llvm-svn: 57724

Fixed an elusive caching bug in ExplodedGraph construction when a PostStmtKind was used instead of a PostStoreKind.

llvm-svn: 57719

- Added new region "SymbolicRegion", which maps symbol values to the region domain.
- Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion)
- Added some utility methods to GRState for fetch svals from the store.
- Fixed regression in CheckNSError (we weren't getting the value bound to the parameter)

llvm-svn: 57717

"Implement" GRExprEngine::VisitLValue for ObjCPropertyRefExpr.  This is only a bandid; we need to properly handle properties by using locv/nonloc objects and specially handling property assignments in the transfer function for BinaryOperator.

llvm-svn: 57693

RVal => SVal
LVal => Loc
NonLVal => NonLoc
lval => loc
nonlval => nonloc

llvm-svn: 57671

llvm-svn: 57666

type T.

llvm-svn: 57665

struct s {};
void f() {
  int a[10];
  int (*p)[10];
  p = &a;
  (*p)[3] =1;

  struct s d;
  struct s *q;
  q = &d;
}

We return the corresponding MemRegionVal for them.

llvm-svn: 57664

llvm-svn: 57659

Remove GRExprEngine::getLVal and RValues::MakeVal.
Enhance StoreManager "GetLValue" methods to dispatch for specific kinds of lvalue queries, as opposed to interogating the expression tree (GRExprEngine already does this).

Added FIXMEs.  In particular, we no longer "assume" that a base pointer in a field/array access is null (this logic was removed).  Perhaps we should do this when fetching the lvalue for fields and array elements?

llvm-svn: 57657

llvm-svn: 57654

new VisitLValue method is added to replace the old VisitLVal. The semantics
model becomes more explicit to separate rvalue evaluation from lvalue
evaluation.  

llvm-svn: 57627

Enhance dead store checker to not flag preincrements to dead variables where the preincrement is a subexpression, e.g. foo(++x);  This can cause false negatives, but will remove a whole class of false positives.

llvm-svn: 57554

llvm-svn: 57317

This is the first step to implement a field-sensitive store model. Other things are simplified: no heap shape assumption, no parameter alias assumption, etc.

llvm-svn: 57285

llvm-svn: 57240

llvm-svn: 57225

Don't use DeclStmt::getDecl(); this will eventually disappear.  Just fetch the first decl using the DeclStmt::decl_iterator.

llvm-svn: 57194

Use DeclStmt::decl_iterator instead of using Decl::getDecl().  Soon DeclStmts will wrap group of Decls.
Added FIXME.

llvm-svn: 57189

llvm-svn: 57146

llvm-svn: 57107

This is a big patch, but the functionality change is small and the rest of the patch consists of deltas due to API changes.

This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h.  This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses.  This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on.  

The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls.  In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal.  Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables.

There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized.

The memory region abstraction also allows type-information to literally be affixed to a memory region.  This will allow the some now redundant logic to be removed from the retain/release checker.

llvm-svn: 57042

Expand checking to include functions, not just methods.

llvm-svn: 56938

llvm-svn: 56912

Use this updated interface when invalidating arguments passed by reference; the type of symbol is of the object passed by reference, not the reference itself.

llvm-svn: 56894

llvm-svn: 56832

from the subexpression type to the expression type.

llvm-svn: 56831

llvm-svn: 56755

llvm-svn: 56735

Move VLA processing logic from LiveVariables to CFG construction.  This way all dataflow analyses "see" the VLA size expressions.

llvm-svn: 56655

Fixes <rdar://problem/6248086>

llvm-svn: 56645

llvm-svn: 56405

llvm-svn: 56403

llvm-svn: 56402

llvm-svn: 56401

llvm-svn: 56394

Changed casing of many bug names.  The convention will be to have bug names (mostly) lower cased, and categories use some capitalization.

llvm-svn: 56385

GRExprEngine:
  Use PostStore in EvalStore.
  Use a second version of EvalStore in EvalBinaryOperator to associate the store with the expression on the LHS.

llvm-svn: 56383

Bug fix: for the base transfer function logic for casts, handle const casts as just propagating the value.

llvm-svn: 56368

For checking if a symbol >= value, we need to check if symbol == value || symbol
> value. When checking symbol > value and we know that symbol != value, the path
is infeasible only if value == maximum integer.

For checking if a symbol <= value, we need to check if symbol == value || symbol
< value. When checking symbol < value and we know that symbol != value, the path
is infeasible only if value == minimum integer.

Updated test case exercising this logic: we only prune paths if the values are
unsigned.

llvm-svn: 56354