8 Commits

Author SHA1 Message Date
Ted Kremenek
c4deb92316 Disallow the use of UnknownVal as the index for ElementRegions. UnknownVals can be used as
the index when the value evaluation isn't powerful enough.  By creating ElementRegions with
UnknownVals as the index, this gives the false impression that they are the same element, when
they really aren't.  This becomes really problematic when deriving symbols from these regions
(e.g., those representing the initial value of the index), since two different indices will
get the same symbol for their binding.

This fixes an issue with the idempotent operations checker that would cause two indices that
are clearly not the same to make it appear as if they always had the same value.

Fixes <rdar://problem/8431728>.

llvm-svn: 113920
2010-09-15 03:13:30 +00:00
John McCall
e302792b61 GCC didn't care for my attempt at API compatibility, so brute-force everything
to the new constants.

llvm-svn: 112047
2010-08-25 11:45:40 +00:00
Zhongxing Xu
5cba6c85c9 Remove a special case for OSAtomic functions. We can already bind and retrieve
with the same binding key. The only trick here is that sometimes the Symbolic
region is stored in with an LocAsInteger wrapper. We unwrap that in 
SVal::getAsLocSymbol().

llvm-svn: 111734
2010-08-21 11:00:26 +00:00
Tom Care
3ff08a8e76 Added a path-sensitive idempotent operation checker (-analyzer-idempotent-operation). Finds idempotent and/or tautological operations in a path sensitive context, flagging operations that have no effect or a predictable effect.
Example:
{
int a = 1;
int b = 5;
int c = b / a; // a is 1 on all paths
}

- New IdempotentOperationChecker class
- Moved recursive Stmt functions in r107675 to IdempotentOperationChecker
- Minor refactoring of SVal to allow checking for any integer
- Added command line option for check
- Added basic test cases

llvm-svn: 107706
2010-07-06 21:43:29 +00:00
Dan Gohman
145f3f1e83 Fix -Wcast-qual warnings.
llvm-svn: 101786
2010-04-19 16:39:44 +00:00
Zhongxing Xu
1bb6a1a593 Add use-after-free check to MallocChecker.
llvm-svn: 98136
2010-03-10 04:58:55 +00:00
Zhongxing Xu
bd96bf1e78 Change LazyCompoundVal to a <Store, MemRegion*> pair. We really don't need to
spread GRState* everywhere.

llvm-svn: 95354
2010-02-05 02:26:30 +00:00
Ted Kremenek
d6b8708643 Split libAnalysis into two libraries: libAnalysis and libChecker.
(1) libAnalysis is a generic analysis library that can be used by
    Sema.  It defines the CFG, basic dataflow analysis primitives, and
    inexpensive flow-sensitive analyses (e.g. LiveVariables).

(2) libChecker contains the guts of the static analyzer, incuding the
    path-sensitive analysis engine and domain-specific checks.

Now any clients that want to use the frontend to build their own tools
don't need to link in the entire static analyzer.

This change exposes various obvious cleanups that can be made to the
layout of files and headers in libChecker.  More changes pending.  :)

This change also exposed a layering violation between AnalysisContext
and MemRegion.  BlockInvocationContext shouldn't explicitly know about
BlockDataRegions.  For now I've removed the BlockDataRegion* from
BlockInvocationContext (removing context-sensitivity; although this
wasn't used yet).  We need to have a better way to extend
BlockInvocationContext (and any LocationContext) to add
context-sensitivty.

llvm-svn: 94406
2010-01-25 04:41:41 +00:00