two worklists: for nodes whose locations are block edges with loop terminators
and another for nodes with all other locations.  We only dequeue from the loop
worklist when the other is empty.  Exploration of the graph is still in
reverse-BFS.

llvm-svn: 49791

llvm-svn: 49771

llvm-svn: 49763

llvm-svn: 49756

to start logically organizing them.

Added initial plug-in transfer function support for Objective-C message expressions.

llvm-svn: 49752

as before r49748 (where BlockVarDecl was removed).

llvm-svn: 49749

Remove FileVarDecl and BlockVarDecl. They are replaced by VarDecl::isBlockVarDecl() and VarDecl::isFileVarDecl().

This is a fairly mechanical/large change. As a result, I avoided making any changes/simplifications that weren't directly related. I did break two Analysis tests. I also have a couple FIXME's in UninitializedValues.cpp. Ted, can you take a look? If the bug isn't obvious, I am happy to dig in and fix it (since I broke it).

llvm-svn: 49748

Fix bug in terminator processing for uninitialized-values: simply ignore the terminator, don't reprocess it.

LiveVariables analysis now does a flow-insensitive analysis to determine what variables have their address taken; these variables are now always treated as being live.

The DataflowSolver now uses "SetTopValue()" when getting the initial value for the entry/exit block.

llvm-svn: 49734

llvm-svn: 49727

llvm-svn: 49711

in a block's terminator.  This expression is visited within a block, but it is accessed by the
terminator.  This is important to observe because for live-variables analysis the block-level
expression is live between the terminator and where the expression occurs in the block.  So far
this hasn't been an issue to not observe this because the block-level expression used in the
terminator is always the last one in the block, and we have never queried the liveness information
about this point (but before the terminator).

llvm-svn: 49709

in a DeclStmt.

llvm-svn: 49708

"Alive" as opposed to staying the same.

llvm-svn: 49707

is still live.

llvm-svn: 49705

llvm-svn: 49672

llvm-svn: 49668

assume that DeclStmts only have VarDecls; they can have TypedefDecls.

llvm-svn: 49662

to functions with NULL summaries.

llvm-svn: 49660

warnings are emitted as part of the warnings registered by GRSimpleVals.

llvm-svn: 49658

Still need some boilerplate in BugReporter to report bugs at the end
of a function (not associated with a particular statement).

llvm-svn: 49564

evaluating transfer functions at the end-of-path.

llvm-svn: 49561

llvm-svn: 49558

llvm-svn: 49556

GRSimpleVals::EvalCal(), and don't change reference counts.

Remove "getDoNothingSummary()", as a NULL summary does the same thing.

Added temporary hack for the "Get" rule for objects that return a pointer type:
treat them as non-owned CF objects.

Added test case to detect the release of a non-owned object.

llvm-svn: 49555

llvm-svn: 49552

llvm-svn: 49551

use-after-release errors.  Added test case.

llvm-svn: 49509

llvm-svn: 49505

llvm-svn: 49503

code path in the clang driver.

Renamed options --grsimple to -checker-simple and -check-cfref to -checker-cfref.

llvm-svn: 49500

llvm-svn: 49488

BugReport-specific SourceRanges (when available).

llvm-svn: 49486

iterator instead of "end") and not implementing "getDescription()" for Nil
argument checks.

llvm-svn: 49485

llvm-svn: 49455

Bugs are now reported using a combination of "BugType" (previously
BugDescription) and Bug "BugReport" objects, which are fed to BugReporter (which
generates PathDiagnostics). This provides a far more modular way of registering
bug types and plugging in diagnostics.

GRExprEngine now owns its copy of GRCoreEngine, and is not owned by the
ExplodedGraph.

ExplodedGraph is no longer templated on the "checker", but instead on the state
contained in the nodes.

llvm-svn: 49453

llvm-svn: 49414

checker-specific diagnostics.

llvm-svn: 49412

llvm-svn: 49356

llvm-svn: 49258

llvm-svn: 49193