Commit Graph

709 Commits

Author SHA1 Message Date
Zhongxing Xu 9103df1688 Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so
do the symblic regions associated with them and we need them to be typed.

Current SymbolicRegion::getRValueType() method is very restricting. It may be
modified when we are more clear about what could be the types of symblic
regions.

BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a
subclass of SubRegion.
 

llvm-svn: 63844
2009-02-05 06:57:29 +00:00
Ted Kremenek 400aae7fa4 Remove a bunch of obscene double-buffering of BugReports in the retain/release
checker. This was previously needed because BugReport objects were previously
allocated on the stack and not owned by BugReporter. Now we can just issue them
on the fly. This change was motivated because we were seeing some weird cases
where some really long paths would get issued for bugs (particularly leaks)
because of some double-caching.

llvm-svn: 63840
2009-02-05 06:50:21 +00:00
Ted Kremenek fb379b2660 Fix regression: Leak (BugType) object should have 'isLeak()' return true.
llvm-svn: 63803
2009-02-05 00:38:00 +00:00
Ted Kremenek fc5d067ea0 Overhaul BugReporter interface and implementation. The new interface cleans up
the ownership of BugTypes and BugReports. Now BugReports are owned by BugTypes,
and BugTypes are owned by the BugReporter object.

The major functionality change in this patch is that reports are not immediately
emitted by a call to BugReporter::EmitWarning (now called EmitReport), but
instead of queued up in report "equivalence classes". When
BugReporter::FlushReports() is called, it emits one diagnostic per report
equivalence class. This provides a nice cleanup with the caching of reports as
well as enables the BugReporter engine to select the "best" path for reporting a
path-sensitive bug based on all the locations in the ExplodedGraph that the same
bug could occur.

Along with this patch, Leaks are now coalesced into a common equivalence class
by their allocation site, and the "summary" diagnostic for leaks now reports the
allocation site as the location of the bug (this may later be augmented to also
provide an example location where the leak occurs).

llvm-svn: 63796
2009-02-04 23:49:09 +00:00
Zhongxing Xu 6d5fe08e1b Remove dead code.
llvm-svn: 63715
2009-02-04 02:30:11 +00:00
Chris Lattner e4ad417664 make SM::getColumnNumber take a predecomposed FileID/offset, which
makes it clear to clients that they have to pick an instantiation
or spelling location before calling it and allows optimization based
on that.

llvm-svn: 63698
2009-02-04 00:55:58 +00:00
Ted Kremenek 378e7fd330 Fix horrible non-termination bug in LiveVariables. The issue was that
the liveness state of block-level expressions could oscillate because
of two issues:
- The initial value before a merge was not always set to "Top"
- The set of live block-level expressions is a union, not an intersection

This fixes <rdar://problem/650084>.

llvm-svn: 63421
2009-01-30 21:35:30 +00:00
Ted Kremenek 0b0a64830a Move method out-of-line.
llvm-svn: 63412
2009-01-30 19:27:39 +00:00
Douglas Gregor ddb2485eb6 Switch Type::isAggregateType to use the C++ definition of "aggregate
type" rather than the C definition. We do this because both C99 and
Clang always use "aggregate type" as "aggregate or union type", and
the C++ definition includes union types.

llvm-svn: 63395
2009-01-30 17:31:00 +00:00
Chris Lattner 34beb046ea update for change in API.
llvm-svn: 63363
2009-01-30 01:58:33 +00:00
Ted Kremenek 7594e2a59a Fix a couple bugs:
- NonLoc::MakeVal() would use sizeof(unsigned) (literally) instead of consulting
  ASTContext for the size (in bits) of 'int'. While it worked, it was a
  conflation of concepts and using ASTContext.IntTy is 100% correct.
- RegionStore::getSizeInElements() no longer assumes that a VarRegion has the
  type "ConstantArray", and handles the case when uses use ordinary variables
  as if they were arrays.
- Fixed ElementRegion::getRValueType() to just return the rvalue type of its
  "array region" in the case the array didn't have ArrayType.
- All of this fixes <rdar://problem/6541136>

llvm-svn: 63347
2009-01-30 00:08:43 +00:00
Ted Kremenek ed90de4caa retain/release checker: When generating summaries for CF/CG functions, allow arguments to "escape" if they are passed to a function containing the terms "InsertValue", "SetValue", or "AddValue". This fixes <rdar://problem/6539791>.
llvm-svn: 63341
2009-01-29 22:45:13 +00:00
Chris Lattner 60f36223a9 move library-specific diagnostic headers into library private dirs. Reduce
redundant #includes.  Patch by Anders Johnsen!

llvm-svn: 63271
2009-01-29 05:15:15 +00:00
Ted Kremenek b4dd3f8685 Remove '#if 0' code.
llvm-svn: 63250
2009-01-28 22:35:55 +00:00
Ted Kremenek 2e561dd491 Remove method 'AddNE' from the public interface of ConstraintManager.
llvm-svn: 63249
2009-01-28 22:27:59 +00:00
Ted Kremenek c783209605 retain/release checker: Always generate an "autorelease" summary for an "autorelease" message, and have the summary processing logic treat it as a no-op in GC mode. This change is motivated to encode more of the semantics in the summaries themselves for eventual better diagnostics.
llvm-svn: 63241
2009-01-28 21:44:40 +00:00
Ted Kremenek 4daeccf28f retain/release checker: Improve diagnostics to indicate that CF objects are not automatically garbage collected.
llvm-svn: 63187
2009-01-28 06:25:48 +00:00
Ted Kremenek f0ec316a04 retain/release checker: Indicate whether a tracked object is a Core Foundation or Objective-C object.
llvm-svn: 63186
2009-01-28 06:06:36 +00:00
Ted Kremenek bdaa384453 retain/release checker: More diagnostic refactoring.
llvm-svn: 63184
2009-01-28 06:01:42 +00:00
Ted Kremenek aeb115f93a retain/release checker: Embed an "object type" into the RetEffect/RetVal objects to help distinguish between Objective-C and Core Foundation objects (for better diagnostics).
llvm-svn: 63183
2009-01-28 05:56:51 +00:00
Ted Kremenek 21114f21c4 retain/release checker: More cleanups (no real functionality change).
llvm-svn: 63181
2009-01-28 05:29:13 +00:00
Ted Kremenek ff3c2bdfee Fix diagnostic truncated by my last patch.
llvm-svn: 63180
2009-01-28 05:18:08 +00:00
Ted Kremenek 758fda632b retain/release checker: More diagnostic refactoring.
llvm-svn: 63179
2009-01-28 05:15:02 +00:00
Ted Kremenek c4118ac79c retain/release checker: Output the name of the function that allocates an object.
llvm-svn: 63178
2009-01-28 05:06:46 +00:00
Ted Kremenek 424c61ff6d Refactor some diagnostic code to use raw_string_ostream. No functionality change.
llvm-svn: 63177
2009-01-28 04:47:13 +00:00
Ted Kremenek 99ae4120d6 Remove '#if 0' code.
llvm-svn: 63176
2009-01-28 04:37:52 +00:00
Chris Lattner 7368d581c1 Split the single monolithic DiagnosticKinds.def file into one
.def file for each library.  This means that adding a diagnostic
to sema doesn't require all the other libraries to be rebuilt.

Patch by Anders Johnsen!

llvm-svn: 63111
2009-01-27 18:30:58 +00:00
Ted Kremenek 422d81dcd4 Fix bug in BasicStore::getLValueElement where if the base of an array subscript expression was an ElementRegion we stacked another ElementRegion on top of that.
This fixes PR 3422.

llvm-svn: 63110
2009-01-27 18:29:03 +00:00
Chris Lattner f1ca7d3e02 Introduce a new PresumedLoc class to represent the concept of a location
as reported to the user and as manipulated by #line.  This is what __FILE__,
__INCLUDE_LEVEL__, diagnostics and other things should follow (but not 
dependency generation!).  

This patch also includes several cleanups along the way: 

- SourceLocation now has a dump method, and several other places 
  that did similar things now use it.
- I cleaned up some code in AnalysisConsumer, but it should probably be
  simplified further now that NamedDecl is better.
- TextDiagnosticPrinter is now simplified and cleaned up a bit.

This patch is a prerequisite for #line, but does not actually provide 
any #line functionality.

llvm-svn: 63098
2009-01-27 07:57:44 +00:00
Ted Kremenek a3f462e49a PathDiagnostics:
- Add the distinction between the 'bug type' and the 'bug description'

HTMLDiagnostics:
- Output the bug type field as HTML comments

scan-build:
- Use the bug type field instead of the bug description for the HTML table.
- Radar filing now automatically picks up the bug description in the title (addresses <rdar://problem/6265970>)

llvm-svn: 63084
2009-01-27 01:53:39 +00:00
Sebastian Redl 54cb4c88e1 Correct size assumption; fixes a crash on amd64.
llvm-svn: 63031
2009-01-26 19:54:12 +00:00
Ted Kremenek e9193283c6 Use tag classes instead of typedefs for GDM entries 'ConstNotEq' and 'ConstEq'. This avoids collisions in the GDM.
llvm-svn: 63002
2009-01-26 06:04:53 +00:00
Eli Friedman 7139af42ce Rename Expr::isConstantExpr to Expr::isConstantInitializer; this more
accurately states what the function is trying to do and how it is 
different from Expr::isEvaluatable.  Also get rid of a parameter that is both 
unused and inaccurate.

llvm-svn: 62951
2009-01-25 02:32:41 +00:00
Ted Kremenek b3fcaa7a77 Fix crash ElementRegion::getRValueType() when the RvalueType of the ArrayRegion is a typedef and not (directly) a pointer.
llvm-svn: 62909
2009-01-24 06:11:36 +00:00
Ted Kremenek f08ac278ed More hacking on static analyzer diagnostics. When emitting summary diagnostics the code paths for diagnostics involving paths or single locations are now unified. This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup.
llvm-svn: 62903
2009-01-24 00:55:43 +00:00
Ted Kremenek 864ead2076 Output summary diagnostic for each bug report.
llvm-svn: 62885
2009-01-23 22:22:49 +00:00
Ted Kremenek ea06ec1cad Added virtual method DiagnosticClient::IncludeInDiagnosticCounts(). This is used by Diagnostics to determine if a diagnostic sent to a given DiagnosticClient should be included in the count of diagnostics. The default implementation of this method returns 'true'.
Implemented DiagCollector::IncludeInDiagnosticCounts() to return 'false' so that the batching of diagnostics for use with BugReporter doesn't mess up the count of real diagnostics.

llvm-svn: 62873
2009-01-23 20:28:53 +00:00
Zhongxing Xu e37f9afb2e Implement retrieval of the default value of element and field regions.
llvm-svn: 62847
2009-01-23 11:22:12 +00:00
Zhongxing Xu 804f26a60a Now this comment should be resolved. See the comments for the KillSet.
llvm-svn: 62846
2009-01-23 10:42:17 +00:00
Zhongxing Xu 570e088e4b When getting the element region type, we should get the rvalue type of the super
region. Otherwise we would get an extra level of pointer type.

llvm-svn: 62844
2009-01-23 10:19:29 +00:00
Ted Kremenek 2e1dfe25c5 For now, return UnknownVal() in RegionStore::getElementsSize() for AnonTypedRegions. It wasn't really doing the right thing and was crashing on rdar-6442306-1.m. This fix causes all path-sensitive test cases to pass with RegionStore.
llvm-svn: 62816
2009-01-22 23:56:56 +00:00
Ted Kremenek fe0f1788ca Add RegionStore support for the implicit object region that 'self' references. This causes tests 'ObjCProperties.m' and 'refcnt_naming.m' to now pass with RegionStore.
llvm-svn: 62814
2009-01-22 23:43:57 +00:00
Ted Kremenek 92d48a71f5 Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781
2009-01-22 20:27:48 +00:00
Ted Kremenek 2dd9c9cbd7 SymbolReaper::isLive(SymbolRef) now always returns true for SymbolRegionRvalues because these represent the symbolic values for parameters/globals upon entry to the function. These values are always ;live' because they represent constraints on the context of how the function was called. This will be useful for both summary generation but is also necessary to get RegionStore's lazy-binding of locations to symbols to work in practice with RemoveDeadBindings.
llvm-svn: 62771
2009-01-22 18:51:33 +00:00
Ted Kremenek 74040833e4 Static analyzer: Remove a bunch of outdated SymbolData objects and
their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769
2009-01-22 18:23:34 +00:00
Ted Kremenek 1322ca1364 Combine two branches into one. No functionality change.
llvm-svn: 62727
2009-01-21 22:58:50 +00:00
Ted Kremenek 16fbfe699e Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.
llvm-svn: 62722
2009-01-21 22:26:05 +00:00
Ted Kremenek fe32cc0ba6 Get RegionStore to work with the retain/release checker and its test cases.
Because the RegionStore can reason about values beyond the reasoning power of BasicStore, this patch splits some of the test cases for the retain/release checker to have versions that are handled by RegionStore (more warnings) and BasicStore (less warnings).

llvm-svn: 62667
2009-01-21 06:57:53 +00:00
Douglas Gregor 6e6ad602e5 Remove ScopedDecl, collapsing all of its functionality into Decl, so
that every declaration lives inside a DeclContext.

Moved several things that don't have names but were ScopedDecls (and,
therefore, NamedDecls) to inherit from Decl rather than NamedDecl,
including ObjCImplementationDecl and LinkageSpecDecl. Now, we don't
store empty DeclarationNames for these things, nor do we try to insert
them into DeclContext's lookup structure.

The serialization tests are temporarily disabled. We'll re-enable them
once we've sorted out the remaining ownership/serialiazation issues
between DeclContexts and TranslationUnion, DeclGroups, etc.

llvm-svn: 62562
2009-01-20 01:17:11 +00:00
Ted Kremenek e5fe617e2b Dead stores checker: Fix <rdar://problem/6506065> by being more selective when say that a store is dead even though the computed value is used in the enclosing expression.
llvm-svn: 62552
2009-01-20 00:47:45 +00:00