pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '85eb72f7cd'
${ noResults }
infer_clone/infer/tests/codetoanalyze/cpp/biabduction/issues.exp

311 lines
96 KiB
Raw Normal View History Unescape

[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/biabduction/process_splitting_assert.cpp, fail, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure fail(),Taking true branch]
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, crash_fgetc, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure crash_fgetc()]
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, crash_getc, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure crash_getc()]
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, malloc_fail_gets_reported, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure malloc_fail_gets_reported()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, malloc_memory_leak_is_reported, 0, BIABDUCTION_MEMORY_LEAK, no_bucket, ERROR, [start of procedure malloc_memory_leak_is_reported()]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, memcpy_spec_is_found, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure memcpy_spec_is_found()]
codetoanalyze/cpp/biabduction/c_tests/c_bugs.cpp, resource_leak_is_reported, 0, RESOURCE_LEAK, no_bucket, ERROR, [start of procedure resource_leak_is_reported()]
codetoanalyze/cpp/biabduction/include_header/header.h, header::A::div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0]
codetoanalyze/cpp/biabduction/include_header/header.h, header::div0_fun, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure header::div0_fun()]
codetoanalyze/cpp/biabduction/include_header/header2.h, header2::B<header2::A>::div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0]
codetoanalyze/cpp/biabduction/include_header/header2.h, header2::B<int>::div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0]
codetoanalyze/cpp/biabduction/include_header/header2.h, header2::div0_templ<header2::A>, 1, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure header2::div0_templ<header2::A>()]
codetoanalyze/cpp/biabduction/include_header/header2.h, header2::div0_templ<int>, 1, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure header2::div0_templ<int>()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/memory_leaks/array_leak.cpp, leak, 4, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure leak()]
codetoanalyze/cpp/biabduction/memory_leaks/object_leak.cpp, object_leak, 0, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure object_leak(),start of procedure Rectangle,return from a call to Rectangle::Rectangle]
codetoanalyze/cpp/biabduction/memory_leaks/raii_malloc.cpp, memory_leak, 0, BIABDUCTION_MEMORY_LEAK, no_bucket, ERROR, [start of procedure memory_leak()]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_compare_exchange_strong_impossible_npe1_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_compare_exchange_strong_impossible_npe1_ok(),Skipping atomic: method has no implementation,Skipping compare_exchange_strong: method has no implementation,Taking false branch,Taking false branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_compare_exchange_strong_impossible_npe2_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_compare_exchange_strong_impossible_npe2_ok(),Skipping atomic: method has no implementation,Skipping compare_exchange_strong: method has no implementation,Taking false branch,Taking false branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_compare_exchange_weak_impossible_npe1_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_compare_exchange_weak_impossible_npe1_ok(),Skipping atomic: method has no implementation,Skipping compare_exchange_weak: method has no implementation,Taking false branch,Taking false branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_compare_exchange_weak_impossible_npe2_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_compare_exchange_weak_impossible_npe2_ok(),Skipping atomic: method has no implementation,Skipping compare_exchange_weak: method has no implementation,Taking false branch,Taking false branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_exchange_impossible_npe_ok, 5, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_exchange_impossible_npe_ok(),Skipping atomic: method has no implementation,Skipping exchange: method has no implementation,Taking false branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_is_zero_impossible_npe_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_is_zero_impossible_npe_ok(),start of procedure A,Skipping atomic: method has no implementation,return from a call to atomic_test::A::A,start of procedure add,Skipping operator++: method has no implementation,return from a call to atomic_test::A::add,start of procedure sub,Skipping operator--: method has no implementation,return from a call to atomic_test::A::sub,start of procedure is_zero,Condition is false,return from a call to atomic_test::A::is_zero,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_load_store_impossible_npe_ok, 5, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_load_store_impossible_npe_ok(),Skipping atomic: method has no implementation,Skipping store: method has no implementation,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::FP_not_zero_impossible_npe_ok, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::FP_not_zero_impossible_npe_ok(),start of procedure A,Skipping atomic: method has no implementation,return from a call to atomic_test::A::A,start of procedure add,Skipping operator++: method has no implementation,return from a call to atomic_test::A::add,start of procedure add,Skipping operator++: method has no implementation,return from a call to atomic_test::A::add,start of procedure is_zero,Condition is true,return from a call to atomic_test::A::is_zero,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::compare_exchange_strong_possible_npe1_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::compare_exchange_strong_possible_npe1_bad(),Skipping atomic: method has no implementation,Skipping compare_exchange_strong: method has no implementation,Taking true branch,Taking true branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::compare_exchange_strong_possible_npe2_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::compare_exchange_strong_possible_npe2_bad(),Skipping atomic: method has no implementation,Skipping compare_exchange_strong: method has no implementation,Taking true branch,Taking true branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::compare_exchange_weak_possible_npe1_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::compare_exchange_weak_possible_npe1_bad(),Skipping atomic: method has no implementation,Skipping compare_exchange_weak: method has no implementation,Taking true branch,Taking true branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::compare_exchange_weak_possible_npe2_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::compare_exchange_weak_possible_npe2_bad(),Skipping atomic: method has no implementation,Skipping compare_exchange_weak: method has no implementation,Taking true branch,Taking true branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::exchange_possible_npe_bad, 5, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::exchange_possible_npe_bad(),Skipping atomic: method has no implementation,Skipping exchange: method has no implementation,Taking true branch,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::is_zero_possible_npe_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::is_zero_possible_npe_bad(),start of procedure A,Skipping atomic: method has no implementation,return from a call to atomic_test::A::A,start of procedure add,Skipping operator++: method has no implementation,return from a call to atomic_test::A::add,start of procedure sub,Skipping operator--: method has no implementation,return from a call to atomic_test::A::sub,start of procedure is_zero,Condition is true,return from a call to atomic_test::A::is_zero,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::load_store_possible_npe_bad, 5, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::load_store_possible_npe_bad(),Skipping atomic: method has no implementation,Skipping store: method has no implementation,Taking true branch]
codetoanalyze/cpp/biabduction/models/atomic.cpp, atomic_test::not_zero_possible_npe_bad, 6, NULL_DEREFERENCE, B1, ERROR, [start of procedure atomic_test::not_zero_possible_npe_bad(),start of procedure A,Skipping atomic: method has no implementation,return from a call to atomic_test::A::A,start of procedure sub,Skipping operator--: method has no implementation,return from a call to atomic_test::A::sub,start of procedure sub,Skipping operator--: method has no implementation,return from a call to atomic_test::A::sub,start of procedure is_zero,Condition is false,return from a call to atomic_test::A::is_zero,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_eq_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_eq_bad(),start of procedure operator==(),Condition is true,Condition is true,return from a call to operator==,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_ge_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_ge_bad(),start of procedure operator>=(),start of procedure operator<(),Taking false branch,Taking false branch,Condition is false,return from a call to operator<,Condition is false,return from a call to operator>=,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_gt_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_gt_bad(),start of procedure operator>(),start of procedure operator<(),Taking false branch,Taking false branch,Condition is true,return from a call to operator<,return from a call to operator>,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_le_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_le_bad(),start of procedure operator<=(),start of procedure operator<(),Taking false branch,Taking false branch,Condition is false,return from a call to operator<,Condition is false,return from a call to operator<=,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_lt_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_lt_bad(),start of procedure operator<(),Taking false branch,Taking false branch,Condition is true,return from a call to operator<,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, operator_neq_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_neq_bad(),start of procedure operator!=(),start of procedure operator==(),Condition is true,Condition is true,return from a call to operator==,Condition is true,return from a call to operator!=,Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_equal_to_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_equal_to_bad(),Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_greater_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_greater_bad(),Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_greater_equal_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_greater_equal_bad(),Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_less_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_less_bad(),Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_less_equal_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_less_equal_bad(),Taking true branch]
codetoanalyze/cpp/biabduction/models/cmp.cpp, std_not_equal_to_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure std_not_equal_to_bad(),Condition is false,Taking true branch]
codetoanalyze/cpp/biabduction/models/move.cpp, move::div0_moved_from, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure move::div0_moved_from(),start of procedure X,return from a call to move::X::X,start of procedure X,return from a call to move::X::X]
codetoanalyze/cpp/biabduction/models/move.cpp, move::div0_moved_to, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure move::div0_moved_to(),start of procedure X,return from a call to move::X::X,start of procedure X,return from a call to move::X::X]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/biabduction/models/pair.cpp, pair::deref_pair_null0_bad_FN, 3, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure pair::deref_pair_null0_bad_FN(),start of procedure pair::pairOfZeroNull(),Skipping ~pair: method has no implementation,return from a call to pair::pairOfZeroNull,Skipping ~pair: method has no implementation]
codetoanalyze/cpp/biabduction/models/pair.cpp, pair::deref_pair_null1_bad, 3, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure pair::deref_pair_null1_bad(),start of procedure pair::pairOfZeroNull(),Skipping ~pair: method has no implementation,return from a call to pair::pairOfZeroNull,Skipping ~pair: method has no implementation]
codetoanalyze/cpp/biabduction/models/pair.cpp, pair::deref_pair_null_guard_ok_FP, 4, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure pair::deref_pair_null_guard_ok_FP(),start of procedure pair::pairOfZeroNull(),Skipping ~pair: method has no implementation,return from a call to pair::pairOfZeroNull,Skipping ~pair: method has no implementation,Taking true branch]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/models/swap.cpp, swap_null_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure swap_null_bad()]
codetoanalyze/cpp/biabduction/models/throw_wrapper.cpp, nothrow_if_null_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure nothrow_if_null_bad(),start of procedure get_null(),return from a call to get_null,Taking true branch,start of procedure do_nothing(),return from a call to do_nothing]
codetoanalyze/cpp/biabduction/mutex/std_mutex.cpp, ends_locked, 3, Cannot_star, no_bucket, ERROR, [start of procedure ends_locked(),Loop condition is true. Entering loop body,start of procedure ensure_unlocked(),start of procedure ensure_locked(),Skipping try_lock: method has no implementation,return from a call to ensure_locked,Skipping unlock: method has no implementation,return from a call to ensure_unlocked]
codetoanalyze/cpp/biabduction/mutex/std_mutex.cpp, starts_with_lock, 3, Cannot_star, no_bucket, ERROR, [start of procedure starts_with_lock(),Loop condition is true. Entering loop body,Skipping lock: method has no implementation]
codetoanalyze/cpp/biabduction/mutex/std_mutex_lock_profiling.cpp, lp_lock<std::mutex>, 7, Cannot_star, no_bucket, ERROR, [start of procedure lp_lock<std::mutex>(),start of procedure detail::try_lock_impl(),Taking false branch,return from a call to detail::try_lock_impl,Switch condition is false. Skipping switch case,Switch condition is true. Entering switch case]
codetoanalyze/cpp/biabduction/npe/boxed_ptr.cpp, boxed_ptr::smart_ptr_null_field_deref, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure boxed_ptr::smart_ptr_null_field_deref(),start of procedure SmartPtr,return from a call to boxed_ptr::SmartPtr::SmartPtr,start of procedure get,return from a call to boxed_ptr::SmartPtr::get]
codetoanalyze/cpp/biabduction/npe/boxed_ptr.cpp, boxed_ptr::smart_ptr_null_method_deref, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure boxed_ptr::smart_ptr_null_method_deref(),start of procedure SmartPtr,return from a call to boxed_ptr::SmartPtr::SmartPtr,start of procedure get,return from a call to boxed_ptr::SmartPtr::get]
codetoanalyze/cpp/biabduction/npe/boxed_ptr.cpp, boxed_ptr::smart_ptr_null_method_deref2, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure boxed_ptr::smart_ptr_null_method_deref2(),start of procedure SmartPtr,return from a call to boxed_ptr::SmartPtr::SmartPtr,start of procedure get,return from a call to boxed_ptr::SmartPtr::get]
codetoanalyze/cpp/biabduction/npe/boxed_ptr.cpp, boxed_ptr::smart_ptr_result_method_null_deref, 4, NULL_DEREFERENCE, B5, ERROR, [start of procedure boxed_ptr::smart_ptr_result_method_null_deref(),start of procedure SmartPtr,return from a call to boxed_ptr::SmartPtr::SmartPtr,start of procedure X,return from a call to boxed_ptr::X::X,start of procedure get,return from a call to boxed_ptr::SmartPtr::get,start of procedure getNull,return from a call to boxed_ptr::X::getNull]
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_nonzero_deref2_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_nonzero_deref2_bad(),start of procedure cancellation_test::is_size_zero(),start of procedure begin,return from a call to cancellation_test::Test::begin,start of procedure end,return from a call to cancellation_test::Test::end,Condition is false,return from a call to cancellation_test::is_size_zero,Taking true branch]
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_nonzero_deref_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_nonzero_deref_bad(),start of procedure cancellation_test::is_size_zero(),start of procedure begin,return from a call to cancellation_test::Test::begin,start of procedure end,return from a call to cancellation_test::Test::end,Condition is false,return from a call to cancellation_test::is_size_zero,Taking true branch]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_nonzero_deref_iter2_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_nonzero_deref_iter2_bad(),start of procedure cancellation_test::is_size_zero_iter(),start of procedure begin_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::begin_iter,start of procedure end_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::end_iter,start of procedure cancellation_test::operator==(),Condition is false,return from a call to cancellation_test::operator==,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::is_size_zero_iter,Taking true branch]
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_nonzero_deref_iter_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_nonzero_deref_iter_bad(),start of procedure cancellation_test::is_size_zero_iter(),start of procedure begin_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::begin_iter,start of procedure end_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::end_iter,start of procedure cancellation_test::operator==(),Condition is false,return from a call to cancellation_test::operator==,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::is_size_zero_iter,Taking true branch]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_zero_deref2_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_zero_deref2_bad(),start of procedure cancellation_test::is_size_zero(),start of procedure begin,return from a call to cancellation_test::Test::begin,start of procedure end,return from a call to cancellation_test::Test::end,Condition is true,return from a call to cancellation_test::is_size_zero,Taking true branch]
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_zero_deref_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_zero_deref_bad(),start of procedure cancellation_test::is_size_zero(),start of procedure begin,return from a call to cancellation_test::Test::begin,start of procedure end,return from a call to cancellation_test::Test::end,Condition is true,return from a call to cancellation_test::is_size_zero,Taking true branch]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_zero_deref_iter2_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_zero_deref_iter2_bad(),start of procedure cancellation_test::is_size_zero_iter(),start of procedure begin_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::begin_iter,start of procedure end_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::end_iter,start of procedure cancellation_test::operator==(),Condition is true,return from a call to cancellation_test::operator==,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::is_size_zero_iter,Taking true branch]
codetoanalyze/cpp/biabduction/npe/cancellation.cpp, cancellation_test::size_zero_deref_iter_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure cancellation_test::size_zero_deref_iter_bad(),start of procedure cancellation_test::is_size_zero_iter(),start of procedure begin_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::begin_iter,start of procedure end_iter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,start of procedure TestIter,return from a call to cancellation_test::TestIter::TestIter,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::Test::end_iter,start of procedure cancellation_test::operator==(),Condition is true,return from a call to cancellation_test::operator==,Skipping ~TestIter: method has no implementation,return from a call to cancellation_test::is_size_zero_iter,Taking true branch]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/npe/npe_added_to_b1.cpp, npe_added_to_b1::causes_npe_person_bad, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure npe_added_to_b1::causes_npe_person_bad(),start of procedure Person,return from a call to npe_added_to_b1::Person::Person,start of procedure npe_added_to_b1::deref_person()]
codetoanalyze/cpp/biabduction/npe/null_returned_by_method.cpp, testNullDeref, 3, NULL_DEREFERENCE, B2, ERROR, [start of procedure testNullDeref(),Taking true branch,start of procedure getNull,return from a call to XFactory::getNull]
codetoanalyze/cpp/biabduction/npe/object_deref.cpp, object_deref::derefNullField, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure object_deref::derefNullField(),start of procedure object_deref::getNull(),return from a call to object_deref::getNull]
[clang] fix bad interaction between ConditionalOperator and initializers Summary: This is several inter-connected changes together to keep the tests happy. The ConditionalOperator `b?t:e` is translated by first creating a placeholder variable to temporarily store the result of the evaluation in each branch, then the real thing we want to assign to reads that variable. But, there are situations where that changes the semantics of the expression, namely when the value created is a struct on the stack (eg, a C++ temporary). This is because in SIL we cannot assign the *address* of a program variable, only its contents, so by the time we're out of the conditional operator we cannot set the struct value correctly anymore: we can only set its content, which we did, but that results in a "shifted" struct value that is one dereference away from where it should be. So a batch of changes concern `conditionalOperator_trans`: - instead of systematically creating a temporary for the conditional, use the `trans_state.var_exp_typ` provided from above if available when translating `ConditionalOperator` - don't even set anything if that variable was already initialized by merely translating the branch expression, eg when it's a constructor - fix long-standing TODO to propagate these initialization facts accurately for ConditionalOperator (used by `init_expr_trans` to also figure out if it should insert a store to the variable being initialised or not) The rest of the changes adapt some relevant other constructs to deal with conditionalOperator properly now that it can set the current variable itself, instead of storing stuff inside a temp variable. This change was a problem because some constructs, eg a variable declaration, will insert nodes that set up the variable before calling its initialization, and now the initialization happens *before* that setup, in the translation of the inner conditional operator, which naturally creates nodes above the current one. - add a generic helper to force a sequential order between two translation results, forcing node creation if necessary - use that in `init_expr_trans` and `cxxNewExpr_trans` - adjust many places where `var_exp_typ` was incorrectly not reset when translating sub-expressions The sequentiality business creates more nodes when used, and the conditionalOperator business uses fewer temporary variables, so the frontend results change quite a bit. Note that biabduction tests were invaluable in debugging this. There could be other constructs to adjust similarly to cxxNewExpr that were not covered by the tests though. Added tests in pulse that exercises the previous bug. Reviewed By: da319 Differential Revision: D24796282 fbshipit-source-id: 0790c8d17
4 years ago
codetoanalyze/cpp/biabduction/npe/skip_function_with_const_formals.cpp, ERROR_FP_skip_then_split_case_bad, 3, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_FP_skip_then_split_case_bad(),Skipping std::make_shared<lol>(): method has no implementation,Skipping ~shared_ptr: method has no implementation,Skipping skip_no_const(): method has no implementation]
codetoanalyze/cpp/biabduction/npe/skip_function_with_const_formals.cpp, ERROR_const_skip2_then_split_case_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_const_skip2_then_split_case_ok(),Skipping std::make_shared<lol>(): method has no implementation,Skipping ~shared_ptr: method has no implementation,Skipping skip_const2(): method has no implementation]
codetoanalyze/cpp/biabduction/npe/skip_function_with_const_formals.cpp, ERROR_const_skip_then_split_case_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_const_skip_then_split_case_ok(),Skipping std::make_shared<lol>(): method has no implementation,Skipping ~shared_ptr: method has no implementation,Skipping skip_const(): method has no implementation]
codetoanalyze/cpp/biabduction/npe/skip_function_with_const_formals.cpp, ERROR_typedef_skip_then_split_case_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_typedef_skip_then_split_case_ok(),Skipping std::make_shared<lol>(): method has no implementation,Skipping ~shared_ptr: method has no implementation,Skipping skip_typedef(): method has no implementation]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/numeric/min_max.cpp, max_X_inv_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure max_X_inv_div0(),start of procedure X_inv,return from a call to X_inv::X_inv,start of procedure X_inv,return from a call to X_inv::X_inv]
codetoanalyze/cpp/biabduction/numeric/min_max.cpp, max_int_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure max_int_div0()]
codetoanalyze/cpp/biabduction/numeric/min_max.cpp, min_X_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure min_X_div0(),start of procedure X,return from a call to X::X,start of procedure X,return from a call to X::X]
codetoanalyze/cpp/biabduction/numeric/min_max.cpp, min_int_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure min_int_div0()]
codetoanalyze/cpp/biabduction/overwrite_attribute/main.cpp, testSetIntValue, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure testSetIntValue(),start of procedure setIntValue(),return from a call to setIntValue]
codetoanalyze/cpp/biabduction/pointers/unintialized.cpp, known_ctor_dangling_bad, 2, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure known_ctor_dangling_bad(),start of procedure TestDangling,return from a call to TestDangling::TestDangling]
codetoanalyze/cpp/biabduction/pointers/unintialized.cpp, uninitialized_dangling_bad, 2, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure uninitialized_dangling_bad()]
codetoanalyze/cpp/biabduction/resource_leaks/raii.cpp, resource_leak, 7, RESOURCE_LEAK, no_bucket, ERROR, [start of procedure resource_leak(),Taking false branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/smart_ptr/deref_after_move_example.cpp, deref_after_mode_example::Person::Person, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure Person,Skipping unique_ptr<true,_void>: method has no implementation]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::ERROR_shared_ptr_check_notnull_ok, 2, Cannot_star, no_bucket, ERROR, [start of procedure shared_ptr::ERROR_shared_ptr_check_notnull_ok(),Skipping shared_ptr: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::ERROR_shared_ptr_check_null_ok, 2, Cannot_star, no_bucket, ERROR, [start of procedure shared_ptr::ERROR_shared_ptr_check_null_ok(),Skipping shared_ptr: method has no implementation]
[clang] fix bad interaction between ConditionalOperator and initializers Summary: This is several inter-connected changes together to keep the tests happy. The ConditionalOperator `b?t:e` is translated by first creating a placeholder variable to temporarily store the result of the evaluation in each branch, then the real thing we want to assign to reads that variable. But, there are situations where that changes the semantics of the expression, namely when the value created is a struct on the stack (eg, a C++ temporary). This is because in SIL we cannot assign the *address* of a program variable, only its contents, so by the time we're out of the conditional operator we cannot set the struct value correctly anymore: we can only set its content, which we did, but that results in a "shifted" struct value that is one dereference away from where it should be. So a batch of changes concern `conditionalOperator_trans`: - instead of systematically creating a temporary for the conditional, use the `trans_state.var_exp_typ` provided from above if available when translating `ConditionalOperator` - don't even set anything if that variable was already initialized by merely translating the branch expression, eg when it's a constructor - fix long-standing TODO to propagate these initialization facts accurately for ConditionalOperator (used by `init_expr_trans` to also figure out if it should insert a store to the variable being initialised or not) The rest of the changes adapt some relevant other constructs to deal with conditionalOperator properly now that it can set the current variable itself, instead of storing stuff inside a temp variable. This change was a problem because some constructs, eg a variable declaration, will insert nodes that set up the variable before calling its initialization, and now the initialization happens *before* that setup, in the translation of the inner conditional operator, which naturally creates nodes above the current one. - add a generic helper to force a sequential order between two translation results, forcing node creation if necessary - use that in `init_expr_trans` and `cxxNewExpr_trans` - adjust many places where `var_exp_typ` was incorrectly not reset when translating sub-expressions The sequentiality business creates more nodes when used, and the conditionalOperator business uses fewer temporary variables, so the frontend results change quite a bit. Note that biabduction tests were invaluable in debugging this. There could be other constructs to adjust similarly to cxxNewExpr that were not covered by the tests though. Added tests in pulse that exercises the previous bug. Reviewed By: da319 Differential Revision: D24796282 fbshipit-source-id: 0790c8d17
4 years ago
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FN_reset_ptr_null_deref2_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FN_reset_ptr_null_deref2_bad(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FN_reset_ptr_null_deref2_bad, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FN_reset_ptr_null_deref2_bad(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation,Skipping reset<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FN_reset_ptr_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FN_reset_ptr_null_deref_bad(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FN_shared_ptr_assign_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FN_shared_ptr_assign_null_deref_bad(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FN_shared_ptr_move_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FN_shared_ptr_move_null_deref_bad(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FP_reset_ptr_deref2_ok, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FP_reset_ptr_deref2_ok(),Skipping shared_ptr: method has no implementation,Skipping reset: method has no implementation,Skipping reset<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FP_reset_ptr_deref_ok, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FP_reset_ptr_deref_ok(),Skipping shared_ptr: method has no implementation,Skipping reset<int>: method has no implementation]
[clang] fix bad interaction between ConditionalOperator and initializers Summary: This is several inter-connected changes together to keep the tests happy. The ConditionalOperator `b?t:e` is translated by first creating a placeholder variable to temporarily store the result of the evaluation in each branch, then the real thing we want to assign to reads that variable. But, there are situations where that changes the semantics of the expression, namely when the value created is a struct on the stack (eg, a C++ temporary). This is because in SIL we cannot assign the *address* of a program variable, only its contents, so by the time we're out of the conditional operator we cannot set the struct value correctly anymore: we can only set its content, which we did, but that results in a "shifted" struct value that is one dereference away from where it should be. So a batch of changes concern `conditionalOperator_trans`: - instead of systematically creating a temporary for the conditional, use the `trans_state.var_exp_typ` provided from above if available when translating `ConditionalOperator` - don't even set anything if that variable was already initialized by merely translating the branch expression, eg when it's a constructor - fix long-standing TODO to propagate these initialization facts accurately for ConditionalOperator (used by `init_expr_trans` to also figure out if it should insert a store to the variable being initialised or not) The rest of the changes adapt some relevant other constructs to deal with conditionalOperator properly now that it can set the current variable itself, instead of storing stuff inside a temp variable. This change was a problem because some constructs, eg a variable declaration, will insert nodes that set up the variable before calling its initialization, and now the initialization happens *before* that setup, in the translation of the inner conditional operator, which naturally creates nodes above the current one. - add a generic helper to force a sequential order between two translation results, forcing node creation if necessary - use that in `init_expr_trans` and `cxxNewExpr_trans` - adjust many places where `var_exp_typ` was incorrectly not reset when translating sub-expressions The sequentiality business creates more nodes when used, and the conditionalOperator business uses fewer temporary variables, so the frontend results change quite a bit. Note that biabduction tests were invaluable in debugging this. There could be other constructs to adjust similarly to cxxNewExpr that were not covered by the tests though. Added tests in pulse that exercises the previous bug. Reviewed By: da319 Differential Revision: D24796282 fbshipit-source-id: 0790c8d17
4 years ago
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FP_shared_ptr_assign_deref_ok, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FP_shared_ptr_assign_deref_ok(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/shared_ptr_deref.cpp, shared_ptr::FP_shared_ptr_copy_deref_ok, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure shared_ptr::FP_shared_ptr_copy_deref_ok(),Skipping __nat: method has no implementation,Skipping shared_ptr<int>: method has no implementation]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FN_FP_reset_ptr_null_deref2_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FN_FP_reset_ptr_null_deref2_bad(),Skipping unique_ptr<true,_void>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FN_FP_reset_ptr_null_deref2_bad, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FN_FP_reset_ptr_null_deref2_bad(),Skipping unique_ptr<true,_void>: method has no implementation,Skipping reset: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FN_FP_reset_ptr_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FN_FP_reset_ptr_null_deref_bad(),Skipping unique_ptr<true,_void>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FN_unique_ptr_assign_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FN_unique_ptr_assign_null_deref_bad(),Skipping unique_ptr<true,_void>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FN_unique_ptr_move_null_deref_bad, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FN_unique_ptr_move_null_deref_bad(),Skipping unique_ptr<true,_void>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FP_reset_ptr_deref2_ok, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FP_reset_ptr_deref2_ok(),Skipping unique_ptr<true,_void>: method has no implementation,Skipping reset: method has no implementation,Skipping reset: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FP_reset_ptr_deref_ok, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FP_reset_ptr_deref_ok(),Skipping unique_ptr<true,_void>: method has no implementation,Skipping reset: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::FP_unique_ptr_move_deref_ok, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::FP_unique_ptr_move_deref_ok(),Skipping unique_ptr<true,_void>: method has no implementation]
codetoanalyze/cpp/biabduction/smart_ptr/unique_ptr_deref.cpp, unique_ptr::unique_ptr_assign_deref_ok, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure unique_ptr::unique_ptr_assign_deref_ok(),Skipping unique_ptr<true,_void>: method has no implementation]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/static_local/nonstatic_local_bad.cpp, nonstatic_local_caller, 2, DANGLING_POINTER_DEREFERENCE, no_bucket, ERROR, [start of procedure nonstatic_local_caller(),start of procedure nonstatic_local_bad(),return from a call to nonstatic_local_bad]
codetoanalyze/cpp/biabduction/subtyping/cast_with_enforce.cpp, cast_with_enforce::cast_with_npe, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure cast_with_enforce::cast_with_npe(),start of procedure Base,return from a call to cast_with_enforce::Base::Base]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::rightPointerCast, 4, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure dynamic__cast::rightPointerCast(),start of procedure Derived,start of procedure Base,return from a call to dynamic__cast::Base::Base,return from a call to dynamic__cast::Derived::Derived,Taking true branch]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::rightPointerCast, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure dynamic__cast::rightPointerCast(),start of procedure Derived,start of procedure Base,return from a call to dynamic__cast::Base::Base,return from a call to dynamic__cast::Derived::Derived,Taking true branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::rightReferenceCast, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure dynamic__cast::rightReferenceCast(),start of procedure Derived,start of procedure Base,return from a call to dynamic__cast::Base::Base,return from a call to dynamic__cast::Derived::Derived]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongCastOfArgumentPointer, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure dynamic__cast::wrongCastOfArgumentPointer(),start of procedure Base,return from a call to dynamic__cast::Base::Base,start of procedure dynamic__cast::castOfArgumentPointer(),Taking false branch,return from a call to dynamic__cast::castOfArgumentPointer]
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongCastOfArgumentReference, 2, CLASS_CAST_EXCEPTION, no_bucket, ERROR, [start of procedure dynamic__cast::wrongCastOfArgumentReference(),start of procedure Base,return from a call to dynamic__cast::Base::Base]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongPointerCast, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure dynamic__cast::wrongPointerCast(),start of procedure Base,return from a call to dynamic__cast::Base::Base]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongPointerCast, 6, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure dynamic__cast::wrongPointerCast(),start of procedure Base,return from a call to dynamic__cast::Base::Base,Taking false branch]
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongReferenceCast, 3, CLASS_CAST_EXCEPTION, no_bucket, ERROR, [start of procedure dynamic__cast::wrongReferenceCast(),start of procedure Base,return from a call to dynamic__cast::Base::Base]
codetoanalyze/cpp/biabduction/subtyping/dynamic_cast.cpp, dynamic__cast::wrongReferenceCastNotAssigned, 3, CLASS_CAST_EXCEPTION, no_bucket, ERROR, [start of procedure dynamic__cast::wrongReferenceCastNotAssigned(),start of procedure Base,return from a call to dynamic__cast::Base::Base]
codetoanalyze/cpp/biabduction/subtyping/implicit_cast_with_const.cpp, implicit_cast_with_const::BaseDerefNPE, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure implicit_cast_with_const::BaseDerefNPE(),start of procedure Base,return from a call to implicit_cast_with_const::Base::Base,start of procedure implicit_cast_with_const::deref()]
codetoanalyze/cpp/biabduction/subtyping/implicit_cast_with_const.cpp, implicit_cast_with_const::DerivedDerefNPE, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure implicit_cast_with_const::DerivedDerefNPE(),start of procedure Derived,start of procedure Base,return from a call to implicit_cast_with_const::Base::Base,return from a call to implicit_cast_with_const::Derived::Derived,start of procedure implicit_cast_with_const::deref()]
codetoanalyze/cpp/biabduction/subtyping/subtyping_check.cpp, B::setFG, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure setFG,start of procedure setF,return from a call to A::setF,Taking true branch]
codetoanalyze/cpp/biabduction/templates/dependent_parent.cpp, instantiate_class_bad, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure instantiate_class_bad(),start of procedure X,return from a call to X<int>::X,start of procedure x_y,start of procedure Y,start of procedure Z,return from a call to Z<int>::Z,return from a call to X<int>::Y::Y,start of procedure y,start of procedure z,return from a call to Z<int>::z,return from a call to X<int>::Y::y,return from a call to X<int>::x_y]
[siof] detect constexpr for all procedures Summary: Previously we were only taking constexpr into account on constructors. Add this info to ProcAttributes.t instead by exporting it from the plugin for all functions. This allows SIOF to take constexpr into account in more cases as it's not always good at capturing which functions *can* be constexpr-evaluated, which caused false positives. Delete now-useless is_constexpr in constructor types. This generated the changes in frontend tests. Some minor renamings of variants of is_const_expr -> is_constexpr. Reviewed By: da319 Differential Revision: D27503433 fbshipit-source-id: 3d1972900
4 years ago
codetoanalyze/cpp/biabduction/templates/mangling.cpp, mangling::bad_integral_types_templates, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure mangling::bad_integral_types_templates(),start of procedure IntTemplate,return from a call to mangling::IntTemplate<0>::IntTemplate,start of procedure CharTemplate,return from a call to mangling::CharTemplate<99>::CharTemplate,start of procedure LongTemplate,return from a call to mangling::LongTemplate<1234567890>::LongTemplate]
codetoanalyze/cpp/biabduction/templates/mangling.cpp, mangling::bad_nullptr_templates, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure mangling::bad_nullptr_templates(),start of procedure NullPtrTemplate,return from a call to mangling::NullPtrTemplate<NullPtr>::NullPtrTemplate]
codetoanalyze/cpp/biabduction/templates/mangling.cpp, mangling::bad_packed_templates, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure mangling::bad_packed_templates(),start of procedure Tuple,return from a call to mangling::Tuple<mangling::Tuple<int>>::Tuple]
codetoanalyze/cpp/biabduction/templates/mangling.cpp, mangling::bad_reference_and_pointer_templates, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure mangling::bad_reference_and_pointer_templates(),start of procedure PointerTypeTemplate,return from a call to mangling::PointerTypeTemplate<Opaque>::PointerTypeTemplate,start of procedure PointerTypeTemplate2,return from a call to mangling::PointerTypeTemplate2<Opaque>::PointerTypeTemplate2,start of procedure FunctionPointerTemplate,return from a call to mangling::FunctionPointerTemplate<Opaque>::FunctionPointerTemplate,start of procedure ReferenceTypeTemplate,return from a call to mangling::ReferenceTypeTemplate<Opaque>::ReferenceTypeTemplate]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, employee_typeid, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure employee_typeid(),start of procedure Employee,start of procedure Person,return from a call to Person::Person,return from a call to Employee::Employee]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, employee_typeid, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure employee_typeid(),start of procedure Employee,start of procedure Person,return from a call to Person::Person,return from a call to Employee::Employee,Taking true branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_ptr_typeid, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure person_ptr_typeid(),start of procedure Person,return from a call to Person::Person]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_ptr_typeid, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure person_ptr_typeid(),start of procedure Person,return from a call to Person::Person,Taking true branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_typeid, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure person_typeid(),start of procedure Person,return from a call to Person::Person]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_typeid, 6, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure person_typeid(),start of procedure Person,return from a call to Person::Person,Taking false branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_typeid_name, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure person_typeid_name(),start of procedure Person,return from a call to Person::Person]
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_typeid_name, 4, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure person_typeid_name(),start of procedure Person,return from a call to Person::Person]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, person_typeid_name, 8, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure person_typeid_name(),start of procedure Person,return from a call to Person::Person,Taking false branch]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, template_type_id_person, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure template_type_id_person(),start of procedure Person,return from a call to Person::Person,Skipping template_typeid<Person>(): empty list of specs]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, template_type_id_person, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure template_type_id_person(),start of procedure Person,return from a call to Person::Person,Taking false branch]
[clang] change the way we wire up return statements Summary: Split the translation of return more aggressively between: 1. the instruction that has to happen before the translation of the sub-expr 2. the sub-expr 3. the instruction that has to happen after the sub-expr This is needed for the next diff which creates potentially large CFGs in (2). Reviewed By: da319 Differential Revision: D24954071 fbshipit-source-id: a7e7e2527
4 years ago
codetoanalyze/cpp/biabduction/types/typeid_expr.cpp, template_typeid<Person>, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure template_typeid<Person>(),start of procedure Person,return from a call to Person::Person,start of procedure Person,return from a call to Person::Person,start of procedure ~Person,start of procedure __infer_inner_destructor_~Person,return from a call to Person::__infer_inner_destructor_~Person,return from a call to Person::~Person]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/vector/empty_access.cpp, ERROR_vector_as_param_by_value_clear_ok, 2, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_vector_as_param_by_value_clear_ok(),Skipping vector: method has no implementation,Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/empty_access.cpp, ERROR_vector_as_param_by_value_empty_bad, 2, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_vector_as_param_by_value_empty_bad(),Skipping vector: method has no implementation,Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/empty_access.cpp, ERROR_vector_as_param_empty_bad, 2, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_vector_as_param_empty_bad(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/empty_access.cpp, ERROR_vector_as_param_nonempty_ok, 2, Cannot_star, no_bucket, ERROR, [start of procedure ERROR_vector_as_param_nonempty_ok(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/empty_access.cpp, FN_vector_as_param_clear_bad, 2, Cannot_star, no_bucket, ERROR, [start of procedure FN_vector_as_param_clear_bad(),Skipping vector: method has no implementation]
[clang] fix bad interaction between ConditionalOperator and initializers Summary: This is several inter-connected changes together to keep the tests happy. The ConditionalOperator `b?t:e` is translated by first creating a placeholder variable to temporarily store the result of the evaluation in each branch, then the real thing we want to assign to reads that variable. But, there are situations where that changes the semantics of the expression, namely when the value created is a struct on the stack (eg, a C++ temporary). This is because in SIL we cannot assign the *address* of a program variable, only its contents, so by the time we're out of the conditional operator we cannot set the struct value correctly anymore: we can only set its content, which we did, but that results in a "shifted" struct value that is one dereference away from where it should be. So a batch of changes concern `conditionalOperator_trans`: - instead of systematically creating a temporary for the conditional, use the `trans_state.var_exp_typ` provided from above if available when translating `ConditionalOperator` - don't even set anything if that variable was already initialized by merely translating the branch expression, eg when it's a constructor - fix long-standing TODO to propagate these initialization facts accurately for ConditionalOperator (used by `init_expr_trans` to also figure out if it should insert a store to the variable being initialised or not) The rest of the changes adapt some relevant other constructs to deal with conditionalOperator properly now that it can set the current variable itself, instead of storing stuff inside a temp variable. This change was a problem because some constructs, eg a variable declaration, will insert nodes that set up the variable before calling its initialization, and now the initialization happens *before* that setup, in the translation of the inner conditional operator, which naturally creates nodes above the current one. - add a generic helper to force a sequential order between two translation results, forcing node creation if necessary - use that in `init_expr_trans` and `cxxNewExpr_trans` - adjust many places where `var_exp_typ` was incorrectly not reset when translating sub-expressions The sequentiality business creates more nodes when used, and the conditionalOperator business uses fewer temporary variables, so the frontend results change quite a bit. Note that biabduction tests were invaluable in debugging this. There could be other constructs to adjust similarly to cxxNewExpr that were not covered by the tests though. Added tests in pulse that exercises the previous bug. Reviewed By: da319 Differential Revision: D24796282 fbshipit-source-id: 0790c8d17
4 years ago
codetoanalyze/cpp/biabduction/vector/iterator_access.cpp, iterator_access::possible_npe, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure iterator_access::possible_npe(),Skipping begin: method has no implementation,Skipping ~__wrap_iter: method has no implementation,Skipping end: method has no implementation,Loop condition is true. Entering loop body,Taking true branch,Taking true branch]
[biabd] rename test directories from {biabduction,errors,infer} to {biabduction} Summary: The directory names had some interesting variety due to historical reasons. - {c,cpp,objc,objcpp}/errors/ date from the time when infer was only biabduction - java/infer/ dates from the time when we had an "--analyzer" option and "infer" was one of them (sic), and eg another was "eradicate". - c/biabduction/ dates from the time when the biabduction analysis was being migrated to the "checkers" (AI) framework. For some reasons the tests there are not a subset of c/infer/ but seem to be entirely new tests. The convention now dictates that we should name all of these */biabduction/. This diff moves the existing tests from c/biabduction/ into c/biabduction/misc/. Reviewed By: mityal Differential Revision: D21300147 fbshipit-source-id: 516d1cb15
5 years ago
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_empty_deref1_bad, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_empty_deref1_bad(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_empty_deref2_bad, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_empty_deref2_bad(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_empty_no_deref1_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_empty_no_deref1_ok(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_empty_no_deref2_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_empty_no_deref2_ok(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_not_empty_deref1_bad, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_not_empty_deref1_bad(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_not_empty_deref2_bad, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_not_empty_deref2_bad(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_not_empty_no_deref1_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_not_empty_no_deref1_ok(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/iterator_cmp.cpp, iterator_compare::ERROR_not_empty_no_deref2_ok, 3, Cannot_star, no_bucket, ERROR, [start of procedure iterator_compare::ERROR_not_empty_no_deref2_ok(),Skipping vector: method has no implementation]
codetoanalyze/cpp/biabduction/vector/loop.cpp, FP_empty_vector_loop_ok, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure FP_empty_vector_loop_ok(),Skipping vector: method has no implementation,Loop condition is true. Entering loop body]
codetoanalyze/cpp/biabduction/vector/loop.cpp, non_empty_vector_loop_bad, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure non_empty_vector_loop_bad(),Skipping vector: method has no implementation,Loop condition is true. Entering loop body]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/attributes/annotate.cpp, derefFirstArg2_null_deref, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure derefFirstArg2_null_deref()]
codetoanalyze/cpp/shared/attributes/annotate.cpp, derefFirstArg3_null_deref, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure derefFirstArg3_null_deref(),start of procedure derefFirstArg3()]
codetoanalyze/cpp/shared/attributes/annotate.cpp, derefFirstArg_null_deref, 2, NULL_DEREFERENCE, B5, ERROR, [start of procedure derefFirstArg_null_deref()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/attributes/annotate.cpp, getPtr_null_deref1, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure getPtr_null_deref1(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
codetoanalyze/cpp/shared/attributes/annotate.cpp, getPtr_null_deref2, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure getPtr_null_deref2(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
codetoanalyze/cpp/shared/attributes/annotate.cpp, getRef_null_deref1, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure getRef_null_deref1(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
codetoanalyze/cpp/shared/attributes/annotate.cpp, getRef_null_deref2, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure getRef_null_deref2(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
codetoanalyze/cpp/shared/attributes/annotate.cpp, operator_star_null_deref1, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_star_null_deref1(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
codetoanalyze/cpp/shared/attributes/annotate.cpp, operator_star_null_deref2, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure operator_star_null_deref2(),start of procedure TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr,return from a call to TranslateAsPtr<int>::TranslateAsPtr,start of procedure setPtr,return from a call to TranslateAsPtr<int>::setPtr]
[biabd] rename a test to follow naming conventions Reviewed By: ngorogiannis Differential Revision: D24794526 fbshipit-source-id: 9b2392c35
4 years ago
codetoanalyze/cpp/shared/conditional/lvalue_conditional.cpp, div0_assign_conditional_bad, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_assign_conditional_bad(),start of procedure assign_conditional(),Condition is false,return from a call to assign_conditional]
codetoanalyze/cpp/shared/conditional/lvalue_conditional.cpp, div0_choose_lvalue_bad, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_choose_lvalue_bad(),start of procedure choose_lvalue(),Condition is true,return from a call to choose_lvalue]
codetoanalyze/cpp/shared/conditional/lvalue_conditional.cpp, div0_choose_rvalue_bad, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_choose_rvalue_bad(),start of procedure choose_rvalue(),Condition is true,return from a call to choose_rvalue]
codetoanalyze/cpp/shared/conditional/lvalue_conditional.cpp, div0_temp_lvalue_bad, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_temp_lvalue_bad(),start of procedure div_temp_lvalue(),Condition is true]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/constructor_init.cpp, delegate_constr_f2_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure delegate_constr_f2_div0(),start of procedure B,start of procedure B,start of procedure A,return from a call to A::A,start of procedure T,return from a call to B::T::T,return from a call to B::B,return from a call to B::B]
codetoanalyze/cpp/shared/constructors/constructor_init.cpp, delegate_constr_f_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure delegate_constr_f_div0(),start of procedure B,start of procedure B,start of procedure A,return from a call to A::A,start of procedure T,return from a call to B::T::T,return from a call to B::B,return from a call to B::B]
codetoanalyze/cpp/shared/constructors/constructor_init.cpp, f2_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure f2_div0(),start of procedure B,start of procedure A,return from a call to A::A,start of procedure T,return from a call to B::T::T,return from a call to B::B]
codetoanalyze/cpp/shared/constructors/constructor_init.cpp, f_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure f_div0(),start of procedure B,start of procedure A,return from a call to A::A,start of procedure T,return from a call to B::T::T,return from a call to B::B]
codetoanalyze/cpp/shared/constructors/constructor_init.cpp, t_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure t_div0(),start of procedure B,start of procedure A,return from a call to A::A,start of procedure T,return from a call to B::T::T,return from a call to B::B]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::array_of_class_with_not_constant_size, 1, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::array_of_class_with_not_constant_size(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is true]
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::array_of_person_with_constant_size, 0, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::array_of_person_with_constant_size()]
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_1_arg_new_div0, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::constructor_1_arg_new_div0(),start of procedure Person,return from a call to constructor_new::Person::Person]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_1_arg_new_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::constructor_1_arg_new_div0(),start of procedure Person,return from a call to constructor_new::Person::Person]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_3_args_new_div0, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::constructor_3_args_new_div0(),start of procedure Person,return from a call to constructor_new::Person::Person]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_3_args_new_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::constructor_3_args_new_div0(),start of procedure Person,return from a call to constructor_new::Person::Person]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_nodes, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::constructor_nodes(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is false,start of procedure Person,return from a call to constructor_new::Person::Person]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::constructor_nodes, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::constructor_nodes(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is false,start of procedure Person,return from a call to constructor_new::Person::Person]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::float_init_number, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::float_init_number()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::float_init_number, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::float_init_number()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_array, 4, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_array(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is true,start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_array, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_array(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is true,start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_array_init, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_array_init()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_array_init, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_array_init()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_empty, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_init_empty()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_empty, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_init_empty()]
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_empty_list, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_init_empty_list()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_empty_list_new, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_init_empty_list_new()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_empty_list_new, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_init_empty_list_new()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_nodes, 3, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_init_nodes(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is false]
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_nodes, 4, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_init_nodes(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is false]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_nodes, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_init_nodes(),start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,start of procedure constructor_new::getValue(),return from a call to constructor_new::getValue,Condition is false]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_number, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::int_init_number()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::int_init_number, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_new::int_init_number()]
[pulse] Enable pulse memory leaks and disable biabduction one Summary: The new memory leaks analysis is now ready to be enabled by default and turned on in production. This also replaces the biabduction one which is now disabled. Reviewed By: jvillard Differential Revision: D21998666 fbshipit-source-id: 9cd95e894
5 years ago
codetoanalyze/cpp/shared/constructors/constructor_new.cpp, constructor_new::matrix_of_person, 2, BIABDUCTION_MEMORY_LEAK, CPP, ERROR, [start of procedure constructor_new::matrix_of_person()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/constructor_with_body.cpp, constructor_with_body::test_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_with_body::test_div0(),start of procedure X,start of procedure init,return from a call to constructor_with_body::X::init,return from a call to constructor_with_body::X::X,start of procedure div]
codetoanalyze/cpp/shared/constructors/constructor_with_body.cpp, constructor_with_body::test_div0_default_constructor, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure constructor_with_body::test_div0_default_constructor(),start of procedure X,start of procedure init,return from a call to constructor_with_body::X::init,return from a call to constructor_with_body::X::X,start of procedure div]
codetoanalyze/cpp/shared/constructors/copy_array_field.cpp, copy_array_field::npe, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure copy_array_field::npe(),start of procedure X,return from a call to copy_array_field::X::X,start of procedure X,return from a call to copy_array_field::X::X]
codetoanalyze/cpp/shared/constructors/copy_move_constructor.cpp, copy_move_constructor::copyX_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure copy_move_constructor::copyX_div0(),start of procedure X,return from a call to copy_move_constructor::X::X,start of procedure X,return from a call to copy_move_constructor::X::X]
codetoanalyze/cpp/shared/constructors/copy_move_constructor.cpp, copy_move_constructor::copyY_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure copy_move_constructor::copyY_div0(),start of procedure Y,return from a call to copy_move_constructor::Y::Y,start of procedure Y,return from a call to copy_move_constructor::Y::Y]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/shared/constructors/copy_move_constructor.cpp, copy_move_constructor::moveX_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure copy_move_constructor::moveX_div0(),start of procedure copy_move_constructor::getX(),start of procedure X,return from a call to copy_move_constructor::X::X,start of procedure X,return from a call to copy_move_constructor::X::X,Skipping ~X: method has no implementation,return from a call to copy_move_constructor::getX,Skipping ~X: method has no implementation]
codetoanalyze/cpp/shared/constructors/copy_move_constructor.cpp, copy_move_constructor::moveY_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure copy_move_constructor::moveY_div0(),start of procedure copy_move_constructor::getY(),start of procedure Y,return from a call to copy_move_constructor::Y::Y,start of procedure Y,return from a call to copy_move_constructor::Y::Y,Skipping ~Y: method has no implementation,return from a call to copy_move_constructor::getY,Skipping ~Y: method has no implementation]
[clang] destroy C++ temporaries Summary: Inject destructor calls to destroy a temporary when its lifetime ends. Reviewed By: mbouaziz Differential Revision: D15674209 fbshipit-source-id: 0f783a906
6 years ago
codetoanalyze/cpp/shared/constructors/copy_move_constructor.cpp, copy_move_constructor::moveY_moveY_copyY_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure copy_move_constructor::moveY_moveY_copyY_div0(),start of procedure copy_move_constructor::getY(),start of procedure Y,return from a call to copy_move_constructor::Y::Y,start of procedure Y,return from a call to copy_move_constructor::Y::Y,Skipping ~Y: method has no implementation,return from a call to copy_move_constructor::getY,start of procedure Y,return from a call to copy_move_constructor::Y::Y,Skipping ~Y: method has no implementation,start of procedure Y,return from a call to copy_move_constructor::Y::Y]
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::assign_temp_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::assign_temp_div0(),start of procedure X,return from a call to temp_object::X::X,start of procedure X,return from a call to temp_object::X::X,Skipping ~X: method has no implementation,start of procedure div]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::getX_field_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::getX_field_div0(),start of procedure temp_object::getX(),start of procedure X,return from a call to temp_object::X::X,start of procedure X,return from a call to temp_object::X::X,Skipping ~X: method has no implementation,return from a call to temp_object::getX,start of procedure temp_object::div()]
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::getX_method_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::getX_method_div0(),start of procedure temp_object::getX(),start of procedure X,return from a call to temp_object::X::X,start of procedure X,return from a call to temp_object::X::X,Skipping ~X: method has no implementation,return from a call to temp_object::getX,start of procedure div]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::temp_field2_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::temp_field2_div0(),start of procedure X,return from a call to temp_object::X::X,start of procedure temp_object::div()]
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::temp_field_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::temp_field_div0(),start of procedure X,return from a call to temp_object::X::X,start of procedure temp_object::div()]
codetoanalyze/cpp/shared/constructors/temp_object.cpp, temp_object::temp_method_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure temp_object::temp_method_div0(),start of procedure X,return from a call to temp_object::X::X,start of procedure div]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/exceptions/Exceptions.cpp, call_deref_with_null, 0, NULL_DEREFERENCE, B1, ERROR, [start of procedure call_deref_with_null(),start of procedure deref_null()]
[clang] destroy C++ temporaries Summary: Inject destructor calls to destroy a temporary when its lifetime ends. Reviewed By: mbouaziz Differential Revision: D15674209 fbshipit-source-id: 0f783a906
6 years ago
codetoanalyze/cpp/shared/lambda/lambda1.cpp, bar, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure bar(),start of procedure ,return from a call to bar::lambda_shared_lambda_lambda1.cpp:9:15::,Skipping ~: method has no implementation,start of procedure operator(),return from a call to bar::lambda_shared_lambda_lambda1.cpp:9:15::operator()]
codetoanalyze/cpp/shared/lambda/lambda1.cpp, foo, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure foo(),start of procedure ,return from a call to foo::lambda_shared_lambda_lambda1.cpp:17:17::,Skipping ~: method has no implementation,start of procedure ,return from a call to foo::lambda_shared_lambda_lambda1.cpp:18:12::,Skipping ~: method has no implementation,start of procedure operator(),return from a call to foo::lambda_shared_lambda_lambda1.cpp:18:12::operator()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/lambda/lambda1.cpp, foo::lambda_shared_lambda_lambda1.cpp:17:17::operator(), 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure operator()]
codetoanalyze/cpp/shared/methods/conversion_operator.cpp, conversion_operator::branch_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure conversion_operator::branch_div0(),start of procedure X,return from a call to conversion_operator::X::X,start of procedure operator_bool,return from a call to conversion_operator::X::operator_bool,Taking true branch,start of procedure operator_int,return from a call to conversion_operator::X::operator_int]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/shared/methods/conversion_operator.cpp, conversion_operator::y_branch_div0, 6, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure conversion_operator::y_branch_div0(),start of procedure Y,return from a call to conversion_operator::Y::Y,start of procedure operator_X,start of procedure X,return from a call to conversion_operator::X::X,start of procedure X,return from a call to conversion_operator::X::X,Skipping ~X: method has no implementation,return from a call to conversion_operator::Y::operator_X,start of procedure X,return from a call to conversion_operator::X::X,start of procedure operator_bool,return from a call to conversion_operator::X::operator_bool,Taking true branch,start of procedure operator_X,start of procedure X,return from a call to conversion_operator::X::X,start of procedure X,return from a call to conversion_operator::X::X,Skipping ~X: method has no implementation,return from a call to conversion_operator::Y::operator_X,start of procedure X,return from a call to conversion_operator::X::X,start of procedure operator_int,return from a call to conversion_operator::X::operator_int,Skipping ~X: method has no implementation]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/methods/static.cpp, div0_class, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_class(),start of procedure fun]
codetoanalyze/cpp/shared/methods/static.cpp, div0_instance, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_instance(),start of procedure fun]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/methods/virtual_methods.cpp, poly_area, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure poly_area(),start of procedure Polygon,return from a call to Polygon::Polygon,start of procedure area,return from a call to Polygon::area]
codetoanalyze/cpp/shared/methods/virtual_methods.cpp, rect_area, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure rect_area(),start of procedure Rectangle,start of procedure Polygon,return from a call to Polygon::Polygon,return from a call to Rectangle::Rectangle,start of procedure set_values,return from a call to Polygon::set_values,start of procedure area,return from a call to Rectangle::area]
codetoanalyze/cpp/shared/methods/virtual_methods.cpp, tri_area, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure tri_area(),start of procedure Triangle,start of procedure Polygon,return from a call to Polygon::Polygon,return from a call to Triangle::Triangle,start of procedure Polygon,return from a call to Polygon::Polygon,start of procedure set_values,return from a call to Polygon::set_values,start of procedure area,return from a call to Triangle::area]
codetoanalyze/cpp/shared/methods/virtual_methods.cpp, tri_not_virtual_area, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure tri_not_virtual_area(),start of procedure Triangle,start of procedure Polygon,return from a call to Polygon::Polygon,return from a call to Triangle::Triangle,start of procedure Polygon,return from a call to Polygon::Polygon,start of procedure set_values,return from a call to Polygon::set_values,start of procedure area,return from a call to Polygon::area]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/namespace/function.cpp, div0_namespace_resolution, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_namespace_resolution(),start of procedure f1::get(),return from a call to f1::get,start of procedure f2::get(),return from a call to f2::get]
codetoanalyze/cpp/shared/namespace/function.cpp, div0_using, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_using(),start of procedure f1::get0(),return from a call to f1::get0]
codetoanalyze/cpp/shared/namespace/function.cpp, type_alias_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure type_alias_div0()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/namespace/function.cpp, using_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure using_div0(),start of procedure ret_zero,return from a call to f3::C::ret_zero]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/namespace/global_variable.cpp, div0_namepace_res, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_namepace_res()]
codetoanalyze/cpp/shared/namespace/global_variable.cpp, div0_static_field, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_static_field()]
codetoanalyze/cpp/shared/namespace/global_variable.cpp, div0_static_field_member_access, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_static_field_member_access()]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, conditional_init_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure conditional_init_div0(),Condition is true,Taking true branch]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, function_call_init_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure function_call_init_div0(),start of procedure get1(),return from a call to get1,Taking true branch]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, reference_init_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_init_div0(),Taking true branch]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, simple_inif_elseif_div0, 6, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure simple_inif_elseif_div0(),Taking false branch,Taking false branch]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, simple_init_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure simple_init_div0(),Taking false branch]
codetoanalyze/cpp/shared/nestedoperators/var_decl_inside_if.cpp, simple_init_null_deref, 4, NULL_DEREFERENCE, B1, ERROR, [start of procedure simple_init_null_deref(),Taking false branch]
codetoanalyze/cpp/shared/npe/method_call.cpp, npe_call, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure npe_call()]
codetoanalyze/cpp/shared/npe/method_call.cpp, npe_call_after_call, 0, NULL_DEREFERENCE, B5, ERROR, [start of procedure npe_call_after_call(),start of procedure getX(),return from a call to getX]
codetoanalyze/cpp/shared/npe/method_call.cpp, npe_call_with_forward_declaration, 1, NULL_DEREFERENCE, B1, ERROR, [start of procedure npe_call_with_forward_declaration(),start of procedure call_with_forward_declaration()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ptr_F_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ptr_F_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ptr,return from a call to reference_field::Ptr::Ptr]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ptr_I_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ptr_I_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ptr,return from a call to reference_field::Ptr::Ptr]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ptr_getF_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ptr_getF_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ptr,return from a call to reference_field::Ptr::Ptr,start of procedure getF,return from a call to reference_field::Ptr::getF]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ptr_getI_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ptr_getI_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ptr,return from a call to reference_field::Ptr::Ptr,start of procedure getI,return from a call to reference_field::Ptr::getI]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ref_F_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ref_F_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ref,return from a call to reference_field::Ref::Ref]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ref_I_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ref_I_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ref,return from a call to reference_field::Ref::Ref]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ref_getF_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ref_getF_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ref,return from a call to reference_field::Ref::Ref,start of procedure getF,return from a call to reference_field::Ref::getF]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::ref_getI_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::ref_getI_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Ref,return from a call to reference_field::Ref::Ref,start of procedure getI,return from a call to reference_field::Ref::getI]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::val_F_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::val_F_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Val,start of procedure X,return from a call to reference_field::X::X,return from a call to reference_field::Val::Val]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::val_I_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::val_I_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Val,start of procedure X,return from a call to reference_field::X::X,return from a call to reference_field::Val::Val]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::val_getF_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::val_getF_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Val,start of procedure X,return from a call to reference_field::X::X,return from a call to reference_field::Val::Val,start of procedure getF,return from a call to reference_field::Val::getF]
codetoanalyze/cpp/shared/reference/reference_field.cpp, reference_field::val_getI_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure reference_field::val_getI_div0(),start of procedure X,return from a call to reference_field::X::X,start of procedure Val,start of procedure X,return from a call to reference_field::X::X,return from a call to reference_field::Val::Val,start of procedure getI,return from a call to reference_field::Val::getI]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, field_div0_ptr, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure field_div0_ptr(),Taking true branch,start of procedure set_field_ptr(),return from a call to set_field_ptr,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, field_div0_ref, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure field_div0_ref(),start of procedure set_field_ref(),return from a call to set_field_ref,start of procedure div]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, get_global_ptr_div0_field, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure get_global_ptr_div0_field(),start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure nonzero,return from a call to X::nonzero,start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, get_global_ptr_div0_method, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure get_global_ptr_div0_method(),start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure zero,return from a call to X::zero,start of procedure get_global_ptr(),return from a call to get_global_ptr,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, get_global_ref_div0_field, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure get_global_ref_div0_field(),start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure nonzero,return from a call to X::nonzero,start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, get_global_ref_div0_method, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure get_global_ref_div0_method(),start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure zero,return from a call to X::zero,start of procedure get_global_ref(),return from a call to get_global_ref,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, method_div0_ptr, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure method_div0_ptr(),Taking true branch,start of procedure zero_ptr(),start of procedure zero,return from a call to X::zero,return from a call to zero_ptr,start of procedure div]
codetoanalyze/cpp/shared/reference/reference_struct_e2e.cpp, method_div0_ref, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure method_div0_ref(),start of procedure zero_ref(),start of procedure zero,return from a call to X::zero,return from a call to zero_ref,start of procedure div]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ptr_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ptr_div0()]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ptr_div0_function, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ptr_div0_function(),start of procedure zero_ptr(),return from a call to zero_ptr]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ptr_div0_function_temp_var, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ptr_div0_function_temp_var(),start of procedure zero_ptr(),return from a call to zero_ptr]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ref_div0, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ref_div0()]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ref_div0_function, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ref_div0_function(),start of procedure zero_ref(),return from a call to zero_ref]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ref_div0_function_temp_var, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ref_div0_function_temp_var(),start of procedure zero_ref(),return from a call to zero_ref]
codetoanalyze/cpp/shared/reference/reference_type_e2e.cpp, ref_div0_nested_assignment, 6, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure ref_div0_nested_assignment()]
codetoanalyze/cpp/shared/reference/temporary_lvalue.cpp, div0_function_param_cast, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_function_param_cast(),start of procedure div()]
codetoanalyze/cpp/shared/reference/temporary_lvalue.cpp, div0_init_expr, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_init_expr(),start of procedure div()]
codetoanalyze/cpp/shared/reference/temporary_lvalue.cpp, div0_no_const_ref, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_no_const_ref(),start of procedure div()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/templates/class_specialization.cpp, class_specialization::foo_int, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure class_specialization::foo_int(),start of procedure Derived,start of procedure Base,return from a call to class_specialization::Base<int>::Base,return from a call to class_specialization::Derived<int>::Derived,start of procedure foo,return from a call to class_specialization::Derived<int>::foo]
codetoanalyze/cpp/shared/templates/class_specialization.cpp, class_specialization::foo_intptr, 3, NULL_DEREFERENCE, B1, ERROR, [start of procedure class_specialization::foo_intptr(),start of procedure Derived,start of procedure Base,return from a call to class_specialization::Base<int*>::Base,return from a call to class_specialization::Derived<int*>::Derived,start of procedure foo2,return from a call to class_specialization::Derived<int*>::foo2]
codetoanalyze/cpp/shared/templates/class_template_instantiate.cpp, ExecStore<Choose2>::call_div, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure call_div,start of procedure div]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/templates/class_template_instantiate.cpp, choose1_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure choose1_div0(),start of procedure call_div,start of procedure div]
codetoanalyze/cpp/shared/templates/class_template_instantiate.cpp, choose2_div0_extra, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure choose2_div0_extra(),start of procedure extra]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/templates/function.cpp, function::createAndDiv<function::X3>, 1, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure function::createAndDiv<function::X3>(),start of procedure function::createAndGetVal<function::X3>(),start of procedure X3,return from a call to function::X3::X3,start of procedure function::getVal<function::X3>(),start of procedure get,return from a call to function::X3::get,return from a call to function::getVal<function::X3>,return from a call to function::createAndGetVal<function::X3>]
codetoanalyze/cpp/shared/templates/function.cpp, function::div0_create_and_get_val, 1, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure function::div0_create_and_get_val(),start of procedure function::createAndGetVal<function::X1>(),start of procedure X1,return from a call to function::X1::X1,start of procedure function::getVal<function::X1>(),start of procedure getVal,return from a call to function::X1::getVal,return from a call to function::getVal<function::X1>,return from a call to function::createAndGetVal<function::X1>,start of procedure function::createAndGetVal<function::X3>(),start of procedure X3,return from a call to function::X3::X3,start of procedure function::getVal<function::X3>(),start of procedure get,return from a call to function::X3::get,return from a call to function::getVal<function::X3>,return from a call to function::createAndGetVal<function::X3>]
codetoanalyze/cpp/shared/templates/function.cpp, function::div0_get_val, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure function::div0_get_val(),start of procedure X1,return from a call to function::X1::X1,start of procedure X3,return from a call to function::X3::X3,start of procedure function::getVal<function::X1>(),start of procedure getVal,return from a call to function::X1::getVal,return from a call to function::getVal<function::X1>,start of procedure function::getVal<function::X3>(),start of procedure get,return from a call to function::X3::get,return from a call to function::getVal<function::X3>]
[clang] change the way we wire up return statements Summary: Split the translation of return more aggressively between: 1. the instruction that has to happen before the translation of the sub-expr 2. the sub-expr 3. the instruction that has to happen after the sub-expr This is needed for the next diff which creates potentially large CFGs in (2). Reviewed By: da319 Differential Revision: D24954071 fbshipit-source-id: a7e7e2527
4 years ago
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_10args, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_10args(),start of procedure div<5ae447456b906d06>(),start of procedure div<int,_int,_int,_int,_int,_int,_int,_int>(),start of procedure div<int,_int,_int,_int,_int,_int,_int>(),start of procedure div<int,_int,_int,_int,_int,_int>(),start of procedure div<int,_int,_int,_int,_int>(),start of procedure div<int,_int,_int,_int>(),start of procedure div<int,_int,_int>(),start of procedure div<int,_int>(),start of procedure div<int>(),start of procedure div(),return from a call to div,return from a call to div<int>]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_1arg, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_1arg(),start of procedure div()]
[clang] change the way we wire up return statements Summary: Split the translation of return more aggressively between: 1. the instruction that has to happen before the translation of the sub-expr 2. the sub-expr 3. the instruction that has to happen after the sub-expr This is needed for the next diff which creates potentially large CFGs in (2). Reviewed By: da319 Differential Revision: D24954071 fbshipit-source-id: a7e7e2527
4 years ago
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_3args1, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_3args1(),start of procedure div<int,_int>(),start of procedure div<int>(),start of procedure div(),return from a call to div,return from a call to div<int>]
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_3args2, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_3args2(),start of procedure div<int,_int>(),start of procedure div<int>(),start of procedure div(),return from a call to div]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_3args3, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_3args3(),start of procedure div<int,_int>(),start of procedure div<int>(),start of procedure div()]
codetoanalyze/cpp/shared/templates/function_pack.cpp, div0_3args4, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_3args4(),start of procedure div<int,_int>(),start of procedure div<int>(),start of procedure div()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/templates/method.cpp, method::div0_getter, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure method::div0_getter(),start of procedure X2,return from a call to method::X2::X2,start of procedure Getter,return from a call to method::Getter::Getter,start of procedure get<method::X2>,start of procedure get,return from a call to method::X2::get,return from a call to method::Getter::get<method::X2>]
codetoanalyze/cpp/shared/templates/method.cpp, method::div0_getter_templ, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure method::div0_getter_templ(),start of procedure X2,return from a call to method::X2::X2,start of procedure X3,return from a call to method::X3::X3,start of procedure GetterTempl,return from a call to method::GetterTempl<method::X3>::GetterTempl,start of procedure get<method::X2>,start of procedure get,return from a call to method::X3::get,start of procedure get,return from a call to method::X2::get,return from a call to method::GetterTempl<method::X3>::get<method::X2>]
codetoanalyze/cpp/shared/templates/method.cpp, method::div0_getter_templ2, 4, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure method::div0_getter_templ2(),start of procedure X2,return from a call to method::X2::X2,start of procedure X2,return from a call to method::X2::X2,start of procedure GetterTempl,return from a call to method::GetterTempl<method::X2>::GetterTempl,start of procedure get<method::X2>,start of procedure get,return from a call to method::X2::get,start of procedure get,return from a call to method::X2::get,return from a call to method::GetterTempl<method::X2>::get<method::X2>]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/types/const.cpp, call_const_params_with_pointer1, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure call_const_params_with_pointer1(),start of procedure const_in_param1()]
codetoanalyze/cpp/shared/types/const.cpp, call_const_params_with_pointer2, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure call_const_params_with_pointer2(),start of procedure const_in_param2()]
codetoanalyze/cpp/shared/types/const.cpp, call_const_params_with_pointer3, 2, NULL_DEREFERENCE, B1, ERROR, [start of procedure call_const_params_with_pointer3(),start of procedure const_in_param2()]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/types/inheritance_casts.cpp, inheritance_casts::div0_A, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure inheritance_casts::div0_A(),start of procedure inheritance_casts::getA(),start of procedure A,return from a call to inheritance_casts::A::A,start of procedure A,return from a call to inheritance_casts::A::A,Skipping ~A: method has no implementation,return from a call to inheritance_casts::getA,start of procedure inheritance_casts::div()]
codetoanalyze/cpp/shared/types/inheritance_casts.cpp, inheritance_casts::div0_B, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure inheritance_casts::div0_B(),start of procedure inheritance_casts::getB(),start of procedure B,start of procedure A,return from a call to inheritance_casts::A::A,return from a call to inheritance_casts::B::B,start of procedure B,start of procedure A,return from a call to inheritance_casts::A::A,return from a call to inheritance_casts::B::B,Skipping ~B: method has no implementation,return from a call to inheritance_casts::getB,start of procedure inheritance_casts::div()]
[tests] record error bucket in expected output Summary: It's useful to test that the bucket a given error is classified as doesn't change over time without notice. This records the bucket for *all* the tests, even though some never produce a bucket. This is to be on the safe size instead of risking to forget adding the bucket information when the test changes, or when copy/pasting from a test that doesn't have buckets to one that does. The implementation is pretty crude: it greps the beginning of the qualifier string for a `[bucket]`. Reviewed By: mbouaziz Differential Revision: D8236393 fbshipit-source-id: b3b1eb9
7 years ago
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_b1, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_b1()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_b1_s, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_b1_s()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_b2, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_b2()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_cast, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_cast()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_cast_ref, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_cast_ref()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_s, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_s()]
codetoanalyze/cpp/shared/types/inheritance_field.cpp, div0_s_b1, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_s_b1()]
codetoanalyze/cpp/shared/types/operator_overload.cpp, div0_function_op, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_function_op(),start of procedure operator*(),return from a call to operator*]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/types/operator_overload.cpp, div0_inheritted_op, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_inheritted_op(),start of procedure operator[],return from a call to X::operator[]]
codetoanalyze/cpp/shared/types/operator_overload.cpp, div0_method, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_method(),start of procedure operator[],return from a call to X::operator[]]
codetoanalyze/cpp/shared/types/operator_overload.cpp, div0_method_op, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_method_op(),start of procedure operator[],return from a call to X::operator[]]
codetoanalyze/cpp/shared/types/operator_overload.cpp, div0_method_op_ptr, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure div0_method_op_ptr(),start of procedure operator[],return from a call to X::operator[]]
[clang] destroy C++ temporaries Summary: Inject destructor calls to destroy a temporary when its lifetime ends. Reviewed By: mbouaziz Differential Revision: D15674209 fbshipit-source-id: 0f783a906
6 years ago
codetoanalyze/cpp/shared/types/return_struct.cpp, return_struct::get_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure return_struct::get_div0(),start of procedure return_struct::get(),start of procedure X,return from a call to return_struct::X::X,start of procedure X,return from a call to return_struct::X::X,Skipping ~X: method has no implementation,return from a call to return_struct::get,start of procedure X,return from a call to return_struct::X::X,Skipping ~X: method has no implementation]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/shared/types/return_struct.cpp, return_struct::get_field_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure return_struct::get_field_div0(),start of procedure return_struct::get(),start of procedure X,return from a call to return_struct::X::X,start of procedure X,return from a call to return_struct::X::X,Skipping ~X: method has no implementation,return from a call to return_struct::get,Skipping ~X: method has no implementation,start of procedure return_struct::get(),start of procedure X,return from a call to return_struct::X::X,start of procedure X,return from a call to return_struct::X::X,Skipping ~X: method has no implementation,return from a call to return_struct::get,Skipping ~X: method has no implementation]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/types/return_struct.cpp, return_struct::get_method_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure return_struct::get_method_div0(),start of procedure return_struct::get(),start of procedure X,return from a call to return_struct::X::X,start of procedure X,return from a call to return_struct::X::X,Skipping ~X: method has no implementation,return from a call to return_struct::get,start of procedure div]
codetoanalyze/cpp/shared/types/struct_forward_declare.cpp, struct_forward_declare::X_Y_div0, 7, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_forward_declare::X_Y_div0(),start of procedure X,return from a call to struct_forward_declare::X::X,Taking false branch,start of procedure getF,return from a call to struct_forward_declare::X::getF]
codetoanalyze/cpp/shared/types/struct_forward_declare.cpp, struct_forward_declare::X_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_forward_declare::X_div0(),start of procedure X,return from a call to struct_forward_declare::X::X,start of procedure getF,return from a call to struct_forward_declare::X::getF]
codetoanalyze/cpp/shared/types/struct_forward_declare.cpp, struct_forward_declare::X_ptr_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_forward_declare::X_ptr_div0(),start of procedure getF,return from a call to struct_forward_declare::X::getF]
codetoanalyze/cpp/shared/types/struct_forward_declare.cpp, struct_forward_declare::Z_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_forward_declare::Z_div0(),start of procedure Z,return from a call to struct_forward_declare::Z::Z,start of procedure getF,return from a call to struct_forward_declare::Z::getF]
codetoanalyze/cpp/shared/types/struct_forward_declare.cpp, struct_forward_declare::Z_ptr_div0, 5, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_forward_declare::Z_ptr_div0(),start of procedure getF,return from a call to struct_forward_declare::Z::getF]
codetoanalyze/cpp/shared/types/struct_pass_by_value.cpp, struct_pass_by_value::field_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_pass_by_value::field_div0(),start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure Y,start of procedure X,return from a call to struct_pass_by_value::X::X,return from a call to struct_pass_by_value::Y::Y,start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure struct_pass_by_value::get_f(),return from a call to struct_pass_by_value::get_f]
codetoanalyze/cpp/shared/types/struct_pass_by_value.cpp, struct_pass_by_value::param_get_copied_div0, 3, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_pass_by_value::param_get_copied_div0(),start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure struct_pass_by_value::set_f(),return from a call to struct_pass_by_value::set_f]
[clang] deal with conditionally-destroyed temporaries Summary: This was left as a TODO before: where to place calls to destructors for C++ temporaries that are only conditionally creating when evaluating an expression. This can happen inside the branches of a conditional operation `b?e:f` or in potentially-short-circuited conditions on the righ-hand side of `&&` and `||` operators. Following the compilation scheme of clang (observed by looking at the generated LLVM bitcode), we instrument the program with "marker" variables, so that for instance `X x = true?X():y;` becomes (following the execution on the true branch): ``` marker1 = 0; // initialize all markers to 0 PRUNE(true) // entering true branch X::X(&temporary); // create temporary... marker1 = 1; // ...triggers setting its marker to 1 X::X(&x, &temporary); // finish expression if (marker1) { X::~X(&temporary); // conditionally destroy the temporary } ``` In this diff, you'll find code for: - associating markers to temporaries that need them - code to initialize markers to 0 before full-expressions - code to conditionally destroy temporaries based on the values of the markers once the full-expression has finished evaluating Reviewed By: da319 Differential Revision: D24954070 fbshipit-source-id: cf15df7f7
4 years ago
codetoanalyze/cpp/shared/types/struct_pass_by_value.cpp, struct_pass_by_value::temp_div0, 0, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_pass_by_value::temp_div0(),start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure struct_pass_by_value::get_f(),return from a call to struct_pass_by_value::get_f,Skipping ~X: method has no implementation]
RFC: stop using _ to separate ObjC/C++ class name from method in Typ.Procname.to_string Reviewed By: jvillard Differential Revision: D14736442 fbshipit-source-id: 500df354b
6 years ago
codetoanalyze/cpp/shared/types/struct_pass_by_value.cpp, struct_pass_by_value::var_div0, 2, DIVIDE_BY_ZERO, no_bucket, ERROR, [start of procedure struct_pass_by_value::var_div0(),start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure X,return from a call to struct_pass_by_value::X::X,start of procedure struct_pass_by_value::get_f(),return from a call to struct_pass_by_value::get_f]