Change the ArrayBoundCheckerV2 to be more aggressive in reporting buffer overflows
when the offset is tainted. Previously, we did not report bugs when the state was
underconstrained (not enough information about the bound to determine if there is
an overflow) to avoid false positives. However, if we know that the buffer
offset is tainted - comes in from the user space and can be anything, we should
report it as a bug.

+ The very first example of us catching a taint related bug.
This is the only example we can currently handle. More to come...

llvm-svn: 144826

The checker is responsible for defining attack surface and adding taint to symbols.

llvm-svn: 144825

many checkers are trying to get a name of the callee when visiting
a CallExpr, so provide a convenience API.

llvm-svn: 144820

[static analyzer] Tweak RetainCountChecker's diagnostics to correctly indicate if a message was due to a property access.  This can
potentially be refactored for other clients, and this is a regression from the refactoring of property acceses.

llvm-svn: 144571

literal types, as well as derived-to-base casts for lvalues and
derived-to-virtual-base casts.

llvm-svn: 144265

Analysis by Ted:
"
    if (stateZero && !stateNotZero) {

is checking to see if:

  (A)  "it is possible for the value to be zero"   (stateZero)

    AND

  (B) "it is not possible for the value to be non-zero"  (!stateNotZero)

That said, the only way for both B to be true AND A to be false is if the path is completely infeasible by the time we reach the divide-by-zero check.  For the most part (all cases?), such cases should automatically get pruned out at branches (i.e., an infeasible path gets dropped), which is the case in our tests.  So the question is whether or not such an infeasible path might not get dropped earlier?  I can't envision any right now.

Indeed, the rest of the checker assumes that if the bug condition didn't fire then 'stateNotZero' is non-NULL:

    C.addTransition(stateNotZero);
"

llvm-svn: 144114

llvm-svn: 143787

Remove unnecessary calls to CheckerContext::getPredecessor() + Comments.

llvm-svn: 143513

[analyzer] ObjC message sends to nil receivers that return structs are now okay (compiler zeroes out the data).  Fixes <rdar://problem/9151319>.

llvm-svn: 143215

CheckerContext::getPredecessor is only used to get to the LocationContext
half of the times.

llvm-svn: 143061

The path sensitive checkers should use EmitBasicReport, which provides the
node information.

llvm-svn: 143060

Also document addTransition methods.

llvm-svn: 143059

A step toward making sure that diagnostics report should only
be generated though the CheckerContext and not though BugReporter
or ExprEngine directly.

llvm-svn: 142947

Remove dead members/parameters: ProgramState, respondsToCallback, autoTransition.
Remove addTransition method since it's the same as generateNode. Maybe we should
rename generateNode to genTransition (since a transition is always automatically
generated)?

llvm-svn: 142946

Now, all the path sensitive checkers use CheckerContext!

llvm-svn: 142944

Get rid of the EndOfPathBuilder completely.
Use the generic NodeBuilder to generate nodes.
Enqueue the end of path frontier explicitly.

llvm-svn: 142943

llvm-svn: 142885

Renamed PureNodeBuilder->StmtNodeBuilder.

llvm-svn: 142849

- OSAtomicChecker
- ExprEngine::processStmt

llvm-svn: 142846

Rename AnalysisContext to AnalysisDeclContext.  Not only is this name more accurate, but it frees up the name AnalysisContext for other uses.

llvm-svn: 142782

NodeBuilder should not assume it's dealing with a single predecessor. Remove predecessor getters. Modify the BranchNodeBuilder to not be responsible for doing auto-transitions (which depend on a predecessor).

llvm-svn: 142453

ExprEngineBuilders is not used.

llvm-svn: 142450

Take advantage of the new builders for branch processing. As part of this change pass generic NodeBuilder (instead of BranchNodeBuilder) to the BranchCondition callback and remove the unused methods form BranchBuilder.

llvm-svn: 142448

llvm-svn: 142444

[analyzer] Node Builder refactoring: Introduce a simple Node Builder responsible for generating the node frontier.

Currently we have a bunch of different node builders which provide some common
functionality but are difficult to refactor. Each builder generates nodes of
different kinds and calculates the frontier nodes, which should be propagated
to the next step (after the builder dies).

Introduce a new NodeBuilder which provides very basic node generation facilities
but takes care of the second problem. The idea is that all the other builders
will eventually use it. Use this builder in CheckerContext instead of
StmtNodeBuilder (the way the frontier is propagated to the StmtBuilder
is a hack and will be removed later on).

llvm-svn: 142443

Passing a pointer was a bad idea as it collides with the overload for void*.

llvm-svn: 141971

llvm-svn: 141678

[analyzer] Warn about the use of insecure, deprecated vfork() function PR11053 (http://llvm.org/bugs/show_bug.cgi?id=11053). 

A patch by Graham Lee!

llvm-svn: 141643

 - Remodel Expr::EvaluateAsInt to behave like the other EvaluateAs* functions,
   and add Expr::EvaluateKnownConstInt to capture the current fold-or-assert
   behaviour.
 - Factor out evaluation of bitfield bit widths.
 - Fix a few places which would evaluate an expression twice: once to determine
   whether it is a constant expression, then again to get the value.

llvm-svn: 141561

Remove AnalysisContext::getLiveVariables(), and introduce a templatized mechanism to lazily create analyses that are attached to AnalysisContext objects.

llvm-svn: 141425

for better self-documenting code, since the semantics
are subtly different from getDefinition().

llvm-svn: 141355

llvm-svn: 141267

llvm-svn: 141262

Fix major regression in RetainCountChecker.  DefaultSummaries were not being used when they were meant to be.  Fixes <rdar://problem/10241614>.

llvm-svn: 141250

[analyzer] Remove the last dependency on CheckerContext::getNodeBuilder() as well as the method itself.

Checkers should not directly access NodeBuilder, nodes can be created by calling the CheckerContext's generateNode() methods.

llvm-svn: 141249

[analyzer] OSAtomicChecker implements evalCall in a very invasive way - it essentially simulates inlining of compareAndSwap() by means of setting the NodeBuilder flags and calling ExprEngine directly. 

This commit introduces a new callback just for this checker to unblock checker API cleanup. 

llvm-svn: 141246

[analyzer] Removing more references to CheckerContext::getNodeBuilder(): ask CheckerContext to generate the nodes.

llvm-svn: 141136

[analyzer] Removing references to CheckerContext::getNodeBuilder(): checkers can obtain block count directly from the Context.

llvm-svn: 141112

llvm-svn: 141098

[analyzer] Remove redundant state (AnalysisContext pointer for every BinaryOperator tracked) from IdempotentOperationChecker.

llvm-svn: 141045