Lines Matching +full:fine +full:- +full:tuning
1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
13 <!--#include virtual="menu.html.incl"-->
21 <p>The static analyzer engine performs path-sensitive exploration of the program and
25 (<a href="https://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">slides</a>
31 <a href="https://discourse.llvm.org/c/clang/static-analyzer/"> Static Analyzer</a> subcategory at
62 <li>To check out the source code and build the project, follow steps 1-4 of
81 $ <b>clang -cc1 -analyze -analyzer-checker=core.DivideZero test.c</b>
86 $ <b>clang -cc1 -analyzer-checker-help</b>
89 <li>See the analyzer help for different output formats, fine tuning, and
92 $ <b>clang -cc1 -help | grep "analyzer"</b>
112 kind means that the state is the result of purging dead symbols - the
118 <li><tt>Environment</tt> - a mapping from source code expressions to symbolic
120 <li><tt>Store</tt> - a mapping from memory locations to symbolic values
121 <li><tt>GenericDataMap</tt> - constraints on symbolic values
127 Checkers are not merely passive receivers of the analyzer core changes - they
129 <tt>GenericDataMap</tt> which can be used to store the checker-defined part
200 Afterwards, when we do the lvalue-to-rvalue conversion, we get a new <tt>SVal</tt>,
225 <!--
230 -->
236 <li>Can the check be effectively implemented without path-sensitive
245 inter-procedural analysis). Also, it uses a simple range tracking based
249 href="https://github.com/llvm/llvm-project/labels/clang%3Astatic%20analyzer">GitHub Issues</a>
260 <li> What checker-specific data needs to be stored as part of the program
304 <br> <tt><b>$clang -cc1 -analyzer-checker-help</b></tt>
330 <li>When values go out of scope, check whether they are still-open file
346 The high-level structure of the checker's class is thus:
424 int currentlValue = state->get<ExampleDataType>(Sym);
434 ProgramStateRef newState = state->set<ExampleDataType>(Sym, newValue);
456 contain top-level namespace references), and the data types that they define
478 summary page generated by the scan-build tool.
486 the detailed line-by-line output generated by scan-build.
510 into a so-called <i>sink node</i>, a node from which no further analysis will be
523 Some checks might not require path-sensitivity to be effective. Simple AST walk
535 $ <b>bin/llvm-lit -sv ../llvm/tools/clang/test/Analysis</b>
542 <p>When your command contains the <tt><b>-cc1</b></tt> flag, you can attach the
546 $ <b>gdb --args clang -cc1 -analyze -analyzer-checker=core test.c</b>
547 $ <b>lldb -- clang -cc1 -analyze -analyzer-checker=core test.c</b>
551 Otherwise, if your command line contains <tt><b>--analyze</b></tt>,
553 order to debug it, use the <tt><b>-###</b></tt> flag for obtaining
558 $ <b>clang --analyze test.c -\#\#\#</b>
563 you are running <tt><b>clang -cc1</b></tt>.
568 <p>While investigating a checker-related issue, instruct the analyzer to only
572 $ <b>clang -cc1 -analyze -analyzer-checker=osx.KeychainAPI test.c</b>
576 processing a large file use the <tt><b>-analyzer-display-progress</b></tt>
580 <tt><b>-analyze-function</b></tt> option:</p>
582 $ <b>clang -cc1 -analyze -analyzer-checker=core test.c -analyzer-display-progress</b>
587 …$ <b>clang -cc1 -analyze -analyzer-checker=core test.c -analyzer-display-progress -analyze-functio…
593 C++ functions and methods, Objective-C methods and blocks, e.g.:
596 $ <b>clang -cc1 -analyze -analyzer-checker=core test.cc -analyze-function='foo(int)'</b>
600 <tt><b>-analyzer-display-progress</b></tt> output.
607 <tt><b>-analyzer-config prune-paths=false</b></tt> option.
614 $ <b>clang -cc1 -ast-dump test.c</b>
620 $ <b>clang -cc1 -analyze -analyzer-checker=debug.ViewCFG test.c</b>
626 $ <b>clang -cc1 -analyze -analyzer-checker=debug.ViewExplodedGraph test.c</b>
628 <p>Or, equivalently, with <tt><b>-analyzer-viz-egraph-graphviz</b></tt>
629 option, which does the same thing - dumps the exploded graph in graphviz
632 <p>You can convert <tt><b>.dot</b></tt> files into other formats - in
636 $ <b>dot -Tsvg ExprEngine-501e2e.dot -o ExprEngine-501e2e.svg</b>
639 <p>The <tt><b>-trim-egraph</b></tt> option removes all paths except those
650 $ <b>clang -cc1 -analyzer-checker-help | grep "debug"</b>
655 <p>To view "half-baked" <tt>ExplodedGraph</tt> while debugging, jump to a frame
663 (gdb) <b>p State->dump()</b>
670 (gdb) <b>p E->dump()</b>
676 (gdb) <b>p C.getPredecessor()->getCodeDecl().getBody()->dump()</b>
683 non-analyzer-developers in <tt>Checkers.td</tt>.</li>
688 <li>Articles are usually omitted, eg. <tt>Dereference of a null pointer</tt> ->
708 …<li>Simplify <tt>C.getState()->getSVal(E, C.getLocationContext())</tt> to <tt>C.getSVal(E)</tt>.</…
712 <li><tt>CallEvent::getOriginExpr</tt> is nullable - for example, it returns null for an
715 <li><tt>CallEvent::getDecl</tt> is nullable - for example, it returns null for a
720 return arguments crash when the argument is out-of-bounds. If you checked the function name,
729 …<li>Is <tt>-analyzer-checker=core</tt> included in all test <tt>RUN:</tt> lines? It was never supp…
739 …<li>In <tt>State->getSVal(Region)</tt>, if <tt>Region</tt> is not known to be a <tt>TypedValueRegi…
746 <tt>NonLoc</tt> or <tt>Unknown</tt>/<tt>Undefined</tt> is totally fine.</li>
762 paths needs to be dropped entirely. For example, it is fine to eagerly split
775 <li>When implementing <tt>evalAssume</tt>, the checker should always return a non-null state
779 Under no circumstances should they change non-<tt>Unknown</tt> values of expressions.
793 <li><a href="https://github.com/llvm/llvm-project/blob/main/clang/lib/StaticAnalyzer/README.txt">
795 <li><a href="https://github.com/llvm/llvm-project/blob/main/clang/docs/analyzer/developer-docs/Regi…
797 <li><a href="https://github.com/llvm/llvm-project/blob/main/clang/docs/analyzer/developer-docs/IPA.…
800 href="https://llvm.org/devmtg/2012-11">November 2012 LLVM Developer's
802 href="https://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">Slides</a>
807 <a href="https://github.com/haoNoQ/clang-analyzer-guide/releases/download/v0.1/clang-analyzer-guide…
812 up-to-date documentation about the APIs available in Clang. Relevant entries
820 <a href="https://discourse.llvm.org/c/clang/static-analyzer/"> Static Analyzer subcategory</a>
822 <a href="https://lists.llvm.org/pipermail/cfe-dev/"> cfe-dev</a> mailing list, which is now