[llvm-branch-commits] [cfe-tag] r91357 - in /cfe/tags/checker/checker-232: include/clang/Analysis/PathSensitive/Checker.h include/clang/Analysis/PathSensitive/MemRegion.h include/clang/Analysis/PathSensitive/SymbolManager.h lib/Analysis/AnalysisContext.cpp lib/Analysis/GRExprEngine.cpp lib/Analysis/MallocChecker.cpp lib/Analysis/MemRegion.cpp lib/Analysis/SymbolManager.cpp
Ted Kremenek
kremenek at apple.com
Mon Dec 14 15:15:48 PST 2009
Author: kremenek
Date: Mon Dec 14 17:15:47 2009
New Revision: 91357
URL: http://llvm.org/viewvc/llvm-project?rev=91357&view=rev
Log:
Merge in r91216, r91258, r91348.
Modified:
cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/Checker.h
cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/MemRegion.h
cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/SymbolManager.h
cfe/tags/checker/checker-232/lib/Analysis/AnalysisContext.cpp
cfe/tags/checker/checker-232/lib/Analysis/GRExprEngine.cpp
cfe/tags/checker/checker-232/lib/Analysis/MallocChecker.cpp
cfe/tags/checker/checker-232/lib/Analysis/MemRegion.cpp
cfe/tags/checker/checker-232/lib/Analysis/SymbolManager.cpp
Modified: cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/Checker.h
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/Checker.h?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/Checker.h (original)
+++ cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/Checker.h Mon Dec 14 17:15:47 2009
@@ -90,6 +90,10 @@
return Eng.getValueManager();
}
+ SValuator &getSValuator() {
+ return Eng.getSValuator();
+ }
+
ExplodedNode *GenerateNode(bool autoTransition = true) {
assert(statement && "Only transitions with statements currently supported");
ExplodedNode *N = GenerateNodeImpl(statement, getState(), false);
Modified: cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/MemRegion.h
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/MemRegion.h?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/MemRegion.h (original)
+++ cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/MemRegion.h Mon Dec 14 17:15:47 2009
@@ -621,6 +621,8 @@
public:
const VarDecl *getDecl() const { return cast<VarDecl>(D); }
+ const StackFrameContext *getStackFrame() const;
+
QualType getValueType(ASTContext& C) const {
// FIXME: We can cache this if needed.
return C.getCanonicalType(getDecl()->getType());
Modified: cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/SymbolManager.h
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/SymbolManager.h?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/SymbolManager.h (original)
+++ cfe/tags/checker/checker-232/include/clang/Analysis/PathSensitive/SymbolManager.h Mon Dec 14 17:15:47 2009
@@ -33,6 +33,7 @@
class MemRegion;
class TypedRegion;
class VarRegion;
+ class StackFrameContext;
}
namespace clang {
@@ -333,10 +334,13 @@
SetTy TheDead;
LiveVariables& Liveness;
SymbolManager& SymMgr;
+ const StackFrameContext *CurrentStackFrame;
public:
- SymbolReaper(LiveVariables& liveness, SymbolManager& symmgr)
- : Liveness(liveness), SymMgr(symmgr) {}
+ SymbolReaper(LiveVariables& liveness, SymbolManager& symmgr,
+ const StackFrameContext *currentStackFrame)
+ : Liveness(liveness), SymMgr(symmgr), CurrentStackFrame(currentStackFrame)
+ {}
~SymbolReaper() {}
Modified: cfe/tags/checker/checker-232/lib/Analysis/AnalysisContext.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/lib/Analysis/AnalysisContext.cpp?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/lib/Analysis/AnalysisContext.cpp (original)
+++ cfe/tags/checker/checker-232/lib/Analysis/AnalysisContext.cpp Mon Dec 14 17:15:47 2009
@@ -39,7 +39,7 @@
else if (const BlockDecl *BD = dyn_cast<BlockDecl>(D))
return BD->getBody();
- llvm::llvm_unreachable("unknown code decl");
+ llvm_unreachable("unknown code decl");
}
const ImplicitParamDecl *AnalysisContext::getSelfDecl() const {
Modified: cfe/tags/checker/checker-232/lib/Analysis/GRExprEngine.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/lib/Analysis/GRExprEngine.cpp?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/lib/Analysis/GRExprEngine.cpp (original)
+++ cfe/tags/checker/checker-232/lib/Analysis/GRExprEngine.cpp Mon Dec 14 17:15:47 2009
@@ -394,8 +394,9 @@
Builder->setAuditor(BatchAuditor.get());
// Create the cleaned state.
- SymbolReaper SymReaper(Builder->getBasePredecessor()->getLiveVariables(),
- SymMgr);
+ const ExplodedNode *BasePred = Builder->getBasePredecessor();
+ SymbolReaper SymReaper(BasePred->getLiveVariables(), SymMgr,
+ BasePred->getLocationContext()->getCurrentStackFrame());
CleanedState = AMgr.shouldPurgeDead()
? StateMgr.RemoveDeadBindings(EntryNode->getState(), CurrentStmt, SymReaper)
: EntryNode->getState();
@@ -418,7 +419,7 @@
CleanedState, SymReaper);
if (Checkers.empty())
- Tmp = Tmp2;
+ Tmp.insert(Tmp2);
else {
ExplodedNodeSet Tmp3;
ExplodedNodeSet *SrcSet = &Tmp2;
Modified: cfe/tags/checker/checker-232/lib/Analysis/MallocChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/lib/Analysis/MallocChecker.cpp?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/lib/Analysis/MallocChecker.cpp (original)
+++ cfe/tags/checker/checker-232/lib/Analysis/MallocChecker.cpp Mon Dec 14 17:15:47 2009
@@ -52,11 +52,11 @@
class MallocChecker : public CheckerVisitor<MallocChecker> {
BuiltinBug *BT_DoubleFree;
BuiltinBug *BT_Leak;
- IdentifierInfo *II_malloc;
- IdentifierInfo *II_free;
+ IdentifierInfo *II_malloc, *II_free, *II_realloc;
public:
- MallocChecker() : BT_DoubleFree(0), BT_Leak(0), II_malloc(0), II_free(0) {}
+ MallocChecker()
+ : BT_DoubleFree(0), BT_Leak(0), II_malloc(0), II_free(0), II_realloc(0) {}
static void *getTag();
bool EvalCallExpr(CheckerContext &C, const CallExpr *CE);
void EvalDeadSymbols(CheckerContext &C,const Stmt *S,SymbolReaper &SymReaper);
@@ -64,7 +64,13 @@
void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S);
private:
void MallocMem(CheckerContext &C, const CallExpr *CE);
+ const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+ const GRState *state);
void FreeMem(CheckerContext &C, const CallExpr *CE);
+ const GRState *FreeMemAux(CheckerContext &C, const CallExpr *CE,
+ const GRState *state);
+
+ void ReallocMem(CheckerContext &C, const CallExpr *CE);
};
} // end anonymous namespace
@@ -99,6 +105,8 @@
II_malloc = &Ctx.Idents.get("malloc");
if (!II_free)
II_free = &Ctx.Idents.get("free");
+ if (!II_realloc)
+ II_realloc = &Ctx.Idents.get("realloc");
if (FD->getIdentifier() == II_malloc) {
MallocMem(C, CE);
@@ -110,26 +118,44 @@
return true;
}
+ if (FD->getIdentifier() == II_realloc) {
+ ReallocMem(C, CE);
+ return true;
+ }
+
return false;
}
void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
+ const GRState *state = MallocMemAux(C, CE, C.getState());
+ C.addTransition(state);
+}
+
+const GRState *MallocChecker::MallocMemAux(CheckerContext &C,
+ const CallExpr *CE,
+ const GRState *state) {
unsigned Count = C.getNodeBuilder().getCurrentBlockCount();
ValueManager &ValMgr = C.getValueManager();
SVal RetVal = ValMgr.getConjuredSymbolVal(NULL, CE, CE->getType(), Count);
- const GRState *state = C.getState();
state = state->BindExpr(CE, RetVal);
SymbolRef Sym = RetVal.getAsLocSymbol();
assert(Sym);
// Set the symbol's state to Allocated.
- C.addTransition(state->set<RegionState>(Sym, RefState::getAllocated(CE)));
+ return state->set<RegionState>(Sym, RefState::getAllocated(CE));
}
void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
- const GRState *state = C.getState();
+ const GRState *state = FreeMemAux(C, CE, C.getState());
+
+ if (state)
+ C.addTransition(state);
+}
+
+const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
+ const GRState *state) {
SVal ArgVal = state->getSVal(CE->getArg(0));
SymbolRef Sym = ArgVal.getAsLocSymbol();
assert(Sym);
@@ -149,13 +175,59 @@
BT_DoubleFree->getDescription(), N);
C.EmitReport(R);
}
- return;
+ return NULL;
}
// Normal free.
- const GRState *FreedState
- = state->set<RegionState>(Sym, RefState::getReleased(CE));
- C.addTransition(FreedState);
+ return state->set<RegionState>(Sym, RefState::getReleased(CE));
+}
+
+void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
+ const GRState *state = C.getState();
+ const Expr *Arg0 = CE->getArg(0);
+ DefinedOrUnknownSVal Arg0Val=cast<DefinedOrUnknownSVal>(state->getSVal(Arg0));
+
+ ValueManager &ValMgr = C.getValueManager();
+ SValuator &SVator = C.getSValuator();
+
+ DefinedOrUnknownSVal PtrEQ = SVator.EvalEQ(state, Arg0Val, ValMgr.makeNull());
+
+ // If the ptr is NULL, the call is equivalent to malloc(size).
+ if (const GRState *stateEqual = state->Assume(PtrEQ, true)) {
+ // Hack: set the NULL symbolic region to released to suppress false warning.
+ // In the future we should add more states for allocated regions, e.g.,
+ // CheckedNull, CheckedNonNull.
+
+ SymbolRef Sym = Arg0Val.getAsLocSymbol();
+ if (Sym)
+ stateEqual = stateEqual->set<RegionState>(Sym, RefState::getReleased(CE));
+
+ const GRState *stateMalloc = MallocMemAux(C, CE, stateEqual);
+ C.addTransition(stateMalloc);
+ }
+
+ if (const GRState *stateNotEqual = state->Assume(PtrEQ, false)) {
+ const Expr *Arg1 = CE->getArg(1);
+ DefinedOrUnknownSVal Arg1Val =
+ cast<DefinedOrUnknownSVal>(stateNotEqual->getSVal(Arg1));
+ DefinedOrUnknownSVal SizeZero = SVator.EvalEQ(stateNotEqual, Arg1Val,
+ ValMgr.makeIntValWithPtrWidth(0, false));
+
+ if (const GRState *stateSizeZero = stateNotEqual->Assume(SizeZero, true)) {
+ const GRState *stateFree = FreeMemAux(C, CE, stateSizeZero);
+ if (stateFree)
+ C.addTransition(stateFree->BindExpr(CE, UndefinedVal(), true));
+ }
+
+ if (const GRState *stateSizeNotZero=stateNotEqual->Assume(SizeZero,false)) {
+ const GRState *stateFree = FreeMemAux(C, CE, stateSizeNotZero);
+ if (stateFree) {
+ // FIXME: We should copy the content of the original buffer.
+ const GRState *stateRealloc = MallocMemAux(C, CE, stateFree);
+ C.addTransition(stateRealloc);
+ }
+ }
+ }
}
void MallocChecker::EvalDeadSymbols(CheckerContext &C, const Stmt *S,
Modified: cfe/tags/checker/checker-232/lib/Analysis/MemRegion.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/lib/Analysis/MemRegion.cpp?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/lib/Analysis/MemRegion.cpp (original)
+++ cfe/tags/checker/checker-232/lib/Analysis/MemRegion.cpp Mon Dec 14 17:15:47 2009
@@ -165,6 +165,15 @@
} while (1);
}
+const StackFrameContext *VarRegion::getStackFrame() const {
+ const StackSpaceRegion *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
+ return SSR ? SSR->getStackFrame() : NULL;
+}
+
+//===----------------------------------------------------------------------===//
+// FoldingSet profiling.
+//===----------------------------------------------------------------------===//
+
void MemSpaceRegion::Profile(llvm::FoldingSetNodeID& ID) const {
ID.AddInteger((unsigned)getKind());
}
Modified: cfe/tags/checker/checker-232/lib/Analysis/SymbolManager.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/tags/checker/checker-232/lib/Analysis/SymbolManager.cpp?rev=91357&r1=91356&r2=91357&view=diff
==============================================================================
--- cfe/tags/checker/checker-232/lib/Analysis/SymbolManager.cpp (original)
+++ cfe/tags/checker/checker-232/lib/Analysis/SymbolManager.cpp Mon Dec 14 17:15:47 2009
@@ -221,7 +221,8 @@
}
bool SymbolReaper::isLive(const Stmt *Loc, const VarRegion *VR) const {
- return Liveness.isLive(Loc, VR->getDecl());
+ const StackFrameContext *SFC = VR->getStackFrame();
+ return SFC == CurrentStackFrame ? Liveness.isLive(Loc, VR->getDecl()) : true;
}
SymbolVisitor::~SymbolVisitor() {}
More information about the llvm-branch-commits
mailing list