- Add the distinction between the 'bug type' and the 'bug description'

HTMLDiagnostics:
- Output the bug type field as HTML comments

scan-build:
- Use the bug type field instead of the bug description for the HTML table.
- Radar filing now automatically picks up the bug description in the title (addresses <rdar://problem/6265970>)

llvm-svn: 63084

More hacking on static analyzer diagnostics.  When emitting summary diagnostics the code paths for diagnostics involving paths or single locations are now unified.  This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup.

llvm-svn: 62903

llvm-svn: 62885

Added virtual method DiagnosticClient::IncludeInDiagnosticCounts().  This is used by Diagnostics to determine if a diagnostic sent to a given DiagnosticClient should be included in the count of diagnostics.  The default implementation of this method returns 'true'.

Implemented DiagCollector::IncludeInDiagnosticCounts() to return 'false' so that the batching of diagnostics for use with BugReporter doesn't mess up the count of real diagnostics.

llvm-svn: 62873

"logical" location, refer to the "instantiation" location.

llvm-svn: 62316

Fix <rdar://problem/6454568>: BugReporter should correctly handle switch statements with no default case.

llvm-svn: 61270

Rename SymbolID to SymbolRef.  This is a precursor to some overhauling of the representation of symbolic values.

llvm-svn: 60575

uses of getName() with uses of getDeclName().  This upgrades a bunch of
diags to take DeclNames instead of std::strings.

This also tweaks a couple of diagnostics to be cleaner and changes
CheckInitializerTypes/PerformInitializationByConstructor to pass
around DeclarationNames instead of std::strings.

llvm-svn: 59947

are formed.  In particular, a diagnostic with all its strings and ranges is now
packaged up and sent to DiagnosticClients as a DiagnosticInfo instead of as a 
ton of random stuff.  This has the benefit of simplifying the interface, making
it more extensible, and allowing us to do more checking for things like access
past the end of the various arrays passed in.

In addition to introducing DiagnosticInfo, this also substantially changes how 
Diagnostic::Report works.  Instead of being passed in all of the info required
to issue a diagnostic, Report now takes only the required info (a location and 
ID) and returns a fresh DiagnosticInfo *by value*.  The caller is then free to
stuff strings and ranges into the DiagnosticInfo with the << operator.  When
the dtor runs on the DiagnosticInfo object (which should happen at the end of
the statement), the diagnostic is actually emitted with all of the accumulated
information.  This is a somewhat tricky dance, but it means that the 
accumulated DiagnosticInfo is allowed to keep pointers to other expression 
temporaries without those pointers getting invalidated.

This is just the minimal change to get this stuff working, but this will allow
us to eliminate the zillions of variant "Diag" methods scattered throughout
(e.g.) sema.  For example, instead of calling:

  Diag(BuiltinLoc, diag::err_overload_no_match, typeNames,
       SourceRange(BuiltinLoc, RParenLoc));

We will soon be able to just do:

  Diag(BuiltinLoc, diag::err_overload_no_match)
      << typeNames << SourceRange(BuiltinLoc, RParenLoc));

This scales better to support arbitrary types being passed in (not just 
strings) in a type-safe way.  Go operator overloading?!

llvm-svn: 59502

delete huge trailing whitespace to fit in 80 cols.

llvm-svn: 59497

RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671

Use DeclStmt::decl_iterator instead of using Decl::getDecl().  Soon DeclStmts will wrap group of Decls.
Added FIXME.

llvm-svn: 57189

This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.

This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042

Changed casing of many bug names.  The convention will be to have bug names (mostly) lower cased, and categories use some capitalization.

llvm-svn: 56385

motivated because it became clear that the number of subclasses of ProgramPoint
would expand and we ran out of bits to represent a pointer variant. As a plus of
this change, BlockEdge program points can now be represented explicitly without
using a cache of CFGBlock* pairs in CFG.

llvm-svn: 56245

llvm-svn: 56166

an APInt directly to an ostream now, so add some hacks.  It would
be better to switch all of the bugreport (and friends) stuff over
to raw_ostream.

llvm-svn: 55264

llvm-svn: 54874

Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721

llvm-svn: 53573

Refactored error reporting in CheckObjCDealloc and CheckObjCInstMethSignature to use this new bug reporting interface (major code simplification).

llvm-svn: 53560

current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423

Have BugReporter::getCFG and BugReporter::getLiveVariables returns pointers instead of references, because they can both fail
on functions we cannot construct full CFGs for yet.

llvm-svn: 53081

Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.

llvm-svn: 53048

1) Check if a dead store appears as a subexpression.  For such cases, we emit
   a verbose diagnostic so that users aren't confused.  This addresses:
   
   <rdar://problem/5968508> checker gives misleading report for dead store in loop
   
2) Don't emit a dead store warning when assigning a null value to a pointer.
   This is a common form of defensive programming.  We may wish to make
   this an option to the the checker one day.
   
   This addresses the feature request in the following email:
   
   http://lists.cs.uiuc.edu/pipermail/cfe-dev/2008-June/001978.html

llvm-svn: 52555

Added a new ProgramPoint: PostPurgeDeadSymbols.  This new program point distinguishes between the cases when we just evaluated the transfer function of a Stmt* (PostStmt) or performed a load (PostLoad).  This solves a caching bug observed in a recent bug report.

llvm-svn: 52443

llvm-svn: 52426

llvm-svn: 51453

Partitioned BugTypeCachedLocation::isCached() into two methods: one that accepts and ExplodedNode, and the other that accepts a ProgramPoint.  The default behavior is to cache bug reports by the
location they occur (the end node).  Subclasses can override this behavior by providing a different ProgramPoint.

llvm-svn: 51197

"Execution continues..." message, which does a better job at handling corner cases.

llvm-svn: 50751

llvm-svn: 50597

llvm-svn: 50553

llvm-svn: 50549

a CF memory leak occurred with GC enabled, etc.

llvm-svn: 50507

empty CFGBlocks that only contained a terminator.

Added improved diagnostics for break and continue statements and default branches in switch statements.

This fixes <rdar://problem/5889244>.

llvm-svn: 50286

Don't emit empty strings for path diagnostics when taking the default branch of a switch statement that has no label.

llvm-svn: 50242

Implemented support for better localized leaks in the CF reference count checker.
Now leaks should be flagged close to where they occur.

This should implement the desired functionality in <rdar://problem/5879592>, although the diagnostics still need to be improved.

llvm-svn: 50241

that say that we are jumping to "case a" instead of "case 0".

This is a feature implementation for <rdar://problem/5880430>.

llvm-svn: 50197

llvm-svn: 50195

When building PathDiagnostics for bug reports, generate a trimmed ExplodedGraph with a single path that BugReport objects can safely walk and introspect.

llvm-svn: 50194