9c14e9d384
[Cost] Fix multiplication by 1
...
Reviewed By: ddino
Differential Revision: D7782184
fbshipit-source-id: dd3c4f1
7 years ago
077d9a534b
[objc frontend] Do not assume that the fast enumeration in ObjC always includes a declaration of the loop variable
...
Reviewed By: sblackshear
Differential Revision: D7831531
fbshipit-source-id: 7d0c816
7 years ago
0bbdf63957
[clang] do not attempt to translate pointer to member constructs
...
Summary:
C++...
seemsalittlecrazy
Reviewed By: sblackshear
Differential Revision: D7815648
fbshipit-source-id: f36ac4f
7 years ago
d4337abcb4
Added predicate for C++ copy constructors
...
Reviewed By: dulmarod
Differential Revision: D7829738
fbshipit-source-id: 73be42f
7 years ago
038c0b92d4
[objc frontend] Raise SelfClassException only inside ObjCMethodCallExpr nodes
...
Reviewed By: jvillard
Differential Revision: D7816329
fbshipit-source-id: 3b46ef5
7 years ago
d718275402
[quandary] fix test expected output
...
Reviewed By: da319, dulmarod
Differential Revision: D7830213
fbshipit-source-id: b754f4b
7 years ago
6b8900746b
[quandary] only treat overrides of service methods as endpoints
...
Reviewed By: jeremydubreil
Differential Revision: D7813903
fbshipit-source-id: 7d77f6a
7 years ago
4b4517e8ec
[clang] call a skip function in case of unimplemented feature
...
Summary: Returning the list of sub-expressions is not right and can cause assertion failures elsewhere in the frontend.
Reviewed By: dulmarod
Differential Revision: D7813493
fbshipit-source-id: 33ac9c1
7 years ago
dab8e2f17d
[starvation] Catch indirect blocks to the UI thread
...
Reviewed By: jeremydubreil
Differential Revision: D7774011
fbshipit-source-id: fe014b6
7 years ago
d92e82b379
[clang] fix translation of `UserDefinedLiteral`
...
Summary: User-defined literals are really just function calls.
Reviewed By: sblackshear
Differential Revision: D7813464
fbshipit-source-id: c9302b9
7 years ago
e0a61c0a4a
[starvation] Move to a cluster checker phase for reporting
...
Reviewed By: jeremydubreil
Differential Revision: D7757783
fbshipit-source-id: 341de51
7 years ago
30d7239aff
[quandary] SQL sinks for java
...
Reviewed By: jeremydubreil
Differential Revision: D7799801
fbshipit-source-id: 002079d
7 years ago
ffba5de70c
[quandary] distinguish between SQL reads and writes
...
Reviewed By: mbouaziz
Differential Revision: D7781377
fbshipit-source-id: 9c76e4d
7 years ago
c80a2b0940
Test Determinator for MobileLab
...
Reviewed By: martinoluca
Differential Revision: D7709133
fbshipit-source-id: ffb2db2
7 years ago
69392d4192
[biabduction] Log reasons for skipping also in non Java context
...
Reviewed By: mbouaziz, da319
Differential Revision: D7788663
fbshipit-source-id: 466faed
7 years ago
094eb9dcc7
[Cost] Use OneInstrPerNode CFG
...
Summary:
We want instr-granular invariant maps so let's use the OneInstrPerNode CFG in the AI analyzers.
This requires specializing the TransferFunctions.
Keep using the normal CFG where we only need node-granular informations.
Depends on D7587241
Depends on D7608526
Reviewed By: sblackshear
Differential Revision: D7618320
fbshipit-source-id: 73918f0
7 years ago
73a47d594c
[debug] print procedures in alphabetical order in cfgs
...
Summary:
When looking at large CFGs, at least in `xdot`, it's often difficult to find
the procedure you're looking for. Sorting the proc names puts them in
alphabetical order, which makes searching one procedure easier.
Reviewed By: mbouaziz
Differential Revision: D7758521
fbshipit-source-id: 8e9997f
7 years ago
63aafd3381
[starvation] catch calls to View.getVisibleDisplayFrame
...
Reviewed By: jeremydubreil
Differential Revision: D7758016
fbshipit-source-id: f3ff474
7 years ago
28200b87d7
[objc blocks] Specialize store instructions with current closure in methods specialized with blocks as arguments
...
Reviewed By: mbouaziz, jvillard
Differential Revision: D7744403
fbshipit-source-id: 42ad5f8
7 years ago
e5265ea85b
[starvation] surface caller of blocking calls in reports
...
Reviewed By: jeremydubreil
Differential Revision: D7727380
fbshipit-source-id: 02822ea
7 years ago
8f0701a01c
Refine dependency analysis to remove vars at prune exit nodes
...
Reviewed By: ddino
Differential Revision: D7670952
fbshipit-source-id: 832a639
7 years ago
a4a1a9c55e
[starvation] Catch java IO blocking calls on UI thread
...
Reviewed By: sblackshear
Differential Revision: D7685918
fbshipit-source-id: 0ec46f2
7 years ago
7a9009e467
[starvation] Catch CountDownLatch.await calls on main thread
...
Reviewed By: ddino
Differential Revision: D7671323
fbshipit-source-id: 88fca56
7 years ago
b6c8766b11
[starvation] report binder calls on ui thread
...
Reviewed By: sblackshear
Differential Revision: D7670674
fbshipit-source-id: 15b858c
7 years ago
523c2f539b
change clang translation to track if_kind (i.e. the type of prune node)
...
Reviewed By: ddino
Differential Revision: D7653684
fbshipit-source-id: d731ccf
7 years ago
196c0e5544
[starvation] harmonize java formatting in tests
...
Reviewed By: ddino
Differential Revision: D7667305
fbshipit-source-id: efee0f8
7 years ago
670ae4a673
[quandary] `WebResourceRequest.getUrl` as source
...
Reviewed By: the-st0rm
Differential Revision: D7336116
fbshipit-source-id: 5d458e5
7 years ago
8084c8fec7
[racerd] treat `@InjectProp` formals as owned
...
Reviewed By: ngorogiannis
Differential Revision: D7641152
fbshipit-source-id: 2dac8df
7 years ago
ce8f958522
[racerd] don't report INTERFACE_NOT_THREAD_SAFE if the receiver of the interface call is marked `ThreadConfined`
...
Summary: We already suppress race reports if the field is marked in this way; makes sense to do the same thing for these reports.
Reviewed By: ngorogiannis
Differential Revision: D7589275
fbshipit-source-id: 8f0aeab
7 years ago
0130c09dfc
[starvation] add infrastructure for blocking events other than lock acquisition
...
Reviewed By: ddino
Differential Revision: D7428995
fbshipit-source-id: 5e1185d
7 years ago
269a1a9b93
[starvation] treat locks in (and accessed from) inner classes properly
...
Reviewed By: sblackshear
Differential Revision: D7427659
fbshipit-source-id: 9abf1ad
7 years ago
94aae8713e
[biabduction] Fix lookup of abduced expression
...
Summary: Currently when we look for already abduced expression and find an assertion [exp|->strexp:typexp], we use typexp rather than strexp.
Reviewed By: sblackshear
Differential Revision: D7617193
fbshipit-source-id: c089720
7 years ago
76300d55c7
Tracks variables that affect control flow for a more precise cost analysis
...
Reviewed By: mbouaziz
Differential Revision: D7586777
fbshipit-source-id: 8752679
7 years ago
af5265f75d
"Report infinity as error per function"
...
Reviewed By: mbouaziz
Differential Revision: D7600383
fbshipit-source-id: d6387ca
7 years ago
dee7414aa9
[inferbo] do not include location information in the bug description
...
Summary:
This information is already available in the trace, and can contain absolute
paths to system includes (or infer's own clang runtime), which confuses the
diff analysis.
Reviewed By: mbouaziz
Differential Revision: D7534609
fbshipit-source-id: 5bd8f8b
7 years ago
aa578ea586
[retain cycles] Treat missing fields also angelically when it still happens in rare cases
...
Reviewed By: mbouaziz
Differential Revision: D7550900
fbshipit-source-id: 11703ab
7 years ago
2f1d486aab
[eradicate] model com.google.common.base.Strings.isNullOrEmpty(...)
...
Reviewed By: sblackshear
Differential Revision: D7526376
fbshipit-source-id: da60808
7 years ago
3b608695af
Improving treatment of default constructor
...
Reviewed By: sblackshear
Differential Revision: D7509019
fbshipit-source-id: 69d99a9
7 years ago
74e16bdb58
[retain cycles] Define custom compare function that is more suited to dedup cycles
...
Reviewed By: mbouaziz
Differential Revision: D7517385
fbshipit-source-id: 00e0433
7 years ago
e9a3913fdb
[Inferbo] Do not propagate all safety conditions
...
Reviewed By: skcho
Differential Revision: D7289292
fbshipit-source-id: 999b14a
7 years ago
4234288c93
[inferbo] Add a pointer arithmetic test
...
Reviewed By: mbouaziz
Differential Revision: D7484490
fbshipit-source-id: 8d64016
7 years ago
e12a4a1071
[inferbo] Add traces in lift functions
...
Reviewed By: mbouaziz
Differential Revision: D7484003
fbshipit-source-id: 4411337
7 years ago
1f6feef448
[inferbo] Revise eval_locs for array blocks
...
Summary:
It renames `eval_locs` to `eval_arr` and we use it for getting array block values the given input expressions are pointing to. For example, when given a program variable `x` as an input, `eval_arr` returns array blocks that `x` is pointing to, on the other hand, `eval` returns an abstract location of `x`.
Depends on D7471891
Reviewed By: mbouaziz
Differential Revision: D7471915
fbshipit-source-id: b994944
7 years ago
94c2cd1d3b
[ownership] tests for pointer arithmetic
...
Reviewed By: jeremydubreil
Differential Revision: D7495530
fbshipit-source-id: 0685772
7 years ago
9180ff56c1
[ownership] handle new kinds of access expressions
...
Reviewed By: jeremydubreil
Differential Revision: D7482554
fbshipit-source-id: c511bda
7 years ago
a353d69a6e
[inferbo] Fix test code
...
Reviewed By: mbouaziz
Differential Revision: D7483906
fbshipit-source-id: 128ad17
7 years ago
4aafe8a990
[inferbo][bugfix] Revise gathering safety conditions in sub-exp
...
Reviewed By: mbouaziz
Differential Revision: D7471891
fbshipit-source-id: 2b592b1
7 years ago
b42d66d557
[inferbo][bugfix] Pointer arithmetics on pointers to non-array
...
Summary: In the pointer arithmetics, it returns top, if we cannot precisely follow the physical memory model, e.g., (&x + 1).
Reviewed By: mbouaziz
Differential Revision: D7453510
fbshipit-source-id: db8738e
7 years ago
00e1139071
[frontend] Parse binary operator using types of parameters
...
Summary: It parses "+" (and "-") to PlusA and PlusPI (and MinusA, MinusPI, MinusPP) using types of parameters.
Reviewed By: mbouaziz
Differential Revision: D7443048
fbshipit-source-id: bd560c7
7 years ago
5dea7c55e2
[infer][java] report nullable inconsistencies on library calls
...
Summary:
Report nullable inconsistencies by relying on the bytecode, and not on the presence of analysis summary on disk.
This use the `--external-java-packages` to avoid reporting inconsistencies outside of the codebase.
Reviewed By: sblackshear
Differential Revision: D7481101
fbshipit-source-id: 281135d
7 years ago
681f2a56ab
[HIL] Explicit dereference
...
Reviewed By: sblackshear
Differential Revision: D7350669
fbshipit-source-id: c316188
7 years ago
436e5340f3
[retain cycles] Move the retain cycle check to sym_exec_wrapper to get the path of the last instruction executed
...
Reviewed By: mbouaziz
Differential Revision: D7443580
fbshipit-source-id: 4512675
7 years ago
462c2e2b2e
[starvation] fix handling of static synchronized methods and static locks
...
Reviewed By: sblackshear
Differential Revision: D7427365
fbshipit-source-id: f23795f
7 years ago
b11dd03fb9
[starvation] ignore local/temp variables as locks
...
Reviewed By: sblackshear
Differential Revision: D7420069
fbshipit-source-id: caea591
7 years ago
d15894c78a
[inferbo] Add tests for relational analysis
...
Reviewed By: mbouaziz
Differential Revision: D7427283
fbshipit-source-id: a08bf63
7 years ago
33fe8879a5
[quandary] report flows originating from `UserControlledEndpoint` as `_RISK`
...
Reviewed By: fahndrich
Differential Revision: D7420925
fbshipit-source-id: 5f40cb2
7 years ago
f621dda0be
[infer][clang] models off-by-default
...
Reviewed By: jeremydubreil
Differential Revision: D7350715
fbshipit-source-id: e1d28ef
7 years ago
927e2049c3
[backend] Add getter/setter execution to the trace
...
Reviewed By: mbouaziz, jvillard
Differential Revision: D7428857
fbshipit-source-id: 93018b0
7 years ago
872daf1ba7
Add estimated cost to trace element
...
Reviewed By: mbouaziz
Differential Revision: D7414240
fbshipit-source-id: b30e4d1
7 years ago
b335fb9c50
[deadlock] rebrand to starvation
...
Reviewed By: sblackshear
Differential Revision: D7415034
fbshipit-source-id: a9789eb
7 years ago
44e5d0564b
[ownership] fix false positives on aggregate locals in loops
...
Summary:
If an aggregate `a` has a field `f` whose type has a constructor (e.g., `std::string`), we translate creating a local aggregate `A { "hi" }` as `string(&(a.f), "hi")`.
This diff makes sure that we recognize this as initializing `a`.
Reviewed By: jeremydubreil
Differential Revision: D7404624
fbshipit-source-id: 0ba90a7
7 years ago
2e14f9c9c3
[infer] model android.app.AlarmManager.cancel(PendingIntent) as not accepting a null parameter
...
Reviewed By: sblackshear
Differential Revision: D7378602
fbshipit-source-id: 94281a2
7 years ago
8cfbdef7e0
[infer][biabduction] no longer track the resources saved into a container
...
Reviewed By: sblackshear
Differential Revision: D7387371
fbshipit-source-id: 81f34cc
7 years ago
aabf8aec55
[quandary] use `_risk` warning types for endpoint sources in Java
...
Summary: Matching what we do on the C++ side.
Reviewed By: jeremydubreil
Differential Revision: D7374902
fbshipit-source-id: 7b25e6d
7 years ago
e54df20eb7
Migrate to Itv.Bound
...
Reviewed By: mbouaziz
Differential Revision: D7351195
fbshipit-source-id: 7f4f57b
7 years ago
7efb5cb549
[ownership] allow placement new on non-var expressions
...
Reviewed By: jeremydubreil
Differential Revision: D7368872
fbshipit-source-id: 43b1ad8
7 years ago
57a8c2f594
[quandary] don't taint dummy Thrift `_return` formals
...
Summary: In C++, Thrift implements return values using these. They shouldn't be tainted.
Reviewed By: mbouaziz
Differential Revision: D7362176
fbshipit-source-id: af8e515
7 years ago
6b3282f619
[ownership] First parameter to constructor is read, not written
...
Reviewed By: jeremydubreil
Differential Revision: D7359197
fbshipit-source-id: 239b44d
7 years ago
862bbdb5fc
[retain cycles] Take weak pointers into account to avoid false positives
...
Reviewed By: mbouaziz
Differential Revision: D7323649
fbshipit-source-id: e05a066
7 years ago
f8dfc2305e
[ownership] simple 2-step traces
...
Summary:
Show where the invalidation occurred in the trace.
Should make things easier to understand.
Reviewed By: jeremydubreil
Differential Revision: D7312182
fbshipit-source-id: 44ba9cc
7 years ago
ec73adc66d
[ownership] support placement new
...
Reviewed By: jeremydubreil
Differential Revision: D7269381
fbshipit-source-id: 7867958
7 years ago
245e49e2da
[infer] Eradicate should understand any form of checkNotNull
...
Reviewed By: mbouaziz
Differential Revision: D7286232
fbshipit-source-id: 8046d90
7 years ago
e801617488
[infer][java] Eradicate should not report a Return Not Nullable when a method returns the integer 0
...
Summary: This was causing false positives when returning the constant integer 0.
Reviewed By: sblackshear
Differential Revision: D7330143
fbshipit-source-id: 45d19dd
7 years ago
d04a7aed52
[clang] Removed the mangling part of Clang global variables in the error messages
...
Reviewed By: mbouaziz
Differential Revision: D7292524
fbshipit-source-id: 1127751
7 years ago
6d46b0c7be
[cleanup] stop printing `&`'s on `Var.t`'s
...
Reviewed By: jeremydubreil
Differential Revision: D7299568
fbshipit-source-id: ec7b18f
7 years ago
bd040cf696
[inferbo] Add an issue type for alarms by unknown function call
...
Summary: It adds an issue type, `BUFFER_OVERRUN_U5`, for alarms involving unknown values, i.e., when the trace set includes an unknown function call.
Reviewed By: mbouaziz
Differential Revision: D7178841
fbshipit-source-id: bfe857b
7 years ago
b57aa90d7d
[quandary] don't crash if JSON source/sink is invalid procedure name
...
Summary:
At the moment, Java and Clang sources/sinks live in the same inferconfig entry.
If we try to parse a Java procedure that happens to be an invalid Clang qualified name (e.g., `MyClass.<init>`),
parsing will crash.
As a temporary fix, throw an exception and catch it instead.
In the future, we can avoid this by requiring that JSON source/sink specifications to indicate the language.
Reviewed By: mbouaziz
Differential Revision: D7291880
fbshipit-source-id: f8f4502
7 years ago
4952f1ea3b
[quandary] tests documenting limitations of sanitizers
...
Reviewed By: mbouaziz
Differential Revision: D7257570
fbshipit-source-id: 5f97e31
7 years ago
484480f72f
[deadlock] regression tests
...
Reviewed By: sblackshear
Differential Revision: D7238932
fbshipit-source-id: 923e18e
7 years ago
12ad6c11c1
[ownership] return bottom on early exit or thrown exception
...
Reviewed By: jeremydubreil
Differential Revision: D7230168
fbshipit-source-id: 84f97a5
7 years ago
3a40afcd22
[ownership] directly assigning any field of an aggregate struct counts as initialization
...
Summary:
Aggregate initialization (e.g., `S s{1, 2}`) doesn't invoke a contructor.
Our frontend translates aggregation initialization as assigning to each field in the struct.
To avoid the appearance of the struct being uninitialized, count any assignment to a field of an aggregate struct as initializing the struct.
Reviewed By: jeremydubreil
Differential Revision: D7189671
fbshipit-source-id: ace02fc
7 years ago
0bc4df4b42
[retain cycles] Report cycles after assignment and method call
...
Reviewed By: mbouaziz
Differential Revision: D7256076
fbshipit-source-id: f9c875a
7 years ago
6976181b77
[ownership] special-case frontend-generated inner destructors.
...
Reviewed By: da319
Differential Revision: D7189239
fbshipit-source-id: 7975603
7 years ago
2edc1d8581
[retain cycles] Improve the message of cycles with blocks by adding more info about captured variables
...
Reviewed By: mbouaziz
Differential Revision: D7235627
fbshipit-source-id: b38cb3b
7 years ago
9d844b707a
Use after free false postives due to missing operator++ of hash map iterator
...
Reviewed By: mbouaziz
Differential Revision: D6899153
fbshipit-source-id: dff74d8
7 years ago
426af10130
[inferbo][bugfix] Pruning array block (NE case)
...
Reviewed By: mbouaziz
Differential Revision: D7235584
fbshipit-source-id: 2ef9144
7 years ago
18ea3f99d8
[inferbo][bugfix] Plus semantics of interval domain
...
Summary: It corrects a precision bug in the interval domain, with adding some test cases.
Reviewed By: mbouaziz
Differential Revision: D7230918
fbshipit-source-id: 3ec641a
7 years ago
d720eb52ba
[quandary] check for subclassing in externally specified sources/sinks
...
Reviewed By: jeremydubreil
Differential Revision: D7221876
fbshipit-source-id: 682900e
7 years ago
89a6d7e20d
[racerd] don't report races in third-party code
...
Reviewed By: jeremydubreil
Differential Revision: D7107581
fbshipit-source-id: 87cde65
7 years ago
d74f189dfe
[infer] add the report kind to the list of expected output
...
Reviewed By: dulmarod
Differential Revision: D7209545
fbshipit-source-id: aab32f3
7 years ago
26697704dc
[retain cycles] Example of a cycle that includes a C++ class
...
Reviewed By: mbouaziz
Differential Revision: D7213885
fbshipit-source-id: e460f6a
7 years ago
5898417fdd
[frontend] Getting appropriate type information for exp in sizeof exp
...
Summary:
:
Previously, we did not have information about type of `exp` in `sizeof exp` from clang plugin which led to `Bad_footprint` errors. Infer did not understand `sizeof *p` in `struct Person* p = malloc(sizeof *p);` and used some default type.
This resulted in `Bad_footprint` error when trying to assign to a field `age` in `p->age=42;`.
This diff uses the version of clang plugin which exports the appropriate type information.
update-submodule: facebook-clang-plugins
Reviewed By: dulmarod
Differential Revision: D7179870
fbshipit-source-id: 4104f10
7 years ago
d2cc5e72f7
Extending analysis to parametric case
...
Reviewed By: mbouaziz
Differential Revision: D7179463
fbshipit-source-id: 1711a0e
7 years ago
1977fefaab
[ownership] assume operator= borrows for function types, copies for other types
...
Reviewed By: jeremydubreil
Differential Revision: D7178249
fbshipit-source-id: 17c1469
7 years ago
6f4c08f798
[inferbo][trace] Trace element for Unknown values
...
Summary:
Helps understand the origin of L5 issues.
Depends on D7194479
Reviewed By: skcho
Differential Revision: D7194493
fbshipit-source-id: 901c40d
7 years ago
72ec9516d4
[inferbo][trace] Show some SymAssigns
...
Summary:
Show some `SymAssign`s (corresponding to parameters) in the trace.
Depends on D7194448
Reviewed By: skcho
Differential Revision: D7194479
fbshipit-source-id: 0deff6c
7 years ago
55fee73669
[inferbo][traces] Nits
...
Summary: Preparing for more changes
Reviewed By: skcho
Differential Revision: D7194448
fbshipit-source-id: b80def7
7 years ago
8fd04d5312
[inferbo][bugfix] Add index to offset at array fields
...
Summary: It corrects a bug that `&(x.f[n])` was evaluated to `&(x.f[0])`.
Reviewed By: mbouaziz
Differential Revision: D7179620
fbshipit-source-id: 04cbaa7
7 years ago
469a5f64ed
[inferbo] Simplify realloc model
...
Summary: It simply resizes the target structure instead of allocating new heap memories and copying values.
Reviewed By: mbouaziz
Differential Revision: D7179353
fbshipit-source-id: 9c20f64
7 years ago
4157ba820a
[HIL] Implicit dereference in access expression
...
Reviewed By: sblackshear
Differential Revision: D7153744
fbshipit-source-id: f439e02
7 years ago
Mehdi Bouaziz
Dulma Churchill
Jules Villard
Dino Distefano
Sam Blackshear
Nikos Gorogiannis
Ezgi Çiçek
Daiva Naudziuniene
Jeremy Dubreil
Sungkeun Cho