Commit Graph

89 Commits

Author SHA1 Message Date
Ted Kremenek 5909059524 Remove BasicStore.h (migrated function prototype for CreateBasicStore() to Store.h)
llvm-svn: 55519
2008-08-28 23:39:42 +00:00
Ted Kremenek e91874f71f Make store "Regions" and "Bindings" more abstract instead of concrete variants.
Their precise semantics will be implemented by a specific StoreManager.

Use function pointer to create the StoreManager in GRStateManager.  This matches how we create ConstraintsManager.

llvm-svn: 55514
2008-08-28 23:31:31 +00:00
Ted Kremenek f1b9209a34 Fixed analyzer caching bug involving the transfer function for loads.
llvm-svn: 55494
2008-08-28 18:43:46 +00:00
Ted Kremenek b45e6b91c6 Fixed analyzer caching bug in DeclStmt.
llvm-svn: 55487
2008-08-28 18:34:26 +00:00
Zhongxing Xu f71b5f39bb Refactor Assume logic into a separate class ConstraintManager.
llvm-svn: 55412
2008-08-27 14:03:33 +00:00
Ted Kremenek 2a2c875b9c Added 'extents' for Regions.
Added 'getExtent()' to StoreManager.
Implemented 'getExtent()' for BasicStoreManager.

llvm-svn: 55321
2008-08-25 19:33:03 +00:00
Zhongxing Xu d95495f601 Move the handling of DeclStmt from GRExprEngine to BasicStoreManager.
llvm-svn: 55144
2008-08-21 22:34:01 +00:00
Ted Kremenek 67102b281e Patch by Zhongxing Xu!
This patch extends BasicStoreManager::getInitialStore() to include code that symbolicates input variables.
It also removes redundant handling of ImplicitParamDecl, since it is a subclass of VarDecl.

llvm-svn: 54993
2008-08-19 16:51:45 +00:00
Argyrios Kyrtzidis 3bab3d21f9 Add ExplicitCastExpr to replace the current CastExpr, and have ImplicitCastExpr and ExplicitCastExpr derive from a common base class (CastExpr):
Expr
  -> CastExpr
     -> ExplicitCastExpr
     -> ImplicitCastExpr 

llvm-svn: 54955
2008-08-18 23:01:59 +00:00
Ted Kremenek ceba6ead45 GRState:
- Remove ConstNotEq from GRState/GRStateManager (!= tracking uses GDM instead).
- GRStateManager now can book-keep "contexts" (e.g., factory objects) for uses
  with data elements stored into the GDM.
- Refactor pretty-printing of states to use GRState::Printer objects
  exclusively. This removed a huge amount of pretty-printing logic from
  GRExprEngine.

CFRefCount
- Simplified some API calls based on refinements to the GDM api.

llvm-svn: 54835
2008-08-16 00:49:49 +00:00
Ted Kremenek c7138bb0a7 Default initialize only pointers and integer types (for now).
llvm-svn: 54798
2008-08-14 22:11:13 +00:00
Ted Kremenek 16306107cf Renamed GRState::CheckerStatePrinter to GRState::Printer.
Updated checker state printer interface to allow transfer functions to return an arbitrary number of GRState::Printers.

llvm-svn: 54762
2008-08-13 21:24:49 +00:00
Ted Kremenek 5ab5a1b578 Rename ValueState -> GRState.
Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721
2008-08-13 04:27:00 +00:00
Ted Kremenek dccd9883c4 Initialize tracked local variables to undefined.
llvm-svn: 54716
2008-08-13 03:28:04 +00:00
Ted Kremenek 98f6e582f2 Added path-sensitive checking for null pointer values passed to function arguments marked nonnull.
This implements <rdar://problem/6069935>

llvm-svn: 53891
2008-07-22 00:46:16 +00:00
Ted Kremenek d785465167 Add panic function.
llvm-svn: 53755
2008-07-18 16:28:33 +00:00
Ted Kremenek 8d6b42e096 Created ValueStateSet class to manage the creation of multiple states by a method.
Modified the new EvalBinOpNN to generate states instead of nodes.  This is a much simpler interface and is what clients will want to do.

llvm-svn: 53750
2008-07-18 05:53:58 +00:00
Ted Kremenek 9c32a1ecf5 Move GRTransferFunc* into ValueStateManager, and move the assumption logic there as well.
llvm-svn: 53743
2008-07-17 23:15:45 +00:00
Ted Kremenek a79d9a9c79 Remove redundant logic.
llvm-svn: 53740
2008-07-17 21:36:43 +00:00
Ted Kremenek bc9118b165 Begin major changes to EvalXXX methods in GRTransferFuncs. Currently some of the methods only return an RVal; we want them to be able to create an arbitrary number of states.
llvm-svn: 53739
2008-07-17 21:27:31 +00:00
Ted Kremenek c50e1a196e Refactored auditor interface within GRExprEngine and GRCoreEngine to use a "batch auditor" to dispatch to specialized auditors instead of having a separate vector for each audited Expr*. This not only provides a much cleaner implementation, but also allows us to install auditors for any expression.
llvm-svn: 53464
2008-07-11 18:37:32 +00:00
Ted Kremenek a7b8ffb05b Refactored most of the "Store" piece of ValueState into a Store type. The
current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423
2008-07-10 22:03:41 +00:00
Ted Kremenek 5f996d5a06 Remove getParentMap() from GRExprEngine.
llvm-svn: 53343
2008-07-09 19:46:42 +00:00
Ted Kremenek b1d0118a1a Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.

llvm-svn: 53048
2008-07-02 21:24:01 +00:00
Ted Kremenek 125d4a3b2d GRExprEngine now expects the LiveVariables information to be provided by its creator.
This allows an optimization in AnalysisConsumer where the same LiveVariables information is used between multiple analyses.

llvm-svn: 53046
2008-07-02 20:13:38 +00:00
Ted Kremenek 34a691734e Modified the dead stores checker to...
1) Check if a dead store appears as a subexpression.  For such cases, we emit
   a verbose diagnostic so that users aren't confused.  This addresses:
   
   <rdar://problem/5968508> checker gives misleading report for dead store in loop
   
2) Don't emit a dead store warning when assigning a null value to a pointer.
   This is a common form of defensive programming.  We may wish to make
   this an option to the the checker one day.
   
   This addresses the feature request in the following email:
   
   http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-June/001978.html

llvm-svn: 52555
2008-06-20 21:45:25 +00:00
Ted Kremenek 46c82ab994 Introduce initial transfer function support for __imag__ and __real__. We don't
have complex RValues yet, so this logic is only fully implemented when __imag__
and __real__ are used on non-complex types.

llvm-svn: 52501
2008-06-19 17:55:38 +00:00
Ted Kremenek 9a935fbdeb Added a new ProgramPoint: PostPurgeDeadSymbols. This new program point distinguishes between the cases when we just evaluated the transfer function of a Stmt* (PostStmt) or performed a load (PostLoad). This solves a caching bug observed in a recent bug report.
llvm-svn: 52443
2008-06-18 05:34:07 +00:00
Chris Lattner 5696e7badf Change self/_cmd to be instances of ImplicitParamDecl instead of ParmVarDecl.
Patch by David Chisnall!

llvm-svn: 52422
2008-06-17 18:05:57 +00:00
Ted Kremenek b120ff1b95 Fixed bug in the transfer function for dereferences: the loaded value from EvalLoad should bind to the UnaryOperator*, not its subexpression.
Added test case to exercise this fix when checking for uses of uninitialized values.

Patch by Zhongxing Xu!

llvm-svn: 51377
2008-05-21 15:48:33 +00:00
Ted Kremenek d727220d1a Micro-optimization when checking for panic functions.
llvm-svn: 51214
2008-05-17 00:42:01 +00:00
Ted Kremenek c8081b4e16 Fix 80 col violation.
llvm-svn: 51213
2008-05-17 00:40:45 +00:00
Ted Kremenek 0e76583574 Added panic function _XCAssertionFailureHandler.
llvm-svn: 51212
2008-05-17 00:33:23 +00:00
Ted Kremenek acdde6f099 Rename IsPointerType to LVal::IsLValType, and update CFRefCount::EvalSummary to use IsLValType when conjuring symbols for return values (this fixes a bug with an assertion firing in the analyzer when two qualified objective-c types were compared).
llvm-svn: 50924
2008-05-09 23:45:33 +00:00
Ted Kremenek bb7386aff5 Really noreturn on exceptions.
llvm-svn: 50579
2008-05-02 17:12:56 +00:00
Ted Kremenek 7f824734e0 Added temporary fix for Obj-C exception handling in the static analyzer: treat these as panic functions.
llvm-svn: 50535
2008-05-01 18:33:28 +00:00
Ted Kremenek b99d01269a Added __assert_rtn to list of panic functions.
llvm-svn: 50530
2008-05-01 17:52:49 +00:00
Ted Kremenek ed36e4b9a4 Added ziperr as a panic function. Eventually inter-procedural analysis
should catch this one easily.

llvm-svn: 50526
2008-05-01 15:55:59 +00:00
Ted Kremenek a16dacb6aa Add placeholder code in the static analyzer for MemberExprs involving struct temporaries.
llvm-svn: 50502
2008-04-30 22:17:15 +00:00
Ted Kremenek ca67cab1e8 Add workaround for __builtin_offsetof in the static analyzer.
llvm-svn: 50500
2008-04-30 21:45:55 +00:00
Ted Kremenek 99057462aa Provide SizeOfAlignTypeExpr workaround in the static analyzer for taking the sizeof of a ObjCInterfaceType.
llvm-svn: 50499
2008-04-30 21:31:12 +00:00
Ted Kremenek 84dea154fc When creating LVals for array entries, canonicalize entries with a 0 index.
llvm-svn: 50497
2008-04-30 21:05:35 +00:00
Ted Kremenek 20d8006e93 Teach more of the static analyzer about ObjCQualifiedIdType.
llvm-svn: 50494
2008-04-30 20:17:27 +00:00
Ted Kremenek 0940b99e3b Teach the static analysis engine about ObjCQualifiedIdType.
llvm-svn: 50493
2008-04-30 20:01:29 +00:00
Ted Kremenek 5ce35cc514 Add conjured symbols for decl initializations.
Add db_error as panic function.

llvm-svn: 50489
2008-04-30 17:54:04 +00:00
Ted Kremenek 5cc9e60a5f Invalidate old subexpression bindings when binding UnknownVal.
llvm-svn: 50466
2008-04-30 04:23:07 +00:00
Ted Kremenek 10246e8bfa Add lval::ArrayOffset, which represent the locations of entries in an array.
llvm-svn: 50453
2008-04-29 23:24:44 +00:00
Ted Kremenek 0d2ccffa83 Added lval::FieldOffset, which represents symbolic lvalues for field offsets from other Lvalues.
This removes the failure in null-deref-ps.c (test suite).

llvm-svn: 50449
2008-04-29 22:17:41 +00:00
Ted Kremenek fa5a3d0fe7 Major rewrite/refactoring of static analysis engine. We now use
EvalStore/EvalLoad to handle all loads/stores from symbolic memory, allowing us
to do checks for null dereferences, etc., at any arbitrary load/store (these
were missed checks before). This also resulted in some major cleanups, some
conceptual, and others just in the structure of the code.

This temporarily introduces a regression in the test suite (null-deref-ps.c)
before I add a new LVal type for structure fields.

llvm-svn: 50443
2008-04-29 21:04:26 +00:00
Ted Kremenek ecbdf75049 Do a better job at computing dead symbols.
Implemented support for better localized leaks in the CF reference count checker.
Now leaks should be flagged close to where they occur.

This should implement the desired functionality in <rdar://problem/5879592>, although the diagnostics still need to be improved.

llvm-svn: 50241
2008-04-25 01:25:15 +00:00