value bindings.  Along with a small change to OSAtomicChecker, this
resolves <rdar://problem/7527292> and resolves some long-standing
issues with how values can be bound to the same physical address by
not have the same "key".  This change is only a beginning; logically
RegionStore needs to better handle loads from addresses where the
stored value is larger/smaller/different type than the loaded value.
We handle these cases in an approximate fashion now (via
CastRetrievedVal and help in SimpleSValuator), but it could be made
much smarter.

llvm-svn: 93137

(1) Introduce a new 'BindingKey' class to match 'BindingValue'.  This
gives us the flexibility to change the current key value from 'const
MemRegion*' to something more interesting.

(2) Rework additions/removals/lookups from the store to use new
'Remove', 'Add', 'Lookup' utility methods.

No "real" functionality change; just prep work and abstraction.

llvm-svn: 93136

Make static analysis support for C++ 'this' expression context-sensitive.  Essentially treat 'this' as a implicit parameter to the method call, and associate a region with it.

llvm-svn: 92675

llvm-svn: 91818

llvm-svn: 91572

attribute: the object type. 
Add initial support for visiting CXXThisExpr.
Fix a bunch of 80-col violations.

llvm-svn: 91535

This change was a lot bigger than I originally anticipated; among
other things it requires us storing more information in the CFG to
record what block-level expressions need to be evaluated as lvalues.

The big change is that CFGBlocks no longer contain Stmt*'s by
CFGElements.  Currently CFGElements just wrap Stmt*, but they also
store a bit indicating whether the block-level expression should be
evalauted as an lvalue.  DeclStmts involving the initialization of a
reference require us treating the initialization expression as an
lvalue, even though that information isn't recorded in the AST.
Conceptually this change isn't that complicated, but it required
bubbling up the data through the CFGBuilder, to GRCoreEngine, and
eventually to GRExprEngine.

The addition of CFGElement is also useful for when we want to handle
more control-flow constructs or other data we want to keep in the CFG
that isn't represented well with just a block of statements.

In GRExprEngine, this patch introduces logic for evaluating the
lvalues of references, which currently retrieves the internal "pointer
value" that the reference represents.  EvalLoad does a two stage load
to catch null dereferences involving an invalid reference (although
this could possibly be caught earlier during the initialization of a
reference).

Symbols are currently symbolicated using the reference type, instead
of a pointer type, and special handling is required creating
ElementRegions that layer on SymbolicRegions (see the changes to
RegionStoreManager).

Along the way, the DeadStoresChecker also silences warnings involving
dead stores to references.  This was the original change I introduced
(which I wrote test cases for) that I realized caused GRExprEngine to
crash.

llvm-svn: 91501

Remove ValueManager::getRegionValueSymbolValOrUnknown().  It was just extra veneer on top of getRegionValueSymbolVal().

llvm-svn: 91471

Enhance understanding of VarRegions referenced by a block whose declarations are outside the current stack frame.  Fixes <rdar://problem/7462324>.

llvm-svn: 91107

- Refactor the MemRegion hierarchy to distinguish between different StackSpaceRegions for locals and parameters.
- VarRegions for "captured" variables now have the BlockDataRegion as their super region (except those passed by reference)
- Add transfer function support to GRExprEngine for BlockDeclRefExprs.

This change also supports analyzing blocks as an analysis entry point
(top-of-the-stack), which required pushing more context-sensitivity
around in the MemRegion hierarchy via the use of LocationContext
objects.  Functionally almost everything is the same, except we track
LocationContexts in a few more areas and StackSpaceRegions now refer
to a StackFrameContext object.  In the future we will need to modify
MemRegionManager to allow multiple StackSpaceRegions in flight at once
(for the analysis of multiple stack frames).

llvm-svn: 90809

llvm-svn: 90582

llvm-svn: 90503

Tweak handling of BlockDataRegions in RegionStoreManager::RemoveDeadBindings():  only the VarRegions for variables marked with the '__block' annotation should have their lifetime extended by a BlockDataRegion.

llvm-svn: 90462

Add value invalidation logic for block-captured variables.  Conceptually invoking a block (without specific reasoning of what the block does) can invalidate any value to it by reference when the block was created.

llvm-svn: 90431

Add batch version of 'StoreManager::InvalidateRegion()' for invalidating multiple regions as once.  After adopting this in the CFRefCount::EvalCall(), we see a reduction in analysis time of 1.5% when analyzing all of SQLite3.

llvm-svn: 90405

llvm-svn: 90028

Teach RegionStoreManager::RemoveDeadBindings() about BlockDataRegions.  Any VarRegion for a "captured" variable should also be considered live.

llvm-svn: 89928

'BlockDataRegion' to distinguish between the code associated with a
block (which is represented by 'BlockTextRegion') and an instance of a
block, which includes both code and data.  'BlockDataRegion' has an
associated LocationContext, which can be used to eventually model the
lifetime of a block object once LocationContexts can represent scopes
(and iterations around a loop, etc.).

llvm-svn: 89900

llvm-svn: 89897

llvm-svn: 89892

Split CodeTextRegion into FunctionTextRegion and BlockTextRegion.  This a precursor to having basic static analysis support for blocks.

llvm-svn: 89828

Fix crash when using --analyzer-store=region when handling initializers with nested arrays/structs whose values are not explicitly specified.  Fixes <rdar://problem/7403269>.

llvm-svn: 89384

* Add a load type to GRExprEngine::EvalLoad().
* When retrieve from 'theValue' of OSAtomic funcitions, use the type of the 
  region instead of the argument expression as the load type.
* Then we can convert CastRetrievedSVal to a pure assertion. In the future
  we can let all Retrieve() methods simply return SVal.

llvm-svn: 88888

llvm-svn: 86932

getBaseRegion will be used in another method.

llvm-svn: 86649

Patch by Victor Zverovich!

llvm-svn: 86638

ArrayType>()) does not instantiate. Update all callers that used this
unsafe feature to use the appropriate ASTContext::getAs*ArrayType method.

llvm-svn: 86596

Refactor StoreManager::BindDecl() to take a VarRegion* instead of a VarDecl*, and modify GRExprEngine::EvalBind() to handle decl initialization as well.  This paves the way for adding "checker" visitation in EvalBind().

llvm-svn: 85983

by Zhongxing Xu.  RemoveDeadBindings() would falsely prune
SymbolicRegions from the store that wrapped derived symbols whose
liveness could only be determined after scanning the store.

llvm-svn: 85484

region when doing lazy value retrieval of an ivar.

This fixes: <rdar://problem/7312221>

llvm-svn: 84584

llvm-svn: 84398

Minor cleanup: move typedef out of anonymous namespace (which now contains nothing) and into RemoveDeadBindings.  No functionality change.

llvm-svn: 84335

the code to standard worklist algorithm. Always add both sub and super 
regions of live regions.

llvm-svn: 84323

kinds. This means we are visiting all regions 'from super region'.

llvm-svn: 84319

retain/release checker: Stop tracking reference counts for any symbols touched by StoreManager::InvalidateRegion().

This fixes <rdar://problem/7257223> and <rdar://problem/7283470>.

llvm-svn: 84223

RegionStoreManager::Retrieve() that was intended to handle conflated uses of pointers as integers.
It turns out this isn't needed, and resulted in inconsistent behavior when creating symbolic values on the following test case in 'tests/Analysis/misc-ps.m':

  typedef struct _BStruct { void *grue; } BStruct;
  void testB_aux(void *ptr);
  void testB(BStruct *b) {
    {
      int *__gruep__ = ((int *)&((b)->grue));
      int __gruev__ = *__gruep__;
      testB_aux(__gruep__);
    }
    {
      int *__gruep__ = ((int *)&((b)->grue));
      int __gruev__ = *__gruep__;
      if (~0 != __gruev__) {}
    }
  }

When the code was analyzed with '-arch x86_64', the value assigned to '__gruev__' be would be a
symbolic integer, but for '-arch i386' the value assigned to '__gruev__' would be a symbolic region
(a blob of memory). With this change the value created is always a symbolic integer.

Since the code being removed was added to support analysis of code calling
OSAtomicCompareAndSwapXXX(), I also modified 'test/Analysis/NSString.m' to analyze the code in both
'-arch i386' and '-arch x86_64', and also added some complementary test cases to test the presence
of leaks when using OSAtomicCompareAndSwap32Barrier()/OSAtomicCompareAndSwap64Barrier() instead of
just their absence. This code change reveals that previously both RegionStore and BasicStore were
handling these cases wrong, and would never cause the analyzer to emit a leak in these cases (false
negatives). Now RegionStore gets it right, but BasicStore still gets it wrong (and hence it has been
disabled temporarily for this test case).

llvm-svn: 84163

* Make all Base value the last argument.

llvm-svn: 84071

llvm-svn: 83934

default binding for regions. This allows us to simply a lot of code. A
further simplification could be done is that many methods of
regionstore can only work on Store instead of GRState. 

llvm-svn: 83762

llvm-svn: 83611