Commit Graph

789 Commits

Author SHA1 Message Date
Ted Kremenek cbcc5e83ca When retrieving the location of a Node, for MemberExprs use the location of the
'.' or '->'.

llvm-svn: 65651
2009-02-27 20:05:10 +00:00
Douglas Gregor deaad8cc34 Create a new TypeNodes.def file that enumerates all of the types,
giving them rough classifications (normal types, never-canonical
types, always-dependent types, abstract type representations) and
making it far easier to make sure that we've hit all of the cases when
decoding types. 

Switched some switch() statements on the type class over to using this
mechanism, and filtering out those things we don't care about. For
example, CodeGen should never see always-dependent or non-canonical
types, while debug info generation should never see always-dependent
types. More switch() statements on the type class need to be moved 
over to using this approach, so that we'll get warnings when we add a
new type then fail to account for it somewhere in the compiler.

As part of this, some types have been renamed:

  TypeOfExpr -> TypeOfExprType
  FunctionTypeProto -> FunctionProtoType
  FunctionTypeNoProto -> FunctionNoProtoType

There shouldn't be any functionality change...

llvm-svn: 65591
2009-02-26 23:50:07 +00:00
Ted Kremenek e9817aaa05 PathDiagnosticPiece now automatically strips off trailing periods in diagnostic messages.
llvm-svn: 65574
2009-02-26 21:30:32 +00:00
Ted Kremenek 6832977821 Refine some grammar in the retain/release diagnostics.
llvm-svn: 65571
2009-02-26 21:04:07 +00:00
Douglas Gregor 87f95b0a6a Introduce code modification hints into the diagnostics system. When we
know how to recover from an error, we can attach a hint to the
diagnostic that states how to modify the code, which can be one of:

  - Insert some new code (a text string) at a particular source
    location
  - Remove the code within a given range
  - Replace the code within a given range with some new code (a text
    string)

Right now, we use these hints to annotate diagnostic information. For
example, if one uses the '>>' in a template argument in C++98, as in
this code:

  template<int I> class B { };
  B<1000 >> 2> *b1;

we'll warn that the behavior will change in C++0x. The fix is to
insert parenthese, so we use code insertion annotations to illustrate
where the parentheses go:

test.cpp:10:10: warning: use of right-shift operator ('>>') in template
argument will require parentheses in C++0x
  B<1000 >> 2> *b1;
         ^
    (        )


Use of these annotations is partially implemented for HTML
diagnostics, but it's not (yet) producing valid HTML, which may be
related to PR2386, so it has been #if 0'd out.

In this future, we could consider hooking this mechanism up to the
rewriter to actually try to fix these problems during compilation (or,
after a compilation whose only errors have fixes). For now, however, I
suggest that we use these code modification hints whenever we can, so
that we get better diagnostics now and will have better coverage when
we find better ways to use this information.

This also fixes PR3410 by placing the complaint about missing tokens
just after the previous token (rather than at the location of the next
token).

llvm-svn: 65570
2009-02-26 21:00:50 +00:00
Ted Kremenek 8b09ad17f9 Use Loc::IsLocType() instead of isPointerType() and isReferenceType().
llvm-svn: 65568
2009-02-26 20:29:19 +00:00
Daniel Dunbar e2617d97a5 Drop uses of isPointerLikeType.
- No functionality change.

llvm-svn: 65560
2009-02-26 19:03:24 +00:00
Ted Kremenek ff290caf56 Fix subtle bug in EvalEagerlyAssume: Check if the previous node was at the same statement.
llvm-svn: 65486
2009-02-25 23:32:10 +00:00
Ted Kremenek 8ec8cf0207 Fix recently introduced switch case fallthrough bug.
llvm-svn: 65485
2009-02-25 23:11:49 +00:00
Ted Kremenek dc3f50fbd9 Add experimental logic in GRExprEngine::EvalEagerlyAssume() to handle
expressions of the form: 'short x = (y != 10);' While we handle 'int x = (y !=
10)' lazily, the cast to another integer type currently loses the symbolic
constraint. Eager evaluation of the constraint causes the paths to bifurcate and
eagerly evaluate 'y != 10' to a constant of 1 or 0. This should address
<rdar://problem/6619921> until we have a better (more lazy approach) for
handling promotions/truncations of symbolic integer values.

llvm-svn: 65480
2009-02-25 22:32:02 +00:00
Ted Kremenek dce7846c24 retain/release checker: Implement basic tracking of autorelease stack. Next thing is to wire up pools with their contents.
llvm-svn: 65425
2009-02-25 02:54:57 +00:00
Ted Kremenek 260c49a712 Fix broken logic from my last commit. Branches only occur at basic blocks that end with terminators.
llvm-svn: 65410
2009-02-24 23:34:17 +00:00
Ted Kremenek c324a0e089 Fix diagnostic regression where the leak diagnostic could appear earlier in the path than the branches taken.
llvm-svn: 65407
2009-02-24 23:30:57 +00:00
Ted Kremenek c52f9394ce retain/release checker:
- For autorelease pool tracking, keep information about the stack of pools
  separate from their contents. Also, keep track of the number of times an
  autorelease pool will send the "release" message to an object when the pool is
  destroyed.
- Update CFRefCount::Update to return a new state instead of a reference count
  binding. This will allow us to implement more complicated semantics with
  autorelease pools.

llvm-svn: 65384
2009-02-24 19:15:11 +00:00
Ted Kremenek cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Ted Kremenek 2c2ec42322 Tidy up 'ExecutionContinues' to distinguish between jumping to the end of a 'method' or 'funciton'.
llvm-svn: 65346
2009-02-23 23:13:51 +00:00
Ted Kremenek 62b3879c5e Tidy up the path diagnostic generation logic in BugReporter and remove a case where an "Execution continues..." diagnostic could result in an empty message bubble.
llvm-svn: 65342
2009-02-23 22:44:26 +00:00
Ted Kremenek 50db3d0923 Add more boilerplate logic to more accurately reason about autorelease pools.
This doesn't change the current functionality, but better codifies the
autorelease pool stack itself.

llvm-svn: 65328
2009-02-23 17:45:03 +00:00
Ted Kremenek 726fd5cbf5 Fix 80 col. violations.
llvm-svn: 65322
2009-02-23 16:54:00 +00:00
Ted Kremenek 82157a17c1 Per Chris L.'s suggestion, use getAsFunctionType() instead of getDesguaredType(). Constify some pointers along the way.
llvm-svn: 65321
2009-02-23 16:51:39 +00:00
Ted Kremenek e73f282213 retain/release checker: For now don't track the retain count of NSWindow objects (opt for false negatives).
llvm-svn: 65304
2009-02-23 02:51:29 +00:00
Ted Kremenek 5485a2f70b Remove typo.
llvm-svn: 65302
2009-02-23 02:42:56 +00:00
Ted Kremenek 7d4fc5bcdc '[NSAutoreleasePool addObject:]' has an 'autorelease' effect, not a DoNothing effect.
llvm-svn: 65301
2009-02-23 02:31:16 +00:00
Ted Kremenek 35251f3d92 Fix regression in naming convention derivation: a method only follows the copy 'rule' if it doesn't already start with 'init', etc.
llvm-svn: 65269
2009-02-22 07:32:24 +00:00
Ted Kremenek 97ad7b689e Use llvm::StringsEqualNoCase instead of strncasecmp.
llvm-svn: 65237
2009-02-21 18:26:02 +00:00
Cedric Venet 4fc88b779e Fix build on windows.
Should clang have a config.h or should we use the config.h of llvm or using the preprocessor is OK?  I did a quick fix here, but having a guideline on how to handle non portable function would be great (or ask ted to stop breaking the windows build :)).

llvm-svn: 65233
2009-02-21 17:14:49 +00:00
Ted Kremenek 8a73c71486 Improved naming convention heuristics in the retain/release checker to better
handle method names that contain 'new', 'copy', etc., but those words might be
the substring of larger words such as 'newsgroup' and 'photocopy' that do not
indicate the allocation of objects. This should address the issues discussed in
<rdar://problem/6552389>.

llvm-svn: 65224
2009-02-21 05:13:43 +00:00
Ted Kremenek b087942765 Greatly simplify the logic in ExplodedGraphImpl::TrimGraph. Now we just do a
vanilla reverse-BFS followed by a forward-DFS instead of resulting to strange
histrionics (whose purpose I can no longer remember) in the reverse-BFS stage.
This fixes an assertion failure in BugReporter due to edge cases where no root
was being hit in the reverse-BFS phase.

llvm-svn: 65160
2009-02-20 21:10:26 +00:00
Zhongxing Xu 617bc3d02e Add an example in comments.
llvm-svn: 65110
2009-02-20 05:19:30 +00:00
Ted Kremenek c537a6d3f1 Fix crash from <rdar://problem/6562655>: 'init' method only return a receiver alias if the return type is a location.
llvm-svn: 65084
2009-02-20 00:05:35 +00:00
Ted Kremenek 68abaa984d retain/release checker: Generate an intermediate simulation node for "leak"
transitions and then generate a subsequent node that removes the dead symbol
bindings. This should drastically improve caching in the simulation graph when
retain-counted objects are being tracked.

llvm-svn: 65082
2009-02-19 23:47:02 +00:00
Ted Kremenek 513f0b147e Added a new method to GRStmtNodeBuilder to build nodes using an arbitrary
PostStmt program point. This allows clients to pass in PostStmtCustom program
points.

llvm-svn: 65080
2009-02-19 23:45:28 +00:00
Ted Kremenek deafc5c601 retain/release checker: Fix crasher when the leak site is the same expression that allocates an object.
llvm-svn: 65047
2009-02-19 18:18:48 +00:00
Zhongxing Xu 69aac369c3 only track integer and pointer values for now.
llvm-svn: 65041
2009-02-19 09:56:08 +00:00
Zhongxing Xu f74ab25e22 Convert the offset to signed before making an ElementRegion with it. It seems
that this problem arises from time to time. We should find a fundamental 
solution for it.

llvm-svn: 65035
2009-02-19 08:37:16 +00:00
Ted Kremenek 66d9edc346 Implemented simple check in <rdar://problem/6600344>: When the receiver of a
message expression is nil and the return type is struct then the returned value
is undefined or potentially garbage.

llvm-svn: 65003
2009-02-19 04:06:22 +00:00
Ted Kremenek 84e7c1e2ff retain/release checker: Place the leak diagnostic after the last statement that
references the tracked object.

llvm-svn: 64980
2009-02-18 23:28:26 +00:00
Ted Kremenek 6692f45829 Remove unused variable.
llvm-svn: 64974
2009-02-18 22:59:38 +00:00
Ted Kremenek 75a96ed40a Remove logic for computing 'display hint'.
llvm-svn: 64973
2009-02-18 22:59:04 +00:00
Ted Kremenek 551747fe3a More fun with retain checker diagnostics:
- Fix some grammar.
- Fix a bug where a "reference count incremented" diagnostic would not be shown
  if the previous typestate was "Released" (only happens in GC mode).

llvm-svn: 64971
2009-02-18 22:57:22 +00:00
Ted Kremenek a790c8dcac Fix diagnostics bugs when computing ranges for the retain/release checker.
llvm-svn: 64962
2009-02-18 22:17:20 +00:00
Ted Kremenek 1045289881 retain/release checker: We now emit fancy diagnostics telling users about the
semantics of CFMakeCollectable and friends.

llvm-svn: 64956
2009-02-18 21:57:45 +00:00
Ted Kremenek f68490a3f7 retain/release checker: Distinguish in the function summaries between
retain/releases performed via [... release] and CFRetain(). The former are
no-ops in GC. The checker already handled this, but now we emit nice diagnostics
to the user telling them that these are no-ops.

llvm-svn: 64937
2009-02-18 18:54:33 +00:00
Ted Kremenek ab89bc8ca1 Revise comment. Comparing pointer values in 'Range' wasn't the performance issue I thought it was, but it is still worth ordering Range objects by their APSInt values.
llvm-svn: 64921
2009-02-18 17:42:44 +00:00
Ted Kremenek c2c0bdb880 Fix performance bug in RangeConstraintManager (that I introduced):
When comparing if one Range is "less" than another, compare the actual APSInt
  numeric values instead of their pointer addresses. This ensures that the
  ImmutableSet in RangeSet always has a consistent ordering between Ranges. This
  is critical for generating the same digest/hash for the contents of the sets.
  This was a serious performance bug because it would often cause state caching
  to be disabled along complicated paths.
  
Along the way:
 - Put Range and RangeSet in the "anonymous namespace" and mark them hidden

llvm-svn: 64890
2009-02-18 05:22:01 +00:00
Ted Kremenek 48d1645179 Hooked up the necessary machinery to allow the retain/release checker reference
back to the summary used when evaluating the statement associated with a
simulation node. This is now being used to help improve the checker's
diagnostics. To get things started, the checker now emits a path diagnostic
indicating that 'autorelease' is a no-op in GC mode.

Some of these changes are exposing further grossness in the interface between
BugReporter and the ExplodedGraph::Trim facilities. These really need to be
cleaned up one day.

llvm-svn: 64881
2009-02-18 03:48:14 +00:00
Ted Kremenek d84fff6524 retain/release checker: Record the summary used to generate a given node.
llvm-svn: 64876
2009-02-18 02:00:25 +00:00
Ted Kremenek fa1840b25e Add panic function.
llvm-svn: 64852
2009-02-17 23:27:17 +00:00
Ted Kremenek 3189f495de Revised RangeConstraintManager based on several discussions with Ben Laurie and
Zhongxing Xu. The resultant code is less than 1/2 the size of the original.

Key highlights:

- All CouldBeXXX methods have been removed. Checking for feasibility is now just
  done in the AddXXX methods.

- RangeSets now represent "all possible values" explicitly as the range set {
  [min, max] } instead of the empty set. The empty set now represents "no
  feasible values". This change consolidated much of the core algorithm to only
  have one code path instead of alternate paths that considered the empty set to
  represent "all possible falues."

llvm-svn: 64787
2009-02-17 19:28:04 +00:00
Ted Kremenek 852882ca97 Add '_assert' to list of known panic functions.
llvm-svn: 64772
2009-02-17 17:48:52 +00:00