1//===-- AnalyzerOptions.def - Metadata about Static Analyses ----*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file defines the analyzer options avaible with -analyzer-config. 10// 11//===----------------------------------------------------------------------===// 12 13#ifndef LLVM_ADT_STRINGREF_H 14#error This .def file is expected to be included in translation units where \ 15"llvm/ADT/StringRef.h" is already included! 16#endif 17 18#ifdef ANALYZER_OPTION 19#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE 20#error If you didnt include this file with the intent of generating methods, \ 21define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros! 22#endif 23#endif 24 25#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE 26#ifdef ANALYZER_OPTION 27#error If you didnt include this file with the intent of generating methods, \ 28define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros! 29#endif 30#endif 31 32#ifndef ANALYZER_OPTION 33/// Create a new analyzer option, but dont generate a method for it in 34/// AnalyzerOptions. 35/// 36/// TYPE - The type of the option object that will be stored in 37/// AnalyzerOptions. This file is expected to be icluded in translation 38/// units where AnalyzerOptions.h is included, so types from that 39/// header should be used. 40/// NAME - The name of the option object. 41/// CMDFLAG - The command line flag for the option. 42/// (-analyzer-config CMDFLAG=VALUE) 43/// DESC - Description of the flag. 44/// DEFAULT_VAL - The default value for CMDFLAG. 45#define ANALYZER_OPTION(TYPE, NAME, CMDFLAG, DESC, DEFAULT_VAL) 46#endif 47 48#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE 49/// Create a new analyzer option, but dont generate a method for it in 50/// AnalyzerOptions. It's value depends on the option "user-mode". 51/// 52/// TYPE - The type of the option object that will be stored in 53/// AnalyzerOptions. This file is expected to be icluded in translation 54/// units where AnalyzerOptions.h is included, so types from that 55/// header should be used. 56/// NAME - The name of the option object. 57/// CMDFLAG - The command line flag for the option. 58/// (-analyzer-config CMDFLAG=VALUE) 59/// DESC - Description of the flag. 60/// SHALLOW_VAL - The default value for CMDFLAG, when "user-mode" was set to 61/// "shallow". 62/// DEEP_VAL - The default value for CMDFLAG, when "user-mode" was set to 63/// "deep". 64#define ANALYZER_OPTION_DEPENDS_ON_USER_MODE(TYPE, NAME, CMDFLAG, DESC, \ 65 SHALLOW_VAL, DEEP_VAL) 66#endif 67 68//===----------------------------------------------------------------------===// 69// The "mode" option. Since some options depend on this, we list it on top of 70// this file in order to make sure that the generated field for it is 71// initialized before the rest. 72//===----------------------------------------------------------------------===// 73 74ANALYZER_OPTION( 75 StringRef, UserMode, "mode", 76 "(string) Controls the high-level analyzer mode, which influences the " 77 "default settings for some of the lower-level config options (such as " 78 "IPAMode). Value: \"deep\", \"shallow\".", 79 "deep") 80 81//===----------------------------------------------------------------------===// 82// Boolean analyzer options. 83//===----------------------------------------------------------------------===// 84 85ANALYZER_OPTION(bool, ShouldIncludeImplicitDtorsInCFG, "cfg-implicit-dtors", 86 "Whether or not implicit destructors for C++ objects " 87 "should be included in the CFG.", 88 true) 89 90ANALYZER_OPTION(bool, ShouldIncludeTemporaryDtorsInCFG, "cfg-temporary-dtors", 91 "Whether or not the destructors for C++ temporary " 92 "objects should be included in the CFG.", 93 true) 94 95ANALYZER_OPTION( 96 bool, ShouldIncludeLifetimeInCFG, "cfg-lifetime", 97 "Whether or not end-of-lifetime information should be included in the CFG.", 98 false) 99 100ANALYZER_OPTION(bool, ShouldIncludeLoopExitInCFG, "cfg-loopexit", 101 "Whether or not the end of the loop information should " 102 "be included in the CFG.", 103 false) 104 105ANALYZER_OPTION(bool, ShouldIncludeRichConstructorsInCFG, 106 "cfg-rich-constructors", 107 "Whether or not construction site information should be " 108 "included in the CFG C++ constructor elements.", 109 true) 110 111ANALYZER_OPTION( 112 bool, ShouldIncludeScopesInCFG, "cfg-scopes", 113 "Whether or not scope information should be included in the CFG.", false) 114 115ANALYZER_OPTION(bool, ShouldIncludeDefaultInitForAggregates, 116 "cfg-expand-default-aggr-inits", 117 "Whether or not inline CXXDefaultInitializers for aggregate " 118 "initialization in the CFG.", 119 false) 120 121ANALYZER_OPTION( 122 bool, MayInlineTemplateFunctions, "c++-template-inlining", 123 "Whether or not templated functions may be considered for inlining.", true) 124 125ANALYZER_OPTION(bool, MayInlineCXXStandardLibrary, "c++-stdlib-inlining", 126 "Whether or not C++ standard library functions may be " 127 "considered for inlining.", 128 true) 129 130ANALYZER_OPTION(bool, MayInlineCXXAllocator, "c++-allocator-inlining", 131 "Whether or not allocator call may be considered for inlining.", 132 true) 133 134ANALYZER_OPTION( 135 bool, MayInlineCXXSharedPtrDtor, "c++-shared_ptr-inlining", 136 "Whether or not the destructor of C++ 'shared_ptr' may be considered for " 137 "inlining. This covers std::shared_ptr, std::tr1::shared_ptr, and " 138 "boost::shared_ptr, and indeed any destructor named '~shared_ptr'.", 139 false) 140 141ANALYZER_OPTION(bool, MayInlineCXXTemporaryDtors, "c++-temp-dtor-inlining", 142 "Whether C++ temporary destructors should be inlined " 143 "during analysis. If temporary destructors are disabled " 144 "in the CFG via the 'cfg-temporary-dtors' option, " 145 "temporary destructors would not be inlined anyway.", 146 true) 147 148ANALYZER_OPTION( 149 bool, ShouldSuppressNullReturnPaths, "suppress-null-return-paths", 150 "Whether or not paths that go through null returns should be suppressed. " 151 "This is a heuristic for avoiding bug reports with paths that go through " 152 "inlined functions that are more defensive than their callers.", 153 true) 154 155ANALYZER_OPTION( 156 bool, ShouldAvoidSuppressingNullArgumentPaths, 157 "avoid-suppressing-null-argument-paths", 158 "Whether a bug report should not be suppressed if its path includes a call " 159 "with a null argument, even if that call has a null return. This option " 160 "has no effect when ShouldSuppressNullReturnPaths is false. This is a " 161 "counter-heuristic to avoid false negatives.", 162 false) 163 164ANALYZER_OPTION(bool, ShouldSuppressInlinedDefensiveChecks, 165 "suppress-inlined-defensive-checks", 166 "Whether or not diagnostics containing inlined " 167 "defensive NULL checks should be suppressed.", 168 true) 169 170ANALYZER_OPTION(bool, MayInlineCXXContainerMethods, "c++-container-inlining", 171 "Whether or not methods of C++ container objects may be " 172 "considered for inlining.", 173 false) 174 175ANALYZER_OPTION(bool, ShouldSuppressFromCXXStandardLibrary, 176 "suppress-c++-stdlib", 177 "Whether or not diagnostics reported within the C++ " 178 "standard library should be suppressed.", 179 true) 180 181ANALYZER_OPTION(bool, ShouldCrosscheckWithZ3, "crosscheck-with-z3", 182 "Whether bug reports should be crosschecked with the Z3 " 183 "constraint manager backend.", 184 false) 185 186ANALYZER_OPTION(bool, ShouldReportIssuesInMainSourceFile, 187 "report-in-main-source-file", 188 "Whether or not the diagnostic report should be always " 189 "reported in the main source file and not the headers.", 190 false) 191 192ANALYZER_OPTION(bool, ShouldWriteStableReportFilename, "stable-report-filename", 193 "Whether or not the report filename should be random or not.", 194 false) 195 196ANALYZER_OPTION( 197 bool, ShouldSerializeStats, "serialize-stats", 198 "Whether the analyzer should serialize statistics to plist output. " 199 "Statistics would be serialized in JSON format inside the main dictionary " 200 "under the statistics key. Available only if compiled in assert mode or " 201 "with LLVM statistics explicitly enabled.", 202 false) 203 204ANALYZER_OPTION(bool, MayInlineObjCMethod, "objc-inlining", 205 "Whether ObjectiveC inlining is enabled, false otherwise.", 206 true) 207 208ANALYZER_OPTION(bool, ShouldPrunePaths, "prune-paths", 209 "Whether irrelevant parts of a bug report path should " 210 "be pruned out of the final output.", 211 true) 212 213ANALYZER_OPTION(bool, ShouldAddPopUpNotes, "add-pop-up-notes", 214 "Whether pop-up notes should be added to the final output.", 215 true) 216 217ANALYZER_OPTION( 218 bool, ShouldConditionalizeStaticInitializers, 219 "cfg-conditional-static-initializers", 220 "Whether 'static' initializers should be in conditional logic in the CFG.", 221 true) 222 223ANALYZER_OPTION(bool, ShouldSynthesizeBodies, "faux-bodies", 224 "Whether the analyzer engine should synthesize fake " 225 "bodies for well-known functions.", 226 true) 227 228ANALYZER_OPTION( 229 bool, ShouldElideConstructors, "elide-constructors", 230 "Whether elidable C++ copy-constructors and move-constructors should be " 231 "actually elided during analysis. Both behaviors are allowed by the C++ " 232 "standard, and the analyzer, like CodeGen, defaults to eliding. Starting " 233 "with C++17 some elisions become mandatory, and in these cases the option " 234 "will be ignored.", 235 true) 236 237ANALYZER_OPTION( 238 bool, ShouldInlineLambdas, "inline-lambdas", 239 "Whether lambdas should be inlined. Otherwise a sink node will be " 240 "generated each time a LambdaExpr is visited.", 241 true) 242 243ANALYZER_OPTION(bool, ShouldWidenLoops, "widen-loops", 244 "Whether the analysis should try to widen loops.", false) 245 246ANALYZER_OPTION( 247 bool, ShouldUnrollLoops, "unroll-loops", 248 "Whether the analysis should try to unroll loops with known bounds.", false) 249 250ANALYZER_OPTION( 251 bool, ShouldDisplayNotesAsEvents, "notes-as-events", 252 "Whether the bug reporter should transparently treat extra note diagnostic " 253 "pieces as event diagnostic pieces. Useful when the diagnostic consumer " 254 "doesn't support the extra note pieces.", 255 false) 256 257ANALYZER_OPTION( 258 bool, ShouldAggressivelySimplifyBinaryOperation, 259 "aggressive-binary-operation-simplification", 260 "Whether SValBuilder should rearrange comparisons and additive operations " 261 "of symbolic expressions which consist of a sum of a symbol and a concrete " 262 "integer into the format where symbols are on the left-hand side and the " 263 "integer is on the right. This is only done if both symbols and both " 264 "concrete integers are signed, greater than or equal to the quarter of the " 265 "minimum value of the type and less than or equal to the quarter of the " 266 "maximum value of that type. A + n <OP> B + m becomes A - B <OP> m - n, " 267 "where A and B symbolic, n and m are integers. <OP> is any of '==', '!=', " 268 "'<', '<=', '>', '>=', '+' or '-'. The rearrangement also happens with '-' " 269 "instead of '+' on either or both side and also if any or both integers " 270 "are missing.", 271 false) 272 273ANALYZER_OPTION( 274 bool, ShouldEagerlyAssume, "eagerly-assume", 275 "Whether we should eagerly assume evaluations of conditionals, thus, " 276 "bifurcating the path. This indicates how the engine should handle " 277 "expressions such as: 'x = (y != 0)'. When this is true then the " 278 "subexpression 'y != 0' will be eagerly assumed to be true or false, thus " 279 "evaluating it to the integers 0 or 1 respectively. The upside is that " 280 "this can increase analysis precision until we have a better way to lazily " 281 "evaluate such logic. The downside is that it eagerly bifurcates paths.", 282 true) 283 284ANALYZER_OPTION( 285 bool, IsNaiveCTUEnabled, "experimental-enable-naive-ctu-analysis", 286 "Whether naive cross translation unit analysis is enabled. This is an " 287 "experimental feature to inline functions from other translation units.", 288 false) 289 290ANALYZER_OPTION(bool, ShouldDisplayMacroExpansions, "expand-macros", 291 "Whether macros related to the bugpath should be " 292 "expanded and included in the plist output.", 293 false) 294 295ANALYZER_OPTION(bool, DisplayCTUProgress, "display-ctu-progress", 296 "Whether to emit verbose output about " 297 "the analyzer's progress related to ctu.", 298 false) 299 300ANALYZER_OPTION(bool, ShouldTrackConditions, "track-conditions", 301 "Whether to track conditions that are a control dependency of " 302 "an already tracked variable.", 303 true) 304 305ANALYZER_OPTION(bool, ShouldTrackConditionsDebug, "track-conditions-debug", 306 "Whether to place an event at each tracked condition.", 307 false) 308 309ANALYZER_OPTION(bool, ShouldApplyFixIts, "apply-fixits", 310 "Apply the fix-it hints to the files", 311 false) 312 313ANALYZER_OPTION(bool, ShouldDisplayCheckerNameForText, "display-checker-name", 314 "Display the checker name for textual outputs", 315 true) 316 317//===----------------------------------------------------------------------===// 318// Unsigned analyzer options. 319//===----------------------------------------------------------------------===// 320 321ANALYZER_OPTION(unsigned, CTUImportThreshold, "ctu-import-threshold", 322 "The maximal amount of translation units that is considered " 323 "for import when inlining functions during CTU analysis. " 324 "Lowering this threshold can alleviate the memory burden of " 325 "analysis with many interdependent definitions located in " 326 "various translation units. This is valid only for non C++ " 327 "source files.", 328 24u) 329 330ANALYZER_OPTION(unsigned, CTUImportCppThreshold, "ctu-import-cpp-threshold", 331 "The maximal amount of translation units that is considered " 332 "for import when inlining functions during CTU analysis of C++ " 333 "source files.", 334 8u) 335 336ANALYZER_OPTION( 337 unsigned, AlwaysInlineSize, "ipa-always-inline-size", 338 "The size of the functions (in basic blocks), which should be considered " 339 "to be small enough to always inline.", 340 3) 341 342ANALYZER_OPTION( 343 unsigned, GraphTrimInterval, "graph-trim-interval", 344 "How often nodes in the ExplodedGraph should be recycled to save memory. " 345 "To disable node reclamation, set the option to 0.", 346 1000) 347 348ANALYZER_OPTION( 349 unsigned, MinCFGSizeTreatFunctionsAsLarge, 350 "min-cfg-size-treat-functions-as-large", 351 "The number of basic blocks a function needs to have to be considered " 352 "large for the 'max-times-inline-large' config option.", 353 14) 354 355ANALYZER_OPTION(unsigned, MaxSymbolComplexity, "max-symbol-complexity", 356 "The maximum complexity of symbolic constraint.", 35) 357 358ANALYZER_OPTION(unsigned, MaxTimesInlineLarge, "max-times-inline-large", 359 "The maximum times a large function could be inlined.", 32) 360 361ANALYZER_OPTION_DEPENDS_ON_USER_MODE( 362 unsigned, MaxInlinableSize, "max-inlinable-size", 363 "The bound on the number of basic blocks in an inlined function.", 364 /* SHALLOW_VAL */ 4, /* DEEP_VAL */ 100) 365 366ANALYZER_OPTION_DEPENDS_ON_USER_MODE( 367 unsigned, MaxNodesPerTopLevelFunction, "max-nodes", 368 "The maximum number of nodes the analyzer can generate while exploring a " 369 "top level function (for each exploded graph). 0 means no limit.", 370 /* SHALLOW_VAL */ 75000, /* DEEP_VAL */ 225000) 371 372ANALYZER_OPTION( 373 unsigned, RegionStoreSmallStructLimit, "region-store-small-struct-limit", 374 "The largest number of fields a struct can have and still be considered " 375 "small This is currently used to decide whether or not it is worth forcing " 376 "a LazyCompoundVal on bind. To disable all small-struct-dependent " 377 "behavior, set the option to 0.", 378 2) 379 380//===----------------------------------------------------------------------===// 381// String analyzer options. 382//===----------------------------------------------------------------------===// 383 384ANALYZER_OPTION(StringRef, CTUDir, "ctu-dir", 385 "The directory containing the CTU related files.", "") 386 387ANALYZER_OPTION(StringRef, CTUIndexName, "ctu-index-name", 388 "The name of the file containing the CTU index of definitions. " 389 "The index file maps USR-names to identifiers. An identifier " 390 "can end with an '.ast' suffix, indicating the indentifier is " 391 "a path to a pch-dump. Otherwise the identifier is regarded as " 392 "path to a source file which is parsed on-demand. Relative " 393 "paths are prefixed with ctu-dir, absolute paths are used " 394 "unmodified during lookup.", 395 "externalDefMap.txt") 396 397ANALYZER_OPTION( 398 StringRef, CTUInvocationList, "ctu-invocation-list", 399 "The path to the YAML format file containing a mapping from source file " 400 "paths to command-line invocations represented as a list of arguments. " 401 "This invocation is used produce the source-file's AST in case on-demand " 402 "loading is performed. Example file-content: " 403 "{/main.cpp: [clang++, /main.cpp], other.cpp: [clang++, /other.cpp]}", 404 "invocations.yaml") 405 406ANALYZER_OPTION( 407 StringRef, ModelPath, "model-path", 408 "The analyzer can inline an alternative implementation written in C at the " 409 "call site if the called function's body is not available. This is a path " 410 "where to look for those alternative implementations (called models).", 411 "") 412 413ANALYZER_OPTION( 414 StringRef, CXXMemberInliningMode, "c++-inlining", 415 "Controls which C++ member functions will be considered for inlining. " 416 "Value: \"constructors\", \"destructors\", \"methods\".", 417 "destructors") 418 419ANALYZER_OPTION( 420 StringRef, ExplorationStrategy, "exploration_strategy", 421 "Value: \"dfs\", \"bfs\", \"unexplored_first\", " 422 "\"unexplored_first_queue\", \"unexplored_first_location_queue\", " 423 "\"bfs_block_dfs_contents\".", 424 "unexplored_first_queue") 425 426ANALYZER_OPTION( 427 StringRef, RawSilencedCheckersAndPackages, "silence-checkers", 428 "A semicolon separated list of checker and package names to silence. " 429 "Silenced checkers will not emit reports, but the modeling remain enabled.", 430 "") 431 432ANALYZER_OPTION_DEPENDS_ON_USER_MODE( 433 StringRef, IPAMode, "ipa", 434 "Controls the mode of inter-procedural analysis. Value: \"none\", " 435 "\"basic-inlining\", \"inlining\", \"dynamic\", \"dynamic-bifurcate\".", 436 /* SHALLOW_VAL */ "inlining", /* DEEP_VAL */ "dynamic-bifurcate") 437 438#undef ANALYZER_OPTION_DEPENDS_ON_USER_MODE 439#undef ANALYZER_OPTION 440