1 //===--- AnalyzerOptions.h - Analysis Engine Options ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This header defines various options for the static analyzer that are set 11 // by the frontend and are consulted throughout the analyzer. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #ifndef LLVM_CLANG_ANALYZEROPTIONS_H 16 #define LLVM_CLANG_ANALYZEROPTIONS_H 17 18 #include "clang/Basic/LLVM.h" 19 #include "llvm/ADT/IntrusiveRefCntPtr.h" 20 #include "llvm/ADT/Optional.h" 21 #include "llvm/ADT/StringMap.h" 22 #include <string> 23 #include <vector> 24 25 namespace clang { 26 class ASTConsumer; 27 class DiagnosticsEngine; 28 class Preprocessor; 29 class LangOptions; 30 31 /// Analysis - Set of available source code analyses. 32 enum Analyses { 33 #define ANALYSIS(NAME, CMDFLAG, DESC, SCOPE) NAME, 34 #include "clang/StaticAnalyzer/Core/Analyses.def" 35 NumAnalyses 36 }; 37 38 /// AnalysisStores - Set of available analysis store models. 39 enum AnalysisStores { 40 #define ANALYSIS_STORE(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 41 #include "clang/StaticAnalyzer/Core/Analyses.def" 42 NumStores 43 }; 44 45 /// AnalysisConstraints - Set of available constraint models. 46 enum AnalysisConstraints { 47 #define ANALYSIS_CONSTRAINTS(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 48 #include "clang/StaticAnalyzer/Core/Analyses.def" 49 NumConstraints 50 }; 51 52 /// AnalysisDiagClients - Set of available diagnostic clients for rendering 53 /// analysis results. 54 enum AnalysisDiagClients { 55 #define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATFN, AUTOCREAT) PD_##NAME, 56 #include "clang/StaticAnalyzer/Core/Analyses.def" 57 NUM_ANALYSIS_DIAG_CLIENTS 58 }; 59 60 /// AnalysisPurgeModes - Set of available strategies for dead symbol removal. 61 enum AnalysisPurgeMode { 62 #define ANALYSIS_PURGE(NAME, CMDFLAG, DESC) NAME, 63 #include "clang/StaticAnalyzer/Core/Analyses.def" 64 NumPurgeModes 65 }; 66 67 /// AnalysisInlineFunctionSelection - Set of inlining function selection heuristics. 68 enum AnalysisInliningMode { 69 #define ANALYSIS_INLINING_MODE(NAME, CMDFLAG, DESC) NAME, 70 #include "clang/StaticAnalyzer/Core/Analyses.def" 71 NumInliningModes 72 }; 73 74 /// \brief Describes the different kinds of C++ member functions which can be 75 /// considered for inlining by the analyzer. 76 /// 77 /// These options are cumulative; enabling one kind of member function will 78 /// enable all kinds with lower enum values. 79 enum CXXInlineableMemberKind { 80 // Uninitialized = 0, 81 82 /// A dummy mode in which no C++ inlining is enabled. 83 CIMK_None = 1, 84 85 /// Refers to regular member function and operator calls. 86 CIMK_MemberFunctions, 87 88 /// Refers to constructors (implicit or explicit). 89 /// 90 /// Note that a constructor will not be inlined if the corresponding 91 /// destructor is non-trivial. 92 CIMK_Constructors, 93 94 /// Refers to destructors (implicit or explicit). 95 CIMK_Destructors 96 }; 97 98 /// \brief Describes the different modes of inter-procedural analysis. 99 enum IPAKind { 100 IPAK_NotSet = 0, 101 102 /// Perform only intra-procedural analysis. 103 IPAK_None = 1, 104 105 /// Inline C functions and blocks when their definitions are available. 106 IPAK_BasicInlining = 2, 107 108 /// Inline callees(C, C++, ObjC) when their definitions are available. 109 IPAK_Inlining = 3, 110 111 /// Enable inlining of dynamically dispatched methods. 112 IPAK_DynamicDispatch = 4, 113 114 /// Enable inlining of dynamically dispatched methods, bifurcate paths when 115 /// exact type info is unavailable. 116 IPAK_DynamicDispatchBifurcate = 5 117 }; 118 119 class AnalyzerOptions : public RefCountedBase<AnalyzerOptions> { 120 public: 121 typedef llvm::StringMap<std::string> ConfigTable; 122 123 /// \brief Pair of checker name and enable/disable. 124 std::vector<std::pair<std::string, bool> > CheckersControlList; 125 126 /// \brief A key-value table of use-specified configuration values. 127 ConfigTable Config; 128 AnalysisStores AnalysisStoreOpt; 129 AnalysisConstraints AnalysisConstraintsOpt; 130 AnalysisDiagClients AnalysisDiagOpt; 131 AnalysisPurgeMode AnalysisPurgeOpt; 132 133 std::string AnalyzeSpecificFunction; 134 135 /// \brief The maximum number of times the analyzer visits a block. 136 unsigned maxBlockVisitOnPath; 137 138 139 unsigned ShowCheckerHelp : 1; 140 unsigned AnalyzeAll : 1; 141 unsigned AnalyzerDisplayProgress : 1; 142 unsigned AnalyzeNestedBlocks : 1; 143 144 /// \brief The flag regulates if we should eagerly assume evaluations of 145 /// conditionals, thus, bifurcating the path. 146 /// 147 /// This flag indicates how the engine should handle expressions such as: 'x = 148 /// (y != 0)'. When this flag is true then the subexpression 'y != 0' will be 149 /// eagerly assumed to be true or false, thus evaluating it to the integers 0 150 /// or 1 respectively. The upside is that this can increase analysis 151 /// precision until we have a better way to lazily evaluate such logic. The 152 /// downside is that it eagerly bifurcates paths. 153 unsigned eagerlyAssumeBinOpBifurcation : 1; 154 155 unsigned TrimGraph : 1; 156 unsigned visualizeExplodedGraphWithGraphViz : 1; 157 unsigned visualizeExplodedGraphWithUbiGraph : 1; 158 unsigned UnoptimizedCFG : 1; 159 unsigned PrintStats : 1; 160 161 /// \brief Do not re-analyze paths leading to exhausted nodes with a different 162 /// strategy. We get better code coverage when retry is enabled. 163 unsigned NoRetryExhausted : 1; 164 165 /// \brief The inlining stack depth limit. 166 unsigned InlineMaxStackDepth; 167 168 /// \brief The mode of function selection used during inlining. 169 AnalysisInliningMode InliningMode; 170 171 private: 172 /// \brief Describes the kinds for high-level analyzer mode. 173 enum UserModeKind { 174 UMK_NotSet = 0, 175 /// Perform shallow but fast analyzes. 176 UMK_Shallow = 1, 177 /// Perform deep analyzes. 178 UMK_Deep = 2 179 }; 180 181 /// Controls the high-level analyzer mode, which influences the default 182 /// settings for some of the lower-level config options (such as IPAMode). 183 /// \sa getUserMode 184 UserModeKind UserMode; 185 186 /// Controls the mode of inter-procedural analysis. 187 IPAKind IPAMode; 188 189 /// Controls which C++ member functions will be considered for inlining. 190 CXXInlineableMemberKind CXXMemberInliningMode; 191 192 /// \sa includeTemporaryDtorsInCFG 193 Optional<bool> IncludeTemporaryDtorsInCFG; 194 195 /// \sa mayInlineCXXStandardLibrary 196 Optional<bool> InlineCXXStandardLibrary; 197 198 /// \sa mayInlineTemplateFunctions 199 Optional<bool> InlineTemplateFunctions; 200 201 /// \sa mayInlineCXXContainerCtorsAndDtors 202 Optional<bool> InlineCXXContainerCtorsAndDtors; 203 204 /// \sa mayInlineCXXSharedPtrDtor 205 Optional<bool> InlineCXXSharedPtrDtor; 206 207 /// \sa mayInlineObjCMethod 208 Optional<bool> ObjCInliningMode; 209 210 // Cache of the "ipa-always-inline-size" setting. 211 // \sa getAlwaysInlineSize 212 Optional<unsigned> AlwaysInlineSize; 213 214 /// \sa shouldSuppressNullReturnPaths 215 Optional<bool> SuppressNullReturnPaths; 216 217 // \sa getMaxInlinableSize 218 Optional<unsigned> MaxInlinableSize; 219 220 /// \sa shouldAvoidSuppressingNullArgumentPaths 221 Optional<bool> AvoidSuppressingNullArgumentPaths; 222 223 /// \sa shouldSuppressInlinedDefensiveChecks 224 Optional<bool> SuppressInlinedDefensiveChecks; 225 226 /// \sa shouldSuppressFromCXXStandardLibrary 227 Optional<bool> SuppressFromCXXStandardLibrary; 228 229 /// \sa reportIssuesInMainSourceFile 230 Optional<bool> ReportIssuesInMainSourceFile; 231 232 /// \sa getGraphTrimInterval 233 Optional<unsigned> GraphTrimInterval; 234 235 /// \sa getMaxTimesInlineLarge 236 Optional<unsigned> MaxTimesInlineLarge; 237 238 /// \sa getMaxNodesPerTopLevelFunction 239 Optional<unsigned> MaxNodesPerTopLevelFunction; 240 241 public: 242 /// Interprets an option's string value as a boolean. 243 /// 244 /// Accepts the strings "true" and "false". 245 /// If an option value is not provided, returns the given \p DefaultVal. 246 bool getBooleanOption(StringRef Name, bool DefaultVal); 247 248 /// Variant that accepts a Optional value to cache the result. 249 bool getBooleanOption(Optional<bool> &V, StringRef Name, bool DefaultVal); 250 251 /// Interprets an option's string value as an integer value. 252 int getOptionAsInteger(StringRef Name, int DefaultVal); 253 254 /// \brief Retrieves and sets the UserMode. This is a high-level option, 255 /// which is used to set other low-level options. It is not accessible 256 /// outside of AnalyzerOptions. 257 UserModeKind getUserMode(); 258 259 /// \brief Returns the inter-procedural analysis mode. 260 IPAKind getIPAMode(); 261 262 /// Returns the option controlling which C++ member functions will be 263 /// considered for inlining. 264 /// 265 /// This is controlled by the 'c++-inlining' config option. 266 /// 267 /// \sa CXXMemberInliningMode 268 bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K); 269 270 /// Returns true if ObjectiveC inlining is enabled, false otherwise. 271 bool mayInlineObjCMethod(); 272 273 /// Returns whether or not the destructors for C++ temporary objects should 274 /// be included in the CFG. 275 /// 276 /// This is controlled by the 'cfg-temporary-dtors' config option, which 277 /// accepts the values "true" and "false". 278 bool includeTemporaryDtorsInCFG(); 279 280 /// Returns whether or not C++ standard library functions may be considered 281 /// for inlining. 282 /// 283 /// This is controlled by the 'c++-stdlib-inlining' config option, which 284 /// accepts the values "true" and "false". 285 bool mayInlineCXXStandardLibrary(); 286 287 /// Returns whether or not templated functions may be considered for inlining. 288 /// 289 /// This is controlled by the 'c++-template-inlining' config option, which 290 /// accepts the values "true" and "false". 291 bool mayInlineTemplateFunctions(); 292 293 /// Returns whether or not constructors and destructors of C++ container 294 /// objects may be considered for inlining. 295 /// 296 /// This is controlled by the 'c++-container-inlining' config option, which 297 /// accepts the values "true" and "false". 298 bool mayInlineCXXContainerCtorsAndDtors(); 299 300 /// Returns whether or not the destructor of C++ 'shared_ptr' may be 301 /// considered for inlining. 302 /// 303 /// This covers std::shared_ptr, std::tr1::shared_ptr, and boost::shared_ptr, 304 /// and indeed any destructor named "~shared_ptr". 305 /// 306 /// This is controlled by the 'c++-shared_ptr-inlining' config option, which 307 /// accepts the values "true" and "false". 308 bool mayInlineCXXSharedPtrDtor(); 309 310 /// Returns whether or not paths that go through null returns should be 311 /// suppressed. 312 /// 313 /// This is a heuristic for avoiding bug reports with paths that go through 314 /// inlined functions that are more defensive than their callers. 315 /// 316 /// This is controlled by the 'suppress-null-return-paths' config option, 317 /// which accepts the values "true" and "false". 318 bool shouldSuppressNullReturnPaths(); 319 320 /// Returns whether a bug report should \em not be suppressed if its path 321 /// includes a call with a null argument, even if that call has a null return. 322 /// 323 /// This option has no effect when #shouldSuppressNullReturnPaths() is false. 324 /// 325 /// This is a counter-heuristic to avoid false negatives. 326 /// 327 /// This is controlled by the 'avoid-suppressing-null-argument-paths' config 328 /// option, which accepts the values "true" and "false". 329 bool shouldAvoidSuppressingNullArgumentPaths(); 330 331 /// Returns whether or not diagnostics containing inlined defensive NULL 332 /// checks should be suppressed. 333 /// 334 /// This is controlled by the 'suppress-inlined-defensive-checks' config 335 /// option, which accepts the values "true" and "false". 336 bool shouldSuppressInlinedDefensiveChecks(); 337 338 /// Returns whether or not diagnostics reported within the C++ standard 339 /// library should be suppressed. 340 /// 341 /// This is controlled by the 'suppress-c++-stdlib' config option, 342 /// which accepts the values "true" and "false". 343 bool shouldSuppressFromCXXStandardLibrary(); 344 345 /// Returns whether or not the diagnostic report should be always reported 346 /// in the main source file and not the headers. 347 /// 348 /// This is controlled by the 'report-in-main-source-file' config option, 349 /// which accepts the values "true" and "false". 350 bool shouldReportIssuesInMainSourceFile(); 351 352 /// Returns whether irrelevant parts of a bug report path should be pruned 353 /// out of the final output. 354 /// 355 /// This is controlled by the 'prune-paths' config option, which accepts the 356 /// values "true" and "false". 357 bool shouldPrunePaths(); 358 359 /// Returns true if 'static' initializers should be in conditional logic 360 /// in the CFG. 361 bool shouldConditionalizeStaticInitializers(); 362 363 // Returns the size of the functions (in basic blocks), which should be 364 // considered to be small enough to always inline. 365 // 366 // This is controlled by "ipa-always-inline-size" analyzer-config option. 367 unsigned getAlwaysInlineSize(); 368 369 // Returns the bound on the number of basic blocks in an inlined function 370 // (50 by default). 371 // 372 // This is controlled by "-analyzer-config max-inlinable-size" option. 373 unsigned getMaxInlinableSize(); 374 375 /// Returns true if the analyzer engine should synthesize fake bodies 376 /// for well-known functions. 377 bool shouldSynthesizeBodies(); 378 379 /// Returns how often nodes in the ExplodedGraph should be recycled to save 380 /// memory. 381 /// 382 /// This is controlled by the 'graph-trim-interval' config option. To disable 383 /// node reclamation, set the option to "0". 384 unsigned getGraphTrimInterval(); 385 386 /// Returns the maximum times a large function could be inlined. 387 /// 388 /// This is controlled by the 'max-times-inline-large' config option. 389 unsigned getMaxTimesInlineLarge(); 390 391 /// Returns the maximum number of nodes the analyzer can generate while 392 /// exploring a top level function (for each exploded graph). 393 /// 150000 is default; 0 means no limit. 394 /// 395 /// This is controlled by the 'max-nodes' config option. 396 unsigned getMaxNodesPerTopLevelFunction(); 397 398 public: 399 AnalyzerOptions() : 400 AnalysisStoreOpt(RegionStoreModel), 401 AnalysisConstraintsOpt(RangeConstraintsModel), 402 AnalysisDiagOpt(PD_HTML), 403 AnalysisPurgeOpt(PurgeStmt), 404 ShowCheckerHelp(0), 405 AnalyzeAll(0), 406 AnalyzerDisplayProgress(0), 407 AnalyzeNestedBlocks(0), 408 eagerlyAssumeBinOpBifurcation(0), 409 TrimGraph(0), 410 visualizeExplodedGraphWithGraphViz(0), 411 visualizeExplodedGraphWithUbiGraph(0), 412 UnoptimizedCFG(0), 413 PrintStats(0), 414 NoRetryExhausted(0), 415 // Cap the stack depth at 4 calls (5 stack frames, base + 4 calls). 416 InlineMaxStackDepth(5), 417 InliningMode(NoRedundancy), 418 UserMode(UMK_NotSet), 419 IPAMode(IPAK_NotSet), 420 CXXMemberInliningMode() {} 421 422 }; 423 424 typedef IntrusiveRefCntPtr<AnalyzerOptions> AnalyzerOptionsRef; 425 426 } 427 428 #endif 429
