261 Commits

Author SHA1 Message Date
Ted Kremenek
834e2f69da Enhanced IsReinterpreted() (RegionStore.cpp) to reason about higher-order
pointers.

Enhanced RegionStoreManager::Retrieve() to handle automatic casts when the
loaded value is different from the requested value. This should be refined over
time, but essentially we should always symbolicate locations as locations, and
convert them to non-locations on demand.

These changes now cause 'misc-ps.m' to pass again.

llvm-svn: 76497
2009-07-20 22:58:02 +00:00
Ted Kremenek
8a286fbdb9 Per offline discussion with Steve Naroff, add back Type::getAsXXXType() methods
until Doug Gregor's Type smart pointer code lands (or more discussion occurs).
These methods just call the new Type::getAs<XXX> methods, so we still have
reduced implementation redundancy. Having explicit getAsXXXType() methods makes
it easier to set breakpoints in the debugger.

llvm-svn: 76193
2009-07-17 17:50:17 +00:00
Ted Kremenek
b825c0ddc5 Replaced Type::getAsLValueReferenceType(), Type::getAsRValueReferenceType(), Type::getAsMemberPointerType(), Type::getAsTagType(), and Type::getAsRecordType() with their Type::getAs<XXX> equivalents.
llvm-svn: 76139
2009-07-17 01:20:38 +00:00
Ted Kremenek
e3fb4b6524 Add member template 'Type::getAs<T>', which converts a Type* to a respective T*.
This method is intended to eventually replace the individual
Type::getAsXXXType<> methods.

The motivation behind this change is twofold:

1) Reduce redundant implementations of Type::getAsXXXType() methods. Most of
them are basically copy-and-paste.

2) By centralizing the implementation of the getAs<Type> logic we can more
smoothly move over to Doug Gregor's proposed canonical type smart pointer
scheme.

Along with this patch:

a) Removed 'Type::getAsPointerType()'; now clients use getAs<PointerType>.
b) Removed 'Type::getAsBlockPointerTypE()'; now clients use getAs<BlockPointerType>.

llvm-svn: 76098
2009-07-16 19:58:26 +00:00
Ted Kremenek
c7b1dade86 Move RegionStoreManager over to using new
ValueManager::makeArrayIndex()/convertArrayIndex() methods.  This
handles yet another crash case when reasoning about array indices of
different bitwidth and signedness.

llvm-svn: 75884
2009-07-16 01:33:37 +00:00
Ted Kremenek
ccc22924b0 Use utility method to create 0-index into ElementRegion.
llvm-svn: 75865
2009-07-16 00:00:11 +00:00
Ted Kremenek
4802955b84 Enhance RegionStore's reasoning about Objective-C ivars. More testing to follow.
llvm-svn: 75748
2009-07-15 06:09:28 +00:00
Zhongxing Xu
b5bf7ee393 Use utility method.
llvm-svn: 75745
2009-07-15 05:09:24 +00:00
Ted Kremenek
57fa7e3cc8 Relax assertion.
llvm-svn: 75738
2009-07-15 04:23:32 +00:00
Ted Kremenek
e6fea68c46 More test cases revealed that the logic in StoreManager::InvalidateRegion() needs more finesse when handling the invalidation of pointers. Pointers that were invalidated as integers could later cause problems for clients using them as pointers. It is easier for us to model a symbolic value as a pointer rather than modeling a non-symbolic value as a pointer.
This patch causes:
- StoreManager::InvalidateRegion() to not used the casted type of a region if
  it would cause a pointer type to be invalidated as a non-pointer type.
- Pushes RegionStore::RetrieveElement() further by handling retrievals from
  symbolic arrays that have been invalidated.  This uses the new SymbolDerived
  construct that was recently introduced.
  
The result is that the failing test in misc-ps-region-store-x86_64.m now passes.
Both misc-ps-region-store-x86_64.m and misc-ps-region-store-i386.m contain a
test case that motivated this change.

llvm-svn: 75730
2009-07-15 02:31:43 +00:00
Ted Kremenek
0c37d19fea Enhance RegionStoreManager to handle 'Retrieve's from SymbolicRegions. We do this by silently wrapping the region with an ElementRegion. This fixes the failures in misc-ps-region-store.m.
llvm-svn: 75679
2009-07-14 20:48:22 +00:00
Zhongxing Xu
170e816eff Instead of recovering from a wrong invalidation, this patch aims to
invalidate the region correctly. It uses the cast-to type to invalidate 
the region when available. To avoid invalid cast-to type like 'void*' or 'id',
region store now only records non-generic casts of regions.

llvm-svn: 75580
2009-07-14 01:12:46 +00:00
Ted Kremenek
a6904ff7f9 Tidy pretty-printing for SVals, using 'dump()' instead of 'printStdErr()', and implementing operator<< support for llvm::raw_ostream.
llvm-svn: 75560
2009-07-13 23:53:06 +00:00
Ted Kremenek
eabdd984b1 Change pretty-printing API for SymExprs and MemRegions to use a naming convention and style similar to other elements in Clang.
llvm-svn: 75548
2009-07-13 23:31:04 +00:00
Ted Kremenek
f6f0461a38 Restructure RegionStoreManager::EvalBinOp() as a switch dispatch over different
MemRegion kinds. This allows the compiler to identify what MemRegions we don't
handle for pointer arithmetic.

llvm-svn: 75326
2009-07-11 00:58:27 +00:00
Ted Kremenek
94575aacc1 Restructure RegionStoreManager::getSizeInElements() to use a switch statement
over the types of MemRegions. This allows the compiler to warn us which regions
are not handled, and also is a little faster.

llvm-svn: 75304
2009-07-10 22:30:06 +00:00
Ted Kremenek
9e010e11c3 Move the new 'CastRegion' implementation from RegionStoreManager to StoreManager
(its superclass). This will allow us to experiment with using the new CastRegion
with BasicStoreManager, and gradually phase out the old implementation.

llvm-svn: 74851
2009-07-06 20:21:51 +00:00
Zhongxing Xu
61e6692993 remove utility methods that are not very useful.
llvm-svn: 74762
2009-07-03 06:11:41 +00:00
Ted Kremenek
194f46a11a Remove unused method.
llvm-svn: 74751
2009-07-03 00:41:09 +00:00
Ted Kremenek
06cc0e31b2 Replace guarded calls in RegionStoreManager to
ValueManager::getRegionValueSymbolVal() with unguarded calls to
ValueManager::getRegionValueSymbolValOrUnknown(). This changes centralizes the
decision of what values to symbolicate in SymbolManager rather than having it
scatter in RegionStoreManager.

llvm-svn: 74730
2009-07-02 22:16:42 +00:00
Ted Kremenek
725b4a3a51 Enhance RegionStore to lazily symbolicate fields and array elements for
structures passed-by-value as function arguments.

llvm-svn: 74729
2009-07-02 22:02:15 +00:00
Ted Kremenek
df67d426d9 StoreManagers: Use 'hasGlobalsStorage()' and 'hasParametersStorage()' instead of
directly consulting if a VarDecl is an implicit or actual parameter, a global,
etc.

llvm-svn: 74716
2009-07-02 18:25:09 +00:00
Ted Kremenek
873db25879 Minor code cleanup: pull variables into scope of 'if' statement, limiting their
actual lifetime to their logical lifetime.

llvm-svn: 74665
2009-07-01 23:30:34 +00:00
Ted Kremenek
55e07efeed Add a FIXME to RegionStore, do some minor code cleanup, and get RegionStore to
pass misc-ps.m. Currently RegionStore/BasicStore don't do any special reasoning
about clang-style vectors, so we should return UnknownVal (in all cases) when
accessing their values via an array.

llvm-svn: 74660
2009-07-01 23:19:52 +00:00
Zhongxing Xu
b4ce4fc4ee add fixme.
llvm-svn: 74581
2009-07-01 02:12:57 +00:00
Zhongxing Xu
e205d43c75 When retrieving element region, if its super region has binding, return
unknown for it.

Mark the super region of a live region as live, if the live region is pointed
to by a live pointer variable.

These fixes xfail_regionstore_wine_crash.c.

llvm-svn: 74524
2009-06-30 12:32:59 +00:00
Argyrios Kyrtzidis
cfbfe78e9e De-ASTContext-ify DeclContext.
Remove ASTContext parameter from DeclContext's methods. This change cascaded down to other Decl's methods and changes to call sites started "escalating".
Timings using pre-tokenized "cocoa.h" showed only a ~1% increase in time run between and after this commit.

llvm-svn: 74506
2009-06-30 02:36:12 +00:00
Zhongxing Xu
0628f539a8 Adjust retrieve handler priority. If a field is of array type, it should be
handled by RetrieveArray().

llvm-svn: 74409
2009-06-28 14:16:39 +00:00
Zhongxing Xu
d260db1238 Do not crash on binding concrete integer location.
llvm-svn: 74407
2009-06-28 10:16:11 +00:00
Ted Kremenek
af1ac826f6 Update method signature.
llvm-svn: 74244
2009-06-26 00:41:43 +00:00
Ted Kremenek
1642bdaaa5 Introduce a new concept to the static analyzer: SValuator.
GRTransferFuncs had the conflated role of both constructing SVals (symbolic
expressions) as well as handling checker-specific logic. Now SValuator has the
role of constructing SVals from expressions and GRTransferFuncs just handles
checker-specific logic. The motivation is by separating these two concepts we
will be able to much more easily create richer constraint-generating logic
without coupling it to the main checker transfer function logic.

We now have one implementation of SValuator: SimpleSValuator.

SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals
(which is removed in this patch). This includes the logic for EvalBinOp,
EvalCast, etc. Because SValuator has a narrower role than the old
GRTransferFuncs, the interfaces are much simpler, and so is the implementation
of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of
SVal-related logic in GRSimpleVals and cleaned it up while moving it over to
SimpleSValuator.

As a consequence of removing GRSimpleVals, there is no longer a
'-checker-simple' option. The '-checker-cfref' did everything that option did
but also ran the retain/release checker. Of course a user may not always wish to
run the retain/release checker, nor do we wish core analysis logic buried in the
checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp
to separate out these pieces into the core analysis engine.

llvm-svn: 74229
2009-06-26 00:05:51 +00:00
Zhongxing Xu
c53b444d36 remove RegionKills GDM. Now UnknownVal is bound to regions explicitly.
llvm-svn: 74168
2009-06-25 05:52:16 +00:00
Zhongxing Xu
2d16073b50 Move element region retrieving logic into a separate function.
llvm-svn: 74166
2009-06-25 05:29:39 +00:00
Zhongxing Xu
e67ea5c784 Move all logic for retrieving ElementRegion binding into a separate method.
Revert to setting default value approach for handling struct initialization.

llvm-svn: 74160
2009-06-25 04:50:44 +00:00
Ted Kremenek
799bb6e178 Remove uses of std::ostream from libAnalysis.
llvm-svn: 74136
2009-06-24 23:06:47 +00:00
Zhongxing Xu
33420090ae use a concrete type instead of a trait type to make code more readable.
llvm-svn: 74047
2009-06-24 01:12:41 +00:00
Zhongxing Xu
9ef415edf2 RegionStore: revert to the default value approach for array initialization.
llvm-svn: 74043
2009-06-24 00:56:31 +00:00
Ted Kremenek
2d99f97c17 - Add MemRegion::getMemorySpace()
- Change implementation of MemRegion::hasStackStorage()/hasHeapStorage() to use
  'getMemorySpace()'.  This avoids a double traversal up the region hierarchy
  and is simpler.
- Add MemRegion::hasHeapOrStackStorage() as a slightly more efficient
  alternative to 'hasStackStorage() || hasHeapStorage()'.

llvm-svn: 73977
2009-06-23 18:17:08 +00:00
Ted Kremenek
404b132dc0 Move 'hasStackStorage()' and 'hasHeapStorage()' from MemRegionManager to MemRegion.
llvm-svn: 73973
2009-06-23 18:05:21 +00:00
Zhongxing Xu
7718ae4701 Move all factory methods from SVal to ValueManager. API cleanup!
llvm-svn: 73954
2009-06-23 09:02:15 +00:00
Zhongxing Xu
d09b5205ef ValueManager::makeNonLoc -> ValueManager::makeIntVal
Clean up code with ValueManager.

llvm-svn: 73951
2009-06-23 06:13:19 +00:00
Zhongxing Xu
0442e962d9 If the init list is fewer than the struct fields, bind the rest fields to 0
explicitly. Make 0 value with the field type.

llvm-svn: 73949
2009-06-23 05:43:16 +00:00
Zhongxing Xu
b7cf95957d Instead of setting the default value of the array region, bind the rest of the
array elements to 0 explicitly. Create 0 values with the element type.

llvm-svn: 73946
2009-06-23 05:23:38 +00:00
Zhongxing Xu
1a195b264f Remove duplicated methods.
llvm-svn: 73940
2009-06-23 02:51:21 +00:00
Zhongxing Xu
74fa0bc3de add a fixme.
llvm-svn: 73939
2009-06-23 02:08:56 +00:00
Zhongxing Xu
8077d7eb15 Allow CodeTextRegion to be cast to 'void *'.
llvm-svn: 73880
2009-06-22 08:36:10 +00:00
Zhongxing Xu
540c009fbe Return UnknownVal for pointer arithmetic on struct fields.
llvm-svn: 73851
2009-06-21 13:24:24 +00:00
Zhongxing Xu
cc45762253 If the SymbolicRegion was cast to another type, use that type to create the
ElementRegion.

llvm-svn: 73754
2009-06-19 04:51:14 +00:00
Zhongxing Xu
cea6578078 When casting region, if we do not create an element region, record the cast-to
type. 

When retrieving the region value, if we are going to create a symbol value, use
the cast-to type if possible.

llvm-svn: 73690
2009-06-18 06:29:10 +00:00
Steve Naroff
fb4330f255 First step toward fixing <rdar://problem/6613046> refactor clang objc type representation.
Add a type (ObjCObjectPointerType) and remove a type (ObjCQualifiedIdType).

This large/tedious patch is just a first step. Next step is to remove ObjCQualifiedInterfaceType. After that, I will remove the magic TypedefType for 'id' (installed by Sema). This work will enable various simplifications throughout clang (when dealing with ObjC types). 

No functionality change.

llvm-svn: 73649
2009-06-17 22:40:22 +00:00