llvm-svn: 61039

- Overhauled the notion of "types" for TypedRegions.  We now distinguish between the "lvalue" of a region (via getLValueRegion()) and the "rvalue" of a region (va getRValueRegion()).  Since a region represents a chunk of memory it has both, but we were conflating these concepts in some cases, leading to some insidious bugs.
- Removed AnonPointeeType, partially because it is unused and because it doesn't have a clear notion of lvalue vs rvalue type.  We can add it back once there is a need for it and we can resolve its role with these concepts.

StoreManager:
- Overhauled StoreManager::CastRegion.  It expects an *lvalue* type for a region.  This is actually what motivated the overhaul to the MemRegion type mechanism.  It also no longer returns an SVal; we can just return a MemRegion*.
- BasicStoreManager::CastRegion now overlays an "AnonTypedRegion" for pointer-pointer casts.  This matches with the MemRegion changes.
- Similar changes to RegionStore, except I've added a bunch of FIXMEs where it wasn't 100% clear where we should use TypedRegion::getRValueRegion() or TypedRegion::getLValueRegion().

AuditCFNumberCreate check:
- Now blasts through AnonTypedRegions that may layer the original memory region, thus checking if the actually memory block is of the appropriate type.  This change was needed to work with the changes to StoreManager::CastRegion.

GRExprEngine::VisitCast:
- Conform to the new interface of StoreManager::CastRegion.

Tests:
- None of the analysis tests fail now for using the "basic store".
- Disabled the tests 'array-struct.c' and 'rdar-6442306-1.m' pending further testing and bug fixing.

llvm-svn: 60995

GRExprEngine (VisitCast):
- When using StoreManager::CastRegion, always use the state and value it returns to generate the next node.  Failure to do so means that region values returned that don't require the state to be modified will get ignored.

MemRegion:
- Tighten the interface for ElementRegion.  Now ElementRegion can only be created with a super region that is a 'TypedRegion' instead of any MemRegion.  Code in BasicStoreManager/RegionStoreManager already assumed this, but it would result in a dynamic assertion check (and crash) rather than just having the compiler forbid the construction of such regions.
- Added ElementRegion::getArrayRegion() to return the 'typed version' of an ElementRegion's super region.
- Removed bogus assertion in ElementRegion::getType() that assumed that the super region was an AnonTypedRegion.  All that matters is that it is a TypedRegion, which is now true all the time by design.

BasicStore:
- Modified getLValueElement() to check if the 'array' region is a TypedRegion before creating an ElementRegion.  This conforms to the updated interface for ElementRegion.

RegionStore:
- In ArrayToPointer() gracefully handle things we don't reason about, and only create an ElementRegion if the array region is indeed a TypedRegion.

llvm-svn: 60990

In GRExprEngine treat @throw as an 'abort' that ends the current path.  This is a temporary solution.

llvm-svn: 60789

llvm-svn: 60734

llvm-svn: 60726

llvm-svn: 60622

Rename SymbolID to SymbolRef.  This is a precursor to some overhauling of the representation of symbolic values.

llvm-svn: 60575

This fixes PR3127
http://llvm.org/bugs/show_bug.cgi?id=3127

llvm-svn: 60280

llvm-svn: 60206

 - Creator function pointers are saved in ManagerRegistry.
 - The Register* class is used to notify ManagerRegistry new module is 
   available.
 - AnalysisManager queries ManagerRegistry for configurable module. Then it
   passes them to GRExprEngine, in turn to GRStateManager.

llvm-svn: 60143

llvm-svn: 59973

One design problem that is emerging is the signed-ness problem during static
analysis. Many unsigned value have to be converted into signed value because
it partipates in operations with signed values. 

On the other hand, we cannot blindly make all values occuring in static analysis
signed, because we do have cases where unsignedness is required, for example,
integer overflow detection.

llvm-svn: 59957

llvm-svn: 59951

llvm-svn: 59903

ConcreteInt index for now.

llvm-svn: 59869

- Add check for returning an undefined value to a caller.

llvm-svn: 59764

environment.

llvm-svn: 59407

 - RegionView and RegionViewMap is introduced to assist back-mapping from
   super region to subregions.
 - GDM is used to carry RegionView information.
 - AnonTypedRegion is added to represent a typed region introduced by pointer
   casting. Later AnonTypedRegion can be used in other similar cases, e.g.,
   malloc()'ed region.
 - The specific conversion is delegated to store manager.

llvm-svn: 59382

llvm-svn: 59354

Reverted part of r59335: http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20081110/009243.html
In that patch I added a bogus type promotion for unary '!'.

The real bug was more fallout from edges cases with compound assignments and conjured symbolic values.  Now the conjured value has the type of the LHS expression, and we do a promotion to the computation type.  We also now correctly do a conversion from the computation type back to the LHS type.

llvm-svn: 59349

llvm-svn: 59348

llvm-svn: 59343

Implement FIXME in GRExprEngine::VisitUnaryOperator() to handle implicit conversions caused by the '!' operator.  This required adding some logic to GRSimpleVals to reason about nonloc::LocAsInteger SVals.  This code appears to work fine, but it should eventually be cleaned up.

llvm-svn: 59335

Second attempt at implementation transfer function support for ObjCForCollectionStmt.  We now assume that the 'element' expression can be any lvalue.

llvm-svn: 59313

function call created in response to the use of operator syntax that
resolves to an overloaded operator in C++, e.g., "str1 +
str2" that resolves to std::operator+(str1, str2)". We now build a
CXXOperatorCallExpr in C++ when we pick an overloaded operator. (But
only for binary operators, where we actually implement overloading)

I decided *not* to refactor the current CallExpr to make it abstract
(with FunctionCallExpr and CXXOperatorCallExpr as derived
classes). Doing so would allow us to make CXXOperatorCallExpr a little
bit smaller, at the cost of making the argument and callee accessors
virtual. We won't know if this is going to be a win until we can parse
lots of C++ code to determine how much memory we'll save by making
this change vs. the performance penalty due to the extra virtual
calls.

llvm-svn: 59306

llvm-svn: 59294

- Temporarily disabled test Analysis/array-struct.c for region store.

llvm-svn: 59245

This is required by some operations, e.g., *p = 1; p[0] = 1;.
Also set the AllocaRegion's type during the cast.

llvm-svn: 59232

GRExprEngine/CFRefCount/GRSimpleVals: We don't do any special handling (yet) of vector types.  Add explicit checks that when we process integers that they really are scalars.

llvm-svn: 59225

- Don't crash on vector types.
- Handle typedefs.

llvm-svn: 59220

llvm-svn: 59162

Add (preliminary) transfer function support for ObjCForCollectionStmt.  Still need to flesh out some logic.

When processing DeclStmt, use the new interface to StateManager::BindDecl.  Conjuring of symbols is now done in VisitDeclStmt.

llvm-svn: 59155

Introduce a single AST node SizeOfAlignOfExpr for all sizeof and alignof expressions, both of values and types.

llvm-svn: 59057

llvm-svn: 58956

llvm-svn: 58886

available, things get much simplified.

One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue
context.

llvm-svn: 58837

llvm-svn: 58552

Comment out invalid assertion.  I'm leaving it in the code for now as a reminder to produce a test case.

llvm-svn: 58510

llvm-svn: 58495