126 Commits

Author SHA1 Message Date
Ted Kremenek
2d495a6f43 Refactor 'BasicStoreManager::CastRegion' and 'RegionStoreManager::CastRegion'
into StoreManager::CastRegion. Both methods were practically identical, and this
is core logic that is common to all StoreManagers since it defines the basic
invariants of the abstract memory model.

llvm-svn: 69730
2009-04-21 21:51:34 +00:00
Zhongxing Xu
3070210377 Remove loc::FuncVal.
llvm-svn: 69577
2009-04-20 06:35:22 +00:00
Zhongxing Xu
dadf250598 Finally nuke loc::SymbolVal.
llvm-svn: 68771
2009-04-10 06:06:13 +00:00
Ted Kremenek
f2489ea043 - Move ownership of MemRegionManager into ValueManager.
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly
simplifies the calling interface to clients.

llvm-svn: 68731
2009-04-09 22:22:44 +00:00
Douglas Gregor
bcced4ec31 Propagate the ASTContext to various AST traversal and lookup functions.
No functionality change (really).

llvm-svn: 68726
2009-04-09 21:40:53 +00:00
Zhongxing Xu
ec7e7dfe0a This is the first step to gradually remove the use of loc::SymbolVal. Now
when creating symbolic values, we distinguish between location and non-location
values. For location values, we create a symbolic region instead of a
loc::SymbolVal.

llvm-svn: 68373
2009-04-03 07:33:13 +00:00
Ted Kremenek
7857bd2743 Re-apply 68028. The code had drifted enough that the tests would fail without
it.  Will discuss offline whether symbolic regions should by typed or typeless.

llvm-svn: 68070
2009-03-30 22:20:54 +00:00
Ted Kremenek
5715393da2 Revert 68028.
llvm-svn: 68068
2009-03-30 21:56:17 +00:00
Zhongxing Xu
5415b207e3 Make SymbolicRegion untyped.
Layer the type information with a TypedViewRegion on top of the SymbolicRegion.

llvm-svn: 68028
2009-03-30 06:48:56 +00:00
Zhongxing Xu
a865b79f87 Implement a FIXME.
llvm-svn: 68024
2009-03-30 05:55:46 +00:00
Zhongxing Xu
17e28b7a54 remove dead code.
llvm-svn: 67825
2009-03-27 05:31:12 +00:00
Ted Kremenek
3e31c26f81 analyzer infrastructure: make a bunch of changes to symbolic expressions that
Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731
2009-03-26 03:35:11 +00:00
Zhongxing Xu
17299e6172 Use a work list to recursively build up the subregion mapping, and mark live
var region roots.

llvm-svn: 67152
2009-03-18 01:54:31 +00:00
Ted Kremenek
0bf152ef0b Updated comment.
llvm-svn: 66894
2009-03-13 15:39:16 +00:00
Ted Kremenek
ec94f08dce Fix failure reported by Sebastian of test/Analysis/ptr-arith.c when the target
is 64-bit. I used his suggestion of doing a direct bitwidth/signedness
conversion of the 'offset' instead of just changing the sign. For more
information, see:

http://lists.cs.uiuc.edu/pipermail/cfe-dev/2009-March/004587.html

llvm-svn: 66892
2009-03-13 15:35:24 +00:00
Zhongxing Xu
5a6fee9fb8 Use getAsRecordType() to get around sugar types.
llvm-svn: 66768
2009-03-12 03:45:35 +00:00
Zhongxing Xu
d2e89ae055 Do not stipulate the record type is a definition in BindStruct().
llvm-svn: 66654
2009-03-11 09:07:35 +00:00
Zhongxing Xu
507202ecb7 Fix crash when LHS of pointer arithmetic is not ElementRegion.
llvm-svn: 66649
2009-03-11 07:43:49 +00:00
Ted Kremenek
90e213f025 RegionStore::getLValueElement: Handle the case where the signedness of the
offset may be different that the base. Ultimately we need a better solution for
these issues, but this point-by-point fixes are gradually outlining the scope of
the problem.

llvm-svn: 66638
2009-03-11 04:04:20 +00:00
Ted Kremenek
0603222888 RegionStore::getElementLValue(): Handle the case where the base is a null pointer.
llvm-svn: 66486
2009-03-09 22:44:49 +00:00
Zhongxing Xu
7219d1bada Only track integer and pointer values.
llvm-svn: 66419
2009-03-09 09:31:22 +00:00
Zhongxing Xu
ce270a6dbc Now we do not retrieve untyped regions.
llvm-svn: 66418
2009-03-09 09:15:51 +00:00
Zhongxing Xu
b09280bcc0 Fix a serious bug in RegionStore: we got the new state with new store from
Bind() and BindStruct(), but we returned a state with the old store.

llvm-svn: 66409
2009-03-09 06:49:50 +00:00
Ted Kremenek
d3c82768e4 Add initial support for tracking ivars, with special handling for ivars of 'self'.
llvm-svn: 66133
2009-03-05 04:50:08 +00:00
Ted Kremenek
52170722ec RegionStore: Handle implicit parameters.
llvm-svn: 65987
2009-03-04 00:23:05 +00:00
Ted Kremenek
67c710e2c8 RegionStore::RemoveDeadBindings needs to check all the symbols of the super region of a scanned region as well.
llvm-svn: 65981
2009-03-04 00:11:38 +00:00
Ted Kremenek
9f276d6279 Don't use std::auto_ptr with getSubRegionMap().
llvm-svn: 65957
2009-03-03 19:02:42 +00:00
Ted Kremenek
4c8a5817a5 Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning MemRegions.
llvm-svn: 65919
2009-03-03 02:51:43 +00:00
Ted Kremenek
8dc671cdc9 Add StoreManager::getSubRegionMap(). This method returns an opaque mapping for clients of StoreManagers from MemRegions to their subregions.
llvm-svn: 65914
2009-03-03 01:35:36 +00:00
Zhongxing Xu
57359cad17 remove an implemented fixme.
llvm-svn: 65817
2009-03-02 08:25:09 +00:00
Zhongxing Xu
e7d1493216 Initial support for pointer arithmetic. Only support concrete indexes and
offsets for now.

llvm-svn: 65814
2009-03-02 07:52:23 +00:00
Ted Kremenek
07e95680fd Rename AnonTypedRegion to TypedViewRegion.
llvm-svn: 65764
2009-03-01 05:44:08 +00:00
Ted Kremenek
cce27f5502 Fix <rdar://problem/6611677>: Add basic transfer function support in the static
analyzer for array subscript expressions involving bases that are vectors. This
solution is probably a hack: it gets the lvalue of the vector instead of an
rvalue like all other types. This should be reviewed (big FIXME in
GRExprEngine).

llvm-svn: 65366
2009-02-24 02:23:11 +00:00
Zhongxing Xu
617bc3d02e Add an example in comments.
llvm-svn: 65110
2009-02-20 05:19:30 +00:00
Zhongxing Xu
69aac369c3 only track integer and pointer values for now.
llvm-svn: 65041
2009-02-19 09:56:08 +00:00
Zhongxing Xu
f74ab25e22 Convert the offset to signed before making an ElementRegion with it. It seems
that this problem arises from time to time. We should find a fundamental 
solution for it.

llvm-svn: 65035
2009-02-19 08:37:16 +00:00
Zhongxing Xu
e42755334c SymbolicRegions really have unknown sizes.
llvm-svn: 63929
2009-02-06 08:51:30 +00:00
Zhongxing Xu
dec48a50df Create ElementRegion when the base is SymbolicRegion. This is like what we do
for FieldRegion. This enables us to track more values.

Simplify SymbolicRegion::getRValueType(). We assume the symbol always has
pointer type.

llvm-svn: 63928
2009-02-06 08:44:27 +00:00
Zhongxing Xu
9103df1688 Make SymbolicRegion subclass TypedRegion, for symbols usually have types, so
do the symblic regions associated with them and we need them to be typed.

Current SymbolicRegion::getRValueType() method is very restricting. It may be
modified when we are more clear about what could be the types of symblic
regions.

BasicConstraintManager::Assume() is changed due to that now SymblicRegion is a
subclass of SubRegion.
 

llvm-svn: 63844
2009-02-05 06:57:29 +00:00
Ted Kremenek
7594e2a59a Fix a couple bugs:
- NonLoc::MakeVal() would use sizeof(unsigned) (literally) instead of consulting
  ASTContext for the size (in bits) of 'int'. While it worked, it was a
  conflation of concepts and using ASTContext.IntTy is 100% correct.
- RegionStore::getSizeInElements() no longer assumes that a VarRegion has the
  type "ConstantArray", and handles the case when uses use ordinary variables
  as if they were arrays.
- Fixed ElementRegion::getRValueType() to just return the rvalue type of its
  "array region" in the case the array didn't have ArrayType.
- All of this fixes <rdar://problem/6541136>

llvm-svn: 63347
2009-01-30 00:08:43 +00:00
Sebastian Redl
54cb4c88e1 Correct size assumption; fixes a crash on amd64.
llvm-svn: 63031
2009-01-26 19:54:12 +00:00
Zhongxing Xu
e37f9afb2e Implement retrieval of the default value of element and field regions.
llvm-svn: 62847
2009-01-23 11:22:12 +00:00
Zhongxing Xu
804f26a60a Now this comment should be resolved. See the comments for the KillSet.
llvm-svn: 62846
2009-01-23 10:42:17 +00:00
Ted Kremenek
2e1dfe25c5 For now, return UnknownVal() in RegionStore::getElementsSize() for AnonTypedRegions. It wasn't really doing the right thing and was crashing on rdar-6442306-1.m. This fix causes all path-sensitive test cases to pass with RegionStore.
llvm-svn: 62816
2009-01-22 23:56:56 +00:00
Ted Kremenek
fe0f1788ca Add RegionStore support for the implicit object region that 'self' references. This causes tests 'ObjCProperties.m' and 'refcnt_naming.m' to now pass with RegionStore.
llvm-svn: 62814
2009-01-22 23:43:57 +00:00
Ted Kremenek
92d48a71f5 Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781
2009-01-22 20:27:48 +00:00
Ted Kremenek
74040833e4 Static analyzer: Remove a bunch of outdated SymbolData objects and
their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769
2009-01-22 18:23:34 +00:00
Ted Kremenek
1322ca1364 Combine two branches into one. No functionality change.
llvm-svn: 62727
2009-01-21 22:58:50 +00:00
Ted Kremenek
16fbfe699e Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.
llvm-svn: 62722
2009-01-21 22:26:05 +00:00
Ted Kremenek
fe32cc0ba6 Get RegionStore to work with the retain/release checker and its test cases.
Because the RegionStore can reason about values beyond the reasoning power of BasicStore, this patch splits some of the test cases for the retain/release checker to have versions that are handled by RegionStore (more warnings) and BasicStore (less warnings).

llvm-svn: 62667
2009-01-21 06:57:53 +00:00