commit 9dca062461a6244cf0f733346657fa3eee853f9b
author Ted Kremenek <kremenek@apple.com> Tue Feb 19 00:22:37 2008 +0000
committer Ted Kremenek <kremenek@apple.com> Tue Feb 19 00:22:37 2008 +0000
tree f50eed32bef850bf51fe8d46e95489dbfc428785
parent 95050fa665c51a29249725101a476de685f43a11

--grsimple now reports the number of nodes in the ExplodedGraph for
an analyzed function.

GRExprEngine now records stores to "uninitialized lvalues" (which are sinks in
the ExplodedGraph).


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@47293 91177308-0d34-0410-b5e6-96231b3b80d8

Analysis/GRExprEngine.cpp

diff --git a/Analysis/GRExprEngine.cpp b/Analysis/GRExprEngine.cpp
index d709eff..a004dc4 100644
--- a/Analysis/GRExprEngine.cpp
+++ b/Analysis/GRExprEngine.cpp
@@ -304,15 +304,14 @@
 
   RValue R1 = GetValue(PrevState, B->getLHS());
   RValue R2 = GetValue(PrevState, B->getRHS(), hasR2);
-    
-  if (isa<UnknownVal>(R1) && 
-       (isa<UnknownVal>(R2) ||
-        isa<UninitializedVal>(R2))) {    
-
-    Nodify(Dst, B, Pred, SetValue(PrevState, B, R2));
-    return;
-  }    
-  else if (isa<UninitializedVal>(R1)) {
+  
+  if (hasR2) {
+    if (isa<UninitializedVal>(R2) || isa<UnknownVal>(R2)) {
+      Nodify(Dst, B, Pred, SetValue(PrevState, B, R2));
+      return;
+    }
+  }
+  else if (isa<UninitializedVal>(R1) || isa<UnknownVal>(R1)) {
     Nodify(Dst, B, Pred, SetValue(PrevState, B, R1));
     return;
   }
@@ -709,7 +708,12 @@
       switch (Op) {
         case BinaryOperator::Assign: {
           const LValue& L1 = cast<LValue>(V1);
-          Nodify(Dst, B, N2, SetValue(SetValue(St, B, V2), L1, V2));
+
+          if (isa<UninitializedVal>(L1))
+            HandleUninitializedStore(B, N2);
+          else          
+            Nodify(Dst, B, N2, SetValue(SetValue(St, B, V2), L1, V2));
+
           break;
         }
 
@@ -718,6 +722,12 @@
           assert (B->isCompoundAssignmentOp());
                           
           const LValue& L1 = cast<LValue>(V1);
+          
+          if (isa<UninitializedVal>(L1)) {
+            HandleUninitializedStore(B, N2);
+            break;
+          }
+          
           RValue Result = cast<NonLValue>(UnknownVal());
           
           if (Op >= BinaryOperator::AndAssign)
@@ -763,9 +773,14 @@
   }
 }
 
+void GRExprEngine::HandleUninitializedStore(Stmt* S, NodeTy* Pred) {
+  
+  NodeTy* N = Builder->generateNode(S, Pred->getState(), Pred);
+  N->markAsSink();
+  UninitStores.insert(N);
+}
 
-void GRExprEngine::Visit(Stmt* S, GRExprEngine::NodeTy* Pred,
-                        GRExprEngine::NodeSet& Dst) {
+void GRExprEngine::Visit(Stmt* S, NodeTy* Pred, NodeSet& Dst) {
 
   // FIXME: add metadata to the CFG so that we can disable
   //  this check when we KNOW that there is no block-level subexpression.
@@ -1137,7 +1152,9 @@
   static std::string getNodeAttributes(const GRExprEngine::NodeTy* N, void*) {
     
     if (GraphPrintCheckerState->isImplicitNullDeref(N) ||
-        GraphPrintCheckerState->isExplicitNullDeref(N))
+        GraphPrintCheckerState->isExplicitNullDeref(N) ||
+        GraphPrintCheckerState->isUninitStore(N) ||
+        GraphPrintCheckerState->isUninitControlFlow(N))
       return "color=\"red\",style=\"filled\"";
     
     return "";
@@ -1172,6 +1189,9 @@
         else if (GraphPrintCheckerState->isExplicitNullDeref(N)) {
           Out << "\\|Explicit-Null Dereference.\\l";
         }
+        else if (GraphPrintCheckerState->isUninitStore(N)) {
+          Out << "\\|Store to Uninitialized LValue.";
+        }
         
         break;
       }

Analysis/GRSimpleVals.cpp

diff --git a/Analysis/GRSimpleVals.cpp b/Analysis/GRSimpleVals.cpp
index 87b39b7..c7fdfd0 100644
--- a/Analysis/GRSimpleVals.cpp
+++ b/Analysis/GRSimpleVals.cpp
@@ -19,11 +19,11 @@
 using namespace clang;
 
 namespace clang {
-  void RunGRSimpleVals(CFG& cfg, FunctionDecl& FD, ASTContext& Ctx,
-                      Diagnostic& Diag, bool Visualize) {
+  unsigned RunGRSimpleVals(CFG& cfg, FunctionDecl& FD, ASTContext& Ctx,
+                           Diagnostic& Diag, bool Visualize) {
     
     if (Diag.hasErrorOccurred())
-      return;
+      return 0;
     
     GRCoreEngine<GRExprEngine> Engine(cfg, FD, Ctx);
     GRExprEngine* CheckerState = &Engine.getCheckerState();
@@ -31,7 +31,7 @@
     CheckerState->setTransferFunctions(GRSV);
     
     // Execute the worklist algorithm.
-    Engine.ExecuteWorkList(10000);
+    Engine.ExecuteWorkList(200);
     
     // Look for explicit-Null dereferences and warn about them.
     for (GRExprEngine::null_iterator I=CheckerState->null_begin(),
@@ -46,7 +46,9 @@
         
 #ifndef NDEBUG
     if (Visualize) CheckerState->ViewGraph();
-#endif  
+#endif
+    
+    return Engine.getGraph().size();
   }
 } // end clang namespace
 

Analysis/ValueState.cpp

diff --git a/Analysis/ValueState.cpp b/Analysis/ValueState.cpp
index 016b070..32be0c6 100644
--- a/Analysis/ValueState.cpp
+++ b/Analysis/ValueState.cpp
@@ -329,7 +329,9 @@
 ValueState
 ValueStateManager::SetValue(ValueState St, const LValue& LV, const RValue& V) {
   
-  assert (!isa<UnknownVal>(LV));
+  if (isa<UnknownVal>(LV))
+    return St;
+  
   assert (!isa<UninitializedVal>(LV));
     
   switch (LV.getSubKind()) {