getting the base region. This makes the RemoveDeadBindings() correct.

llvm-svn: 123375

since the bindings are purged after they are set up. Need to investigate
RemoveDeadBindings algorithm.

llvm-svn: 123374

a struct value to a symbolic index into array.
RegionStore can't actually reason about this,
so we were getting bogus warnings about loading
uninitialized values from the array.  The solution
is invalidate the entire array when we cannot
represent the binding explicitly.

Fixes <rdar://problem/8848957>

llvm-svn: 123368

[analyzer] Introduce ObjCSelfInitChecker, which checks initialization methods to verify that they assign 'self' to the
result of an initialization call (e.g. [super init], or [self initWith..]) before using any instance variable or
returning 'self'.

llvm-svn: 123264

to use a node builder.  This paves the way
for Checkers to interpose (via a "visit" method)
at the entrance to blocks.

llvm-svn: 123217

llvm-svn: 123158

// rdar://8818375

llvm-svn: 122831

SimpleSValBuilder.  This clears up some
false positives emitted by ArrayBoundCheckerV2
due to the lack of support for pointer arithmetic.

llvm-svn: 122546

set the RUN line correctly in a test file!

Mark a bunch of tests for ArrayBoundCheckerV2
as FIXME's, as our current lack of pointer
arithmetic handling causes these to be all
false positives/negatives.

llvm-svn: 122471

checker based on using raw (symbolic) byte offsets
from a base region.

llvm-svn: 122469

the location (l-value) to it.

llvm-svn: 122396

This change is necessary when the variable is a const reference and we need
the l-value of the construct expr.  After that, when binding the variable,
recover the lazy compound value when the variable is not a reference.

In Environment, use the value of a no-op cast expression when it has one.
Otherwise, blast-through it.

llvm-svn: 122388

create a temporary object for it.

llvm-svn: 122161

when the selector is the string 'mutable'.

llvm-svn: 122046

only indicates the create rule if it starts
at the beginning of the method name, not
within the method name.

llvm-svn: 122036

Fixes rdar://problem/8776586.

llvm-svn: 121992

implicit lvalue-to-rvalue casts that John McCall
recently introduced.  This causes a whole bunch
of logic in the analyzer for handling lvalues
to vanish.  It does, however, raise a few issues
in the analyzer w.r.t to modeling various constructs
(e.g., field accesses to compound literals).

The .c/.m analysis test cases that fail are
due to a missing lvalue-to-rvalue cast that
will get introduced into the AST.  The .cpp
failures were more than I could investigate in
one go, and the patch was already getting huge.
I have XFAILED some of these tests, and they
should obviously be further investigated.

Some highlights of this patch include:

- CFG no longer requires an lvalue bit for
  CFGElements
- StackFrameContext doesn't need an 'asLValue'
  flag
- The "VisitLValue" path from GRExprEngine has
  been eliminated.

Besides the test case failures (XFAILed), there
are surely other bugs that are fallout from
this change.

llvm-svn: 121960

llvm-svn: 120796

Follow through references to catch returned stack addresses, local blocks, label addresses or references to temporaries, e.g:

const int& g2() {
  int s1;
  int &s2 = s1; // expected-note {{binding reference variable 's2' here}}
  return s2; // expected-warning {{reference to stack memory associated with local variable 's1' returned}}
}

llvm-svn: 120483

llvm-svn: 120351

The issue was brought to our attention by Matthieu Monrocq.

llvm-svn: 120331

llvm-svn: 120173

llvm-svn: 120143

to be consistent with the type of 'this' expr in the method.
此行及以下内容将会被忽略--

M    test/Analysis/method-call.cpp
M    include/clang/Checker/PathSensitive/GRExprEngine.h
M    lib/Checker/GRCXXExprEngine.cpp

llvm-svn: 120094

llvm-svn: 119960

llvm-svn: 119897

allocation sizes of 0 bytes.

Fixes PR 2899.

llvm-svn: 119364

 - Add a new Kind of ProgramPoint: PostInitializer.
 - Still use GRStmtNodeBuilder. But special handling PostInitializer in 
   GRStmtNodeBuilder::GenerateAutoTransition().
 - Someday we should clean up the interface of GRStmtNodeBuilder.

llvm-svn: 119335

Remove invalid assertion from CFG builder.  When building the CFG pieces for a ternary '?' expression,
it is possible for the confluence block to only have a single predecessor due to calls to 'noreturn'
functions.  Fixes assertion failure reported in PR 8619.

llvm-svn: 119284

Relax assertion in SValuator so that we don't crash when analyzing a call via a function pointer that
casts the return value to something completely different.  While we need better reasoning here,
we should definately not crash.

llvm-svn: 119177

Elidable CXXConstructExpr should inhibit calling destructor for temporary 
that is copied, not the one created. This is because eliding copy constructor 
means that the object that was to be copied will be constructed directly in 
memory the copy would be constructed in.

llvm-svn: 119044

CXXConstructExpr.

llvm-svn: 118991

RegionStore/BasicStore: do not return UndefinedVal for accesses to concrete addresses; instead return UnknownVal.  This
leads it up to checkers (e.g., DereferenceChecker) to guard against illegal accesses (e.g., null dereferences).

Fixes PR 5272 and <rdar://problem/6839683>.

llvm-svn: 118852

Teach AttrNonNullChecker about transparent unions.  Fixes crash reported in <rdar://problem/8642434>.

llvm-svn: 118473

llvm-svn: 118166

Added generating destructors for temporary objects. Two cases I know of, that are not handled properly:
1. For statement: const C& c = C(0) ?: C(1) destructors generated for condition will not differ from those generated for case without prolonged lifetime of temporary,
2. There will be no destructor for constant reference member bound to temporary at the exit from constructor.

llvm-svn: 118158

llvm-svn: 117974

declaration names, from Jim Goodnow II!

llvm-svn: 117970

Let the destination of AggExprVisitor be an explicit MemRegion. 
Reenable the test case.

llvm-svn: 117908

method inlining. Temporarily fail a test case.

llvm-svn: 117907