Zhongxing and I discussed by email.

Main changes:
- Removed SymIntConstraintVal and SymIntConstraint
- Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr
- Added nonloc::SymExprVal to wrap SymExpr
- SymbolRef is now just a typedef of 'const SymbolData*'
- Bunch of minor code cleanups in how some methods were invoked (no functionality change)

This changes are part of a long-term plan to have full symbolic expression
trees. This will be useful for lazily evaluating complicated expressions.

llvm-svn: 67731

representing symbolic expressions like 'x'+3 and 'x'+'y'. The design is
subjected to change later when we fix the class hierarchy of symbolic
expressions.

llvm-svn: 67678

<rdar://problem/6704930> involving SimpleConstraintManager not reasoning well
about symbolic constraint values involving arithmetic operators.

llvm-svn: 67534

values passed-by-reference to unknown functions.

llvm-svn: 67519

- Conjure symbols at '--' and '++' unary operations
- Add utility method SVal::GetConjuredSymbolVal() and constify some arguments
  along the way.

llvm-svn: 67395

completely there with accurately modeling autorelease pools.

llvm-svn: 67384

llvm-svn: 67260

SVal::GetRValueSymbolVal do the checking if we can symbolicate a type instead of
having BasicStoreManager do it (which wasn't always doing the check
consistently). Having this check in SVal::GetRValueSymbolVal keeps the check in
one centralized place.

llvm-svn: 67245

var region roots.

llvm-svn: 67152

we resolve the semantics of this function when GC is enabled.

llvm-svn: 67116

llvm-svn: 67094

diagnostics. This builds on the patch that Sebastian committed and
then revert. Major differences are:

  - We don't remove or use the current ".def" files. Instead, for now,
    we just make sure that we're building the ".inc" files.
  - Fixed CMake makefiles to run TableGen and build the ".inc" files
    when needed. Tested with both the Xcode and Makefile generators
    provided by CMake, so it should be solid.
  - Fixed normal makefiles to handle out-of-source builds that involve
    the ".inc" files.

I'll send a separate patch to the list with Sebastian's changes that
eliminate the use of the .def files.

llvm-svn: 67058

to return an owning pointer.

llvm-svn: 66934

conditions. Currently the analyzer does not reason well about
promotions/truncations of symbolic values, so at branch conditions when we see:

  if (condition)
  
and condition is something like a 'short' or 'char', essentially ignore the
promotion to 'int' so that we track constraints on the original symbolic value.
We only ignore the casts if the underlying type has the same or fewer bits as
the converted type.

This fixes:

<rdar://problem/6619921>

llvm-svn: 66899

llvm-svn: 66894

is 64-bit. I used his suggestion of doing a direct bitwidth/signedness
conversion of the 'offset' instead of just changing the sign. For more
information, see:

http://lists.cs.uiuc.edu/pipermail/cfe-dev/2009-March/004587.html

llvm-svn: 66892

ExplodedGraph::TrimGraph:
- Just do a DFS both ways instead of BFS-DFS. We're just determining what subset
  of the nodes are reachable from the root and reverse-reachable from the bug
  nodes.  DFS is more efficient for this task.
  
BugReporter:
- MakeReportGraph: Do a reverse-BFS instead of a reverse-DFS to determine the
  approximate shortest path through the simulation graph. We were seeing some
  weird cases where too many loops were being reported for simple bugs. Possibly
  we will need to replace this with actually computing the shortest path in
  terms of line numbers.

llvm-svn: 66842

- PathDiagnosticControlFlowPiece now consists of a "start" and "end" location
  to indicating the branch location and where the branch goes.

BugReporter:
- Updated BugReporter to construct PathDiagnosticControlFlowPiece objects with
  "end" locations.

PlistDiagnostics:
- Plists now contain the bug "type" (not just bug "category")
- Plists now encode control-flow pieces differently than events; now the
  "start" and "end" locations are recorded

llvm-svn: 66818

llvm-svn: 66782

llvm-svn: 66768

llvm-svn: 66739

TypedViewRegion has a valid rvalue type. Also renamed instance variable 'T' to
'LvalueType' to make it unambiguous of its purpose.

This fixes some crashes I was seeing after:

http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20090309/013771.html

This is because 'isBoundable()' is defined in TypedRegion (the parent class) in
terms of the rvalue type (which could be null), while for TypedViewRegion it
should be defined in terms of the lvalue type.

llvm-svn: 66712

llvm-svn: 66654

llvm-svn: 66649

offset may be different that the base. Ultimately we need a better solution for
these issues, but this point-by-point fixes are gradually outlining the scope of
the problem.

llvm-svn: 66638

llvm-svn: 66636

return an unsigned integer for a null pointer value.

llvm-svn: 66630

llvm-svn: 66629

values. Indicating this in 'canReasonAbout' allows GRExprEngine to recover
path-sensitivity in some cases.

llvm-svn: 66628

path-sensitivity, beyond checking to see if the value is "unknown" also check if
the ConstraintManager can handle the SVal. This allows us to recover some
path-sensitivity by actually discarding some information.

llvm-svn: 66627

a ConstraintManager can usefully reason about the given SVal.

llvm-svn: 66624

llvm-svn: 66622

llvm-svn: 66555

- Group control flow and event PathDiagnosticPieces into PathDiagnosticMacroPieces.
- Afterwards, eliminate any PathDiagnosticMacroPieces from a PathDiagnostic that
  contain no informative events.

HTMLDiagnostics:
- Use new information about PathDiagnosticMacroPieces to specially format
  message bubbles for macro expansions containing interesting events.

llvm-svn: 66524

llvm-svn: 66487

llvm-svn: 66486

SymbolicRegions. This fixes a serious regression when checking symbolic pointers
against null.

llvm-svn: 66444

llvm-svn: 66437

llvm-svn: 66419

llvm-svn: 66418