Commit Graph

58 Commits

Author SHA1 Message Date
Chris Lattner 8a42586c54 more SourceLocation lexicon change: instead of referring to the
"logical" location, refer to the "instantiation" location.

llvm-svn: 62316
2009-01-16 07:36:28 +00:00
Ted Kremenek 7d002beb5b Fix <rdar://problem/6454568>: BugReporter should correctly handle switch statements with no default case.
llvm-svn: 61270
2008-12-20 01:41:43 +00:00
Ted Kremenek d8242f19f7 Rename SymbolID to SymbolRef. This is a precursor to some overhauling of the representation of symbolic values.
llvm-svn: 60575
2008-12-05 02:27:51 +00:00
Chris Lattner f3d3faeca6 Rename NamedDecl::getName() to getNameAsString(). Replace a bunch of
uses of getName() with uses of getDeclName().  This upgrades a bunch of
diags to take DeclNames instead of std::strings.

This also tweaks a couple of diagnostics to be cleaner and changes
CheckInitializerTypes/PerformInitializationByConstructor to pass
around DeclarationNames instead of std::strings.

llvm-svn: 59947
2008-11-24 05:29:24 +00:00
Chris Lattner 8488c8297c This reworks some of the Diagnostic interfaces a bit to change how diagnostics
are formed.  In particular, a diagnostic with all its strings and ranges is now
packaged up and sent to DiagnosticClients as a DiagnosticInfo instead of as a 
ton of random stuff.  This has the benefit of simplifying the interface, making
it more extensible, and allowing us to do more checking for things like access
past the end of the various arrays passed in.

In addition to introducing DiagnosticInfo, this also substantially changes how 
Diagnostic::Report works.  Instead of being passed in all of the info required
to issue a diagnostic, Report now takes only the required info (a location and 
ID) and returns a fresh DiagnosticInfo *by value*.  The caller is then free to
stuff strings and ranges into the DiagnosticInfo with the << operator.  When
the dtor runs on the DiagnosticInfo object (which should happen at the end of
the statement), the diagnostic is actually emitted with all of the accumulated
information.  This is a somewhat tricky dance, but it means that the 
accumulated DiagnosticInfo is allowed to keep pointers to other expression 
temporaries without those pointers getting invalidated.

This is just the minimal change to get this stuff working, but this will allow
us to eliminate the zillions of variant "Diag" methods scattered throughout
(e.g.) sema.  For example, instead of calling:

  Diag(BuiltinLoc, diag::err_overload_no_match, typeNames,
       SourceRange(BuiltinLoc, RParenLoc));

We will soon be able to just do:

  Diag(BuiltinLoc, diag::err_overload_no_match)
      << typeNames << SourceRange(BuiltinLoc, RParenLoc));

This scales better to support arbitrary types being passed in (not just 
strings) in a type-safe way.  Go operator overloading?!

llvm-svn: 59502
2008-11-18 07:04:44 +00:00
Chris Lattner 3de58149bd eliminate dependence of strange "Diagnostic::Report" method,
delete huge trailing whitespace to fit in 80 cols.

llvm-svn: 59497
2008-11-18 06:07:40 +00:00
Zhongxing Xu 27f174214d This patch did the following renaming. There should be no functional changes.
RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671
2008-10-17 05:57:07 +00:00
Ted Kremenek fae8cb0736 Use DeclStmt::decl_iterator instead of using Decl::getDecl(). Soon DeclStmts will wrap group of Decls.
Added FIXME.

llvm-svn: 57189
2008-10-06 18:37:46 +00:00
Ted Kremenek 5ca90a244f This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.
This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042
2008-10-04 05:50:14 +00:00
Ted Kremenek de195e2100 Add "category" to BugTypes, allowing bugs to be grouped.
Changed casing of many bug names.  The convention will be to have bug names (mostly) lower cased, and categories use some capitalization.

llvm-svn: 56385
2008-09-20 04:23:38 +00:00
Ted Kremenek 0ecb53a421 ProgramPoint now takes the space of two pointers instead of one. This change was
motivated because it became clear that the number of subclasses of ProgramPoint
would expand and we ran out of bits to represent a pointer variant. As a plus of
this change, BlockEdge program points can now be represented explicitly without
using a cache of CFGBlock* pairs in CFG.

llvm-svn: 56245
2008-09-16 18:44:52 +00:00
Ted Kremenek ef2b3a71bb Add missing spaces in path diagnostics.
llvm-svn: 56166
2008-09-12 18:17:46 +00:00
Chris Lattner a2e25e5e72 adjust to changes in various APIs from LLVM. We can't print
an APInt directly to an ostream now, so add some hacks.  It would
be better to switch all of the bugreport (and friends) stuff over
to raw_ostream.

llvm-svn: 55264
2008-08-23 22:23:37 +00:00
Chris Lattner 5d1cfa1229 various updates to match r54873 on mainline.
llvm-svn: 54874
2008-08-17 07:19:51 +00:00
Ted Kremenek 5ab5a1b578 Rename ValueState -> GRState.
Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721
2008-08-13 04:27:00 +00:00
Ted Kremenek c18255d80f Refactor Dead Stores error reporting to use the simplified BugReporter::EmitBasicReport interface.
llvm-svn: 53573
2008-07-14 20:56:04 +00:00
Ted Kremenek 0255531dd3 Added method "EmitBasicReport" to BugReporter to simplify the emission of simple bug diagnostics.
Refactored error reporting in CheckObjCDealloc and CheckObjCInstMethSignature to use this new bug reporting interface (major code simplification).

llvm-svn: 53560
2008-07-14 17:40:50 +00:00
Ted Kremenek a7b8ffb05b Refactored most of the "Store" piece of ValueState into a Store type. The
current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423
2008-07-10 22:03:41 +00:00
Ted Kremenek 1d3c797c90 Have BugReporter::getCFG and BugReporter::getLiveVariables returns pointers instead of references, because they can both fail
on functions we cannot construct full CFGs for yet.

llvm-svn: 53081
2008-07-03 05:26:14 +00:00
Ted Kremenek b1d0118a1a Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.

llvm-svn: 53048
2008-07-02 21:24:01 +00:00
Ted Kremenek 34a691734e Modified the dead stores checker to...
1) Check if a dead store appears as a subexpression.  For such cases, we emit
   a verbose diagnostic so that users aren't confused.  This addresses:
   
   <rdar://problem/5968508> checker gives misleading report for dead store in loop
   
2) Don't emit a dead store warning when assigning a null value to a pointer.
   This is a common form of defensive programming.  We may wish to make
   this an option to the the checker one day.
   
   This addresses the feature request in the following email:
   
   http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-June/001978.html

llvm-svn: 52555
2008-06-20 21:45:25 +00:00
Ted Kremenek 9a935fbdeb Added a new ProgramPoint: PostPurgeDeadSymbols. This new program point distinguishes between the cases when we just evaluated the transfer function of a Stmt* (PostStmt) or performed a load (PostLoad). This solves a caching bug observed in a recent bug report.
llvm-svn: 52443
2008-06-18 05:34:07 +00:00
Ted Kremenek 3802fedfe4 Fix non-termination bug reported by Thomas Clement!
llvm-svn: 52426
2008-06-17 19:14:06 +00:00
Ted Kremenek b91ef1b62b Prototyped support in the BugReporter to emit diagnostics of the form "p now aliases q".
llvm-svn: 51453
2008-05-22 23:45:19 +00:00
Ted Kremenek 590abd363e Partitioned BugTypeCachedLocation::isCached() into two methods: one that accepts and ExplodedNode, and the other that accepts a ProgramPoint. The default behavior is to cache bug reports by the
location they occur (the end node).  Subclasses can override this behavior by providing a different ProgramPoint.

llvm-svn: 51197
2008-05-16 18:33:14 +00:00
Ted Kremenek 8bcc1bd3d5 More refactorings in GeneratePathDiagnostic: use ExecutionContinues to display
"Execution continues..." message, which does a better job at handling corner cases.

llvm-svn: 50751
2008-05-06 18:11:09 +00:00
Ted Kremenek a5e2df015a Rename member variable.
llvm-svn: 50597
2008-05-02 23:21:21 +00:00
Ted Kremenek 1097b4c61f Added line number diagnostics to indicate the allocation site of the leaked object.
llvm-svn: 50553
2008-05-01 23:13:35 +00:00
Ted Kremenek fabfb4677d Do not highlight bogus ranges for leaks.
llvm-svn: 50549
2008-05-01 22:50:36 +00:00
Ted Kremenek b0f87c48cb added preliminary diagnostics in scan-build results to denote whether
a CF memory leak occurred with GC enabled, etc.

llvm-svn: 50507
2008-04-30 23:47:44 +00:00
Ted Kremenek dd38e0bd0d Fix bug in BugReporter where we didn't handle emitting diagnostics for
empty CFGBlocks that only contained a terminator.

Added improved diagnostics for break and continue statements and default branches in switch statements.

This fixes <rdar://problem/5889244>.

llvm-svn: 50286
2008-04-25 19:01:27 +00:00
Ted Kremenek 4dd412e022 Don't emit empty strings for path diagnostics when taking the default branch of a switch statement that has no label.
llvm-svn: 50242
2008-04-25 01:29:56 +00:00
Ted Kremenek ecbdf75049 Do a better job at computing dead symbols.
Implemented support for better localized leaks in the CF reference count checker.
Now leaks should be flagged close to where they occur.

This should implement the desired functionality in <rdar://problem/5879592>, although the diagnostics still need to be improved.

llvm-svn: 50241
2008-04-25 01:25:15 +00:00
Ted Kremenek 21bf6006b0 For case statements involving enums, BugReporter now generates PathDiagnostics
that say that we are jumping to "case a" instead of "case 0".

This is a feature implementation for <rdar://problem/5880430>.

llvm-svn: 50197
2008-04-23 23:35:07 +00:00
Ted Kremenek 05e6267466 Fix minor regression in bug report generation.
llvm-svn: 50195
2008-04-23 23:04:32 +00:00
Ted Kremenek f26bc55b9a When building PathDiagnostics for bug reports, generate a trimmed ExplodedGraph with a single path that BugReport objects can safely walk and introspect.
llvm-svn: 50194
2008-04-23 23:02:12 +00:00
Ted Kremenek 0224ac57e0 For default branches in switch statements with no default label, print out
the line we are going to.

llvm-svn: 50113
2008-04-22 22:29:46 +00:00
Ted Kremenek 9718c9e8ee PathDiagnosticClients now retain ownership of passed PathDiagnostics, requiring
them to not be stack-allocated.

HTMLDiagnostics now batches PathDiagnostics before emitting HTML in its dtor.
This is a workaround for a problem when we trampled the Preprocessor state
when highlighting macros (sometimes resulting in an assertion failure).

llvm-svn: 50102
2008-04-22 16:15:03 +00:00
Ted Kremenek 423edc2384 Another bug fix in emitting warnings without a path: construct a unit PathDiagnostic as we did
before.  This allows the HTMLDiagnostic object to retrieve the bug type, bug description, etc.

llvm-svn: 49939
2008-04-18 22:56:53 +00:00
Ted Kremenek bf27dc9659 Reenable using the PathDiagnosticClient for BugReports without paths.
llvm-svn: 49934
2008-04-18 22:11:59 +00:00
Ted Kremenek 31484b2477 Generalize caching mechanism for bugs reports. Now individual BugTypes
can decide the policy on how to cache related bugs.  This allows us to
properly to handle warning about multiple leaks in the same location in the
ref count checker (not yet done).

llvm-svn: 49918
2008-04-18 20:54:29 +00:00
Ted Kremenek 396f43620f BugReport::VisitNode now takes BugReporter& instead of ASTContext&.
Shuffled around code in CFRefCount to better pair classes with implementation,
and started adding subclasses of RangedBugReport to handle better diagnostics
for reference count bugs.

llvm-svn: 49889
2008-04-18 03:39:05 +00:00
Ted Kremenek 89e6a9b98c Added null check.
llvm-svn: 49887
2008-04-18 02:24:50 +00:00
Ted Kremenek cffe635699 Simplified internal logic of BugReporter, consolidating EmitWarning and
EmitPathWarning into one method.  We now properly handle emitting warnings
without a PathDiagnosticClient when the warning does not involve a particular
statement.

llvm-svn: 49884
2008-04-18 01:56:37 +00:00
Ted Kremenek 69049c272f Modified BugReport::getEndPath() to handle the case where end path is at
the exit block of the CFG.

llvm-svn: 49880
2008-04-17 23:44:37 +00:00
Ted Kremenek bae225d57a Have BugReporter::EmitWarning use the PathDiagnosticClient if it is available.
llvm-svn: 49668
2008-04-14 18:06:42 +00:00
Ted Kremenek 7e15130dc9 Hooked up the dead-store checker to the BugReporter interface. Now dead-store
warnings are emitted as part of the warnings registered by GRSimpleVals.

llvm-svn: 49658
2008-04-14 17:39:48 +00:00
Ted Kremenek 6e38ffa517 Added "RangedBugReport".
llvm-svn: 49551
2008-04-11 18:40:29 +00:00
Ted Kremenek 42d9db75f0 When not emitting path diagnostics in BugReporter::EmitWarning(), use the
BugReport-specific SourceRanges (when available).

llvm-svn: 49486
2008-04-10 16:12:38 +00:00
Ted Kremenek 7acc3a36ef Major refactoring/cleanup of GRExprEngine, ExplodedGraph, and BugReporter.
Bugs are now reported using a combination of "BugType" (previously
BugDescription) and Bug "BugReport" objects, which are fed to BugReporter (which
generates PathDiagnostics). This provides a far more modular way of registering
bug types and plugging in diagnostics.

GRExprEngine now owns its copy of GRCoreEngine, and is not owned by the
ExplodedGraph.

ExplodedGraph is no longer templated on the "checker", but instead on the state
contained in the nodes.

llvm-svn: 49453
2008-04-09 21:41:14 +00:00