Commit Graph

18 Commits

Author SHA1 Message Date
Ted Kremenek c7fef2ad53 analyzer: Fix embarrassing regression in BasicStore when invalidating struct
values passed-by-reference to unknown functions.

llvm-svn: 67519
2009-03-23 15:42:58 +00:00
Ted Kremenek 6b31533ad1 GRExprEngine:
- Conjure symbols at '--' and '++' unary operations
- Add utility method SVal::GetConjuredSymbolVal() and constify some arguments
  along the way.

llvm-svn: 67395
2009-03-20 20:10:45 +00:00
Ted Kremenek 6ee8f8bcb5 Add an optional "tag" to conjured symbols that allows us to distinguish between
multiple symbols conjured at the same location. All that is required of the tag
is that it is a fixed void* value that points to an memory address that remains
valid throughout the remainder of the lifetime of the SymbolManager.

llvm-svn: 66092
2009-03-04 22:53:46 +00:00
Ted Kremenek c9747dd60f Rework use of loc::SymbolVal in the retain/release checker to use the new method
SVal::getAsLocSymbol(). This simplifies the code and allows the retain/release
checker to (I believe) also correctly reason about location symbols wrapped in
SymbolicRegions.

Along the way I cleaned up SymbolRef a little, disallowing implicit casts to
'unsigned'.

llvm-svn: 65972
2009-03-03 22:06:47 +00:00
Ted Kremenek 4e9d4b5d48 Added GRStateManager::scanReachableSymbols(), a method which scans the reachable
symbols from an SVal.

- Fixed a bug in EnvironmentManager::RemoveDeadBindings() where it did not mark
  live all the symbols reachable from a live block-level expression.

- Fixed a bug in the retain/release checker where it did not stop tracking
  symbols that 'escaped' via compound literals being assigned to something the
  BasicStoreManager didn't reason about.

llvm-svn: 64534
2009-02-14 03:16:10 +00:00
Ted Kremenek 2dd9c9cbd7 SymbolReaper::isLive(SymbolRef) now always returns true for SymbolRegionRvalues because these represent the symbolic values for parameters/globals upon entry to the function. These values are always ;live' because they represent constraints on the context of how the function was called. This will be useful for both summary generation but is also necessary to get RegionStore's lazy-binding of locations to symbols to work in practice with RemoveDeadBindings.
llvm-svn: 62771
2009-01-22 18:51:33 +00:00
Ted Kremenek 74040833e4 Static analyzer: Remove a bunch of outdated SymbolData objects and
their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769
2009-01-22 18:23:34 +00:00
Ted Kremenek 16fbfe699e Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.
llvm-svn: 62722
2009-01-21 22:26:05 +00:00
Daniel Dunbar 435bbe0254 Fix some unused variable, control reaches end of non-void function,
and uninitialized use options.

llvm-svn: 62270
2009-01-15 18:32:35 +00:00
Zhongxing Xu af7415ffb1 Lazy bingding for region-store manager.
* Now Bind() methods take and return GRState* because binding could
  also alter GDM.
* No variables are initialized except those declared with initial
  values.
* failed C test cases are due to bugs in RemoveDeadBindings(),
which removes constraints that is still alive. This will be fixed in later
patch.
* default value of array and struct regions will be implemented in later patch.

llvm-svn: 61274
2008-12-20 06:32:12 +00:00
Ted Kremenek c9e7622a52 Add SymbolRef::print() and have SymbolicRegion::print() use this method instead of calling SymbolRef::getNumber().
llvm-svn: 60578
2008-12-05 02:45:20 +00:00
Ted Kremenek d8242f19f7 Rename SymbolID to SymbolRef. This is a precursor to some overhauling of the representation of symbolic values.
llvm-svn: 60575
2008-12-05 02:27:51 +00:00
Ted Kremenek 8e942123cb Remove SymbolDataContentsOf (unused).
llvm-svn: 60572
2008-12-05 01:31:31 +00:00
Zhongxing Xu b8e54884c8 Add SymbolData for array elements and struct fields.
llvm-svn: 59618
2008-11-19 11:03:17 +00:00
Ted Kremenek 9999d72fe2 Conjured symbols now bind to Stmt* instead of Expr*.
llvm-svn: 59154
2008-11-12 19:22:47 +00:00
Ted Kremenek d331d09e2f Add a QualType to ConjuredSymbol to represent the type and size of the symbol.
Use this updated interface when invalidating arguments passed by reference; the type of symbol is of the object passed by reference, not the reference itself.

llvm-svn: 56894
2008-10-01 00:21:14 +00:00
Ted Kremenek dccd9883c4 Initialize tracked local variables to undefined.
llvm-svn: 54716
2008-08-13 03:28:04 +00:00
Chris Lattner 7a51313d8a Make a major restructuring of the clang tree: introduce a top-level
lib dir and move all the libraries into it.  This follows the main
llvm tree, and allows the libraries to be built in parallel.  The
top level now enforces that all the libs are built before Driver,
but we don't care what order the libs are built in.  This speeds
up parallel builds, particularly incremental ones.

llvm-svn: 48402
2008-03-15 23:59:48 +00:00