Enhance reference-count checker to correctly identify CG "release" functions.  This fixes <rdar://problem/6303488>.

llvm-svn: 57997

Handle [NSAutoreleasePool addObject:] (an alternative way to add objects to the current autorelease pool).

Added initial code for tracking stack of autorelease pools.

llvm-svn: 57908

retain/release checker: Check if a tracked value escapes if we also try binding it to the store and the store doesn't support that binding (i.e., it cannot track it).  This has the nice feature that the checker will automatically get more powerful if we use a more powerful store model.

llvm-svn: 57755

When conjuring symbols to recover path-sensitivity, don't conjure symbols that represent an entire struct.  We need to implement struct temporaries as an actual "region", and then bind symbols to the FieldRegion of those temporaries.

llvm-svn: 57739

- Added new region "SymbolicRegion", which maps symbol values to the region domain.
- Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion)
- Added some utility methods to GRState for fetch svals from the store.
- Fixed regression in CheckNSError (we weren't getting the value bound to the parameter)

llvm-svn: 57717

RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671

This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.

This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042

Use this updated interface when invalidating arguments passed by reference; the type of symbol is of the object passed by reference, not the reference itself.

llvm-svn: 56894

llvm-svn: 56755

llvm-svn: 56735

llvm-svn: 56405

Changed casing of many bug names.  The convention will be to have bug names (mostly) lower cased, and categories use some capitalization.

llvm-svn: 56385

- Change definition of store::Region and store::Binding (once again) to make
  them real classes that just wrap pointers. This makes them more strictly
  typed, and allows specific implementations of Regions/Bindings to just
  subclass them.
- minor renamings to RegionExtent and its subclasses
- added a bunch of doxygen comments

StoreManager: (static analyzer)
- added 'iterBindings', an iteration method for iterating over the bindings of a
  store. It that takes a callback object (acting like a poor man's closure).
- added 'getRVal' version for store::Binding. Will potentially phase the other
  versions of GetRVal in StoreManager out.
- reimplemented 'getBindings' to be non-virtual and to use 'iterBindings'

BasicStoreManager: (static analyzer)
- implemented 'iterBindings' for BasicStoreManager

llvm-svn: 55688

llvm-svn: 55536

Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of
making assumptions about the Store (removed dependence on GRState::vb_iterator).

llvm-svn: 55522

directly, but instead have GRStateManager manage it.

llvm-svn: 54862

- Remove ConstNotEq from GRState/GRStateManager (!= tracking uses GDM instead).
- GRStateManager now can book-keep "contexts" (e.g., factory objects) for uses
  with data elements stored into the GDM.
- Refactor pretty-printing of states to use GRState::Printer objects
  exclusively. This removed a huge amount of pretty-printing logic from
  GRExprEngine.

CFRefCount
- Simplified some API calls based on refinements to the GDM api.

llvm-svn: 54835

of using CheckerState).

Removed CheckerState from GRState.

Added class GRStateRef which wraps GRState* and GRStateManager*. This is handy
for generating new states with a single handle.

Added member template set/get functions to GRStateRef/GRState/GRStateManager for
accessing the Generic Data Map.

llvm-svn: 54788

Updated checker state printer interface to allow transfer functions to return an arbitrary number of GRState::Printers.

llvm-svn: 54762

Rename ValueStateManager -> GRStateManager.

llvm-svn: 54721

llvm-svn: 54699

llvm-svn: 54696

Add variadic addInstMethSummary() and refactored addPanicSummary() to use this method. (code reduction).
Misc. cleanups.

llvm-svn: 54694

 - Drop {Decl.h,DeclObjC.h,IdentifierTable.h} from Expr.h
 - Moved Sema::getCurMethodDecl() out of line (dependent on
   ObjCMethodDecl via dyn_cast).

llvm-svn: 54629

llvm-svn: 54106

This fixes: http://llvm.org/bugs/show_bug.cgi?id=2593

llvm-svn: 53993

Moved registration of basic path-sensitive checks from GRSimpleVals.cpp to GRExprEngineInternalChecks.cpp.

llvm-svn: 53909

llvm-svn: 53763

llvm-svn: 53759

llvm-svn: 53758

llvm-svn: 53745

isRetain() and isRelease() now only returns true if "Retain"/"Release" appears in the suffix of a function's name.

llvm-svn: 53621

llvm-svn: 53617

current store implementation is now encapsulated by BasicStore.

These changes prompted some long due constification of ValueState. Much of the
diffs in this patch include adding "const" qualifiers.

llvm-svn: 53423

llvm-svn: 53334

llvm-svn: 53172

passed-by-reference to a function. This allows us to build up constraints for
their new values and restore some lost path-sensitivity. This addresses a few
false positives since in Adium.

llvm-svn: 53125

Refactored some of the BugReporter interface so that data such as the ASTContext&, PathDiagnosticClient*, can be provided by an external source.
Split BugReporter into BugReporter and GRBugReporter so checkers not based on GRExprEngine can still use the BugReporter mechanism.

llvm-svn: 53048

llvm-svn: 52963

llvm-svn: 52940