[analyzer] Migrate assumption and binding handling from CFRefCount to RetainReleaseChecker. This is mostly a textual move and required no supporting changes. No functionality change intended.

llvm-svn: 137874

Fix a handful of dead stores found by Clang's static analyzer.  There's a bunch of others I haven't touched.

llvm-svn: 137867

llvm-svn: 137814

llvm-svn: 137813

This is ugly but ISO C++ doesn't allow direct casts.

llvm-svn: 137812

llvm-svn: 137802

[analyzer] teach ExprEngine about loads from static C++ class fields.  Fixes <rdar://problem/9948787>.

llvm-svn: 137760

[analyzer] Overhaul of checker registration in preparation for basic plugin support. Removes support for checker groups (we can add them back in later if we decide they are still useful), and -analyzer-checker-help output is a little worse for the time being (no packages).

llvm-svn: 137758

llvm-svn: 137740

llvm-svn: 137720

[analyzer] Enhance ConditionVisitor to handle arbitrary ValueDecls in binary expressions, and also handle inverting the order of comparison when the named decl appears on the RHS.

llvm-svn: 137714

llvm-svn: 137708

[analyzer] Enhance ConditionVisitor to understand eagerly evaluated (simple) binary conditions, and teach it to only focus on constraint changes.

llvm-svn: 137705

[analyzer] add ExprEngine::getEagerlyAssumedTags() to allow externally querying of "eagerly assumed" expressions.

llvm-svn: 137704

llvm-svn: 137697

MacOSKeychainAPIChecker: The security API/memory leak checker should always generate regular nodes instead of sink nodes.

llvm-svn: 137681

llvm-svn: 137677

llvm-svn: 137665

MacOSKeychainAPIChecker: Use llvm::SmallString instead of std::string (as per code review for r137523).

llvm-svn: 137633

Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*].  It was highly inconsistent, and very ugly to look at.

llvm-svn: 137537

Having a notion of an actual ProgramPointTag will aid in introspection of the analyzer's behavior.
For example, the GraphViz output of the analyzer will pretty-print the tags in a useful manner.

llvm-svn: 137529

MacOSKeychainAPIChecker: If the allocated data address entered as an enclosing function parameter, skip it to avoid false positives.

llvm-svn: 137526

Report errors earlier: on checkDeadSymbols() and clear the state after the symbol we are tracking goes out of scope. 

Also, perform lazy error checking. Instead of forcing the paths to be split depending one the return value of the allocator, make the return symbol depend on the allocated data symbol, which prolongs its life span to the time when the allocated data symbol becomes dead.

llvm-svn: 137523

time. One is cleanup, the other is me being OCD about enum group nesting.

llvm-svn: 137517

MacOSKeychainAPIChecker: There is no need to use SymbolMetadata to represent the allocated data symbol, we can just use the symbol corresponding to the SymbolicRegion. This simplifies tracking of the symbol, for example, SymbolMetadata needs to go through extra hoops to stay alive.

Make AllocationState internal to the MacOSKeychainAPIChecker class.

llvm-svn: 137514

[analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can separate TypedRegions that implement getValueType() from those that don't.

Patch by Olaf Krzikalla!

llvm-svn: 137498

1) Change SymbolDependTy map to keep pointers as data. And other small tweaks like making the DenseMap smaller 64->16 elements; remove removeSymbolDependencies() as it will probably not be used.

2) Do not mark dependents live more then once.

llvm-svn: 137401

Analyzer Core: Adding support for user-defined symbol dependencies. (For example, the allocated resource symbol only needs to be freed if no error has been returned by the allocator, so a checker might want to make the lifespan of the error code symbol depend on the allocated resource symbol.) Note, by default, the map that holds the dependencies will get destroyed along with the SymbolManager at the end of function exploration.

llvm-svn: 137309

Cleanup: remove CleanedSate member and GetState() wrapper from StmtNodeBuilder, not needed as of r137273.

llvm-svn: 137284

llvm-svn: 137279

Analyzer Core: In checkDeadSymbols checker callback, provide the state in which the symbols are not yet deleted so that checkers could inspect them. Since we are now always creating a transition in ProcessStmt(), remove the logic for adding a transition when none was generated. TODO: the extra transitions will have to be removed; more cleanups; a checker that tests teh new fucntionality.

llvm-svn: 137273

[analyzer] Start sketching out a new BugReporterVisitor that inspects branches and other expressions to generate interesting path events in diagnostics.

llvm-svn: 137012

[analyzer] Simplify logic for ExprEngine::VisitUnaryExprOrTypeTraitExpr to avoid recursion to subexpression.

This exposed bugs in the live variables analysis, and a latent analyzer bug in the SymbolReaper.

llvm-svn: 137006

[analyzer] Change SymbolReaper to store region roots implied by the Environment, allowing it be queried when
determining if symbols derived from regions are still live.

llvm-svn: 137005

KeychainAPI checker: Track SymbolMetadata instead of MemRegion in checker state so that we could clear the state on evalDeadSymbols; also track the return value.

llvm-svn: 137003

KeychainAPI checker: Generate an error on double allocation. Pull out getAsPointeeMemoryRegion so that it could be reused.

llvm-svn: 136952

KeychainAPI checker: Track additional pair of SecKeychain APIs. Also, keep exploring the transition on which a call to allocator function failed (to be able to find errors in examples like ErrorCodesFromDifferentAPISDoNotInterfere).

llvm-svn: 136930

KeychainAPI checker: Refactor to make it easier to add more allocator/deallocator API pairs. Add the allocator function ID to the checker state. Better comments.

llvm-svn: 136889

llvm-svn: 136852

KeychainAPI checker: Add basic diagnostics. Track MemoryRegion istead of SymbolicRef since the address might not be a symbolic value in some cases, for example in fooOnlyFree() test.

llvm-svn: 136851