153 Commits

Author SHA1 Message Date
Chris Lattner
231f7bbdbe silence a warning from gcc.
llvm-svn: 58956
2008-11-10 03:00:37 +00:00
Zhongxing Xu
3d43015bc7 Add a boilerplate for out-of-bound array checking. This has no real function currently.
llvm-svn: 58886
2008-11-08 03:45:42 +00:00
Zhongxing Xu
2c677c34d5 Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is
available, things get much simplified.

One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue
context.

llvm-svn: 58837
2008-11-07 10:38:33 +00:00
Ted Kremenek
9bf363979d Add transfer function logic for alloca().
llvm-svn: 58552
2008-11-02 00:35:01 +00:00
Ted Kremenek
59ae7c0fd5 Comment out invalid assertion. I'm leaving it in the code for now as a reminder to produce a test case.
llvm-svn: 58510
2008-10-31 15:33:11 +00:00
Zhongxing Xu
4de1c851d3 Fix 80-col violations.
llvm-svn: 58495
2008-10-31 07:26:14 +00:00
Zhongxing Xu
2caf586d2f Add a tentative assertion.
llvm-svn: 58492
2008-10-31 06:05:32 +00:00
Zhongxing Xu
121a53a176 Fix a comment.
llvm-svn: 58487
2008-10-31 03:01:26 +00:00
Ted Kremenek
828e6dff9b Handle the case in VisitInitListExprs where there are no initializers in the compound literal.
llvm-svn: 58468
2008-10-30 23:14:36 +00:00
Ted Kremenek
0f0adc97c5 Use the correct predecessor node.
llvm-svn: 58446
2008-10-30 18:37:08 +00:00
Ted Kremenek
28f41ba829 Add missing return statement.
llvm-svn: 58444
2008-10-30 18:34:31 +00:00
Ted Kremenek
f68bf63611 Use a worklist in GRExprEngine::VisitInitListExpr to process subexpressions.
llvm-svn: 58440
2008-10-30 17:47:32 +00:00
Zhongxing Xu
610634fe39 Merge the array and struct case. They are essentially the same.
llvm-svn: 58422
2008-10-30 05:35:59 +00:00
Zhongxing Xu
a15cfd4db9 Rename:
- SetSVal(GRState*, Loc, SVal) => BindLoc
 - SetSVal(GRState*, Expr*, SVal) => BindExpr 

llvm-svn: 58421
2008-10-30 05:33:54 +00:00
Zhongxing Xu
b281cdda87 Implement VisitInitListExpr(). InitListExpr will have a nonloc::CompoundVal value.
llvm-svn: 58419
2008-10-30 05:02:23 +00:00
Ted Kremenek
204ae1f0d9 Mark yy_fatal_error as a panic function.
llvm-svn: 58410
2008-10-30 00:00:57 +00:00
Zhongxing Xu
628ae879ea Rename: AddDecl => BindDecl
BindDecl better describes what the function does:
  - Bind the VarDecl to its memory region
  - Bind the memory region to some initial value.

llvm-svn: 58359
2008-10-29 02:34:02 +00:00
Douglas Gregor
f19b2319c9 Rename ExplicitCCastExpr to CStyleCastExpr
llvm-svn: 58331
2008-10-28 15:36:24 +00:00
Douglas Gregor
6b75484ba6 Improve our handling of (C++) references within Clang. Specifically:
- Do not allow expressions to ever have reference type
  - Extend Expr::isLvalue to handle more cases where having written a
    reference into the source implies that the expression is an lvalue
    (e.g., function calls, C++ casts).
  - Make GRExprEngine::VisitCall treat the call arguments as lvalues when
    they are being bound to a reference parameter.

llvm-svn: 58306
2008-10-28 00:22:11 +00:00
Ted Kremenek
54d399ac5d Remove type-punning warning in GRExprEngine. No functionality change.
llvm-svn: 58292
2008-10-27 23:02:39 +00:00
Ted Kremenek
bf26368255 Added preliminary support for CompoundLiterals in the static analyzer:
- GRExprEngine::VisitCompoundLiteral...
   (1) visits the initializer list (generating ExplodedNodes)
   (2) creates a CompoundMemRegion for the literal
   (3) creates a new state with the bound literal values using
       GRStateManager::BindCompoundLiteral

- GRStateManager::BindCompoundLiteral simply calls 
  StoreManager::BindCompoundLiteral to get a new store and returns a persistent
  GRState with that store.

- BasicStore::BindCompoundLiteral simply returns the same store, as it
  doesn't handle field sensitivity
  
- RegionStore::BindCompoundLiteral currently fires an assert (pending discussion
  of how to best implement mappings for CompoundLiteralRegion).

llvm-svn: 58277
2008-10-27 21:54:31 +00:00
Douglas Gregor
e200adc503 Refactor the expression class hierarchy for casts. Most importantly:
- CastExpr is the root of all casts
  - ImplicitCastExpr is (still) used for all explicit casts
  - ExplicitCastExpr is now the root of all *explicit* casts
  - ExplicitCCastExpr (new name needed!?) is a C-style cast in C or C++
  - CXXFunctionalCastExpr inherits from ExplicitCastExpr
  - CXXNamedCastExpr inherits from ExplicitCastExpr and is the root of all
    of the C++ named cast expression types (static_cast, dynamic_cast, etc.)
  - Added classes CXXStaticCastExpr, CXXDynamicCastExpr, 
    CXXReinterpretCastExpr, and CXXConstCastExpr to 

Also, fixed returned-stack-addr.cpp, which broke once when we fixed
reinterpret_cast to diagnose double->int* conversions and again when
we eliminated implicit conversions to reference types. The fix is in
both testcase and SemaChecking.cpp.

Most of this patch is simply support for the renaming. There's very
little actual change in semantics.

llvm-svn: 58264
2008-10-27 19:41:14 +00:00
Ted Kremenek
e69a1fa342 Do not crash when performing VisitLValue on union types.
This fixes PR 2948.

llvm-svn: 58148
2008-10-25 20:09:21 +00:00
Zhongxing Xu
0d2706f6b8 Add code for get the lvalue for string literals. Now we return a StringRegion
for StringLiteral lvalue evaluation, instead of directly returning a
loc::StringLiteralVal by the Environment.

llvm-svn: 58138
2008-10-25 14:18:57 +00:00
Zhongxing Xu
ad20b671fc Now we can handle arrays.
llvm-svn: 58135
2008-10-25 10:26:46 +00:00
Ted Kremenek
6e09d8f632 Implicit conversions from arrays can also be conversions to references (will add a test case shortly).
llvm-svn: 58110
2008-10-24 21:10:49 +00:00
Ted Kremenek
f3be44f191 Added method "getSelfRegion" to Store. This method returns the region associated with the "this" or "self" object (C++ and Objective-C respectively).
llvm-svn: 58107
2008-10-24 20:32:16 +00:00
Zhongxing Xu
c7796d347d Fix 80-col violation.
llvm-svn: 58070
2008-10-24 04:33:15 +00:00
Ted Kremenek
6779f893b9 Make the analyzer store (memory model) a command line option.
llvm-svn: 58056
2008-10-24 01:04:59 +00:00
Zhongxing Xu
9c4bc9dd33 Add an assertion to make our intention more clear.
llvm-svn: 58030
2008-10-23 04:19:25 +00:00
Zhongxing Xu
b0a4875b42 Let StoreManager do different cast on arrays. BasicStore will just keep it intact.
llvm-svn: 58028
2008-10-23 03:10:39 +00:00
Zhongxing Xu
c5382eae80 Adjust parameter order to more natural one.
llvm-svn: 57964
2008-10-22 09:00:19 +00:00
Zhongxing Xu
c272152919 Exprs of function type is another special case for ImplicitCast.
llvm-svn: 57963
2008-10-22 08:02:16 +00:00
Ted Kremenek
677fba12a5 When conjuring symbols for compound assignments, use the promoted type to determine if the symbolic value as a "loc::" or "nonloc::" value.
llvm-svn: 57917
2008-10-21 19:49:01 +00:00
Douglas Gregor
5251f1b283 Preliminary support for function overloading
llvm-svn: 57909
2008-10-21 16:13:35 +00:00
Zhongxing Xu
dab76fd822 Localize the special processing of array variable inside
GRExprEngine::VisitCast() so that other parts of the analyzer can be ignorant.
When we cast "array of type T" to "pointer to T", we get the loc::MemRegionVal
corresponding to the array variable. This is sufficient for BasicStore, but not
for RegionStore. RegionStore should get the element region for the first array
element in the cast. So next comes to the revamping of transfer functions for
different store model.

llvm-svn: 57897
2008-10-21 06:54:23 +00:00
Ted Kremenek
c32ec3a0c4 Further improve path-sensitivity with divide-by-zero checking by assuming that a denominator cannot be zero even when the result of an '/' or '%' expression is unknown.
llvm-svn: 57855
2008-10-20 23:40:25 +00:00
Ted Kremenek
7f8a87f4a9 Used conjured symbols to recover path-sensitivity when the result of a compound assignment is UnknownVal().
llvm-svn: 57851
2008-10-20 23:13:25 +00:00
Ted Kremenek
f8d65a30d6 Add support in GRExprEngine for UnaryOperator::AlignOf. This fixes one crash report in PR 2796.
llvm-svn: 57777
2008-10-18 22:20:20 +00:00
Ted Kremenek
850422e5d2 Generalize VisitLValue: not only can CallExprs and ObjCMessageExprs return aggregate temporaries, so can many other expressions.
llvm-svn: 57761
2008-10-18 04:15:35 +00:00
Ted Kremenek
8f5dc295ce Function calls and ObjC message expressions can be used in a lvalue context if they return a structure. E.g foo().x == 1. We don't really support, however, such temporaries yet in the environment or the store.
llvm-svn: 57760
2008-10-18 04:08:49 +00:00
Ted Kremenek
fef1f30ea2 Use "VisitLValue" when processing the base for "x.f" field accesses, and "Visit" when processing the base for "x->f" field accesses.
llvm-svn: 57754
2008-10-18 03:28:48 +00:00
Ted Kremenek
213873232d When conjuring symbols to recover path-sensitivity, don't conjure symbols that represent an entire struct. We need to implement struct temporaries as an actual "region", and then bind symbols to the FieldRegion of those temporaries.
llvm-svn: 57739
2008-10-17 22:23:12 +00:00
Ted Kremenek
5870046c43 "Implement" GRExprEngine::VisitLValue for ObjCPropertyRefExpr. This is only a bandid; we need to properly handle properties by using locv/nonloc objects and specially handling property assignments in the transfer function for BinaryOperator.
llvm-svn: 57693
2008-10-17 17:24:14 +00:00
Zhongxing Xu
27f174214d This patch did the following renaming. There should be no functional changes.
RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671
2008-10-17 05:57:07 +00:00
Zhongxing Xu
252fe5c9f1 Get array's lvalue through standard interface.
llvm-svn: 57666
2008-10-17 02:20:14 +00:00
Zhongxing Xu
9fe408057a Return the corresponding MemRegionVal for both rvalue and lvalue of array of
type T.

llvm-svn: 57665
2008-10-17 02:14:42 +00:00
Ted Kremenek
357c63ab37 Remove an untrue assertion: lval::FuncVals can be returned in both rvalue and lvalue contexts.
llvm-svn: 57659
2008-10-17 00:55:33 +00:00
Ted Kremenek
3ad391d800 Remove lval::FieldOffset, lval::ArrayOffset. These will be replaced with regions.
Remove GRExprEngine::getLVal and RValues::MakeVal.
Enhance StoreManager "GetLValue" methods to dispatch for specific kinds of lvalue queries, as opposed to interogating the expression tree (GRExprEngine already does this).

Added FIXMEs.  In particular, we no longer "assume" that a base pointer in a field/array access is null (this logic was removed).  Perhaps we should do this when fetching the lvalue for fields and array elements?

llvm-svn: 57657
2008-10-17 00:51:01 +00:00
Ted Kremenek
12dd55b23d Add transfer function support for ObjCIvarRefExpr.
llvm-svn: 57654
2008-10-17 00:03:18 +00:00