14 Commits

Author SHA1 Message Date
Anna Zaks
c25efccc8b [analyzer] Propagate taint through NonLoc to NonLoc casts.
- Created a new SymExpr type - SymbolCast.
 - SymbolCast is created when we don't know how to simplify a NonLoc to
NonLoc casts.
 - A bit of code refactoring: introduced dispatchCast to have better
code reuse, remove a goto.
 - Updated the test case to showcase the new taint flow.

llvm-svn: 145985
2011-12-06 23:12:27 +00:00
Anna Zaks
d066f79c80 [analyzer] Unify SymbolVal and SymExprVal under a single SymbolVal
class.

We are going into the direction of handling SymbolData and other SymExpr
uniformly, so it makes less sense to keep two different SVal classes.
For example, the checkers would have to take an extra step to reason
about each type separately.

The classes have the same members, we were just using the SVal kind
field for easy differentiation in 3 switch statements. The switch
statements look more ugly now, but we can make the code more readable in
other ways, for example, moving some code into separate functions.

llvm-svn: 145833
2011-12-05 18:58:30 +00:00
Anna Zaks
a636fbe73f [analyzer] Remove all uses of ConstraintManager::canResonAbout() from
ExprEngine.

Teach SimpleConstraintManager::assumeSymRel() to propagate constraints
to symbolic expressions.

+ One extra warning (real bug) is now generated due to enhanced
assumeSymRel().

llvm-svn: 145832
2011-12-05 18:58:25 +00:00
Anna Zaks
040ddfedc0 [analyzer] Do not conjure a symbol when we need to propagate taint.
When the solver and SValBuilder cannot reason about symbolic expressions (ex: (x+1)*y ), the analyzer conjures a new symbol with no ties to the past. This helps it to recover some path-sensitivity. However, this breaks the taint propagation.

With this commit, we are going to construct the expression even if we cannot reason about it later on if an operand is tainted.

Also added some comments and asserts.

llvm-svn: 144932
2011-11-17 23:07:28 +00:00
David Blaikie
aa347f9392 Removing a bunch of dead returns/breaks after llvm_unreachables.
llvm-svn: 140407
2011-09-23 20:26:49 +00:00
David Blaikie
83d382b1ca Switch assert(0/false) llvm_unreachable.
llvm-svn: 140367
2011-09-23 05:06:16 +00:00
Ted Kremenek
001fd5b498 Rename GRState to ProgramState, and cleanup some code formatting along the way.
llvm-svn: 137665
2011-08-15 22:09:50 +00:00
Jordy Rose
b891bd8a3c [analyzer] When performing a binary operation on symbolic operands, we convert the symbol values to a common type. But in a relational operation, the result is an 'int' or 'bool', which may not be the appropriate type to convert the operands to. In these cases, use the left-hand operand's type as the conversion type.
There's no associated test for this because fully-constrained symbolic values are evaluated ahead of time in normal expressions. This can only come up in checker-constructed expressions (like the ones in an upcoming patch to CStringChecker).

llvm-svn: 133041
2011-06-15 04:55:49 +00:00
Douglas Gregor
61b6e49ee1 A few more is(Un)signedIntegerType/is(Un)signedOrEnumerationType cleanups.
llvm-svn: 131793
2011-05-21 16:28:01 +00:00
Ted Kremenek
57a4a152b2 Fix bug in SimpleSValBuilder where '--' pointer arithmetic was treated like '++' pointer arithmetic.
llvm-svn: 129348
2011-04-12 03:49:37 +00:00
Zhanyong Wan
5ad574c096 Improves the coding style in SValBuilder. This patch:
- renames evalCastNL and evalCastL to evalCastFromNonLoc and
  evalCastFromLoc (avoid abbreviations that aren't well known).

- makes all function parameter names start with a lower case letter
  for consistency and distinction from member variables.

- avoids abbreviations in function parameter names.

Reviewed by kremenek@apple.com.

llvm-svn: 126722
2011-03-01 00:45:32 +00:00
Zhanyong Wan
85a203ebdd Makes most methods in SVals.h conform to the naming guide. Reviewed
by kremenek.

llvm-svn: 125687
2011-02-16 21:13:32 +00:00
Ted Kremenek
f8cbac4b91 Split 'include/clang/StaticAnalyzer' into 'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'.
This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries.

llvm-svn: 125251
2011-02-10 01:03:03 +00:00
Argyrios Kyrtzidis
fa0734ec4f [analyzer] Move the files in lib/StaticAnalyzer to lib/StaticAnalyzer/Core.
Eventually there will also be a lib/StaticAnalyzer/Frontend that will handle initialization and checker registration.
Yet another library to avoid cyclic dependencies between Core and Checkers.

llvm-svn: 125124
2011-02-08 22:30:36 +00:00