Commit Graph

152 Commits

Author SHA1 Message Date
Mike Stump 3fe60b2118 Prep for new warning.
llvm-svn: 76621
2009-07-21 18:59:16 +00:00
Ted Kremenek 834e2f69da Enhanced IsReinterpreted() (RegionStore.cpp) to reason about higher-order
pointers.

Enhanced RegionStoreManager::Retrieve() to handle automatic casts when the
loaded value is different from the requested value. This should be refined over
time, but essentially we should always symbolicate locations as locations, and
convert them to non-locations on demand.

These changes now cause 'misc-ps.m' to pass again.

llvm-svn: 76497
2009-07-20 22:58:02 +00:00
Ted Kremenek bf04f98c1f Add XFAILED test.
llvm-svn: 76469
2009-07-20 21:00:55 +00:00
Ted Kremenek e9812bdac5 Fix crash in StoreManager::NewCastRegion() when handling casts from 'id' (or whatever) to a BlockPointerType.
llvm-svn: 76288
2009-07-18 06:27:51 +00:00
Ted Kremenek c7b1dade86 Move RegionStoreManager over to using new
ValueManager::makeArrayIndex()/convertArrayIndex() methods.  This
handles yet another crash case when reasoning about array indices of
different bitwidth and signedness.

llvm-svn: 75884
2009-07-16 01:33:37 +00:00
Ted Kremenek f3e1e4d9a1 Fix <rdar://problem/7062158> by having BasicStoreManager model values for 'static' global variables.
llvm-svn: 75844
2009-07-15 22:09:25 +00:00
Ted Kremenek b63f71528e Enhance SimpleSValuator::EvalBinOpNN to recognize the trivial case
where we are comparing a symbolic value against itself, regardless of
the nature of that symbolic value.

This enhancement identified a case where RegionStoreManager is not
correctly symbolicating the values of the pointees of parameters.  The
failing test is now in 'test/Analysis/misc-ps-region-store.m', with
that test file now (temporarily) marked XFAIL.

llvm-svn: 75521
2009-07-13 21:55:12 +00:00
Ted Kremenek da03e8443e Handle insidious corner case exposed by RegionStoreManager when handling void* values that are bound
to symbolic regions and then treated like integers.

llvm-svn: 75356
2009-07-11 04:38:49 +00:00
Ted Kremenek 6cb2a34e3c Test case in test/Analysis/xfail_regionstore_wine_crash.c no longer fails, so
move this case to 'test/Analysis/misc-ps.m' to test with both BasicStoreManager
and RegionStoreManager.

llvm-svn: 75294
2009-07-10 21:43:30 +00:00
Ted Kremenek bf73ad47a8 Revert r75281 and simply remove the assertion in NewCastRegion that
CodeTextRegions can only be casted to FunctionPointer or BlockPointerTypes. This
simply isn't true. We can handle bogus operations on CodeTextRegions (e.g, an
array access) elsewhere.

llvm-svn: 75285
2009-07-10 21:24:45 +00:00
Ted Kremenek 6c94771a0b Fix crash in StoreManager::NewCastRegion regarding handling casts to void*,
void**, void***, etc.  Such casts should just pass the region through.

llvm-svn: 75281
2009-07-10 21:11:16 +00:00
Ted Kremenek f66557978e Switch BasicStoreManager to use the new CastRegion implementation by default,
and replace the 'clang-cc' option '-analyzer-store=basic-new-cast' with
'-analyzer-store=basic-old-cast'. We'll keep the old CastRegion implementation
around for a little while for regression testing.

llvm-svn: 75209
2009-07-10 00:41:58 +00:00
Ted Kremenek 8ee3dd7cc5 Fix: <rdar://problem/7034511> ValueManager::makeIntVal(uint64_t X, QualType T) should return a 'Loc' when 'T' is a pointer
llvm-svn: 75062
2009-07-08 22:42:46 +00:00
Ted Kremenek 97213bac53 NewCastRegion: Handle casts *from* pointers to incomplete structs to other types.
llvm-svn: 74884
2009-07-06 23:47:19 +00:00
Ted Kremenek c5ab3a0eab StoreManager::NewCastRegion:
- Refactor logic that creates ElementRegions into a help method 'MakeElementRegion'.
- Fix crash due to not handling StringRegions.  Casts of StringRegions now
  result in a new ElementRegion layered on the original StringRegion.

llvm-svn: 74867
2009-07-06 22:23:45 +00:00
Ted Kremenek eea8c29aa3 Make 'BasicStoreManager' + 'NewCastRegion' testable from the command line using '-analyzer-store=basic-new-cast'.
llvm-svn: 74865
2009-07-06 21:58:46 +00:00
Ted Kremenek 0b0f206efa Fix a horrible CFG bug reported in <rdar://problem/7027684>. The wrong successor
block would get hooked up in some cases when processing empty compound
statements.

llvm-svn: 74743
2009-07-03 00:10:50 +00:00
Ted Kremenek 55e07efeed Add a FIXME to RegionStore, do some minor code cleanup, and get RegionStore to
pass misc-ps.m. Currently RegionStore/BasicStore don't do any special reasoning
about clang-style vectors, so we should return UnknownVal (in all cases) when
accessing their values via an array.

llvm-svn: 74660
2009-07-01 23:19:52 +00:00
Ted Kremenek 3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Ted Kremenek 02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Ted Kremenek 407d81b2cd Add another test case found due to an analyzer regression.
llvm-svn: 70600
2009-05-01 23:35:18 +00:00
Ted Kremenek 9c03f68206 Fix PR 4033: the analyzer shouldn't crash on computed gotos involving symbolic
target addresses.

llvm-svn: 69900
2009-04-23 17:49:43 +00:00
Ted Kremenek 35f875c136 Fix: <rdar://problem/6777209> false Dereference of null pointer in loop: pointer increment/decrement preserves non-nullness
When the StoreManager doesn't reason well about pointer-arithmetic, propagate
the non-nullness constraint on a pointer value when performing pointer
arithmetic uisng ++/--.

llvm-svn: 69741
2009-04-21 22:38:05 +00:00
Ted Kremenek b3b2395520 Split failing test case from misc-ps.m to misc-ps-ranges.m (which tests
functionality specific to RangeConstraintManager).

llvm-svn: 68759
2009-04-10 04:02:38 +00:00
Ted Kremenek 5054663daa Fix: <rdar://problem/6776949> Branch condition evaluates to an uninitialized value (argc is guaranteed to be >= 1)
The analyzer now adds the precondition that the first argument of 'main' is > 0.

llvm-svn: 68757
2009-04-10 00:59:50 +00:00
Ted Kremenek 40f4ee74fd Implement attribute "analyzer_noreturn" (<rdar://problem/6777003>). This allows
clients of the analyzer to designate custom assertion routines as "noreturn"
functions from the analyzer's perspective but not the compiler's.

llvm-svn: 68746
2009-04-10 00:01:14 +00:00
Ted Kremenek 9335fecc2a Update expected warning in test case.
llvm-svn: 68276
2009-04-02 02:52:13 +00:00
Daniel Dunbar a45cf5b6b0 Rename clang to clang-cc.
Tests and drivers updated, still need to shuffle dirs.

llvm-svn: 67602
2009-03-24 02:24:46 +00:00
Ted Kremenek c7fef2ad53 analyzer: Fix embarrassing regression in BasicStore when invalidating struct
values passed-by-reference to unknown functions.

llvm-svn: 67519
2009-03-23 15:42:58 +00:00
Ted Kremenek b36e01d87e Fix crash reported in <rdar://problem/6695527>. We now have
SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of
having BasicStoreManager do it (which wasn't always doing the check
consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in
one centralized place.

llvm-svn: 67245
2009-03-18 22:10:22 +00:00
Ted Kremenek be485b6c7d Fix StmtIterator bug reported in PR 3780 where a VLA within a DeclGroup would
not be consulted for its size expression when operator* was called in the
StmtIterator (this resulted in an assertion failure).

llvm-svn: 66679
2009-03-11 18:17:16 +00:00
Ted Kremenek 0fa538528e Fix PR 3780: In one code path in BasicValueFactory::getValue() we would not
return an unsigned integer for a null pointer value.

llvm-svn: 66630
2009-03-11 02:52:39 +00:00
Ted Kremenek 3f5a85ad06 SimpleConstraintManager doesn't reason about bitwise-constraints on symbolic
values. Indicating this in 'canReasonAbout' allows GRExprEngine to recover
path-sensitivity in some cases.

llvm-svn: 66628
2009-03-11 02:29:48 +00:00
Ted Kremenek fa3d77bc2c Retrofit some basic tracking of ivars (for the current object) into BasicStore.
llvm-svn: 66166
2009-03-05 18:08:28 +00:00
Ted Kremenek cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Ted Kremenek 47c853007e Enhance tests to exercise more combinations of using the RangeConstraintManager with the RegionStoreManager.
llvm-svn: 64788
2009-02-17 19:29:07 +00:00
Ted Kremenek b535181199 Static Analyzer driver/options (partial) cleanup:
- Move all analyzer options logic to AnalysisConsumer.cpp.
- Unified specification of stores/constraints/output to be:
   -analyzer-output=...
   -analyzer-store=...
   -analyzer-constraints=...
  instead of -analyzer-range-constraints, -analyzer-store-basic, etc.
- Updated drivers (ccc-analyzer, scan-builds, new ccc) to obey this new
  interface
- Updated test cases to conform to new driver options

llvm-svn: 64737
2009-02-17 04:27:41 +00:00
Ted Kremenek d25fb7a613 GRExprEngine: Handle empty statement expressions.
llvm-svn: 64541
2009-02-14 05:55:08 +00:00
Ted Kremenek 422d81dcd4 Fix bug in BasicStore::getLValueElement where if the base of an array subscript expression was an ElementRegion we stacked another ElementRegion on top of that.
This fixes PR 3422.

llvm-svn: 63110
2009-01-27 18:29:03 +00:00
Ted Kremenek 556c3709d6 The 'misc-ps.m' test case now passes with RegionStore. One case needed to be split out into 'misc-ps-basic-store.m' and 'misc-ps-region-store.m' because the behavior was different between the two store models (RegionStore flags an additional valid bug).
llvm-svn: 62772
2009-01-22 18:53:15 +00:00
Daniel Dunbar 34fc92fdc2 Add -analyze action to run static analyzer, instead of inferring from
individual checker options.

llvm-svn: 62634
2009-01-20 23:17:32 +00:00
Ted Kremenek 4299d5d2d8 Fix regression in handling sizeof(void) in the static analyzer.
llvm-svn: 61039
2008-12-15 18:51:00 +00:00
Ted Kremenek c28ce29a12 [static analyzer] Extend VLA size checking to look for undefined sizes.
llvm-svn: 60734
2008-12-09 00:44:16 +00:00
Ted Kremenek d7266bf20a Add zero-sized VLA check test case.
llvm-svn: 60731
2008-12-09 00:14:48 +00:00
Chris Lattner 2ca529ce61 instead of forcing blocks on by default, make them default to off, but let
specific targets default them to on.  Default blocks to on on 10.6 and later.
Add a -fblocks option that allows the user to override the target's default.
Use -fblocks in the various testcases that use blocks.

llvm-svn: 60563
2008-12-04 23:20:07 +00:00
Ted Kremenek 16866d6fd8 GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) of vector types. Add explicit checks that when we process integers that they really are scalars.
llvm-svn: 59225
2008-11-13 06:10:40 +00:00
Ted Kremenek 45698bf05f GRExprEngine::VisitInitListExpr:
- Don't crash on vector types.
- Handle typedefs.

llvm-svn: 59220
2008-11-13 05:05:34 +00:00
Ted Kremenek e69a1fa342 Do not crash when performing VisitLValue on union types.
This fixes PR 2948.

llvm-svn: 58148
2008-10-25 20:09:21 +00:00
Ted Kremenek c32ec3a0c4 Further improve path-sensitivity with divide-by-zero checking by assuming that a denominator cannot be zero even when the result of an '/' or '%' expression is unknown.
llvm-svn: 57855
2008-10-20 23:40:25 +00:00
Ted Kremenek e67437f3a9 Added test case inspired by <rdar://6268365>: recover path-sensitivity after compound assignment when the result of the assignment is not known.
llvm-svn: 57852
2008-10-20 23:14:31 +00:00
Ted Kremenek f8d65a30d6 Add support in GRExprEngine for UnaryOperator::AlignOf. This fixes one crash report in PR 2796.
llvm-svn: 57777
2008-10-18 22:20:20 +00:00
Ted Kremenek 63249b6e57 Added test case.
llvm-svn: 56915
2008-10-01 05:05:46 +00:00