Commit Graph

388 Commits

Author SHA1 Message Date
Ted Kremenek
bb7818b666 Enhance dead store checker to not flag preincrements to dead variables where the preincrement is a subexpression, e.g. foo(++x); This can cause false negatives, but will remove a whole class of false positives.
llvm-svn: 57554
2008-10-15 05:23:41 +00:00
Zhongxing Xu
cc06b463f5 Check some cases for previous patch. Make the code more robust.
llvm-svn: 57317
2008-10-09 03:19:06 +00:00
Zhongxing Xu
d9959aee34 This is the first step to implement a field-sensitive store model. Other things are simplified: no heap shape assumption, no parameter alias assumption, etc.
llvm-svn: 57285
2008-10-08 02:50:44 +00:00
Zhongxing Xu
de7509f01a Added a function call case that generates sink nodes.
llvm-svn: 57240
2008-10-07 10:06:03 +00:00
Zhongxing Xu
f5e7c90c46 Migrate MemRegionManager from StateManager to StoreManager.
llvm-svn: 57225
2008-10-07 01:31:04 +00:00
Ted Kremenek
4db44b62ad Don't use DeclStmt::getDecl(); this will eventually disappear. Just fetch the first decl using the DeclStmt::decl_iterator.
llvm-svn: 57194
2008-10-06 18:43:53 +00:00
Ted Kremenek
fae8cb0736 Use DeclStmt::decl_iterator instead of using Decl::getDecl(). Soon DeclStmts will wrap group of Decls.
Added FIXME.

llvm-svn: 57189
2008-10-06 18:37:46 +00:00
Zhongxing Xu
a4bbcd302e Fix typos.
llvm-svn: 57146
2008-10-06 03:03:33 +00:00
Zhongxing Xu
8c9771bdf0 Remove redundant parameter and rename StMgr to StateMgr.
llvm-svn: 57107
2008-10-05 12:12:48 +00:00
Ted Kremenek
5ca90a244f This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.
This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042
2008-10-04 05:50:14 +00:00
Ted Kremenek
3aa89a971d Enhance NSError** checking with analogous checking for CFErrorRef*.
Expand checking to include functions, not just methods.

llvm-svn: 56938
2008-10-01 23:24:09 +00:00
Ted Kremenek
8dcd40768e Use LVal::IsLValType(T) instead of checking to see if the type is an "lvalue" type directly.
llvm-svn: 56912
2008-10-01 05:02:13 +00:00
Ted Kremenek
d331d09e2f Add a QualType to ConjuredSymbol to represent the type and size of the symbol.
Use this updated interface when invalidating arguments passed by reference; the type of symbol is of the object passed by reference, not the reference itself.

llvm-svn: 56894
2008-10-01 00:21:14 +00:00
Ted Kremenek
f1b299952a Revert last patch, but add a fixme
llvm-svn: 56832
2008-09-30 05:35:42 +00:00
Ted Kremenek
76bccf6221 Within the transfer function of UnaryOperatorExpr, handle implicit promotions
from the subexpression type to the expression type.

llvm-svn: 56831
2008-09-30 05:32:44 +00:00
Ted Kremenek
21c24f1785 Revert 56735. The old bug categories were more informative.
llvm-svn: 56755
2008-09-27 22:02:42 +00:00
Ted Kremenek
16a59fabec Change "leaks" to have the category "Performance".
llvm-svn: 56735
2008-09-27 00:45:27 +00:00
Ted Kremenek
61a625ff70 Move VLA processing logic from LiveVariables to CFG construction. This way all dataflow analyses "see" the VLA size expressions.
llvm-svn: 56655
2008-09-26 16:26:36 +00:00
Ted Kremenek
2ece64bbc4 Examine VLA size expressions when computing liveness information.
Fixes <rdar://problem/6248086>

llvm-svn: 56645
2008-09-26 05:52:45 +00:00
Ted Kremenek
76f79ba890 Change casing of bug type.
llvm-svn: 56405
2008-09-21 19:08:31 +00:00
Ted Kremenek
638e280c32 The checks in BasicObjCFoundationChecks now have a category: "API Misuse (Apple)"
llvm-svn: 56403
2008-09-21 19:01:39 +00:00
Ted Kremenek
ba9781dcfc The "unused ivar" check now has a category: "Optimization"
llvm-svn: 56402
2008-09-21 18:58:22 +00:00
Ted Kremenek
1b6997ed5e Built-in checks now have a category: "Logic Errors"
llvm-svn: 56401
2008-09-21 18:57:28 +00:00
Ted Kremenek
33663885c3 Add a bug category for NSError** checks.
llvm-svn: 56394
2008-09-21 06:57:40 +00:00
Ted Kremenek
de195e2100 Add "category" to BugTypes, allowing bugs to be grouped.
Changed casing of many bug names.  The convention will be to have bug names (mostly) lower cased, and categories use some capitalization.

llvm-svn: 56385
2008-09-20 04:23:38 +00:00
Ted Kremenek
bc15d8539d Add PostStore, a new ProgramPoint to distinguish between 'stores' and other PostStmts.
GRExprEngine:
  Use PostStore in EvalStore.
  Use a second version of EvalStore in EvalBinaryOperator to associate the store with the expression on the LHS.

llvm-svn: 56383
2008-09-20 01:50:34 +00:00
Ted Kremenek
31a15f8ba2 Bug fix: for the base transfer function logic for casts, handle const casts as just propagating the value.
llvm-svn: 56368
2008-09-19 20:51:22 +00:00
Ted Kremenek
34bfd8a490 Fixed logic error in BasicConstraintManager pointed out by Zhongxing Xu.
For checking if a symbol >= value, we need to check if symbol == value || symbol
> value. When checking symbol > value and we know that symbol != value, the path
is infeasible only if value == maximum integer.

For checking if a symbol <= value, we need to check if symbol == value || symbol
< value. When checking symbol < value and we know that symbol != value, the path
is infeasible only if value == minimum integer.

Updated test case exercising this logic: we only prune paths if the values are
unsigned.

llvm-svn: 56354
2008-09-19 18:00:36 +00:00
Ted Kremenek
a5bf9cb4be When we have a binary expression 'int operator symbol', properly rewrite this as
'symbol operator-reverse int'. This patch is a combination of code from
Zhongxing Xu and myself (Zhongxing noticed this bug for the cases of
relational operators).

llvm-svn: 56351
2008-09-19 17:31:13 +00:00
Zhongxing Xu
a8e88ecda6 Add an omitted case for AssumeSymInt.
llvm-svn: 56334
2008-09-19 06:07:59 +00:00
Ted Kremenek
a417c0e80a Add panic function "__assert_fail".
llvm-svn: 56327
2008-09-19 02:30:47 +00:00
Ted Kremenek
6a1a334b6c Register the implicit null-dereferenced object as a notable symbol.
llvm-svn: 56319
2008-09-18 23:23:19 +00:00
Ted Kremenek
b42f482c91 Implement second part of PR 2600: NSError** parameter may be null, and should be checked before being dereferenced.
llvm-svn: 56318
2008-09-18 23:09:54 +00:00
Ted Kremenek
f0673e4eb6 Change implementation of NSError** coding-style check to be invoked at the end of the retain/release analysis.
llvm-svn: 56312
2008-09-18 21:25:13 +00:00
Ted Kremenek
fc3abeb1e5 Implemented one of the checks requested in PR 2600:
"Method accepting NSError** argument should have non-void return value to indicate that an error occurred."

Test case written, but the header needs to be delta-debugged reduced.  Will commit shortly.

llvm-svn: 56297
2008-09-18 06:33:41 +00:00
Ted Kremenek
8782716c4a Minor pass-sensitivity improvement:
if we know that 'len != 0' and know that 'i == 0' then we know that
  'i < len' must evaluate to true and cannot evaluate to false

llvm-svn: 56260
2008-09-16 23:24:45 +00:00
Ted Kremenek
0ecb53a421 ProgramPoint now takes the space of two pointers instead of one. This change was
motivated because it became clear that the number of subclasses of ProgramPoint
would expand and we ran out of bits to represent a pointer variant. As a plus of
this change, BlockEdge program points can now be represented explicitly without
using a cache of CFGBlock* pairs in CFG.

llvm-svn: 56245
2008-09-16 18:44:52 +00:00
Ted Kremenek
2d470fc0ba Patch by Csaba Hruska!
"Here is a patch what replaces std::ostream with llvm::raw_ostream. This patch
covers the AST library, but ignores Analysis lib."

llvm-svn: 56185
2008-09-13 05:16:45 +00:00
Ted Kremenek
ef2b3a71bb Add missing spaces in path diagnostics.
llvm-svn: 56166
2008-09-12 18:17:46 +00:00
Ted Kremenek
1b9e10390b Store: (static analyzer)
- Change definition of store::Region and store::Binding (once again) to make
  them real classes that just wrap pointers. This makes them more strictly
  typed, and allows specific implementations of Regions/Bindings to just
  subclass them.
- minor renamings to RegionExtent and its subclasses
- added a bunch of doxygen comments

StoreManager: (static analyzer)
- added 'iterBindings', an iteration method for iterating over the bindings of a
  store. It that takes a callback object (acting like a poor man's closure).
- added 'getRVal' version for store::Binding. Will potentially phase the other
  versions of GetRVal in StoreManager out.
- reimplemented 'getBindings' to be non-virtual and to use 'iterBindings'

BasicStoreManager: (static analyzer)
- implemented 'iterBindings' for BasicStoreManager

llvm-svn: 55688
2008-09-03 03:06:11 +00:00
Daniel Dunbar
c62cf79290 Add newline at end of file.
llvm-svn: 55559
2008-08-30 02:06:22 +00:00
Zhongxing Xu
4c23963de8 Added LLVM comment header.
llvm-svn: 55537
2008-08-29 15:09:12 +00:00
Zhongxing Xu
c1bd3a5f8b Migrate the rest symbolic analysis stuff to BasicConstraintManager.
llvm-svn: 55536
2008-08-29 14:52:36 +00:00
Ted Kremenek
5043680da4 Remove dead method.
llvm-svn: 55526
2008-08-29 03:55:31 +00:00
Ted Kremenek
c83e755d78 Added "getBindings" and "BindingAsString" to GRStateManager and StoreManager.
Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of
making assumptions about the Store (removed dependence on GRState::vb_iterator).

llvm-svn: 55522
2008-08-29 00:47:32 +00:00
Ted Kremenek
5909059524 Remove BasicStore.h (migrated function prototype for CreateBasicStore() to Store.h)
llvm-svn: 55519
2008-08-28 23:39:42 +00:00
Ted Kremenek
75d2ac956f Remove Regions.h and Regions.cpp, since we are now using an even more abstract representation of "memory regions" in the static analyzer.
llvm-svn: 55515
2008-08-28 23:32:43 +00:00
Ted Kremenek
e91874f71f Make store "Regions" and "Bindings" more abstract instead of concrete variants.
Their precise semantics will be implemented by a specific StoreManager.

Use function pointer to create the StoreManager in GRStateManager.  This matches how we create ConstraintsManager.

llvm-svn: 55514
2008-08-28 23:31:31 +00:00
Ted Kremenek
f1b9209a34 Fixed analyzer caching bug involving the transfer function for loads.
llvm-svn: 55494
2008-08-28 18:43:46 +00:00
Ted Kremenek
b45e6b91c6 Fixed analyzer caching bug in DeclStmt.
llvm-svn: 55487
2008-08-28 18:34:26 +00:00