393 Commits

Author SHA1 Message Date
Zhongxing Xu
56dd5f0f70 Initial refactor of UndefBranchChecker. We still use GRBranchNodeBuilder
in the checker directly. But I don't have a better approach for now.

llvm-svn: 89640
2009-11-23 03:20:54 +00:00
Zhongxing Xu
014af28ce3 Undefined compound assignment result is checked in UndefinedAssignmentChecker. So this check is redundant.
llvm-svn: 89592
2009-11-22 13:36:20 +00:00
Zhongxing Xu
39638e133a Remove invalid comments. The result is undefined only when operands are undefined.
llvm-svn: 89591
2009-11-22 13:30:10 +00:00
Ted Kremenek
caf2c51fad Pull BadCallChecker int UndefinedArgChecker, and have UndefinedArgChecker also handled undefined receivers in message expressions.
llvm-svn: 89524
2009-11-21 01:25:37 +00:00
Ted Kremenek
f7adea43b4 More checker refactoring. Passing undefined values in a message expression is now handled by UndefinedArgChecker.
llvm-svn: 89519
2009-11-21 00:49:41 +00:00
Zhongxing Xu
ab0ae2139a Revert r89437 and add a comment.
llvm-svn: 89446
2009-11-20 03:50:46 +00:00
Zhongxing Xu
6d9a942174 It's unnecessary to check for unknown at this point.
llvm-svn: 89437
2009-11-20 01:56:48 +00:00
Ted Kremenek
0c54d2da14 Remove printf statement.
llvm-svn: 89383
2009-11-19 20:01:53 +00:00
Zhongxing Xu
4668c7ed1c Add EvalEndPath interface to Checker. Now we can check memory leaked at the
end of the path. Need to unify interfaces.

llvm-svn: 89063
2009-11-17 07:54:15 +00:00
Zhongxing Xu
f19f251523 Clear the dest set.
llvm-svn: 89060
2009-11-17 07:19:51 +00:00
Zhongxing Xu
731f46264f * Do the same thing to the basicstore as in r84163.
* Add a load type to GRExprEngine::EvalLoad().
* When retrieve from 'theValue' of OSAtomic funcitions, use the type of the 
  region instead of the argument expression as the load type.
* Then we can convert CastRetrievedSVal to a pure assertion. In the future
  we can let all Retrieve() methods simply return SVal.

llvm-svn: 88888
2009-11-16 04:49:44 +00:00
Zhongxing Xu
223f5119e1 Remove an unused parameter.
llvm-svn: 88882
2009-11-16 02:52:18 +00:00
Ted Kremenek
1a0dd2e30b Move definition of GRExprEngine::ProcessEndPath() out-of-line.
llvm-svn: 88729
2009-11-14 01:05:20 +00:00
Zhongxing Xu
a4276b091d Check in a new interface of Checker, which will soon be used.
llvm-svn: 87092
2009-11-13 06:53:04 +00:00
Zhongxing Xu
0320ad28c7 GRStateManager::CurrentStmt is not used. Remove it.
llvm-svn: 87091
2009-11-13 06:04:01 +00:00
Ted Kremenek
a971afb90f Enhance Checker class (and GRExprEngine) to support PostVisitation for CallExprs. No clients (yet).
llvm-svn: 86949
2009-11-12 04:35:08 +00:00
Ted Kremenek
8f6c4e8617 Remove GRExprEngine::EvalCall(). It had a single callsite in GRExprEngine, and was easily inlined.
llvm-svn: 86948
2009-11-12 04:16:35 +00:00
Ted Kremenek
7cf8238291 Remove some stale ErrorNodes variables in GRExprEngine and the old buffer overflow logic in GRExprEngineInternalChecks.cpp.
llvm-svn: 86877
2009-11-11 20:16:36 +00:00
Zhongxing Xu
b166712d02 Add undefined array subscript checker.
llvm-svn: 86837
2009-11-11 13:42:54 +00:00
Zhongxing Xu
83c4374e72 Remove the old out-of-bound checking code.
llvm-svn: 86836
2009-11-11 12:52:39 +00:00
Ted Kremenek
5e1f78aeb1 Refactor DereferenceChecker to use only the new Checker API instead of
the old builder API.  This percolated a bunch of changes up to the
Checker class (where CheckLocation has been renamed VisitLocation) and
GRExprEngine.  ProgramPoint now has the notion of a "LocationCheck"
point (with PreLoad and PreStore respectively), and a bunch of the old
ProgramPoints that are no longer used have been removed.

llvm-svn: 86798
2009-11-11 03:26:34 +00:00
Jeffrey Yasskin
612e38026a Fix clang's use of DenseMap iterators after r86636 fixed their constness.
Patch by Victor Zverovich!

llvm-svn: 86638
2009-11-10 01:17:45 +00:00
Ted Kremenek
dd51f7cca2 Remove stale FIXME.
llvm-svn: 86595
2009-11-09 21:56:44 +00:00
Zhongxing Xu
f06c684a33 Add checker for CWE-588: Attempt to Access Child of a Non-structure Pointer.
llvm-svn: 86529
2009-11-09 08:07:38 +00:00
Ted Kremenek
ae3361de2d Remove Checker::CheckType() (and instead using CheckerVisitor::PreVisitDeclStmt()), and refactor VLASizeChecker to have only one Checker subclass (not two) and to not use the node builders directly (and instead use the newer CheckerContext).
llvm-svn: 86329
2009-11-07 03:56:57 +00:00
Ted Kremenek
bee01e5b61 static analyzer: refactor checking logic for returning the address of a stack variable or a garbage
value into their own respective subclasses of Checker (and put them in .cpp files where their
implementation details are hidden from GRExprEngine).

llvm-svn: 86215
2009-11-06 02:24:13 +00:00
Ted Kremenek
209e31b883 Modify GRExprEngine::EvalBind() to take both a "store expression" and
an "assign expression", representing the expressions where the value
binding occurs and the assignment takes place respectively.  These are
largely syntactic clues for better error reporting.

llvm-svn: 86084
2009-11-05 00:42:23 +00:00
Ted Kremenek
ef910047b2 Catch uses of undefined values when they are used in assignment, thus catching such bugs closer to the source.
llvm-svn: 86003
2009-11-04 04:24:16 +00:00
Ted Kremenek
b006b82daf Refactor StoreManager::BindDecl() to take a VarRegion* instead of a VarDecl*, and modify GRExprEngine::EvalBind() to handle decl initialization as well. This paves the way for adding "checker" visitation in EvalBind().
llvm-svn: 85983
2009-11-04 00:09:15 +00:00
Ted Kremenek
0fbbb0877d Change GRTransferFuncs::RegisterChecks() to take a GRExprEngine& instead of a BugReporter&. This paves the way for pulling some of the retain/release checker into a "Checker" class.
llvm-svn: 85971
2009-11-03 23:30:34 +00:00
Zhongxing Xu
27fee83ec4 Pull VLA size checker into its own files.
Split it to two checkers, one for undefined size, 
the other for zero size, so that we don't need to query the size
when emitting the bug report.

llvm-svn: 85895
2009-11-03 12:13:38 +00:00
Ted Kremenek
18c7ceee16 Implement: <rdar://problem/6250216> Warn against using -[NSAutoreleasePool release] in GC mode
llvm-svn: 85887
2009-11-03 08:03:59 +00:00
Ted Kremenek
fac290d359 Remove GRExprEngine::CheckerVisitLocation(). It was only called in one place, so we inlined it in to GRExprEngine::EvalLocation().
llvm-svn: 85838
2009-11-02 23:19:29 +00:00
Ted Kremenek
5c2040b182 Tighten computation of ExprVal using ?: expression. No functionality change.
llvm-svn: 85618
2009-10-30 22:01:29 +00:00
Ted Kremenek
6f2a705a24 Make checkers run in deterministic order.
llvm-svn: 85597
2009-10-30 17:47:32 +00:00
Zhongxing Xu
b9eda67380 Fix PR5316: make assignment expressions can be visited as lvalue. Then we
can get the correct base lvalue.
Revert r85578.

llvm-svn: 85579
2009-10-30 07:19:39 +00:00
Ted Kremenek
e96a30a531 Handle loading of field values from LazyCompoundVals in GRExprEngine::VisitMemberExpr().
This fixes the crash reported in PR 5316.

llvm-svn: 85578
2009-10-30 05:48:30 +00:00
Zhongxing Xu
6b8bfb376b Move NullDeref and UndefDeref into their own checker.
Add a CheckLocation() interface to Checker.
Now ImplicitNullDeref nodes are cached in NullDerefChecker.
More cleanups follow.

llvm-svn: 85471
2009-10-29 02:09:30 +00:00
Douglas Gregor
f7b87cb529 [llvm up]
Switch a few ugly switch-on-string-literal constructs to use the new
llvm::StringSwitch.

llvm-svn: 85461
2009-10-29 00:41:01 +00:00
Zhongxing Xu
b7945461cb 'error' is usually used as a noreturn function. This can suppress some false
warnings. Eventually we need a way to import externally defined functions
summaries.

llvm-svn: 85092
2009-10-26 05:18:31 +00:00
Douglas Gregor
4bd90e53c2 Eliminate QualifiedDeclRefExpr, which captured the notion of a
qualified reference to a declaration that is not a non-static data
member or non-static member function, e.g., 

  namespace N { int i; }
  int j = N::i;

Instead, extend DeclRefExpr to optionally store the qualifier. Most
clients won't see or care about the difference (since
QualifierDeclRefExpr inherited DeclRefExpr). However, this reduces the
number of top-level expression types that clients need to cope with,
brings the implementation of DeclRefExpr into line with MemberExpr,
and simplifies and unifies our handling of declaration references.

Extended DeclRefExpr to (optionally) store explicitly-specified
template arguments. This occurs when naming a declaration via a
template-id (which will be stored in a TemplateIdRefExpr) that,
following template argument deduction and (possibly) overload
resolution, is replaced with a DeclRefExpr that refers to a template
specialization but maintains the template arguments as written.

llvm-svn: 84962
2009-10-23 18:54:35 +00:00
Zhongxing Xu
2ebee13ff2 Simplify some code. No functionality change.
llvm-svn: 84757
2009-10-21 11:42:22 +00:00
Daniel Dunbar
07d0785dbb PR5218: Replace IdentifierInfo::getName with StringRef version, now that clients
are updated.

llvm-svn: 84447
2009-10-18 21:17:35 +00:00
Daniel Dunbar
70e7eadd15 Move misc clients to IdentifierInfo StringRef API.
- strcmp -> ==
 - OS.write(II->getName() ...) -> OS << II->getNameStr()
 - Avoid std::string concatenation
 - Use getNameStr().str() when an std::string is really needed.

llvm-svn: 84437
2009-10-18 20:26:27 +00:00
Daniel Dunbar
2c422dc9ca Move clients to use IdentifierInfo::getNameStart() instead of getName()
llvm-svn: 84436
2009-10-18 20:26:12 +00:00
Zhongxing Xu
9eb2706101 Remove dead code.
llvm-svn: 84073
2009-10-14 05:07:51 +00:00
Zhongxing Xu
7d6387bb24 * Remove unused GRState* parameter
* Make all Base value the last argument.

llvm-svn: 84071
2009-10-14 03:33:08 +00:00
Ted Kremenek
8ec5771dcb Fix: <rdar://problem/7275774> Static analyzer warns about NULL pointer when
adding assert

This fix required a few changes:

SimpleSValuator:
- Eagerly replace a symbolic value with its constant value in EvalBinOpNN
  when it is constrained to a constant.  This allows us to better constant fold
  values along a path.
- Handle trivial case of '<', '>' comparison of pointers when the two pointers
  are exactly the same.

RegionStoreManager:

llvm-svn: 83358
2009-10-06 01:39:48 +00:00
Ted Kremenek
e41b81e9ab Fix:
<rdar://problem/6914474> checker doesn't realize that variable might
have been assigned if a pointer to that variable was passed to another
function via a structure

The problem here was the RegionStoreManager::InvalidateRegion didn't
invalidate the bindings of invalidated regions.  This required a
rewrite of this method using a worklist.

As part of this fix, changed ValueManager::getConjuredSymbolVal() to
require a 'void*' SymbolTag argument.  This tag is used to
differentiate two different symbols created at the same location.

llvm-svn: 82920
2009-09-27 20:45:21 +00:00
Ted Kremenek
1624a4784a Fix PR 4988 by removing an invalid assertion (a function can be referenced in
GRExprEngine::VisitDeclRefExpr without 'asLValue' being true).

llvm-svn: 82598
2009-09-23 01:30:01 +00:00