Lines Matching +full:case +full:- +full:sensitive
5 inlining. The major one is ``-analyzer-config ipa``:
7 * ``analyzer-config ipa=none`` - All inlining is disabled. This is the only mode
10 * ``analyzer-config ipa=basic-inlining`` - Turns on inlining for C functions, C++
11 static member functions, and blocks -- essentially, the calls that behave
15 * ``analyzer-config ipa=inlining`` - Turns on inlining when we can confidently find
17 functions, devirtualized C++ methods, Objective-C class methods, Objective-C
21 * ``analyzer-config ipa=dynamic`` - Inline instance methods for which the type is
25 * ``analyzer-config ipa=dynamic-bifurcate`` - Same as -analyzer-config ipa=dynamic,
30 Currently, ``-analyzer-config ipa=dynamic-bifurcate`` is the default mode.
32 While ``-analyzer-config ipa`` determines in general how aggressively the analyzer
34 functions can inlined, in an all-or-nothing way. These options use the
37 ``-analyzer-config OPTION=VALUE``
39 c++-inlining
40 ------------
44 ``-analyzer-config c++-inlining=[none | methods | constructors | destructors]``
50 The default c++-inlining mode is 'destructors', meaning that all member
54 Note that under 'constructors', constructors for types with non-trivial
56 inlined under -analyzer-config ipa=none or -analyzer-config ipa=basic-inlining,
57 regardless of the setting of the c++-inlining mode.
59 c++-template-inlining
64 ``-analyzer-config c++-template-inlining=[true | false]``
73 c++-stdlib-inlining
80 ``-analyzer-config c++-stdlib-inlining=[true | false]``
91 c++-container-inlining
97 ``-analyzer-config c++-container-inlining=[true | false]``
105 fairly poor job of modeling certain data structure invariants of container-like
109 .. code-block:: cpp
122 ------------------------
124 The low-level mechanism of inlining a function is handled in
141 call. (In the case of calls without origin expressions, such as destructors,
150 5. Custom post-call checks are processed and the final nodes are pushed back
159 Currently, we use this technique to recover coverage in case we stop
166 path is then re-analyzed from that point without inlining that particular call.
175 - If there is no definition available for the called function or method. In
176 this case, there is no opportunity to inline.
178 - If the CFG cannot be constructed for a called function, or the liveness
182 - If the LocationContext chain for a given ExplodedNode reaches a maximum cutoff
186 - If the function is variadic. This is not a hard limitation, but an engineering
191 - In C++, constructors are not inlined unless the destructor call will be
198 - In C++, ExprEngine does not inline custom implementations of operator 'new'
202 - Calls resulting in "dynamic dispatch" are specially handled. See more below.
204 - The FunctionSummaries map stores additional information about declarations,
215 method calls and Objective-C message sends. Due to the path-sensitive nature of
219 This path-sensitive devirtualization occurs when the analyzer can determine what
221 information is constrained enough for a simulated C++/Objective-C object that
231 Such type information is tracked as DynamicTypeInfo. This is path-sensitive
258 ProgramState to attempt to devirtualize the call. In the case of no dynamic
263 In the case of dynamic dispatch where our information is not perfect, CallEvent
266 corresponding to the object being called (i.e., the "receiver" in Objective-C
273 The -analyzer-config ipa option has five different modes: none, basic-inlining,
274 inlining, dynamic, and dynamic-bifurcate. Under -analyzer-config ipa=dynamic,
276 actually be the definition used at runtime. Under -analyzer-config ipa=inlining,
277 only "near-perfect" devirtualized calls are inlined*, and other dynamic calls
280 * Currently, no Objective-C messages are not inlined under
281 -analyzer-config ipa=inlining, even if we are reasonably confident of the type
285 The last option, -analyzer-config ipa=dynamic-bifurcate, behaves similarly to
286 "dynamic", but performs a conservative invalidation in the general virtual case
289 As stated above, -analyzer-config ipa=basic-inlining does not inline any C++
290 member functions or Objective-C method calls, even if they are non-virtual or
297 ExprEngine::BifurcateCall implements the ``-analyzer-config ipa=dynamic-bifurcate``
303 RuntimeDefinition object) with a path-sensitive "mode" in the ProgramState.
307 * ``DynamicDispatchModeInlined`` - Models the case where the dynamic type information
314 * ``DynamicDispatchModeConservative`` - Models the case where the dynamic type
331 Objective-C Message Heuristics
334 ExprEngine relies on a set of heuristics to partition the set of Objective-C
339 - If the object was created with +alloc or +new and initialized with an -init
342 - If the calls are property accesses using dot syntax. This is based on the
346 - If the class interface is declared inside the main source file. In this case
349 - If the method is not declared outside of main source file, either by the
379 code. It is path-sensitive, containing both the current state (ProgramStateRef)
393 CallEvents are reference-counted objects managed by a CallEventManager. While
395 they are intended for short-lived use, and can be recreated from CFGElements or
396 non-top-level StackFrameContexts fairly easily.