1 //===--- AnalyzerOptions.h - Analysis Engine Options ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This header defines various options for the static analyzer that are set 11 // by the frontend and are consulted throughout the analyzer. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H 16 #define LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H 17 18 #include "clang/Basic/LLVM.h" 19 #include "llvm/ADT/IntrusiveRefCntPtr.h" 20 #include "llvm/ADT/Optional.h" 21 #include "llvm/ADT/StringMap.h" 22 #include <string> 23 #include <vector> 24 25 namespace clang { 26 class ASTConsumer; 27 class DiagnosticsEngine; 28 class Preprocessor; 29 class LangOptions; 30 31 /// Analysis - Set of available source code analyses. 32 enum Analyses { 33 #define ANALYSIS(NAME, CMDFLAG, DESC, SCOPE) NAME, 34 #include "clang/StaticAnalyzer/Core/Analyses.def" 35 NumAnalyses 36 }; 37 38 /// AnalysisStores - Set of available analysis store models. 39 enum AnalysisStores { 40 #define ANALYSIS_STORE(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 41 #include "clang/StaticAnalyzer/Core/Analyses.def" 42 NumStores 43 }; 44 45 /// AnalysisConstraints - Set of available constraint models. 46 enum AnalysisConstraints { 47 #define ANALYSIS_CONSTRAINTS(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 48 #include "clang/StaticAnalyzer/Core/Analyses.def" 49 NumConstraints 50 }; 51 52 /// AnalysisDiagClients - Set of available diagnostic clients for rendering 53 /// analysis results. 54 enum AnalysisDiagClients { 55 #define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATFN) PD_##NAME, 56 #include "clang/StaticAnalyzer/Core/Analyses.def" 57 PD_NONE, 58 NUM_ANALYSIS_DIAG_CLIENTS 59 }; 60 61 /// AnalysisPurgeModes - Set of available strategies for dead symbol removal. 62 enum AnalysisPurgeMode { 63 #define ANALYSIS_PURGE(NAME, CMDFLAG, DESC) NAME, 64 #include "clang/StaticAnalyzer/Core/Analyses.def" 65 NumPurgeModes 66 }; 67 68 /// AnalysisInlineFunctionSelection - Set of inlining function selection heuristics. 69 enum AnalysisInliningMode { 70 #define ANALYSIS_INLINING_MODE(NAME, CMDFLAG, DESC) NAME, 71 #include "clang/StaticAnalyzer/Core/Analyses.def" 72 NumInliningModes 73 }; 74 75 /// \brief Describes the different kinds of C++ member functions which can be 76 /// considered for inlining by the analyzer. 77 /// 78 /// These options are cumulative; enabling one kind of member function will 79 /// enable all kinds with lower enum values. 80 enum CXXInlineableMemberKind { 81 // Uninitialized = 0, 82 83 /// A dummy mode in which no C++ inlining is enabled. 84 CIMK_None = 1, 85 86 /// Refers to regular member function and operator calls. 87 CIMK_MemberFunctions, 88 89 /// Refers to constructors (implicit or explicit). 90 /// 91 /// Note that a constructor will not be inlined if the corresponding 92 /// destructor is non-trivial. 93 CIMK_Constructors, 94 95 /// Refers to destructors (implicit or explicit). 96 CIMK_Destructors 97 }; 98 99 /// \brief Describes the different modes of inter-procedural analysis. 100 enum IPAKind { 101 IPAK_NotSet = 0, 102 103 /// Perform only intra-procedural analysis. 104 IPAK_None = 1, 105 106 /// Inline C functions and blocks when their definitions are available. 107 IPAK_BasicInlining = 2, 108 109 /// Inline callees(C, C++, ObjC) when their definitions are available. 110 IPAK_Inlining = 3, 111 112 /// Enable inlining of dynamically dispatched methods. 113 IPAK_DynamicDispatch = 4, 114 115 /// Enable inlining of dynamically dispatched methods, bifurcate paths when 116 /// exact type info is unavailable. 117 IPAK_DynamicDispatchBifurcate = 5 118 }; 119 120 class AnalyzerOptions : public RefCountedBase<AnalyzerOptions> { 121 public: 122 typedef llvm::StringMap<std::string> ConfigTable; 123 124 /// \brief Pair of checker name and enable/disable. 125 std::vector<std::pair<std::string, bool> > CheckersControlList; 126 127 /// \brief A key-value table of use-specified configuration values. 128 ConfigTable Config; 129 AnalysisStores AnalysisStoreOpt; 130 AnalysisConstraints AnalysisConstraintsOpt; 131 AnalysisDiagClients AnalysisDiagOpt; 132 AnalysisPurgeMode AnalysisPurgeOpt; 133 134 std::string AnalyzeSpecificFunction; 135 136 /// \brief The maximum number of times the analyzer visits a block. 137 unsigned maxBlockVisitOnPath; 138 139 140 /// \brief Disable all analyzer checks. 141 /// 142 /// This flag allows one to disable analyzer checks on the code processed by 143 /// the given analysis consumer. Note, the code will get parsed and the 144 /// command-line options will get checked. 145 unsigned DisableAllChecks : 1; 146 147 unsigned ShowCheckerHelp : 1; 148 unsigned AnalyzeAll : 1; 149 unsigned AnalyzerDisplayProgress : 1; 150 unsigned AnalyzeNestedBlocks : 1; 151 152 /// \brief The flag regulates if we should eagerly assume evaluations of 153 /// conditionals, thus, bifurcating the path. 154 /// 155 /// This flag indicates how the engine should handle expressions such as: 'x = 156 /// (y != 0)'. When this flag is true then the subexpression 'y != 0' will be 157 /// eagerly assumed to be true or false, thus evaluating it to the integers 0 158 /// or 1 respectively. The upside is that this can increase analysis 159 /// precision until we have a better way to lazily evaluate such logic. The 160 /// downside is that it eagerly bifurcates paths. 161 unsigned eagerlyAssumeBinOpBifurcation : 1; 162 163 unsigned TrimGraph : 1; 164 unsigned visualizeExplodedGraphWithGraphViz : 1; 165 unsigned visualizeExplodedGraphWithUbiGraph : 1; 166 unsigned UnoptimizedCFG : 1; 167 unsigned PrintStats : 1; 168 169 /// \brief Do not re-analyze paths leading to exhausted nodes with a different 170 /// strategy. We get better code coverage when retry is enabled. 171 unsigned NoRetryExhausted : 1; 172 173 /// \brief The inlining stack depth limit. 174 unsigned InlineMaxStackDepth; 175 176 /// \brief The mode of function selection used during inlining. 177 AnalysisInliningMode InliningMode; 178 179 private: 180 /// \brief Describes the kinds for high-level analyzer mode. 181 enum UserModeKind { 182 UMK_NotSet = 0, 183 /// Perform shallow but fast analyzes. 184 UMK_Shallow = 1, 185 /// Perform deep analyzes. 186 UMK_Deep = 2 187 }; 188 189 /// Controls the high-level analyzer mode, which influences the default 190 /// settings for some of the lower-level config options (such as IPAMode). 191 /// \sa getUserMode 192 UserModeKind UserMode; 193 194 /// Controls the mode of inter-procedural analysis. 195 IPAKind IPAMode; 196 197 /// Controls which C++ member functions will be considered for inlining. 198 CXXInlineableMemberKind CXXMemberInliningMode; 199 200 /// \sa includeTemporaryDtorsInCFG 201 Optional<bool> IncludeTemporaryDtorsInCFG; 202 203 /// \sa mayInlineCXXStandardLibrary 204 Optional<bool> InlineCXXStandardLibrary; 205 206 /// \sa mayInlineTemplateFunctions 207 Optional<bool> InlineTemplateFunctions; 208 209 /// \sa mayInlineCXXAllocator 210 Optional<bool> InlineCXXAllocator; 211 212 /// \sa mayInlineCXXContainerMethods 213 Optional<bool> InlineCXXContainerMethods; 214 215 /// \sa mayInlineCXXSharedPtrDtor 216 Optional<bool> InlineCXXSharedPtrDtor; 217 218 /// \sa mayInlineObjCMethod 219 Optional<bool> ObjCInliningMode; 220 221 // Cache of the "ipa-always-inline-size" setting. 222 // \sa getAlwaysInlineSize 223 Optional<unsigned> AlwaysInlineSize; 224 225 /// \sa shouldSuppressNullReturnPaths 226 Optional<bool> SuppressNullReturnPaths; 227 228 // \sa getMaxInlinableSize 229 Optional<unsigned> MaxInlinableSize; 230 231 /// \sa shouldAvoidSuppressingNullArgumentPaths 232 Optional<bool> AvoidSuppressingNullArgumentPaths; 233 234 /// \sa shouldSuppressInlinedDefensiveChecks 235 Optional<bool> SuppressInlinedDefensiveChecks; 236 237 /// \sa shouldSuppressFromCXXStandardLibrary 238 Optional<bool> SuppressFromCXXStandardLibrary; 239 240 /// \sa reportIssuesInMainSourceFile 241 Optional<bool> ReportIssuesInMainSourceFile; 242 243 /// \sa StableReportFilename 244 Optional<bool> StableReportFilename; 245 246 /// \sa getGraphTrimInterval 247 Optional<unsigned> GraphTrimInterval; 248 249 /// \sa getMaxTimesInlineLarge 250 Optional<unsigned> MaxTimesInlineLarge; 251 252 /// \sa getMaxNodesPerTopLevelFunction 253 Optional<unsigned> MaxNodesPerTopLevelFunction; 254 255 public: 256 /// Interprets an option's string value as a boolean. 257 /// 258 /// Accepts the strings "true" and "false". 259 /// If an option value is not provided, returns the given \p DefaultVal. 260 bool getBooleanOption(StringRef Name, bool DefaultVal); 261 262 /// Variant that accepts a Optional value to cache the result. 263 bool getBooleanOption(Optional<bool> &V, StringRef Name, bool DefaultVal); 264 265 /// Interprets an option's string value as an integer value. 266 int getOptionAsInteger(StringRef Name, int DefaultVal); 267 268 /// \brief Retrieves and sets the UserMode. This is a high-level option, 269 /// which is used to set other low-level options. It is not accessible 270 /// outside of AnalyzerOptions. 271 UserModeKind getUserMode(); 272 273 /// \brief Returns the inter-procedural analysis mode. 274 IPAKind getIPAMode(); 275 276 /// Returns the option controlling which C++ member functions will be 277 /// considered for inlining. 278 /// 279 /// This is controlled by the 'c++-inlining' config option. 280 /// 281 /// \sa CXXMemberInliningMode 282 bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K); 283 284 /// Returns true if ObjectiveC inlining is enabled, false otherwise. 285 bool mayInlineObjCMethod(); 286 287 /// Returns whether or not the destructors for C++ temporary objects should 288 /// be included in the CFG. 289 /// 290 /// This is controlled by the 'cfg-temporary-dtors' config option, which 291 /// accepts the values "true" and "false". 292 bool includeTemporaryDtorsInCFG(); 293 294 /// Returns whether or not C++ standard library functions may be considered 295 /// for inlining. 296 /// 297 /// This is controlled by the 'c++-stdlib-inlining' config option, which 298 /// accepts the values "true" and "false". 299 bool mayInlineCXXStandardLibrary(); 300 301 /// Returns whether or not templated functions may be considered for inlining. 302 /// 303 /// This is controlled by the 'c++-template-inlining' config option, which 304 /// accepts the values "true" and "false". 305 bool mayInlineTemplateFunctions(); 306 307 /// Returns whether or not allocator call may be considered for inlining. 308 /// 309 /// This is controlled by the 'c++-allocator-inlining' config option, which 310 /// accepts the values "true" and "false". 311 bool mayInlineCXXAllocator(); 312 313 /// Returns whether or not methods of C++ container objects may be considered 314 /// for inlining. 315 /// 316 /// This is controlled by the 'c++-container-inlining' config option, which 317 /// accepts the values "true" and "false". 318 bool mayInlineCXXContainerMethods(); 319 320 /// Returns whether or not the destructor of C++ 'shared_ptr' may be 321 /// considered for inlining. 322 /// 323 /// This covers std::shared_ptr, std::tr1::shared_ptr, and boost::shared_ptr, 324 /// and indeed any destructor named "~shared_ptr". 325 /// 326 /// This is controlled by the 'c++-shared_ptr-inlining' config option, which 327 /// accepts the values "true" and "false". 328 bool mayInlineCXXSharedPtrDtor(); 329 330 /// Returns whether or not paths that go through null returns should be 331 /// suppressed. 332 /// 333 /// This is a heuristic for avoiding bug reports with paths that go through 334 /// inlined functions that are more defensive than their callers. 335 /// 336 /// This is controlled by the 'suppress-null-return-paths' config option, 337 /// which accepts the values "true" and "false". 338 bool shouldSuppressNullReturnPaths(); 339 340 /// Returns whether a bug report should \em not be suppressed if its path 341 /// includes a call with a null argument, even if that call has a null return. 342 /// 343 /// This option has no effect when #shouldSuppressNullReturnPaths() is false. 344 /// 345 /// This is a counter-heuristic to avoid false negatives. 346 /// 347 /// This is controlled by the 'avoid-suppressing-null-argument-paths' config 348 /// option, which accepts the values "true" and "false". 349 bool shouldAvoidSuppressingNullArgumentPaths(); 350 351 /// Returns whether or not diagnostics containing inlined defensive NULL 352 /// checks should be suppressed. 353 /// 354 /// This is controlled by the 'suppress-inlined-defensive-checks' config 355 /// option, which accepts the values "true" and "false". 356 bool shouldSuppressInlinedDefensiveChecks(); 357 358 /// Returns whether or not diagnostics reported within the C++ standard 359 /// library should be suppressed. 360 /// 361 /// This is controlled by the 'suppress-c++-stdlib' config option, 362 /// which accepts the values "true" and "false". 363 bool shouldSuppressFromCXXStandardLibrary(); 364 365 /// Returns whether or not the diagnostic report should be always reported 366 /// in the main source file and not the headers. 367 /// 368 /// This is controlled by the 'report-in-main-source-file' config option, 369 /// which accepts the values "true" and "false". 370 bool shouldReportIssuesInMainSourceFile(); 371 372 /// Returns whether or not the report filename should be random or not. 373 /// 374 /// This is controlled by the 'stable-report-filename' config option, 375 /// which accepts the values "true" and "false". Default = false 376 bool shouldWriteStableReportFilename(); 377 378 /// Returns whether irrelevant parts of a bug report path should be pruned 379 /// out of the final output. 380 /// 381 /// This is controlled by the 'prune-paths' config option, which accepts the 382 /// values "true" and "false". 383 bool shouldPrunePaths(); 384 385 /// Returns true if 'static' initializers should be in conditional logic 386 /// in the CFG. 387 bool shouldConditionalizeStaticInitializers(); 388 389 // Returns the size of the functions (in basic blocks), which should be 390 // considered to be small enough to always inline. 391 // 392 // This is controlled by "ipa-always-inline-size" analyzer-config option. 393 unsigned getAlwaysInlineSize(); 394 395 // Returns the bound on the number of basic blocks in an inlined function 396 // (50 by default). 397 // 398 // This is controlled by "-analyzer-config max-inlinable-size" option. 399 unsigned getMaxInlinableSize(); 400 401 /// Returns true if the analyzer engine should synthesize fake bodies 402 /// for well-known functions. 403 bool shouldSynthesizeBodies(); 404 405 /// Returns how often nodes in the ExplodedGraph should be recycled to save 406 /// memory. 407 /// 408 /// This is controlled by the 'graph-trim-interval' config option. To disable 409 /// node reclamation, set the option to "0". 410 unsigned getGraphTrimInterval(); 411 412 /// Returns the maximum times a large function could be inlined. 413 /// 414 /// This is controlled by the 'max-times-inline-large' config option. 415 unsigned getMaxTimesInlineLarge(); 416 417 /// Returns the maximum number of nodes the analyzer can generate while 418 /// exploring a top level function (for each exploded graph). 419 /// 150000 is default; 0 means no limit. 420 /// 421 /// This is controlled by the 'max-nodes' config option. 422 unsigned getMaxNodesPerTopLevelFunction(); 423 424 public: AnalyzerOptions()425 AnalyzerOptions() : 426 AnalysisStoreOpt(RegionStoreModel), 427 AnalysisConstraintsOpt(RangeConstraintsModel), 428 AnalysisDiagOpt(PD_HTML), 429 AnalysisPurgeOpt(PurgeStmt), 430 DisableAllChecks(0), 431 ShowCheckerHelp(0), 432 AnalyzeAll(0), 433 AnalyzerDisplayProgress(0), 434 AnalyzeNestedBlocks(0), 435 eagerlyAssumeBinOpBifurcation(0), 436 TrimGraph(0), 437 visualizeExplodedGraphWithGraphViz(0), 438 visualizeExplodedGraphWithUbiGraph(0), 439 UnoptimizedCFG(0), 440 PrintStats(0), 441 NoRetryExhausted(0), 442 // Cap the stack depth at 4 calls (5 stack frames, base + 4 calls). 443 InlineMaxStackDepth(5), 444 InliningMode(NoRedundancy), 445 UserMode(UMK_NotSet), 446 IPAMode(IPAK_NotSet), 447 CXXMemberInliningMode() {} 448 449 }; 450 451 typedef IntrusiveRefCntPtr<AnalyzerOptions> AnalyzerOptionsRef; 452 453 } 454 455 #endif 456