1f4a2713aSLionel Sambuc<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" 2f4a2713aSLionel Sambuc "http://www.w3.org/TR/html4/strict.dtd"> 3f4a2713aSLionel Sambuc<html> 4f4a2713aSLionel Sambuc<head> 5f4a2713aSLionel Sambuc <title>Checker Developer Manual</title> 6f4a2713aSLionel Sambuc <link type="text/css" rel="stylesheet" href="menu.css"> 7f4a2713aSLionel Sambuc <link type="text/css" rel="stylesheet" href="content.css"> 8f4a2713aSLionel Sambuc <script type="text/javascript" src="scripts/menu.js"></script> 9f4a2713aSLionel Sambuc</head> 10f4a2713aSLionel Sambuc<body> 11f4a2713aSLionel Sambuc 12f4a2713aSLionel Sambuc<div id="page"> 13f4a2713aSLionel Sambuc<!--#include virtual="menu.html.incl"--> 14f4a2713aSLionel Sambuc 15f4a2713aSLionel Sambuc<div id="content"> 16f4a2713aSLionel Sambuc 17f4a2713aSLionel Sambuc<h3 style="color:red">This Page Is Under Construction</h3> 18f4a2713aSLionel Sambuc 19f4a2713aSLionel Sambuc<h1>Checker Developer Manual</h1> 20f4a2713aSLionel Sambuc 21f4a2713aSLionel Sambuc<p>The static analyzer engine performs path-sensitive exploration of the program and 22f4a2713aSLionel Sambucrelies on a set of checkers to implement the logic for detecting and 23f4a2713aSLionel Sambucconstructing specific bug reports. Anyone who is interested in implementing their own 24f4a2713aSLionel Sambucchecker, should check out the Building a Checker in 24 Hours talk 25f4a2713aSLionel Sambuc(<a href="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">slides</a> 26f4a2713aSLionel Sambuc <a href="http://llvm.org/devmtg/2012-11/videos/Zaks-Rose-Checker24Hours.mp4">video</a>) 27f4a2713aSLionel Sambucand refer to this page for additional information on writing a checker. The static analyzer is a 28f4a2713aSLionel Sambucpart of the Clang project, so consult <a href="http://clang.llvm.org/hacking.html">Hacking on Clang</a> 29f4a2713aSLionel Sambucand <a href="http://llvm.org/docs/ProgrammersManual.html">LLVM Programmer's Manual</a> 30f4a2713aSLionel Sambucfor developer guidelines and send your questions and proposals to 31f4a2713aSLionel Sambuc<a href=http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev>cfe-dev mailing list</a>. 32f4a2713aSLionel Sambuc</p> 33f4a2713aSLionel Sambuc 34f4a2713aSLionel Sambuc <ul> 35f4a2713aSLionel Sambuc <li><a href="#start">Getting Started</a></li> 36f4a2713aSLionel Sambuc <li><a href="#analyzer">Static Analyzer Overview</a> 37f4a2713aSLionel Sambuc <ul> 38f4a2713aSLionel Sambuc <li><a href="#interaction">Interaction with Checkers</a></li> 39f4a2713aSLionel Sambuc <li><a href="#values">Representing Values</a></li> 40f4a2713aSLionel Sambuc </ul></li> 41f4a2713aSLionel Sambuc <li><a href="#idea">Idea for a Checker</a></li> 42f4a2713aSLionel Sambuc <li><a href="#registration">Checker Registration</a></li> 43f4a2713aSLionel Sambuc <li><a href="#events_callbacks">Events, Callbacks, and Checker Class Structure</a></li> 44f4a2713aSLionel Sambuc <li><a href="#extendingstates">Custom Program States</a></li> 45f4a2713aSLionel Sambuc <li><a href="#bugs">Bug Reports</a></li> 46f4a2713aSLionel Sambuc <li><a href="#ast">AST Visitors</a></li> 47f4a2713aSLionel Sambuc <li><a href="#testing">Testing</a></li> 48f4a2713aSLionel Sambuc <li><a href="#commands">Useful Commands/Debugging Hints</a></li> 49f4a2713aSLionel Sambuc <li><a href="#additioninformation">Additional Sources of Information</a></li> 50*0a6a1f1dSLionel Sambuc <li><a href="#links">Useful Links</a></li> 51f4a2713aSLionel Sambuc </ul> 52f4a2713aSLionel Sambuc 53f4a2713aSLionel Sambuc<h2 id=start>Getting Started</h2> 54f4a2713aSLionel Sambuc <ul> 55f4a2713aSLionel Sambuc <li>To check out the source code and build the project, follow steps 1-4 of 56f4a2713aSLionel Sambuc the <a href="http://clang.llvm.org/get_started.html">Clang Getting Started</a> 57f4a2713aSLionel Sambuc page.</li> 58f4a2713aSLionel Sambuc 59f4a2713aSLionel Sambuc <li>The analyzer source code is located under the Clang source tree: 60f4a2713aSLionel Sambuc <br><tt> 61f4a2713aSLionel Sambuc $ <b>cd llvm/tools/clang</b> 62f4a2713aSLionel Sambuc </tt> 63f4a2713aSLionel Sambuc <br>See: <tt>include/clang/StaticAnalyzer</tt>, <tt>lib/StaticAnalyzer</tt>, 64f4a2713aSLionel Sambuc <tt>test/Analysis</tt>.</li> 65f4a2713aSLionel Sambuc 66f4a2713aSLionel Sambuc <li>The analyzer regression tests can be executed from the Clang's build 67f4a2713aSLionel Sambuc directory: 68f4a2713aSLionel Sambuc <br><tt> 69f4a2713aSLionel Sambuc $ <b>cd ../../../; cd build/tools/clang; TESTDIRS=Analysis make test</b> 70f4a2713aSLionel Sambuc </tt></li> 71f4a2713aSLionel Sambuc 72f4a2713aSLionel Sambuc <li>Analyze a file with the specified checker: 73f4a2713aSLionel Sambuc <br><tt> 74f4a2713aSLionel Sambuc $ <b>clang -cc1 -analyze -analyzer-checker=core.DivideZero test.c</b> 75f4a2713aSLionel Sambuc </tt></li> 76f4a2713aSLionel Sambuc 77f4a2713aSLionel Sambuc <li>List the available checkers: 78f4a2713aSLionel Sambuc <br><tt> 79f4a2713aSLionel Sambuc $ <b>clang -cc1 -analyzer-checker-help</b> 80f4a2713aSLionel Sambuc </tt></li> 81f4a2713aSLionel Sambuc 82f4a2713aSLionel Sambuc <li>See the analyzer help for different output formats, fine tuning, and 83f4a2713aSLionel Sambuc debug options: 84f4a2713aSLionel Sambuc <br><tt> 85f4a2713aSLionel Sambuc $ <b>clang -cc1 -help | grep "analyzer"</b> 86f4a2713aSLionel Sambuc </tt></li> 87f4a2713aSLionel Sambuc 88f4a2713aSLionel Sambuc </ul> 89f4a2713aSLionel Sambuc 90f4a2713aSLionel Sambuc<h2 id=analyzer>Static Analyzer Overview</h2> 91f4a2713aSLionel Sambuc The analyzer core performs symbolic execution of the given program. All the 92f4a2713aSLionel Sambuc input values are represented with symbolic values; further, the engine deduces 93f4a2713aSLionel Sambuc the values of all the expressions in the program based on the input symbols 94f4a2713aSLionel Sambuc and the path. The execution is path sensitive and every possible path through 95f4a2713aSLionel Sambuc the program is explored. The explored execution traces are represented with 96f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1ExplodedGraph.html">ExplodedGraph</a> object. 97f4a2713aSLionel Sambuc Each node of the graph is 98f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1ExplodedNode.html">ExplodedNode</a>, 99f4a2713aSLionel Sambuc which consists of a <tt>ProgramPoint</tt> and a <tt>ProgramState</tt>. 100f4a2713aSLionel Sambuc <p> 101f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ProgramPoint.html">ProgramPoint</a> 102f4a2713aSLionel Sambuc represents the corresponding location in the program (or the CFG graph). 103f4a2713aSLionel Sambuc <tt>ProgramPoint</tt> is also used to record additional information on 104f4a2713aSLionel Sambuc when/how the state was added. For example, <tt>PostPurgeDeadSymbolsKind</tt> 105f4a2713aSLionel Sambuc kind means that the state is the result of purging dead symbols - the 106f4a2713aSLionel Sambuc analyzer's equivalent of garbage collection. 107f4a2713aSLionel Sambuc <p> 108f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1ProgramState.html">ProgramState</a> 109f4a2713aSLionel Sambuc represents abstract state of the program. It consists of: 110f4a2713aSLionel Sambuc <ul> 111f4a2713aSLionel Sambuc <li><tt>Environment</tt> - a mapping from source code expressions to symbolic 112f4a2713aSLionel Sambuc values 113f4a2713aSLionel Sambuc <li><tt>Store</tt> - a mapping from memory locations to symbolic values 114f4a2713aSLionel Sambuc <li><tt>GenericDataMap</tt> - constraints on symbolic values 115f4a2713aSLionel Sambuc </ul> 116f4a2713aSLionel Sambuc 117f4a2713aSLionel Sambuc <h3 id=interaction>Interaction with Checkers</h3> 118f4a2713aSLionel Sambuc Checkers are not merely passive receivers of the analyzer core changes - they 119f4a2713aSLionel Sambuc actively participate in the <tt>ProgramState</tt> construction through the 120f4a2713aSLionel Sambuc <tt>GenericDataMap</tt> which can be used to store the checker-defined part 121f4a2713aSLionel Sambuc of the state. Each time the analyzer engine explores a new statement, it 122f4a2713aSLionel Sambuc notifies each checker registered to listen for that statement, giving it an 123f4a2713aSLionel Sambuc opportunity to either report a bug or modify the state. (As a rule of thumb, 124f4a2713aSLionel Sambuc the checker itself should be stateless.) The checkers are called one after another 125f4a2713aSLionel Sambuc in the predefined order; thus, calling all the checkers adds a chain to the 126f4a2713aSLionel Sambuc <tt>ExplodedGraph</tt>. 127f4a2713aSLionel Sambuc 128f4a2713aSLionel Sambuc <h3 id=values>Representing Values</h3> 129f4a2713aSLionel Sambuc During symbolic execution, <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1SVal.html">SVal</a> 130f4a2713aSLionel Sambuc objects are used to represent the semantic evaluation of expressions. 131f4a2713aSLionel Sambuc They can represent things like concrete 132f4a2713aSLionel Sambuc integers, symbolic values, or memory locations (which are memory regions). 133f4a2713aSLionel Sambuc They are a discriminated union of "values", symbolic and otherwise. 134f4a2713aSLionel Sambuc If a value isn't symbolic, usually that means there is no symbolic 135f4a2713aSLionel Sambuc information to track. For example, if the value was an integer, such as 136f4a2713aSLionel Sambuc <tt>42</tt>, it would be a <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1nonloc_1_1ConcreteInt.html">ConcreteInt</a>, 137f4a2713aSLionel Sambuc and the checker doesn't usually need to track any state with the concrete 138f4a2713aSLionel Sambuc number. In some cases, <tt>SVal</tt> is not a symbol, but it really should be 139f4a2713aSLionel Sambuc a symbolic value. This happens when the analyzer cannot reason about something 140f4a2713aSLionel Sambuc (yet). An example is floating point numbers. In such cases, the 141f4a2713aSLionel Sambuc <tt>SVal</tt> will evaluate to <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1UnknownVal.html">UnknownVal</a>. 142f4a2713aSLionel Sambuc This represents a case that is outside the realm of the analyzer's reasoning 143f4a2713aSLionel Sambuc capabilities. <tt>SVals</tt> are value objects and their values can be viewed 144f4a2713aSLionel Sambuc using the <tt>.dump()</tt> method. Often they wrap persistent objects such as 145f4a2713aSLionel Sambuc symbols or regions. 146f4a2713aSLionel Sambuc <p> 147f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1SymExpr.html">SymExpr</a> (symbol) 148f4a2713aSLionel Sambuc is meant to represent abstract, but named, symbolic value. Symbols represent 149f4a2713aSLionel Sambuc an actual (immutable) value. We might not know what its specific value is, but 150f4a2713aSLionel Sambuc we can associate constraints with that value as we analyze a path. For 151f4a2713aSLionel Sambuc example, we might record that the value of a symbol is greater than 152f4a2713aSLionel Sambuc <tt>0</tt>, etc. 153f4a2713aSLionel Sambuc <p> 154f4a2713aSLionel Sambuc 155f4a2713aSLionel Sambuc <p> 156f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1MemRegion.html">MemRegion</a> is similar to a symbol. 157f4a2713aSLionel Sambuc It is used to provide a lexicon of how to describe abstract memory. Regions can 158f4a2713aSLionel Sambuc layer on top of other regions, providing a layered approach to representing memory. 159f4a2713aSLionel Sambuc For example, a struct object on the stack might be represented by a <tt>VarRegion</tt>, 160f4a2713aSLionel Sambuc but a <tt>FieldRegion</tt> which is a subregion of the <tt>VarRegion</tt> could 161f4a2713aSLionel Sambuc be used to represent the memory associated with a specific field of that object. 162f4a2713aSLionel Sambuc So how do we represent symbolic memory regions? That's what 163f4a2713aSLionel Sambuc <a href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1SymbolicRegion.html">SymbolicRegion</a> 164f4a2713aSLionel Sambuc is for. It is a <tt>MemRegion</tt> that has an associated symbol. Since the 165f4a2713aSLionel Sambuc symbol is unique and has a unique name; that symbol names the region. 166f4a2713aSLionel Sambuc 167f4a2713aSLionel Sambuc <P> 168f4a2713aSLionel Sambuc Let's see how the analyzer processes the expressions in the following example: 169f4a2713aSLionel Sambuc <p> 170f4a2713aSLionel Sambuc <pre class="code_example"> 171f4a2713aSLionel Sambuc int foo(int x) { 172f4a2713aSLionel Sambuc int y = x * 2; 173f4a2713aSLionel Sambuc int z = x; 174f4a2713aSLionel Sambuc ... 175f4a2713aSLionel Sambuc } 176f4a2713aSLionel Sambuc </pre> 177f4a2713aSLionel Sambuc <p> 178f4a2713aSLionel SambucLet's look at how <tt>x*2</tt> gets evaluated. When <tt>x</tt> is evaluated, 179f4a2713aSLionel Sambucwe first construct an <tt>SVal</tt> that represents the lvalue of <tt>x</tt>, in 180f4a2713aSLionel Sambucthis case it is an <tt>SVal</tt> that references the <tt>MemRegion</tt> for <tt>x</tt>. 181f4a2713aSLionel SambucAfterwards, when we do the lvalue-to-rvalue conversion, we get a new <tt>SVal</tt>, 182f4a2713aSLionel Sambucwhich references the value <b>currently bound</b> to <tt>x</tt>. That value is 183f4a2713aSLionel Sambucsymbolic; it's whatever <tt>x</tt> was bound to at the start of the function. 184f4a2713aSLionel SambucLet's call that symbol <tt>$0</tt>. Similarly, we evaluate the expression for <tt>2</tt>, 185f4a2713aSLionel Sambucand get an <tt>SVal</tt> that references the concrete number <tt>2</tt>. When 186f4a2713aSLionel Sambucwe evaluate <tt>x*2</tt>, we take the two <tt>SVals</tt> of the subexpressions, 187f4a2713aSLionel Sambucand create a new <tt>SVal</tt> that represents their multiplication (which in 188f4a2713aSLionel Sambucthis case is a new symbolic expression, which we might call <tt>$1</tt>). When we 189f4a2713aSLionel Sambucevaluate the assignment to <tt>y</tt>, we again compute its lvalue (a <tt>MemRegion</tt>), 190f4a2713aSLionel Sambucand then bind the <tt>SVal</tt> for the RHS (which references the symbolic value <tt>$1</tt>) 191f4a2713aSLionel Sambucto the <tt>MemRegion</tt> in the symbolic store. 192f4a2713aSLionel Sambuc<br> 193f4a2713aSLionel SambucThe second line is similar. When we evaluate <tt>x</tt> again, we do the same 194f4a2713aSLionel Sambucdance, and create an <tt>SVal</tt> that references the symbol <tt>$0</tt>. Note, two <tt>SVals</tt> 195f4a2713aSLionel Sambucmight reference the same underlying values. 196f4a2713aSLionel Sambuc 197f4a2713aSLionel Sambuc<p> 198f4a2713aSLionel SambucTo summarize, MemRegions are unique names for blocks of memory. Symbols are 199f4a2713aSLionel Sambucunique names for abstract symbolic values. Some MemRegions represents abstract 200f4a2713aSLionel Sambucsymbolic chunks of memory, and thus are also based on symbols. SVals are just 201f4a2713aSLionel Sambucreferences to values, and can reference either MemRegions, Symbols, or concrete 202f4a2713aSLionel Sambucvalues (e.g., the number 1). 203f4a2713aSLionel Sambuc 204f4a2713aSLionel Sambuc <!-- 205f4a2713aSLionel Sambuc TODO: Add a picture. 206f4a2713aSLionel Sambuc <br> 207f4a2713aSLionel Sambuc Symbols<br> 208f4a2713aSLionel Sambuc FunctionalObjects are used throughout. 209f4a2713aSLionel Sambuc --> 210f4a2713aSLionel Sambuc 211f4a2713aSLionel Sambuc<h2 id=idea>Idea for a Checker</h2> 212f4a2713aSLionel Sambuc Here are several questions which you should consider when evaluating your 213f4a2713aSLionel Sambuc checker idea: 214f4a2713aSLionel Sambuc <ul> 215f4a2713aSLionel Sambuc <li>Can the check be effectively implemented without path-sensitive 216f4a2713aSLionel Sambuc analysis? See <a href="#ast">AST Visitors</a>.</li> 217f4a2713aSLionel Sambuc 218f4a2713aSLionel Sambuc <li>How high the false positive rate is going to be? Looking at the occurrences 219f4a2713aSLionel Sambuc of the issue you want to write a checker for in the existing code bases might 220f4a2713aSLionel Sambuc give you some ideas. </li> 221f4a2713aSLionel Sambuc 222f4a2713aSLionel Sambuc <li>How the current limitations of the analysis will effect the false alarm 223f4a2713aSLionel Sambuc rate? Currently, the analyzer only reasons about one procedure at a time (no 224f4a2713aSLionel Sambuc inter-procedural analysis). Also, it uses a simple range tracking based 225f4a2713aSLionel Sambuc solver to model symbolic execution.</li> 226f4a2713aSLionel Sambuc 227f4a2713aSLionel Sambuc <li>Consult the <a 228f4a2713aSLionel Sambuc href="http://llvm.org/bugs/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=REOPENED&version=trunk&component=Static%20Analyzer&product=clang">Bugzilla database</a> 229f4a2713aSLionel Sambuc to get some ideas for new checkers and consider starting with improving/fixing 230f4a2713aSLionel Sambuc bugs in the existing checkers.</li> 231f4a2713aSLionel Sambuc </ul> 232f4a2713aSLionel Sambuc 233f4a2713aSLionel Sambuc<p>Once an idea for a checker has been chosen, there are two key decisions that 234f4a2713aSLionel Sambucneed to be made: 235f4a2713aSLionel Sambuc <ul> 236f4a2713aSLionel Sambuc <li> Which events the checker should be tracking. This is discussed in more 237f4a2713aSLionel Sambuc detail in the section <a href="#events_callbacks">Events, Callbacks, and 238f4a2713aSLionel Sambuc Checker Class Structure</a>. 239f4a2713aSLionel Sambuc <li> What checker-specific data needs to be stored as part of the program 240f4a2713aSLionel Sambuc state (if any). This should be minimized as much as possible. More detail about 241f4a2713aSLionel Sambuc implementing custom program state is given in section <a 242f4a2713aSLionel Sambuc href="#extendingstates">Custom Program States</a>. 243f4a2713aSLionel Sambuc </ul> 244f4a2713aSLionel Sambuc 245f4a2713aSLionel Sambuc 246f4a2713aSLionel Sambuc<h2 id=registration>Checker Registration</h2> 247f4a2713aSLionel Sambuc All checker implementation files are located in 248f4a2713aSLionel Sambuc <tt>clang/lib/StaticAnalyzer/Checkers</tt> folder. The steps below describe 249f4a2713aSLionel Sambuc how the checker <tt>SimpleStreamChecker</tt>, which checks for misuses of 250f4a2713aSLionel Sambuc stream APIs, was registered with the analyzer. 251f4a2713aSLionel Sambuc Similar steps should be followed for a new checker. 252f4a2713aSLionel Sambuc<ol> 253f4a2713aSLionel Sambuc <li>A new checker implementation file, <tt>SimpleStreamChecker.cpp</tt>, was 254f4a2713aSLionel Sambuc created in the directory <tt>lib/StaticAnalyzer/Checkers</tt>. 255f4a2713aSLionel Sambuc <li>The following registration code was added to the implementation file: 256f4a2713aSLionel Sambuc<pre class="code_example"> 257f4a2713aSLionel Sambucvoid ento::registerSimpleStreamChecker(CheckerManager &mgr) { 258f4a2713aSLionel Sambuc mgr.registerChecker<SimpleStreamChecker>(); 259f4a2713aSLionel Sambuc} 260f4a2713aSLionel Sambuc</pre> 261f4a2713aSLionel Sambuc<li>A package was selected for the checker and the checker was defined in the 262f4a2713aSLionel Sambuctable of checkers at <tt>lib/StaticAnalyzer/Checkers/Checkers.td</tt>. Since all 263f4a2713aSLionel Sambuccheckers should first be developed as "alpha", and the SimpleStreamChecker 264f4a2713aSLionel Sambucperforms UNIX API checks, the correct package is "alpha.unix", and the following 265f4a2713aSLionel Sambucwas added to the corresponding <tt>UnixAlpha</tt> section of <tt>Checkers.td</tt>: 266f4a2713aSLionel Sambuc<pre class="code_example"> 267f4a2713aSLionel Sambuclet ParentPackage = UnixAlpha in { 268f4a2713aSLionel Sambuc... 269f4a2713aSLionel Sambucdef SimpleStreamChecker : Checker<"SimpleStream">, 270f4a2713aSLionel Sambuc HelpText<"Check for misuses of stream APIs">, 271f4a2713aSLionel Sambuc DescFile<"SimpleStreamChecker.cpp">; 272f4a2713aSLionel Sambuc... 273f4a2713aSLionel Sambuc} // end "alpha.unix" 274f4a2713aSLionel Sambuc</pre> 275f4a2713aSLionel Sambuc 276f4a2713aSLionel Sambuc<li>The source code file was made visible to CMake by adding it to 277f4a2713aSLionel Sambuc<tt>lib/StaticAnalyzer/Checkers/CMakeLists.txt</tt>. 278f4a2713aSLionel Sambuc 279f4a2713aSLionel Sambuc</ol> 280f4a2713aSLionel Sambuc 281f4a2713aSLionel SambucAfter adding a new checker to the analyzer, one can verify that the new checker 282f4a2713aSLionel Sambucwas successfully added by seeing if it appears in the list of available checkers: 283f4a2713aSLionel Sambuc<br> <tt><b>$clang -cc1 -analyzer-checker-help</b></tt> 284f4a2713aSLionel Sambuc 285f4a2713aSLionel Sambuc<h2 id=events_callbacks>Events, Callbacks, and Checker Class Structure</h2> 286f4a2713aSLionel Sambuc 287f4a2713aSLionel Sambuc<p> All checkers inherit from the <tt><a 288f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1Checker.html"> 289f4a2713aSLionel SambucChecker</a></tt> template class; the template parameter(s) describe the type of 290f4a2713aSLionel Sambucevents that the checker is interested in processing. The various types of events 291f4a2713aSLionel Sambucthat are available are described in the file <a 292f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/CheckerDocumentation_8cpp_source.html"> 293f4a2713aSLionel SambucCheckerDocumentation.cpp</a> 294f4a2713aSLionel Sambuc 295f4a2713aSLionel Sambuc<p> For each event type requested, a corresponding callback function must be 296f4a2713aSLionel Sambucdefined in the checker class (<a 297f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/CheckerDocumentation_8cpp_source.html"> 298f4a2713aSLionel SambucCheckerDocumentation.cpp</a> shows the 299f4a2713aSLionel Sambuccorrect function name and signature for each event type). 300f4a2713aSLionel Sambuc 301f4a2713aSLionel Sambuc<p> As an example, consider <tt>SimpleStreamChecker</tt>. This checker needs to 302f4a2713aSLionel Sambuctake action at the following times: 303f4a2713aSLionel Sambuc 304f4a2713aSLionel Sambuc<ul> 305f4a2713aSLionel Sambuc<li>Before making a call to a function, check if the function is <tt>fclose</tt>. 306f4a2713aSLionel SambucIf so, check the parameter being passed. 307f4a2713aSLionel Sambuc<li>After making a function call, check if the function is <tt>fopen</tt>. If 308f4a2713aSLionel Sambucso, process the return value. 309f4a2713aSLionel Sambuc<li>When values go out of scope, check whether they are still-open file 310f4a2713aSLionel Sambucdescriptors, and report a bug if so. In addition, remove any information about 311f4a2713aSLionel Sambucthem from the program state in order to keep the state as small as possible. 312f4a2713aSLionel Sambuc<li>When file pointers "escape" (are used in a way that the analyzer can no longer 313f4a2713aSLionel Sambuctrack them), mark them as such. This prevents false positives in the cases where 314f4a2713aSLionel Sambucthe analyzer cannot be sure whether the file was closed or not. 315f4a2713aSLionel Sambuc</ul> 316f4a2713aSLionel Sambuc 317f4a2713aSLionel Sambuc<p>These events that will be used for each of these actions are, respectively, <a 318f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1check_1_1PreCall.html">PreCall</a>, 319f4a2713aSLionel Sambuc<a 320f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1check_1_1PostCall.html">PostCall</a>, 321f4a2713aSLionel Sambuc<a 322f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1check_1_1DeadSymbols.html">DeadSymbols</a>, 323f4a2713aSLionel Sambucand <a 324f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1check_1_1PointerEscape.html">PointerEscape</a>. 325f4a2713aSLionel SambucThe high-level structure of the checker's class is thus: 326f4a2713aSLionel Sambuc 327f4a2713aSLionel Sambuc<pre class="code_example"> 328f4a2713aSLionel Sambucclass SimpleStreamChecker : public Checker<check::PreCall, 329f4a2713aSLionel Sambuc check::PostCall, 330f4a2713aSLionel Sambuc check::DeadSymbols, 331f4a2713aSLionel Sambuc check::PointerEscape> { 332f4a2713aSLionel Sambucpublic: 333f4a2713aSLionel Sambuc 334f4a2713aSLionel Sambuc void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 335f4a2713aSLionel Sambuc 336f4a2713aSLionel Sambuc void checkPostCall(const CallEvent &Call, CheckerContext &C) const; 337f4a2713aSLionel Sambuc 338f4a2713aSLionel Sambuc void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const; 339f4a2713aSLionel Sambuc 340f4a2713aSLionel Sambuc ProgramStateRef checkPointerEscape(ProgramStateRef State, 341f4a2713aSLionel Sambuc const InvalidatedSymbols &Escaped, 342f4a2713aSLionel Sambuc const CallEvent *Call, 343f4a2713aSLionel Sambuc PointerEscapeKind Kind) const; 344f4a2713aSLionel Sambuc}; 345f4a2713aSLionel Sambuc</pre> 346f4a2713aSLionel Sambuc 347f4a2713aSLionel Sambuc<h2 id=extendingstates>Custom Program States</h2> 348f4a2713aSLionel Sambuc 349f4a2713aSLionel Sambuc<p> Checkers often need to keep track of information specific to the checks they 350f4a2713aSLionel Sambucperform. However, since checkers have no guarantee about the order in which the 351f4a2713aSLionel Sambucprogram will be explored, or even that all possible paths will be explored, this 352f4a2713aSLionel Sambucstate information cannot be kept within individual checkers. Therefore, if 353f4a2713aSLionel Sambuccheckers need to store custom information, they need to add new categories of 354f4a2713aSLionel Sambucdata to the <tt>ProgramState</tt>. The preferred way to do so is to use one of 355f4a2713aSLionel Sambucseveral macros designed for this purpose. They are: 356f4a2713aSLionel Sambuc 357f4a2713aSLionel Sambuc<ul> 358f4a2713aSLionel Sambuc<li><a 359f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/ProgramStateTrait_8h.html#ae4cddb54383cd702a045d7c61b009147">REGISTER_TRAIT_WITH_PROGRAMSTATE</a>: 360f4a2713aSLionel SambucUsed when the state information is a single value. The methods available for 361f4a2713aSLionel Sambucstate types declared with this macro are <tt>get</tt>, <tt>set</tt>, and 362f4a2713aSLionel Sambuc<tt>remove</tt>. 363f4a2713aSLionel Sambuc<li><a 364f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/CheckerContext_8h.html#aa27656fa0ce65b0d9ba12eb3c02e8be9">REGISTER_LIST_WITH_PROGRAMSTATE</a>: 365f4a2713aSLionel SambucUsed when the state information is a list of values. The methods available for 366f4a2713aSLionel Sambucstate types declared with this macro are <tt>add</tt>, <tt>get</tt>, 367f4a2713aSLionel Sambuc<tt>remove</tt>, and <tt>contains</tt>. 368f4a2713aSLionel Sambuc<li><a 369f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/CheckerContext_8h.html#ad90f9387b94b344eaaf499afec05f4d1">REGISTER_SET_WITH_PROGRAMSTATE</a>: 370f4a2713aSLionel SambucUsed when the state information is a set of values. The methods available for 371f4a2713aSLionel Sambucstate types declared with this macro are <tt>add</tt>, <tt>get</tt>, 372f4a2713aSLionel Sambuc<tt>remove</tt>, and <tt>contains</tt>. 373f4a2713aSLionel Sambuc<li><a 374f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/CheckerContext_8h.html#a6d1893bb8c18543337b6c363c1319fcf">REGISTER_MAP_WITH_PROGRAMSTATE</a>: 375f4a2713aSLionel SambucUsed when the state information is a map from a key to a value. The methods 376f4a2713aSLionel Sambucavailable for state types declared with this macro are <tt>add</tt>, 377f4a2713aSLionel Sambuc<tt>set</tt>, <tt>get</tt>, <tt>remove</tt>, and <tt>contains</tt>. 378f4a2713aSLionel Sambuc</ul> 379f4a2713aSLionel Sambuc 380f4a2713aSLionel Sambuc<p>All of these macros take as parameters the name to be used for the custom 381f4a2713aSLionel Sambuccategory of state information and the data type(s) to be used for storage. The 382f4a2713aSLionel Sambucdata type(s) specified will become the parameter type and/or return type of the 383f4a2713aSLionel Sambucmethods that manipulate the new category of state information. Each of these 384f4a2713aSLionel Sambucmethods are templated with the name of the custom data type. 385f4a2713aSLionel Sambuc 386f4a2713aSLionel Sambuc<p>For example, a common case is the need to track data associated with a 387f4a2713aSLionel Sambucsymbolic expression; a map type is the most logical way to implement this. The 388f4a2713aSLionel Sambuckey for this map will be a pointer to a symbolic expression 389f4a2713aSLionel Sambuc(<tt>SymbolRef</tt>). If the data type to be associated with the symbolic 390f4a2713aSLionel Sambucexpression is an integer, then the custom category of state information would be 391f4a2713aSLionel Sambucdeclared as 392f4a2713aSLionel Sambuc 393f4a2713aSLionel Sambuc<pre class="code_example"> 394f4a2713aSLionel SambucREGISTER_MAP_WITH_PROGRAMSTATE(ExampleDataType, SymbolRef, int) 395f4a2713aSLionel Sambuc</pre> 396f4a2713aSLionel Sambuc 397f4a2713aSLionel SambucThe data would be accessed with the function 398f4a2713aSLionel Sambuc 399f4a2713aSLionel Sambuc<pre class="code_example"> 400f4a2713aSLionel SambucProgramStateRef state; 401f4a2713aSLionel SambucSymbolRef Sym; 402f4a2713aSLionel Sambuc... 403f4a2713aSLionel Sambucint currentlValue = state->get<ExampleDataType>(Sym); 404f4a2713aSLionel Sambuc</pre> 405f4a2713aSLionel Sambuc 406f4a2713aSLionel Sambucand set with the function 407f4a2713aSLionel Sambuc 408f4a2713aSLionel Sambuc<pre class="code_example"> 409f4a2713aSLionel SambucProgramStateRef state; 410f4a2713aSLionel SambucSymbolRef Sym; 411f4a2713aSLionel Sambucint newValue; 412f4a2713aSLionel Sambuc... 413f4a2713aSLionel SambucProgramStateRef newState = state->set<ExampleDataType>(Sym, newValue); 414f4a2713aSLionel Sambuc</pre> 415f4a2713aSLionel Sambuc 416f4a2713aSLionel Sambuc<p>In addition, the macros define a data type used for storing the data of the 417f4a2713aSLionel Sambucnew data category; the name of this type is the name of the data category with 418f4a2713aSLionel Sambuc"Ty" appended. For <tt>REGISTER_TRAIT_WITH_PROGRAMSTATE</tt>, this will simply 419f4a2713aSLionel Sambucbe passed data type; for the other three macros, this will be a specialized 420f4a2713aSLionel Sambucversion of the <a 421f4a2713aSLionel Sambuchref="http://llvm.org/doxygen/classllvm_1_1ImmutableList.html">llvm::ImmutableList</a>, 422f4a2713aSLionel Sambuc<a 423f4a2713aSLionel Sambuchref="http://llvm.org/doxygen/classllvm_1_1ImmutableSet.html">llvm::ImmutableSet</a>, 424f4a2713aSLionel Sambucor <a 425f4a2713aSLionel Sambuchref="http://llvm.org/doxygen/classllvm_1_1ImmutableMap.html">llvm::ImmutableMap</a> 426f4a2713aSLionel Sambuctemplated class. For the <tt>ExampleDataType</tt> example above, the type 427f4a2713aSLionel Sambuccreated would be equivalent to writing the declaration: 428f4a2713aSLionel Sambuc 429f4a2713aSLionel Sambuc<pre class="code_example"> 430f4a2713aSLionel Sambuctypedef llvm::ImmutableMap<SymbolRef, int> ExampleDataTypeTy; 431f4a2713aSLionel Sambuc</pre> 432f4a2713aSLionel Sambuc 433f4a2713aSLionel Sambuc<p>These macros will cover a majority of use cases; however, they still have a 434f4a2713aSLionel Sambucfew limitations. They cannot be used inside namespaces (since they expand to 435f4a2713aSLionel Sambuccontain top-level namespace references), and the data types that they define 436f4a2713aSLionel Sambuccannot be referenced from more than one file. 437f4a2713aSLionel Sambuc 438f4a2713aSLionel Sambuc<p>Note that <tt>ProgramStates</tt> are immutable; instead of modifying an existing 439f4a2713aSLionel Sambucone, functions that modify the state will return a copy of the previous state 440f4a2713aSLionel Sambucwith the change applied. This updated state must be then provided to the 441f4a2713aSLionel Sambucanalyzer core by calling the <tt>CheckerContext::addTransition</tt> function. 442f4a2713aSLionel Sambuc<h2 id=bugs>Bug Reports</h2> 443f4a2713aSLionel Sambuc 444f4a2713aSLionel Sambuc 445f4a2713aSLionel Sambuc<p> When a checker detects a mistake in the analyzed code, it needs a way to 446f4a2713aSLionel Sambucreport it to the analyzer core so that it can be displayed. The two classes used 447f4a2713aSLionel Sambucto construct this report are <tt><a 448f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1BugType.html">BugType</a></tt> 449f4a2713aSLionel Sambucand <tt><a 450f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1BugReport.html"> 451f4a2713aSLionel SambucBugReport</a></tt>. 452f4a2713aSLionel Sambuc 453f4a2713aSLionel Sambuc<p> 454f4a2713aSLionel Sambuc<tt>BugType</tt>, as the name would suggest, represents a type of bug. The 455f4a2713aSLionel Sambucconstructor for <tt>BugType</tt> takes two parameters: The name of the bug 456f4a2713aSLionel Sambuctype, and the name of the category of the bug. These are used (e.g.) in the 457f4a2713aSLionel Sambucsummary page generated by the scan-build tool. 458f4a2713aSLionel Sambuc 459f4a2713aSLionel Sambuc<P> 460f4a2713aSLionel Sambuc The <tt>BugReport</tt> class represents a specific occurrence of a bug. In 461f4a2713aSLionel Sambuc the most common case, three parameters are used to form a <tt>BugReport</tt>: 462f4a2713aSLionel Sambuc<ol> 463f4a2713aSLionel Sambuc<li>The type of bug, specified as an instance of the <tt>BugType</tt> class. 464f4a2713aSLionel Sambuc<li>A short descriptive string. This is placed at the location of the bug in 465f4a2713aSLionel Sambucthe detailed line-by-line output generated by scan-build. 466f4a2713aSLionel Sambuc<li>The context in which the bug occurred. This includes both the location of 467f4a2713aSLionel Sambucthe bug in the program and the program's state when the location is reached. These are 468f4a2713aSLionel Sambucboth encapsulated in an <tt>ExplodedNode</tt>. 469f4a2713aSLionel Sambuc</ol> 470f4a2713aSLionel Sambuc 471f4a2713aSLionel Sambuc<p>In order to obtain the correct <tt>ExplodedNode</tt>, a decision must be made 472f4a2713aSLionel Sambucas to whether or not analysis can continue along the current path. This decision 473f4a2713aSLionel Sambucis based on whether the detected bug is one that would prevent the program under 474f4a2713aSLionel Sambucanalysis from continuing. For example, leaking of a resource should not stop 475f4a2713aSLionel Sambucanalysis, as the program can continue to run after the leak. Dereferencing a 476f4a2713aSLionel Sambucnull pointer, on the other hand, should stop analysis, as there is no way for 477f4a2713aSLionel Sambucthe program to meaningfully continue after such an error. 478f4a2713aSLionel Sambuc 479f4a2713aSLionel Sambuc<p>If analysis can continue, then the most recent <tt>ExplodedNode</tt> 480f4a2713aSLionel Sambucgenerated by the checker can be passed to the <tt>BugReport</tt> constructor 481f4a2713aSLionel Sambucwithout additional modification. This <tt>ExplodedNode</tt> will be the one 482f4a2713aSLionel Sambucreturned by the most recent call to <a 483f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1CheckerContext.html#a264f48d97809707049689c37aa35af78">CheckerContext::addTransition</a>. 484f4a2713aSLionel SambucIf no transition has been performed during the current callback, the checker should call <a 485f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1CheckerContext.html#a264f48d97809707049689c37aa35af78">CheckerContext::addTransition()</a> 486f4a2713aSLionel Sambucand use the returned node for bug reporting. 487f4a2713aSLionel Sambuc 488f4a2713aSLionel Sambuc<p>If analysis can not continue, then the current state should be transitioned 489f4a2713aSLionel Sambucinto a so-called <i>sink node</i>, a node from which no further analysis will be 490f4a2713aSLionel Sambucperformed. This is done by calling the <a 491f4a2713aSLionel Sambuchref="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1CheckerContext.html#adeea33a5a2bed190210c4a2bb807a6f0"> 492f4a2713aSLionel SambucCheckerContext::generateSink</a> function; this function is the same as the 493f4a2713aSLionel Sambuc<tt>addTransition</tt> function, but marks the state as a sink node. Like 494f4a2713aSLionel Sambuc<tt>addTransition</tt>, this returns an <tt>ExplodedNode</tt> with the updated 495f4a2713aSLionel Sambucstate, which can then be passed to the <tt>BugReport</tt> constructor. 496f4a2713aSLionel Sambuc 497f4a2713aSLionel Sambuc<p> 498f4a2713aSLionel SambucAfter a <tt>BugReport</tt> is created, it should be passed to the analyzer core 499f4a2713aSLionel Sambucby calling <a href = "http://clang.llvm.org/doxygen/classclang_1_1ento_1_1CheckerContext.html#ae7738af2cbfd1d713edec33d3203dff5">CheckerContext::emitReport</a>. 500f4a2713aSLionel Sambuc 501f4a2713aSLionel Sambuc<h2 id=ast>AST Visitors</h2> 502f4a2713aSLionel Sambuc Some checks might not require path-sensitivity to be effective. Simple AST walk 503f4a2713aSLionel Sambuc might be sufficient. If that is the case, consider implementing a Clang 504f4a2713aSLionel Sambuc compiler warning. On the other hand, a check might not be acceptable as a compiler 505f4a2713aSLionel Sambuc warning; for example, because of a relatively high false positive rate. In this 506f4a2713aSLionel Sambuc situation, AST callbacks <tt><b>checkASTDecl</b></tt> and 507f4a2713aSLionel Sambuc <tt><b>checkASTCodeBody</b></tt> are your best friends. 508f4a2713aSLionel Sambuc 509f4a2713aSLionel Sambuc<h2 id=testing>Testing</h2> 510f4a2713aSLionel Sambuc Every patch should be well tested with Clang regression tests. The checker tests 511f4a2713aSLionel Sambuc live in <tt>clang/test/Analysis</tt> folder. To run all of the analyzer tests, 512f4a2713aSLionel Sambuc execute the following from the <tt>clang</tt> build directory: 513f4a2713aSLionel Sambuc <pre class="code"> 514f4a2713aSLionel Sambuc $ <b>TESTDIRS=Analysis make test</b> 515f4a2713aSLionel Sambuc </pre> 516f4a2713aSLionel Sambuc 517f4a2713aSLionel Sambuc<h2 id=commands>Useful Commands/Debugging Hints</h2> 518f4a2713aSLionel Sambuc<ul> 519f4a2713aSLionel Sambuc<li> 520f4a2713aSLionel SambucWhile investigating a checker-related issue, instruct the analyzer to only 521f4a2713aSLionel Sambucexecute a single checker: 522f4a2713aSLionel Sambuc<br><tt> 523f4a2713aSLionel Sambuc$ <b>clang -cc1 -analyze -analyzer-checker=osx.KeychainAPI test.c</b> 524f4a2713aSLionel Sambuc</tt> 525f4a2713aSLionel Sambuc</li> 526f4a2713aSLionel Sambuc<li> 527f4a2713aSLionel SambucTo dump AST: 528f4a2713aSLionel Sambuc<br><tt> 529f4a2713aSLionel Sambuc$ <b>clang -cc1 -ast-dump test.c</b> 530f4a2713aSLionel Sambuc</tt> 531f4a2713aSLionel Sambuc</li> 532f4a2713aSLionel Sambuc<li> 533f4a2713aSLionel SambucTo view/dump CFG use <tt>debug.ViewCFG</tt> or <tt>debug.DumpCFG</tt> checkers: 534f4a2713aSLionel Sambuc<br><tt> 535f4a2713aSLionel Sambuc$ <b>clang -cc1 -analyze -analyzer-checker=debug.ViewCFG test.c</b> 536f4a2713aSLionel Sambuc</tt> 537f4a2713aSLionel Sambuc</li> 538f4a2713aSLionel Sambuc<li> 539f4a2713aSLionel SambucTo see all available debug checkers: 540f4a2713aSLionel Sambuc<br><tt> 541f4a2713aSLionel Sambuc$ <b>clang -cc1 -analyzer-checker-help | grep "debug"</b> 542f4a2713aSLionel Sambuc</tt> 543f4a2713aSLionel Sambuc</li> 544f4a2713aSLionel Sambuc<li> 545f4a2713aSLionel SambucTo see which function is failing while processing a large file use 546f4a2713aSLionel Sambuc<tt>-analyzer-display-progress</tt> option. 547f4a2713aSLionel Sambuc</li> 548f4a2713aSLionel Sambuc<li> 549f4a2713aSLionel SambucWhile debugging execute <tt>clang -cc1 -analyze -analyzer-checker=core</tt> 550f4a2713aSLionel Sambucinstead of <tt>clang --analyze</tt>, as the later would call the compiler 551f4a2713aSLionel Sambucin a separate process. 552f4a2713aSLionel Sambuc</li> 553f4a2713aSLionel Sambuc<li> 554f4a2713aSLionel SambucTo view <tt>ExplodedGraph</tt> (the state graph explored by the analyzer) while 555f4a2713aSLionel Sambucdebugging, goto a frame that has <tt>clang::ento::ExprEngine</tt> object and 556f4a2713aSLionel Sambucexecute: 557f4a2713aSLionel Sambuc<br><tt> 558f4a2713aSLionel Sambuc(gdb) <b>p ViewGraph(0)</b> 559f4a2713aSLionel Sambuc</tt> 560f4a2713aSLionel Sambuc</li> 561f4a2713aSLionel Sambuc<li> 562f4a2713aSLionel SambucTo see the <tt>ProgramState</tt> while debugging use the following command. 563f4a2713aSLionel Sambuc<br><tt> 564f4a2713aSLionel Sambuc(gdb) <b>p State->dump()</b> 565f4a2713aSLionel Sambuc</tt> 566f4a2713aSLionel Sambuc</li> 567f4a2713aSLionel Sambuc<li> 568f4a2713aSLionel SambucTo see <tt>clang::Expr</tt> while debugging use the following command. If you 569f4a2713aSLionel Sambucpass in a SourceManager object, it will also dump the corresponding line in the 570f4a2713aSLionel Sambucsource code. 571f4a2713aSLionel Sambuc<br><tt> 572f4a2713aSLionel Sambuc(gdb) <b>p E->dump()</b> 573f4a2713aSLionel Sambuc</tt> 574f4a2713aSLionel Sambuc</li> 575f4a2713aSLionel Sambuc<li> 576f4a2713aSLionel SambucTo dump AST of a method that the current <tt>ExplodedNode</tt> belongs to: 577f4a2713aSLionel Sambuc<br><tt> 578f4a2713aSLionel Sambuc(gdb) <b>p C.getPredecessor()->getCodeDecl().getBody()->dump()</b> 579f4a2713aSLionel Sambuc(gdb) <b>p C.getPredecessor()->getCodeDecl().getBody()->dump(getContext().getSourceManager())</b> 580f4a2713aSLionel Sambuc</tt> 581f4a2713aSLionel Sambuc</li> 582f4a2713aSLionel Sambuc</ul> 583f4a2713aSLionel Sambuc 584f4a2713aSLionel Sambuc<h2 id=additioninformation>Additional Sources of Information</h2> 585f4a2713aSLionel Sambuc 586f4a2713aSLionel SambucHere are some additional resources that are useful when working on the Clang 587f4a2713aSLionel SambucStatic Analyzer: 588f4a2713aSLionel Sambuc 589f4a2713aSLionel Sambuc<ul> 590f4a2713aSLionel Sambuc<li> <a href="http://clang.llvm.org/doxygen">Clang doxygen</a>. Contains 591f4a2713aSLionel Sambucup-to-date documentation about the APIs available in Clang. Relevant entries 592f4a2713aSLionel Sambuchave been linked throughout this page. Also of use is the 593f4a2713aSLionel Sambuc<a href="http://llvm.org/doxygen">LLVM doxygen</a>, when dealing with classes 594f4a2713aSLionel Sambucfrom LLVM. 595f4a2713aSLionel Sambuc<li> The <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev"> 596f4a2713aSLionel Sambuccfe-dev mailing list</a>. This is the primary mailing list used for 597f4a2713aSLionel Sambucdiscussion of Clang development (including static code analysis). The 598f4a2713aSLionel Sambuc<a href="http://lists.cs.uiuc.edu/pipermail/cfe-dev">archive</a> also contains 599f4a2713aSLionel Sambuca lot of information. 600f4a2713aSLionel Sambuc<li> The "Building a Checker in 24 hours" presentation given at the <a 601f4a2713aSLionel Sambuchref="http://llvm.org/devmtg/2012-11">November 2012 LLVM Developer's 602f4a2713aSLionel Sambucmeeting</a>. Describes the construction of SimpleStreamChecker. <a 603f4a2713aSLionel Sambuchref="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">Slides</a> 604f4a2713aSLionel Sambucand <a 605f4a2713aSLionel Sambuchref="http://llvm.org/devmtg/2012-11/videos/Zaks-Rose-Checker24Hours.mp4">video</a> 606f4a2713aSLionel Sambucare available. 607f4a2713aSLionel Sambuc</ul> 608f4a2713aSLionel Sambuc 609*0a6a1f1dSLionel Sambuc<h2 id=links>Useful Links</h2> 610*0a6a1f1dSLionel Sambuc<ul> 611*0a6a1f1dSLionel Sambuc<li>The list of <a href="implicit_checks.html">Implicit Checkers</a></li> 612*0a6a1f1dSLionel Sambuc</ul> 613*0a6a1f1dSLionel Sambuc 614f4a2713aSLionel Sambuc</div> 615f4a2713aSLionel Sambuc</div> 616f4a2713aSLionel Sambuc</body> 617f4a2713aSLionel Sambuc</html> 618