1 //==--AnalyzerStatsChecker.cpp - Analyzer visitation statistics --*- C++ -*-==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // This file reports various statistics about analyzer visitation. 10 //===----------------------------------------------------------------------===// 11 12 #include "ClangSACheckers.h" 13 #include "clang/StaticAnalyzer/Core/Checker.h" 14 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 15 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" 16 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 18 19 #include "clang/AST/DeclObjC.h" 20 #include "clang/Basic/SourceManager.h" 21 #include "llvm/ADT/SmallPtrSet.h" 22 #include "llvm/ADT/SmallString.h" 23 24 using namespace clang; 25 using namespace ento; 26 27 namespace { 28 class AnalyzerStatsChecker : public Checker<check::EndAnalysis> { 29 public: 30 void checkEndAnalysis(ExplodedGraph &G, BugReporter &B,ExprEngine &Eng) const; 31 }; 32 } 33 34 void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G, 35 BugReporter &B, 36 ExprEngine &Eng) const { 37 const CFG *C = 0; 38 const Decl *D = 0; 39 const SourceManager &SM = B.getSourceManager(); 40 llvm::SmallPtrSet<const CFGBlock*, 256> reachable; 41 42 // Root node should have the location context of the top most function. 43 const ExplodedNode *GraphRoot = *G.roots_begin(); 44 const LocationContext *LC = GraphRoot->getLocation().getLocationContext(); 45 46 // Iterate over the exploded graph. 47 for (ExplodedGraph::node_iterator I = G.nodes_begin(); 48 I != G.nodes_end(); ++I) { 49 const ProgramPoint &P = I->getLocation(); 50 51 // Only check the coverage in the top level function. 52 if (LC != P.getLocationContext()) 53 continue; 54 55 if (const BlockEntrance *BE = dyn_cast<BlockEntrance>(&P)) { 56 const CFGBlock *CB = BE->getBlock(); 57 reachable.insert(CB); 58 } 59 } 60 61 // Get the CFG and the Decl of this block 62 C = LC->getCFG(); 63 D = LC->getAnalysisDeclContext()->getDecl(); 64 65 unsigned total = 0, unreachable = 0; 66 67 // Find CFGBlocks that were not covered by any node 68 for (CFG::const_iterator I = C->begin(); I != C->end(); ++I) { 69 const CFGBlock *CB = *I; 70 ++total; 71 // Check if the block is unreachable 72 if (!reachable.count(CB)) { 73 ++unreachable; 74 } 75 } 76 77 // We never 'reach' the entry block, so correct the unreachable count 78 unreachable--; 79 // There is no BlockEntrance corresponding to the exit block as well, so 80 // assume it is reached as well. 81 unreachable--; 82 83 // Generate the warning string 84 SmallString<128> buf; 85 llvm::raw_svector_ostream output(buf); 86 PresumedLoc Loc = SM.getPresumedLoc(D->getLocation()); 87 if (Loc.isValid()) { 88 output << Loc.getFilename() << " : "; 89 90 if (isa<FunctionDecl>(D) || isa<ObjCMethodDecl>(D)) { 91 const NamedDecl *ND = cast<NamedDecl>(D); 92 output << *ND; 93 } 94 else if (isa<BlockDecl>(D)) { 95 output << "block(line:" << Loc.getLine() << ":col:" << Loc.getColumn(); 96 } 97 } 98 99 output << " -> Total CFGBlocks: " << total << " | Unreachable CFGBlocks: " 100 << unreachable << " | Exhausted Block: " 101 << (Eng.wasBlocksExhausted() ? "yes" : "no") 102 << " | Empty WorkList: " 103 << (Eng.hasEmptyWorkList() ? "yes" : "no"); 104 105 B.EmitBasicReport("Analyzer Statistics", "Internal Statistics", output.str(), 106 PathDiagnosticLocation(D, SM)); 107 108 // Emit warning for each block we bailed out on 109 typedef CoreEngine::BlocksExhausted::const_iterator ExhaustedIterator; 110 const CoreEngine &CE = Eng.getCoreEngine(); 111 for (ExhaustedIterator I = CE.blocks_exhausted_begin(), 112 E = CE.blocks_exhausted_end(); I != E; ++I) { 113 const BlockEdge &BE = I->first; 114 const CFGBlock *Exit = BE.getDst(); 115 const CFGElement &CE = Exit->front(); 116 if (const CFGStmt *CS = dyn_cast<CFGStmt>(&CE)) 117 B.EmitBasicReport("Bailout Point", "Internal Statistics", "The analyzer " 118 "stopped analyzing at this point", 119 PathDiagnosticLocation::createBegin(CS->getStmt(), SM, LC)); 120 } 121 } 122 123 void ento::registerAnalyzerStatsChecker(CheckerManager &mgr) { 124 mgr.registerChecker<AnalyzerStatsChecker>(); 125 } 126