Commit Graph

2294 Commits

Author SHA1 Message Date
Fariborz Jahanian 3365bfc609 Revert r221702 until I address Richard Trieu's
comments.

llvm-svn: 221714
2014-11-11 21:54:19 +00:00
Fariborz Jahanian c5fd4844da Patch to warn when logical evaluation of operand evalutes to a true value;
That this is a c-only patch. c++ already has this warning.
This addresses rdar://18716393

llvm-svn: 221702
2014-11-11 19:59:16 +00:00
Anton Yartsev 6ca45c92a9 [analyzer] Move the NewDeleteLeaks checker from CplusplusAlpha to Cplusplus package.
llvm-svn: 220289
2014-10-21 12:41:36 +00:00
Ted Kremenek 0c28bc20da [analyzer] Tweak MallocSizeOfChecker to not warn when using sizeof(void*) to allocate a bunch of any pointer type.
This suppresses a common false positive when analyzing libc++.

Along the way, introduce some tests to show this checker actually
works with C++ static_cast<>.

llvm-svn: 220160
2014-10-19 07:30:55 +00:00
Jordan Rose 679659f58c [analyzer] Check all 'nonnull' attributes, not just the first one.
Patch by Daniel Fahlgren!

llvm-svn: 219625
2014-10-13 19:38:02 +00:00
Anna Zaks 2d2f137ed4 [analyzer] Make CStringChecker correctly calculate return value of mempcpy
The return value of mempcpy is only correct when the destination type is
one byte in size. This patch casts the argument to a char* so the
calculation is also correct for structs, ints etc.

A patch by Daniel Fahlgren!

llvm-svn: 219024
2014-10-03 21:48:54 +00:00
Jordan Rose 59801406ca [analyzer] Fix pthread lock tests so that the API comes from a system header.
...and verify that a global mutex in user code can be used without warnings.

Patch by Aleksei Sidorin!

llvm-svn: 217515
2014-09-10 16:17:42 +00:00
Jordan Rose 21933ccdd7 Teach the analyzer that __builtin_assume_aligned returns its first argument.
Patch by Daniel Fahlgren!

llvm-svn: 217461
2014-09-09 21:42:16 +00:00
Jordan Rose f69e65f75c [analyzer] Don't crash if malloc() has an unexpected function prototype.
Patch by Daniel Fahlgren!

llvm-svn: 217258
2014-09-05 16:33:51 +00:00
Anna Zaks ae08e431dd Fixup for r216763. Add a driver test.
llvm-svn: 216783
2014-08-29 21:51:22 +00:00
Fariborz Jahanian 3b23008987 Objective-C [qoi]. If property is going to be implemented
in the super class, do not issue the warning about property
in current class's protocol will not be auto synthesized.
// rdar://18179833

llvm-svn: 216769
2014-08-29 20:29:31 +00:00
Anna Zaks d5478fdd8f Add an option to silence all analyzer warnings.
People have been incorrectly using "-analyzer-disable-checker" to
silence analyzer warnings on a file, when analyzing a project. Add
the "-analyzer-disable-all-checks" option, which would allow the
suppression and suggest it as part of the error message for
"-analyzer-disable-checker". The idea here is to compose this with
"--analyze" so that users can selectively opt out specific files from
static analysis.

llvm-svn: 216763
2014-08-29 20:01:38 +00:00
Fariborz Jahanian c9b771560a Objective-C. Tweak diagnosing properties that are not auto-synthesized.
Do not warn when property declared in class's protocol will be auto-synthesized
by its uper class implementation because super class has also declared this
property while this class has not. Continue to warn if current class
has declared the property also (because this declaration will not result
in a 2nd synthesis).
rdar://18152478

llvm-svn: 216753
2014-08-29 18:31:16 +00:00
Richard Smith 925721572b Add tests for variadic functions versus attribute nonnull in the static analyzer.
llvm-svn: 216577
2014-08-27 19:05:47 +00:00
Ted Kremenek eeccb30b94 Add support for the static analyzer to synthesize function implementations from external model files.
Currently the analyzer lazily models some functions using 'BodyFarm',
which constructs a fake function implementation that the analyzer
can simulate that approximates the semantics of the function when
it is called.  BodyFarm does this by constructing the AST for
such definitions on-the-fly.  One strength of BodyFarm
is that all symbols and types referenced by synthesized function
bodies are contextual adapted to the containing translation unit.
The downside is that these ASTs are hardcoded in Clang's own
source code.

A more scalable model is to allow these models to be defined as source
code in separate "model" files and have the analyzer use those
definitions lazily when a function body is needed.  Among other things,
it will allow more customization of the analyzer for specific APIs
and platforms.

This patch provides the initial infrastructure for this feature.
It extends BodyFarm to use an abstract API 'CodeInjector' that can be
used to synthesize function bodies.  That 'CodeInjector' is
implemented using a new 'ModelInjector' in libFrontend, which lazily
parses a model file and injects the ASTs into the current translation
unit.  

Models are currently found by specifying a 'model-path' as an
analyzer option; if no path is specified the CodeInjector is not
used, thus defaulting to the current behavior in the analyzer.

Models currently contain a single function definition, and can
be found by finding the file <function name>.model.  This is an
initial starting point for something more rich, but it bootstraps
this feature for future evolution.

This patch was contributed by Gábor Horváth as part of his
Google Summer of Code project.

Some notes:

- This introduces the notion of a "model file" into
  FrontendAction and the Preprocessor.  This nomenclature
  is specific to the static analyzer, but possibly could be
  generalized.  Essentially these are sources pulled in
  exogenously from the principal translation.

  Preprocessor gets a 'InitializeForModelFile' and
  'FinalizeForModelFile' which could possibly be hoisted out
  of Preprocessor if Preprocessor exposed a new API to
  change the PragmaHandlers and some other internal pieces.  This
  can be revisited.

  FrontendAction gets a 'isModelParsingAction()' predicate function
  used to allow a new FrontendAction to recycle the Preprocessor
  and ASTContext.  This name could probably be made something
  more general (i.e., not tied to 'model files') at the expense
  of losing the intent of why it exists.  This can be revisited.

- This is a moderate sized patch; it has gone through some amount of
  offline code review.  Most of the changes to the non-analyzer
  parts are fairly small, and would make little sense without
  the analyzer changes.

- Most of the analyzer changes are plumbing, with the interesting
  behavior being introduced by ModelInjector.cpp and
  ModelConsumer.cpp.

- The new functionality introduced by this change is off-by-default.
  It requires an analyzer config option to enable.

llvm-svn: 216550
2014-08-27 15:14:15 +00:00
Benjamin Kramer cb4efc1028 [analyzer] Don't warn on virtual calls in ctors to final methods.
The call will never go to a more derived class, but that's intentional in those
cases.

llvm-svn: 216167
2014-08-21 10:25:03 +00:00
Jordan Rose 50de57df6d [test] Turn off warnings for test/Analysis/identical-expressions.cpp.
Also, make it slightly clearer what's being tested by only differentiating integer
literals based on their suffix, rather than using a very large constant.

llvm-svn: 216133
2014-08-20 22:40:57 +00:00
Jordan Rose ba129af62a [analyzer] UnixAPI: Check that the third argument to open(2) (if present) is an integer.
Patch by Daniel Fahlgren.

llvm-svn: 216079
2014-08-20 16:58:09 +00:00
Jordan Rose cd4db5c6d2 [analyzer] UnixAPI: Check when open(2) is called with more than three arguments.
Patch by Daniel Fahlgren.

llvm-svn: 216078
2014-08-20 16:58:03 +00:00
Jordan Rose f3544e913d [analyzer] IdenticalExpr: don't try to compare integer literals with different widths.
PR20659. Patch by Anders Rönnholm.

llvm-svn: 216076
2014-08-20 16:51:26 +00:00
Jordan Rose b6100301e8 [analyzer] IdenticalExpr: use getBytes rather than getString to compare string literals.
PR20693. Patch by Anders Rönnholm.

llvm-svn: 216075
2014-08-20 16:51:18 +00:00
Manuel Klimek f67672e41c Work around missing handling of temporaries bound to default arguments.
Yet more problems due to the missing CXXBindTemporaryExpr in the CFG for
default arguments.

Unfortunately we cannot just switch off inserting temporaries for the
corresponding default arguments, as that breaks existing tests
(test/SemaCXX/return-noreturn.cpp:245).

llvm-svn: 215554
2014-08-13 15:25:55 +00:00
Jordan Rose 1a9c0d141c [analyzer] Check for negative values used as the size of a C variable-length array.
Patch by Daniel Fahlgren!

llvm-svn: 215456
2014-08-12 16:44:22 +00:00
Manuel Klimek 26f649f3f4 Work around default parameter problem in the static analyzer.
In cases like:
  struct C { ~C(); }
  void f(C c = C());
  void t() {
    f();
  }

We currently do not add the CXXBindTemporaryExpr for the temporary (the
code mentions that as the default parameter expressions are owned by
the declaration, we'd otherwise add the same expression multiple times),
but we add the temporary destructor pointing to the CXXBindTemporaryExpr.
We need to fix that before we can re-enable the assertion.

llvm-svn: 215357
2014-08-11 14:54:30 +00:00
Manuel Klimek b5616c9f8d Re-applying r214962.
Changes to the original patch:
- model the CFG for temporary destructors in conditional operators so that
  the destructors of the true and false branch are always exclusive. This
  is necessary because we must not have impossible paths for the path
  based analysis to work.
- add multiple regression tests with ternary operators

Original description:
Fix modelling of non-lifetime-extended temporary destructors in the
analyzer.

Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 215096
2014-08-07 10:42:17 +00:00
Rui Ueyama a89f9c8fdb Revert "Fix modelling of non-lifetime-extended temporary destructors in the analyzer."
This reverts commit r214962 because after the change the
following code doesn't compile with -Wreturn-type -Werror.

  #include <cstdlib>

  class NoReturn {
  public:
    ~NoReturn() __attribute__((noreturn)) { exit(1); }
  };

  int check() {
    true ? NoReturn() : NoReturn();
  }

llvm-svn: 214998
2014-08-06 22:01:54 +00:00
Manuel Klimek d9b4ad6e1f Fix modelling of non-lifetime-extended temporary destructors in the analyzer.
1. Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 214962
2014-08-06 12:45:51 +00:00
Anton Yartsev 4e4cb6bc30 [Analyzer] fix for PR19102
Newly-created unconsumed instance is now assumed escaped if an invoked constructor has an argument of a pointer-to-record type.

llvm-svn: 214909
2014-08-05 18:26:05 +00:00
Manuel Klimek b0042c414e Fix some cases of incorrect handling of lifetime extended temporaries.
MaterializeTemporaryExpr already contains information about the lifetime
of the temporary; if the lifetime is not the full statement, we do not
want to emit a destructor at the end of the full statement for it.

llvm-svn: 214292
2014-07-30 08:34:42 +00:00
Fariborz Jahanian 6c9ee7b0c8 Objective-C. Issue more warning diagnostic when certain
properties are not synthesized in property auto-synthesis,
as it can potentiall lead to runtime errors.
rdar://17774815

llvm-svn: 214032
2014-07-26 20:52:26 +00:00
Alp Toker 5d96e0a3a7 Consolidate header inclusion diagnostics
Make argument orders match, unify diagnostic IDs and reword the message to be a
little less saccharine.

llvm-svn: 212845
2014-07-11 20:53:51 +00:00
Jordan Rose dc352bb82b [analyzer] Check for code testing a variable for 0 after using it as a denominator.
This new checker, alpha.core.TestAfterDivZero, catches issues like this:

  int sum = ...
  int avg = sum / count; // potential division by zero...
  if (count == 0) { ... } // ...caught here

Because the analyzer does not necessarily explore /all/ paths through a program,
this check is restricted to only work on zero checks that immediately follow a
division operation (/ % /= %=). This could later be expanded to handle checks
dominated by a division operation but not necessarily in the same CFG block.

Patch by Anders Rönnholm! (with very minor modifications by me)

llvm-svn: 212731
2014-07-10 16:10:52 +00:00
Anna Zaks b8de0c4278 Do not inline methods of C++ containers (coming from headers).
This silences false positives (leaks, use of uninitialized value) in simple
code that uses containers such as std::vector and std::list. The analyzer
cannot reason about the internal invariances of those data structures which
leads to false positives. Until we come up with a better solution to that
problem, let's just not inline the methods of the containers and allow objects
to escape whenever such methods are called.

This just extends an already existing flag "c++-container-inlining" and applies
the heuristic not only to constructors and destructors of the containers, but
to all of their methods.

We have a bunch of distinct user reports all related to this issue
(radar://16058651, radar://16580751, radar://16384286, radar://16795491
[PR19637]).

llvm-svn: 211832
2014-06-27 01:03:05 +00:00
Jordan Rose e3f310f3bd [analyzer] Check for NULL passed to CFAutorelease.
Patch by Sean McBride, tests adjusted by me.

llvm-svn: 211453
2014-06-21 23:50:40 +00:00
Daniel Jasper b3b0b8034c Fix/Improve SourceRange of explicitly defaulted members
When adding the implicit compound statement (required for Codegen?), the
end location was previously overridden by the start location, probably
based on the assumptions:

* The location of the compound statement should be the member's location
* The compound statement if present is the last element of a FunctionDecl

This patch changes the location of the compound statement to the
member's end location.

Code review: http://reviews.llvm.org/D4175

llvm-svn: 211344
2014-06-20 08:44:22 +00:00
Jordan Rose 6914e2f339 [analyzer] Don't create new PostStmt nodes if we don't have to.
Doing this caused us to mistakenly think we'd seen a particular state before
when we actually hadn't, which resulted in false negatives. Credit to
Rafael Auler for discovering this issue!

llvm-svn: 211209
2014-06-18 19:23:30 +00:00
Anna Zaks a6fea1386f Fix a crash in Retain Count checker error reporting
Fixes a crash in Retain Count checker error reporting logic by handing
the allocation statement retrieval from a BlockEdge program point.

Also added a simple CFG dump routine for debugging.

llvm-svn: 210960
2014-06-13 23:47:38 +00:00
Richard Trieu f7432755d0 Add -Wtautological-undefined-compare and -Wundefined-bool-conversion warnings
to detect underfined behavior involving pointers.

llvm-svn: 210372
2014-06-06 21:39:26 +00:00
Eric Christopher 4c08be18b1 Fix testcase for case.
llvm-svn: 209218
2014-05-20 17:15:31 +00:00
Eric Christopher c9e2a68905 Clean up language and grammar.
Based on a patch by jfcaron3@gmail.com!
PR19806

llvm-svn: 209215
2014-05-20 17:10:39 +00:00
Jordan Rose 2741654b89 [analyzer] Functions marked __attribute__((const)) don't modify any memory.
This applies to __attribute__((pure)) as well, but 'const' is more interesting
because many of our builtins are marked 'const'.

PR19661

llvm-svn: 208154
2014-05-07 03:29:56 +00:00
Manuel Klimek 75f34c1386 Fix handling of condition variables in the face of temp dtors.
The assignment needs to be before the destruction of the temporary.
This patch calls out to addStmt, which invokes VisitDeclStmt, which has
all the correct logic for handling temporaries.

llvm-svn: 207985
2014-05-05 18:21:06 +00:00
Manuel Klimek 264f963114 Fix crash when resolving branch conditions for temporary destructor condition blocks.
Document and simplify ResolveCondition.

1. Introduce a temporary special case for temporary desctructors when resolving
the branch condition - in an upcoming patch, alexmc will change temporary
destructor conditions to not run through this logic, in which case we can remove
this (marked as FIXME); this currently fixes a crash.

2. Simplify ResolveCondition; while documenting the function, I noticed that it
always returns the last statement - either that statement is the condition
itself (in which case the condition was returned anyway), or the rightmost
leaf is returned; for correctness, the rightmost leaf must be evaluated anyway
(which the CFG does in the last statement), thus we can just return the last
statement in that case, too. Added an assert to verify the invariant.

llvm-svn: 207957
2014-05-05 09:58:03 +00:00
Jordan Rose 6017348856 [analyzer] Improve test from r207486.
The constructor that comes right before a variable declaration in the CFG might
not be the initialization of that variable. Previously, we just checked that
the variable's initializer expression was different from the construction
expression, but forgot to see whether the variable had an initializer expression
at all.

Thanks for the prompting, David.

llvm-svn: 207562
2014-04-29 17:08:17 +00:00
Jordan Rose 62ac9ecadc [analyzer] Don't assert when combining using .* on a temporary.
While we don't model pointer-to-member operators yet (neither .* nor ->*),
CallAndMessageChecker still checks to make sure the 'this' object is not
null or undefined first. However, it also expects that the object should
always have a valid MemRegion, something that's generally important elsewhere
in the analyzer as well. Ensure this is true ahead of time, just like we do
for member access.

PR19531

llvm-svn: 207561
2014-04-29 17:08:12 +00:00
Jordan Rose bcd889730d [analyzer] Don't crash when a construction is followed by an uninitialized variable.
This could happen due to unfortunate CFG coincidences.

PR19579

llvm-svn: 207486
2014-04-29 01:56:12 +00:00
Jordan Rose 0675c87395 [analyzer] When checking Foundation method calls, match the selectors exactly.
This also includes some infrastructure to make it easier to build multi-argument
selectors, rather than trying to use string matching on each piece. There's a bit
more setup code, but less cost at runtime.

PR18908

llvm-svn: 205827
2014-04-09 01:39:22 +00:00
Jordan Rose 9c8a5ff161 [analyzer] Re-enable test I accidentally committed commented-out.
Thanks, Alex!

llvm-svn: 205720
2014-04-07 16:36:08 +00:00
Jordan Rose 8a5a094ec5 [analyzer] Look through temporary destructors when finding a region to construct.
Fixes a false positive when temporary destructors are enabled where a temporary
is destroyed after a variable is constructed but before the VarDecl itself is
processed, which occurs when the variable is in the condition of an if or while.

Patch by Alex McCarthy, with an extra test from me.

llvm-svn: 205661
2014-04-05 02:01:41 +00:00
David Blaikie abe1a398e3 Render anonymous entities as '(anonymous <thing>)' (and lambdas as '(lambda at ... )')
For namespaces, this is consistent with mangling and GCC's debug info
behavior. For structs, GCC uses <anonymous struct> but we prefer
consistency between all anonymous entities but don't want to confuse
them with template arguments, etc, so we'll just go with parens in all
cases.

llvm-svn: 205398
2014-04-02 05:58:29 +00:00