Instead of using operator bool() for testing if a BindingKey is valid, use an explicit isValid() method.

llvm-svn: 111181

llvm-svn: 111179

- Fix memcpy() and friends to actually invalidate the destination buffer.
- Emit a different message for out-of-bounds buffer accesses if the buffer is being written to.
- When conjuring symbols, let ValueManager figure out the type.

llvm-svn: 111120

- Allow making ElementRegions with complex offsets (expressions or symbols) for the purpose of bounds-checking.
- Rewrite GRState::AssumeInBound to actually do that checking, and to use the normal constraint path.
- Remove ConstraintManager::AssumeInBound.
- Teach RegionStore and FlatStore to ignore those regions for now.

llvm-svn: 111116

llvm-svn: 111113

llvm-svn: 111103

llvm-svn: 111099

iterate over symbols being tracked, instead of symbols being dead.

llvm-svn: 111097

llvm-svn: 111091

Update CStringChecker to take advantage of the new metadata symbols and region change callback. Now does basic tracking of string length for general regions. Currently this is still only used for modeling strlen().

llvm-svn: 111081

Add a callback for when region changes occur. Still somewhat of a work-in-progress, but working! Effect on clients: all changes to a store now go through GRState.

llvm-svn: 111078

llvm-svn: 111077

Add a new metadata symbol type for checkers to use. Metadata symbols must be associated with a region and will be collected if the region dies or its checker fails to mark it as in use.

llvm-svn: 111076

llvm-svn: 110996

- Added detection of Empty CFGBlocks (artificial blocks)
- Relaxed an assertion based on an incorrect assumption until further investigation

llvm-svn: 110974

- Unfinished analysis may still report valid warnings if the path was completely analyzed
- New 'CanVary' heuristic to recursively determine if a subexpression has a varying element
- Updated test cases, including one known bug
- Exposed GRCoreEngine through GRExprEngine

llvm-svn: 110970

Remove OwnershipAttr::Kind, since it's essentially redundant with attr::Kind the way it's being used. Also fix isa<OwnershipAttr> support, break more-than-80-char lines, and other miscellaneous ownership attr cleanup.

llvm-svn: 110908

llvm-svn: 110904

llvm-svn: 110784

Have GRCoreEngine record the blocks where analysis was aborted because we visited a block too many times along a given path.  This is to support the unreachable code analysis.

llvm-svn: 110755

llvm-svn: 110592

an lvalue of another, compatible Objective-C object type (e.g., a
subclass). Introduce a new initialization sequence step kind to
describe this binding, along with a new cast kind. Fixes PR7741.

llvm-svn: 110513

Removed IdempotentOperationChecker from default analysis and returned back to a flag (-analyzer-check-idempotent-operations)
- Added IdempotentOperationChecker to experimental analyses for testing purposes
- Updated test cases to explictly call the checker

llvm-svn: 110482

llvm-svn: 110473

Nest variable declaration into into 'if' condition, thus restricting the scope of the variable and condensing the code.

llvm-svn: 110472

Use 'GenerateNode()' instead of 'GenerateSink()' when reporting a leak.  A leak is not a hard enough bug to stop analyzing a path.

llvm-svn: 110471

If all nodes are sunk, bail out early. This make the later check for checkersEvaluated really meaningful.

llvm-svn: 110430

llvm-svn: 110392

When checking if a buffer access is valid, first make sure the buffer has a valid Loc. Fixes PR7830.

llvm-svn: 110390

Fixed logic error in UnreachableCodeChecker's marking algorithm that would sometimes allow for multiple sequential statements to be flagged.

llvm-svn: 110353

llvm-svn: 110330

llvm-svn: 110320

llvm-svn: 110317

Tweak GRState::unbindLoc to use makeWithStore, and make sure it's only called for non-region locations.

llvm-svn: 110310

llvm-svn: 110309

Correctly handle 'Class<...>' when examining Cocoa conventions in the static analyzer.  Fixes a crash reported in <rdar://problem/8272168>.  Patch by Henry Mason!

llvm-svn: 110289

Change the checker callback cache in GRExprEngine to be more compact (and IMHO a little easier to understand), and add the same sort of caching for EvalAssume (tied for least-used callback), mostly as proof-of-concept.

Before we go further with these, we should figure out a way to reuse the visit-and-cache code in CheckerVisit.

llvm-svn: 110191

- Reporting now uses getUnreachableStmt which returns the Stmt* we should report
- Indexing of reachable and visited blocks now use CFGBlock ID's instead of pointers
- The CFG used in the unreachable search is now the unoptimized CFG
- Added 'Dead code' category to warnings
- Removed obsolete function getCondition
- Simplified false positive detection based on properties of FindUnreachableEntryPoints

llvm-svn: 110148

Makes GRState::makeWithStore private, to encourage clients to make store changes through GRState instead of directly accessing the StoreManager. Also adds cover methods for InvalidateRegion(s) and EnterStackFrame to GRState.

This is in preparation for proposed region change notifications. No functionality change.

llvm-svn: 110137

shouldn't put restrictions in store manager.

llvm-svn: 110106