Commit Graph

769 Commits

Author SHA1 Message Date
Jordy Rose 895c899142 Adds analyzer support for idempotent and tautological binary operations such as "a*0" and "a+0". This is not very powerful, but does make the analyzer look a little smarter than it actually is.
llvm-svn: 106402
2010-06-20 04:56:29 +00:00
Jordy Rose 2dd9b02cc8 Casting to void* or any other pointer-to-sizeless type (e.g. function pointers) causes a divide-by-zero error. Simple fix: check if the pointee type size is 0 and bail out early if it is.
llvm-svn: 106401
2010-06-20 04:30:57 +00:00
Jordy Rose c0fe8429f2 Fold additive constants, and support comparsions of the form $sym+const1 <> const2
llvm-svn: 106339
2010-06-18 22:49:11 +00:00
Zhongxing Xu e96a9132b8 Add null stream check for more APIs.
llvm-svn: 106274
2010-06-18 02:47:46 +00:00
Ted Kremenek 5df037e808 Tweak stack address checker to report multiple cases where globals may reference stack memory.
Also refactor the diagnostics so that we print out the kind of stack memory returned.

llvm-svn: 106210
2010-06-17 04:21:37 +00:00
Ted Kremenek 17504bea33 Rework StackAddrLeakChecker to find stores of stack memory addresses to global variables
by inspecting the Store bindings instead of iterating over all the global variables
in a translation unit.  By looking at the store directly, we avoid cases where we cannot
directly load from the global variable, such as an array (which can result in an assertion failure)
and it also catches cases where we store stack addresses to non-scalar globals.
Also, but not iterating over all the globals in the translation unit, we maintain cache
locality, and the complexity of the checker becomes restricted to the complexity of the
analyzed function, and doesn't scale with the size of the translation unit.

This fixes PR 7383.

llvm-svn: 106184
2010-06-17 00:24:44 +00:00
Zhongxing Xu 0fa7cddbab Add StreamChecker. This checker models and checks stream manipulation functions.
This is the start.

llvm-svn: 106082
2010-06-16 05:38:05 +00:00
Ted Kremenek 4c721bf892 Change AnalysisConsumer to analyze functions created by instantiantiating a macro. Fixes PR 7361.
llvm-svn: 105984
2010-06-15 00:55:40 +00:00
Zhongxing Xu 1225aacacf Merge StackAddrLeakChecker and ReturnStackAddressChecker.
llvm-svn: 105687
2010-06-09 06:08:24 +00:00
Zhongxing Xu 4200be5e76 Directly compare the StackFrameContext. This greatly simplifies logic and
improves generality. Thanks Ted.

llvm-svn: 105686
2010-06-09 05:50:38 +00:00
Zhongxing Xu 87e7fc5dc2 Add a checker check if a global variable holds a local variable's address after
the function call is left where the local variable is declared.

llvm-svn: 105602
2010-06-08 10:00:00 +00:00
Jordy Rose 3597b21f20 Catch free()s on non-regions and regions known to be not from malloc(), by checking the symbol type and memory space.
llvm-svn: 105547
2010-06-07 19:32:37 +00:00
Jordy Rose 2e22268904 Assignments to reference variables shouldn't kill the variable.
llvm-svn: 105452
2010-06-04 01:14:56 +00:00
Zhongxing Xu 41cdf585c2 CFG: add all LHS of assingments as lvalue. This improves support for C++ reference. Patch by Jordy.
llvm-svn: 105383
2010-06-03 06:23:18 +00:00
Zhongxing Xu 527ff6d1dc Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.

llvm-svn: 105264
2010-06-01 03:01:33 +00:00
Ted Kremenek 4708f5a89b After conversations with Zhongxing Xu and Jordy Rose, refine the logic in
RegionStoreManager::RetrieveElement() that handles indexing into a larger scalar
object to only consult the direct binding of a super region if it is a scalar.
This isn't perfect yet, and a big FIXME is attached to the code.  This causes
the test case for PR 7218 now to pass.

llvm-svn: 105195
2010-05-31 01:22:04 +00:00
Zhongxing Xu 94aec9381d Revert r105097. Thinking about a better fix.
llvm-svn: 105099
2010-05-29 06:49:04 +00:00
Zhongxing Xu 928a190a8e Fix PR7218. Patch by Jordy Rose.
llvm-svn: 105097
2010-05-29 06:23:24 +00:00
Ted Kremenek 15a0abd399 Discard qualifiers for ElementRegions so that a 'const' doesn't change the lookup semantics
in the symbol store.  We may wish to push this down into the StoreManager itself.

llvm-svn: 104788
2010-05-27 00:29:00 +00:00
Ted Kremenek 34ddec630c Predefine the '__clang_analyzer__' macro when using '-analyze'.
llvm-svn: 104742
2010-05-26 21:36:54 +00:00
Zhongxing Xu 658dd8b176 CastSizeChecker checks when casting a malloc'ed symbolic region to type T,
whether the size of the symbolic region is a multiple of the size of T.
Fixes PR6123 and PR7217.

llvm-svn: 104584
2010-05-25 04:59:19 +00:00
Ted Kremenek a2448b85be Update retain-release checker to understand changes to how 'super' is represented
in the ASTs.  Fixes <rdar://problem/8015556>.

llvm-svn: 104389
2010-05-21 21:57:00 +00:00
Ted Kremenek 304a9537e1 Fix crash in CFG construction for 'break' statements appearing in statement expressions
within the increment code of a for loop.

llvm-svn: 104375
2010-05-21 20:30:15 +00:00
Ted Kremenek ecc31c93c2 Don't add a null successor to a CFGBlock when the contents of an @synchronized statement is empty.
Fixes <rdar://problem/7979430>.

llvm-svn: 103717
2010-05-13 16:38:08 +00:00
Zhongxing Xu 1a56a488ed Turn -analyzer-inline-call on for C functions. This also fixed a bug that
after inlining post-call checking shouldn't be done.

llvm-svn: 103161
2010-05-06 03:38:27 +00:00
Zhongxing Xu 9174b2c2f9 Make -analyzer-inline-call not a separate analysis. Instead it's a boolean
flag now, and can be used with other analyses. Only turned it on for C++ 
methods for now.

llvm-svn: 103160
2010-05-06 02:59:29 +00:00
Zhongxing Xu 685a1d818d Refactor the AnalysisConsumer to analyze functions after the whole
translation unit is parsed. This enables us to inline some calls when still
analyzing one function at a time.

Actions are classified into Function, CXXMethod, ObjCMethod, 
ObjCImplementation.

This does not hurt performance much. The analysis time for sqlite3.c:

before:
real    17m52.440s
user    17m49.460s
sys    0m2.010s

after:
real    18m0.500s
user    17m56.900s
sys    0m2.330s

DisplayProgress option is broken now. -inine-call action is removed. It
will be reenabled in another form, perhaps as an indenpendant option.

llvm-svn: 102689
2010-04-30 04:14:20 +00:00
Ted Kremenek 989da5eeff Fix CFG crasher involving statement expressions reported in PR 6938.
llvm-svn: 102576
2010-04-29 01:10:26 +00:00
Zhongxing Xu f29231ece0 The second check point in the old test case was invalid.
llvm-svn: 101983
2010-04-21 02:22:25 +00:00
Zhongxing Xu 52c28fe61a Add test cases.
llvm-svn: 101878
2010-04-20 05:48:57 +00:00
Ted Kremenek ef55dd17ec Static analyzer: Don't crash when casting a symbolic region address to a float. Fixes PR 6854.
llvm-svn: 101499
2010-04-16 17:54:33 +00:00
Ted Kremenek 8db54ff1de Fix PR 6844, a regression caused by the introduction of llvm_unreachable for the default
case in GRExprEngine::Visit (in r101129).  Instead, enumerate all Stmt cases and have
no 'default' case in the switch statement.  When we encounter a Stmt we don't handle,
we should explicitly add it to the switch statement.

llvm-svn: 101378
2010-04-15 17:33:31 +00:00
Ted Kremenek 5868ec6e3d Fix CFG bug where bases of member expressions were not always evaluated in a lvalue context. Fixes <rdar://problem/7813989>.
llvm-svn: 100966
2010-04-11 17:02:10 +00:00
Douglas Gregor c68e140657 Improve diagnostics when we fail to convert from a source type to a
destination type for initialization, assignment, parameter-passing,
etc. The main issue fixed here is that we used rather confusing
wording for diagnostics such as

t.c:2:9: warning: initializing 'char const [2]' discards qualifiers,
      expected 'char *' [-pedantic]
  char *name = __func__;
        ^      ~~~~~~~~

We're not initializing a 'char const [2]', we're initializing a 'char
*' with an expression of type 'char const [2]'. Similar problems
existed for other diagnostics in this area, so I've normalized them all
with more precise descriptive text to say what we're
initializing/converting/assigning/etc. from and to. The warning for
the code above is now:

t.c:2:9: warning: initializing 'char *' from an expression of type
      'char const [2]' discards qualifiers [-pedantic]
  char *name = __func__;
        ^      ~~~~~~~~

Fixes <rdar://problem/7447179>.

llvm-svn: 100832
2010-04-09 00:35:39 +00:00
Ted Kremenek ea4a5abf61 Add static analyzer check for calls to 'pthread_once()' where the control-flow has
automatic storage.  This matches the corresponding check for 'dispatch_once()'.

llvm-svn: 100803
2010-04-08 19:53:31 +00:00
Chris Lattner 198cb4df6e Instead of counting totally diagnostics, split the count into a count
of errors and warnings.  This allows us to emit something like this:

2 warnings and 1 error generated.

instead of:

3 diagnostics generated.

This also stops counting 'notes' because they are just follow-on information
about the previous diag, not a diagnostic in themselves.

llvm-svn: 100675
2010-04-07 18:47:42 +00:00
Ted Kremenek 6e95bfc6a5 Fix crash in StoreManager::CastRegion() when the base region is a type with 0 size.
llvm-svn: 100594
2010-04-07 00:46:49 +00:00
Ted Kremenek f969841a1a Teach MemRegion::getBaseRegion() about ObjCIvarRegions. We want to treat
them the same way as fields.  This fixes a regression in RegionStore::RemoveDeadbindings()
that emerged from going to the cluster-based analysis.

llvm-svn: 100570
2010-04-06 22:06:03 +00:00
Zhongxing Xu faa4905e0c Always assume block-level expressions in the caller are alive when analyzing
the callee.

llvm-svn: 100429
2010-04-05 13:16:29 +00:00
Zhongxing Xu 640aad7667 Use the element type to compute the array size when the base region is a VarRegion.
Patch by Jordy Rose.

llvm-svn: 100099
2010-04-01 08:20:27 +00:00
Ted Kremenek c3e1f2f9ba Fix a bug (PR 6699) in RegionStore::RemoveDeadBindings() where
array values with a non-zero offset would get prematurely pruned from the store.

llvm-svn: 100067
2010-04-01 00:15:55 +00:00
Ted Kremenek 2d107f9d1d RegionStore: specially handle loads from integer global variables declared 'const'.
Fixes a false positive reported in PR 6288.

llvm-svn: 99922
2010-03-30 20:31:04 +00:00
Ted Kremenek 4be6a75884 Change the analyzer to recognize (but ignore) assignments to isa. Fixes PR 6302.
llvm-svn: 99904
2010-03-30 18:24:54 +00:00
Fariborz Jahanian 97752f7c95 Improve diagnostics on incomplete implementation
of objc classes; including which methods
need be implemented and where they come from.
WIP.

llvm-svn: 99724
2010-03-27 19:02:17 +00:00
Ted Kremenek 0f250e4c5b Fix NoReturnFunctionChecker to properly look at a function's type
when determining if it returns.  Fixes <rdar://problem/7796563>.

llvm-svn: 99663
2010-03-26 22:57:13 +00:00
Ted Kremenek bb6f5af4a4 Tweak null dereference diagnostics to give clearer diagnostics when
a null dereference results from a field access.

llvm-svn: 99236
2010-03-23 01:11:38 +00:00
Ted Kremenek 28ec56d7dd Improve the diagnostics for the UndefinedAssignmentChecker when an
uninitialized value is used in the LHS of a compound assignment.

llvm-svn: 99221
2010-03-22 22:16:26 +00:00
Ted Kremenek c517974e9e Add test case for <rdar://problem/7770737>.
llvm-svn: 98979
2010-03-19 19:45:03 +00:00
Ted Kremenek c342c9c001 Refactor argument checking in CallAndMessageChecker to be the same
for both CallExprs and ObjCMessageExprs.

llvm-svn: 98800
2010-03-18 03:22:29 +00:00
Ted Kremenek 9c05f4ef69 Detect pass-by-value arguments that are structs that contain
uninitialized data.

llvm-svn: 98796
2010-03-18 02:17:27 +00:00