History log of /external/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
6bcf27bb9a4b5c3f79cb44c0e4654a6d7619ad89 29-May-2014 Stephen Hines <srhines@google.com> Update Clang for 3.5 rebase (r209713).

Change-Id: I8c9133b0f8f776dc915f270b60f94962e771bc83
651f13cea278ec967336033dd032faef0e9fc2ec 24-Apr-2014 Stephen Hines <srhines@google.com> Updated to Clang 3.5a.

Change-Id: I8127eb568f674c2e72635b639a3295381fe8af82
da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8 25-Sep-2013 Anton Yartsev <anton.yartsev@gmail.com> [analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future.
With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters.

This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191342 91177308-0d34-0410-b5e6-96231b3b80d8
36d558d85653315edb389677e995ec9ccdbfbf3d 03-Sep-2013 Jordan Rose <jordan_rose@apple.com> Add an implicit dtor CFG node just before C++ 'delete' expressions.

This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

1. <expr>
2. [B1.1]->~Foo() (Implicit destructor)
3. delete [B1.1]

Patch by Karthik Bhat!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@189828 91177308-0d34-0410-b5e6-96231b3b80d8
0f5c5c60e9806d13f0907cd99d7204ffab0e08f7 29-Mar-2013 Ted Kremenek <kremenek@apple.com> Add static analyzer support for conditionally executing static initializers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178318 91177308-0d34-0410-b5e6-96231b3b80d8
41988f331a74a72cf243a2a68ffb56418e9a174e 29-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Add support for escape of const pointers and use it to allow “newed” pointers to escape

Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works
for const pointers passed as a top level parameter into a function. We need to differentiate the const
pointers escape from regular escape since the content pointed by const pointer will not change;
if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers.

This should suppress several false positives reported by the NewDelete checker on llvm codebase.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178310 91177308-0d34-0410-b5e6-96231b3b80d8
8a660eb1084294a903f6dcc00bf2fa4e3bc92cfc 26-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Change inlining policy to inline small functions when reanalyzing ObjC methods as top level.

This allows us to better reason about(inline) small wrapper functions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178063 91177308-0d34-0410-b5e6-96231b3b80d8
a8d937e4bdd39cdf503f77454e9dc4c9c730a9f7 16-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Model trivial copy/move assignment operators with a bind as well.

r175234 allowed the analyzer to model trivial copy/move constructors as
an aggregate bind. This commit extends that to trivial assignment
operators as well. Like the last commit, one of the motivating factors here
is not warning when the right-hand object is partially-initialized, which
can have legitimate uses.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177220 91177308-0d34-0410-b5e6-96231b3b80d8
c9963132736782d0c9178c744b3e2307cfb98a08 16-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Eliminate InterExplodedGraphMap class and NodeBackMap typedef.

...in favor of this typedef:

typedef llvm::DenseMap<const ExplodedNode *, const ExplodedNode *>

Use this everywhere the previous class and typedef were used.

Took the opportunity to ArrayRef-ize ExplodedGraph::trim while I'm at it.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177215 91177308-0d34-0410-b5e6-96231b3b80d8
8dadf15224f1a8df96793e5fc4e0b0e38a5ffbe4 22-Feb-2013 Anna Zaks <ganna@apple.com> [analyzer] Place all inlining policy checks into one palce

Previously, we had the decisions about inlining spread out
over multiple functions.

In addition to the refactor, this commit ensures
that we will always inline BodyFarm functions as long as the Decl
is available. This fixes false positives due to those functions
not being inlined when no or minimal inlining is enabled such (as
shallow mode).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175857 91177308-0d34-0410-b5e6-96231b3b80d8
5e5440ba9c135f523f72e7e7c5da59d390d697c5 22-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Make sure a materialized temporary matches its bindings.

This is a follow-up to r175830, which made sure a temporary object region
created for, say, a struct rvalue matched up with the initial bindings
being stored into it. This does the same for the case in which the AST
actually tells us that we need to create a temporary via a
MaterializeObjectExpr. I've unified the two code paths and moved a static
helper function onto ExprEngine.

This also caused a bit of test churn, causing us to go back to describing
temporary regions without a 'const' qualifier. This seems acceptable; it's
our behavior from a few months ago.

<rdar://problem/13265460> (part 2)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175854 91177308-0d34-0410-b5e6-96231b3b80d8
5251abea41b446c26e3239c8dd6c7edea6fc335d 20-Feb-2013 David Blaikie <dblaikie@gmail.com> Replace SVal llvm::cast support to be well-defined.

See r175462 for another example/more details.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175594 91177308-0d34-0410-b5e6-96231b3b80d8
bc403861bc4e6f7ad1371e9e129f0f25b38b3a9a 15-Feb-2013 Jordan Rose <jordan_rose@apple.com> Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."

...after a host of optimizations related to the use of LazyCompoundVals
(our implementation of aggregate binds).

Originally applied in r173951.
Reverted in r174069 because it was causing hangs.
Re-applied in r174212.
Reverted in r174265 because it was /still/ causing hangs.

If this needs to be reverted again it will be punted to far in the future.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175234 91177308-0d34-0410-b5e6-96231b3b80d8
2a3fe34b4a2a1b6ceab8838b896435378ae0e692 02-Feb-2013 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."

...again. The problem has not been fixed and our internal buildbot is still
getting hangs.

This reverts r174212, originally applied in r173951, then reverted in r174069.
Will not re-apply until the entire project analyzes successfully on my
local machine.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174265 91177308-0d34-0410-b5e6-96231b3b80d8
5500fc193af4b786bbbbee6ece743f523448e90b 01-Feb-2013 Jordan Rose <jordan_rose@apple.com> Re-apply "[analyzer] Model trivial copy/move ctors with an aggregate bind."

With the optimization in the previous commit, this should be safe again.

Originally applied in r173951, then reverted in r174069.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174212 91177308-0d34-0410-b5e6-96231b3b80d8
33e83b6cf776875be5716d214710717a898325c0 31-Jan-2013 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Model trivial copy/move ctors with an aggregate bind."

It's causing hangs on our internal analyzer buildbot. Will restore after

This reverts r173951 / baa7ca1142990e1ad6d4e9d2c73adb749ff50789.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174069 91177308-0d34-0410-b5e6-96231b3b80d8
baa7ca1142990e1ad6d4e9d2c73adb749ff50789 30-Jan-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Model trivial copy/move ctors with an aggregate bind.

This is faster for the analyzer to process than inlining the constructor
and performing a member-wise copy, and it also solves the problem of
warning when a partially-initialized POD struct is copied.

CGPoint p;
p.x = 0;
CGPoint p2 = p; <-- assigned value is garbage or undefined

CGPoint p;
p.x = 0;
CGPoint p2 = p; // no-warning

This matches our behavior in C, where we don't see a field-by-field copy.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173951 91177308-0d34-0410-b5e6-96231b3b80d8
bdc691f1d61765dd806d5ae3b75ae004f676a7c9 14-Jan-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Add ProgramStatePartialTrait<const void *>.

This should fix cast-away-const warnings reported by David Greene.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172446 91177308-0d34-0410-b5e6-96231b3b80d8
344c77aac25e5d960aced3f45fbaa09853383f6d 03-Jan-2013 Anna Zaks <ganna@apple.com> [analyzer] Rename callback EndPath -> EndFunction

This better reflects when callback is called and what the checkers
are relying on. (Both names meant the same pre-IPA.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171432 91177308-0d34-0410-b5e6-96231b3b80d8
1655bcd052a67a3050fc55df8ecce57342352e68 21-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Address Jordan's nitpicks as per code review of r170625.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170832 91177308-0d34-0410-b5e6-96231b3b80d8
bf53dfac8195835028bd6347433f7dbebcc29fc1 20-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Add the pointer escaped callback.

Instead of using several callbacks to identify the pointer escape event,
checkers now can register for the checkPointerEscape.

Converted the Malloc checker to use the new callback.
SimpleStreamChecker will be converted next.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170625 91177308-0d34-0410-b5e6-96231b3b80d8
75f31c4862643ab09479c979fabf754e7ffe1460 07-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Optimization heuristic: do not reanalyze every ObjC method as
top level.

This heuristic is already turned on for non-ObjC methods
(inlining-mode=noredundancy). If a method has been previously analyzed,
while being inlined inside of another method, do not reanalyze it as top

This commit applies it to ObjCMethods as well. The main caveat here is
that to catch the retain release errors, we are still going to reanalyze
all the ObjC methods but without inlining turned on.

Gives 21% performance increase on one heavy ObjC benchmark, which
suffered large performance regressions due to ObjC inlining.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169639 91177308-0d34-0410-b5e6-96231b3b80d8
9428723d6730f4fd257e15b78d24991ae95bbd84 06-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove unused fields from ExprEngine.

'currStmt', 'CleanedState', and 'EntryNode' were being set, but only ever
used locally.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169529 91177308-0d34-0410-b5e6-96231b3b80d8
30a2e16f6c27f888dd11eba6bbbae1e980078fcb 04-Dec-2012 Chandler Carruth <chandlerc@gmail.com> Sort #include lines for all files under include/...

This is a simpler sort, entirely automatic with the help of
llvm/utils/sort_includes.py -- no manual edits here.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169238 91177308-0d34-0410-b5e6-96231b3b80d8
84c484545c5906ba55143e212b4a5275ab55889f 15-Nov-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Mark symbol values as dead in the environment.

This allows us to properly remove dead bindings at the end of the top-level
stack frame, using the ReturnStmt, if there is one, to keep the return value
live. This in turn removes the need for a check::EndPath callback in leak

This does cause some changes in the path notes for leak checkers. Previously,
a leak would be reported at the location of the closing brace in a function.
Now, it gets reported at the last statement. This matches the way leaks are
currently reported for inlined functions, but is less than ideal for both.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168066 91177308-0d34-0410-b5e6-96231b3b80d8
8501b7a1c4c4a9ba0ea6cb8e500e601ef3759deb 03-Nov-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead on end of path.

This will simplify checkers that need to register for leaks. Currently,
they have to register for both: check dead and check end of path.

I've modified the SymbolReaper to consider everything on the stack dead
if the input StackLocationContext is 0.

(This is a bit disruptive, so I'd like to flash out all the issues

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167352 91177308-0d34-0410-b5e6-96231b3b80d8
b355be838a22a511d078504b2277f70aea52ca85 03-Nov-2012 Anna Zaks <ganna@apple.com> [analyzer] Refactor: Remove Pred from NodeBuilderContext.

Node builders should manage the nodes, not the context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167350 91177308-0d34-0410-b5e6-96231b3b80d8
466224fd068a0a0084968a7f521a690a51c3b226 02-Nov-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Convert some of the harder cases over to ProgramStateTrait macros.

Add FIXMEs for the traits visible from multiple translation units.
Currently the macros hide their key types in an anonymous namespace.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167277 91177308-0d34-0410-b5e6-96231b3b80d8
afbb66262948732dc0f9617ffd80768c7145e0c7 26-Sep-2012 Ted Kremenek <kremenek@apple.com> Remove 'const' version of getBasicVals(), which is useless.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164643 91177308-0d34-0410-b5e6-96231b3b80d8
4ef19205b6912316296db74a9073ad6fa60e4cca 13-Sep-2012 Ted Kremenek <kremenek@apple.com> Refactor logic in ExprEngine for detecting 'noreturn' methods
in NSException to a helper object in libAnalysis that can also
be used by Sema. Not sure if the predicate name 'isImplicitNoReturn'
is the best one, but we can massage that later.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163759 91177308-0d34-0410-b5e6-96231b3b80d8
4ea9b89ff6dc50d5404eb56cad5e5870bce49ef2 11-Sep-2012 Anna Zaks <ganna@apple.com> [analyzer] Do not count calls to small functions when computing stack

We only want to count how many substantial functions we inlined. This
is an improvement to r163558.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163571 91177308-0d34-0410-b5e6-96231b3b80d8
200fa2e70d52ae6d620e81cd45536071fdde70c0 06-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't attempt to devirtualize calls to base class destructors.

CXXDestructorCall now has a flag for when it is a base destructor call.
Other kinds of destructor calls (locals, fields, temporaries, and 'delete')
all behave as "whole-object" destructors and do not behave differently
from one another (specifically, in these cases we /should/ try to
devirtualize a call to a virtual destructor).

This was causing crashes in both our internal buildbot, the crash still
being tracked in PR13765, and some of the crashes being tracked in PR13763,
due to a assertion failure. (The behavior under -Asserts happened to be
correct anyway.)

Adding this knowledge also allows our DynamicTypePropagation checker to do
a bit less work; the special rules about virtual method calls during a
destructor only require extra handling during base destructors.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163348 91177308-0d34-0410-b5e6-96231b3b80d8
fbcb3f11fc90e9f00e6074e9b118b8dc11ca604c 31-Aug-2012 Anna Zaks <ganna@apple.com> [analyzer] Refactor the logic that determines if a functions should be

The policy on what to reanalyze should be in AnalysisConsumer with the
rest of visitation order logic.

There is no reason why ExprEngine needs to pass the Visited set to
CoreEngine, it can populate it itself.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162957 91177308-0d34-0410-b5e6-96231b3b80d8
0caa2d47b84337e942b3f6652adfafe4ae506cfe 30-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename AnalyzerOptions 'EagerlyAssume' to 'eagerlyAssumeBinOpBifurcation'.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162930 91177308-0d34-0410-b5e6-96231b3b80d8
3682f1ea9c7fddc7dcbc590891158ba40f7fca16 25-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use the common evalBind infrastructure for initializers.

This allows checkers (like the MallocChecker) to process the effects of the
bind. Previously, using a memory-allocating function (like strdup()) in an
initializer would result in a leak warning.

This does bend the expectations of checkBind a bit; since there is no
assignment expression, the statement being used is the initializer value.
In most cases this shouldn't matter because we'll use a PostInitializer
program point (rather than PostStmt) for any checker-generated nodes, though
we /will/ generate a PostStore node referencing the internal statement.
(In theory this could have funny effects if someone actually does an
assignment within an initializer; in practice, that seems like it would be
very rare.)


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162637 91177308-0d34-0410-b5e6-96231b3b80d8
df5faf5e7ae6823d0af0b801c4ac26d47f2cee97 25-Aug-2012 Chad Rosier <mcrosier@apple.com> [ms-inline asm] As part of a larger refactoring, rename AsmStmt to GCCAsmStmt.
No functional change intended.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162632 91177308-0d34-0410-b5e6-96231b3b80d8
66c486f275531df6362b3511fc3af6563561801b 22-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.
Also rename 'getCurrentBlockCounter()' to 'blockCount()'.

This ripples a bunch of code simplifications; mostly aesthetic,
but makes the code a bit tighter.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162349 91177308-0d34-0410-b5e6-96231b3b80d8
645baeed6800f952e9ad1d5666e01080385531a2 14-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Reduce code duplication: make CXXDestructorCall a CXXInstanceCall.

While there is now some duplication between SimpleCall and the CXXInstanceCall
sub-hierarchy, this is much better than copy-and-pasting the devirtualization
logic shared by both instance methods and destructors.

An unfortunate side effect is that there is no longer a single CallEvent type
that corresponds to "calls written as CallExprs". For the most part this is a
good thing, but the checker callback eval::Call still takes a CallExpr rather
than a CallEvent (since we're not sure if we want to allow checkers to
evaluate other kinds of calls). A mistake here will be caught by a cast<> in

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161809 91177308-0d34-0410-b5e6-96231b3b80d8
e90d3f847dcce76237078b67db8895eb7a24189e 09-Aug-2012 Anna Zaks <ganna@apple.com> [analyzer] Bifurcate the path with dynamic dispatch.

This is an initial (unoptimized) version. We split the path when
inlining ObjC instance methods. On one branch we always assume that the
type information for the given memory region is precise. On the other we
assume that we don't have the exact type info. It is important to check
since the class could be subclassed and the method can be overridden. If
we always inline we can loose coverage.

Had to refactor some of the call eval functions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161552 91177308-0d34-0410-b5e6-96231b3b80d8
d563d3fb73879df7147b8a5302c3bf0e1402ba18 30-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Only allow CallEvents to be created by CallEventManager.

This ensures that it is valid to reference-count any CallEvents, and we
won't accidentally try to reclaim a CallEvent that lives on the stack.
It also hides an ugly switch statement for handling CallExprs!

There should be no functionality change here.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160986 91177308-0d34-0410-b5e6-96231b3b80d8
a989aebecde3d2fd374b894e894a950b0bd9cf67 30-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove declaration of refactored evalObjCMessage method.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160985 91177308-0d34-0410-b5e6-96231b3b80d8
888c90ac0ef6baf7d47e86cf5cc4715707d223b1 26-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle base class initializers and destructors.

Most of the logic here is fairly simple; the interesting thing is that
we now distinguish complete constructors from base or delegate constructors.
We also make sure to cast to the base class before evaluating a constructor
or destructor, since non-virtual base classes may behave differently.

This includes some refactoring of VisitCXXConstructExpr and VisitCXXDestructor
in order to keep ExprEngine.cpp as clean as possible (leaving the details for

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160806 91177308-0d34-0410-b5e6-96231b3b80d8
9dc5167e4017ef4c8b327abb6f72225eec2e0f19 26-Jul-2012 Anna Zaks <ganna@apple.com> [analyzer] Inline ObjC class methods.

- Some cleanup(the TODOs) will be done after ObjC method inlining is
- Simplified CallEvent::getDefinition not to require ISDynamicDispatch
- Also addressed Jordan's comments from r160530.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160768 91177308-0d34-0410-b5e6-96231b3b80d8
829846b5002d7f8d6a54b9c58c3ecf7cac56d2cc 25-Jul-2012 Ted Kremenek <kremenek@apple.com> Remove ExprEngine::MarkBranch(), as it is no longer needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160761 91177308-0d34-0410-b5e6-96231b3b80d8
e81ce256b62717dd846bd19aecc4115a0dcd4995 20-Jul-2012 Anna Zaks <ganna@apple.com> [analyzer] Refactor VisitObjCMessage and VisitCallExpr to rely on the
same implementation for call evaluation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160530 91177308-0d34-0410-b5e6-96231b3b80d8
7ff8f5e9b1b8d87a64853735fc4218a6a9f70652 18-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove unused ExprEngine::VisitCXXTemporaryObjectExpr.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160457 91177308-0d34-0410-b5e6-96231b3b80d8
69f87c956b3ac2b80124fd9604af012e1061473a 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use CallEvent for inlining and call default-evaluation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159560 91177308-0d34-0410-b5e6-96231b3b80d8
cde8cdbd6a662c636164465ad309b5f17ff01064 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends.

Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper
around the existing ObjCMessage abstraction (over message sends and property
accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses
ObjCMessageSend and ObjCPropertyAccess.

In addition to removing yet another wrapper object, this should make it easy
to add a ObjCSubscriptAccess call event soon.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159558 91177308-0d34-0410-b5e6-96231b3b80d8
740d490593e0de8732a697c9f77b90ddd463863b 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Add a new abstraction over all types of calls: CallEvent

This is intended to replace CallOrObjCMessage, and is eventually intended to be
used for anything that cares more about /what/ is being called than /how/ it's
being called. For example, inlining destructors should be the same as inlining
blocks, and checking __attribute__((nonnull)) should apply to the allocator
calls generated by operator new.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159554 91177308-0d34-0410-b5e6-96231b3b80d8
10f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2 23-Jun-2012 Ted Kremenek <kremenek@apple.com> Implement initial static analysis inlining support for C++ methods.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159047 91177308-0d34-0410-b5e6-96231b3b80d8
8cd64b4c5553fa6284d248336cb7c82dc960a394 11-Jun-2012 Chad Rosier <mcrosier@apple.com> Etch out the code path for MS-style inline assembly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158325 91177308-0d34-0410-b5e6-96231b3b80d8
7fa9b4f258636d89342eda28f21a986c8ac353b1 01-Jun-2012 Ted Kremenek <kremenek@apple.com> static analyzer: add inlining support for directly called blocks.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157833 91177308-0d34-0410-b5e6-96231b3b80d8
0b3ade86a1c60cf0c7b56aa238aff458eb7f5974 20-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead bindings right before leaving a function.

This is needed to ensure that we always report issues in the correct
function. For example, leaks are identified when we call remove dead
bindings. In order to make sure we report a callee's leak in the callee,
we have to run the operation in the callee's context.

This change required quite a bit of infrastructure work since:
- We used to only run remove dead bindings before a given statement;
here we need to run it after the last statement in the function. For
this, we added additional Program Point and special mode in the
SymbolReaper to remove all symbols in context lower than the current
- The call exit operation turned into a sequence of nodes, which are
now guarded by CallExitBegin and CallExitEnd nodes for clarity and

(Sorry for the long diff.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
6a86082f3a06a2dcceaaf63f78a0e52d64bcbaa3 13-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] PCH deserialization optimization.

We should not deserialize unused declarations from the PCH file. Achieve
this by storing the top level declarations during parsing
(HandleTopLevelDecl ASTConsumer callback) and analyzing/building a call
graph only for those.

Tested the patch on a sample ObjC file that uses PCH. With the patch,
the analyzes is 17.5% faster and clang consumes 40% less memory.
Got about 10% overall build/analyzes time decrease on a large Objective
C project.

A bit of CallGraph refactoring/cleanup as well..

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154625 91177308-0d34-0410-b5e6-96231b3b80d8
bd613137499b1d4c3b63dccd0aa21f6add243f4f 07-Apr-2012 Ted Kremenek <kremenek@apple.com> Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that when we generate a new ExplodedNode
we use the same Expr* as the one being currently visited. This is preparation for transitioning to having
ProgramPoints refer to CFGStmts.

This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact,
as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for
the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra
argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but
it will look a lot cleaner when were start using CFGStmt* in the appropriate places.

As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed.
I have audited these, and they look reasonable.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154214 91177308-0d34-0410-b5e6-96231b3b80d8
e62f048960645b79363408fdead53fec2a063c52 03-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] Record the basic blocks covered by the analyzes run.

Store this info inside the function summary generated for all analyzed
functions. This is useful for coverage stats and can be helpful for
analyzer state space search strategies.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153923 91177308-0d34-0410-b5e6-96231b3b80d8
3bbd8cd831788c506f2980293eb3c7e1b3ca2501 30-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Do not inline functions which previously reached max block

This is an optimization for "retry without inlining" option. Here, if we
failed to inline a function due to reaching the basic block max count,
we are going to store this information and not try to inline it
again in the translation unit. This can be viewed as a function summary.

On sqlite, with this optimization, we are 30% faster then before and
cover 10% more basic blocks (partially because the number of times we
reach timeout is decreased by 20%).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153730 91177308-0d34-0410-b5e6-96231b3b80d8
253955ca25c7e7049963b5db613c0cd15d66e4f8 28-Mar-2012 Anna Zaks <ganna@apple.com> [analyser] Stats checker: do not mark a node as exhausted if we will
retry without inlining.

(+ other minor cleanups)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
5903a373db3d27794c90b25687e0dd6adb0e497d 27-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Add an option to re-analyze a dead-end path without inlining.

The analyzer gives up path exploration under certain conditions. For
example, when the same basic block has been visited more than 4 times.
With inlining turned on, this could lead to decrease in code coverage.
Specifically, if we give up inside the inlined function, the rest of
parent's basic blocks will not get analyzed.

This commit introduces an option to enable re-run along the failed path,
in which we do not inline the last inlined call site. This is done by
enqueueing the node before the processing of the inlined call site
with a special policy encoded in the state. The policy tells us not to
inline the call site along the path.

This lead to ~10% increase in the number of paths analyzed. Even though
we expected a much greater coverage improvement.

The option is turned off by default for now.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
3d7c44e01d568e5d5c0fac9c6ccb3f080157ba19 21-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Malloc: Utter the name of the leaked variable.
Specifically, we use the last store of the leaked symbol in the leak diagnostic.
(No support for struct fields since the malloc checker doesn't track those

+ Infrastructure to track the regions used in store evaluations.
This approach is more precise than iterating the store to
obtain the region bound to the symbol, which is used in RetainCount
checker. The region corresponds to what is uttered in the code in the
last store and we do not rely on the store implementation to support
this functionality.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
d7b83148ac0a537f5ec9be9d87bbec62b75435f4 15-Mar-2012 Jordy Rose <jediknil@belkadan.com> [analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ expressions with a "base object", because the CFG is now linearized.

The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152856 91177308-0d34-0410-b5e6-96231b3b80d8
e5049d29f74183d88a332ce4868e84a9c12893f0 14-Mar-2012 Erik Verbruggen <erikjv@me.com> [Analyser] Removes more recursive visitations in ExprEngine that are no
longer needed as the CFG is fully linearized.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152720 91177308-0d34-0410-b5e6-96231b3b80d8
337e4dbc6859589b8878146a88bebf754e916702 10-Mar-2012 Ted Kremenek <kremenek@apple.com> [analyzer] fix regression in analyzer of NOT actually aborting on Stmts it doesn't understand. We registered
as aborted, but didn't treat such cases as sinks in the ExplodedGraph.

Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly).

Fixes: <rdar://problem/10892489>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152468 91177308-0d34-0410-b5e6-96231b3b80d8
3fd5f370a28552976c52e76c3035d79012d78dda 09-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Add support for NoRedundancy inlining mode.

We do not reanalyze a function, which has already been analyzed as an
inlined callee. As per PRELIMINARY testing, this gives over
50% run time reduction on some benchmarks without decreasing of the
number of bugs found.

Turning the mode on by default.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152440 91177308-0d34-0410-b5e6-96231b3b80d8
a81d3d434e6581ff354eaf5b2a3c25c75771a792 04-Mar-2012 Erik Verbruggen <erikjv@me.com> Remove a recursive visitation in ExprEngine that is no longer needed because the CFG is fully linearized.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152007 91177308-0d34-0410-b5e6-96231b3b80d8
66c40400e7d6272b0cd675ada18dd62c1f0362c7 14-Feb-2012 Anna Zaks <ganna@apple.com> [analyzer] Make Malloc Checker optimistic in presence of inlining.
(In response of Ted's review of r150112.)

This moves the logic which checked if a symbol escapes through a
parameter to invalidateRegionCallback (instead of post CallExpr visit.)

To accommodate the change, added a CallOrObjCMessage parameter to
checkRegionChanges callback.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150513 91177308-0d34-0410-b5e6-96231b3b80d8
c35fb7d67d515659ad2325b4f6ec97c9fe64fb63 28-Jan-2012 Benjamin Kramer <benny.kra@googlemail.com> StaticAnalyzer: Move ObjC- and CXX-specific methods out of line so checkers that don't care about the language don't have to pull in all the headers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149178 91177308-0d34-0410-b5e6-96231b3b80d8
8bef8238181a30e52dea380789a7e2d760eac532 26-Jan-2012 Ted Kremenek <kremenek@apple.com> Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.

At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149081 91177308-0d34-0410-b5e6-96231b3b80d8
3070e13dca5bbefa32acb80ce4a7b217a6220983 07-Jan-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Remove CallEnterNodeBuilder and simplify ExprEngine::processCallEnter().

This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147705 91177308-0d34-0410-b5e6-96231b3b80d8
894212e9510299abb203801e014fec76b7926a05 07-Jan-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Remove CallExitNodeBuilder, and have ExprEngine::processCallExit() do the work manually. This is a nice simplification.

Along the way, fix Exprengine::processCallExit() to also perform the postStmt callback for checkers for CallExprs.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147697 91177308-0d34-0410-b5e6-96231b3b80d8
5eca482fe895ea57bc82410222e6426c09e63284 06-Jan-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining. Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back. There are also potential performance implications
of enlarging the Environment. Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment. This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
eb31a76d1cdaaf8874c549dc6bd964ff270d3822 05-Jan-2012 Anna Zaks <ganna@apple.com> [analyzer] Be less pessimistic about invalidation of global variables
as a result of a call.

Global variables, which come in from system libraries should not be
invalidated by all calls. Also, non-system globals should not be
invalidated by system calls.

The following solution to invalidation of globals seems flexible enough
for taint (does not invalidate stdin) and should not lead to too
many false positives. We split globals into 3 classes:

* immutable - values are preserved by calls (unless the specific
global is passed in as a parameter):
A : Most system globals and const scalars

* invalidated by functions defined in system headers:
B: errno

* invalidated by all other functions (note, these functions may in
turn contain system calls):
B: errno
C: all other globals (which are not in A nor B)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
c03a39e16762627b421247b12a2658be630a3300 26-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] GenericNodeBuilder -> NodeBuilder.

Remove GenericNodeBuilder and use a class inherited from NodeBuilder instead.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143057 91177308-0d34-0410-b5e6-96231b3b80d8
af498a28797c075c48d7e943df5f5a8e78ed8eb0 25-Oct-2011 Anna Zaks <ganna@apple.com> [analyze] Convert EndOfPath callback to use CheckerContext

Get rid of the EndOfPathBuilder completely.
Use the generic NodeBuilder to generate nodes.
Enqueue the end of path frontier explicitly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142943 91177308-0d34-0410-b5e6-96231b3b80d8
aa0aeb1cbe117db68d35700cb3a34aace0f99b99 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Node builders cleanup + comments
Renamed PureNodeBuilder->StmtNodeBuilder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142849 91177308-0d34-0410-b5e6-96231b3b80d8
056c4b46335a3bd2612414735d5749ee159c0165 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Completely remove the global Builder object.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142847 91177308-0d34-0410-b5e6-96231b3b80d8
ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert ExprEngine::visit() to use short lived builders.

This commit removes the major functional dependency on the ExprEngine::Builder
member variable.

In some cases the code became more verbose. Particularly, we call takeNodes()
and addNodes() to move responsibility for the nodes from one builder to another.
This will get simplified later on.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142831 91177308-0d34-0410-b5e6-96231b3b80d8
8ad8c546372fe602708cb7ceeaf0ebbb866735c6 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert VisitUnaryOperator to use short lived Node builders

To convert iteratively, we take the nodes the local builder will
process from the from the global builder and add the generated nodes
after the short lived builder is done. PureStmtNodeBuilder is the
one we should eventually use everywhere. Added Stmt index and Builder
context as ExprEngine globals. To avoid passing them around.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142828 91177308-0d34-0410-b5e6-96231b3b80d8
1aae01a8308d2f8e31adab3f4d7ac35543aac680 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Pass external Dst set to NodeBuilder

This moves the responsibility for storing the output node set from the
builder to the clients. The builder is just responsible for transforming
an input set into the output set: {SrcSet/SrcNode} -> {Frontier}.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142826 91177308-0d34-0410-b5e6-96231b3b80d8
1d26f48dc2eea1c07431ca1519d7034a21b9bcff 24-Oct-2011 Ted Kremenek <kremenek@apple.com> Rename AnalysisContext to AnalysisDeclContext. Not only is this name more accurate, but it frees up the name AnalysisContext for other uses.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142782 91177308-0d34-0410-b5e6-96231b3b80d8
b1b5daf30d2597e066936772bd206500232d7d65 23-Oct-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove LocationContext creation methods from AnalysisManager, and change clients to use AnalysisContext instead.

WIP to remove/reduce ExprEngine's usage of AnalysisManager.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142739 91177308-0d34-0410-b5e6-96231b3b80d8
4e82d3cf6fd4c907265e3fa3aac0a835c35dc759 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Make NodeBuilder and Pred node loosely coupled

NodeBuilder should not assume it's dealing with a single predecessor. Remove predecessor getters. Modify the BranchNodeBuilder to not be responsible for doing auto-transitions (which depend on a predecessor).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142453 91177308-0d34-0410-b5e6-96231b3b80d8
ad62deeb70e97da6bd514dd390ea1ce6af6ad81d 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Pull Pred out of NodeBuilderContext.
Each builder will have a different one, so it doesn't make sense to keep it in the context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142447 91177308-0d34-0410-b5e6-96231b3b80d8
a19f4af7a94835ce4693bfe12d6270754e79eb56 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] NodeBuilder Refactoring: Subclass BranchNodeBuilder from NodeBuilder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142444 91177308-0d34-0410-b5e6-96231b3b80d8
a81fffe678107d49a9f1c03d80adf85f18a9867f 12-Sep-2011 Anna Zaks <ganna@apple.com> Doxygen comments.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139508 91177308-0d34-0410-b5e6-96231b3b80d8
d1e5a89226da79f7e6f43d40facc46abda9e5245 02-Sep-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Remove TransferFuncs.h, then deal with the fallout.

And with that, TransferFuncs is gone!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139003 91177308-0d34-0410-b5e6-96231b3b80d8
17a38e2636a8b1ce473fc6504c4b16cb09db29f4 02-Sep-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Move the knowledge of whether or not GC is enabled for the current analysis from CFRefCount to ExprEngine.

Remove TransferFuncs from ExprEngine and AnalysisConsumer.

Demote RetainReleaseChecker to a regular checker, and give it the name osx.cocoa.RetainCount (class name change coming shortly). Update tests accordingly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138998 91177308-0d34-0410-b5e6-96231b3b80d8
f5e39ece75b18c9ce19351929d4879ad9731e7f5 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Header cleanup to decrease coupling (and recompilation). No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138729 91177308-0d34-0410-b5e6-96231b3b80d8
dbd658e139b3e0bf084f75feaea8d844af9e319f 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Introduce a new callback for checkers, printState, to be used for debug-printing the contents of a ProgramState.

Unlike the other callbacks, this one is a simple virtual method, since it is only to be used for debugging.

This new callback replaces the old ProgramState::Printer interface, and allows us to move the printing of refcount bindings from CFRefCount to RetainReleaseChecker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138728 91177308-0d34-0410-b5e6-96231b3b80d8
93bd5ca766c4d7906878f4ffe76ce1b2080e540b 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Remove the ProgramState argument from ExprEngine::evalBind; we were ignoring it anyway. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138720 91177308-0d34-0410-b5e6-96231b3b80d8
e38dd95dddb8f1b38469c8d0e28aa1c660489324 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Migrate argument invalidation from CFRefCount to ExprEngine.

This is a common path for function and C++ method calls, Objective-C messages and property accesses, and C++ construct-exprs.

As support, add message receiver accessors to ObjCMessage and CallOrObjCMessage.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138718 91177308-0d34-0410-b5e6-96231b3b80d8
537716ad8dd10f984b6cfe6985afade1185c5e3c 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Change the check::RegionChanges callback to include the regions explicitly requested for invalidation.

Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well.

Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138716 91177308-0d34-0410-b5e6-96231b3b80d8
500abad7edfcc2409b18dd616cdbc28a094926f5 21-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Migrate return value handling from CFRefCount to ExprEngine. This seems to result in a minor performance hit, but I think that will go away again once we eliminate TransferFuncs from function calls entirely.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138220 91177308-0d34-0410-b5e6-96231b3b80d8
f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9 20-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Handle reads of ObjCPropertyRefExprs implicitly in Environment. No need to bind an explicit value and create a new node.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138196 91177308-0d34-0410-b5e6-96231b3b80d8
6c7511db998817e64f2e124013e7d7c9a430c580 16-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] add ExprEngine::getEagerlyAssumedTags() to allow externally querying of "eagerly assumed" expressions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137704 91177308-0d34-0410-b5e6-96231b3b80d8
18c66fdc3c4008d335885695fe36fb5353c5f672 16-Aug-2011 Ted Kremenek <kremenek@apple.com> Rename GRState to ProgramState, and cleanup some code formatting along the way.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137665 91177308-0d34-0410-b5e6-96231b3b80d8
9c378f705405d37f49795d5e915989de774fe11f 13-Aug-2011 Ted Kremenek <kremenek@apple.com> Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
ca804539d908d3a0e8c72a0df5f1f571d29490bb 13-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] change "tag" in ProgramPoint from "void*" to a ProgramPointTag*.

Having a notion of an actual ProgramPointTag will aid in introspection of the analyzer's behavior.
For example, the GraphViz output of the analyzer will pretty-print the tags in a useful manner.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137529 91177308-0d34-0410-b5e6-96231b3b80d8
db5e8cd095d1ffdd18f5620ad2348b5f386bebe3 11-Aug-2011 Anna Zaks <ganna@apple.com> Cleanup: remove GetState() wrapper from ExprEngine, not needed as of r137273.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137279 91177308-0d34-0410-b5e6-96231b3b80d8
70a34da7a767bda69958d8f659de9f87b03de747 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitObjCForCollectionStmt because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136519 91177308-0d34-0410-b5e6-96231b3b80d8
4410a935e8d8ee3c903b858bbf74ca24fce629b5 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove explicit argument processing from ExprEngine::VisitObjCMessage() since it is no longer needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136518 91177308-0d34-0410-b5e6-96231b3b80d8
eea72a925f294225391ecec876a342771c09b635 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] fix handling of MaterializeTemporaryExpr by binding the result value to
the proper expression.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136412 91177308-0d34-0410-b5e6-96231b3b80d8
e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bc 26-May-2011 Ted Kremenek <kremenek@apple.com> static analyzer: when conservatively evaluating functions, don't invalidate the values of globals when the called function is strlen.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132100 91177308-0d34-0410-b5e6-96231b3b80d8
35bdbf40624beba3fc00cb72ab444659939c1a6b 02-May-2011 Ted Kremenek <kremenek@apple.com> Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130711 91177308-0d34-0410-b5e6-96231b3b80d8
d40066b0fb883839a9100e5455e33190b9b8abac 05-Apr-2011 Ted Kremenek <kremenek@apple.com> Fix PR 9626 (duplicated self-init warnings under -Wuninitialized) with numerous CFG and UninitializedValues analysis changes:

1) Change the CFG to include the DeclStmt for conditional variables, instead of using the condition itself as a faux DeclStmt.
2) Update ExprEngine (the static analyzer) to understand (1), so not to regress.
3) Update UninitializedValues.cpp to initialize all tracked variables to Uninitialized at the start of the function/method.
4) Only use the SelfReferenceChecker (SemaDecl.cpp) on global variables, leaving the dataflow analysis to handle other cases.

The combination of (1) and (3) allows the dataflow-based -Wuninitialized to find self-init problems when the initializer
contained control-flow.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128858 91177308-0d34-0410-b5e6-96231b3b80d8
422ab7a49a9a4252dbc6350e49d7a5708337b9c7 02-Apr-2011 Ted Kremenek <kremenek@apple.com> Teach IdempotentOperationsChecker about paths aborted because ExprEngine didn't know how to handle a specific Expr type.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128761 91177308-0d34-0410-b5e6-96231b3b80d8
b277159055933e610bbc80262b600d3ad7e0595c 30-Mar-2011 Ted Kremenek <kremenek@apple.com> Begin reworking static analyzer support for C++ method calls. The current logic was divorced
from how we process ordinary function calls, had a tremendous about of redundancy, and relied
strictly on inlining behavior (which was incomplete) to provide semantics instead of falling
back to the conservative analysis we use for C functions. This is a significant step into
making C++ analyzer support more useful.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128557 91177308-0d34-0410-b5e6-96231b3b80d8
f4e3cfbe8abd124be6341ef5d714819b4fbd9082 11-Mar-2011 Peter Collingbourne <peter@pcc.me.uk> Add support for the OpenCL vec_step operator, by generalising and
extending the existing support for sizeof and alignof. Original
patch by Guy Benyei.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127475 91177308-0d34-0410-b5e6-96231b3b80d8
ec8605f1d7ec846dbf51047bfd5c56d32d1ff91c 01-Mar-2011 Argyrios Kyrtzidis <akyrtzi@gmail.com> [analyzer] Rename CheckerV2 -> Checker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126726 91177308-0d34-0410-b5e6-96231b3b80d8
eb48bd1dd4168ab206a330bf523659170291a6a0 01-Mar-2011 Argyrios Kyrtzidis <akyrtzi@gmail.com> [analyzer] Remove checker V1 registration and running from ExprEngine.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126724 91177308-0d34-0410-b5e6-96231b3b80d8
769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5 22-Feb-2011 Argyrios Kyrtzidis <akyrtzi@gmail.com> [analyzer] Start moving the path-sensitive checkers to CheckerV2.

-Migrate ObjCSelfInitChecker to CheckerV2. In the process remove the 'preCallSelfFlags' field
from the checker class and use GRState for storing that info.
-Get ExprEngine to start delegating checker running to CheckerManager.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126229 91177308-0d34-0410-b5e6-96231b3b80d8
9b663716449b618ba0390b1dbebc54fa8e971124 10-Feb-2011 Ted Kremenek <kremenek@apple.com> Split 'include/clang/StaticAnalyzer' into 'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'.

This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125251 91177308-0d34-0410-b5e6-96231b3b80d8