Akira Hatanaka [Wed, 28 Feb 2018 07:15:55 +0000 (07:15 +0000)]
[ObjC] Allow declaring __strong pointer fields in structs in Objective-C
ARC mode.
Declaring __strong pointer fields in structs was not allowed in
Objective-C ARC until now because that would make the struct non-trivial
to default-initialize, copy/move, and destroy, which is not something C
was designed to do. This patch lifts that restriction.
Special functions for non-trivial C structs are synthesized that are
needed to default-initialize, copy/move, and destroy the structs and
manage the ownership of the objects the __strong pointer fields point
to. Non-trivial structs passed to functions are destructed in the callee
function.
Richard Smith [Wed, 28 Feb 2018 03:02:23 +0000 (03:02 +0000)]
Fix a couple of cases where we would fail to correctly parse deduced class template specialization types.
Specifically, we would not properly parse these types within template arguments
(for non-type template parameters), and in tentative parses. Fixing both of
these essentially requires that we parse deduced template specialization types
as types in all contexts, even in template argument lists -- in particular,
tentative parsing may look ahead and annotate a deduced template specialization
type before we figure out that we're actually supposed to treat the tokens as a
template-name. We deal with this by simply permitting deduced template
specialization types when parsing template arguments, and converting them to
template template arguments.
Artem Dergachev [Tue, 27 Feb 2018 22:05:55 +0000 (22:05 +0000)]
[analyzer] UndefinedAssignmentChecker: Better warning message in implicit ctors.
When a class forgets to initialize a field in the constructor, and then gets
copied around, a warning is emitted that the value assigned to a specific field
is undefined.
When the copy/move constructor is implicit (not written out in the code) but not
trivial (is not a trivial memory copy, eg. because members have an explicit copy
constructor), the body of such constructor is auto-generated in the AST.
In this case the checker's warning message is squeezed at the top of
the class declaration, and it gets hard to guess which field is at fault.
Fix the warning message to include the name of the field.
- Expand GK_*s (i.e. GFX6 -> GFX600, GFX601, etc.)
- This allows us to choose features correctly in some cases (for example, fast fmaf is available on gfx600, but not gfx601)
- Move HasFMAF, HasFP64, HasLDEXPF to GPUInfo tables
- Add HasFastFMA, HasFastFMAF to GPUInfo tables
- Add missing tests
Artem Dergachev [Tue, 27 Feb 2018 21:19:33 +0000 (21:19 +0000)]
[analyzer] MallocChecker: Suppress false positives in shared pointers.
Throw away MallocChecker warnings that occur after releasing a pointer within a
destructor (or its callees) after performing C11 atomic fetch_add or fetch_sub
within that destructor (or its callees).
This is an indication that the destructor's class is likely a
reference-counting pointer. The analyzer is not able to understand that the
original reference count is usually large enough to avoid most use-after-frees.
Even when the smart pointer is a local variable, we still have these false
positives that this patch suppresses, because the analyzer doesn't currently
support atomics well enough.
Artem Dergachev [Tue, 27 Feb 2018 21:10:08 +0000 (21:10 +0000)]
[analyzer] Fix trivial copy for empty objects.
The SVal for any empty C++ object is an UnknownVal. Because RegionStore does
not have binding extents, binding an empty object to an UnknownVal may
potentially overwrite existing bindings at the same offset.
Therefore, when performing a trivial copy of an empty object, don't try to
take the value of the object and bind it to the copy. Doing nothing is accurate
enough, and it doesn't screw any existing bindings.
Artem Dergachev [Tue, 27 Feb 2018 21:02:58 +0000 (21:02 +0000)]
[analyzer] Track temporaries without construction contexts for destruction.
Sometimes it is not known at compile time which temporary objects will be
constructed, eg. 'x ? A() : B()' or 'C() || D()'. In this case we track which
temporary was constructed to know how to properly call the destructor.
Once the construction context for temporaries was introduced, we moved the
tracking code to the code that investigates the construction context.
Bring back the old mechanism because construction contexts are not always
available yet - eg. in the case where a temporary is constructed without a
constructor expression, eg. returned from a function by value. The mechanism
should still go away eventually.
Additionally, fix a bug in the temporary cleanup code for the case when
construction contexts are not available, which could lead to temporaries
staying in the program state and increasing memory consumption.
Artem Dergachev [Tue, 27 Feb 2018 20:54:40 +0000 (20:54 +0000)]
[analyzer] Don't crash when dynamic type of a variable is set via placement new.
If a variable or an otherwise a concrete typed-value region is being
placement-new'ed into, its dynamic type may change in arbitrary manners. And
when the region is used, there may be a third type that's different from both
the static and the dynamic type. It cannot be *completely* different from the
dynamic type, but it may be a base class of the dynamic type - and in this case
there isn't (and shouldn't be) any indication anywhere in the AST that there is
a derived-to-base cast from the dynamic type to the third type.
Perform a generic cast (evalCast()) from the third type to the dynamic type
in this case. From the point of view of the SVal hierarchy, this would have
produced non-canonical SVals if we used such generic cast in the normal case,
but in this case there doesn't seem to be a better option.
Artem Dergachev [Tue, 27 Feb 2018 20:03:35 +0000 (20:03 +0000)]
[CFG] NFC: Refactor ConstructionContext into a finite set of cases.
ConstructionContext is moved into a separate translation unit and is separated
into multiple classes. The "old" "raw" ConstructionContext is renamed into
ConstructionContextLayer - which corresponds to the idea of building the context
gradually layer-by-layer, but it isn't easy to use in the clients. Once
CXXConstructExpr is reached, layers that we've gathered so far are transformed
into the actual, "new-style" "flat" ConstructionContext, which is put into the
CFGConstructor element and has no layers whatsoever (until it actually needs
them, eg. aggregate initialization). The new-style ConstructionContext is
instead presented as a variety of sub-classes that enumerate different ways of
constructing an object in C++. There are 5 of these supported for now,
which is around a half of what needs to be supported.
The layer-by-layer buildup process is still a little bit weird, but it hides
all the weirdness in one place, that sounds like a good thing.
Artem Dergachev [Tue, 27 Feb 2018 19:47:49 +0000 (19:47 +0000)]
[analyzer] Introduce correct lifetime extension behavior in simple cases.
This patch uses the reference to MaterializeTemporaryExpr stored in the
construction context since r326014 in order to model that expression correctly.
When modeling MaterializeTemporaryExpr, instead of copying the raw memory
contents from the sub-expression's rvalue to a completely new temporary region,
that we conjure up for the lack of better options, we now have the better
option to recall the region into which the object was originally constructed
and declare that region to be the value of the expression, which is semantically
correct.
This only works when the construction context is available, which is worked on
independently.
The temporary region's liveness (in the sense of removeDeadBindings) is extended
until the MaterializeTemporaryExpr is resolved, in order to keep the store
bindings around, because it wouldn't be referenced from anywhere else in the
program state.
George Karpenkov [Tue, 27 Feb 2018 19:28:52 +0000 (19:28 +0000)]
[analyzer] Only attempt to get the value of locations of known type
Fixes https://bugs.llvm.org/show_bug.cgi?id=36474
In general, getSVal API should be changed so that it does not crash on
some non-obvious conditions.
It should either be updated to require a type, or to return Optional<SVal>.
Summary: This fixes a glitch where ``operator: value`` in a text proto would mess up the underlying formatting since it gets parsed as a kw_operator instead of an identifier.
Roman Lebedev [Tue, 27 Feb 2018 15:54:55 +0000 (15:54 +0000)]
Revert "[Tooling] [0/1] Refactor FrontendActionFactory::create() to return std::unique_ptr<>"
This reverts commit rL326201
This broke gcc4.8 builds, compiler just segfaults:¬
http://lab.llvm.org:8011/builders/clang-atom-d525-fedora-rel/builds/14909¬
http://lab.llvm.org:8011/builders/clang-x86_64-linux-abi-test/builds/22673¬
Roman Lebedev [Tue, 27 Feb 2018 15:19:20 +0000 (15:19 +0000)]
[Tooling] [0/1] Refactor FrontendActionFactory::create() to return std::unique_ptr<>
Summary:
Noticed during review of D41102.
I'm not sure whether there are any principal reasons why it returns raw owning pointer,
or it is just a old code that was not updated post-C++11.
I'm not too sure what testing i should do, because `check-all` is not error clean here for some reason,
but it does not //appear// asif those failures are related to these changes.
This is clang part.
Clang-tools-extra part is D43780.
Francois Ferrand [Tue, 27 Feb 2018 13:48:27 +0000 (13:48 +0000)]
clang-format: use AfterControlStatement to format ObjC control blocks
ObjC defines `@autoreleasepool` and `@synchronized` control blocks. These
used to be formatted according to the `AfterObjCDeclaration` brace-
wrapping flag, which is not very consistent.
This patch changes the behavior to use the `AfterControlStatement` flag
instead. This should not affect the behavior unless a custom brace
wrapping mode is used.
Francois Ferrand [Tue, 27 Feb 2018 13:48:21 +0000 (13:48 +0000)]
clang-format: fix formatting of ObjC @synchronized blocks
Summary:
The blocks used to be formatted using the "default" behavior, and would
thus be mistaken for function calls followed by blocks: this could lead
to unexpected inlining of the block and extra line-break before the
opening brace.
They are now formatted similarly to `@autoreleasepool` blocks, as
expected:
Martin Storsjo [Tue, 27 Feb 2018 06:27:06 +0000 (06:27 +0000)]
[RecordLayout] Don't align to non-power-of-2 sizes when using -mms-bitfields
When targeting GNU/MinGW for i386, the size of the "long double" data
type is 12 bytes (while it is 8 bytes in MSVC). When building
with -mms-bitfields to have struct layouts match MSVC, data types
are laid out in a struct with alignment according to their size.
However, this doesn't make sense for the long double type, since
it doesn't match MSVC at all, and aligning to a non-power-of-2
size triggers other asserts later.
This matches what GCC does, aligning a long double to 4 bytes
in structs on i386 even when -mms-bitfields is specified.
This fixes asserts when using the max_align_t data type when
building for MinGW/i386 with the -mms-bitfields flag.
Shoaib Meenai [Tue, 27 Feb 2018 06:04:23 +0000 (06:04 +0000)]
[Driver] Fix codeview-column-info on macOS
macOS home directory paths begin with /Users, and clang-cl interprets
the /U portion as a macro undefine rather than a path, causing test
failures on macOS. Use a -- to explicitly treat the input file as a path
and fix the test.
This effectively reverts r326168 and adds an alternative fix.
George Karpenkov [Mon, 26 Feb 2018 22:14:18 +0000 (22:14 +0000)]
[analyzer] Exploration strategy prioritizing unexplored nodes first
See D42775 for discussion. Turns out, just exploring nodes which
weren't explored first is not quite enough, as e.g. the first quick
traversal resulting in a report can mark everything as "visited", and
then subsequent traversals of the same region will get all the pitfalls
of DFS.
Priority queue-based approach in comparison shows much greater
increase in coverage and even performance, without sacrificing memory.
George Karpenkov [Mon, 26 Feb 2018 22:14:16 +0000 (22:14 +0000)]
[analyzer] Do not analyze bison-generated files
Bison/YACC generated files result in a very large number of (presumably)
false positives from the analyzer.
These false positives are "true" in a sense of the information analyzer
sees: assuming that the lexer can return any token at any point a number
of uninitialized reads does occur.
(naturally, the analyzer can not capture a complex invariant that
certain tokens can only occur under certain conditions).
Current fix simply stops analysis on those files.
I have examined a very large number of such auto-generated files, and
they do all start with such a comment.
Conversely, user code is very unlikely to contain such a comment.
A proper fix would be much harder, and would involve changing the
appropriate code in ExprEngine to be aware of the size limitations of
the type used for addressing.
This is failing on ASAN bots because asan expects column info,
and it's also failing on some linux bots for unknown reasons which
i need to investigate.
Zachary Turner [Mon, 26 Feb 2018 19:25:39 +0000 (19:25 +0000)]
Emit proper CodeView when -gcodeview is passed without the cl driver.
Windows debuggers don't work properly when column info is emitted
with lines. We handled this by checking if the driver mode was
cl, but it's possible to cause the gcc driver to emit codeview as
well, and in that path we were emitting column info with codeview.
Scott Linder [Mon, 26 Feb 2018 17:32:31 +0000 (17:32 +0000)]
[DebugInfo] Support DWARF v5 source code embedding extension
In DWARF v5 the Line Number Program Header is extensible, allowing values with
new content types. This vendor extension to DWARF v5 allows source text to be
embedded directly in the line tables of the debug line section.
Add new flag (-g[no-]embed-source) to Driver and CC1 which indicates
that source should be passed through to LLVM during CodeGen.
Re-land: "[Support] Replace HashString with djbHash."
This patch removes the HashString function from StringExtraces and
replaces its uses with calls to djbHash from DJB.h.
This change is *almost* NFC. While the algorithm is identical, the
djbHash implementation in StringExtras used 0 as its default seed while
the implementation in DJB uses 5381. The latter has been shown to result
in less collisions and improved avalanching and is used by the DWARF
accelerator tables.
Because some test were implicitly relying on the hash order, I've
reverted to using zero as a seed for the following two files:
Bjorn Pettersson [Mon, 26 Feb 2018 14:14:11 +0000 (14:14 +0000)]
Resolve build bot problems in unittests/Format/FormatTest.cpp
Summary:
Make the new GetStyleWithEmptyFileName test case independent
of the file system used when running the test. Since the
test is supposed to use the fallback "Google" style we now
use a InMemoryFileSystem to make sure that we do not accidentaly
find a .clang-format file in the real file system. That could
for example happen when having the build directory inside the
llvm och clang repo (as there is a .clang-format file inside
the repos).
This removes the HashString function from StringExtraces and replaces
its uses with calls to djbHash from DJB.h
This is *almost* NFC. While the algorithm is identical, the djbHash
implementation in StringExtras used 0 as its seed while the
implementation in DJB uses 5381. The latter has been shown to result in
less collisions and improved avalanching.
Aaron Ballman [Sun, 25 Feb 2018 15:34:17 +0000 (15:34 +0000)]
Switch the default behavior of the Clang<> spelling to opt-in to the C2x attribute spellings. NFC to the attribute spellings themselves.
The Clang<> spelling helper generates a spelling for C++11, GNU, and C2x attribute spellings. Previously, users had to manually opt in to the C2x spelling while we cautiously added attributes to that spelling. Now that majority of attributes are exposed in C2x, we can switch the default.
Aaron Ballman [Sun, 25 Feb 2018 14:01:04 +0000 (14:01 +0000)]
Add a C++11 and C2x spelling for the type safety attribute (argument_with_type_tag, pointer_with_type_tag, and type_tag_for_datatype) in the clang vendor namespace.
The TypeTagForDatatype attribute had custom parsing rules that previously prevented it from being supported with square bracket notation. The ArgumentWithTypeTag attribute previously had unnecessary custom parsing that could be handled declaratively.
[RISCV] Enable __int128_t and __uint128_t through clang flag
Summary:
If the flag -fforce-enable-int128 is passed, it will enable support for __int128_t and __uint128_t types.
This flag can then be used to build compiler-rt for RISCV32.
Aaron Ballman [Sat, 24 Feb 2018 17:16:42 +0000 (17:16 +0000)]
Add a C++11 and C2x spelling for the availability attribute in the clang vendor namespace.
This attribute has custom parsing rules that previously prevented it from being supported with square bracket notation. Rework the clang attribute argument parsing to be more easily extended for other custom-parsed attributes.
Daniel Jasper [Sat, 24 Feb 2018 06:54:09 +0000 (06:54 +0000)]
Make module use diagnostics refer to the top-level module
All use declarations need to be directly placed in the top-level module
anyway, knowing the submodule doesn't really help. The header that has
the offending #include can easily be seen in the diagnostics source
location.
Artem Dergachev [Sat, 24 Feb 2018 03:54:22 +0000 (03:54 +0000)]
[CFG] Keep speculatively working around an MSVC compiler crash.
Replace if() with a switch(). Because random changes in the code seem to
suppress the crash.
Story so far:
r325966 - Crash introduced.
r325969 - Speculative fix had no effect.
r325978 - Tried to bisect the offending function, crash suddenly disappeared.
r326016 - After another random change in the code, bug appeared again.
Artem Dergachev [Sat, 24 Feb 2018 03:10:15 +0000 (03:10 +0000)]
[CFG] Provide construction contexts for temporaries in conditional operators.
When a lifetime-extended temporary is on a branch of a conditional operator,
materialization of such temporary occurs after the condition is resolved.
This change allows us to understand, by including the MaterializeTemporaryExpr
in the construction context, the target for temporary materialization in such
cases.
Artem Dergachev [Sat, 24 Feb 2018 02:07:50 +0000 (02:07 +0000)]
[CFG] Provide construction contexts for temporaries bound to const references.
In order to bind a temporary to a const lvalue reference, a no-op cast is added
to make the temporary itself const, and only then the reference is taken
(materialized). Skip the no-op cast when looking for the construction context.
Artem Dergachev [Sat, 24 Feb 2018 02:05:11 +0000 (02:05 +0000)]
[CFG] Provide construction contexts for functional cast-like constructors.
When a constructor of a temporary with a single argument is treated
as a functional cast expression, skip the functional cast expression
and provide the correct construction context for the temporary.
Artem Dergachev [Sat, 24 Feb 2018 02:00:30 +0000 (02:00 +0000)]
[CFG] Provide construction contexts for lifetime-extended temporaries.
When constructing a temporary that is going to be lifetime-extended through a
MaterializeTemporaryExpr later, CFG elements for the respective constructor
can now be queried to obtain the reference to that MaterializeTemporaryExpr
and therefore gain information about lifetime extension.
This may produce multi-layered construction contexts when information about
both temporary destruction and lifetime extension is available.
Volodymyr Sapsai [Fri, 23 Feb 2018 23:59:20 +0000 (23:59 +0000)]
[ExprConstant] Fix crash when initialize an indirect field with another field.
When indirect field is initialized with another field, you have
MemberExpr with CXXThisExpr that corresponds to the field's immediate
anonymous parent. But 'this' was referring to the non-anonymous parent.
So when we were building LValue Designator, it was incorrect as it had
wrong starting point. Usage of such designator would cause unexpected
APValue changes and crashes.
The fix is in adjusting 'this' for indirect fields from non-anonymous
parent to the field's immediate parent.
Discovered by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4985
George Karpenkov [Fri, 23 Feb 2018 23:26:57 +0000 (23:26 +0000)]
[analyzer] Relax the assert used when traversing the node graph.
The assertion gets exposed when changing the exploration order.
This is a quick hacky fix, but the intention is that if the nodes do
merge, it should not matter which predecessor should be traverse.
A proper fix would be not to traverse predecessors at all, as all
information relevant for any decision should be avilable locally.
George Karpenkov [Fri, 23 Feb 2018 23:26:56 +0000 (23:26 +0000)]
[analyzer] mark returns of functions where the region passed as parameter was not initialized
In the wild, many cases of null pointer dereference, or uninitialized
value read occur because the value was meant to be initialized by the
inlined function, but did not, most often due to error condition in the
inlined function.
This change highlights the return branch taken by the inlined function,
in order to help user understand the error report and see why the value
was uninitialized.
George Karpenkov [Fri, 23 Feb 2018 23:26:54 +0000 (23:26 +0000)]
[analyzer] Consider switch- and goto- labels when constructing the set of executed lines
When viewing the report in the collapsed mode the label signifying where
did the execution go is often necessary for properly understanding the
context.
Artem Dergachev [Fri, 23 Feb 2018 22:20:39 +0000 (22:20 +0000)]
[CFG] [analyzer] NFC: Allow more complicated construction contexts.
ConstructionContexts introduced in D42672 are an additional piece of information
included with CFGConstructor elements that help the client of the CFG (such as
the Static Analyzer) understand where the newly constructed object is stored.
The patch refactors the ConstructionContext class to prepare for including
multi-layered contexts that are being constructed gradually, layer-by-layer,
as the AST is traversed.
projects / clang / log