Commit Graph

1581 Commits

Author SHA1 Message Date
Anna Zaks f0267f5c9e Turn on strncat-size warning implemented a while ago.
Warns on anti-patterns/typos in the 'size' argument to strncat. The
correct size argument should look like the following:
 - strncat(dst, src, sizeof(dst) - strlen(dest) - 1);

We warn on: 
 - sizeof(dst)
 - sizeof(src)
 - sizeof(dst) - strlen(dst)
 - sizeof(src) - anything

(This has been implemented in void Sema::CheckStrncatArguments().)

llvm-svn: 161440
2012-08-07 18:36:58 +00:00
Anna Zaks b8146afcd1 [analyzer] + New line at end of file
llvm-svn: 161392
2012-08-07 05:12:29 +00:00
Anna Zaks 75930b65b4 [analyzer] Address Jordan's review of DynamicTypePropagation.
llvm-svn: 161391
2012-08-07 05:12:24 +00:00
Jordan Rose c11a33a2bd [analyzer] Add a test case for OS X 10.8's NSMakeCollectable under non-GC.
This is an additional test for r161349 (ignoring 10.8's annotations for
NSMakeCollectable).

llvm-svn: 161380
2012-08-07 01:11:14 +00:00
Anna Zaks 0a5e1b840a [analyzer] DynTypes: Add a test for improper cast performed by user.
Dynamic type inference does the right thing in this case. However, as
Jordan suggested, it would be nice to add a warning here as well.

llvm-svn: 161365
2012-08-06 23:58:16 +00:00
Anna Zaks 05253782a4 [analyzer] Dynamic type info - propagate through implicit casts.
I currently have a bit of redundancy with the cast kind switch statement
inside the ImplicitCast callback, but I might be adding more casts going
forward.

llvm-svn: 161358
2012-08-06 23:25:45 +00:00
Anna Zaks 472dbcf156 [analyzer] Add a checker to manage dynamic type propagation.
Instead of sprinkling dynamic type info propagation throughout
ExprEngine, the added checker would add the more precise type
information on known APIs (Ex: ObjC alloc, new) and propagate
the type info in other cases (ex: ObjC init method, casts (the second is
not implemented yet)).

Add handling of ObjC alloc, new and init to the checker.

llvm-svn: 161357
2012-08-06 23:25:39 +00:00
Jordan Rose a3e3343e51 [analyzer] Add plist output checks for all four "path notes" tests.
No functionality change, but from now on, any new path notes should be
tested both with plain-text output (for ease of human auditing) and with
plist output (to ensure control flow and events are being correctly
represented in Xcode).

llvm-svn: 161351
2012-08-06 21:28:14 +00:00
Jordan Rose e32e153f7d [analyzer] Improve arrow locations for PseudoObjectExprs.
llvm-svn: 161350
2012-08-06 21:28:11 +00:00
Anna Zaks 6ce686e6a4 [analyzer] Malloc: remove assert since is not valid as of r161248
We can be in the situation where we did not track the symbol before
realloc was called on it.

llvm-svn: 161294
2012-08-04 02:04:27 +00:00
Jordan Rose a01741fce4 [analyzer] Use a more robust check for null in CallAndMessageChecker.
This should fix the failing test on the buildbot as well.

llvm-svn: 161290
2012-08-04 01:04:52 +00:00
Jordan Rose 4aa80e156d [analyzer] Don't assume values bound to references are automatically non-null.
While there is no such thing as a "null reference" in the C++ standard,
many implementations of references (including Clang's) do not actually
check that the location bound to them is non-null. Thus unlike a regular
null dereference, this will not cause a problem at runtime until the
reference is actually used. In order to catch these cases, we need to not
prune out paths on which the input pointer is null.

llvm-svn: 161288
2012-08-04 00:25:30 +00:00
Jordan Rose 17a8757a46 [analyzer] Update initializer assertion for delegating constructors.
Like base constructors, delegating constructors require no further
processing in the CFGInitializer node.

Also, add PrettyStackTraceLoc to the initializer and destructor logic
so we can get better stack traces in the future.

llvm-svn: 161283
2012-08-03 23:31:15 +00:00
Jordan Rose cfb4eb293f [analyzer] When a symbol is null, we should track its constraints.
Because of this, we would previously emit NO path notes when a parameter
is constrained to null (because there are no stores). Now we show where we
made the assumption, which is much more useful.

llvm-svn: 161280
2012-08-03 23:09:01 +00:00
Jordan Rose 3eb3cd45b8 [analyzer] Flatten path diagnostics for text output like we do for HTML.
llvm-svn: 161279
2012-08-03 23:08:54 +00:00
Jordan Rose 92e1449b55 [analyzer] Track null/uninitialized C++ objects used in method calls.
llvm-svn: 161278
2012-08-03 23:08:49 +00:00
Jordan Rose 16fe35eb2b Enhance getImplicitObjectArgument to look through ->*.
This only applies in the case where ->* is not overloaded, since it
specifically looks for BinaryOperator and not CXXOperatorCallExpr.

llvm-svn: 161275
2012-08-03 23:08:39 +00:00
Jordan Rose 86bedb0de0 [analyzer] Add a test for copy-constructor inlining.
llvm-svn: 161274
2012-08-03 23:08:36 +00:00
Anna Zaks 150843b87e [analyzer] ObjC Inlining: Start tracking dynamic type info in the GDM
In the following code, find the type of the symbolic receiver by
following it and updating the dynamic type info in the state when we
cast the symbol from id to MyClass *.

  MyClass *a = [[self alloc] init];
  return 5/[a testSelf];

llvm-svn: 161264
2012-08-03 21:43:37 +00:00
Anna Zaks 52242a6677 [analyzer] Malloc: track non-allocated but freed memory
There is no reason why we should not track the memory which was not
allocated in the current function, but was freed there. This would
allow to catch more use-after-free and double free with no/limited IPA.

Also fix a realloc issue which surfaced as the result of this patch.

llvm-svn: 161248
2012-08-03 18:30:18 +00:00
Benjamin Kramer 7555b54020 Reduce temp file pollution in some test cases.
llvm-svn: 161237
2012-08-03 10:35:06 +00:00
Anna Zaks 4c03dfd4b1 [analyzer] Solve another source of non-determinism in the diagnostic
engine.

The code that was supposed to split the tie in a deterministic way is
not deterministic. Most likely one of the profile methods uses a
pointer. After this change we do finally get the consistent diagnostic
output. Testing this requires running the analyzer on large code bases
and diffing the results.

llvm-svn: 161224
2012-08-02 23:41:05 +00:00
Jordan Rose 9a2eec3826 [analyzer] Add a simple check for initializing reference variables with null.
There's still more work to be done here; this doesn't catch reference
parameters or return values. But it's a step in the right direction.

Part of <rdar://problem/11212286>.

llvm-svn: 161214
2012-08-02 21:33:42 +00:00
Jordan Rose a765bac7a1 [analyzer] Turn -cfg-add-initializers on by default, and remove the flag.
llvm-svn: 161060
2012-07-31 18:04:59 +00:00
Jordan Rose 6a97d92ef5 [analyzer] Don't try to inline if there's no region for a message receiver.
While usually we'd use a symbolic region rather than a straight-up Unknown,
we can still generate unknowns via array subscripts with symbolic indexes.
(And if this ever changes in the future, we still shouldn't crash.)

llvm-svn: 161059
2012-07-31 18:04:53 +00:00
Jordan Rose e8a21b73ac [analyzer] Getting an lvalue for a reference field still requires a load.
This was causing a crash in our array-to-pointer logic, since the region
was clearly not an array.

PR13440 / <rdar://problem/11977113>

llvm-svn: 161051
2012-07-31 16:34:07 +00:00
Jordan Rose 3865c6e670 [analyzer] Add a test that messages to super invalidate ivars.
llvm-svn: 161021
2012-07-31 02:05:30 +00:00
Anna Zaks 5808eb8029 [analyzer] Handle inlining of instance calls to super.
Use self-init.m for testing. (It used to have a bunch of failing tests
with dynamic inlining turned on.)

llvm-svn: 161012
2012-07-30 23:48:36 +00:00
Anna Zaks 160dcdf2d6 [analyzer] Only run this test with no IPA
The inlinable portion of the test relies on attributes/instead of the
function implementation.

llvm-svn: 161011
2012-07-30 23:48:31 +00:00
Anna Zaks 63282aefb9 [analyzer] Very simple ObjC instance method inlining
- Retrieves the type of the object/receiver from the state.
- Binds self during stack setup.
- Only explores the path on which the method is inlined (no
bifurcation to explore the path on which the method is not inlined).

llvm-svn: 160991
2012-07-30 20:31:29 +00:00
Anna Zaks e49190984c [analyzer] Add -analyzer-ipa=dynamic option for inlining dynamically
dispatched methods.

Disabled by default for now.

llvm-svn: 160988
2012-07-30 20:31:18 +00:00
Anna Zaks 8e3b260313 [analyzer] Another false positive in Class method inlining.
We are currently not setting the self object to the calling class object
during inlining nor do we reason about [AAA class].

llvm-svn: 160884
2012-07-27 19:07:34 +00:00
Anna Zaks 15b13a9f0c [analyzer] Address Jordan's and Fariborz's review of r160768.
llvm-svn: 160883
2012-07-27 19:07:32 +00:00
Jordan Rose 41c98d9dc3 [analyzer] Look through SubstNonTypeTemplateParmExprs.
We were treating this like a CXXDefaultArgExpr, but
SubstNonTypeTemplateParmExpr actually appears when a template is
instantiated, i.e. we have all the information necessary to evaluate it.
This allows us to inline functions like llvm::array_lengthof.

<rdar://problem/11949235>

llvm-svn: 160846
2012-07-27 01:15:02 +00:00
Ted Kremenek ecc928c89b Tweak test case to not emit warning.
llvm-svn: 160822
2012-07-26 22:32:35 +00:00
Ted Kremenek 313c2ff375 Look at the preceding CFGBlock for the expression to load from in ExprEngine::VisitGuardedExpr
instead of walking to the preceding PostStmt node.  There are cases where the last evaluated
expression does not appear in the ExplodedGraph.

Fixes PR 13466.

llvm-svn: 160819
2012-07-26 22:23:41 +00:00
Jordan Rose 25bc20f846 [analyzer] Don't crash on implicit statements inside initializers.
Our BugReporter knows how to deal with implicit statements: it looks in
the ParentMap until it finds a parent with a valid location. However, since
initializers are not in the body of a constructor, their sub-expressions are
not in the ParentMap. That was easy enough to fix in AnalysisDeclContext.

...and then even once THAT was fixed, there's still an extra funny case
of Objective-C object pointer fields under ARC, which are initialized with
a top-level ImplicitValueInitExpr. To catch these cases,
PathDiagnosticLocation will now fall back to the start of the current
function if it can't find any other valid SourceLocations. This isn't great,
but it's miles better than a crash.

(All of this is only relevant when constructors and destructors are being
inlined, i.e. under -cfg-add-initializers and -cfg-add-implicit-dtors.)

llvm-svn: 160810
2012-07-26 20:04:30 +00:00
Jordan Rose 20edae8749 [analyzer] Don't crash on array constructors and destructors.
This workaround is fairly lame: we simulate the first element's constructor
and destructor and rely on the region invalidation to "initialize" the rest
of the elements.

llvm-svn: 160809
2012-07-26 20:04:25 +00:00
Jordan Rose 54529a347e [analyzer] Handle C++ member initializers and destructors.
This uses CFG to tell if a constructor call is for a member, and uses
the member's region appropriately.

llvm-svn: 160808
2012-07-26 20:04:21 +00:00
Jordan Rose a4c0d21f42 [analyzer] Show paths for destructor calls.
This modifies BugReporter and friends to handle CallEnter and CallExitEnd
program points that came from implicit call CFG nodes (read: destructors).

This required some extra handling for nested implicit calls. For example,
the added multiple-inheritance test case has a call graph that looks like this:

testMultipleInheritance3
  ~MultipleInheritance
    ~SmartPointer
    ~Subclass
      ~SmartPointer
        ***bug here***

In this case we correctly notice that we started in an inlined function
when we reach the CallEnter program point for the second ~SmartPointer.
However, when we reach the next CallEnter (for ~Subclass), we were
accidentally re-using the inner ~SmartPointer call in the diagnostics.

Rather than guess if we saw the corresponding CallExitEnd based on the
contents of the active path, we now just ask the PathDiagnostic if there's
any known stack before popping off the top path.

(A similar issue could have occured without multiple inheritance, but there
wasn't a test case for it.)

llvm-svn: 160804
2012-07-26 20:04:05 +00:00
Jordan Rose c5d852447b [analyzer] Inline ctors + dtors when the CFG is built for them.
At the very least this means initializer nodes for constructors and
automatic object destructors are present in the CFG.

llvm-svn: 160803
2012-07-26 20:04:00 +00:00
Anna Zaks 83f1495fcb [analyzer] Inline ObjC class methods.
- Some cleanup(the TODOs) will be done after ObjC method inlining is
complete.
- Simplified CallEvent::getDefinition not to require ISDynamicDispatch
parameter.
- Also addressed Jordan's comments from r160530.

llvm-svn: 160768
2012-07-26 00:27:51 +00:00
Ted Kremenek faef9cb694 Add static analyzer check for calling a C++ instance method with a null/uninitialized pointer.
llvm-svn: 160767
2012-07-26 00:22:32 +00:00
Ted Kremenek bb81ffb342 Update ExprEngine's handling of ternary operators to find the ternary expression
value by scanning the path, rather than assuming we have visited the '?:' operator
as a terminator (which sets a value indicating which expression to grab the
final ternary expression value from).

llvm-svn: 160760
2012-07-25 21:58:25 +00:00
Ted Kremenek b1fcddfc6a Remove experimental invalid iterators checker from the codebase until we have the time
to fix all the issues.  Currently the code is essentially unmaintained and buggy, and
needs major revision (with coupled enhancements to the analyzer core).

llvm-svn: 160754
2012-07-25 20:02:05 +00:00
NAKAMURA Takumi e1efe31948 test/Analysis/iterators.cpp: Mark as REQUIRES:asserts. It crashes due to assertion failure.
I saw the case it XPASSes.

llvm-svn: 160715
2012-07-25 09:47:24 +00:00
Ted Kremenek 875a402dc3 Turn -Wobjc-root-class on by default. <rdar://problem/11203649>.
llvm-svn: 160707
2012-07-25 07:26:32 +00:00
Jordan Rose 627b046c88 [analyzer] Combine all ObjC message CallEvents into ObjCMethodCall.
As pointed out by Anna, we only differentiate between explicit message sends

This also adds support for ObjCSubscriptExprs, which are basically the same
as properties in many ways. We were already checking these, but not emitting
nice messages for them.

This depends on the llvm::PointerIntPair change in r160456.

llvm-svn: 160461
2012-07-18 21:59:51 +00:00
Ted Kremenek 46dcfc9431 Fix crash in RegionStoreManager::evalDerivedToBase() due to not handling references
(in uses of dynamic_cast<>).

Fixes <rdar://problem/11817693>.

llvm-svn: 160427
2012-07-18 05:57:33 +00:00
Ted Kremenek 3d6177306b Teach CFG construction about destructors resulting from references to array types. Fixes crash in <rdar://problem/11671507>.
llvm-svn: 160424
2012-07-18 04:57:57 +00:00