152 Commits

Author SHA1 Message Date
Ted Kremenek
7020eae076 Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a way
to statically type various methods in SValuator/GRState as required either a
defined value or a defined-but-possibly-unknown value. This leads to various
logic cleanups in GRExprEngine, and lets the compiler enforce via type checking
our assumptions about what symbolic values are possibly undefined and what are
not.

Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values.

llvm-svn: 81579
2009-09-11 22:07:28 +00:00
Zhongxing Xu
7e3431b5cf Make AnalysisManager stateless. Now other analyzer components only depends on
local node information.

llvm-svn: 81433
2009-09-10 05:44:00 +00:00
Mike Stump
11289f4280 Remove tabs, and whitespace cleanups.
llvm-svn: 81346
2009-09-09 15:08:12 +00:00
Zhongxing Xu
d7674a47f9 Do not call FlushReports() in GRBugReporter's dtor. We already call it in
ActionGRExprEngine().

llvm-svn: 81064
2009-09-05 06:06:49 +00:00
Zhongxing Xu
342950efc5 Remove CodeDecl and CFG from GRExprEngine and GRStateManager.
Now AnalysisManager is the only place we can get CodeDecl.
This leads to an API change: GRState::bindExpr() now takes the CFG argument.

llvm-svn: 79980
2009-08-25 06:51:30 +00:00
Zhongxing Xu
94ec649b33 Remove Decl and CFG from ExplodedGraph. This leads to a series small changes.
llvm-svn: 79973
2009-08-25 03:33:41 +00:00
Zhongxing Xu
068928b2a6 Rename: ProgramPoint::getContext() => ProgramPoint::getLocationContext().
llvm-svn: 79502
2009-08-20 01:23:34 +00:00
Zhongxing Xu
080fa0522b Get the Decl from the current ExplodedNode. Eventually the diagnostic client
and other core analysis logic will be untied to a particular Decl.

llvm-svn: 79420
2009-08-19 12:50:00 +00:00
Zhongxing Xu
7864b9ea0c Remove unused parameter BugReporter due to previous patch.
llvm-svn: 79328
2009-08-18 08:58:41 +00:00
Zhongxing Xu
4c76dbc758 Now we can get the CFG from the ProgramPoint. No need to pass in the
BugReporter.

llvm-svn: 79327
2009-08-18 08:46:04 +00:00
Ted Kremenek
9b2c79de59 Enhance static analyzer diagnostics by introducing a new 'EnhancedBugReporter'
which allows custom checks to register callback creator functions for creating
BugReporterVisitor objects. This allows various checks to include diagnostics
such as 'assuming value is null' with little extra work. Eventually this API
should be refactored to be cleaner and more simple.

llvm-svn: 79302
2009-08-18 01:05:30 +00:00
Zhongxing Xu
c90a0c2e81 Core analysis engine template cleanup step 2:
merge ExplodedGraphImpl and ExplodedGraph.

llvm-svn: 78291
2009-08-06 06:28:40 +00:00
Zhongxing Xu
20227f71d7 As GRState seems general enough, it is time to merge some template classes
and their impl base classes. This can greatly simply some code of the core 
analysis engine. This patch merges ExplodedNodeImpl into ExplodedNode.

llvm-svn: 78270
2009-08-06 01:32:16 +00:00
Zhongxing Xu
c2394f0ad9 add a fixme
llvm-svn: 77447
2009-07-29 08:13:37 +00:00
Ted Kremenek
4c9f161fd5 Fix helper function GetNextStmt() to look for the first statement that has a
valid SourceLocation.

llvm-svn: 77280
2009-07-28 00:07:15 +00:00
Ted Kremenek
bfd28fd596 Refactor 'PostStmt' and 'PreStmt' to subclass a common parent 'StmtPoint'.
Educate GRExprEngine::VisitGraph() about 'PreStmt'.

Mark the constructor of 'PostStmt' to be explicit, preventing implicit
conversions and the selection of the wrong 'generateNode' method in
GRStmtNodeBuilder.

Constify a bunch of arguments, which falls out of the changes to ProgramPoint.

llvm-svn: 76809
2009-07-22 22:35:28 +00:00
Ted Kremenek
6796fbd2e8 Move the source-level CFG from libAST to libAnalysis.
llvm-svn: 76092
2009-07-16 18:13:04 +00:00
Argyrios Kyrtzidis
ddcd132a5b Remove the ASTContext parameter from the getBody() methods of Decl and subclasses.
Timings showed no significant difference before and after the commit.

llvm-svn: 74504
2009-06-30 02:35:26 +00:00
Ted Kremenek
1642bdaaa5 Introduce a new concept to the static analyzer: SValuator.
GRTransferFuncs had the conflated role of both constructing SVals (symbolic
expressions) as well as handling checker-specific logic. Now SValuator has the
role of constructing SVals from expressions and GRTransferFuncs just handles
checker-specific logic. The motivation is by separating these two concepts we
will be able to much more easily create richer constraint-generating logic
without coupling it to the main checker transfer function logic.

We now have one implementation of SValuator: SimpleSValuator.

SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals
(which is removed in this patch). This includes the logic for EvalBinOp,
EvalCast, etc. Because SValuator has a narrower role than the old
GRTransferFuncs, the interfaces are much simpler, and so is the implementation
of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of
SVal-related logic in GRSimpleVals and cleaned it up while moving it over to
SimpleSValuator.

As a consequence of removing GRSimpleVals, there is no longer a
'-checker-simple' option. The '-checker-cfref' did everything that option did
but also ran the retain/release checker. Of course a user may not always wish to
run the retain/release checker, nor do we wish core analysis logic buried in the
checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp
to separate out these pieces into the core analysis engine.

llvm-svn: 74229
2009-06-26 00:05:51 +00:00
Ted Kremenek
ae01dc73af API cleanup: move more methods from GRStateManager to GRState.
llvm-svn: 73968
2009-06-23 17:55:07 +00:00
Ted Kremenek
095f1a9848 Move clients over from using GRStateManager::BindXXX and friends to
GRState->bindXXX and friends (and constify some arguments along the way).

llvm-svn: 73740
2009-06-18 23:58:37 +00:00
Ted Kremenek
a28565ac62 Fix another bug in BugReporter where we wouldn't always select the bug report in a bug equivalence class with the shortest path.
llvm-svn: 71920
2009-05-16 01:11:58 +00:00
Ted Kremenek
73777059f0 BugReporter (extensive diagnostics): Do not include the range of target '}'
llvm-svn: 71832
2009-05-15 02:46:13 +00:00
Ted Kremenek
cfe7d02b2c BugReporter (extensive diagnostics): Add control-flow piece to '}' in
loop body when generating 'Looping back to the head of the loop'
diagnostics.

llvm-svn: 71829
2009-05-15 01:50:15 +00:00
Ted Kremenek
5fb7847fbf BugReport::getEndPath() - Only add a Stmt's range to the constructed PathDiagnosticEventPiece if the BugReport contained no explicit ranges.
llvm-svn: 71516
2009-05-11 23:50:59 +00:00
Ted Kremenek
2ee73b86c0 EdgeBuilder: DeclStmts and BinaryOperators are not the enclosing location context when they are used as initialization code for loops.
llvm-svn: 71480
2009-05-11 22:19:32 +00:00
Ted Kremenek
c0b879b4a7 EdgeBuilder::cleanUpLocation() should used the PathDiagnosticLocation constructor for a single point, not a range.
llvm-svn: 71477
2009-05-11 21:42:34 +00:00
Ted Kremenek
c14b594b14 BugReporter (extensive diagnostics): Add EdgeBuilder::cleanUpLocation for canonicalization locations and use this in both popLocation and rawAddEdge.
llvm-svn: 71470
2009-05-11 19:50:47 +00:00
Ted Kremenek
3978f7972d analyzer:
- Improve -autorelease diagnostics.
- Improve VLA diagnostics.
- Use "short description" for bug when outputting to TextDiagnostics

llvm-svn: 71383
2009-05-10 05:11:21 +00:00
Ted Kremenek
9abe474852 Add preliminary support for enhancing null-pointer dereference diagnostics.
llvm-svn: 71135
2009-05-07 00:45:33 +00:00
Ted Kremenek
bb8d546208 Refactor BugReporter interface to have a new 'BugReporterContext' and
'BugReporterVisitor'. This simplifies callbacks from BugReporter to BugReports
(via VisitNode). It also lays the foundation for arbitrary visitor "call backs"
that can be registered to a BugReporterContext as a PathDiagnostic is
constructed. These call backs can help operate as separate "experts" that can
work on constructed pieces of a PathDiagnostic for which they possess special
knowledge.

llvm-svn: 71121
2009-05-06 21:39:49 +00:00
Ted Kremenek
a8106efce9 BugReporter (extensive diagnostics): improve location context generation for the
start of 'do' and '@synchronized' statements.

llvm-svn: 71038
2009-05-05 23:13:38 +00:00
Ted Kremenek
98017051ae BugReporter (extensive diagnostics): Fix getEnclosingStmtLocation to reason
about Exprs that are not consumed and fix where the loop iteration diagnostic
goes.

llvm-svn: 71027
2009-05-05 22:19:17 +00:00
Ted Kremenek
e396f72ec7 BugReporter (extensive diagnostics): don't mark location contexts that are
control-flow expressions as dead.

llvm-svn: 70887
2009-05-04 18:15:17 +00:00
Ted Kremenek
afbff15e64 BugReporter (extensive diagnostics): introduce the notion of a "dead"
location context.  This allows us to postpone the decision of whether
or not a context should add a control-flow piece to the diagnostics
when inspecting its subexpressions.

llvm-svn: 70545
2009-05-01 16:08:09 +00:00
Ted Kremenek
29d0880e50 Remove #if 0'ed code.
llvm-svn: 70542
2009-05-01 15:19:33 +00:00
Ted Kremenek
9f08b842e1 Fix null dereference.
llvm-svn: 70417
2009-04-29 22:05:03 +00:00
Ted Kremenek
47187c6ad2 BugReporter/PathDiagnostics:
- Add an (optional) short description for BugReports for clients that want
  to distinguish between long and short descriptions for bugs
- Make the bug report for VLA less obscene for Plist diagnostics by using
  the short description

llvm-svn: 70415
2009-04-29 21:58:13 +00:00
Ted Kremenek
9bea0dc178 Extensive diagnostics: Do not add a location context for do...while statements.
llvm-svn: 70286
2009-04-28 04:28:12 +00:00
Ted Kremenek
61114bc558 BugReporter (extensive diagnostics): Clean up do...while control-flow edges, and
add "Looping back to the head of the loop" diagnostic for loops.

llvm-svn: 70285
2009-04-28 04:23:15 +00:00
Sebastian Redl
a7b98a772c Implement function-try-blocks. However, there's a very subtle bug that I can't track down.
llvm-svn: 70155
2009-04-26 20:35:05 +00:00
Eli Friedman
5cdb8cc267 Minor code cleanup.
llvm-svn: 70144
2009-04-26 19:04:51 +00:00
Chris Lattner
f0b64d73a8 split ObjC and C++ Statements out into their own headers.
llvm-svn: 70105
2009-04-26 01:32:48 +00:00
Ted Kremenek
3ebc5057ac BugReporter (extensive diagnostics): Recursively adjust the referred expression
when popping location contexts.

llvm-svn: 69898
2009-04-23 16:44:22 +00:00
Ted Kremenek
e60809c31d BugReporter (extensive diagnostics): Ignore parentheses when added control-flow
pieces for location contexts.

llvm-svn: 69895
2009-04-23 16:19:29 +00:00
Ted Kremenek
48b7875e55 BugReporter (extensive diagnostics): Use correct location for location contexts.
llvm-svn: 69824
2009-04-22 20:51:59 +00:00
Ted Kremenek
fb05406cef BugReporter (extensive diagnostics): always add an edge if there is no location
context.

llvm-svn: 69823
2009-04-22 20:36:26 +00:00
Ted Kremenek
6c867a1460 BugReporter (extensive diagnostics):
- Remove stale assertion that was breaking the test suite.
- When popping location contexts, only add a control-flow piece for fileID
  locations.

llvm-svn: 69814
2009-04-22 18:37:42 +00:00
Ted Kremenek
0752a5dff3 BugReporter (extensive diagnostic algorithm): The initial control-flow edge now
starts from the first character of the first statement.

llvm-svn: 69813
2009-04-22 18:16:20 +00:00
Douglas Gregor
e3dcb2ddd1 FunctionDecl::getBody() is getting an ASTContext argument for use in
lazy PCH deserialization. Propagate that argument wherever it needs to
be. No functionality change, except that I've tightened up a few PCH
tests in preparation.

llvm-svn: 69406
2009-04-18 00:02:19 +00:00