[analyzer] Simple inline defensive checks suppression
authorAnna Zaks <ganna@apple.com>
Sat, 2 Mar 2013 03:20:52 +0000 (03:20 +0000)
committerAnna Zaks <ganna@apple.com>
Sat, 2 Mar 2013 03:20:52 +0000 (03:20 +0000)
commit8d7c8a4dd6ef965e9f6b358c7005195e635ca7c1
treecedacc3aeb89371513adac93e2c9695f21b91ce9
parente400cb70d4c37e8ae9c96ebf1f412eaa329d2850
[analyzer] Simple inline defensive checks suppression

Inlining brought a few "null pointer use" false positives, which occur because
the callee defensively checks if a pointer is NULL, whereas the caller knows
that the pointer cannot be NULL in the context of the given call.

This is a first attempt to silence these warnings by tracking the symbolic value
along the execution path in the BugReporter. The new visitor finds the node
in which the symbol was first constrained to NULL. If the node belongs to
a function on the active stack, the warning is reported, otherwise, it is
suppressed.

There are several areas for follow up work, for example:
 - How do we differentiate the cases where the first check is followed by
another one, which does happen on the active stack?

Also, this only silences a fraction of null pointer use warnings. For example, it
does not do anything for the cases where NULL was assigned inside a callee.

llvm-svn: 176402
clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h
clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
clang/lib/StaticAnalyzer/Core/ProgramState.cpp
clang/test/Analysis/diagnostics/deref-track-symbolic-region.c
clang/test/Analysis/inlining/inline-defensive-checks.c [new file with mode: 0644]
clang/test/Analysis/inlining/path-notes.c