272 Commits

Author SHA1 Message Date
Ted Kremenek
d93c6e3fd6 Remove more dependencies on GRStateRef. As a consequence, we can now
pretty-print a GRState object anywhere it is referenced (instead of
needing a GRStateRef of a GRStateManager handy).

llvm-svn: 73669
2009-06-18 01:23:53 +00:00
Chris Lattner
15ba94987a Sink the BuiltinInfo object from ASTContext into the
preprocessor and initialize it early in clang-cc.  This
ensures that __has_builtin works in all modes, not just
when ASTContext is around.

llvm-svn: 73319
2009-06-14 01:54:56 +00:00
Zhongxing Xu
a7907608fb * API change: we need to pass GRState to GRExprEngine::EvalBinOp() because
RegionStore needs to know the type of alloca region. 
* RegionStoreManager::EvalBinOp() now converts the alloca region to its first
  element region, as what is done to symbolic region.

llvm-svn: 72164
2009-05-20 09:00:16 +00:00
Zhongxing Xu
34d04b3ca9 As discussed with Ted, rename TypedRegion::getObjectType() to
TypedRegion::getValueType().

llvm-svn: 71321
2009-05-09 03:57:34 +00:00
Zhongxing Xu
8038f7b30f rename: MemRegion:
RValueType => ObjectType
 LValueType => LocationType

No functionality change.

llvm-svn: 71304
2009-05-09 00:50:33 +00:00
Ted Kremenek
a6e08327c0 analyzer: Add ProgramPoint 'PostLValue' just to distinguish (for
analysis introspection) when we computed an lvalue.  This shouldn't
effect the current analysis results in any way.

llvm-svn: 71169
2009-05-07 18:27:16 +00:00
Ted Kremenek
02e508960c Per conversations with Zhongxing, add an 'element type' to
ElementRegion.  I also removed 'ElementRegion::getArrayRegion',
although we may need to add this back.

This breaks a few test cases with RegionStore:
- 'array-struct.c' triggers an infinite recursion in RegionStoreManager.  Need to investigate.
- misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic:
  'Line 159: Uninitialized or undefined return value returned to caller.'
  
There were a bunch of places that needed to be edit
RegionStoreManager, and we may not be passing all the correct 'element
types' down from GRExprEngine.

Zhongxing: When you get a chance, could you review this?  I could have
easily screwed up something basic in RegionStoreManager.

llvm-svn: 70830
2009-05-04 06:18:28 +00:00
Chris Lattner
f0b64d73a8 split ObjC and C++ Statements out into their own headers.
llvm-svn: 70105
2009-04-26 01:32:48 +00:00
Ted Kremenek
9c03f68206 Fix PR 4033: the analyzer shouldn't crash on computed gotos involving symbolic
target addresses.

llvm-svn: 69900
2009-04-23 17:49:43 +00:00
Ted Kremenek
fe95afd0bc Fix crash reported in PR 3991. The analyzer doesn't reason about ObjCKVCExpr.
llvm-svn: 69754
2009-04-21 23:53:32 +00:00
Ted Kremenek
35f875c136 Fix: <rdar://problem/6777209> false Dereference of null pointer in loop: pointer increment/decrement preserves non-nullness
When the StoreManager doesn't reason well about pointer-arithmetic, propagate
the non-nullness constraint on a pointer value when performing pointer
arithmetic uisng ++/--.

llvm-svn: 69741
2009-04-21 22:38:05 +00:00
Zhongxing Xu
ac1294318d get a CodeTextRegion when visiting FunctionDecl reference.
get FunctionDecl with more general utility method.

llvm-svn: 69570
2009-04-20 05:24:46 +00:00
Ted Kremenek
4531be138c Add analyzer support for objc_atomicCompareAndSwap()
llvm-svn: 68849
2009-04-11 00:54:13 +00:00
Ted Kremenek
df24000d24 Implement analyzer support for OSCompareAndSwap. This required pushing "tagged"
ProgramPoints all the way through to GRCoreEngine.

NSString.m now fails with RegionStoreManager because of the void** cast.
Disabling use of region store for that test for now.

llvm-svn: 68845
2009-04-11 00:11:10 +00:00
Zhongxing Xu
dadf250598 Finally nuke loc::SymbolVal.
llvm-svn: 68771
2009-04-10 06:06:13 +00:00
Ted Kremenek
5054663daa Fix: <rdar://problem/6776949> Branch condition evaluates to an uninitialized value (argc is guaranteed to be >= 1)
The analyzer now adds the precondition that the first argument of 'main' is > 0.

llvm-svn: 68757
2009-04-10 00:59:50 +00:00
Ted Kremenek
40f4ee74fd Implement attribute "analyzer_noreturn" (<rdar://problem/6777003>). This allows
clients of the analyzer to designate custom assertion routines as "noreturn"
functions from the analyzer's perspective but not the compiler's.

llvm-svn: 68746
2009-04-10 00:01:14 +00:00
Ted Kremenek
f2489ea043 - Move ownership of MemRegionManager into ValueManager.
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly
simplifies the calling interface to clients.

llvm-svn: 68731
2009-04-09 22:22:44 +00:00
Ted Kremenek
f8cb51c20e Remove SVal::MakeZero and replace it with ValueManager::makeZeroVal.
llvm-svn: 68711
2009-04-09 16:46:55 +00:00
Zhongxing Xu
783cd82487 clean up code with new API.
llvm-svn: 68700
2009-04-09 07:01:16 +00:00
Zhongxing Xu
726876b385 clean up code with new API.
llvm-svn: 68699
2009-04-09 06:56:25 +00:00
Zhongxing Xu
2945210d71 clean up code with new API.
llvm-svn: 68698
2009-04-09 06:53:24 +00:00
Zhongxing Xu
c48eb32872 stop using loc::SymbolVal.
llvm-svn: 68697
2009-04-09 06:49:52 +00:00
Ted Kremenek
2f3b0dbff4 Fix a null pointer dereference error due to state caching in a loop involving
sending a message to a nil receiver.

llvm-svn: 68686
2009-04-09 06:02:06 +00:00
Zhongxing Xu
cb5d3ced70 Create a symbolic region instead of a loc::SymbolVal. This is a continued step
to eliminate the use of loc::SymbolVal.

llvm-svn: 68685
2009-04-09 05:57:11 +00:00
Ted Kremenek
f9f9420303 GRExprEngine: Don't try to reason about the size of 'void' for the return type
of messages sent to nil.

llvm-svn: 68683
2009-04-09 05:45:56 +00:00
Ted Kremenek
c3f7c85129 Fix another regression introduced by changes to the analyzer's reasoning about
nil receivers in message expressions.

llvm-svn: 68672
2009-04-09 04:06:51 +00:00
Ted Kremenek
d937ed386e Refactor/cleanup reasoning of nil receivers in message expressions.
llvm-svn: 68661
2009-04-09 00:00:02 +00:00
Ted Kremenek
5451c60f5a Enhance analyzer reasoning about sending messages to nil. A nil receiver returns 0 for scalars of size <= sizeof(void*).
llvm-svn: 68629
2009-04-08 18:51:08 +00:00
Ted Kremenek
605fee8445 New static analyzer check by Nikita Zhuk!
"The attached patch generates warnings of cases where an ObjC message is sent to
a nil object and the size of return type of that message is larger than the size
of void pointer. This may result in undefined return values as described in PR
2718.  The patch also includes test cases."

llvm-svn: 68585
2009-04-08 03:07:17 +00:00
Zhongxing Xu
ec7e7dfe0a This is the first step to gradually remove the use of loc::SymbolVal. Now
when creating symbolic values, we distinguish between location and non-location
values. For location values, we create a symbolic region instead of a
loc::SymbolVal.

llvm-svn: 68373
2009-04-03 07:33:13 +00:00
Ted Kremenek
8b0dba358a Fix: <rdar://problem/6740387>. Sending nil to an object that returns a struct
should only be an error if that value is consumed. This fix was largely
accomplished by moving 'isConsumedExpr' back to ParentMap.

llvm-svn: 68195
2009-04-01 06:52:48 +00:00
Ted Kremenek
4967c8979e Add version of GRExprEngine::AddCheck that registered a GRSimpleAPICheck that
will be called for every expression in a basic block.

llvm-svn: 68041
2009-03-30 17:53:05 +00:00
Zhongxing Xu
a865b79f87 Implement a FIXME.
llvm-svn: 68024
2009-03-30 05:55:46 +00:00
Chris Lattner
529efc74ad rename some methods.
llvm-svn: 67923
2009-03-28 06:33:19 +00:00
Eli Friedman
8b7b1b1aee Change compound assignment operators to keep track of both the promoted
LHS type and the computation result type; this encodes information into 
the AST which is otherwise non-obvious.  Fix Sema to always come up with the 
right answer for both of these types.  Fix IRGen and the analyzer to 
account for these changes.  This fixes PR2601.  The approach is inspired 
by PR2601 comment 2.

Note that this changes real *= complex in CodeGen from a silent 
miscompilation to an explicit error.

I'm not really sure that the analyzer changes are correct, or how to 
test them... someone more familiar with the analyzer should check those 
changes.

llvm-svn: 67889
2009-03-28 01:22:36 +00:00
Ted Kremenek
3e31c26f81 analyzer infrastructure: make a bunch of changes to symbolic expressions that
Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731
2009-03-26 03:35:11 +00:00
Ted Kremenek
6b31533ad1 GRExprEngine:
- Conjure symbols at '--' and '++' unary operations
- Add utility method SVal::GetConjuredSymbolVal() and constify some arguments
  along the way.

llvm-svn: 67395
2009-03-20 20:10:45 +00:00
Ted Kremenek
891642e4da Fix PR 3836 by eagerly assuming symbolic constraints returned by unary '!'.
llvm-svn: 67260
2009-03-18 23:49:26 +00:00
Ted Kremenek
22358bd681 Add a hack in the analyzer to recover some path-sensitivity at branch
conditions. Currently the analyzer does not reason well about
promotions/truncations of symbolic values, so at branch conditions when we see:

  if (condition)
  
and condition is something like a 'short' or 'char', essentially ignore the
promotion to 'int' so that we track constraints on the original symbolic value.
We only ignore the casts if the underlying type has the same or fewer bits as
the converted type.

This fixes:

<rdar://problem/6619921>

llvm-svn: 66899
2009-03-13 16:32:54 +00:00
Ted Kremenek
32c41ec66e GRExprEngine::ProcessBranch: Don't register a "pretty-stack printer" when the Condition is null.
llvm-svn: 66636
2009-03-11 03:54:24 +00:00
Ted Kremenek
91076caabf GRExprEngine: Add pretty-stack trace printing for crashes and assertion failures.
llvm-svn: 66629
2009-03-11 02:41:36 +00:00
Ted Kremenek
44c12ef615 GRExprEngine: For places we might conjure up a new symbol to recover
path-sensitivity, beyond checking to see if the value is "unknown" also check if
the ConstraintManager can handle the SVal. This allows us to recover some
path-sensitivity by actually discarding some information.

llvm-svn: 66627
2009-03-11 02:24:48 +00:00
Ted Kremenek
95175052b2 Use the BugReports in BugReporter to determine the root nodes for "trim-egraph".
llvm-svn: 66622
2009-03-11 01:41:22 +00:00
Ted Kremenek
701e487520 Remove some dead spacing. No functionality change.
llvm-svn: 66437
2009-03-09 20:26:47 +00:00
Ted Kremenek
3add5e51ff Fix another GRExprEngine::VisitCast regression: handle casts of void* to function pointers.
llvm-svn: 66211
2009-03-05 22:47:06 +00:00
Ted Kremenek
a06a68fa9b Fix regression in GRExprEngine::VisitCast: Do not wrap symbolic function pointers with TypedViewRegions.
llvm-svn: 66187
2009-03-05 20:22:13 +00:00
Ted Kremenek
9ce427b21f Add 'cast<>' to remove an extra function call and dynamic cast.
llvm-svn: 66131
2009-03-05 03:44:53 +00:00
Ted Kremenek
d982bd83ba More fixes in cast logic.
llvm-svn: 66130
2009-03-05 03:42:31 +00:00
Ted Kremenek
eba836a457 GRExprEngine: Polish up handling of casting integer constants to pointers and back.
llvm-svn: 66127
2009-03-05 02:42:32 +00:00