirect gotos trigger the
jump-checker regardless, because the conditions there are slightly more
elaborate and it's too marginal a case to be worth optimizing.

Turns off the jump-checker in a lot of cases in C++.  rdar://problem/7702918

llvm-svn: 109962
2010-08-01 00:26:45 +00:00
Ted Kremenek 83b598c14f Finesse 'idempotent operations' analyzer issues to include the opcode of the binary operator for clearer error reporting. Also remove the 'Idempotent operation' prefix in messages; it's redundant since the bug type is the same.
llvm-svn: 109527
2010-07-27 18:49:08 +00:00
Ted Kremenek b32964d02d Fix '<rdar://problem/8202272> __imag passed non-complex should not crash' by removing a bogus assertion.
llvm-svn: 108602
2010-07-17 01:28:55 +00:00
Tom Care 826e6b4023 Improved false positive rate for the idempotent operations checker and moved it into the default path-sensitive analysis options.
- Added checks for static local variables, self assigned parameters, and truncating/extending self assignments
- Removed command line option (now default with --analyze)
- Updated test cases to pass with idempotent operation warnings

llvm-svn: 108550
2010-07-16 20:41:41 +00:00
Chris Lattner 3956106543 implement PR7569, warning about assignment to null, which
people seem to write when they want a deterministic trap.
Suggest instead that they use a volatile pointer or 
__builtin_trap.

llvm-svn: 107756
2010-07-07 06:14:23 +00:00
Ted Kremenek bd862711fd Fix PR 7475 by enhancing the static analyzer to also invalidate bindings for non-static global variables
when calling a function/method whose impact on global variables we cannot accurately estimate.
This change introduces two new MemSpaceRegions that divide up the memory space of globals, and causes
RegionStore and BasicStore to consult a binding to the NonStaticGlobalsMemSpaceRegion when lazily
determining the value of a global.

llvm-svn: 107423
2010-07-01 20:16:50 +00:00
Jordy Rose 7f8ea4d677 Implicitly compare symbolic expressions to zero when they're being used as constraints. Part of PR7491.
llvm-svn: 106972
2010-06-27 01:20:56 +00:00
Ted Kremenek 4c721bf892 Change AnalysisConsumer to analyze functions created by instantiantiating a macro. Fixes PR 7361.
llvm-svn: 105984
2010-06-15 00:55:40 +00:00
Ted Kremenek 34ddec630c Predefine the '__clang_analyzer__' macro when using '-analyze'.
llvm-svn: 104742
2010-05-26 21:36:54 +00:00
Ted Kremenek ecc31c93c2 Don't add a null successor to a CFGBlock when the contents of an @synchronized statement is empty.
Fixes <rdar://problem/7979430>.

llvm-svn: 103717
2010-05-13 16:38:08 +00:00
Ted Kremenek 989da5eeff Fix CFG crasher involving statement expressions reported in PR 6938.
llvm-svn: 102576
2010-04-29 01:10:26 +00:00
Ted Kremenek 499b4e3387 Fix lookup of fields from lazy bindings to check if the region is
NULL, not the store, to determine if a lookup succeeded.  The store
can be null if it contained no bindings.  This fixes a false positive
reported to me by a user of the analyzer.

llvm-svn: 95679
2010-02-09 19:11:53 +00:00
Ted Kremenek bdfcacbe8f Also teach RegionStore::RetrieveVar() to handle 'static' pointers that are implicitly initialized to NULL.
llvm-svn: 95479
2010-02-06 04:04:46 +00:00
Ted Kremenek 30fe9ecac2 Fix regression in RegionStore (from BasicStore) where static variables were not treated as being implicitly initialized to 0 (and instead were getting symbolicated).
llvm-svn: 95478
2010-02-06 03:57:59 +00:00
Ted Kremenek 2f2692f8ca Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.
llvm-svn: 95348
2010-02-05 02:06:54 +00:00
Ted Kremenek 49f878524c Specially handle casts to 'void' in AdjustedReturnValueChecker.
llvm-svn: 95287
2010-02-04 04:18:55 +00:00