History log of /external/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
ef8225444452a1486bd721f3285301fe84643b00 21-Jul-2014 Stephen Hines <srhines@google.com> Update Clang for rebase to r212749.

This also fixes a small issue with arm_neon.h not being generated always.

Includes a cherry-pick of:
r213450 - fixes mac-specific header issue
r213126 - removes a default -Bsymbolic on Android

Change-Id: I2a790a0f5d3b2aab11de596fc3a74e7cbc99081d
6bcf27bb9a4b5c3f79cb44c0e4654a6d7619ad89 29-May-2014 Stephen Hines <srhines@google.com> Update Clang for 3.5 rebase (r209713).

Change-Id: I8c9133b0f8f776dc915f270b60f94962e771bc83
651f13cea278ec967336033dd032faef0e9fc2ec 24-Apr-2014 Stephen Hines <srhines@google.com> Updated to Clang 3.5a.

Change-Id: I8127eb568f674c2e72635b639a3295381fe8af82
dd9e9cec6f863afa15dd91b34fbf15c66c678c02 09-Dec-2013 Bill Wendling <isanbard@gmail.com> Merging r196593:
r196593 | zaks | 2013-12-06 10:56:29 -0800 (Fri, 06 Dec 2013) | 7 lines

Revert "[analyzer] Refactor conditional expression evaluating code"

This reverts commit r189090.

The original patch introduced regressions (see the added live-variables.* tests). The patch depends on the correctness of live variable analyses, which are not computed correctly. I've opened PR18159 to track the proper resolution to this problem.

The patch was a stepping block to r189746. This is why part of the patch reverts temporary destructor tests that started crashing. The temporary destructors feature is disabled by default.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/branches/release_34@196795 91177308-0d34-0410-b5e6-96231b3b80d8
81557223ba8d7ef8b0468a6e1dc8fc79f2de46f2 25-Sep-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle destructors for the argument to C++ 'delete'.

Now that the CFG includes nodes for the destructors in a delete-expression,
process them in the analyzer using the same common destructor interface
currently used for local, member, and base destructors. Also, check for when
the value is known to be null, in which case no destructor is actually run.

This does not yet handle destructors for deleted /arrays/, which may need
more CFG work. It also causes a slight regression in the location of
double delete warnings; the double delete is detected at the destructor
call, which is implicit, and so is reported on the first access within the
destructor instead of at the 'delete' statement. This will be fixed soon.

Patch by Karthik Bhat!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191381 91177308-0d34-0410-b5e6-96231b3b80d8
da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8 25-Sep-2013 Anton Yartsev <anton.yartsev@gmail.com> [analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future.
With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters.

This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191342 91177308-0d34-0410-b5e6-96231b3b80d8
414a1bdbdaf250e0488589f12865c8961831b65d 18-Sep-2013 Hal Finkel <hfinkel@anl.gov> Add the intrinsic __builtin_convertvector

LLVM supports applying conversion instructions to vectors of the same number of
elements (fptrunc, fptosi, etc.) but there had been no way for a Clang user to
cause such instructions to be generated when using builtin vector types.

C-style casting on vectors is already defined in terms of bitcasts, and so
cannot be used for these conversions as well (without leading to a very
confusing set of semantics). As a result, this adds a __builtin_convertvector
intrinsic (patterned after the OpenCL __builtin_astype intrinsic). This is
intended to aid the creation of vector intrinsic headers that create generic IR
instead of target-dependent intrinsics (in other words, this is a generic
_mm_cvtepi32_ps). As noted in the documentation, the action of
__builtin_convertvector is defined in terms of the action of a C-style cast on
each vector element.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@190915 91177308-0d34-0410-b5e6-96231b3b80d8
36d558d85653315edb389677e995ec9ccdbfbf3d 03-Sep-2013 Jordan Rose <jordan_rose@apple.com> Add an implicit dtor CFG node just before C++ 'delete' expressions.

This paves the way for adding support for modeling the destructor of a
region before it is deleted. The statement "delete <expr>" now generates
this series of CFG elements:

1. <expr>
2. [B1.1]->~Foo() (Implicit destructor)
3. delete [B1.1]

Patch by Karthik Bhat!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@189828 91177308-0d34-0410-b5e6-96231b3b80d8
95ab9e306f4deefeabd89ea61987f4a8d67e0890 02-Sep-2013 Pavel Labath <labath@google.com> [analyzer] Add very limited support for temporary destructors

This is an improved version of r186498. It enables ExprEngine to reason about
temporary object destructors. However, these destructor calls are never
inlined, since this feature is still broken. Still, this is sufficient to
properly handle noreturn temporary destructors.

Now, the analyzer correctly handles expressions like "a || A()", and executes the
destructor of "A" only on the paths where "a" evaluted to false.

Temporary destructor processing is still off by default and one has to
explicitly request it by setting cfg-temporary-dtors=true.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1259

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@189746 91177308-0d34-0410-b5e6-96231b3b80d8
6a556a42d48cc098fb8dcb5d4ecdd0e03e32c0ec 23-Aug-2013 Pavel Labath <labath@google.com> [analyzer] Refactor conditional expression evaluating code

Instead of digging through the ExplodedGraph, to figure out which edge brought
us here, I compute the value of conditional expression by looking at the
sub-expression values.

To do this, I needed to change the liveness algorithm a bit -- now, the full
conditional expression also depends on all atomic sub-expressions, not only the
outermost ones.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1340

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@189090 91177308-0d34-0410-b5e6-96231b3b80d8
76b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0 26-Jul-2013 Pavel Labath <labath@google.com> [analyzer] Fix FP warnings when binding a temporary to a local static variable

When binding a temporary object to a static local variable, the analyzer would
complain about a dangling reference even though the temporary's lifetime should
be extended past the end of the function. This commit tries to detect these
cases and construct them in a global memory region instead of a local one.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1133

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@187196 91177308-0d34-0410-b5e6-96231b3b80d8
fee16225a103ee1459af4f3ecb89fa2804e81ac3 23-Jul-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Enable pseudo-destructor expressions.

These are cases where a scalar type is "destructed", usually due to
template instantiation (e.g. "obj.~T()", where 'T' is 'int'). This has
no actual effect and the analyzer should just skip over it.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186927 91177308-0d34-0410-b5e6-96231b3b80d8
9815ec0a00fe04db92e51a4160fc905f6cd48f30 23-Jul-2013 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Add very limited support for temporary destructors"

The analyzer doesn't currently expect CFG blocks with terminators to be
empty, but this can happen when generating conditional destructors for
a complex logical expression, such as (a && (b || Temp{})). Moreover,
the branch conditions for these expressions are not persisted in the
state. Even for handling noreturn destructors this needs more work.

This reverts r186498.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186925 91177308-0d34-0410-b5e6-96231b3b80d8
4fa7eab771ab8212e1058bd1a91061ff120c8fbb 19-Jul-2013 Alexey Bataev <a.bataev@hotmail.com> OpenMP: basic support for #pragma omp parallel

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186647 91177308-0d34-0410-b5e6-96231b3b80d8
ac7cc2d37e82181e73fcc265c1d0a619d18b7605 19-Jul-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Include analysis stack in crash traces.

Sample output:

0. Program arguments: ...
1. <eof> parser at end of file
2. While analyzing stack:
#0 void inlined()
#1 void test()
3. crash-trace.c:6:3: Error evaluating statement

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186639 91177308-0d34-0410-b5e6-96231b3b80d8
bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0 17-Jul-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle C++11 member initializer expressions.

Previously, we would simply abort the path when we saw a default member
initialization; now, we actually attempt to evaluate it. Like default
arguments, the contents of these expressions are not actually part of the
current function, so we fall back to constant evaluation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186521 91177308-0d34-0410-b5e6-96231b3b80d8
be2e1b11e3350e3a6e632c71beaab83aae3824d2 17-Jul-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Treat std::initializer_list as opaque rather than aborting.

Previously, the use of a std::initializer_list (actually, a
CXXStdInitializerListExpr) would cause the analyzer to give up on the rest
of the path. Now, it just uses an opaque symbolic value for the
initializer_list and continues on.

At some point in the future we can add proper support for initializer_list,
with access to the elements in the InitListExpr.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186519 91177308-0d34-0410-b5e6-96231b3b80d8
046e79a425bfa82b480b8a07ce11d96391fa0a9b 17-Jul-2013 Pavel Labath <labath@google.com> [analyzer] Add very limited support for temporary destructors

This patch enables ExprEndgine to reason about temporary object destructors.
However, these destructor calls are never inlined, since this feature is still
broken. Still, this is sufficient to properly handle noreturn temporary
destructors and close bug #15599. I have also enabled the cfg-temporary-dtors
analyzer option by default.

Reviewers: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1131

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@186498 91177308-0d34-0410-b5e6-96231b3b80d8
ed2e2de580f840385f25a188ed48d2a14948af76 02-Jul-2013 Pavel Labath <labath@google.com> Teach static analyzer about AttributedStmts

Static analyzer used to abort when encountering AttributedStmts, because it
asserted that the statements should not appear in the CFG. This is however not
the case, since at least the clang::fallthrough annotation makes it through.

This commit simply makes the analyzer ignore the statement attributes.

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1030

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@185417 91177308-0d34-0410-b5e6-96231b3b80d8
7c3e615f01e8f9f587315800fdaf2305ed824568 13-Jun-2013 Richard Smith <richard-llvm@metafoo.co.uk> PR12086, PR15117

Introduce CXXStdInitializerListExpr node, representing the implicit
construction of a std::initializer_list<T> object from its underlying array.
The AST representation of such an expression goes from an InitListExpr with a
flag set, to a CXXStdInitializerListExpr containing a MaterializeTemporaryExpr
containing an InitListExpr (possibly wrapped in a CXXBindTemporaryExpr).

This more detailed representation has several advantages, the most important of
which is that the new MaterializeTemporaryExpr allows us to directly model
lifetime extension of the underlying temporary array. Using that, this patch
*drastically* simplifies the IR generation of this construct, provides IR
generation support for nested global initializer_list objects, fixes several
bugs where the destructors for the underlying array would accidentally not get
invoked, and provides constant expression evaluation support for
std::initializer_list objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@183872 91177308-0d34-0410-b5e6-96231b3b80d8
5955c37230046e8c297f5afb9f91b7c8c1e18446 07-Jun-2013 Anna Zaks <ganna@apple.com> [analyzer] fixup the comment

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@183450 91177308-0d34-0410-b5e6-96231b3b80d8
73b417f363a67439b30b3167ef8d9fb32e37191b 06-Jun-2013 Anna Zaks <ganna@apple.com> [analyzer] Fix a crash that occurs when processing an rvalue array.

When processing ArrayToPointerDecay, we expect the array to be a location, not a LazyCompoundVal.
Special case the rvalue arrays by using a location to represent them. This case is handled similarly
elsewhere in the code.

Fixes PR16206.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@183359 91177308-0d34-0410-b5e6-96231b3b80d8
1acb394679b6e644044a0f6c358229759009b1a6 29-May-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Accept references to variables declared "extern void" (C only).

In C, 'void' is treated like any other incomplete type, and though it is
never completed, you can cast the address of a void-typed variable to do
something useful. (In C++ it's illegal to declare a variable with void type.)

Previously we asserted on this code; now we just treat it like any other
incomplete type.

And speaking of incomplete types, we don't know their extent. Actually
check that in TypedValueRegion::getExtent, though that's not being used
by any checkers that are on by default.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@182880 91177308-0d34-0410-b5e6-96231b3b80d8
4b75085f5669efc6407c662b5686361624c3ff2f 02-May-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't try to evaluate MaterializeTemporaryExpr as a constant.

...and don't consider '0' to be a null pointer constant if it's the
initializer for a float!

Apparently null pointer constant evaluation looks through both
MaterializeTemporaryExpr and ImplicitCastExpr, so we have to be more
careful about types in the callers. For RegionStore this just means giving
up a little more; for ExprEngine this means handling the
MaterializeTemporaryExpr case explicitly.

Follow-up to r180894.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180944 91177308-0d34-0410-b5e6-96231b3b80d8
e2b1246a24e8babf2f58c93713fba16b8edb8e2d 02-May-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Consolidate constant evaluation logic in SValBuilder.

Previously, this was scattered across Environment (literal expressions),
ExprEngine (default arguments), and RegionStore (global constants). The
former special-cased several kinds of simple constant expressions, while
the latter two deferred to the AST's constant evaluator.

Now, these are all unified as SValBuilder::getConstantVal(). To keep
Environment fast, the special cases for simple constant expressions have
been left in, but the main benefits are that (a) unusual constants like
ObjCStringLiterals now work as default arguments and global constant
initializers, and (b) we're not duplicating code between ExprEngine and

This actually caught a bug in our test suite, which is awesome: we stop
tracking allocated memory if it's passed as an argument along with some
kind of callback, but not if the callback is 0. We were testing this in
a case where the callback parameter had a default value, but that value
was 0. After this change, the analyzer now (correctly) flags that as a


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180894 91177308-0d34-0410-b5e6-96231b3b80d8
c3bf52ced9652f555aa0767bb822ec4c64546212 21-Apr-2013 Richard Smith <richard-llvm@metafoo.co.uk> C++1y: Allow aggregates to have default initializers.

Add a CXXDefaultInitExpr, analogous to CXXDefaultArgExpr, and use it both in
CXXCtorInitializers and in InitListExprs to represent a default initializer.

There's an additional complication here: because the default initializer can
refer to the initialized object via its 'this' pointer, we need to make sure
that 'this' points to the right thing within the evaluation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179958 91177308-0d34-0410-b5e6-96231b3b80d8
044fe23e79fff3841cc4c315f8c97e1cdccdd8dd 19-Apr-2013 Anton Yartsev <anton.yartsev@gmail.com> [analyzer] Call proper callback for const regions escaped other then on call.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179846 91177308-0d34-0410-b5e6-96231b3b80d8
476f41c4750421a7ead5014e75a0e790ff682754 18-Apr-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't crash if we cache out after making a temporary region.

A C++ overloaded operator may be implemented as an instance method, and
that instance method may be called on an rvalue object, which has no
associated region. The analyzer handles this by creating a temporary region
just for the evaluation of this call; however, it is possible that /by
creating the region/, the analyzer ends up in a previously-explored state.
In this case we don't need to continue along this path.

This doesn't actually show any behavioral change now, but it starts being
used with the next commit and prevents an assertion failure there.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179766 91177308-0d34-0410-b5e6-96231b3b80d8
051303ce09291dfbed537fa33b0d8a4d92c82b75 16-Apr-2013 Tareq A. Siraj <tareq.a.sriaj@intel.com> Implement CapturedStmt AST

CapturedStmt can be used to implement generic function outlining as described in

CapturedStmt is not exposed to the C api.

Serialization and template support are pending.

Author: Wei Pan <wei.pan@intel.com>

Differential Revision: http://llvm-reviews.chandlerc.com/D370

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179615 91177308-0d34-0410-b5e6-96231b3b80d8
76da55d3a49e1805f51b1ced7c5da5bcd7f759d8 16-Apr-2013 John McCall <rjmccall@apple.com> Basic support for Microsoft property declarations and
references thereto.

Patch by Tong Shen!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179585 91177308-0d34-0410-b5e6-96231b3b80d8
28117be48de465bc2862a8f4aaab09338be5090b 16-Apr-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't assert on a temporary of pointer-to-member type.

While we don't do anything intelligent with pointers-to-members today,
it's perfectly legal to need a temporary of pointer-to-member type to, say,
pass by const reference. Tweak an assertion to allow this.

PR15742 and PR15747

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179563 91177308-0d34-0410-b5e6-96231b3b80d8
a5796f87229b4aeebca71fa6ee1790ae7a5a0382 09-Apr-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().

Previously, the analyzer used isIntegerType() everywhere, which uses the C
definition of "integer". The C++ predicate with the same behavior is

However, the analyzer is /really/ using this to ask if it's some sort of
"integrally representable" type, i.e. it should include C++11 scoped
enumerations as well. hasIntegerRepresentation() sounds like the right
predicate, but that includes vectors, which the analyzer represents by its

This commit audits all uses of isIntegerType() and replaces them with the
general isIntegerOrEnumerationType(), except in some specific cases where
it makes sense to exclude scoped enumerations, or any enumerations. These
cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>()
plus BuiltinType::isInteger().

isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and
include/clang/StaticAnalysis. :-)

Fixes real assertion failures. PR15703 / <rdar://problem/12350701>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179081 91177308-0d34-0410-b5e6-96231b3b80d8
610f79cbab4d752349b5c81a94682a6a82b102e7 05-Apr-2013 Anna Zaks <ganna@apple.com> [analyzer] Show path diagnostic for C++ initializers

Also had to modify the PostInitializer ProgramLocation to contain the field region.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178826 91177308-0d34-0410-b5e6-96231b3b80d8
08291a937a149dbd036fd6ac8ab061eb8034343d 03-Apr-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Correctly handle destructors for lifetime-extended temporaries.

The lifetime of a temporary can be extended when it is immediately bound
to a local reference:

const Value &MyVal = Value("temporary");

In this case, the temporary object's lifetime is extended for the entire
scope of the reference; at the end of the scope it is destroyed.

The analyzer was modeling this improperly in two ways:
- Since we don't model temporary constructors just yet, we create a fake
temporary region when it comes time to "materialize" a temporary into
a real object (lvalue). This wasn't taking base casts into account when
the bindings being materialized was Unknown; now it always respects base
casts except when the temporary region is itself a pointer.
- When actually destroying the region, the analyzer did not actually load
from the reference variable -- it was basically destroying the reference
instead of its referent. Now it does do the load.

This will be more useful whenever we finally start modeling temporaries,
or at least those that get bound to local reference variables.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178697 91177308-0d34-0410-b5e6-96231b3b80d8
ecee1651c100342366a9417c85c6e50399039930 03-Apr-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Better model for copying of array fields in implicit copy ctors.

- Find the correct region to represent the first array element when
constructing a CXXConstructorCall.
- If the array is trivial, model the copy with a primitive load/store.
- Don't warn about the "uninitialized" subscript in the AST -- we don't use
the helper variable that Sema provides.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178602 91177308-0d34-0410-b5e6-96231b3b80d8
0f5c5c60e9806d13f0907cd99d7204ffab0e08f7 29-Mar-2013 Ted Kremenek <kremenek@apple.com> Add static analyzer support for conditionally executing static initializers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178318 91177308-0d34-0410-b5e6-96231b3b80d8
41988f331a74a72cf243a2a68ffb56418e9a174e 29-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Add support for escape of const pointers and use it to allow “newed” pointers to escape

Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works
for const pointers passed as a top level parameter into a function. We need to differentiate the const
pointers escape from regular escape since the content pointed by const pointer will not change;
if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers.

This should suppress several false positives reported by the NewDelete checker on llvm codebase.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178310 91177308-0d34-0410-b5e6-96231b3b80d8
1aa4f5019164592643bf46b7d61f15b6ef509c8e 22-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Fix ExprEngine::ViewGraph to handle C++ initializers.

Debugging aid only, no functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177762 91177308-0d34-0410-b5e6-96231b3b80d8
74f6982232c25ae723b1cc5abc59665a10867f21 20-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Track malloc'd memory into struct fields.

Due to improper modelling of copy constructors (specifically, their
const reference arguments), we were producing spurious leak warnings
for allocated memory stored in structs. In order to silence this, we
decided to consider storing into a struct to be the same as escaping.
However, the previous commit has fixed this issue and we can now properly
distinguish leaked memory that happens to be in a struct from a buffer
that escapes within a struct wrapper.

Originally applied in r161511, reverted in r174468.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177571 91177308-0d34-0410-b5e6-96231b3b80d8
c9963132736782d0c9178c744b3e2307cfb98a08 16-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Eliminate InterExplodedGraphMap class and NodeBackMap typedef.

...in favor of this typedef:

typedef llvm::DenseMap<const ExplodedNode *, const ExplodedNode *>

Use this everywhere the previous class and typedef were used.

Took the opportunity to ArrayRef-ize ExplodedGraph::trim while I'm at it.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177215 91177308-0d34-0410-b5e6-96231b3b80d8
eafb5c694cc5d165149fcb9453bc9355fb0d44a5 26-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't look through casts when creating pointer temporaries.

Normally, we need to look through derived-to-base casts when creating
temporary object regions (added in r175854). However, if the temporary
is a pointer (rather than a struct/class instance), we need to /preserve/
the base casts that have been applied.

This also ensures that we really do create a new temporary region when
we need to: MaterializeTemporaryExpr and lvalue CXXDefaultArgExprs.

Fixes PR15342, although the test case doesn't include the crash because
I couldn't isolate it.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176069 91177308-0d34-0410-b5e6-96231b3b80d8
fbdbed3bde8577815826b9d15790e5effb913f7b 25-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle reference parameters with default values.

r175026 added support for default values, but didn't take reference
parameters into account, which expect the default argument to be an
lvalue. Use createTemporaryRegionIfNeeded if we can evaluate the default
expr as an rvalue but the expected result is an lvalue.

Fixes the most recent report of PR12915. The original report predates
default argument support, so that can't be it.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176042 91177308-0d34-0410-b5e6-96231b3b80d8
b07805485c603be3d8011f72611465324c9e664b 23-Feb-2013 David Blaikie <dblaikie@gmail.com> Remove the CFGElement "Invalid" state.

Use Optional<CFG*> where invalid states were needed previously. In the one case
where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy

Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek
and Doug Gregor.

Post commit code review feedback on r175796 by Ted Kremenek.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175938 91177308-0d34-0410-b5e6-96231b3b80d8
5e5440ba9c135f523f72e7e7c5da59d390d697c5 22-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Make sure a materialized temporary matches its bindings.

This is a follow-up to r175830, which made sure a temporary object region
created for, say, a struct rvalue matched up with the initial bindings
being stored into it. This does the same for the case in which the AST
actually tells us that we need to create a temporary via a
MaterializeObjectExpr. I've unified the two code paths and moved a static
helper function onto ExprEngine.

This also caused a bit of test churn, causing us to go back to describing
temporary regions without a 'const' qualifier. This seems acceptable; it's
our behavior from a few months ago.

<rdar://problem/13265460> (part 2)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175854 91177308-0d34-0410-b5e6-96231b3b80d8
87193dac8f2c6c8f7ee1aa9eeb64622ec75c881b 22-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Fix buildbot by not reusing a variable name.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175848 91177308-0d34-0410-b5e6-96231b3b80d8
9f1d541ef1aca8f953e5bb4e7177969f0a2062d5 22-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Make sure a temporary object region matches its initial bindings.

When creating a temporary region (say, when a struct rvalue is used as
the base of a member expr), make sure we account for any derived-to-base
casts. We don't actually record these in the LazyCompoundVal that
represents the rvalue, but we need to make sure that the temporary region
we're creating (a) matches the bindings, and (b) matches its expression.

Most of the time this will do exactly the same thing as before, but it
fixes spurious "garbage value" warnings introduced in r175234 by the use
of lazy bindings to model trivial copy constructors.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175830 91177308-0d34-0410-b5e6-96231b3b80d8
7a95de68c093991047ed8d339479ccad51b88663 21-Feb-2013 David Blaikie <dblaikie@gmail.com> Replace ProgramPoint llvm::cast support to be well-defined.

See r175462 for another example/more details.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175812 91177308-0d34-0410-b5e6-96231b3b80d8
fdf6a279c9a75c778eba382d9a156697092982a1 21-Feb-2013 David Blaikie <dblaikie@gmail.com> Replace CFGElement llvm::cast support to be well-defined.

See r175462 for another example/more details.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175796 91177308-0d34-0410-b5e6-96231b3b80d8
4411b423e91da0a2c879b70c0222aeba35f72044 21-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Record whether a base object region represents a virtual base.

This allows MemRegion and MemRegionManager to avoid asking over and over
again whether an class is a virtual base or a non-virtual base.

Minor optimization/cleanup; no functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175716 91177308-0d34-0410-b5e6-96231b3b80d8
dc84cd5efdd3430efb22546b4ac656aa0540b210 20-Feb-2013 David Blaikie <dblaikie@gmail.com> Include llvm::Optional in clang/Basic/LLVM.h

Post-commit CR feedback from Jordan Rose regarding r175594.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175679 91177308-0d34-0410-b5e6-96231b3b80d8
5251abea41b446c26e3239c8dd6c7edea6fc335d 20-Feb-2013 David Blaikie <dblaikie@gmail.com> Replace SVal llvm::cast support to be well-defined.

See r175462 for another example/more details.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175594 91177308-0d34-0410-b5e6-96231b3b80d8
38f68ef19cb51d5876e9025b5fceb44b33ec9ed7 13-Feb-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Use Clang's evaluation for global constants and default arguments.

Previously, we were handling only simple integer constants for globals and
the smattering of implicitly-valued expressions handled by Environment for
default arguments. Now, we can use any integer constant expression that
Clang can evaluate, in addition to everything we handled before.

PR15094 / <rdar://problem/12830437>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175026 91177308-0d34-0410-b5e6-96231b3b80d8
233e26acc0ff2a1098f4c813f69286fce840a422 08-Feb-2013 Anna Zaks <ganna@apple.com> [analyzer] Add pointer escape type param to checkPointerEscape callback

The checkPointerEscape callback previously did not specify how a
pointer escaped. This change includes an enum which describes the
different ways a pointer may escape. This enum is passed to the
checkPointerEscape callback when a pointer escapes. If the escape
is due to a function call, the call is passed. This changes
previous behavior where the call is passed as NULL if the escape
was due to indirectly invalidating the region the pointer referenced.

A patch by Branden Archer!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174677 91177308-0d34-0410-b5e6-96231b3b80d8
b98c6fe8877b809d4da3020692c9b38f972b92cf 06-Feb-2013 Anna Zaks <ganna@apple.com> [analyzer]Revert part of r161511; suppresses leak false positives in C++

This is a "quick fix".

The underlining issue is that when a const pointer to a struct is passed
into a function, we do not invalidate the pointer fields. This results
in false positives that are common in C++ (since copy constructors are
prevalent). (Silences two llvm false positives.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174468 91177308-0d34-0410-b5e6-96231b3b80d8
07c52d2813a6b5e4025276d3687bd25f75fd51b9 26-Jan-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] C++ initializers may require cleanups; look through these.

When the analyzer sees an initializer, it checks if the initializer
contains a CXXConstructExpr. If so, it trusts that the CXXConstructExpr
does the necessary work to initialize the object, and performs no further

This patch looks through any implicit wrapping expressions like
ExprWithCleanups to find the CXXConstructExpr inside.

Fixes PR15070.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173557 91177308-0d34-0410-b5e6-96231b3b80d8
16303fcc569ea149dc2de38ff9e367d2d4831cee 15-Jan-2013 David Greene <greened@obbligato.org> Fix Cast

Properly use const_cast to fix a cast-away-const error.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172561 91177308-0d34-0410-b5e6-96231b3b80d8
cfa88f893915ceb8ae4ce2f17c46c24a4d67502f 12-Jan-2013 Dmitri Gribenko <gribozavr@gmail.com> Remove useless 'llvm::' qualifier from names like StringRef and others that are
brought into 'clang' namespace by clang/Basic/LLVM.h

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172323 91177308-0d34-0410-b5e6-96231b3b80d8
344c77aac25e5d960aced3f45fbaa09853383f6d 03-Jan-2013 Anna Zaks <ganna@apple.com> [analyzer] Rename callback EndPath -> EndFunction

This better reflects when callback is called and what the checkers
are relying on. (Both names meant the same pre-IPA.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171432 91177308-0d34-0410-b5e6-96231b3b80d8
1655bcd052a67a3050fc55df8ecce57342352e68 21-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Address Jordan's nitpicks as per code review of r170625.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170832 91177308-0d34-0410-b5e6-96231b3b80d8
bf53dfac8195835028bd6347433f7dbebcc29fc1 20-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Add the pointer escaped callback.

Instead of using several callbacks to identify the pointer escape event,
checkers now can register for the checkPointerEscape.

Converted the Malloc checker to use the new callback.
SimpleStreamChecker will be converted next.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170625 91177308-0d34-0410-b5e6-96231b3b80d8
d74324371465a152387ac45e737ab7d23e543552 14-Dec-2012 Anton Yartsev <anton.yartsev@gmail.com> fixed line endings

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170238 91177308-0d34-0410-b5e6-96231b3b80d8
2bfa166a26edb6f26915abe38caa551dbb05ad19 14-Dec-2012 Anton Yartsev <anton.yartsev@gmail.com> added post-statement callback to CXXNewExpr and pre-statement callback to CXXDeleteExpr

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170234 91177308-0d34-0410-b5e6-96231b3b80d8
12b3e3199c530b72f3cc44dd24a1e20ed6086292 14-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Propagate the checker's state from checkBranchCondition

Fixes a bug, where we were dropping the state modifications from the
checkBranchCondition checker callback.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@170232 91177308-0d34-0410-b5e6-96231b3b80d8
75f31c4862643ab09479c979fabf754e7ffe1460 07-Dec-2012 Anna Zaks <ganna@apple.com> [analyzer] Optimization heuristic: do not reanalyze every ObjC method as
top level.

This heuristic is already turned on for non-ObjC methods
(inlining-mode=noredundancy). If a method has been previously analyzed,
while being inlined inside of another method, do not reanalyze it as top

This commit applies it to ObjCMethods as well. The main caveat here is
that to catch the retain release errors, we are still going to reanalyze
all the ObjC methods but without inlining turned on.

Gives 21% performance increase on one heavy ObjC benchmark, which
suffered large performance regressions due to ObjC inlining.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169639 91177308-0d34-0410-b5e6-96231b3b80d8
9428723d6730f4fd257e15b78d24991ae95bbd84 06-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove unused fields from ExprEngine.

'currStmt', 'CleanedState', and 'EntryNode' were being set, but only ever
used locally.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169529 91177308-0d34-0410-b5e6-96231b3b80d8
e9cd031c77a92015571425b6445e8867816997cd 06-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove checks that predate the linearized CFG.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169528 91177308-0d34-0410-b5e6-96231b3b80d8
6960d08b4ddf389d7c81504df7f16dc645120482 06-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use optimized assumeDual for branches.

This doesn't seem to make much of a difference in practice, but it does
have the potential to avoid a trip through the constraint manager.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169524 91177308-0d34-0410-b5e6-96231b3b80d8
7affe151f5689b2d3547b8947c4099532c78a021 06-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove bindExprAndLocation, which does extra work for no gain.

This feature was probably intended to improve diagnostics, but was currently
only used when dumping the Environment. It shows what location a given value
was loaded from, e.g. when evaluating an LValueToRValue cast.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169522 91177308-0d34-0410-b5e6-96231b3b80d8
55fc873017f10f6f566b182b70f6fc22aefa3464 04-Dec-2012 Chandler Carruth <chandlerc@gmail.com> Sort all of Clang's files under 'lib', and fix up the broken headers

This required manually correcting all of the incorrect main-module
headers I could find, and running the new llvm/utils/sort_includes.py
script over the files.

I also manually added quite a few missing headers that were uncovered by
shuffling the order or moving headers up to be main-module-headers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169237 91177308-0d34-0410-b5e6-96231b3b80d8
84c484545c5906ba55143e212b4a5275ab55889f 15-Nov-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Mark symbol values as dead in the environment.

This allows us to properly remove dead bindings at the end of the top-level
stack frame, using the ReturnStmt, if there is one, to keep the return value
live. This in turn removes the need for a check::EndPath callback in leak

This does cause some changes in the path notes for leak checkers. Previously,
a leak would be reported at the location of the closing brace in a function.
Now, it gets reported at the last statement. This matches the way leaks are
currently reported for inlined functions, but is less than ideal for both.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168066 91177308-0d34-0410-b5e6-96231b3b80d8
8501b7a1c4c4a9ba0ea6cb8e500e601ef3759deb 03-Nov-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead on end of path.

This will simplify checkers that need to register for leaks. Currently,
they have to register for both: check dead and check end of path.

I've modified the SymbolReaper to consider everything on the stack dead
if the input StackLocationContext is 0.

(This is a bit disruptive, so I'd like to flash out all the issues

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167352 91177308-0d34-0410-b5e6-96231b3b80d8
b355be838a22a511d078504b2277f70aea52ca85 03-Nov-2012 Anna Zaks <ganna@apple.com> [analyzer] Refactor: Remove Pred from NodeBuilderContext.

Node builders should manage the nodes, not the context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167350 91177308-0d34-0410-b5e6-96231b3b80d8
603513d2294c437b37bcf47f326b686e31bd9e84 24-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle 'SomeVar.SomeEnumConstant', which is legal in C++.

This caused assertion failures analyzing LLVM.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166529 91177308-0d34-0410-b5e6-96231b3b80d8
4d9e497a2b1eab3b1214848216050c64fc3acfd6 24-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace -analyzer-no-eagerly-trim-egraph with graph-trim-interval.

After every 1000 CFGElements processed, the ExplodedGraph trims out nodes
that satisfy a number of criteria for being "boring" (single predecessor,
single successor, and more). Rather than controlling this with a cc1 option,
which can only disable this behavior, we now have an analyzer-config option,
'graph-trim-interval', which can change this interval from 1000 to something
else. Setting the value to 0 disables reclamation.

The next commit relies on this behavior to actually test anything.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166528 91177308-0d34-0410-b5e6-96231b3b80d8
f1e67d75fc922ff905de9faa6326bb1a96685ec1 17-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Create a temporary region when accessing a struct rvalue.

In C++, rvalues that need to have their address taken (for example, to be
passed to a function by const reference) will be wrapped in a
MaterializeTemporaryExpr, which lets CodeGen know to create a temporary
region to store this value. However, MaterializeTemporaryExprs are /not/
created when a method is called on an rvalue struct, even though the 'this'
pointer needs a valid value. CodeGen works around this by creating a
temporary region anyway; now, so does the analyzer.

The analyzer also does this when accessing a field of a struct rvalue.
This is a little unfortunate, since the rest of the struct will soon be
thrown away, but it does make things consistent with the rest of the

This allows us to bring back the assumption that all known 'this' values
are Locs. This is a revised version of r164828-9, reverted in r164876-7.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166120 91177308-0d34-0410-b5e6-96231b3b80d8
d27a368f4800b447b970b7c438d0fb4da00838dc 01-Oct-2012 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Check that a member expr is valid even when the result is an lvalue."

The original intent of this commit was to catch potential null dereferences
early, but it breaks the common "home-grown offsetof" idiom (PR13927):

(((struct Foo *)0)->member - ((struct foo *)0))

As it turns out, this appears to be legal in C, per a footnote in
C11 "Thus, &*E is equivalent to E (even if E is a null pointer)".
In C++ this issue is still open:

We'll just have to make sure we have good path notes in the future.

This reverts r164441 / 9be016dcd1ca3986873a7b66bd4bc027309ceb59.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164958 91177308-0d34-0410-b5e6-96231b3b80d8
ca5d78d0bc3010164f2f9682967d64d7e305a167 01-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Make ProgramStateManager's SubEngine parameter optional.

It is possible and valid to have a state manager and associated objects
without having a SubEngine or checkers.

Patch by Olaf Krzikalla!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164947 91177308-0d34-0410-b5e6-96231b3b80d8
ce6644bc1e921833f9b3c10cf7d4a0b78e8d5dc9 29-Sep-2012 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Create a temporary region for rvalue structs when accessing fields"

This reverts commit 6f61df3e7256413dcb99afb9673f4206e3c4992c.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164877 91177308-0d34-0410-b5e6-96231b3b80d8
20aa40342bd74895128860c081aa84cd85bfa68d 29-Sep-2012 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Create a temp region when a method is called on a struct rvalue."

This reverts commit 0006ba445962621ed82ec84400a6b978205a3fbc.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164876 91177308-0d34-0410-b5e6-96231b3b80d8
0006ba445962621ed82ec84400a6b978205a3fbc 28-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Create a temp region when a method is called on a struct rvalue.

An rvalue has no address, but calling a C++ member function requires a
'this' pointer. This commit makes the analyzer create a temporary region
in which to store the struct rvalue and use as a 'this' pointer whenever
a member function is called on an rvalue, which is essentially what
CodeGen does.

More of <rdar://problem/12137950>. The last part is tracking down the
C++ FIXME in array-struct-region.cpp.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164829 91177308-0d34-0410-b5e6-96231b3b80d8
6f61df3e7256413dcb99afb9673f4206e3c4992c 28-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Create a temporary region for rvalue structs when accessing fields

Struct rvalues are represented in the analyzer by CompoundVals,
LazyCompoundVals, or plain ConjuredSymbols -- none of which have associated
regions. If the entire structure is going to persist, this is not a
problem -- either the rvalue will be assigned to an existing region, or
a MaterializeTemporaryExpr will be present to create a temporary region.
However, if we just need a field from the struct, we need to create the
temporary region ourselves.

This is inspired by the way CodeGen handles calls to temporaries;
support for that in the analyzer is coming next.

Part of <rdar://problem/12137950>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164828 91177308-0d34-0410-b5e6-96231b3b80d8
dd1d7d88f1fe6d7d7e79acaec3f83bc10d9f7b97 22-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Check that a member expr is valid even when the result is an lvalue.

We want to catch cases like this early, so that we can produce better
diagnostics and path notes:

Point *p = 0;
int *px = &p->x; // should warn here
*px = 1;

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164441 91177308-0d34-0410-b5e6-96231b3b80d8
4ef19205b6912316296db74a9073ad6fa60e4cca 13-Sep-2012 Ted Kremenek <kremenek@apple.com> Refactor logic in ExprEngine for detecting 'noreturn' methods
in NSException to a helper object in libAnalysis that can also
be used by Sema. Not sure if the predicate name 'isImplicitNoReturn'
is the best one, but we can massage that later.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163759 91177308-0d34-0410-b5e6-96231b3b80d8
9a4db032ecd991626d236a502e770126db32bd31 12-Sep-2012 Richard Smith <richard-llvm@metafoo.co.uk> PR13811: Add a FunctionParmPackExpr node to handle references to function
parameter packs where the reference is not being expanded but the pack has
been. Previously, Clang would segfault in such cases.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163672 91177308-0d34-0410-b5e6-96231b3b80d8
200fa2e70d52ae6d620e81cd45536071fdde70c0 06-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Don't attempt to devirtualize calls to base class destructors.

CXXDestructorCall now has a flag for when it is a base destructor call.
Other kinds of destructor calls (locals, fields, temporaries, and 'delete')
all behave as "whole-object" destructors and do not behave differently
from one another (specifically, in these cases we /should/ try to
devirtualize a call to a virtual destructor).

This was causing crashes in both our internal buildbot, the crash still
being tracked in PR13765, and some of the crashes being tracked in PR13763,
due to a assertion failure. (The behavior under -Asserts happened to be
correct anyway.)

Adding this knowledge also allows our DynamicTypePropagation checker to do
a bit less work; the special rules about virtual method calls during a
destructor only require extra handling during base destructors.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163348 91177308-0d34-0410-b5e6-96231b3b80d8
31ba6135375433b617a8587ea6cc836a014ebd86 06-Sep-2012 Roman Divacky <rdivacky@freebsd.org> Dont cast away const needlessly. Found by gcc48 -Wcast-qual.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163325 91177308-0d34-0410-b5e6-96231b3b80d8
568ba871bbac959029671b81f8e531edb7e0d7d6 04-Sep-2012 Joao Matos <ripzonetriton@gmail.com> Revert r163083 per chandlerc's request.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163149 91177308-0d34-0410-b5e6-96231b3b80d8
5be92de217a1940d0e109abd0f401df4480c1a4b 02-Sep-2012 Joao Matos <ripzonetriton@gmail.com> Implemented parsing and AST support for the MS __leave exception statement. Also a minor fix to __except printing in StmtPrinter.cpp. Thanks to Aaron Ballman for review.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163083 91177308-0d34-0410-b5e6-96231b3b80d8
fbcb3f11fc90e9f00e6074e9b118b8dc11ca604c 31-Aug-2012 Anna Zaks <ganna@apple.com> [analyzer] Refactor the logic that determines if a functions should be

The policy on what to reanalyze should be in AnalysisConsumer with the
rest of visitation order logic.

There is no reason why ExprEngine needs to pass the Visited set to
CoreEngine, it can populate it itself.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162957 91177308-0d34-0410-b5e6-96231b3b80d8
2fa9d72d4d23ccdcd4137946e5ebafac7a04f04c 30-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename 'MaxLoop' to 'maxBlockVisitOnPath' to reflect reality. We
should consider renaming the command line option as well.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162932 91177308-0d34-0410-b5e6-96231b3b80d8
0caa2d47b84337e942b3f6652adfafe4ae506cfe 30-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename AnalyzerOptions 'EagerlyAssume' to 'eagerlyAssumeBinOpBifurcation'.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162930 91177308-0d34-0410-b5e6-96231b3b80d8
255d4d4226b24036ceb11228fbb74286e58620f7 30-Aug-2012 Ted Kremenek <kremenek@apple.com> Store const& to AnalyzerOptions in AnalysisManager instead of copying
individual flags.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162929 91177308-0d34-0410-b5e6-96231b3b80d8
6062334cc388bce69fb3978c4ecb26c6485a5c2b 28-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Rename CallEvent::mayBeInlined to CallEvent::isCallStmt.

The two callers are using this in order to be conservative, so let's just
clarify the information that's actually being provided here. This is not
related to inlining decisions in any way.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162717 91177308-0d34-0410-b5e6-96231b3b80d8
c210cb7a358d14cdd93b58562f33ff5ed2d895c1 27-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Inline constructors for any object with a trivial destructor.

This allows us to better reason about status objects, like Clang's own
llvm::Optional (when its contents are trivially destructible), which are
often intended to be passed around by value.

We still don't inline constructors for temporaries in the general case.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162681 91177308-0d34-0410-b5e6-96231b3b80d8
3682f1ea9c7fddc7dcbc590891158ba40f7fca16 25-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use the common evalBind infrastructure for initializers.

This allows checkers (like the MallocChecker) to process the effects of the
bind. Previously, using a memory-allocating function (like strdup()) in an
initializer would result in a leak warning.

This does bend the expectations of checkBind a bit; since there is no
assignment expression, the statement being used is the initializer value.
In most cases this shouldn't matter because we'll use a PostInitializer
program point (rather than PostStmt) for any checker-generated nodes, though
we /will/ generate a PostStore node referencing the internal statement.
(In theory this could have funny effects if someone actually does an
assignment within an initializer; in practice, that seems like it would be
very rare.)


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162637 91177308-0d34-0410-b5e6-96231b3b80d8
df5faf5e7ae6823d0af0b801c4ac26d47f2cee97 25-Aug-2012 Chad Rosier <mcrosier@apple.com> [ms-inline asm] As part of a larger refactoring, rename AsmStmt to GCCAsmStmt.
No functional change intended.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162632 91177308-0d34-0410-b5e6-96231b3b80d8
0156439a3d718ea0ef5922c38d189a60829c8a86 24-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] For now, treat pointers-to-members as non-null void * symbols.

Until we have full support for pointers-to-members, we can at least
approximate some of their use by tracking null and non-null values.
We thus treat &A::m_ptr as a non-null void * symbol, and MemberPointer(0)
as a pointer-sized null constant.

This enables support for what is sometimes called the "safe bool" idiom,
demonstrated in the test case.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162495 91177308-0d34-0410-b5e6-96231b3b80d8
b66529d04727dc686b97ea3d937fc9785792f505 23-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Support C++ default arguments if they are literal values.

A CXXDefaultArgExpr wraps an Expr owned by a ParmVarDecl belonging to the
called function. In general, ExprEngine and Environment ought to treat this
like a ParenExpr or other transparent wrapper expression, with the inside
expression evaluated first.

However, if we call the same function twice, we'd produce a CFG that contains
the same wrapped expression twice, and we're not set up to handle that. I've
added a FIXME to the CFG builder to come back to that, but meanwhile we can
at least handle expressions that don't need to be explicitly evaluated:
literals. This probably handles many common uses of default parameters:
true/false, null, etc.

Part of PR13385 / <rdar://problem/12156507>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162453 91177308-0d34-0410-b5e6-96231b3b80d8
66c486f275531df6362b3511fc3af6563561801b 22-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.
Also rename 'getCurrentBlockCounter()' to 'blockCount()'.

This ripples a bunch of code simplifications; mostly aesthetic,
but makes the code a bit tighter.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162349 91177308-0d34-0410-b5e6-96231b3b80d8
3b1df8bb941a18c4a7256d7cfcbccb9de7e39995 22-Aug-2012 Ted Kremenek <kremenek@apple.com> Rename 'getConjuredSymbol*' to 'conjureSymbol*'.

No need to have the "get", the word "conjure" is a verb too!
Getting a conjured symbol is the same as conjuring one up.

This shortening is largely cosmetic, but just this simple changed
cleaned up a handful of lines, making them less verbose.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162348 91177308-0d34-0410-b5e6-96231b3b80d8
32a549a64922af0903bdb777613ae7ae4490b70f 22-Aug-2012 Ted Kremenek <kremenek@apple.com> Remove Store::bindDecl() and Store::bindDeclWithNoInit(), and
all forwarding methods.

This functionality is already covered by bindLoc().

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162346 91177308-0d34-0410-b5e6-96231b3b80d8
fa06f0464a04bb7fce1fcfb3780d151bb029e00c 20-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace boolean IsSink parameters with 'generateSink' methods.

Generating a sink is significantly different behavior from generating a
normal node, and a simple boolean parameter can be rather opaque. Per
offline discussion with Anna, adding new generation methods is the
clearest way to communicate intent.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162215 91177308-0d34-0410-b5e6-96231b3b80d8
c32a453e40b2c8878fed10512fb2f570b7aba576 18-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Treat C++ 'throw' as a sink.

Our current handling of 'throw' is all CFG-based: it jumps to a 'catch' block
if there is one and the function exit block if not. But this doesn't really
get the right behavior when a function is inlined: execution will continue on
the caller's side, which is always the wrong thing to do.

Even within a single function, 'throw' completely skips any destructors that
are to be run. This is essentially the same problem as @finally -- a CFGBlock
that can have multiple entry points, whose exit points depend on whether it
was entered normally or exceptionally.

Representing 'throw' as a sink matches our current (non-)handling of @throw.
It's not a perfect solution, but it's better than continuing analysis in an
inconsistent or even impossible state.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162157 91177308-0d34-0410-b5e6-96231b3b80d8
19275bdec34b2ec5d77a78c0ea393a45ab05e128 18-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Treat @throw as a sink (stop processing).

The CFG approximates @throw as a return statement, but that's not good
enough in inlined functions. Moreover, since Objective-C exceptions are
usually considered fatal, we should be suppressing leak warnings like we
do for calls to noreturn functions (like abort()).

The comments indicate that we were probably intending to do this all along;
it may have been inadvertantly changed during a refactor at one point.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162156 91177308-0d34-0410-b5e6-96231b3b80d8
563ea2335d7d0df44bbfe8941f64523e8af1fc14 04-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Update initializer assertion for delegating constructors.

Like base constructors, delegating constructors require no further
processing in the CFGInitializer node.

Also, add PrettyStackTraceLoc to the initializer and destructor logic
so we can get better stack traces in the future.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161283 91177308-0d34-0410-b5e6-96231b3b80d8
6b4be2ef4ce49717ff972434975ce3c34c9a1c4c 31-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Getting an lvalue for a reference field still requires a load.

This was causing a crash in our array-to-pointer logic, since the region
was clearly not an array.

PR13440 / <rdar://problem/11977113>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161051 91177308-0d34-0410-b5e6-96231b3b80d8
d563d3fb73879df7147b8a5302c3bf0e1402ba18 30-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Only allow CallEvents to be created by CallEventManager.

This ensures that it is valid to reference-count any CallEvents, and we
won't accidentally try to reclaim a CallEvent that lives on the stack.
It also hides an ugly switch statement for handling CallExprs!

There should be no functionality change here.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160986 91177308-0d34-0410-b5e6-96231b3b80d8
69a0e5021c5c49a34aa25cd89b1e613a52097e65 27-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Look through SubstNonTypeTemplateParmExprs.

We were treating this like a CXXDefaultArgExpr, but
SubstNonTypeTemplateParmExpr actually appears when a template is
instantiated, i.e. we have all the information necessary to evaluate it.
This allows us to inline functions like llvm::array_lengthof.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160846 91177308-0d34-0410-b5e6-96231b3b80d8
e3fd87c18b865a1bf61d3b977051580f9315f2a5 27-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use a stack-based local instead of a temporary to fix build.

Passing a temporary via reference parameter still requires a visible
copy constructor.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160840 91177308-0d34-0410-b5e6-96231b3b80d8
f540c54701e3eeb34cb619a3a4eb18f1ac70ef2d 26-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Rename Calls.{h,cpp} to CallEvent.{h,cpp}. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160815 91177308-0d34-0410-b5e6-96231b3b80d8
3a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861e 26-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle C++ member initializers and destructors.

This uses CFG to tell if a constructor call is for a member, and uses
the member's region appropriately.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160808 91177308-0d34-0410-b5e6-96231b3b80d8
888c90ac0ef6baf7d47e86cf5cc4715707d223b1 26-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Handle base class initializers and destructors.

Most of the logic here is fairly simple; the interesting thing is that
we now distinguish complete constructors from base or delegate constructors.
We also make sure to cast to the base class before evaluating a constructor
or destructor, since non-virtual base classes may behave differently.

This includes some refactoring of VisitCXXConstructExpr and VisitCXXDestructor
in order to keep ExprEngine.cpp as clean as possible (leaving the details for

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160806 91177308-0d34-0410-b5e6-96231b3b80d8
829846b5002d7f8d6a54b9c58c3ecf7cac56d2cc 25-Jul-2012 Ted Kremenek <kremenek@apple.com> Remove ExprEngine::MarkBranch(), as it is no longer needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160761 91177308-0d34-0410-b5e6-96231b3b80d8
8919e688dc610d1f632a4d43f7f1489f67255476 18-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Combine all ObjC message CallEvents into ObjCMethodCall.

As pointed out by Anna, we only differentiate between explicit message sends

This also adds support for ObjCSubscriptExprs, which are basically the same
as properties in many ways. We were already checking these, but not emitting
nice messages for them.

This depends on the llvm::PointerIntPair change in r160456.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160461 91177308-0d34-0410-b5e6-96231b3b80d8
4ccc4cc5d4e7c5c436d5f45065d3639cfc7c6e48 18-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove obsolete ObjCPropRef SVal kind.

ObjC properties are handled through their semantic form of ObjCMessageExprs
and their wrapper PseudoObjectExprs, and have been for quite a while. The
syntactic ObjCPropertyRefExprs do not appear in the CFG and are not visited
by ExprEngine.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160458 91177308-0d34-0410-b5e6-96231b3b80d8
3f635c08b2d0b2d5bafb38da09589cb238407faa 14-Jul-2012 Ted Kremenek <kremenek@apple.com> Refine CFG so that '&&' and '||' don't lead to extra confluence points when used in a branch, but
instead push the terminator for the branch down into the basic blocks of the subexpressions of '&&' and '||'
respectively. This eliminates some artifical control-flow from the CFG and results in a more
compact CFG.

Note that this patch only alters the branches 'while', 'if' and 'for'. This was complex enough for
one patch. The remaining branches (e.g., do...while) can be handled in a separate patch, but they
weren't immediately tackled because they were less important.

It is possible that this patch introduces some subtle bugs, particularly w.r.t. to destructor placement.
I've tried to audit these changes, but it is also known that the destructor logic needs some refinement
in the area of '||' and '&&' regardless (i.e., their are known bugs).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160218 91177308-0d34-0410-b5e6-96231b3b80d8
48b6247804eacc262cc5508e0fbb74ed819fbb6e 11-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Construct stack variables directly in their VarDecl.

Also contains a number of tweaks to inlining that are necessary
for constructors and destructors. (I have this enabled on a private
branch, but it is very much unstable.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160023 91177308-0d34-0410-b5e6-96231b3b80d8
852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5 11-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Make CallEnter, CallExitBegin, and CallExitEnd not be StmtPoints

These ProgramPoints are used in inlining calls,
and not all calls have associated statements anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160021 91177308-0d34-0410-b5e6-96231b3b80d8
28038f33aa2db4833881fea757a1f0daf85ac02b 11-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints.

These are currently unused, but are intended to be used in lieu of PreStmt
and PostStmt when the call is implicit (e.g. an automatic object destructor).

This also modifies the Data1 field of ProgramPoints to allow storing any
pointer-sized value, as opposed to only aligned pointers. This is necessary
to store SourceLocations.

There is currently no BugReporter support for these; they should be skipped
over in any diagnostic output.

This commit also tags checkers that currently rely on function calls only
occurring at StmtPoints.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160019 91177308-0d34-0410-b5e6-96231b3b80d8
840c9842ed8b3a2b1276519a80f89e7d409fc148 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> Revert "Remove unused member (& consequently unused parameter) in SA's Call code."

...and instead add an accessor. We're not using this today, but it's something
that should probably stay in the source for potential clients, and it doesn't
cost a lot. (ObjCPropertyAccess is only created on the stack, and right now
there's only ever one alive at a time.)

This reverts r159581 / commit 8e674e1da34a131faa7d43dc3fcbd6e49120edbe.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159595 91177308-0d34-0410-b5e6-96231b3b80d8
8e674e1da34a131faa7d43dc3fcbd6e49120edbe 02-Jul-2012 David Blaikie <dblaikie@gmail.com> Remove unused member (& consequently unused parameter) in SA's Call code.

This member became unused in r159559.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159581 91177308-0d34-0410-b5e6-96231b3b80d8
de507eaf3cb54d3cb234dc14499c10ab3373d15f 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Finish replacing ObjCMessage with ObjCMethodDecl and friends.

The preObjCMessage and postObjCMessage callbacks now take an ObjCMethodCall
argument, which can represent an explicit message send (ObjCMessageSend) or an
implicit message generated by a property access (ObjCPropertyAccess).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159559 91177308-0d34-0410-b5e6-96231b3b80d8
cde8cdbd6a662c636164465ad309b5f17ff01064 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends.

Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper
around the existing ObjCMessage abstraction (over message sends and property
accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses
ObjCMessageSend and ObjCPropertyAccess.

In addition to removing yet another wrapper object, this should make it easy
to add a ObjCSubscriptAccess call event soon.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159558 91177308-0d34-0410-b5e6-96231b3b80d8
85d7e01cf639b257d70f8a129709a2d7594d7b22 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Move the last bits of CallOrObjCMessage over to CallEvent.

This involved refactoring some common pointer-escapes code onto CallEvent,
then having MallocChecker use those callbacks for whether or not to consider
a pointer's /ownership/ as escaping. This still needs to be pinned down, and
probably we want to make the new argumentsMayEscape() function a little more
discerning (content invalidation vs. ownership/metadata invalidation), but
this is a good improvement.

As a bonus, also remove CallOrObjCMessage from the source completely.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159557 91177308-0d34-0410-b5e6-96231b3b80d8
740d490593e0de8732a697c9f77b90ddd463863b 02-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Add a new abstraction over all types of calls: CallEvent

This is intended to replace CallOrObjCMessage, and is eventually intended to be
used for anything that cares more about /what/ is being called than /how/ it's
being called. For example, inlining destructors should be the same as inlining
blocks, and checking __attribute__((nonnull)) should apply to the allocator
calls generated by operator new.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159554 91177308-0d34-0410-b5e6-96231b3b80d8
4715ed95e3e710db097bfdd9a38b67bd7e86aced 27-Jun-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Remove unneeded helper function (it's in ASTContext.h)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159244 91177308-0d34-0410-b5e6-96231b3b80d8
10f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2 23-Jun-2012 Ted Kremenek <kremenek@apple.com> Implement initial static analysis inlining support for C++ methods.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159047 91177308-0d34-0410-b5e6-96231b3b80d8
2e6f5b823912ae76211427cb8684c9eaa6e53a1f 16-Jun-2012 James Dennett <jdennett@google.com> Documentation cleanup: fix a type, LocatioinE -> LocationE

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158566 91177308-0d34-0410-b5e6-96231b3b80d8
5b8c69494881b7d35bc6244b4a19be0cc2eab368 12-Jun-2012 Jordan Rose <jordan_rose@apple.com> Revert "[analyzer] Treat LValueBitCasts like regular pointer bit casts."

This does not actually give us the right behavior for reinterpret_cast
of references. Reverting so I can think about it some more.

This reverts commit 50a75a6e26a49011150067adac556ef978639fe6.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158341 91177308-0d34-0410-b5e6-96231b3b80d8
570d03c6831a8e19447dc863aa94ffff020077eb 12-Jun-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Treat LValueBitCasts like regular pointer bit casts.

These casts only appear in very well-defined circumstances, in which the
target of a reinterpret_cast or a function formal parameter is an lvalue
reference. According to the C++ standard, the following are equivalent:

reinterpret_cast<T&>( x)


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158338 91177308-0d34-0410-b5e6-96231b3b80d8
8cd64b4c5553fa6284d248336cb7c82dc960a394 11-Jun-2012 Chad Rosier <mcrosier@apple.com> Etch out the code path for MS-style inline assembly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158325 91177308-0d34-0410-b5e6-96231b3b80d8
c0e71a15bce9bb8c0d4ec1c42fab70c03140f9e0 02-Jun-2012 Anna Zaks <ganna@apple.com> [analyzer] Rely on canBeInlined utility instead of checking CallExpr

This will make it easier to add inlining support to more expressions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157870 91177308-0d34-0410-b5e6-96231b3b80d8
591b5f53c0e11d87401b4804bb1be1a53f95c619 19-May-2012 Anna Zaks <ganna@apple.com> [analyzer] For locations, use isGLValue() instead of isLValue().

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157088 91177308-0d34-0410-b5e6-96231b3b80d8
719b429e3ed660cfd9cce88397b29c695a25fa50 19-May-2012 Anna Zaks <ganna@apple.com> [analyzer] Fix a c++11 crash: xvalues can be locations (VisitMemberExpr)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157082 91177308-0d34-0410-b5e6-96231b3b80d8
70fdbc366da85880aae5baebd3351e993ca05603 12-May-2012 Jordy Rose <jediknil@belkadan.com> [analyzer] RetainCountChecker: track ObjC boxed expression objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156699 91177308-0d34-0410-b5e6-96231b3b80d8
c319c585c0d5899cba0dca2272e6e4909c8b9f16 08-May-2012 Ted Kremenek <kremenek@apple.com> Teach the analyzer about CXXScaleValueInitExpr.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156369 91177308-0d34-0410-b5e6-96231b3b80d8
0b3ade86a1c60cf0c7b56aa238aff458eb7f5974 20-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead bindings right before leaving a function.

This is needed to ensure that we always report issues in the correct
function. For example, leaks are identified when we call remove dead
bindings. In order to make sure we report a callee's leak in the callee,
we have to run the operation in the callee's context.

This change required quite a bit of infrastructure work since:
- We used to only run remove dead bindings before a given statement;
here we need to run it after the last statement in the function. For
this, we added additional Program Point and special mode in the
SymbolReaper to remove all symbols in context lower than the current
- The call exit operation turned into a sequence of nodes, which are
now guarded by CallExitBegin and CallExitEnd nodes for clarity and

(Sorry for the long diff.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
eb382ec1507cf2c8c12d7443d0b67c076223aec6 19-Apr-2012 Patrick Beard <pcbeard@mac.com> Implements boxed expressions for Objective-C. <rdar://problem/10194391>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155082 91177308-0d34-0410-b5e6-96231b3b80d8
534986f2b21e6050bf00163cd6423fd92155a6ed 14-Apr-2012 Richard Smith <richard-llvm@metafoo.co.uk> Add an AttributedStmt type to represent a statement with C++11 attributes
attached. Since we do not support any attributes which appertain to a statement
(yet), testing of this is necessarily quite minimal.

Patch by Alexander Kornienko!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154723 91177308-0d34-0410-b5e6-96231b3b80d8
6a86082f3a06a2dcceaaf63f78a0e52d64bcbaa3 13-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] PCH deserialization optimization.

We should not deserialize unused declarations from the PCH file. Achieve
this by storing the top level declarations during parsing
(HandleTopLevelDecl ASTConsumer callback) and analyzing/building a call
graph only for those.

Tested the patch on a sample ObjC file that uses PCH. With the patch,
the analyzes is 17.5% faster and clang consumes 40% less memory.
Got about 10% overall build/analyzes time decrease on a large Objective
C project.

A bit of CallGraph refactoring/cleanup as well..

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154625 91177308-0d34-0410-b5e6-96231b3b80d8
bd613137499b1d4c3b63dccd0aa21f6add243f4f 07-Apr-2012 Ted Kremenek <kremenek@apple.com> Rework ExprEngine::evalLoad and clients (e.g. VisitBinaryOperator) so that when we generate a new ExplodedNode
we use the same Expr* as the one being currently visited. This is preparation for transitioning to having
ProgramPoints refer to CFGStmts.

This required a bit of trickery. We wish to keep the old Expr* bindings in the Environment intact,
as plenty of logic relies on it and there is no reason to change it, but we sometimes want the Stmt* for
the ProgramPoint to be different than the Expr* being used for bindings. This requires adding an extra
argument for some functions (e.g., evalLocation). This looks a bit strange for some clients, but
it will look a lot cleaner when were start using CFGStmt* in the appropriate places.

As some fallout, the diagnostics arrows are a bit difference, since some of the node locations have changed.
I have audited these, and they look reasonable.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154214 91177308-0d34-0410-b5e6-96231b3b80d8
e62f048960645b79363408fdead53fec2a063c52 03-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] Record the basic blocks covered by the analyzes run.

Store this info inside the function summary generated for all analyzed
functions. This is useful for coverage stats and can be helpful for
analyzer state space search strategies.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153923 91177308-0d34-0410-b5e6-96231b3b80d8
4a5f724538cbc275370c9504e8169ce92503256c 01-Apr-2012 Benjamin Kramer <benny.kra@googlemail.com> Analyzer: Store BugReports directly in a ilist instead of adding another layer of inderection with std::list

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153847 91177308-0d34-0410-b5e6-96231b3b80d8
3bbd8cd831788c506f2980293eb3c7e1b3ca2501 30-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Do not inline functions which previously reached max block

This is an optimization for "retry without inlining" option. Here, if we
failed to inline a function due to reaching the basic block max count,
we are going to store this information and not try to inline it
again in the translation unit. This can be viewed as a function summary.

On sqlite, with this optimization, we are 30% faster then before and
cover 10% more basic blocks (partially because the number of times we
reach timeout is decreased by 20%).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153730 91177308-0d34-0410-b5e6-96231b3b80d8
b47dbcbc12430fdf3e5a5b9f59cdec5480e89e75 28-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Enable retry exhausted without inlining by default.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153591 91177308-0d34-0410-b5e6-96231b3b80d8
253955ca25c7e7049963b5db613c0cd15d66e4f8 28-Mar-2012 Anna Zaks <ganna@apple.com> [analyser] Stats checker: do not mark a node as exhausted if we will
retry without inlining.

(+ other minor cleanups)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
5903a373db3d27794c90b25687e0dd6adb0e497d 27-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Add an option to re-analyze a dead-end path without inlining.

The analyzer gives up path exploration under certain conditions. For
example, when the same basic block has been visited more than 4 times.
With inlining turned on, this could lead to decrease in code coverage.
Specifically, if we give up inside the inlined function, the rest of
parent's basic blocks will not get analyzed.

This commit introduces an option to enable re-run along the failed path,
in which we do not inline the last inlined call site. This is done by
enqueueing the node before the processing of the inlined call site
with a special policy encoded in the state. The policy tells us not to
inline the call site along the path.

This lead to ~10% increase in the number of paths analyzed. Even though
we expected a much greater coverage improvement.

The option is turned off by default for now.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
5aac0b6ae95f137b1783f3e6227241fb457b8f8b 22-Mar-2012 Ted Kremenek <kremenek@apple.com> Fix static analyzer crash on code taking the address of a field. Fixes PR 11146.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153283 91177308-0d34-0410-b5e6-96231b3b80d8
749bbe6f5f23676244f12a0d41511c8e73516feb 22-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Add stats useful for coverage investigations.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153280 91177308-0d34-0410-b5e6-96231b3b80d8
3d7c44e01d568e5d5c0fac9c6ccb3f080157ba19 21-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Malloc: Utter the name of the leaked variable.
Specifically, we use the last store of the leaked symbol in the leak diagnostic.
(No support for struct fields since the malloc checker doesn't track those

+ Infrastructure to track the regions used in store evaluations.
This approach is more precise than iterating the store to
obtain the region bound to the symbol, which is used in RetainCount
checker. The region corresponds to what is uttered in the code in the
last store and we do not rely on the store implementation to support
this functionality.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
e711d7e7875920fee4180a26bfc67d67f0f71a2c 14-Mar-2012 Erik Verbruggen <erikjv@me.com> [Analyser] Remove unnecessary recursive visits for ExprWithCleanups and

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152730 91177308-0d34-0410-b5e6-96231b3b80d8
f4b88a45902af1802a1cb42ba48b1c474474f228 10-Mar-2012 John McCall <rjmccall@apple.com> Remove BlockDeclRefExpr and introduce a bit on DeclRefExpr to
track whether the referenced declaration comes from an enclosing
local context. I'm amenable to suggestions about the exact meaning
of this bit.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152491 91177308-0d34-0410-b5e6-96231b3b80d8
337e4dbc6859589b8878146a88bebf754e916702 10-Mar-2012 Ted Kremenek <kremenek@apple.com> [analyzer] fix regression in analyzer of NOT actually aborting on Stmts it doesn't understand. We registered
as aborted, but didn't treat such cases as sinks in the ExplodedGraph.

Along the way, add basic support for CXXCatchStmt, expanding the set of code we actually analyze (hopefully correctly).

Fixes: <rdar://problem/10892489>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152468 91177308-0d34-0410-b5e6-96231b3b80d8
3fd5f370a28552976c52e76c3035d79012d78dda 09-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Add support for NoRedundancy inlining mode.

We do not reanalyze a function, which has already been analyzed as an
inlined callee. As per PRELIMINARY testing, this gives over
50% run time reduction on some benchmarks without decreasing of the
number of bugs found.

Turning the mode on by default.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152440 91177308-0d34-0410-b5e6-96231b3b80d8
9fcce65e7e1307b5b8da9be13e4092d6bb94dc1d 07-Mar-2012 Richard Smith <richard-llvm@metafoo.co.uk> AST representation for user-defined literals, plus just enough of semantic
analysis to make the AST representation testable. They are represented by a
new UserDefinedLiteral AST node, which is a sugared CallExpr. All semantic
properties, including full CodeGen support, are achieved for free by this

UserDefinedLiterals can never be dependent, so no custom instantiation
behavior is required. They are mangled as if they were direct calls to the
underlying literal operator. This matches g++'s apparent behavior (but not its
actual mangling, which is broken for literal-operator-ids).

User-defined *string* literals are now fully-operational, but the semantic
analysis is quite hacky and needs more work. No other forms of user-defined
literal are created yet, but the AST support for them is present.

This patch committed after midnight because we had already hit the quota for
new kinds of literal yesterday.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152211 91177308-0d34-0410-b5e6-96231b3b80d8
1a45a5ff5d495cb6cd9a3d4d06317af79c0f634d 06-Mar-2012 Ted Kremenek <kremenek@apple.com> Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152139 91177308-0d34-0410-b5e6-96231b3b80d8
a81d3d434e6581ff354eaf5b2a3c25c75771a792 04-Mar-2012 Erik Verbruggen <erikjv@me.com> Remove a recursive visitation in ExprEngine that is no longer needed because the CFG is fully linearized.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152007 91177308-0d34-0410-b5e6-96231b3b80d8
cc2c4b293d8590346f26b7ecc16d299226b8794f 02-Mar-2012 Ted Kremenek <kremenek@apple.com> Teach the analyzer to just ignore CXXBindTemporaryExpr. There's nothing special to do with it, since destructors are represented explicitly in the CFG.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151856 91177308-0d34-0410-b5e6-96231b3b80d8
c2994283aa7538b7420c8e398cde7afa328d7042 28-Feb-2012 Anna Zaks <ganna@apple.com> [analyzer] Stats: Add the stats about remove dead bindings, correct the

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151656 91177308-0d34-0410-b5e6-96231b3b80d8
e739a29c62c67eaec0af5c4d5c75f9e8f11228bd 28-Feb-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Don't generate an explicit ExplodedNode for StringLiterals; have the SVal lazily generated from Environment::getSVal().

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151589 91177308-0d34-0410-b5e6-96231b3b80d8
ff80afcfb2b00ccffcb6cb10528bec565fc59edd 24-Feb-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead bindings before each call.

This ensures that we report the bugs associated with symbols going
out of scope in the correct function context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151369 91177308-0d34-0410-b5e6-96231b3b80d8
4ca8ac2e61c37ddadf37024af86f3e1019af8532 24-Feb-2012 Douglas Gregor <dgregor@apple.com> Implement a new type trait __is_trivially_constructible(T, Args...)
that provides the behavior of the C++11 library trait
std::is_trivially_constructible<T, Args...>, which can't be
implemented purely as a library.

Since __is_trivially_constructible can have zero or more arguments, I
needed to add Yet Another Type Trait Expression Class, this one
handling arbitrary arguments. The next step will be to migrate
UnaryTypeTrait and BinaryTypeTrait over to this new, more general
TypeTrait class.

Fixes the Clang side of <rdar://problem/10895483> / PR12038.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151352 91177308-0d34-0410-b5e6-96231b3b80d8
b673a41c92aa276f2e37164d0747be1cfb0c402b 18-Feb-2012 Ted Kremenek <kremenek@apple.com> Adopt ExprEngine and checkers to ObjC property refactoring. Everything was working, but now diagnostics are aware of message expressions implied by uses of properties. Fixes <rdar://problem/9241180>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150888 91177308-0d34-0410-b5e6-96231b3b80d8
bdd4c848349d4091d66b052efa453e6d69a77e36 16-Feb-2012 Ted Kremenek <kremenek@apple.com> Add checker visitation hooks in ExprEngine::Visit() for common no-op expressions. To be used later.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150723 91177308-0d34-0410-b5e6-96231b3b80d8
2ac58b7c09938bb28c51c7cd2deada609b75f94c 16-Feb-2012 Ted Kremenek <kremenek@apple.com> Revert "Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change."

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150722 91177308-0d34-0410-b5e6-96231b3b80d8
437ee81e54f39c2363d5fe0ea155604c28adc615 16-Feb-2012 Ted Kremenek <kremenek@apple.com> Move ExplodedNode reclaimation out of ExprEngine and into CoreEngine. Also have it based on adding predecessors/successors, not node allocation. No measurable performance change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150720 91177308-0d34-0410-b5e6-96231b3b80d8
66c40400e7d6272b0cd675ada18dd62c1f0362c7 14-Feb-2012 Anna Zaks <ganna@apple.com> [analyzer] Make Malloc Checker optimistic in presence of inlining.
(In response of Ted's review of r150112.)

This moves the logic which checked if a symbol escapes through a
parameter to invalidateRegionCallback (instead of post CallExpr visit.)

To accommodate the change, added a CallOrObjCMessage parameter to
checkRegionChanges callback.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150513 91177308-0d34-0410-b5e6-96231b3b80d8
01d08018b7cf5ce1601707cfd7a84d22015fc04e 07-Feb-2012 Douglas Gregor <dgregor@apple.com> Introduce basic ASTs for lambda expressions. This covers:
- Capturing variables by-reference and by-copy within a lambda
- The representation of lambda captures
- The creation of the non-static data members in the lambda class
that store the captured variables
- The initialization of the non-static data members from the
captured variables
- Pretty-printing lambda expressions

There are a number of FIXMEs, both explicit and implied, including:
- Creating a field for a capture of 'this'
- Improved diagnostics for initialization failures when capturing
variables by copy
- Dealing with temporaries created during said initialization
- Template instantiation
- AST (de-)serialization
- Binding and returning the lambda expression; turning it into a
proper temporary
- Lots and lots of semantic constraints
- Parameter pack captures

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149977 91177308-0d34-0410-b5e6-96231b3b80d8
a5888f61be9f8d76e9b48a453dbced50523bd2e0 31-Jan-2012 Argyrios Kyrtzidis <akyrtzi@gmail.com> Reapply r149311 which I reverted by mistake.

Original log:

Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates. This leads to a slight memory
improvement, and a simplification of the logic for managing ProgramState objects.
# Please enter the commit message for your changes. Lines starting

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149339 91177308-0d34-0410-b5e6-96231b3b80d8
b9b0f6fb6e113b5e6be3ed9754c4bf01186a17bf 31-Jan-2012 Argyrios Kyrtzidis <akyrtzi@gmail.com> Revert r149311 which failed to compile.

Original log:

Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates. This leads to a slight memory
improvement, and a simplification of the logic for managing ProgramState objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149336 91177308-0d34-0410-b5e6-96231b3b80d8
72e93068c9f2a2f05f5932cdd917c0d2961f11d9 31-Jan-2012 Ted Kremenek <kremenek@apple.com> Convert ProgramStateRef to a smart pointer for managing the reference counts of ProgramStates. This leads to a slight memory
improvement, and a simplification of the logic for managing ProgramState objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149311 91177308-0d34-0410-b5e6-96231b3b80d8
8bef8238181a30e52dea380789a7e2d760eac532 26-Jan-2012 Ted Kremenek <kremenek@apple.com> Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.

At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149081 91177308-0d34-0410-b5e6-96231b3b80d8
3026348bd4c13a0f83b59839f64065e0fcbea253 20-Jan-2012 David Blaikie <dblaikie@gmail.com> More dead code removal (using -Wunreachable-code)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148577 91177308-0d34-0410-b5e6-96231b3b80d8
256ef642f8feef22fd53be7efa868e8e34752eed 11-Jan-2012 Ted Kremenek <kremenek@apple.com> Remove '#if 0' from ExprEngine::InlineCall(), and start fresh by wiring up inlining for straight C calls.
My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders
and re-evaluating how C++ calls are handled in the CFG. The hope is to turn inlining "on-by-default" as soon as possible
with a core set of things working well, and then expand over time.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147904 91177308-0d34-0410-b5e6-96231b3b80d8
3070e13dca5bbefa32acb80ce4a7b217a6220983 07-Jan-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Remove CallEnterNodeBuilder and simplify ExprEngine::processCallEnter().

This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147705 91177308-0d34-0410-b5e6-96231b3b80d8
5eca482fe895ea57bc82410222e6426c09e63284 06-Jan-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining. Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back. There are also potential performance implications
of enlarging the Environment. Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment. This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
eb31a76d1cdaaf8874c549dc6bd964ff270d3822 05-Jan-2012 Anna Zaks <ganna@apple.com> [analyzer] Be less pessimistic about invalidation of global variables
as a result of a call.

Global variables, which come in from system libraries should not be
invalidated by all calls. Also, non-system globals should not be
invalidated by system calls.

The following solution to invalidation of globals seems flexible enough
for taint (does not invalidate stdin) and should not lead to too
many false positives. We split globals into 3 classes:

* immutable - values are preserved by calls (unless the specific
global is passed in as a parameter):
A : Most system globals and const scalars

* invalidated by functions defined in system headers:
B: errno

* invalidated by all other functions (note, these functions may in
turn contain system calls):
B: errno
C: all other globals (which are not in A nor B)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
5344baa704f42b22d9df25c24ffbbf6b4716603b 05-Dec-2011 Anna Zaks <ganna@apple.com> [analyzer] Unify SymbolVal and SymExprVal under a single SymbolVal

We are going into the direction of handling SymbolData and other SymExpr
uniformly, so it makes less sense to keep two different SVal classes.
For example, the checkers would have to take an extra step to reason
about each type separately.

The classes have the same members, we were just using the SVal kind
field for easy differentiation in 3 switch statements. The switch
statements look more ugly now, but we can make the code more readable in
other ways, for example, moving some code into separate functions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145833 91177308-0d34-0410-b5e6-96231b3b80d8
a078ecf3484d62b01d9f8c01e0fecffd65c583e1 01-Dec-2011 Ted Kremenek <kremenek@apple.com> When analyzing a C++ method (without a specific caller), assume 'this' is non-null. Fixes <rdar://problem/10508787>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145575 91177308-0d34-0410-b5e6-96231b3b80d8
9e9a3e612d57b583800d5f0e48bb28d4afbd8b84 11-Nov-2011 Ted Kremenek <kremenek@apple.com> [static analyzer] be more specific when running removeDeadBindings. Instead of seeing if the predecessor node was a non-StmtPoint, check if it is specifically a BlockEntrance node.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144340 91177308-0d34-0410-b5e6-96231b3b80d8
ce117a7d289f57f792e5cc3294280cfe070433de 11-Nov-2011 Ted Kremenek <kremenek@apple.com> [static analyzer]: only call RemoveDeadBindings() when analyzing non-Expr stmts, entering a basic block, or analyzing non-consumed expressions. This sigificantly speeds up analysis time, and reduces analysis time down to 27% less than before we linearized the CFG.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144332 91177308-0d34-0410-b5e6-96231b3b80d8
4b9c2d235fb9449e249d74f48ecfec601650de93 06-Nov-2011 John McCall <rjmccall@apple.com> Change the AST representation of operations on Objective-C
property references to use a new PseudoObjectExpr
expression which pairs a syntactic form of the expression
with a set of semantic expressions implementing it.
This should significantly reduce the complexity required
elsewhere in the compiler to deal with these kinds of
expressions (e.g. IR generation's special l-value kind,
the static analyzer's Message abstraction), at the lower
cost of specifically dealing with the odd AST structure
of these expressions. It should also greatly simplify
efforts to implement similar language features in the
future, most notably Managed C++'s properties and indexed

Most of the effort here is in dealing with the various
clients of the AST. I've gone ahead and simplified the
ObjC rewriter's use of properties; other clients, like
IR-gen and the static analyzer, have all the old
complexity *and* all the new complexity, at least
temporarily. Many thanks to Ted for writing and advising
on the necessary changes to the static analyzer.

I've xfailed a small diagnostics regression in the static
analyzer at Ted's request.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143867 91177308-0d34-0410-b5e6-96231b3b80d8
6800ba622e4edf287801ac69c42c61e7e294b06b 01-Nov-2011 Anna Zaks <ganna@apple.com> [analyzer] Make sink attribute part of the node profile.

This prevents caching out on nodes with different sink flag.
(This is a cleaner fix for radar://10376675).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143517 91177308-0d34-0410-b5e6-96231b3b80d8
6889679d72859960e0fc8d1080487f63c4df1e0a 01-Nov-2011 Anna Zaks <ganna@apple.com> [analyzer] Make sure the child builder use temporary destination sets

The parent and child builders should not share node sets.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143515 91177308-0d34-0410-b5e6-96231b3b80d8
4d2ae4a70336dc2aa11389b34946be152bb454c9 27-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Move enqueueEndOfFunction into CoreEngine.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143090 91177308-0d34-0410-b5e6-96231b3b80d8
dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42 27-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Make CoreEngine responsible for enqueueing Stmt Nodes.

Enqueue the nodes generated as the result of processing a statement
inside the Core Engine. This makes sure ExpEngine does not access
CoreEngine's private members and is more concise.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143089 91177308-0d34-0410-b5e6-96231b3b80d8
c03a39e16762627b421247b12a2658be630a3300 26-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] GenericNodeBuilder -> NodeBuilder.

Remove GenericNodeBuilder and use a class inherited from NodeBuilder instead.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143057 91177308-0d34-0410-b5e6-96231b3b80d8
2e9264a17bacc7dc228d5f93caaeb98dfb23d508 25-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove unused headers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142945 91177308-0d34-0410-b5e6-96231b3b80d8
f236b6503a4dbc44c1fccb8756bd57c9d0efdf05 25-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Make branch for condition callback use CheckerContext

Now, all the path sensitive checkers use CheckerContext!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142944 91177308-0d34-0410-b5e6-96231b3b80d8
af498a28797c075c48d7e943df5f5a8e78ed8eb0 25-Oct-2011 Anna Zaks <ganna@apple.com> [analyze] Convert EndOfPath callback to use CheckerContext

Get rid of the EndOfPathBuilder completely.
Use the generic NodeBuilder to generate nodes.
Enqueue the end of path frontier explicitly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142943 91177308-0d34-0410-b5e6-96231b3b80d8
ba0513de93d2fab6db5ab30b6927209fcc883078 25-Oct-2011 Douglas Gregor <dgregor@apple.com> Implement support for dependent Microsoft __if_exists/__if_not_exists
statements. As noted in the documentation for the AST node, the
semantics of __if_exists/__if_not_exists are somewhat different from
the way Visual C++ implements them, because our parsed-template
representation can't accommodate VC++ semantics without serious
contortions. Hopefully this implementation is "good enough".

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142901 91177308-0d34-0410-b5e6-96231b3b80d8
aa0aeb1cbe117db68d35700cb3a34aace0f99b99 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Node builders cleanup + comments
Renamed PureNodeBuilder->StmtNodeBuilder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142849 91177308-0d34-0410-b5e6-96231b3b80d8
056c4b46335a3bd2612414735d5749ee159c0165 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Completely remove the global Builder object.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142847 91177308-0d34-0410-b5e6-96231b3b80d8
f185cc1ac77a84139c603eee3473b88dcb839c68 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove more dependencies from global Builder
- OSAtomicChecker
- ExprEngine::processStmt

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142846 91177308-0d34-0410-b5e6-96231b3b80d8
ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert ExprEngine::visit() to use short lived builders.

This commit removes the major functional dependency on the ExprEngine::Builder
member variable.

In some cases the code became more verbose. Particularly, we call takeNodes()
and addNodes() to move responsibility for the nodes from one builder to another.
This will get simplified later on.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142831 91177308-0d34-0410-b5e6-96231b3b80d8
d231d0130a95336610ab9a42eaeb2cdac19992f3 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert VisitDeclStmt to use local node builder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142830 91177308-0d34-0410-b5e6-96231b3b80d8
6b6152ba96c164a292cc0b8d8b1d4cecbec27a60 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert more functions (ex:evalBind()) to iterative builders

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142829 91177308-0d34-0410-b5e6-96231b3b80d8
8ad8c546372fe602708cb7ceeaf0ebbb866735c6 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Convert VisitUnaryOperator to use short lived Node builders

To convert iteratively, we take the nodes the local builder will
process from the from the global builder and add the generated nodes
after the short lived builder is done. PureStmtNodeBuilder is the
one we should eventually use everywhere. Added Stmt index and Builder
context as ExprEngine globals. To avoid passing them around.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142828 91177308-0d34-0410-b5e6-96231b3b80d8
8ff5c41f2bde7ebbe568b4c15e59f14b8befae66 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Use a temporary builder in CheckerContext.

First step toward removing the global Stmt builder. Added several transitional methods (like takeNodes/addNodes).
+ Stop early if the set of exploded nodes for the next iteration is empty.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142827 91177308-0d34-0410-b5e6-96231b3b80d8
1aae01a8308d2f8e31adab3f4d7ac35543aac680 24-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Pass external Dst set to NodeBuilder

This moves the responsibility for storing the output node set from the
builder to the clients. The builder is just responsible for transforming
an input set into the output set: {SrcSet/SrcNode} -> {Frontier}.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142826 91177308-0d34-0410-b5e6-96231b3b80d8
1d26f48dc2eea1c07431ca1519d7034a21b9bcff 24-Oct-2011 Ted Kremenek <kremenek@apple.com> Rename AnalysisContext to AnalysisDeclContext. Not only is this name more accurate, but it frees up the name AnalysisContext for other uses.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142782 91177308-0d34-0410-b5e6-96231b3b80d8
b1b5daf30d2597e066936772bd206500232d7d65 23-Oct-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove LocationContext creation methods from AnalysisManager, and change clients to use AnalysisContext instead.

WIP to remove/reduce ExprEngine's usage of AnalysisManager.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142739 91177308-0d34-0410-b5e6-96231b3b80d8
c9003c89c7aead1686aba89c8e3ddcea1f2bec54 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Move predecessor into the NodeBuilder context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142454 91177308-0d34-0410-b5e6-96231b3b80d8
4e82d3cf6fd4c907265e3fa3aac0a835c35dc759 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Make NodeBuilder and Pred node loosely coupled

NodeBuilder should not assume it's dealing with a single predecessor. Remove predecessor getters. Modify the BranchNodeBuilder to not be responsible for doing auto-transitions (which depend on a predecessor).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142453 91177308-0d34-0410-b5e6-96231b3b80d8
67d9fbac82922ef5b6c9ba5ac4a07e80f9960292 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove dead code.
ExprEngineBuilders is not used.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142450 91177308-0d34-0410-b5e6-96231b3b80d8
cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Modularize builder use in processBranch.

Take advantage of the new builders for branch processing. As part of this change pass generic NodeBuilder (instead of BranchNodeBuilder) to the BranchCondition callback and remove the unused methods form BranchBuilder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142448 91177308-0d34-0410-b5e6-96231b3b80d8
ad62deeb70e97da6bd514dd390ea1ce6af6ad81d 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] Pull Pred out of NodeBuilderContext.
Each builder will have a different one, so it doesn't make sense to keep it in the context.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142447 91177308-0d34-0410-b5e6-96231b3b80d8
a19f4af7a94835ce4693bfe12d6270754e79eb56 19-Oct-2011 Anna Zaks <ganna@apple.com> [analyzer] NodeBuilder Refactoring: Subclass BranchNodeBuilder from NodeBuilder.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142444 91177308-0d34-0410-b5e6-96231b3b80d8
85df96c1f04867e26ba069aa0cc6a4cd6a01292e 14-Oct-2011 Richard Smith <richard-llvm@metafoo.co.uk> Refactor static analyzer to use simpler interface to constant expression evaluation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141983 91177308-0d34-0410-b5e6-96231b3b80d8
276b061970939293f1abaf694bd3ef05b2cbda79 11-Oct-2011 Eli Friedman <eli.friedman@gmail.com> Initial implementation of __atomic_* (everything except __atomic_is_lock_free).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141632 91177308-0d34-0410-b5e6-96231b3b80d8
46eaf7789a1059a7b42b7dbd183150c72df5738f 11-Oct-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Teach the static analyzer about CXXForRangeStmt. Patch by Jim Goodnow II!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141587 91177308-0d34-0410-b5e6-96231b3b80d8
744f1cd66bb6747ea71fbf1172698e7bf35ec88d 08-Oct-2011 Ted Kremenek <kremenek@apple.com> Provide basic static analyzer support for CXXTemporaryObjectExpr. Patch by Jim Goodnow II.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@141433 91177308-0d34-0410-b5e6-96231b3b80d8
d30952838421ddfb9f7e346b2ba8213889a5f789 30-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Add -analyzer-purge option which can take on multiple values, remove -analyzer-purge=none. (Small refactor as well: move the work of constructing AnalysisManager from the callers to the class itself.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140838 91177308-0d34-0410-b5e6-96231b3b80d8
eb2d1f1c88836bd5382e5d7aa8f6b85148a88b27 23-Sep-2011 David Blaikie <dblaikie@gmail.com> Removing a bunch of dead returns/breaks after llvm_unreachables.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140407 91177308-0d34-0410-b5e6-96231b3b80d8
b219cfc4d75f0a03630b7c4509ef791b7e97b2c8 23-Sep-2011 David Blaikie <dblaikie@gmail.com> Switch assert(0/false) llvm_unreachable.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140367 91177308-0d34-0410-b5e6-96231b3b80d8
d1e5a89226da79f7e6f43d40facc46abda9e5245 02-Sep-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Remove TransferFuncs.h, then deal with the fallout.

And with that, TransferFuncs is gone!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139003 91177308-0d34-0410-b5e6-96231b3b80d8
e1b364324b94e54c610a1681ab96df755ba766fd 02-Sep-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Fix member initialization order. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138999 91177308-0d34-0410-b5e6-96231b3b80d8
17a38e2636a8b1ce473fc6504c4b16cb09db29f4 02-Sep-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Move the knowledge of whether or not GC is enabled for the current analysis from CFRefCount to ExprEngine.

Remove TransferFuncs from ExprEngine and AnalysisConsumer.

Demote RetainReleaseChecker to a regular checker, and give it the name osx.cocoa.RetainCount (class name change coming shortly). Update tests accordingly.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138998 91177308-0d34-0410-b5e6-96231b3b80d8
dbd658e139b3e0bf084f75feaea8d844af9e319f 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Introduce a new callback for checkers, printState, to be used for debug-printing the contents of a ProgramState.

Unlike the other callbacks, this one is a simple virtual method, since it is only to be used for debugging.

This new callback replaces the old ProgramState::Printer interface, and allows us to move the printing of refcount bindings from CFRefCount to RetainReleaseChecker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138728 91177308-0d34-0410-b5e6-96231b3b80d8
93bd5ca766c4d7906878f4ffe76ce1b2080e540b 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Remove the ProgramState argument from ExprEngine::evalBind; we were ignoring it anyway. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138720 91177308-0d34-0410-b5e6-96231b3b80d8
fe27971d54d26997149d6b84057f04ff398d1d5d 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Eliminate almost all uses of TransferFuncs from ExprEngine.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138719 91177308-0d34-0410-b5e6-96231b3b80d8
537716ad8dd10f984b6cfe6985afade1185c5e3c 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Change the check::RegionChanges callback to include the regions explicitly requested for invalidation.

Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well.

Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138716 91177308-0d34-0410-b5e6-96231b3b80d8
f1d10d939739f1a4544926d807e4f0f9fb64be61 24-Aug-2011 Ted Kremenek <kremenek@apple.com> Constify the result of CFGStmt::getStmt().

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138408 91177308-0d34-0410-b5e6-96231b3b80d8
38f17d6c86417944403dfa2b0d50a0dc92efa9ce 23-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Move symbol death leak analysis from CFRefCount to RetainReleaseChecker.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138353 91177308-0d34-0410-b5e6-96231b3b80d8
f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9 20-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Handle reads of ObjCPropertyRefExprs implicitly in Environment. No need to bind an explicit value and create a new node.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138196 91177308-0d34-0410-b5e6-96231b3b80d8
294fd0a62b95f512637910bf85c7efa6c2354b50 20-Aug-2011 Ted Kremenek <kremenek@apple.com> Start partitioning ExprEngine.cpp into separate .cpp files that handle different parts
of the analysis (e.g., analysis of C expressions, analysis of Objective-C expressions, and so on).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138194 91177308-0d34-0410-b5e6-96231b3b80d8
5bd04952d4ae7ca894f583583208f0cec4735a90 16-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] teach ExprEngine about loads from static C++ class fields. Fixes <rdar://problem/9948787>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137760 91177308-0d34-0410-b5e6-96231b3b80d8
6c7511db998817e64f2e124013e7d7c9a430c580 16-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] add ExprEngine::getEagerlyAssumedTags() to allow externally querying of "eagerly assumed" expressions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137704 91177308-0d34-0410-b5e6-96231b3b80d8
86b39f20d5091ca3fdcbeb4a22766aaffdf6ac35 16-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove PostStmtCustom ProgramPoint. It can be represented using tagged PostStmts.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137697 91177308-0d34-0410-b5e6-96231b3b80d8
18c66fdc3c4008d335885695fe36fb5353c5f672 16-Aug-2011 Ted Kremenek <kremenek@apple.com> Rename GRState to ProgramState, and cleanup some code formatting along the way.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137665 91177308-0d34-0410-b5e6-96231b3b80d8
9c378f705405d37f49795d5e915989de774fe11f 13-Aug-2011 Ted Kremenek <kremenek@apple.com> Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
ca804539d908d3a0e8c72a0df5f1f571d29490bb 13-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] change "tag" in ProgramPoint from "void*" to a ProgramPointTag*.

Having a notion of an actual ProgramPointTag will aid in introspection of the analyzer's behavior.
For example, the GraphViz output of the analyzer will pretty-print the tags in a useful manner.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137529 91177308-0d34-0410-b5e6-96231b3b80d8
9697934650354bed2e509d8e7e44f21a1fb00f76 12-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can separate TypedRegions that implement getValueType() from those that don't.

Patch by Olaf Krzikalla!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137498 91177308-0d34-0410-b5e6-96231b3b80d8
0e89061a399bae32f0eca5b85658ad66a58c504d 11-Aug-2011 Anna Zaks <ganna@apple.com> Cleanup: remove CleanedSate member and GetState() wrapper from StmtNodeBuilder, not needed as of r137273.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137284 91177308-0d34-0410-b5e6-96231b3b80d8
db5e8cd095d1ffdd18f5620ad2348b5f386bebe3 11-Aug-2011 Anna Zaks <ganna@apple.com> Cleanup: remove GetState() wrapper from ExprEngine, not needed as of r137273.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137279 91177308-0d34-0410-b5e6-96231b3b80d8
6bd528b9d703fdea51053719d9c53504a61a6bd7 11-Aug-2011 Anna Zaks <ganna@apple.com> Analyzer Core: In checkDeadSymbols checker callback, provide the state in which the symbols are not yet deleted so that checkers could inspect them. Since we are now always creating a transition in ProcessStmt(), remove the logic for adding a transition when none was generated. TODO: the extra transitions will have to be removed; more cleanups; a checker that tests teh new fucntionality.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137273 91177308-0d34-0410-b5e6-96231b3b80d8
f91a5b008d1a63630ae483247204c2651e512fa1 06-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Simplify logic for ExprEngine::VisitUnaryExprOrTypeTraitExpr to avoid recursion to subexpression.

This exposed bugs in the live variables analysis, and a latent analyzer bug in the SymbolReaper.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137006 91177308-0d34-0410-b5e6-96231b3b80d8
ff8e758c30b86628a6cdaa6f1b089fefbbdba40c 02-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Drastically simplify ExprEngine::VisitInitListExpr() by assuming all initializer expressions have already been evaluated.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136706 91177308-0d34-0410-b5e6-96231b3b80d8
b9a8adf57b30611951e72e140b61ecc7caee3564 31-Jul-2011 Benjamin Kramer <benny.kra@googlemail.com> Remove dead code flagged by GCC's -Wunused-but-set-variable.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136581 91177308-0d34-0410-b5e6-96231b3b80d8
6075f01f557ea9f0f59a8040a666e78df9bbb3df 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitDeclStmt because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136522 91177308-0d34-0410-b5e6-96231b3b80d8
71f20db43bfcb6e7a377982e20615f5f62789cc2 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitCompoundLiteralExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136521 91177308-0d34-0410-b5e6-96231b3b80d8
4e906e889d51e1026964c0224e814ded39e9522f 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitCastExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136520 91177308-0d34-0410-b5e6-96231b3b80d8
70a34da7a767bda69958d8f659de9f87b03de747 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitObjCForCollectionStmt because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136519 91177308-0d34-0410-b5e6-96231b3b80d8
4410a935e8d8ee3c903b858bbf74ca24fce629b5 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove explicit argument processing from ExprEngine::VisitObjCMessage() since it is no longer needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136518 91177308-0d34-0410-b5e6-96231b3b80d8
871f686b477b0ff225a7f53bb3350a54f35269ba 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitLValObjCIvarRefExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136517 91177308-0d34-0410-b5e6-96231b3b80d8
994b8d374adb56c3897a43e4e97118b4111ecfc7 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] tighten up ExprEngine::VisitObjCAtSynchronizationStmt().

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136516 91177308-0d34-0410-b5e6-96231b3b80d8
ae2dc146c936244f3cd72efa24085259452a861c 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitObjCPropertyRefExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136515 91177308-0d34-0410-b5e6-96231b3b80d8
962fddcd97d20012ea2e68a8c4e1833c53b6d937 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitCallExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136514 91177308-0d34-0410-b5e6-96231b3b80d8
e3939d7446959afb6b650fe08e952d0f64ab6794 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitMemberExpr because it isn't needed anymore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136513 91177308-0d34-0410-b5e6-96231b3b80d8
8f3407ef22bc7efe6ca4169381e09d0d657ec192 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Remove recursive visitation in ExprEngine::VisitLvalArraySubscriptExpr() because it is no longer needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136512 91177308-0d34-0410-b5e6-96231b3b80d8
882998923889a2fcce9b49696506c499e22cf38f 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs.

The motivation of this large change is to drastically simplify the logic in ExprEngine going forward.

Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will
need to be fixed over time. There is also some possible performance regression as RemoveDeadBindings
will be called frequently; this can also be improved over time.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136419 91177308-0d34-0410-b5e6-96231b3b80d8
eea72a925f294225391ecec876a342771c09b635 29-Jul-2011 Ted Kremenek <kremenek@apple.com> [analyzer] fix handling of MaterializeTemporaryExpr by binding the result value to
the proper expression.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136412 91177308-0d34-0410-b5e6-96231b3b80d8
642116259e8df6286063a17361c20e95b5017a0a 25-Jul-2011 Chandler Carruth <chandlerc@gmail.com> Rename getInstantiationLineNumber to getExpansionLineNumber in both
SourceManager and FullSourceLoc.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135969 91177308-0d34-0410-b5e6-96231b3b80d8
a77c031cb66f75d22672070052cc6e0205289ff8 25-Jul-2011 Chandler Carruth <chandlerc@gmail.com> Rename getInstantiationColumnNumber to getExpansionColumnNumber in both
SourceManager and FullSourceLoc.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135965 91177308-0d34-0410-b5e6-96231b3b80d8
5f9e272e632e951b1efe824cd16acb4d96077930 23-Jul-2011 Chris Lattner <sabre@nondot.org> remove unneeded llvm:: namespace qualifiers on some core types now that LLVM.h imports
them into the clang namespace.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135852 91177308-0d34-0410-b5e6-96231b3b80d8
8f08426e6f54ed20b959018f24dbea106a00b4ad 15-Jul-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] GNU __null is a pointer-sized integer, not a pointer. Fixes PR10372.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135294 91177308-0d34-0410-b5e6-96231b3b80d8
91a5755ad73c5dc1dfb167e448fdd74e75a6df56 15-Jul-2011 John McCall <rjmccall@apple.com> Create a new expression node, SubstNonTypeTemplateParmExpr,
to represent a fully-substituted non-type template parameter.
This should improve source fidelity, as well as being generically
useful for diagnostics and such.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135243 91177308-0d34-0410-b5e6-96231b3b80d8
7e5e5f4cc36fe50f46ad76dca7a266434c94f475 07-Jul-2011 John McCall <rjmccall@apple.com> In ARC, reclaim all return values of retainable type, not just those
where we have an immediate need of a retained value.

As an exception, don't do this when the call is made as the immediate
operand of a __bridge retain. This is more in the way of a workaround
than an actual guarantee, so it's acceptable to be brittle here.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134605 91177308-0d34-0410-b5e6-96231b3b80d8
03e80030515c800d1ab44125b9052dfffd1bd04c 21-Jun-2011 Douglas Gregor <dgregor@apple.com> Introduce a new AST node describing reference binding to temporaries.

MaterializeTemporaryExpr captures a reference binding to a temporary
value, making explicit that the temporary value (a prvalue) needs to
be materialized into memory so that its address can be used. The
intended AST invariant here is that a reference will always bind to a
glvalue, and MaterializeTemporaryExpr will be used to convert prvalues
into glvalues for that binding to happen. For example, given

const int& r = 1.0;

The initializer of "r" will be a MaterializeTemporaryExpr whose
subexpression is an implicit conversion from the double literal "1.0"
to an integer value.

IR generation benefits most from this new node, since it was
previously guessing (badly) when to materialize temporaries for the
purposes of reference binding. There are likely more refactoring and
cleanups we could perform there, but the introduction of
MaterializeTemporaryExpr fixes PR9565, a case where IR generation
would effectively bind a const reference directly to a bitfield in a
struct. Addresses <rdar://problem/9552231>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133521 91177308-0d34-0410-b5e6-96231b3b80d8
f85e193739c953358c865005855253af4f68a497 16-Jun-2011 John McCall <rjmccall@apple.com> Automatic Reference Counting.

Language-design credit goes to a lot of people, but I particularly want
to single out Blaine Garst and Patrick Beard for their contributions.

Compiler implementation credit goes to Argyrios, Doug, Fariborz, and myself,
in no particular order.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133103 91177308-0d34-0410-b5e6-96231b3b80d8
61eee0ca33b29e102f11bab77c8b74cc00e2392b 04-Jun-2011 Tanya Lattner <tonic@nondot.org> Add support for builtin astype:
__builtin_astype(): Used to reinterpreted as another data type of the same size using for both scalar and vector data types.
Added test case.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132612 91177308-0d34-0410-b5e6-96231b3b80d8
e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bc 26-May-2011 Ted Kremenek <kremenek@apple.com> static analyzer: when conservatively evaluating functions, don't invalidate the values of globals when the called function is strlen.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132100 91177308-0d34-0410-b5e6-96231b3b80d8
ce30688b8aa0effd70a7a69a4d1e3d6a2a86efcd 21-May-2011 Ted Kremenek <kremenek@apple.com> Fix regression in static analyzer's handling of prefix '--' operator. It was being treated as postfix '--' in C mode.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@131770 91177308-0d34-0410-b5e6-96231b3b80d8
575a1c9dc8dc5b4977194993e289f9eda7295c39 20-May-2011 Douglas Gregor <dgregor@apple.com> Introduce Type::isSignedIntegerOrEnumerationType() and
Type::isUnsignedIntegerOrEnumerationType(), which are like
Type::isSignedIntegerType() and Type::isUnsignedIntegerType() but also
consider the underlying type of a C++0x scoped enumeration type.

Audited all callers to the existing functions, switching those that
need to also handle scoped enumeration types (e.g., those that deal
with constant values) over to the new functions. Fixes PR9923 /

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@131735 91177308-0d34-0410-b5e6-96231b3b80d8
35bdbf40624beba3fc00cb72ab444659939c1a6b 02-May-2011 Ted Kremenek <kremenek@apple.com> Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130711 91177308-0d34-0410-b5e6-96231b3b80d8
28bbe4b8acc338476fe0825769b41fb32b423c72 28-Apr-2011 John Wiegley <johnw@boostpro.com> Parsing/AST support for Structured Exception Handling

Patch authored by Sohail Somani.

Provide parsing and AST support for Windows structured exception handling.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130366 91177308-0d34-0410-b5e6-96231b3b80d8
21ff2e516b0e0bc8c1dbf965cb3d44bac3c64330 28-Apr-2011 John Wiegley <johnw@boostpro.com> Implementation of Embarcadero array type traits

Patch authored by John Wiegley.

These are array type traits used for parsing code that employs certain
features of the Embarcadero C++ compiler: __array_rank(T) and
__array_extent(T, Dim).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130351 91177308-0d34-0410-b5e6-96231b3b80d8
552622067dc45013d240f73952fece703f5e63bd 25-Apr-2011 John Wiegley <johnw@boostpro.com> t/clang/expr-traits

Patch authored by David Abrahams.

These two expression traits (__is_lvalue_expr, __is_rvalue_expr) are used for
parsing code that employs certain features of the Embarcadero C++ compiler.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130122 91177308-0d34-0410-b5e6-96231b3b80d8
e970c60dadaf22019743724bac879dbefbc4f5e3 22-Apr-2011 Ted Kremenek <kremenek@apple.com> Add static analyzer support for C++'0X nullptr. Patch by Jim Goodnow II.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130003 91177308-0d34-0410-b5e6-96231b3b80d8
f111d935722ed488144600cea5ed03a6b5069e8f 15-Apr-2011 Peter Collingbourne <peter@pcc.me.uk> C1X: implement generic selections

As an extension, generic selection support has been added for all
supported languages. The syntax is the same as for C1X.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129554 91177308-0d34-0410-b5e6-96231b3b80d8
ad762fcdc16b9e4705b12b09d92b8c026212b906 15-Apr-2011 Richard Smith <richard-llvm@metafoo.co.uk> Add support for C++0x's range-based for loops, as specified by the C++11 draft standard (N3291).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129541 91177308-0d34-0410-b5e6-96231b3b80d8
755d8497e39071aa24acc173ff07083e3256b8f8 12-Apr-2011 John McCall <rjmccall@apple.com> After some discussion with Doug, we decided that it made a lot more sense
for __unknown_anytype resolution to destructively modify the AST. So that's
what it does now, which significantly simplifies some of the implementation.
Normal member calls work pretty cleanly now, and I added support for
propagating unknown-ness through &.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129331 91177308-0d34-0410-b5e6-96231b3b80d8
379b5155b4566f63679e1da6b0ceb5fdfa2aec6d 11-Apr-2011 John McCall <rjmccall@apple.com> More __unknown_anytype work.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129269 91177308-0d34-0410-b5e6-96231b3b80d8
575b374fdbfc2c2224fd3047ac11ffc4b8db9ae5 11-Apr-2011 Anders Carlsson <andersca@mac.com> Remove CK_DynamicToNull.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129265 91177308-0d34-0410-b5e6-96231b3b80d8
7d99bc37e77157523e3bfbc6c077842b74e6690f 10-Apr-2011 Anders Carlsson <andersca@mac.com> As a first step towards fixing PR9641, add a CK_DynamicToNull cast kind which
represents a dynamic cast where we know that the result is always null.

For example:

struct A {
virtual ~A();
struct B final : A { };
struct C { };

bool f(B* b) {
return dynamic_cast<C*>(b);

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129256 91177308-0d34-0410-b5e6-96231b3b80d8
5fe98728dca1f3a7a378ce1a21984a0f8a0c0b8b 09-Apr-2011 Ted Kremenek <kremenek@apple.com> Start overhauling static analyzer support for C++ constructors. The inlining support isn't complete, and needs
to be reworked to model CallEnter/CallExit (just like all other calls). For now, treat constructors mostly
like other function calls, making the analysis of C++ code just a little more useful.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129166 91177308-0d34-0410-b5e6-96231b3b80d8
1de4d4e8cb2e9c88809fea8092bc6e835a5473d2 07-Apr-2011 John McCall <rjmccall@apple.com> Basic, untested implementation for an "unknown any" type requested by LLDB.
The idea is that you can create a VarDecl with an unknown type, or a
FunctionDecl with an unknown return type, and it will still be valid to
access that object as long as you explicitly cast it at every use. I'm
still going back and forth about how I want to test this effectively, but
I wanted to go ahead and provide a skeletal implementation for the LLDB
folks' benefit and because it also improves some diagnostic goodness for
placeholder expressions.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129065 91177308-0d34-0410-b5e6-96231b3b80d8
d40066b0fb883839a9100e5455e33190b9b8abac 05-Apr-2011 Ted Kremenek <kremenek@apple.com> Fix PR 9626 (duplicated self-init warnings under -Wuninitialized) with numerous CFG and UninitializedValues analysis changes:

1) Change the CFG to include the DeclStmt for conditional variables, instead of using the condition itself as a faux DeclStmt.
2) Update ExprEngine (the static analyzer) to understand (1), so not to regress.
3) Update UninitializedValues.cpp to initialize all tracked variables to Uninitialized at the start of the function/method.
4) Only use the SelfReferenceChecker (SemaDecl.cpp) on global variables, leaving the dataflow analysis to handle other cases.

The combination of (1) and (3) allows the dataflow-based -Wuninitialized to find self-init problems when the initializer
contained control-flow.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128858 91177308-0d34-0410-b5e6-96231b3b80d8
422ab7a49a9a4252dbc6350e49d7a5708337b9c7 02-Apr-2011 Ted Kremenek <kremenek@apple.com> Teach IdempotentOperationsChecker about paths aborted because ExprEngine didn't know how to handle a specific Expr type.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128761 91177308-0d34-0410-b5e6-96231b3b80d8
94ae8fd470471134114599ccfc2301da05719212 31-Mar-2011 Ted Kremenek <kremenek@apple.com> Static analyzer: fix bug in handling of dynamic_cast<>. The sink node wouldn't always be the final node, thus causing the state to continue propagating. Instead,
recover some path-sensitivity by conjuring a symbol.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128612 91177308-0d34-0410-b5e6-96231b3b80d8
b277159055933e610bbc80262b600d3ad7e0595c 30-Mar-2011 Ted Kremenek <kremenek@apple.com> Begin reworking static analyzer support for C++ method calls. The current logic was divorced
from how we process ordinary function calls, had a tremendous about of redundancy, and relied
strictly on inlining behavior (which was incomplete) to provide semantics instead of falling
back to the conservative analysis we use for C functions. This is a significant step into
making C++ analyzer support more useful.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128557 91177308-0d34-0410-b5e6-96231b3b80d8
46fc3fae1cf1926a3b8138bca4adeda37c41f92c 12-Mar-2011 Ted Kremenek <kremenek@apple.com> static analyzer: Handle 'ExprWithCleanups' in ExprEngine by essentially ignoring them.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127523 91177308-0d34-0410-b5e6-96231b3b80d8
f4e3cfbe8abd124be6341ef5d714819b4fbd9082 11-Mar-2011 Peter Collingbourne <peter@pcc.me.uk> Add support for the OpenCL vec_step operator, by generalising and
extending the existing support for sizeof and alignof. Original
patch by Guy Benyei.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127475 91177308-0d34-0410-b5e6-96231b3b80d8
e71f3d587844110d836c82250830b27b1651afdb 02-Mar-2011 Ted Kremenek <kremenek@apple.com> Teach CFGBuilder to prune trivially unreachable case statements.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126797 91177308-0d34-0410-b5e6-96231b3b80d8
3c0349e87cdbd7316d06d2411d86ee1086e717a5 01-Mar-2011 Ted Kremenek <kremenek@apple.com> In preparation for fixing PR 6884, rework CFGElement to have getAs<> return pointers instead of fresh CFGElements.

- Also, consoldiate getDtorKind() and getKind() into one "kind".
- Add empty getDestructorDecl() method to CFGImplicitDtor.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126738 91177308-0d34-0410-b5e6-96231b3b80d8
7636d8853f4b96be2fa394eb59047ccad37efa4c 01-Mar-2011 Argyrios Kyrtzidis <akyrtzi@gmail.com> [analyzer] Move lib/StaticAnalyzer/Checkers/ExprEngine.cpp -> lib/StaticAnalyzer/Core
and hope the wrath of the buildbots will not descend upon me.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126728 91177308-0d34-0410-b5e6-96231b3b80d8