[static analyzer] Don't flag nil storage into NSMutableDictionary.

This is now allowed and has the behavior of removing the mapping.

llvm-svn: 252679

[analyzer] Add generateErrorNode() APIs to CheckerContext.

The analyzer trims unnecessary nodes from the exploded graph before reporting
path diagnostics. However, in some cases it can trim all node

[analyzer] Add generateErrorNode() APIs to CheckerContext.

The analyzer trims unnecessary nodes from the exploded graph before reporting
path diagnostics. However, in some cases it can trim all nodes (including the
error node), leading to an assertion failure (see
https://llvm.org/bugs/show_bug.cgi?id=24184).

This commit addresses the issue by adding two new APIs to CheckerContext to
explicitly create error nodes. Unless the client provides a custom tag, these
APIs tag the node with the checker's tag -- preventing it from being trimmed.
The generateErrorNode() method creates a sink error node, while
generateNonFatalErrorNode() creates an error node for a path that should
continue being explored.

The intent is that one of these two methods should be used whenever a checker
creates an error node.

This commit updates the checkers to use these APIs. These APIs
(unlike addTransition() and generateSink()) do not take an explicit Pred node.
This is because there are not any error nodes in the checkers that were created
with an explicit different than the default (the CheckerContext's Pred node).

It also changes generateSink() to require state and pred nodes (previously
these were optional) to reduce confusion.

Additionally, there were several cases where checkers did check whether a
generated node could be null; we now explicitly check for null in these places.

This commit also includes a test case written by Ying Yi as part of
http://reviews.llvm.org/D12163 (that patch originally addressed this issue but
was reverted because it introduced false positive regressions).

Differential Revision: http://reviews.llvm.org/D12780

llvm-svn: 247859

show more ...

[analyzer] Apply whitespace cleanups by Honggyu Kim.

llvm-svn: 246978

Clarify pointer ownership semantics by hoisting the std::unique_ptr creation to the caller instead of hiding it in emitReport. NFC.

llvm-svn: 240400

Revert r240270 ("Fixed/added namespace ending comments using clang-tidy").

llvm-svn: 240353

Fixed/added namespace ending comments using clang-tidy. NFC

The patch is generated using this command:

$ tools/extra/clang-tidy/tool/run-clang-tidy.py -fix \
-checks=-*,llvm-namespace-comme

Fixed/added namespace ending comments using clang-tidy. NFC

The patch is generated using this command:

$ tools/extra/clang-tidy/tool/run-clang-tidy.py -fix \
-checks=-*,llvm-namespace-comment -header-filter='llvm/.*|clang/.*' \
work/llvm/tools/clang

To reduce churn, not touching namespaces spanning less than 10 lines.

llvm-svn: 240270

show more ...

[analyzer] Check for NULL passed to CFAutorelease.

Patch by Sean McBride, tests adjusted by me.

llvm-svn: 211453

[C++11] Use 'nullptr'. StaticAnalyzer edition.

llvm-svn: 209642

[analyzer] When checking Foundation method calls, match the selectors exactly.

This also includes some infrastructure to make it easier to build multi-argument
selectors, rather than trying to use s

[analyzer] When checking Foundation method calls, match the selectors exactly.

This also includes some infrastructure to make it easier to build multi-argument
selectors, rather than trying to use string matching on each piece. There's a bit
more setup code, but less cost at runtime.

PR18908

llvm-svn: 205827

show more ...

Replace OwningPtr with std::unique_ptr.

This compiles cleanly with lldb/lld/clang-tools-extra/llvm.

llvm-svn: 203279

[C++11] Replace llvm::tie with std::tie.

llvm-svn: 202639

Expose the name of the checker producing each diagnostic message.

Summary:
In clang-tidy we'd like to know the name of the checker producing each
diagnostic message. PathDiagnostic has BugType and C

Expose the name of the checker producing each diagnostic message.

Summary:
In clang-tidy we'd like to know the name of the checker producing each
diagnostic message. PathDiagnostic has BugType and Category fields, which are
both arbitrary human-readable strings, but we need to know the exact name of the
checker in the form that can be used in the CheckersControlList option to
enable/disable the specific checker.

This patch adds the CheckName field to the CheckerBase class, and sets it in
the CheckerManager::registerChecker() method, which gets them from the
CheckerRegistry.

Checkers that implement multiple checks have to store the names of each check
in the respective registerXXXChecker method.

Reviewers: jordan_rose, krememek

Reviewed By: jordan_rose

CC: cfe-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2557

llvm-svn: 201186

show more ...

[analyzer] Objective-C object literals are always non-nil.

<rdar://problem/15999214>

llvm-svn: 201007

Fixed a FIXME; created a print method for Selectors that accepts a raw_ostream, and started using it in places it made sense.

No functional changes intended, just API cleanliness.

llvm-svn: 198428

Remove a whole lot of unused variables

There are about 30 removed in this patch, generated by a new FixIt I haven't
got round to submitting yet.

llvm-svn: 195814

Revert 'Tweak ContainerNonEmptyMap with "int" instead of "bool"'.

I've added the missing ImutProfileInfo [sic] specialization for bool,
so this patch on r194235 is no longer needed.

This reverts r1

Revert 'Tweak ContainerNonEmptyMap with "int" instead of "bool"'.

I've added the missing ImutProfileInfo [sic] specialization for bool,
so this patch on r194235 is no longer needed.

This reverts r194244 / 2baea2887dfcf023c8e3560e5d4713c42eed7b6b.

llvm-svn: 194265

show more ...

StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp: Tweak ContainerNonEmptyMap with "int" instead of "bool", to appease building since r194235.

In ADT/ImmutableSet, ImutProfileInfo<bool> cannot b

StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp: Tweak ContainerNonEmptyMap with "int" instead of "bool", to appease building since r194235.

In ADT/ImmutableSet, ImutProfileInfo<bool> cannot be matched to ImutProfileInteger.
I didn't have idea it'd the right way if PROFILE_INTEGER_INFO(bool) could be added there.

llvm-svn: 194244

show more ...

[analyzer] Track whether an ObjC for-in loop had zero iterations.

An Objective-C for-in loop will have zero iterations if the collection is
empty. Previously, we could only detect this case if the p

[analyzer] Track whether an ObjC for-in loop had zero iterations.

An Objective-C for-in loop will have zero iterations if the collection is
empty. Previously, we could only detect this case if the program asked for
the collection's -count /before/ the for-in loop. Now, the analyzer
distinguishes for-in loops that had zero iterations from those with at
least one, and can use this information to constrain the result of calling
-count after the loop.

In order to make this actually useful, teach the checker that methods on
NSArray, NSDictionary, and the other immutable collection classes don't
change the count.

<rdar://problem/14992886>

llvm-svn: 194235

show more ...

[analyzer] Track the count of NSOrderedSet similarly to other fast enumerations.

llvm-svn: 194005

[analyzer] Use output form collections’ count to decide if ObjC for loop should be entered

This fixes false positives by allowing us to know that a loop is always entered if
the collection count met

[analyzer] Use output form collections’ count to decide if ObjC for loop should be entered

This fixes false positives by allowing us to know that a loop is always entered if
the collection count method returns a positive value and vice versa.

Addresses radar://14169391.

llvm-svn: 184618

show more ...

[analyzer] Refactor: address Jordan’s code review of r181738.

(Modifying the checker to record that the values are no longer nil will be done separately.)

llvm-svn: 181744

[analyzer] Warn about nil elements/keys/values in array and dictionary literals.

llvm-svn: 181738

[analyzer] Assume [NSNull null] does not return nil.

llvm-svn: 181616

[analyzer] An ObjC for-in loop runs 0 times if the collection is nil.

In an Objective-C for-in loop "for (id element in collection) {}", the loop
will run 0 times if the collection is nil. This is b

[analyzer] An ObjC for-in loop runs 0 times if the collection is nil.

In an Objective-C for-in loop "for (id element in collection) {}", the loop
will run 0 times if the collection is nil. This is because the for-in loop
is implemented using a protocol method that returns 0 when there are no
elements to iterate, and messages to nil will result in a 0 return value.

At some point we may want to actually model this message send, but for now
we may as well get the nil case correct, and avoid the false positives that
would come with this case.

<rdar://problem/13744632>

llvm-svn: 180639

show more ...

[analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().

Previously, the analyzer used isIntegerType() everywhere, which uses the C
definition of "integer". The C++ predicate with the s

[analyzer] Replace isIntegerType() with isIntegerOrEnumerationType().

Previously, the analyzer used isIntegerType() everywhere, which uses the C
definition of "integer". The C++ predicate with the same behavior is
isIntegerOrUnscopedEnumerationType().

However, the analyzer is /really/ using this to ask if it's some sort of
"integrally representable" type, i.e. it should include C++11 scoped
enumerations as well. hasIntegerRepresentation() sounds like the right
predicate, but that includes vectors, which the analyzer represents by its
elements.

This commit audits all uses of isIntegerType() and replaces them with the
general isIntegerOrEnumerationType(), except in some specific cases where
it makes sense to exclude scoped enumerations, or any enumerations. These
cases now use isIntegerOrUnscopedEnumerationType() and getAs<BuiltinType>()
plus BuiltinType::isInteger().

isIntegerType() is hereby banned in the analyzer - lib/StaticAnalysis and
include/clang/StaticAnalysis. :-)

Fixes real assertion failures. PR15703 / <rdar://problem/12350701>

llvm-svn: 179081

show more ...