llvm-svn: 107728

Add a new path-sensitive checker for functions in <string.h>, for both null-terminated strings and memory blocks. Currently only checks memcpy(), memmove(), and bcopy(), but this is intended to be expanded soon.

llvm-svn: 107722

llvm-svn: 107709

Added a path-sensitive idempotent operation checker (-analyzer-idempotent-operation). Finds idempotent and/or tautological operations in a path sensitive context, flagging operations that have no effect or a predictable effect.

Example:
{
int a = 1;
int b = 5;
int c = b / a; // a is 1 on all paths
}

- New IdempotentOperationChecker class
- Moved recursive Stmt functions in r107675 to IdempotentOperationChecker
- Minor refactoring of SVal to allow checking for any integer
- Added command line option for check
- Added basic test cases

llvm-svn: 107706

llvm-svn: 107645

Remove the now-unused GRState::isEqual method. Instead of asking if an expression equals a certain value, use SValuator::EvalEQ and GRState::Assume to see if it can, must, or must not equal that value.

llvm-svn: 107638

Improve NULL-checking for CFRetain/CFRelease. We now remember that the argument was non-NULL, and we report where the null assumption came from (like AttrNonNullChecker already did).

llvm-svn: 107633

Support sizeof for VLA expressions (sizeof(someVLA)). sizeof(int[n]) still unimplemented. A VLA region's sizeof value matches its extent.

llvm-svn: 107611

llvm-svn: 107603

Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.

Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577

Fix PR 7475 by enhancing the static analyzer to also invalidate bindings for non-static global variables
when calling a function/method whose impact on global variables we cannot accurately estimate.
This change introduces two new MemSpaceRegions that divide up the memory space of globals, and causes
RegionStore and BasicStore to consult a binding to the NonStaticGlobalsMemSpaceRegion when lazily
determining the value of a global.

llvm-svn: 107423

Add an ivar to SymbolReaper for the current statement, and then stop passing the current statement around everywhere. Preparation for symbolic extents.

llvm-svn: 107422

llvm-svn: 107388

Correctly implement the CheckerVisit optimization introduced in r106884, but this time actually used the cached checker list when calling back to Checker visit methods.  This reduces the analysis time for sqlite3.c by 8%.

llvm-svn: 107259

Pointers casted as integers still count as locations to SimpleSValuator, so don't crash if we do a funny thing like ((int)ptr)&1. Fixes PR7527.

llvm-svn: 107236

be true if some paths were aborted because they exceeded
the maximum loop unrolling count.

llvm-svn: 107209

llvm-svn: 107012

Pointer comparisons (and pointer-pointer subtraction). Basically filling in SimpleSValuator::EvalBinOpLL().

llvm-svn: 106992

Implicitly compare symbolic expressions to zero when they're being used as constraints. Part of PR7491.

llvm-svn: 106972

llvm-svn: 106964

llvm-svn: 106919

llvm-svn: 106911

a winowed list of checkers that actually do something for a given StmtClass.
As the number of checkers grows, this may potentially significantly reduce
the number of checkers called at any one time.  My own measurements show that
for the ~20 registered Checker objects, only ~5 of them respond at any one time
to a give statement.  While this isn't a net performance win right now (there
is a minor slowdown on sqlite.3) this improvement does greatly improve debugging
when stepping through the checkers used to evaluate a given statement.

llvm-svn: 106884

llvm-svn: 106883

Change RegionStoreManager::Retrieve to infer the type of a symbolic region from the context when it is not already available.

llvm-svn: 106868

llvm-svn: 106755

llvm-svn: 106742

llvm-svn: 106741

llvm-svn: 106738

when the worklist algorithm has terminated.  This allows some checkers to do a post-analysis
phase after all paths have been analyzed.

llvm-svn: 106689

llvm-svn: 106617

llvm-svn: 106616

crash reported in PR 7450.

llvm-svn: 106609

types, updating callers of both isFloatingType() and
isRealFloatingType() accordingly. Caught at least one issue where we
allowed one to declare a vector of vectors (!), along with cleaning up
the standard-conversion logic for C++.

llvm-svn: 106595

Instead, halt the analysis of the current path, which is what we do in GRExprEngine::ProcessStmt
for all other C++ constructs not currently handled by the analyzer.

llvm-svn: 106561

llvm-svn: 106530

When folding additive operations, convert the values to the same type. When assuming relationships, convert the integers to the same type as the symbol, at least for now.

llvm-svn: 106458

llvm-svn: 106456

llvm-svn: 106403

Adds analyzer support for idempotent and tautological binary operations such as "a*0" and "a+0". This is not very powerful, but does make the analyzer look a little smarter than it actually is.

llvm-svn: 106402