132 Commits

Author SHA1 Message Date
Richard Smith
c67fdd4eb9 AST representation for user-defined literals, plus just enough of semantic
analysis to make the AST representation testable. They are represented by a
new UserDefinedLiteral AST node, which is a sugared CallExpr. All semantic
properties, including full CodeGen support, are achieved for free by this
representation.

UserDefinedLiterals can never be dependent, so no custom instantiation
behavior is required. They are mangled as if they were direct calls to the
underlying literal operator. This matches g++'s apparent behavior (but not its
actual mangling, which is broken for literal-operator-ids).

User-defined *string* literals are now fully-operational, but the semantic
analysis is quite hacky and needs more work. No other forms of user-defined
literal are created yet, but the AST support for them is present.

This patch committed after midnight because we had already hit the quota for
new kinds of literal yesterday.

llvm-svn: 152211
2012-03-07 08:35:16 +00:00
Ted Kremenek
415287d943 Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.
llvm-svn: 152139
2012-03-06 20:06:12 +00:00
Erik Verbruggen
8c738bc98a Remove a recursive visitation in ExprEngine that is no longer needed because the CFG is fully linearized.
llvm-svn: 152007
2012-03-04 18:12:21 +00:00
Ted Kremenek
57207d6074 Teach the analyzer to just ignore CXXBindTemporaryExpr. There's nothing special to do with it, since destructors are represented explicitly in the CFG.
llvm-svn: 151856
2012-03-01 23:06:04 +00:00
Anna Zaks
b6e2854f68 [analyzer] Stats: Add the stats about remove dead bindings, correct the
test.

llvm-svn: 151656
2012-02-28 21:49:04 +00:00
Ted Kremenek
e0bce93e14 [analyzer] Don't generate an explicit ExplodedNode for StringLiterals; have the SVal lazily generated from Environment::getSVal().
llvm-svn: 151589
2012-02-27 23:34:19 +00:00
Anna Zaks
18de54b1a6 [analyzer] Run remove dead bindings before each call.
This ensures that we report the bugs associated with symbols going
out of scope in the correct function context.

llvm-svn: 151369
2012-02-24 16:49:46 +00:00
Douglas Gregor
29c42f2a25 Implement a new type trait __is_trivially_constructible(T, Args...)
that provides the behavior of the C++11 library trait
std::is_trivially_constructible<T, Args...>, which can't be
implemented purely as a library.

Since __is_trivially_constructible can have zero or more arguments, I
needed to add Yet Another Type Trait Expression Class, this one
handling arbitrary arguments. The next step will be to migrate
UnaryTypeTrait and BinaryTypeTrait over to this new, more general
TypeTrait class.

Fixes the Clang side of <rdar://problem/10895483> / PR12038.

llvm-svn: 151352
2012-02-24 07:38:34 +00:00
Ted Kremenek
e98d63a823 Adopt ExprEngine and checkers to ObjC property refactoring. Everything was working, but now diagnostics are aware of message expressions implied by uses of properties. Fixes <rdar://problem/9241180>.
llvm-svn: 150888
2012-02-18 20:53:30 +00:00
Ted Kremenek
2eef6b9e4b Add checker visitation hooks in ExprEngine::Visit() for common no-op expressions. To be used later.
llvm-svn: 150723
2012-02-16 20:56:01 +00:00
Ted Kremenek
35e55fe49f Revert "Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change."
llvm-svn: 150722
2012-02-16 20:48:04 +00:00
Ted Kremenek
ea8dbdeefd Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change.
llvm-svn: 150720
2012-02-16 20:19:30 +00:00
Anna Zaks
3d34834bb0 [analyzer] Make Malloc Checker optimistic in presence of inlining.
(In response of Ted's review of r150112.)

This moves the logic which checked if a symbol escapes through a
parameter to invalidateRegionCallback (instead of post CallExpr visit.)

To accommodate the change, added a CallOrObjCMessage parameter to
checkRegionChanges callback.

llvm-svn: 150513
2012-02-14 21:55:24 +00:00
Douglas Gregor
e31e606ff3 Introduce basic ASTs for lambda expressions. This covers:
- Capturing variables by-reference and by-copy within a lambda
  - The representation of lambda captures
  - The creation of the non-static data members in the lambda class
  that store the captured variables
  - The initialization of the non-static data members from the
  captured variables
  - Pretty-printing lambda expressions

There are a number of FIXMEs, both explicit and implied, including:
  - Creating a field for a capture of 'this'
  - Improved diagnostics for initialization failures when capturing
  variables by copy
  - Dealing with temporaries created during said initialization
  - Template instantiation
  - AST (de-)serialization
  - Binding and returning the lambda expression; turning it into a
  proper temporary
  - Lots and lots of semantic constraints
  - Parameter pack captures

llvm-svn: 149977
2012-02-07 10:09:13 +00:00
Argyrios Kyrtzidis
2753ca84f0 Reapply r149311 which I reverted by mistake.
Original log:

 Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates.  This leads to a slight memory
 improvement, and a simplification of the logic for managing ProgramState objects.
 # Please enter the commit message for your changes. Lines starting

llvm-svn: 149339
2012-01-31 02:23:28 +00:00
Argyrios Kyrtzidis
0dc0c5411f Revert r149311 which failed to compile.
Original log:

Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates.  This leads to a slight memory
improvement, and a simplification of the logic for managing ProgramState objects.

llvm-svn: 149336
2012-01-31 02:14:24 +00:00
Ted Kremenek
b1ca33fde5 Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates. This leads to a slight memory
improvement, and a simplification of the logic for managing ProgramState objects.

llvm-svn: 149311
2012-01-31 00:57:20 +00:00
Ted Kremenek
49b1e38e4b Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.
At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

llvm-svn: 149081
2012-01-26 21:29:00 +00:00
David Blaikie
e4d798f078 More dead code removal (using -Wunreachable-code)
llvm-svn: 148577
2012-01-20 21:50:17 +00:00
Ted Kremenek
3f406ba4bf Remove '#if 0' from ExprEngine::InlineCall(), and start fresh by wiring up inlining for straight C calls.
My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders
and re-evaluating how C++ calls are handled in the CFG.  The hope is to turn inlining "on-by-default" as soon as possible
with a core set of things working well, and then expand over time.

llvm-svn: 147904
2012-01-11 01:06:27 +00:00
Ted Kremenek
e1181f3ea0 [analyzer] Remove CallEnterNodeBuilder and simplify ExprEngine::processCallEnter().
This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later.

llvm-svn: 147705
2012-01-07 01:03:17 +00:00
Ted Kremenek
632e3b7ee2 [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining.  Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back.  There are also potential performance implications
of enlarging the Environment.  Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment.  This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

llvm-svn: 147688
2012-01-06 22:09:28 +00:00
Anna Zaks
8158ef0dec [analyzer] Be less pessimistic about invalidation of global variables
as a result of a call.

Problem:
Global variables, which come in from system libraries should not be
invalidated by all calls. Also, non-system globals should not be
invalidated by system calls.

Solution:
The following solution to invalidation of globals seems flexible enough
for taint (does not invalidate stdin) and should not lead to too
many false positives. We split globals into 3 classes:

* immutable - values are preserved by calls (unless the specific
global is passed in as a parameter):
     A :  Most system globals and const scalars

* invalidated by functions defined in system headers:
     B: errno

* invalidated by all other functions (note, these functions may in
turn contain system calls):
     B: errno
     C: all other globals (which are not in A nor B)

llvm-svn: 147569
2012-01-04 23:54:01 +00:00
Anna Zaks
d066f79c80 [analyzer] Unify SymbolVal and SymExprVal under a single SymbolVal
class.

We are going into the direction of handling SymbolData and other SymExpr
uniformly, so it makes less sense to keep two different SVal classes.
For example, the checkers would have to take an extra step to reason
about each type separately.

The classes have the same members, we were just using the SVal kind
field for easy differentiation in 3 switch statements. The switch
statements look more ugly now, but we can make the code more readable in
other ways, for example, moving some code into separate functions.

llvm-svn: 145833
2011-12-05 18:58:30 +00:00
Ted Kremenek
24fc93a940 When analyzing a C++ method (without a specific caller), assume 'this' is non-null. Fixes <rdar://problem/10508787>.
llvm-svn: 145575
2011-12-01 05:29:42 +00:00
Ted Kremenek
61fb647fb4 [static analyzer] be more specific when running removeDeadBindings. Instead of seeing if the predecessor node was a non-StmtPoint, check if it is specifically a BlockEntrance node.
llvm-svn: 144340
2011-11-11 00:10:55 +00:00
Ted Kremenek
20be0b4397 [static analyzer]: only call RemoveDeadBindings() when analyzing non-Expr stmts, entering a basic block, or analyzing non-consumed expressions. This sigificantly speeds up analysis time, and reduces analysis time down to 27% less than before we linearized the CFG.
llvm-svn: 144332
2011-11-10 23:26:10 +00:00
John McCall
fe96e0b6be Change the AST representation of operations on Objective-C
property references to use a new PseudoObjectExpr
expression which pairs a syntactic form of the expression
with a set of semantic expressions implementing it.
This should significantly reduce the complexity required
elsewhere in the compiler to deal with these kinds of
expressions (e.g. IR generation's special l-value kind,
the static analyzer's Message abstraction), at the lower
cost of specifically dealing with the odd AST structure
of these expressions.  It should also greatly simplify
efforts to implement similar language features in the
future, most notably Managed C++'s properties and indexed
properties.

Most of the effort here is in dealing with the various
clients of the AST.  I've gone ahead and simplified the
ObjC rewriter's use of properties;  other clients, like
IR-gen and the static analyzer, have all the old
complexity *and* all the new complexity, at least
temporarily.  Many thanks to Ted for writing and advising
on the necessary changes to the static analyzer.

I've xfailed a small diagnostics regression in the static
analyzer at Ted's request.

llvm-svn: 143867
2011-11-06 09:01:30 +00:00
Anna Zaks
49ea5bf562 [analyzer] Make sink attribute part of the node profile.
This prevents caching out on nodes with different sink flag.
(This is a cleaner fix for radar://10376675).

llvm-svn: 143517
2011-11-01 22:41:19 +00:00
Anna Zaks
bfb3520fc5 [analyzer] Make sure the child builder use temporary destination sets
The parent and child builders should not share node sets.

llvm-svn: 143515
2011-11-01 22:41:09 +00:00
Anna Zaks
0ec04bf738 [analyzer] Move enqueueEndOfFunction into CoreEngine.
llvm-svn: 143090
2011-10-27 00:59:28 +00:00
Anna Zaks
b1d3d96872 [analyzer] Make CoreEngine responsible for enqueueing Stmt Nodes.
Enqueue the nodes generated as the result of processing a statement
inside the Core Engine. This makes sure ExpEngine does not access
CoreEngine's private members and is more concise.

llvm-svn: 143089
2011-10-27 00:59:23 +00:00
Anna Zaks
b31d0143dd [analyzer] GenericNodeBuilder -> NodeBuilder.
Remove GenericNodeBuilder and use a class inherited from NodeBuilder instead.

llvm-svn: 143057
2011-10-26 21:06:22 +00:00
Anna Zaks
513921dc8a [analyzer] Remove unused headers.
llvm-svn: 142945
2011-10-25 19:56:58 +00:00
Anna Zaks
f380534a1a [analyzer] Make branch for condition callback use CheckerContext
Now, all the path sensitive checkers use CheckerContext!

llvm-svn: 142944
2011-10-25 19:56:54 +00:00
Anna Zaks
3eae33412d [analyze] Convert EndOfPath callback to use CheckerContext
Get rid of the EndOfPathBuilder completely.
Use the generic NodeBuilder to generate nodes.
Enqueue the end of path frontier explicitly.

llvm-svn: 142943
2011-10-25 19:56:48 +00:00
Douglas Gregor
deb4a2be67 Implement support for dependent Microsoft __if_exists/__if_not_exists
statements. As noted in the documentation for the AST node, the
semantics of __if_exists/__if_not_exists are somewhat different from
the way Visual C++ implements them, because our parsed-template
representation can't accommodate VC++ semantics without serious
contortions. Hopefully this implementation is "good enough".

llvm-svn: 142901
2011-10-25 01:33:02 +00:00
Anna Zaks
e4e5712cd7 [analyzer] Node builders cleanup + comments
Renamed PureNodeBuilder->StmtNodeBuilder.

llvm-svn: 142849
2011-10-24 21:19:59 +00:00
Anna Zaks
4c9169254f [analyzer] Completely remove the global Builder object.
llvm-svn: 142847
2011-10-24 21:19:48 +00:00
Anna Zaks
7b8a2609ff [analyzer] Remove more dependencies from global Builder
- OSAtomicChecker
- ExprEngine::processStmt

llvm-svn: 142846
2011-10-24 21:19:43 +00:00
Anna Zaks
e594034f1f [analyzer] Convert ExprEngine::visit() to use short lived builders.
This commit removes the major functional dependency on the ExprEngine::Builder
member variable.

In some cases the code became more verbose. Particularly, we call takeNodes()
and addNodes() to move responsibility for the nodes from one builder to another.
This will get simplified later on.

llvm-svn: 142831
2011-10-24 18:26:19 +00:00
Anna Zaks
5236792019 [analyzer] Convert VisitDeclStmt to use local node builder.
llvm-svn: 142830
2011-10-24 18:26:12 +00:00
Anna Zaks
cbdf10be19 [analyzer] Convert more functions (ex:evalBind()) to iterative builders
llvm-svn: 142829
2011-10-24 18:26:08 +00:00
Anna Zaks
f011a4a6f9 [analyzer] Convert VisitUnaryOperator to use short lived Node builders
To convert iteratively, we take the nodes the local builder will
process from the from the global builder and add the generated nodes
after the short lived builder is done. PureStmtNodeBuilder is the
one we should eventually use everywhere. Added Stmt index and Builder
context as ExprEngine globals. To avoid passing them around.

llvm-svn: 142828
2011-10-24 18:26:03 +00:00
Anna Zaks
0bb9d1b917 [analyzer] Use a temporary builder in CheckerContext.
First step toward removing the global Stmt builder. Added several transitional methods (like takeNodes/addNodes).
+ Stop early if the set of exploded nodes for the next iteration is empty.

llvm-svn: 142827
2011-10-24 18:25:58 +00:00
Anna Zaks
7fec527d16 [analyzer] Pass external Dst set to NodeBuilder
This moves the responsibility for storing the output node set from the
builder to the clients. The builder is just responsible for transforming
an input set into the output set: {SrcSet/SrcNode} -> {Frontier}.

llvm-svn: 142826
2011-10-24 18:25:53 +00:00
Ted Kremenek
81ce1c8a99 Rename AnalysisContext to AnalysisDeclContext. Not only is this name more accurate, but it frees up the name AnalysisContext for other uses.
llvm-svn: 142782
2011-10-24 01:32:45 +00:00
Ted Kremenek
142adc492b [analyzer] Remove LocationContext creation methods from AnalysisManager, and change clients to use AnalysisContext instead.
WIP to remove/reduce ExprEngine's usage of AnalysisManager.

llvm-svn: 142739
2011-10-23 02:31:52 +00:00
Anna Zaks
d009bfac0c [analyzer] Move predecessor into the NodeBuilder context.
llvm-svn: 142454
2011-10-18 23:06:48 +00:00
Anna Zaks
a99b41f37f [analyzer] Make NodeBuilder and Pred node loosely coupled
NodeBuilder should not assume it's dealing with a single predecessor. Remove predecessor getters. Modify the BranchNodeBuilder to not be responsible for doing auto-transitions (which depend on a predecessor).

llvm-svn: 142453
2011-10-18 23:06:44 +00:00