Jordan Rose [Fri, 3 Aug 2012 23:09:01 +0000 (23:09 +0000)]
[analyzer] When a symbol is null, we should track its constraints.
Because of this, we would previously emit NO path notes when a parameter
is constrained to null (because there are no stores). Now we show where we
made the assumption, which is much more useful.
Jordan Rose [Fri, 3 Aug 2012 23:08:42 +0000 (23:08 +0000)]
[analyzer] FindLastStoreBRVisitor was not actually finding stores.
The visitor walks back through the ExplodedGraph as expected, but
it wasn't actually keeping track of when a value was assigned. This
meant that it only worked when the value was assigned when the variable
was defined.
Tests in the next commit (dependent on another change).
Anna Zaks [Fri, 3 Aug 2012 21:43:37 +0000 (21:43 +0000)]
[analyzer] ObjC Inlining: Start tracking dynamic type info in the GDM
In the following code, find the type of the symbolic receiver by
following it and updating the dynamic type info in the state when we
cast the symbol from id to MyClass *.
Anna Zaks [Fri, 3 Aug 2012 18:30:18 +0000 (18:30 +0000)]
[analyzer] Malloc: track non-allocated but freed memory
There is no reason why we should not track the memory which was not
allocated in the current function, but was freed there. This would
allow to catch more use-after-free and double free with no/limited IPA.
Also fix a realloc issue which surfaced as the result of this patch.
Benjamin Kramer [Fri, 3 Aug 2012 08:39:58 +0000 (08:39 +0000)]
Fix failed to generate vtables in certain cases.
By C++ standard, the vtable should be generated if the first non-inline
virtual function is defined in the TU. Current version of clang doesn't
generate vtable if the first virtual function is defaulted, because the
key function is regarded as the defaulted function.
Anna Zaks [Thu, 2 Aug 2012 23:41:05 +0000 (23:41 +0000)]
[analyzer] Solve another source of non-determinism in the diagnostic
engine.
The code that was supposed to split the tie in a deterministic way is
not deterministic. Most likely one of the profile methods uses a
pointer. After this change we do finally get the consistent diagnostic
output. Testing this requires running the analyzer on large code bases
and diffing the results.
Hans Wennborg [Thu, 2 Aug 2012 12:27:08 +0000 (12:27 +0000)]
Correct AddDefaultCIncludePaths for OpenBSD to not include /usr/local/include
in the default search path. Compilers on *BSD OS's only include /usr/include by
default.
Dmitri Gribenko [Wed, 1 Aug 2012 23:08:09 +0000 (23:08 +0000)]
Comment AST: add DeclInfo to store information about the declaration. Sema was
already extracting most of this, but discarding at the end of semantic analysis.
John McCall [Wed, 1 Aug 2012 05:04:58 +0000 (05:04 +0000)]
When devirtualizing the conversion to a virtual base subobject,
don't explode if the offset we get is zero. This can happen if
you have an empty virtual base class.
While I'm at it, remove an unnecessary block from the IR-generation
of the null-check, mark the eventual GEP as inbounds, and generally
prettify.
Dmitri Gribenko [Tue, 31 Jul 2012 22:37:06 +0000 (22:37 +0000)]
Comment parsing: add support for \tparam command on all levels.
The only caveat is renumbering CXCommentKind enum for aesthetic reasons -- this
breaks libclang binary compatibility, but should not be a problem since API is
so new.
David Blaikie [Tue, 31 Jul 2012 20:29:59 +0000 (20:29 +0000)]
Include clang-check as part of the clang installation.
This also tidies up a couple of other tools we were (partially) installing:
* c-index-test was being installed but shouldn't be (it's just a clang-dev tool)
* diagtool was being installed in cmake but not make (& shouldn't be installed in either)
Review by Manuel Klimek, Doug Gregor, and Chandler Carruth.
Jordan Rose [Tue, 31 Jul 2012 18:04:53 +0000 (18:04 +0000)]
[analyzer] Don't try to inline if there's no region for a message receiver.
While usually we'd use a symbolic region rather than a straight-up Unknown,
we can still generate unknowns via array subscripts with symbolic indexes.
(And if this ever changes in the future, we still shouldn't crash.)
Manuel Klimek [Tue, 31 Jul 2012 13:56:54 +0000 (13:56 +0000)]
Fixes a segfault in Tooling when using pch's:
Clear the FileManager's stat cache in between running
translation units, as the stat cache loaded from a pch
is only valid for one compiler invocation.
John McCall [Tue, 31 Jul 2012 05:14:30 +0000 (05:14 +0000)]
Introduce new queries on ObjCRuntime for how to interpret subscripts
on object pointers and whether pointer arithmetic on object pointers
is supported. Make ObjFW interpret subscripts as pseudo-objects.
Based on a patch by Jonathan Schleifer.
Rafael Espindola [Tue, 31 Jul 2012 02:44:24 +0000 (02:44 +0000)]
Handle functions with struct arguments or return types and the regparm
attribute. It is a variation of the x86_64 ABI:
* A struct returned indirectly uses the first register argument to pass the
pointer.
* Floats, Doubles and structs containing only one of them are not passed in
registers.
* Other structs are split into registers if they fit on the remaining ones.
Otherwise they are passed in memory.
* When a struct doesn't fit it still consumes the registers.
Rafael Espindola [Tue, 31 Jul 2012 01:54:04 +0000 (01:54 +0000)]
Attributes preceding a function declaration are first applied to the return
type and then propagated to the function. This was failing for destructors,
constructors and constructors templates since they don't have a return type.
Fix that by directly calling processTypeAttrs on the dummy type we use as the
return type in these cases.
Jordan Rose [Tue, 31 Jul 2012 01:07:55 +0000 (01:07 +0000)]
[analyzer] Let CallEvent decide what goes in an inital stack frame.
This removes explicit checks for 'this' and 'self' from
Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual
method on all CallEvents; it's now only implemented in the parts of the
hierarchy where it is relevant. Finally, it removes the option to ask
for the ParmVarDecls attached to the definition of an inlined function,
saving a recomputation of the result of getRuntimeDefinition().
Douglas Gregor [Tue, 31 Jul 2012 00:50:07 +0000 (00:50 +0000)]
When we encounter a code-completion token while parsing an ill-formed
lambda-introducer in Objective-C++11, fall back to treating the tokens
as an Objective-C message send to provide those (more likely)
completions. Fixes <rdar://problem/11980263>.
Richard Smith [Mon, 30 Jul 2012 23:48:14 +0000 (23:48 +0000)]
PR13479: If we see the definition of an out-of-line destructor in C++11, be
sure to update the exception specification on the declaration as well as the
definition. If we're building in -fno-exceptions mode, nothing else will
trigger it to be updated.
Jordan Rose [Mon, 30 Jul 2012 23:39:47 +0000 (23:39 +0000)]
[analyzer] Perform post-call checks for all inlined calls.
Previously, we were only checking the origin expressions of inlined calls.
Checkers using the generic postCall and older postObjCMessage callbacks were
ignored. Now that we have CallEventManager, it is much easier to create
a CallEvent generically when exiting an inlined function, which we can then
use for post-call checks.
No test case because we don't (yet) have any checkers that depend on this
behavior (which is why it hadn't been fixed before now).
Richard Smith [Mon, 30 Jul 2012 21:30:52 +0000 (21:30 +0000)]
Improvements to vexing-parse warnings. Make the no-parameters case more
accurate by asking the parser whether there was an ambiguity rather than trying
to reverse-engineer it from the DeclSpec. Make the with-parameters case have
better diagnostics by using semantic information to drive the warning,
improving the diagnostics and adding a fixit.
Patch by Nikola Smiljanic. Some minor changes by me to suppress diagnostics for
declarations of the form 'T (*x)(...)', which seem to have a very high false
positive rate, and to reduce indentation in 'warnAboutAmbiguousFunction'.
objective-c arc: ARC IRGen correctly assumes result
type of generated call to super dealloc is 'void'
and asserts if user's dealloc is not of 'void type.
This rule must be enforced in clang front-end (with a
fixit) if this is not the case, instead of asserting in CodeGen.
// rdar://11987838
Anna Zaks [Mon, 30 Jul 2012 20:31:29 +0000 (20:31 +0000)]
[analyzer] Very simple ObjC instance method inlining
- Retrieves the type of the object/receiver from the state.
- Binds self during stack setup.
- Only explores the path on which the method is inlined (no
bifurcation to explore the path on which the method is not inlined).
Jordan Rose [Mon, 30 Jul 2012 20:22:09 +0000 (20:22 +0000)]
[analyzer] Only allow CallEvents to be created by CallEventManager.
This ensures that it is valid to reference-count any CallEvents, and we
won't accidentally try to reclaim a CallEvent that lives on the stack.
It also hides an ugly switch statement for handling CallExprs!
Do not warn on correct use of the '%n' format specifier.
While '%n' can be used for evil in an attacker-controlled format string, there
isn't any acute danger in using it in a literal format string with an argument
of the appropriate type.
Jordan Rose [Mon, 30 Jul 2012 20:21:55 +0000 (20:21 +0000)]
[analyzer] Introduce a CallEventManager to keep a pool of CallEvents.
This allows us to get around the C++ "virtual constructor" problem
when we'd like to create a CallEvent from an ExplodedNode, an inlined
StackFrameContext, or another CallEvent. The solution has three parts:
- CallEventManager uses a BumpPtrAllocator to allocate CallEvent-sized
memory blocks. It also keeps a cache of freed CallEvents for reuse.
- CallEvents all have protected copy constructors, along with cloneTo()
methods that use placement new to copy into CallEventManager-managed
memory, vtables intact.
- CallEvents owned by CallEventManager are now wrapped in an
IntrusiveRefCntPtr. Going forwards, it's probably a good idea to create
ALL CallEvents through the CallEventManager, so that we don't accidentally
try to reclaim a stack-allocated CallEvent.
All of this machinery is currently unused but will be put into use shortly.
projects / clang / log