8 Commits

Author SHA1 Message Date
Kovarththanan Rajaratnam
65c6566b5b lib/Analysis: Remove VISIBILITY_HIDDEN from definitions in anonymous namespace
llvm-svn: 90028
2009-11-28 06:07:30 +00:00
Ted Kremenek
c0229557dd Enhance null dereference diagnostics by indicating what variable (if any) was dereferenced. Addresses <rdar://problem/7039161>.
llvm-svn: 89726
2009-11-24 01:33:10 +00:00
Ted Kremenek
f57351570e Clean up the Checker API a little more, resolving some hidden bugs
along the way.  Important changes:

1) To generate a sink node, use GenerateSink(); GenerateNode() is for
generating regular transitions.  This makes the API clearer and also
allows us to use the 'bool' option to GenerateNode() for a different
purpose.

2) GenerateNode() now automatically adds the generated node to the
destination ExplodedNodeSet (autotransition) unless the client
specifies otherwise with a bool flag.  Several checkers did not call
'addTransition()' after calling 'GenerateNode()', causing the
simulation path to be prematurely culled when a non-fail stop bug was
encountered.

3) Add variants of GenerateNode()/GenerateSink() that take neither a
Stmt* or a GRState*; most callers of GenerateNode() just pass in the
same Stmt* as provided when the CheckerContext object is created; we
can just use that the majority of the time.  This cleanup also allows
us to potentially coelesce the APIs for evaluating branches and
end-of-paths (which currently directly use builders).

4) addTransition() no longer needs to be called except for a few
cases.  We now have a variant of addTransition() that takes a
GRState*; this allows one to propagate the updated state without
caring about generating a new node explicitly.  This nicely cleaned up
a bunch of cases that called autoTransition() with a bunch of
conditional logic surround the call (that common logic has now been
swallowed up by addTransition() itself).

llvm-svn: 89707
2009-11-23 22:22:01 +00:00
Ted Kremenek
9d6daf2cc4 Restructure DereferenceChecker slightly to handle caching out when we would report a null dereference more than once.
llvm-svn: 89526
2009-11-21 01:50:48 +00:00
Benjamin Kramer
f4c511b026 Change *BugReport constructors to take StringRefs.
- Eliminates many calls to std::string.c_str()
- Fixes an invalid read in ReturnStackAddressChecker due to an unsafe call to
  StringRef.data() which doesn't guarantee null-termination.

llvm-svn: 88779
2009-11-14 12:08:24 +00:00
Ted Kremenek
5e1f78aeb1 Refactor DereferenceChecker to use only the new Checker API instead of
the old builder API.  This percolated a bunch of changes up to the
Checker class (where CheckLocation has been renamed VisitLocation) and
GRExprEngine.  ProgramPoint now has the notion of a "LocationCheck"
point (with PreLoad and PreStore respectively), and a bunch of the old
ProgramPoints that are no longer used have been removed.

llvm-svn: 86798
2009-11-11 03:26:34 +00:00
Ted Kremenek
2980b975ee Minor cleanup: use BuiltinBug (which will soon be renamed) for DeferenceChecker and friends so that they always report the same bug type.
llvm-svn: 86208
2009-11-06 00:44:32 +00:00
Ted Kremenek
8d43a6ac3d Merge NullDerefChecker.[h,cpp] and UndefDerefChecker.[h,cpp]. They are essentially two parts of the same check.
llvm-svn: 85911
2009-11-03 18:41:06 +00:00