Commit Graph

844 Commits

Author SHA1 Message Date
Tom Care 71cc9d886a Added checking of (x == x) and (x != x) to IdempotentOperationChecker and updated test cases flagged by it.
llvm-svn: 112313
2010-08-27 22:50:47 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 036223bdcf Fix horrible GRExprEngine bug where switch statements with no 'case:' statements would cause the path to get prematurely aborted. Fixes <rdar://problem/8360854>.
llvm-svn: 112233
2010-08-26 22:19:33 +00:00
Tom Care 82b2a1dada Improved the handling of blocks and block variables in PseudoConstantAnalysis
- Removed the assumption that __block vars are all non-constant
- Simplified some repetitive code in RunAnalysis
- Added block walking support
- Code/comments cleanup
- Separated out test for block pseudoconstants

llvm-svn: 112098
2010-08-25 22:37:26 +00:00
Tom Care a460311710 Improvements to IdempotentOperationChecker and its use of PseudoConstantAnalysis
- Added wasReferenced function to PseudoConstantAnalysis to determine if a variable was ever referenced in a function (outside of a self-assignment)
- BlockDeclRefExpr referenced variables are now explicitly added to the non-constant list
- Remove unnecessary ignore of implicit casts
- Generalized parameter self-assign detection to detect deliberate self-assigns of variables to avoid unused variable warnings
- Updated test cases with deliberate self-assignments
- Fixed bug with C++ references and pseudoconstants
- Added test case for C++ references and pseudoconstants

llvm-svn: 111965
2010-08-24 21:09:07 +00:00
Tom Care 905c051e47 Modified pseudoconstant test case to make it a bit clearer and fix a missing line
llvm-svn: 111833
2010-08-23 19:57:25 +00:00
Tom Care e332c3b762 Several small changes to PseudoConstantAnalysis and the way IdempotentOperationChecker uses it.
- Psuedo -> Pseudo (doh...)
- C++ reference support
- Added pseudoconstant test case for __block vars
- Separated out static local checking from pseudoconstant analysis and generalized to non-local checking
- Added missing test cases for storage false positives

llvm-svn: 111832
2010-08-23 19:51:57 +00:00
Jordy Rose 796b5122d9 Handle nested compound values in BindArray for multidimensional arrays. Fixes PR7945.
llvm-svn: 111602
2010-08-20 01:05:59 +00:00
Ted Kremenek 50e0105f1c Add warning for functions/blocks that have attribute 'noreturn' but return a non-void result. (<rdar://problem/7562925>)
llvm-svn: 111492
2010-08-19 00:52:13 +00:00
Tom Care b9933f365e Added psuedo-constant analysis and integrated it into the false positive reduction stage in IdempotentOperationChecker.
- Renamed IdempotentOperationChecker::isConstant to isConstantOrPseudoConstant to better reflect the function
- Changed IdempotentOperationChecker::PreVisitBinaryOperator to only run 'CanVary' once on undefined assumptions
- Created new PsuedoConstantAnalysis class and added it to AnalysisContext
- Changed IdempotentOperationChecker to exploit the new analysis
- Updated tests with psuedo-constants
- Added check to IdempotentOperationChecker to see if a Decl is const qualified

llvm-svn: 111426
2010-08-18 21:17:24 +00:00
Ted Kremenek 4f2ab5a549 Fix horrible CFG bug caused by a series of NullStmts appearing at the beginning of a do...while loop. This would cause
the body of the DoStmt to be disconnected from the preceding code.

llvm-svn: 111283
2010-08-17 21:00:06 +00:00
Tom Care c129cc18f0 Added basic psuedoconstant checking in IdempotentOperationChecker and fixed some test cases.
llvm-svn: 111190
2010-08-16 21:43:52 +00:00
Jordy Rose 722f558f07 Model the effects of strcpy() and stpcpy() in CStringChecker. Other changes:
- Fix memcpy() and friends to actually invalidate the destination buffer.
- Emit a different message for out-of-bounds buffer accesses if the buffer is being written to.
- When conjuring symbols, let ValueManager figure out the type.

llvm-svn: 111120
2010-08-16 07:51:42 +00:00
Jordy Rose df28e8ec41 - Allow making ElementRegions with complex offsets (expressions or symbols) for the purpose of bounds-checking.
- Rewrite GRState::AssumeInBound to actually do that checking, and to use the normal constraint path.
- Remove ConstraintManager::AssumeInBound.
- Teach RegionStore and FlatStore to ignore those regions for now.

llvm-svn: 111116
2010-08-16 01:15:17 +00:00
Jordy Rose 2a2e21c902 Update CStringChecker to take advantage of the new metadata symbols and region change callback. Now does basic tracking of string length for general regions. Currently this is still only used for modeling strlen().
llvm-svn: 111081
2010-08-14 21:02:52 +00:00
Jordy Rose a797475712 Add a test for alloca region extents.
llvm-svn: 111079
2010-08-14 20:46:10 +00:00
Tom Care f8a9863df9 Improved IdempotentOperationChecker false positives and false negatives.
- Unfinished analysis may still report valid warnings if the path was completely analyzed
- New 'CanVary' heuristic to recursively determine if a subexpression has a varying element
- Updated test cases, including one known bug
- Exposed GRCoreEngine through GRExprEngine

llvm-svn: 110970
2010-08-12 22:45:47 +00:00
Jordy Rose c6c0fc9164 Allow EvalBinOpNN to handle expressions of the form $a+$b if $b can be reduced to a constant.
llvm-svn: 110592
2010-08-09 20:31:57 +00:00
Tom Care 925501c548 Removed IdempotentOperationChecker from default analysis and returned back to a flag (-analyzer-check-idempotent-operations)
- Added IdempotentOperationChecker to experimental analyses for testing purposes
- Updated test cases to explictly call the checker

llvm-svn: 110482
2010-08-06 22:23:07 +00:00
Zhongxing Xu 396e041f5e add test case.
llvm-svn: 110408
2010-08-06 00:04:40 +00:00
Jordy Rose afdb053618 When checking if a buffer access is valid, first make sure the buffer has a valid Loc. Fixes PR7830.
llvm-svn: 110390
2010-08-05 23:11:30 +00:00
Tom Care 16ba7c652e Fixed logic error in UnreachableCodeChecker's marking algorithm that would sometimes allow for multiple sequential statements to be flagged.
llvm-svn: 110353
2010-08-05 17:53:44 +00:00
Ted Kremenek 1d08fd9b79 Correctly handle 'Class<...>' when examining Cocoa conventions in the static analyzer. Fixes a crash reported in <rdar://problem/8272168>. Patch by Henry Mason!
llvm-svn: 110289
2010-08-05 00:19:24 +00:00
Ted Kremenek b786156b01 Teach SemaChecking::CheckReturnStackAddr about ImplicitCastExprs that convert values to an lvalue. This allows us to warn (again) about returning references to stack variables. (fixes PR 7812).
llvm-svn: 110242
2010-08-04 20:01:07 +00:00
Ted Kremenek 297e2e5bf6 Fix idempotent operations false positive caused by ivars not being invalidated in function
calls when the enclosing object had retain/release state.  Fixes <rdar://problem/8261992>.

llvm-svn: 110068
2010-08-02 21:59:12 +00:00
Ted Kremenek 4b83f753a1 Add test case for <rdar://problem/8258814>.
llvm-svn: 110058
2010-08-02 20:33:00 +00:00
Zhongxing Xu fd91d27630 Improve flat store: MemRegion::getAsOffset() computes a region's offset within
the top-level object. FlatStore now can bind and retrieve element and field
regions.
PR7297 is fixed by flat store.

llvm-svn: 110020
2010-08-02 04:56:14 +00:00
John McCall a95172baa0 Only run the jump-checker if there's a branch-protected scope *and* there's
a switch or goto somewhere in the function.  Indirect gotos trigger the
jump-checker regardless, because the conditions there are slightly more
elaborate and it's too marginal a case to be worth optimizing.

Turns off the jump-checker in a lot of cases in C++.  rdar://problem/7702918

llvm-svn: 109962
2010-08-01 00:26:45 +00:00
Ted Kremenek d21139a34f After a lengthy design discussion, add support for "ownership attributes" for malloc/free checking. Patch by Andrew McGregor!
llvm-svn: 109939
2010-07-31 01:52:11 +00:00
Tom Care fe1a4944b1 Test case for PR7763.
llvm-svn: 109895
2010-07-30 21:42:31 +00:00
Jordy Rose 23f0f4b7ae Move new test (that requires RegionStore) into its own file.
llvm-svn: 109736
2010-07-29 07:11:59 +00:00
Jordy Rose daa1c83413 Use a LazyCompoundVal to handle initialization with a string literal, rather than copying each character.
llvm-svn: 109734
2010-07-29 06:40:33 +00:00
Ted Kremenek 8bedb7dd3f Teach GRExprEngine::VisitLValue() about FloatingLiteral, ImaginaryLiteral, and CharacterLiteral. Fixes an assertion failure reported in PR 7675.
llvm-svn: 109719
2010-07-29 01:31:59 +00:00
Ted Kremenek 385f71b1f4 Augment RegionStore::BindStruct() to bind symbolicated struct values. This fixes a false path issue reported in <rdar://problem/8243408> and also spurs another cause where the idempotent operations checker fires.
llvm-svn: 109710
2010-07-29 00:28:47 +00:00
Tom Care 29a6250bf0 Added some false positive checking to UnreachableCodeChecker
- Allowed reporting of dead macros
- Added path walking function to search for false positives in conditional statements
- Updated some affected tests
- Added some false positive test cases

llvm-svn: 109561
2010-07-27 23:30:21 +00:00
Ted Kremenek 83b598c14f Finesse 'idempotent operations' analyzer issues to include the opcode of the binary operator for clearer error reporting. Also remove the 'Idempotent operation' prefix in messages; it's redundant since the bug type is the same.
llvm-svn: 109527
2010-07-27 18:49:08 +00:00
Jordy Rose 55442abee6 Don't warn about unreachable code if the block starts with __builtin_unreachable().
The next step is to warn if a block labeled unreachable is, in fact, reachable. Somewhat related to PR810.

llvm-svn: 109487
2010-07-27 03:39:53 +00:00
Jordy Rose b052e8f436 Groundwork for C string length tracking. Currently only handles the length of constant string literals, which is not too helpful, and only calls to strlen() are checked.
llvm-svn: 109480
2010-07-27 01:37:31 +00:00
Tom Care cba9f517ac Added an path-sensitive unreachable code checker to the experimental analyzer checks.
- Created a new class to do post-analysis
- Updated several test cases with unreachable code to expect a warning
- Added some general tests

llvm-svn: 109286
2010-07-23 23:04:53 +00:00
Zhongxing Xu 5e6ef6d957 Add FILE* leak check to StreamChecker. Patch by Lei Zhang.
llvm-svn: 109225
2010-07-23 14:14:59 +00:00
Zhongxing Xu f0c133fe88 This patch adds support for tmpfile in StreamChecker. Patch by Lei Zhang.
llvm-svn: 109106
2010-07-22 14:01:01 +00:00
Zhongxing Xu cf144c6322 fix test case.
llvm-svn: 108671
2010-07-19 02:06:14 +00:00
Zhongxing Xu ec5623570e Add double close check to StreamChecker. Patch by Lei Zhang.
llvm-svn: 108669
2010-07-19 01:52:29 +00:00
Ted Kremenek b32964d02d Fix '<rdar://problem/8202272> __imag passed non-complex should not crash' by removing a bogus assertion.
llvm-svn: 108602
2010-07-17 01:28:55 +00:00
Ted Kremenek 8b9fd890e3 Fix APFloat assertion failure in IdempotentOperationChecker resulting in having
an APFloat with different "float semantics" than the compared float literal.

llvm-svn: 108590
2010-07-17 00:40:32 +00:00
Tom Care 826e6b4023 Improved false positive rate for the idempotent operations checker and moved it into the default path-sensitive analysis options.
- Added checks for static local variables, self assigned parameters, and truncating/extending self assignments
- Removed command line option (now default with --analyze)
- Updated test cases to pass with idempotent operation warnings

llvm-svn: 108550
2010-07-16 20:41:41 +00:00
Chris Lattner 33919e7450 fix PR7280 by making the warning on code like this:
int test1() {
  return;
}

default to an error.

llvm-svn: 108108
2010-07-11 23:34:02 +00:00
Jordy Rose d5d2e50f3e Cleanup in CStringChecker. Now properly bifurcates the state for zero/nonzero sizes.
llvm-svn: 107935
2010-07-08 23:57:29 +00:00
Jordy Rose 65136fb669 Add memcmp() and bcmp() to CStringChecker. These check for valid access to the buffer arguments and have a special-case for when the buffer arguments are known to be the same address, or when the size is zero.
llvm-svn: 107761
2010-07-07 08:15:01 +00:00
Jordy Rose 33c829a6fd Cleanup on CStringChecker and its associated tests. Also check for null arguments...which are allowed if the access length is 0!
llvm-svn: 107759
2010-07-07 07:48:06 +00:00