Commit Graph

1720 Commits

Author SHA1 Message Date
Ted Kremenek ed2246aa2a Teach 'ExecutionContinues' (part of BugReporter's diagnostic generation) about BlockDecls.
llvm-svn: 90584
2009-12-04 20:34:31 +00:00
Ted Kremenek 75d6fa27bd Include BlockDeclRefExprs in constructed CFGs.
llvm-svn: 90583
2009-12-04 20:33:25 +00:00
Ted Kremenek c32f2c2e0f Replace SymbolReaper::isLive(VarDecl) with SymbolReaper::isLive(VarRegion).
llvm-svn: 90582
2009-12-04 20:32:20 +00:00
Ted Kremenek 6e8541ddd0 Rename instance variable to avoid name conflict with parameters, and modify addTransition() to compare the correct state values.
llvm-svn: 90552
2009-12-04 06:57:49 +00:00
Ted Kremenek c7916f9ff2 Allow BlockInvocationContext to wrap either a BlockDecl* or a BlockDataRegion*, giving us choice in our degree of context-sensitivity.
llvm-svn: 90516
2009-12-04 02:03:51 +00:00
Ted Kremenek 43d4a899c4 Refactor LocationContext creation logic into a single member template.
llvm-svn: 90509
2009-12-04 01:28:56 +00:00
Ted Kremenek 253882431e Refactor FoldingSet profiling code for LocationContexts, and add a new BlockInvocationContext to represent the invocation of a block.
llvm-svn: 90506
2009-12-04 00:50:10 +00:00
Ted Kremenek 721fcc007e constify MemRegion* returned by MemRegionManager::getXXXRegion() methods.
llvm-svn: 90503
2009-12-04 00:26:31 +00:00
Ted Kremenek 0ecd4c7d70 More template-logic for MemRegion construction out of MemRegion.h and into MemRegion.cpp.
llvm-svn: 90499
2009-12-04 00:05:57 +00:00
Ted Kremenek 4b349cc9c5 Tweak handling of BlockDataRegions in RegionStoreManager::RemoveDeadBindings(): only the VarRegions for variables marked with the '__block' annotation should have their lifetime extended by a BlockDataRegion.
llvm-svn: 90462
2009-12-03 17:48:05 +00:00
Zhongxing Xu 39bba629f3 Add security syntactic checker for mktemp.
Patch by Lei Zhang!

llvm-svn: 90444
2009-12-03 09:15:23 +00:00
Daniel Dunbar 98f2067ca4 Update CMake for CallGraph.cpp move.
llvm-svn: 90443
2009-12-03 09:14:19 +00:00
Ted Kremenek 5bee5c4ff0 Add value invalidation logic for block-captured variables. Conceptually invoking a block (without specific reasoning of what the block does) can invalidate any value to it by reference when the block was created.
llvm-svn: 90431
2009-12-03 08:25:47 +00:00
Ted Kremenek 4a815fc82e Make BlockDataRegion::referenced_vars_iterator an actual class that enforces that all MemRegions iterated over are VarRegions.
llvm-svn: 90430
2009-12-03 08:09:21 +00:00
Daniel Dunbar 19a30ca8c0 Fix layering violation by moving Analysis/CallGraph to Index
llvm-svn: 90424
2009-12-03 07:20:04 +00:00
Ted Kremenek e5716cbae7 Add batch version of 'StoreManager::InvalidateRegion()' for invalidating multiple regions as once. After adopting this in the CFRefCount::EvalCall(), we see a reduction in analysis time of 1.5% when analyzing all of SQLite3.
llvm-svn: 90405
2009-12-03 03:27:11 +00:00
Ted Kremenek f66b72094a Add a heuristic to the dead stores checker to prune dead stores for variables annotated with '__block'. This is overly conservative, but now the analyzer doesn't report dead stores for variables that can be updated by a block call.
llvm-svn: 90364
2009-12-03 00:46:16 +00:00
Zhongxing Xu af35329f71 Hard bifurcate the state into nil receiver and non-nil receiver, so that
we don't need to use the DoneEvaluation hack when check for 
ObjCMessageExpr.

PreVisitObjCMessageExpr() only checks for undefined receiver or arguments.

Add checker interface EvalNilReceiver(). This is a 'once-and-done' interface.

llvm-svn: 90296
2009-12-02 05:49:12 +00:00
Ted Kremenek 117e472b52 Provide the correct vector size for referenced variables.
llvm-svn: 90267
2009-12-01 22:12:34 +00:00
Ted Kremenek d3a241a9c6 Fix early-return logic in scanReachableSymbols() to match the rest of the recursive logic in the methods of ScanReachableSymbols.
llvm-svn: 90245
2009-12-01 17:50:25 +00:00
Douglas Gregor 693ba203a1 Eliminate another VISIBILITY_HIDDEN
llvm-svn: 90139
2009-11-30 16:08:24 +00:00
Tobias Grosser 9fc223a6b1 Adapt to the DOTGraphTraits changes in LLVM.
llvm-svn: 90137
2009-11-30 14:16:05 +00:00
Benjamin Kramer 6341553c93 Port BugReporter and BugType to StringRef.
llvm-svn: 90086
2009-11-29 18:27:55 +00:00
Benjamin Kramer ff3750f306 Kill some unnecessary calls to c_str().
llvm-svn: 90084
2009-11-29 18:03:28 +00:00
Ted Kremenek 33e88a7be7 Fix null dereference in UndefResultChecker identified by running the analyzer over Postgresql.
llvm-svn: 90060
2009-11-29 06:37:44 +00:00
Benjamin Kramer 4e75cd063f Cleanup includes and forward decls.
llvm-svn: 90034
2009-11-28 10:50:44 +00:00
Benjamin Kramer 435ef9b383 Remove unneeded includes.
llvm-svn: 90032
2009-11-28 09:41:31 +00:00
Kovarththanan Rajaratnam 65c6566b5b lib/Analysis: Remove VISIBILITY_HIDDEN from definitions in anonymous namespace
llvm-svn: 90028
2009-11-28 06:07:30 +00:00
Ted Kremenek 2350e0c3ba Improve diagnostics in ReturnStackAddressChecker for returning a stack-allocated block. Implements the rest of <rdar://problem/7387385>.
llvm-svn: 89940
2009-11-26 07:14:50 +00:00
Ted Kremenek f89dcdaf19 Add a PostVisitBlockExpr() method to RetainReleaseChecker to query for
the set of variables "captured" by a block.  Until the analysis gets
more sophisticated, for now we stop the retain count tracking of any
objects (transitively) referenced by these variables.

llvm-svn: 89929
2009-11-26 02:38:19 +00:00
Ted Kremenek 94f8c4a7d5 Teach RegionStoreManager::RemoveDeadBindings() about BlockDataRegions. Any VarRegion for a "captured" variable should also be considered live.
llvm-svn: 89928
2009-11-26 02:35:42 +00:00
Ted Kremenek 3378b610ae Add iterators to BlockDataRegion that allow clients to iterate over the VarRegions for "captured" variables for a block.
llvm-svn: 89927
2009-11-26 02:34:36 +00:00
Ted Kremenek 705fd953ef Added batch versions of GRState::scanReachableSymbols() so that clients can scan a collection of SVals or MemRegions all at once.
llvm-svn: 89926
2009-11-26 02:32:19 +00:00
Ted Kremenek 0f5e6f8805 Enhance LiveVariables to understand that blocks can extend the liveness of a variable by "capturing" them in a BlockExpr.
This required two changes:

1) Added 'getReferencedgetReferencedBlockVars()' to AnalysisContext so
that clients can iterate over the "captured" variables in a block.

2) Modified LiveVariables to take an AnalysisContext& in its
constructor and to call getReferencedgetReferencedBlockVars() when it
processes a BlockExpr*.

llvm-svn: 89924
2009-11-26 02:31:33 +00:00
Ted Kremenek 1646cf6d05 Add missing case in switch statement.
llvm-svn: 89903
2009-11-25 23:58:21 +00:00
Ted Kremenek b63ad7a6c1 Refine MemRegions for blocks. Add a new region called
'BlockDataRegion' to distinguish between the code associated with a
block (which is represented by 'BlockTextRegion') and an instance of a
block, which includes both code and data.  'BlockDataRegion' has an
associated LocationContext, which can be used to eventually model the
lifetime of a block object once LocationContexts can represent scopes
(and iterations around a loop, etc.).

llvm-svn: 89900
2009-11-25 23:53:07 +00:00
Ted Kremenek 80f70b54aa Remove recently added FIXME. The appropriate FIXME is already in MemRegionManager::getVarRegion().
llvm-svn: 89897
2009-11-25 23:30:34 +00:00
Ted Kremenek a3d6e62003 Add FIXME.
llvm-svn: 89892
2009-11-25 22:41:34 +00:00
Ted Kremenek e6929ffc21 Add post-visit Checker support in GRExprEngine for BlockExpr.
llvm-svn: 89890
2009-11-25 22:23:25 +00:00
Ted Kremenek 70a8788368 Add a new RetainReleaseChecker class (that subclasses CheckerVisitor) to extend the functionality of the retain/release checker using the new Checker interface. Pieces of CFRefCount will gradually be migrated to this new class over time.
llvm-svn: 89889
2009-11-25 22:17:44 +00:00
Ted Kremenek 945422794b Move RegisterChecks() to the end of the file. No functionality change.
llvm-svn: 89888
2009-11-25 22:08:49 +00:00
Ted Kremenek d0fe8047dd Make RegisterInternalChecks() part of GRExprEngine's private implementation by making it a static function within GRExprEngine.cpp.
llvm-svn: 89884
2009-11-25 21:51:20 +00:00
Ted Kremenek efb5003f95 Register internal checks with GRExprEngine when it is constructed, not manually in AnalysisConsumer.cpp.
llvm-svn: 89883
2009-11-25 21:45:48 +00:00
Ted Kremenek acdc817ed9 When dispatching to Checker objects in GRExprEngine::CheckerVisit(),
only stop processing the checkers after all the nodes for a current
check have been processed.  This (I believe) handles the case where
PredSet (the input nodes) contains more than one node due to state
bifurcation.  Zhongxing: can you review this?

llvm-svn: 89882
2009-11-25 21:40:22 +00:00
Ted Kremenek e6a2780c96 Add really basic support for blocks in the retain/release checker. For now, anytime we pass a tracked object to a block call we stop tracking it.
llvm-svn: 89831
2009-11-25 01:35:18 +00:00
Ted Kremenek 470bfa47db Allow building of CFGs for ASTs that contain BlockExprs.
llvm-svn: 89830
2009-11-25 01:34:30 +00:00
Ted Kremenek cfe223f637 Add transfer function support for BlockExpr.
llvm-svn: 89829
2009-11-25 01:33:13 +00:00
Ted Kremenek 10a50e7371 Split CodeTextRegion into FunctionTextRegion and BlockTextRegion. This a precursor to having basic static analysis support for blocks.
llvm-svn: 89828
2009-11-25 01:32:22 +00:00
Ted Kremenek 1fc1f20efd For the nil-receiver checker, take into account the behavioral changes that got introduced in Mac OS X 10.5 and later, notably return values of double, float, etc., will not be garbage. Fixes <rdar://problem/6829160>.
llvm-svn: 89809
2009-11-24 22:48:18 +00:00
Ted Kremenek 005e8a06f2 Cleanups and fixes to the nil-receiver checker, some of it fallout the
initial transition of the nil-receiver checker to the Checker
interface as done in r89745.  Some important changes include:

1) We consolidate the BugType object used for nil receiver bug
reports, and don't include the type of the returned value in the
BugType (which would be wrong if a nil receiver bug was reported more
than once)

2) Added a new (temporary) flag to CheckerContext: DoneEvauating.
This is used by GRExprEngine when evaluating message expressions to
not continue evaluating the message expression if this flag is set.
This flag is currently set by the nil receiver checker.  This is an
intermediate solution to allow the nil-receiver checker to properly
work as a plug-in outside of GRExprEngine.  Basically, this flag
indicates that the entire message expression has been evaluated, not
just a precondition (which is what the nil-receiver checker does).
This flag *should not* be repurposed for general use, but just to pull
more things out of GRExprEngine that already in there as we devise a
better interface in the Checker class.

3) Cleaned up the logic in the nil-receiver checker, making the
control-flow a lot easier to read.

llvm-svn: 89804
2009-11-24 21:41:28 +00:00