Fix crash ElementRegion::getRValueType() when the RvalueType of the ArrayRegion is a typedef and not (directly) a pointer.

llvm-svn: 62909

More hacking on static analyzer diagnostics.  When emitting summary diagnostics the code paths for diagnostics involving paths or single locations are now unified.  This patch also constifies many arguments/methods that are touched by this logic, leading to a nice overall code cleanup.

llvm-svn: 62903

llvm-svn: 62885

Added virtual method DiagnosticClient::IncludeInDiagnosticCounts().  This is used by Diagnostics to determine if a diagnostic sent to a given DiagnosticClient should be included in the count of diagnostics.  The default implementation of this method returns 'true'.

Implemented DiagCollector::IncludeInDiagnosticCounts() to return 'false' so that the batching of diagnostics for use with BugReporter doesn't mess up the count of real diagnostics.

llvm-svn: 62873

llvm-svn: 62847

llvm-svn: 62846

region. Otherwise we would get an extra level of pointer type.

llvm-svn: 62844

For now, return UnknownVal() in RegionStore::getElementsSize() for AnonTypedRegions.  It wasn't really doing the right thing and was crashing on rdar-6442306-1.m.  This fix causes all path-sensitive test cases to pass with RegionStore.

llvm-svn: 62816

Add RegionStore support for the implicit object region that 'self' references.  This causes tests 'ObjCProperties.m' and 'refcnt_naming.m' to now pass with RegionStore.

llvm-svn: 62814

Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781

SymbolReaper::isLive(SymbolRef) now always returns true for SymbolRegionRvalues because these represent the symbolic values for parameters/globals upon entry to the function.  These values are always ;live' because they represent constraints on the context of how the function was called.  This will be useful for both summary generation but is also necessary to get RegionStore's lazy-binding of locations to symbols to work in practice with RemoveDeadBindings.

llvm-svn: 62771

their associated APIs.  We no longer need separate SymbolData objects
for fields, variables, etc.  Instead, we now associated symbols with
the "rvalue" of a MemRegion (i.e., the value stored at that region).
Now we only have two kinds of SymbolData objects: SymbolRegionRValue
and SymbolConjured.

This cleanup also makes the distinction between a SymbolicRegion and a
symbolic value that is a location much clearer.  A SymbolicRegion
represents a chunk of symbolic memory, while a symbolic location is
just a "pointer" with different possible values.  Without any specific
knowledge, a symbolic location resolves (i.e., via a dereference) to a
SymbolicRegion.  In the future, when we do better alias reasoning, a
symbolic location can become an alias for another location, thus
merging the constraints on the referred SymbolicRegion with the other
region.

llvm-svn: 62769

llvm-svn: 62727

Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object called "SymbolReaper".  Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore.

llvm-svn: 62722

Because the RegionStore can reason about values beyond the reasoning power of BasicStore, this patch splits some of the test cases for the retain/release checker to have versions that are handled by RegionStore (more warnings) and BasicStore (less warnings).

llvm-svn: 62667

that every declaration lives inside a DeclContext.

Moved several things that don't have names but were ScopedDecls (and,
therefore, NamedDecls) to inherit from Decl rather than NamedDecl,
including ObjCImplementationDecl and LinkageSpecDecl. Now, we don't
store empty DeclarationNames for these things, nor do we try to insert
them into DeclContext's lookup structure.

The serialization tests are temporarily disabled. We'll re-enable them
once we've sorted out the remaining ownership/serialiazation issues
between DeclContexts and TranslationUnion, DeclGroups, etc.

llvm-svn: 62562

Dead stores checker: Fix <rdar://problem/6506065> by being more selective when say that a store is dead even though the computed value is used in the enclosing expression.

llvm-svn: 62552

Fix analyzer crash found when scanning Wine sources where the analyzer used old logic to determine the value of a switch 'case' label.

llvm-svn: 62395

StringRegion::print: Remove copy/paste code and just call Stmt::printPretty() for the StringLiteral.

llvm-svn: 62340

llvm-svn: 62331

"logical" location, refer to the "instantiation" location.

llvm-svn: 62316

the "physical" location of tokens, refer to the "spelling" location.
This is more concrete and useful, tokens aren't really physical objects!

llvm-svn: 62309

and uninitialized use options.

llvm-svn: 62270

llvm-svn: 62142

 - put the killed region in the kill set.
 - set its default value to unknown.
 - removes all bindings for its subregions.  

llvm-svn: 62138

llvm-svn: 62130

Invert condition on branch (was causing RegionStore::ArrayToPointer to return 'unknown' on most cases.

llvm-svn: 62129

- Refactor a bunch of logic in the retain/release checker, making it more
  condense and easier to read.
- Add support for "Create" methods in the DiskArbitration framework

retain/release tests:
- Rename CFDate.m to retain-release.m, and move test from CFString.c to
  retain-release.m
- Add DiskArbitration framework tests cases.
- Add/refine and few more retain/release GC test cases.

llvm-svn: 62106

Dead stores checker: Don't flag dead stores for self-assignments (common escape hatch for 'unused variable' warnings).

llvm-svn: 62010

llvm-svn: 61924

llvm-svn: 61894

llvm-svn: 61888

recent discussions with Thomas Clement and Ken Ferry concerning the "fundamental
rule" for Cocoa memory management
(http://developer.apple.com/documentation/Cocoa/Conceptual/MemoryMgmt/Tasks/MemoryManagementRules.html).

Here is the revised behavior of the checker concerning tracking retain/release
counts for objects returned from message expressions involving instance methods:

1) Track the returned object if the return type of the message expression is
id<..>, id, or a pointer to *any* object that subclasses NSObject. Such objects
are assumed to have a retain count. Previously the checker only tracked objects
when the receiver of the message expression was part of the standard Cocoa API
(i.e., had class names prefixed with 'NS'). This should significantly expand the
amount of checking performed.

2) Consider the object owned if the selector of the message expression contains
"alloc", "new", or "copy". Previously we also considered "create", but this
doesn't follow from the fundamental rule (discussions with the Cocoa folks
confirms this).

llvm-svn: 61837

Return UnknownVal in RegionStoreManager::getSizeInElements() for unsupported regions.  This silences a warning when compiling Release-Asserts builds.

llvm-svn: 61818

information for declarations that were referenced via a qualified-id,
e.g., N::C::value. We keep track of the location of the start of the
nested-name-specifier. Note that the difference between
QualifiedDeclRefExpr and DeclRefExpr does have an effect on the
semantics of function calls in two ways:
  1) The use of a qualified-id instead of an unqualified-id suppresses
     argument-dependent lookup
  2) If the name refers to a virtual function, the qualified-id
  version will call the function determined statically while the
  unqualified-id version will call the function determined dynamically
  (by looking up the appropriate function in the vtable).

Neither of these features is implemented yet, but we do print out
qualified names for QualifiedDeclRefExprs as part of the AST printing.

llvm-svn: 61789

llvm-svn: 61419

llvm-svn: 61418

llvm-svn: 61409

llvm-svn: 61333

us to measure the effect of this optimization.

llvm-svn: 61319