Commit Graph

890 Commits

Author SHA1 Message Date
Ted Kremenek c5644e1b97 Tweak the ObjCAtSyncChecker to assume that a mutex is non-nil after checking that it is
nil.  Otherwise we can get false paths where a second @synchronized using the mutex
can have a bogus warning.  Fixes <rdar://problem/8578650>.

llvm-svn: 117016
2010-10-21 15:38:55 +00:00
Ted Kremenek da8a79ac8d "Fix" bogus idempotent operations warning due to loop unrolling not unrolling enough loops to show that an invariant
doesn't hold.  This fix is to increase the loop unrolling count to 4, which experiments show doesn't typically impact
analysis time.  The real fix is to modify the IdempotentOperationsChecker to suppress warnings where an analysis point
could be preceded by a point where we gave up due to loop unrolling.

llvm-svn: 116769
2010-10-18 23:36:05 +00:00
Ted Kremenek 4f63ac7057 Tweak retain/release checker diagnostics to specify a leak occurs because an object is not referenced later in the path,
not that it isn't referenced later in the code.  Fixes <rdar://problem/8527839>.

llvm-svn: 116636
2010-10-15 22:50:23 +00:00
Zhongxing Xu 271c9c7b6d Add experimental chroot check which checks improper use of chroot(). Patch by
Lei Zhang.

llvm-svn: 116163
2010-10-10 05:45:30 +00:00
Tom Care ea53e82c78 UnreachableCodeChecker cleanup and improvements
- Fixed some iterator style issues
- Don't process blocks that have been visited already
- Fixed a case where a unreachable block cycle was not reported
- Minor test case changes
- Added one test case from flow-sensitive version of the check. More coming.

llvm-svn: 115861
2010-10-06 23:02:25 +00:00
Marcin Swiderski 20b88739ed Added support for base and member destructors in destructor.
llvm-svn: 115592
2010-10-05 05:37:00 +00:00
Marcin Swiderski 87b1bb6fd2 Added support for C++ initializers in CFG.
llvm-svn: 115493
2010-10-04 03:38:22 +00:00
Marcin Swiderski 3546b1aea1 Added generating CFGAutomaticObjDtors for exception variable in catch statement.
llvm-svn: 115266
2010-10-01 01:46:52 +00:00
Marcin Swiderski 6d5ee0c7f9 Added generating CFGAutomaticObjDtors for init statement, condition variable and implicit scope in for statement.
llvm-svn: 115265
2010-10-01 01:38:14 +00:00
Marcin Swiderski e407a3ba1e dded generating CFGAutomaticObjDtors for condition variable and implicit scopes in switch statement.
llvm-svn: 115264
2010-10-01 01:24:41 +00:00
Marcin Swiderski 1f4e15c56f Added generating CFGAutomaticObjDtors for condition variable and implicit scopes in while and do statements.
llvm-svn: 115262
2010-10-01 01:14:17 +00:00
Marcin Swiderski f883ade880 Added generating CFGAutomaticObjDtors for condition variable and implicit scopes in if statement.
llvm-svn: 115256
2010-10-01 00:52:17 +00:00
Marcin Swiderski 667ffecd9e Added:
- Adding LocalScope for CompoundStmt,
- Adding CFGAutomaticObjDtors for end of scope, return, goto, break, continue,
- Regression tests for above cases.

llvm-svn: 115252
2010-10-01 00:23:17 +00:00
Ted Kremenek 3d6c0c0091 Tweak nil receiver checker to not warning about 64-bit return values.
Fixes: <rdar://problem/7513117>
llvm-svn: 115113
2010-09-30 00:37:10 +00:00
Argyrios Kyrtzidis 40cec8326c Revert r114316, -Wunused-value enabled by default was intended.
llvm-svn: 114318
2010-09-19 23:03:35 +00:00
Argyrios Kyrtzidis 3698bf1c6d Make -Wunused-value off by default, matching GCC. Fixes rdar://7126194.
llvm-svn: 114316
2010-09-19 21:21:44 +00:00
Ted Kremenek 7b31a61d10 Relax assertion in CFG builder when processing ForStmts. This fixes an assertion failure
on code containing GNU statement expressions reported in PR 8141.

llvm-svn: 113953
2010-09-15 07:01:20 +00:00
Ted Kremenek c4deb92316 Disallow the use of UnknownVal as the index for ElementRegions. UnknownVals can be used as
the index when the value evaluation isn't powerful enough.  By creating ElementRegions with
UnknownVals as the index, this gives the false impression that they are the same element, when
they really aren't.  This becomes really problematic when deriving symbols from these regions
(e.g., those representing the initial value of the index), since two different indices will
get the same symbol for their binding.

This fixes an issue with the idempotent operations checker that would cause two indices that
are clearly not the same to make it appear as if they always had the same value.

Fixes <rdar://problem/8431728>.

llvm-svn: 113920
2010-09-15 03:13:30 +00:00
Ted Kremenek c95589d2e6 Don't divide-by-zero in RegionStoreManager::getSizeInElements() when getting the size of a VLA. We don't track VLA extents yet,
but we should at least not crash.  Fixes <rdar://problem/8424269>.

llvm-svn: 113888
2010-09-14 23:08:34 +00:00
Ted Kremenek 8abff774aa Fix CFGBuilder crash reported in PR 8141.
llvm-svn: 113826
2010-09-14 01:13:32 +00:00
Ted Kremenek 0a3f523614 Polish diagnostics for null dereferences via ObjC ivar accesses. Finishes up <rdar://problem/6352035>.
llvm-svn: 113612
2010-09-10 20:20:49 +00:00
Ted Kremenek e495c99055 Implement: <rdar://problem/6351970> rule request: warn if @synchronized mutex can be nil
llvm-svn: 113573
2010-09-10 03:05:40 +00:00
Tom Care 4545b2df42 Added AnalyzerStatsChecker, a path sensitive check that reports visitation statistics about analysis. Running clang with the -analyzer-stats flag will emit warnings containing the information. We can then run a postanalysis script to take this data and give useful information about how much the analyzer missed in a project.
llvm-svn: 113568
2010-09-10 00:44:44 +00:00
Ted Kremenek 5cdaeaaa1d Clean up obtuse wording of checker diagnostic of using an uninitialized value in a function call.
Fixes: <rdar://problem/8409480> “warning: Pass-by-value argument in function call is undefined” message can be improved
llvm-svn: 113554
2010-09-09 22:51:55 +00:00
Ted Kremenek ff3a4ff6e9 Use FindReportInEquivalenceClass to identify all the nodes used for the trimmed graph (in BugReporter). This fixes a problem where a leak that happened to occur on both an exit() path and a non-exit() path was getting reported with the exit() path (which users don't care about).
This fixes:

<rdar://problem/8331641> leak reports should not show paths that end with exit() (but ones that don't end with exit())

llvm-svn: 113524
2010-09-09 19:05:34 +00:00
Ted Kremenek 5f256da834 Rename GRState::getSVal() -> getRawSVal() and getSimplifiedSVal() -> getSVal().
The end result is now we eagarly constant-fold symbols in the analyzer that are perfectly constrained
to be a constant value.  This allows us to recover some path-sensitivity in some cases by lowering
the required level of reasoning power needed to evaluate some expressions.

The net win from this change is that the false positive in PR 8015 is fixed, and we also
find more idempotent operations bugs.

We do, however, regress with the BugReporterVisitors, which need to be modified to understand
this constant folding (and look past it).  This causes some diagnostic regressions in plist-output.m
which will get addressed in a future patch.  plist-output.m is now marked XFAIL, while
plist-output-alternate.m now tests that the plist output is working, but with the suboptimal
diagnostics.  This second test file will eventually be removed.

llvm-svn: 113477
2010-09-09 07:13:00 +00:00
Ted Kremenek 5ebb6156d8 Include test case for <rdar://problem/5880430>.
llvm-svn: 113458
2010-09-09 00:40:43 +00:00
John McCall 83556c1a80 Put the tautological-comparison-of-unsigned-against-zero warnings in
-Wtautological-compare instead of -Wsign-compare, which also implies turning
them on by default.

Restoration of r112877.

llvm-svn: 113334
2010-09-08 02:01:27 +00:00
Daniel Dunbar 53c9ac30f9 tests: Use -ffreestanding when including stdint.h, to avoid platform dependencies.
llvm-svn: 113301
2010-09-07 22:54:28 +00:00
Ted Kremenek aba4958db2 Fix null pointer dereference in StreamChecker::Fseek (reported in PR 8081) and simplify surrounding checking logic.
llvm-svn: 113282
2010-09-07 20:45:26 +00:00
Tom Care bc9eaef24c Re-enabled truncation/extension checking in IdempotentOperationChecker and added a test case.
llvm-svn: 113269
2010-09-07 20:27:56 +00:00
Chris Lattner 53fa04909c make clang print types as "const int *" instead of "int const*",
which is should have done from the beginning.  As usual, the most
fun with this sort of change is updating all the testcases.

llvm-svn: 113090
2010-09-05 00:04:01 +00:00
Anders Carlsson af7534f084 Get rid of the "functions declared 'noreturn' should have a 'void' result type" warning.
The rationale behind this is that it is normal for callback functions to have a non-void return type
and it should still be possible to mark them noreturn. (JavaScriptCore is a good example of this).

llvm-svn: 112918
2010-09-03 00:25:02 +00:00
John McCall 310083c3e3 sabre points out that the timing here is pretty pessimal; I'll retry the
experiment in a few days.

llvm-svn: 112882
2010-09-02 22:27:38 +00:00
John McCall 25f7aa8158 Experimentally move the tautological comparison warnings from -Wsign-compare
to -Wtautological-compare.  This implies that they're now on by default.
If this causes chaos, I'll figure something else out.

llvm-svn: 112877
2010-09-02 22:18:59 +00:00
Zhongxing Xu ef94284f2f Tweak test case. 'int' would introduce out-of-bound issues. We focus on array
index constraints in this case.

llvm-svn: 112794
2010-09-02 01:42:44 +00:00
Ted Kremenek 07343c02be For GRExprEngine::EvalBind() (and called visitors), unifiy StoreE and AssignE. Now StoreE (const Stmt*) represents the expression where the store took place, which is the assignment expression if it takes place in an assignment. This removes some conceptual dissidence as well as removes an extra parameter from the Checker::PreVisitBind() visitor. It also improves ranges and source location information in analyzer diagnostics.
llvm-svn: 112789
2010-09-02 00:56:20 +00:00
Ted Kremenek f3a734d8ee Add yet another test case for PR 8015, showing how reasoning over symbolic indices should exactly resolve over multiple index possibilities (and thus suppress the false positive in the test).
llvm-svn: 112770
2010-09-01 23:37:38 +00:00
Ted Kremenek 121ddd6a5c Add another test case for PR 8015, here with the array index being within a valid range and not just a single constant.
llvm-svn: 112769
2010-09-01 23:37:36 +00:00
Ted Kremenek 0e12f9cc7b Partial fix for PR 8015 (fix is actually by Jordy Rose, and I added a test case for follow-on work). This patch adds a bandaid for RegionStore's limited reasoning about symbolic array values.
llvm-svn: 112766
2010-09-01 23:27:26 +00:00
Ted Kremenek d588e78b95 Don't assert in the analyzer when analyze code does a byte load from a function's address. Fixes PR 8052.
llvm-svn: 112761
2010-09-01 23:00:46 +00:00
Ted Kremenek 026cb58a44 Don't assert in CastSizeChecker when the casted-to pointee is an incomplete type. Fixes PR 8050.
llvm-svn: 112738
2010-09-01 20:35:38 +00:00
Ted Kremenek 128d04dfe8 Explicitly handle CXXOperatorCallExpr when building CFGs. We should treat it the same as CallExprs.
Fixes: <rdar://problem/8375510> [Boost] CFGBuilder crash in Boost.Graph
llvm-svn: 112618
2010-08-31 18:47:34 +00:00
Douglas Gregor 79a2788512 Revert my lame attempt at appeasing the CFGBuilder
llvm-svn: 112580
2010-08-31 05:36:56 +00:00
Douglas Gregor f5d453d067 Teach the CFGBuilder not do die on CXXBindTemporaryExpr, CXXOperatorCallExpr. Fixes a Boost.Graph crasher.
llvm-svn: 112578
2010-08-31 05:10:27 +00:00
Tom Care 9026d4b488 Adjusted the semantics of assign checking in IdempotentOperationChecker
- Fixed a regression where assigning '0' would be reported
- Changed the way self assignments are filtered to allow constant testing
- Added a test case for assign ops
- Fixed one test case where a function pointer was not considered constant
- Fixed test cases relating to 0 assignment

llvm-svn: 112501
2010-08-30 19:25:43 +00:00
Tom Care 71cc9d886a Added checking of (x == x) and (x != x) to IdempotentOperationChecker and updated test cases flagged by it.
llvm-svn: 112313
2010-08-27 22:50:47 +00:00
Tom Care 98e679508d Enabled relaxed LiveVariables analysis in the path-sensitive engine to increase the coverage of bugs. Primarily affects IdempotentOperationChecker.
- Migrated a temporarily separated test back to its original file (bug has been fixed, null-deref-ps-temp.c -> null-deref-ps.c)
- Changed SymbolManager to use relaxed LiveVariables
- Updated several test cases that the IdempotentOperationChecker class now flags
- Added test case to test relaxed LiveVariables use by the IdempotentOperationChecker

llvm-svn: 112312
2010-08-27 22:46:32 +00:00
Ted Kremenek 036223bdcf Fix horrible GRExprEngine bug where switch statements with no 'case:' statements would cause the path to get prematurely aborted. Fixes <rdar://problem/8360854>.
llvm-svn: 112233
2010-08-26 22:19:33 +00:00
Tom Care 82b2a1dada Improved the handling of blocks and block variables in PseudoConstantAnalysis
- Removed the assumption that __block vars are all non-constant
- Simplified some repetitive code in RunAnalysis
- Added block walking support
- Code/comments cleanup
- Separated out test for block pseudoconstants

llvm-svn: 112098
2010-08-25 22:37:26 +00:00