- Overhauled the notion of "types" for TypedRegions.  We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()).  Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs.
- Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type.  We can add it back once there is a need for it and we can resolve its role with these concepts.

StoreManager:
- Overhauled StoreManager::CastRegion.  It expects an *lvalue* type for a region.  This is actually what motivated the overhaul to the MemRegion type mechanism.  It also no longer returns an SVal; we can just return a MemRegion*.
- BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts.  This matches with the MemRegion changes.
- Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion().

AuditCFNumberCreate check:
- Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type.  This change was needed to work with the changes to StoreManager::CastRegion.

GRExprEngine::VisitCast:
- Conform to the new interface of StoreManager::CastRegion.

Tests:
- None of the analysis tests fail now for using the "basic store".
- Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing.

llvm-svn: 60995

a new NamedDecl::getAsString() method.

Change uses of Selector::getName() to just pass in a Selector 
where possible (e.g. to diagnostics) instead of going through
an std::string.

This also adds new formatters for objcinstance and objcclass
as described in the dox.

llvm-svn: 59933

Added method "getSelfRegion" to Store.  This method returns the region associated with the "this" or "self" object (C++ and Objective-C respectively).

llvm-svn: 58107

- Added new region "SymbolicRegion", which maps symbol values to the region domain.
- Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion)
- Added some utility methods to GRState for fetch svals from the store.
- Fixed regression in CheckNSError (we weren't getting the value bound to the parameter)

llvm-svn: 57717

RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671

This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.

This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042

llvm-svn: 56403

Change implementation of NSError** coding-style check to be invoked at the end of the retain/release analysis.

llvm-svn: 56312

llvm-svn: 55526

Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721

 - Drop {Decl.h,DeclObjC.h,IdentifierTable.h} from Expr.h
 - Moved Sema::getCurMethodDecl() out of line (dependent on
   ObjCMethodDecl via dyn_cast).

llvm-svn: 54629

ASTContext::getCanonicalType instead (PR2189)

llvm-svn: 54105

Moved registration of basic path-sensitive checks from GRSimpleVals.cpp to GRExprEngineInternalChecks.cpp.

llvm-svn: 53909

This implements <rdar://problem/6069935>

llvm-svn: 53891

current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423

llvm-svn: 52799

- #include ExprObjC.h in many places

llvm-svn: 51703

llvm-svn: 51324

llvm-svn: 50549

llvm-svn: 50503

llvm-svn: 50494

llvm-svn: 49959

can decide the policy on how to cache related bugs.  This allows us to
properly to handle warning about multiple leaks in the same location in the
ref count checker (not yet done).

llvm-svn: 49918

EmitPathWarning into one method.  We now properly handle emitting warnings
without a PathDiagnosticClient when the warning does not involve a particular
statement.

llvm-svn: 49884

warnings are emitted as part of the warnings registered by GRSimpleVals.

llvm-svn: 49658

iterator instead of "end") and not implementing "getDescription()" for Nil
argument checks.

llvm-svn: 49485

Bugs are now reported using a combination of "BugType" (previously
BugDescription) and Bug "BugReport" objects, which are fed to BugReporter (which
generates PathDiagnostics). This provides a far more modular way of registering
bug types and plugging in diagnostics.

GRExprEngine now owns its copy of GRCoreEngine, and is not owned by the
ExplodedGraph.

ExplodedGraph is no longer templated on the "checker", but instead on the state
contained in the nodes.

llvm-svn: 49453

llvm-svn: 49193

the new BugReporter interface.

llvm-svn: 49180

Added skeleton checking for NSString's method initWithFormat: (do not pass nil).  This won't be useful in most cases right now
because the analyzer isn't tracking expected types for an object, and [NSString alloc] just runs "id".

llvm-svn: 48917

llvm-svn: 48898

Added test case to test warning about passing 'nil' to NSString's compare: method.

llvm-svn: 48896

llvm-svn: 48895

llvm-svn: 48886

Added "GRAuditor" and "GRSimpleAPICheck" interface to allow simple stateless checkers to be injected into the analyzer.
Added "AnnotatedPath" class to record an annotated path that will be useful for inspecting paths.
Added some boilerplate code for simple checks of Apple's Foundation API.

llvm-svn: 48867