summaryrefslogtreecommitdiffstats
path: root/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* Merging r311182:Hans Wennborg2017-08-211-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ------------------------------------------------------------------------ r311182 | alexshap | 2017-08-18 11:20:43 -0700 (Fri, 18 Aug 2017) | 22 lines [analyzer] Fix modeling of constructors This diff fixes analyzer's crash (triggered assert) on the newly added test case. The assert being discussed is assert(!B.lookup(R, BindingKey::Direct)) in lib/StaticAnalyzer/Core/RegionStore.cpp, however the root cause is different. For classes with empty bases the offsets might be tricky. For example, let's assume we have struct S: NonEmptyBase, EmptyBase { ... }; In this case Clang applies empty base class optimization and the offset of EmptyBase will be 0, it can be verified via clang -cc1 -x c++ -v -fdump-record-layouts main.cpp -emit-llvm -o /dev/null. When the analyzer tries to perform zero initialization of EmptyBase it will hit the assert because that region has already been "written" by the constructor of NonEmptyBase. Test plan: make check-all Differential revision: https://reviews.llvm.org/D36851 ------------------------------------------------------------------------ git-svn-id: https://llvm.org/svn/llvm-project/cfe/branches/release_50@311378 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add annotation attribute to trust retain count implementationDevin Coughlin2017-07-191-4/+31
| | | | | | | | | | | | | | | | | Add support to the retain-count checker for an annotation indicating that a function's implementation should be trusted by the retain count checker. Functions with these attributes will not be inlined and the arguments will be treating as escaping. Adding this annotation avoids spurious diagnostics when the implementation of a reference counting operation is visible but the analyzer can't reason precisely about the ref count. Patch by Malhar Thakkar! Differential Revision: https://reviews.llvm.org/D34937 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@308416 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add annotation for functions taking user-facing stringsErik Verbruggen2017-07-141-10/+59
| | | | | | | | | | | | | | | | | There was already a returns_localized_nsstring annotation to indicate that the return value could be passed to UIKit methods that would display them. However, those UIKit methods were hard-coded, and it was not possible to indicate that other classes/methods in a code-base would do the same. The takes_localized_nsstring annotation can be put on function parameters and selector parameters to indicate that those will also show the string to the user. Differential Revision: https://reviews.llvm.org/D35186 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@308012 91177308-0d34-0410-b5e6-96231b3b80d8
* Revert "[analyzer] Support generating and reasoning over more symbolic ↵Dominic Chen2017-07-123-38/+22
| | | | | | | | | | constraint types" Assertion `Loc::isLocType(SSE->getLHS()->getType())' failed in Analysis/PR3991.m This reverts commit e469ff2759275e67f9072b3d67fac90f647c0fe6. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@307853 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Support generating and reasoning over more symbolic constraint typesDominic Chen2017-07-123-22/+38
| | | | | | | | | | | | Summary: Generate more IntSymExpr constraints, perform SVal simplification for IntSymExpr and SymbolCast constraints, and create fully symbolic SymExprs Reviewers: zaks.anna, dcoughlin, NoQ, xazax.hun Subscribers: mgorny, cfe-commits Differential Revision: https://reviews.llvm.org/D28953 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@307833 91177308-0d34-0410-b5e6-96231b3b80d8
* CFG: Add CFGElement for automatic variables that leave the scopeMatthias Gehre2017-07-124-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This mimics the implementation for the implicit destructors. The generation of this scope leaving elements is hidden behind a flag to the CFGBuilder, thus it should not affect existing code. Currently, I'm missing a test (it's implicitly tested by the clang-tidy lifetime checker that I'm proposing). I though about a test using debug.DumpCFG, but then I would have to add an option to StaticAnalyzer/Core/AnalyzerOptions to enable the scope leaving CFGElement, which would only be useful to that particular test. Any other ideas how I could make a test for this feature? Reviewers: krememek, jordan_rose Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D15031 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@307759 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Start fixing modeling of bool based typesAlexander Shaposhnikov2017-07-111-5/+2
| | | | | | | | | | | | | | | | | | | | This is a follow up for one of the previous diffs https://reviews.llvm.org/D32328. getTypeSize and with getIntWidth are not equivalent for bool (see https://clang.llvm.org/doxygen/ASTContext_8cpp_source.html#l08444), this causes a number of issues (for instance, if APint X representing a bool is created with the wrong bit width then X is not comparable against Min/Max (because of the different bit width), that results in crashes (triggered asserts) inside assume* methods), for examples see the newly added test cases. Test plan: make check-all Differential revision: https://reviews.llvm.org/D35041 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@307604 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Move zero-size allocation checks to optin.portability.Artem Dergachev2017-06-271-20/+35
| | | | | | | | | | | | | | | This is a new checker package. It contains checkers that highlight well-documented implementation-defined behavior. Such checkers are only useful to developers that intend to write portable code. Code that is only compiled for a single platform should be allowed to rely on this platform's specific documented behavior. rdar://problem/30545046 Differential Revision: https://reviews.llvm.org/D34102 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@306396 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Do not continue to analyze a path if the constraints contradict ↵Gabor Horvath2017-06-221-1/+3
| | | | | | | | | with builtin assume Differential Revision: https://reviews.llvm.org/D34502 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305991 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Bump a few default performance thresholds.Artem Dergachev2017-06-211-2/+2
| | | | | | | | | | | | | | | This makes the analyzer around 10% slower by default, allowing it to find deeper bugs. Default values for the following -analyzer-config change: max-nodes: 150000 -> 225000; max-inlinable-size: 50 -> 100. rdar://problem/32539666 Differential Revision: https://reviews.llvm.org/D34277 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305900 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] LocalizationChecker: Support new localizable APIs.Artem Dergachev2017-06-211-0/+43
| | | | | | | | | | | | | Add support for new methods that were added in macOS High Sierra & iOS 11 and require a localized string. Patch by Kulpreet Chilana! rdar://problem/32795210 Differential Revision: https://reviews.llvm.org/D34266 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305896 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Teach CloneDetection about Qt Meta-Object Compiler to filter auto ↵Leslie Zhai2017-06-201-1/+1
| | | | | | | | | | | | | generated files Reviewers: v.g.vassilev, teemperor Reviewed By: teemperor Differential Revision: https://reviews.llvm.org/D34353 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305774 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Check NULL pointer dereference issue for memset functionLeslie Zhai2017-06-201-0/+51
| | | | | | | | | | | Reviewers: dcoughlin, zaks.anna, NoQ, danielmarjamaki Reviewed By: NoQ, danielmarjamaki Differential Revision: https://reviews.llvm.org/D31868 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305773 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix logical not for pointers with different bit widthDaniel Marjamaki2017-06-191-3/+2
| | | | | | | Differential Revision: https://reviews.llvm.org/D31029 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305669 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Teach CloneDetection about Qt Meta-Object CompilerLeslie Zhai2017-06-191-1/+6
| | | | | | | | | | | Reviewers: v.g.vassilev, zaks.anna, NoQ, teemperor Reviewed By: v.g.vassilev, zaks.anna, NoQ, teemperor Differential Revision: https://reviews.llvm.org/D31320 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305659 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix a crash when an ObjC object is constructed in AllocaRegion.Artem Dergachev2017-06-121-0/+6
| | | | | | | | | | | | | Memory region allocated by alloca() carries no implicit type information. Don't crash when resolving the init message for an Objective-C object that is being constructed in such region. rdar://problem/32517077 Differential Revision: https://reviews.llvm.org/D33828 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@305211 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Don't add arrow to the inlined function's decl when it has no body.Artem Dergachev2017-06-051-3/+9
| | | | | | | | | | | | | | In plist output mode with alternate path diagnostics, when entering a function, we draw an arrow from the caller to the beginning of the callee's declaration. Upon exiting, however, we draw the arrow from the last statement in the callee function. The former makes little sense when the declaration is not a definition, i.e. has no body, which may happen in case the body is coming from a body farm, eg. Objective-C autosynthesized property accessor. Differential Revision: https://reviews.llvm.org/D33671 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304713 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Nullability: fix notes around synthesized ObjC property accessors.Artem Dergachev2017-06-052-3/+45
| | | | | | | | | | | | | | Nullable-to-nonnull checks used to crash when the custom bug visitor was trying to add its notes to autosynthesized accessors of Objective-C properties. Now we avoid this, mostly automatically outside of checker control, by moving the diagnostic to the parent stack frame where the accessor has been called. Differential revision: https://reviews.llvm.org/D32437 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304710 91177308-0d34-0410-b5e6-96231b3b80d8
* Added LLVM_FALLTHROUGH to address warning: this statement may fall through. NFC.Galina Kistanova2017-06-034-0/+4
| | | | git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304644 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix immutable map factory lifetime for partial taint.Artem Dergachev2017-05-291-13/+10
| | | | | | | | | | This should fix the leaks found by asan buildbot in r304162. Also don't store a reference to the factory with every map value, which is the only difference between ImmutableMap and ImmutableMapRef. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304170 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Support partially tainted records.Artem Dergachev2017-05-293-80/+111
| | | | | | | | | | | | | | | | | The analyzer's taint analysis can now reason about structures or arrays originating from taint sources in which only certain sections are tainted. In particular, it also benefits modeling functions like read(), which may read tainted data into a section of a structure, but RegionStore is incapable of expressing the fact that the rest of the structure remains intact, even if we try to model read() directly. Patch by Vlad Tsyrklevich! Differential revision: https://reviews.llvm.org/D28445 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304162 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Initial commit for the upcoming refactoring of the IteratorChecker.Artem Dergachev2017-05-293-841/+834
| | | | | | | | | | | | | | | | The new checker currently contains the very core infrastructure for tracking the state of iterator-type objects in the analyzer: relating iterators to their containers, tracking symbolic begin and end iterator values for containers, and solving simple equality-type constraints over iterators. A single specific check over this infrastructure is capable of finding usage of out-of-range iterators in some simple cases. Patch by Ádám Balogh! Differential revision: https://reviews.llvm.org/D32592 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304160 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] PthreadLockChecker: model failed pthread_mutex_destroy() calls.Artem Dergachev2017-05-291-13/+133
| | | | | | | | | | | | | | pthread_mutex_destroy() may fail, returning a non-zero error number, and keeping the mutex untouched. The mutex can be used on the execution branch that follows such failure, so the analyzer shouldn't warn on using a mutex that was previously destroyed, when in fact the destroy call has failed. Patch by Malhar Thakkar! Differential revision: https://reviews.llvm.org/D32449 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@304159 91177308-0d34-0410-b5e6-96231b3b80d8
* [Statistics] Use the new Statistic::updateMax to atomically calculate a ↵Craig Topper2017-05-182-8/+4
| | | | | | maximum value statistic. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@303320 91177308-0d34-0410-b5e6-96231b3b80d8
* [StaticAnalyzer] Move inline counter increaser to inlineCall functionPeter Szecsi2017-05-161-2/+1
| | | | | | | | | | | | Even though the shouldInlineCall function returns true, it can happen that the function is not going to be inlined (as it can be seen at line 913 and below). Moved the bumpNumTimesInlined(D) (the counter increaser) call to the inlineCall function where it logically belongs. Differential Revision: https://reviews.llvm.org/D32179 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@303158 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add modelling of __builtin_assumeGabor Horvath2017-05-121-0/+16
| | | | | | | Differential Revision: https://reviews.llvm.org/D33092 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@302880 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Avoid an allocation in Std C function modellingGabor Horvath2017-05-121-1/+4
| | | | | | | Differential Revision: https://reviews.llvm.org/D33095 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@302879 91177308-0d34-0410-b5e6-96231b3b80d8
* Use clang++-3.5 compatible initializer_list constructorSerge Guelton2017-05-101-1/+1
| | | | | | | Otherwise, a warning is issued. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@302654 91177308-0d34-0410-b5e6-96231b3b80d8
* Suppress all uses of LLVM_END_WITH_NULL. NFC.Serge Guelton2017-05-094-85/+52
| | | | | | | | | | | Use variadic templates instead of relying on <cstdarg> + sentinel. This enforces better type checking and makes code more readable. Differential revision: https://reviews.llvm.org/D32550 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@302572 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix memory error bug category capitalization.Artem Dergachev2017-05-034-18/+23
| | | | | | | | | | | | | It was written as "Memory Error" in most places and as "Memory error" in a few other places, however it is the latter that is more consistent with other categories (such as "Logic error"). rdar://problem/31718115 Differential Revision: https://reviews.llvm.org/D32702 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@302016 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Detect bad free of function pointersDaniel Marjamaki2017-05-021-1/+44
| | | | | | | Differential Revision: https://reviews.llvm.org/D31650 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@301913 91177308-0d34-0410-b5e6-96231b3b80d8
* Refactor frontend InputKind to prepare for treating module maps as a ↵Richard Smith2017-04-261-1/+1
| | | | | | | | | distinct kind of input. No functionality change intended. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@301442 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Teach the MallocChecker about Glib API for two argumentsLeslie Zhai2017-04-261-28/+74
| | | | | | | | | | | | | Reviewers: zaks.anna, NoQ, danielmarjamaki Reviewed By: zaks.anna, NoQ, danielmarjamaki Subscribers: cfe-commits, kalev, pwithnall Differential Revision: https://reviews.llvm.org/D30771 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@301384 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Improve subscripting null arrays for catching null dereferences.Artem Dergachev2017-04-242-10/+12
| | | | | | | | | | | | | | Array-to-pointer cast now works correctly when the pointer to the array is concrete, eg. null, which allows further symbolic calculations involving such values. Inlined defensive checks are now detected correctly when the resulting null symbol is being array-subscripted before dereference. Differential Revision: https://reviews.llvm.org/D32291 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@301251 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Improve suppression for inlined defensive checks before operator &.Artem Dergachev2017-04-242-3/+29
| | | | | | | | | | | | | | | | | | | | Null dereferences are suppressed if the lvalue was constrained to 0 for the first time inside a sub-function that was inlined during analysis, because such constraint is a valid defensive check that does not, by itself, indicate that null pointer case is anyhow special for the caller. If further operations on the lvalue are performed, the symbolic lvalue is collapsed to concrete null pointer, and we need to track where does the null pointer come from. Improve such tracking for lvalue operations involving operator &. rdar://problem/27876009 Differential Revision: https://reviews.llvm.org/D31982 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@301224 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix assert in ExprEngine::processSwitchAlexander Shaposhnikov2017-04-211-2/+2
| | | | | | | | | | | | | | | | This diff replaces getTypeSize(CondE->getType())) with getIntWidth(CondE->getType())) in ExprEngine::processSwitch. These calls are not equivalent for bool, see ASTContext.cpp Add a test case. Test plan: make check-clang-analysis make check-clang Differential revision: https://reviews.llvm.org/D32328 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300936 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Enforce super-region classes for various memory regions.Artem Dergachev2017-04-136-51/+58
| | | | | | | | | | | | | We now check the type of the super-region pointer for most SubRegion classes in compile time; some checks are run-time though. This is an API-breaking change (we now require explicit casts to specific region sub-classes), but in practice very few checkers are affected. Differential Revision: https://reviews.llvm.org/D26838 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300189 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add numerous assertions to SVal, SymExpr, and MemRegion classes.Artem Dergachev2017-04-131-4/+2
| | | | | | | | | | | | | | | Clean up vtable anchors (remove anchors for regions that have regular out-of-line virtual methods, add anchors for regions that don't have those). Fix private/public methods (all constructors should now be private for leaf classes, protected for abstract classes). No functional change intended, only extra sanity checks and cleanups. Differential Revision: https://reviews.llvm.org/D26837 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300187 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Simplify values in binary operations a bit more aggressively.Artem Dergachev2017-04-131-5/+82
| | | | | | | | | | | | | | | | | | SValBuilder tries to constant-fold symbols in the left-hand side of the symbolic expression whenever it fails to evaluate the expression directly. However, it only constant-folds them when they are atomic expressions, not when they are complicated expressions themselves. This patch adds recursive constant-folding to the left-hand side subexpression (there's a lack of symmetry because we're trying to have symbols on the left and constants on the right). As an example, we'd now be able to handle operations similar to "$x + 1 < $y", when $x is constrained to a constant. rdar://problem/31354676 Differential Revision: https://reviews.llvm.org/D31886 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300178 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add a check for IvarRegion in getExtraInvalidatedValuesAlexander Shaposhnikov2017-04-121-5/+7
| | | | | | | | | | | | | This diff adds a defensive check in getExtraInvalidatedValues for the case when there are no regions for the ivar associated with a property. Corresponding test case added. Test plan: make check-clang make check-clang-analysis git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@300114 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Reland r299544 "Add a modular constraint system to the CloneDetector"Artem Dergachev2017-04-061-31/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Hopefully fix crashes by unshadowing the variable. Original commit message: A big part of the clone detection code is functionality for filtering clones and clone groups based on different criteria. So far this filtering process was hardcoded into the CloneDetector class, which made it hard to understand and, ultimately, to extend. This patch splits the CloneDetector's logic into a sequence of reusable constraints that are used for filtering clone groups. These constraints can be turned on and off and reodreder at will, and new constraints are easy to implement if necessary. Unit tests are added for the new constraint interface. This is a refactoring patch - no functional change intended. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23418 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299653 91177308-0d34-0410-b5e6-96231b3b80d8
* Revert "[analyzer] Add a modular constraint system to the CloneDetector"Artem Dergachev2017-04-051-69/+31
| | | | | | | | | This reverts commit r299544. Crashes on tests on some buildbots. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299550 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add a modular constraint system to the CloneDetectorArtem Dergachev2017-04-051-31/+69
| | | | | | | | | | | | | | | | | | | | | | | A big part of the clone detection code is functionality for filtering clones and clone groups based on different criteria. So far this filtering process was hardcoded into the CloneDetector class, which made it hard to understand and, ultimately, to extend. This patch splits the CloneDetector's logic into a sequence of reusable constraints that are used for filtering clone groups. These constraints can be turned on and off and reodreder at will, and new constraints are easy to implement if necessary. Unit tests are added for the new constraint interface. This is a refactoring patch - no functional change intended. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D23418 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299544 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] alpha.core.Conversion - Fix false positive for 'U32 += S16;' ↵Daniel Marjamaki2017-04-051-10/+32
| | | | | | | | | | | | | expression, that is not unsafe Summary: The alpha.core.Conversion was too strict about compound assignments and could warn even though there is no problem. Differential Revision: https://reviews.llvm.org/D25596 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299523 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add new Z3 constraint manager backendDominic Chen2017-04-042-0/+1634
| | | | | | | | | | | | Summary: Implement new Z3 constraint manager backend. Reviewers: zaks.anna, dcoughlin, NoQ, xazax.hun Subscribers: mgorny, cfe-commits Differential Revision: https://reviews.llvm.org/D28952 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299463 91177308-0d34-0410-b5e6-96231b3b80d8
* Spelling mistakes in comments. NFCI. (PR27635)Simon Pilgrim2017-03-304-8/+8
| | | | git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@299083 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Fix symbolication for unknown unary increment/decrement results.Artem Dergachev2017-03-282-1/+10
| | | | | | | | | | | | | | | | If the value is known, but we cannot increment it, conjure a symbol to represent the result of the operation based on the operator expression, not on the sub-expression. In particular, no longer crash on comparing a result of a LocAsInteger increment to a constant integer. rdar://problem/31067356 Differential Revision: https://reviews.llvm.org/D31289 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@298927 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] When creating a temporary object, properly copy the value into it.Artem Dergachev2017-03-282-23/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adjustments should be considered properly; we should copy the unadjusted object over the whole temporary base region. If the unadjusted object is no longer available in the Environment, invalidate the temporary base region, and then copy the adjusted object into the adjusted sub-region of the temporary region. This fixes a regression introduced by r288263, that caused various false positives, due to copying only adjusted object into the adjusted region; the rest of the base region therefore remained undefined. Before r288263, the adjusted value was copied over the unadjusted region, which is incorrect, but accidentally worked better due to how region store disregards compound value bindings to non-base regions. An additional test machinery is introduced to make sure that despite making two binds, we only notify checkers once for both of them, without exposing the partially copied objects. This fix is a hack over a hack. The proper fix would be to model C++ temporaries in the CFG, and after that dealing with adjustments would no longer be necessary, and the values we need would no longer disappear from the Environment. rdar://problem/30658168 Differential Revision: https://reviews.llvm.org/D30534 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@298924 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] MisusedMovedObject: Remove deprecated callback. NFCArtem Dergachev2017-03-241-7/+0
| | | | | | | | | wantsRegionChangeUpdate() checker callback is no longer used since recently. Fixes a buildbot warning. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@298699 91177308-0d34-0410-b5e6-96231b3b80d8
* [analyzer] Add MisusedMovedObjectChecker for detecting use-after-move errors.Artem Dergachev2017-03-242-0/+489
| | | | | | | | | | | | | The checker currently warns on copying, moving, or calling methods on an object that was recently std::move'd from. It understands a set of "state reset" methods that bring a moved-from object back to a well-specified state. Patch by Peter Szecsi! Differential Revision: https://reviews.llvm.org/D24246 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@298698 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 05:00:13 +0000