1 //===--- AnalyzerOptions.h - Analysis Engine Options ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This header defines various options for the static analyzer that are set 11 // by the frontend and are consulted throughout the analyzer. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #ifndef LLVM_CLANG_ANALYZEROPTIONS_H 16 #define LLVM_CLANG_ANALYZEROPTIONS_H 17 18 #include "clang/Basic/LLVM.h" 19 #include "llvm/ADT/IntrusiveRefCntPtr.h" 20 #include "llvm/ADT/Optional.h" 21 #include "llvm/ADT/StringMap.h" 22 #include <string> 23 #include <vector> 24 25 namespace clang { 26 class ASTConsumer; 27 class DiagnosticsEngine; 28 class Preprocessor; 29 class LangOptions; 30 31 /// Analysis - Set of available source code analyses. 32 enum Analyses { 33 #define ANALYSIS(NAME, CMDFLAG, DESC, SCOPE) NAME, 34 #include "clang/StaticAnalyzer/Core/Analyses.def" 35 NumAnalyses 36 }; 37 38 /// AnalysisStores - Set of available analysis store models. 39 enum AnalysisStores { 40 #define ANALYSIS_STORE(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 41 #include "clang/StaticAnalyzer/Core/Analyses.def" 42 NumStores 43 }; 44 45 /// AnalysisConstraints - Set of available constraint models. 46 enum AnalysisConstraints { 47 #define ANALYSIS_CONSTRAINTS(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 48 #include "clang/StaticAnalyzer/Core/Analyses.def" 49 NumConstraints 50 }; 51 52 /// AnalysisDiagClients - Set of available diagnostic clients for rendering 53 /// analysis results. 54 enum AnalysisDiagClients { 55 #define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATFN) PD_##NAME, 56 #include "clang/StaticAnalyzer/Core/Analyses.def" 57 PD_NONE, 58 NUM_ANALYSIS_DIAG_CLIENTS 59 }; 60 61 /// AnalysisPurgeModes - Set of available strategies for dead symbol removal. 62 enum AnalysisPurgeMode { 63 #define ANALYSIS_PURGE(NAME, CMDFLAG, DESC) NAME, 64 #include "clang/StaticAnalyzer/Core/Analyses.def" 65 NumPurgeModes 66 }; 67 68 /// AnalysisInlineFunctionSelection - Set of inlining function selection heuristics. 69 enum AnalysisInliningMode { 70 #define ANALYSIS_INLINING_MODE(NAME, CMDFLAG, DESC) NAME, 71 #include "clang/StaticAnalyzer/Core/Analyses.def" 72 NumInliningModes 73 }; 74 75 /// \brief Describes the different kinds of C++ member functions which can be 76 /// considered for inlining by the analyzer. 77 /// 78 /// These options are cumulative; enabling one kind of member function will 79 /// enable all kinds with lower enum values. 80 enum CXXInlineableMemberKind { 81 // Uninitialized = 0, 82 83 /// A dummy mode in which no C++ inlining is enabled. 84 CIMK_None = 1, 85 86 /// Refers to regular member function and operator calls. 87 CIMK_MemberFunctions, 88 89 /// Refers to constructors (implicit or explicit). 90 /// 91 /// Note that a constructor will not be inlined if the corresponding 92 /// destructor is non-trivial. 93 CIMK_Constructors, 94 95 /// Refers to destructors (implicit or explicit). 96 CIMK_Destructors 97 }; 98 99 /// \brief Describes the different modes of inter-procedural analysis. 100 enum IPAKind { 101 IPAK_NotSet = 0, 102 103 /// Perform only intra-procedural analysis. 104 IPAK_None = 1, 105 106 /// Inline C functions and blocks when their definitions are available. 107 IPAK_BasicInlining = 2, 108 109 /// Inline callees(C, C++, ObjC) when their definitions are available. 110 IPAK_Inlining = 3, 111 112 /// Enable inlining of dynamically dispatched methods. 113 IPAK_DynamicDispatch = 4, 114 115 /// Enable inlining of dynamically dispatched methods, bifurcate paths when 116 /// exact type info is unavailable. 117 IPAK_DynamicDispatchBifurcate = 5 118 }; 119 120 class AnalyzerOptions : public RefCountedBase<AnalyzerOptions> { 121 public: 122 typedef llvm::StringMap<std::string> ConfigTable; 123 124 /// \brief Pair of checker name and enable/disable. 125 std::vector<std::pair<std::string, bool> > CheckersControlList; 126 127 /// \brief A key-value table of use-specified configuration values. 128 ConfigTable Config; 129 AnalysisStores AnalysisStoreOpt; 130 AnalysisConstraints AnalysisConstraintsOpt; 131 AnalysisDiagClients AnalysisDiagOpt; 132 AnalysisPurgeMode AnalysisPurgeOpt; 133 134 std::string AnalyzeSpecificFunction; 135 136 /// \brief The maximum number of times the analyzer visits a block. 137 unsigned maxBlockVisitOnPath; 138 139 140 unsigned ShowCheckerHelp : 1; 141 unsigned AnalyzeAll : 1; 142 unsigned AnalyzerDisplayProgress : 1; 143 unsigned AnalyzeNestedBlocks : 1; 144 145 /// \brief The flag regulates if we should eagerly assume evaluations of 146 /// conditionals, thus, bifurcating the path. 147 /// 148 /// This flag indicates how the engine should handle expressions such as: 'x = 149 /// (y != 0)'. When this flag is true then the subexpression 'y != 0' will be 150 /// eagerly assumed to be true or false, thus evaluating it to the integers 0 151 /// or 1 respectively. The upside is that this can increase analysis 152 /// precision until we have a better way to lazily evaluate such logic. The 153 /// downside is that it eagerly bifurcates paths. 154 unsigned eagerlyAssumeBinOpBifurcation : 1; 155 156 unsigned TrimGraph : 1; 157 unsigned visualizeExplodedGraphWithGraphViz : 1; 158 unsigned visualizeExplodedGraphWithUbiGraph : 1; 159 unsigned UnoptimizedCFG : 1; 160 unsigned PrintStats : 1; 161 162 /// \brief Do not re-analyze paths leading to exhausted nodes with a different 163 /// strategy. We get better code coverage when retry is enabled. 164 unsigned NoRetryExhausted : 1; 165 166 /// \brief The inlining stack depth limit. 167 unsigned InlineMaxStackDepth; 168 169 /// \brief The mode of function selection used during inlining. 170 AnalysisInliningMode InliningMode; 171 172 private: 173 /// \brief Describes the kinds for high-level analyzer mode. 174 enum UserModeKind { 175 UMK_NotSet = 0, 176 /// Perform shallow but fast analyzes. 177 UMK_Shallow = 1, 178 /// Perform deep analyzes. 179 UMK_Deep = 2 180 }; 181 182 /// Controls the high-level analyzer mode, which influences the default 183 /// settings for some of the lower-level config options (such as IPAMode). 184 /// \sa getUserMode 185 UserModeKind UserMode; 186 187 /// Controls the mode of inter-procedural analysis. 188 IPAKind IPAMode; 189 190 /// Controls which C++ member functions will be considered for inlining. 191 CXXInlineableMemberKind CXXMemberInliningMode; 192 193 /// \sa includeTemporaryDtorsInCFG 194 Optional<bool> IncludeTemporaryDtorsInCFG; 195 196 /// \sa mayInlineCXXStandardLibrary 197 Optional<bool> InlineCXXStandardLibrary; 198 199 /// \sa mayInlineTemplateFunctions 200 Optional<bool> InlineTemplateFunctions; 201 202 /// \sa mayInlineCXXAllocator 203 Optional<bool> InlineCXXAllocator; 204 205 /// \sa mayInlineCXXContainerMethods 206 Optional<bool> InlineCXXContainerMethods; 207 208 /// \sa mayInlineCXXSharedPtrDtor 209 Optional<bool> InlineCXXSharedPtrDtor; 210 211 /// \sa mayInlineObjCMethod 212 Optional<bool> ObjCInliningMode; 213 214 // Cache of the "ipa-always-inline-size" setting. 215 // \sa getAlwaysInlineSize 216 Optional<unsigned> AlwaysInlineSize; 217 218 /// \sa shouldSuppressNullReturnPaths 219 Optional<bool> SuppressNullReturnPaths; 220 221 // \sa getMaxInlinableSize 222 Optional<unsigned> MaxInlinableSize; 223 224 /// \sa shouldAvoidSuppressingNullArgumentPaths 225 Optional<bool> AvoidSuppressingNullArgumentPaths; 226 227 /// \sa shouldSuppressInlinedDefensiveChecks 228 Optional<bool> SuppressInlinedDefensiveChecks; 229 230 /// \sa shouldSuppressFromCXXStandardLibrary 231 Optional<bool> SuppressFromCXXStandardLibrary; 232 233 /// \sa reportIssuesInMainSourceFile 234 Optional<bool> ReportIssuesInMainSourceFile; 235 236 /// \sa StableReportFilename 237 Optional<bool> StableReportFilename; 238 239 /// \sa getGraphTrimInterval 240 Optional<unsigned> GraphTrimInterval; 241 242 /// \sa getMaxTimesInlineLarge 243 Optional<unsigned> MaxTimesInlineLarge; 244 245 /// \sa getMaxNodesPerTopLevelFunction 246 Optional<unsigned> MaxNodesPerTopLevelFunction; 247 248 public: 249 /// Interprets an option's string value as a boolean. 250 /// 251 /// Accepts the strings "true" and "false". 252 /// If an option value is not provided, returns the given \p DefaultVal. 253 bool getBooleanOption(StringRef Name, bool DefaultVal); 254 255 /// Variant that accepts a Optional value to cache the result. 256 bool getBooleanOption(Optional<bool> &V, StringRef Name, bool DefaultVal); 257 258 /// Interprets an option's string value as an integer value. 259 int getOptionAsInteger(StringRef Name, int DefaultVal); 260 261 /// \brief Retrieves and sets the UserMode. This is a high-level option, 262 /// which is used to set other low-level options. It is not accessible 263 /// outside of AnalyzerOptions. 264 UserModeKind getUserMode(); 265 266 /// \brief Returns the inter-procedural analysis mode. 267 IPAKind getIPAMode(); 268 269 /// Returns the option controlling which C++ member functions will be 270 /// considered for inlining. 271 /// 272 /// This is controlled by the 'c++-inlining' config option. 273 /// 274 /// \sa CXXMemberInliningMode 275 bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K); 276 277 /// Returns true if ObjectiveC inlining is enabled, false otherwise. 278 bool mayInlineObjCMethod(); 279 280 /// Returns whether or not the destructors for C++ temporary objects should 281 /// be included in the CFG. 282 /// 283 /// This is controlled by the 'cfg-temporary-dtors' config option, which 284 /// accepts the values "true" and "false". 285 bool includeTemporaryDtorsInCFG(); 286 287 /// Returns whether or not C++ standard library functions may be considered 288 /// for inlining. 289 /// 290 /// This is controlled by the 'c++-stdlib-inlining' config option, which 291 /// accepts the values "true" and "false". 292 bool mayInlineCXXStandardLibrary(); 293 294 /// Returns whether or not templated functions may be considered for inlining. 295 /// 296 /// This is controlled by the 'c++-template-inlining' config option, which 297 /// accepts the values "true" and "false". 298 bool mayInlineTemplateFunctions(); 299 300 /// Returns whether or not allocator call may be considered for inlining. 301 /// 302 /// This is controlled by the 'c++-allocator-inlining' config option, which 303 /// accepts the values "true" and "false". 304 bool mayInlineCXXAllocator(); 305 306 /// Returns whether or not methods of C++ container objects may be considered 307 /// for inlining. 308 /// 309 /// This is controlled by the 'c++-container-inlining' config option, which 310 /// accepts the values "true" and "false". 311 bool mayInlineCXXContainerMethods(); 312 313 /// Returns whether or not the destructor of C++ 'shared_ptr' may be 314 /// considered for inlining. 315 /// 316 /// This covers std::shared_ptr, std::tr1::shared_ptr, and boost::shared_ptr, 317 /// and indeed any destructor named "~shared_ptr". 318 /// 319 /// This is controlled by the 'c++-shared_ptr-inlining' config option, which 320 /// accepts the values "true" and "false". 321 bool mayInlineCXXSharedPtrDtor(); 322 323 /// Returns whether or not paths that go through null returns should be 324 /// suppressed. 325 /// 326 /// This is a heuristic for avoiding bug reports with paths that go through 327 /// inlined functions that are more defensive than their callers. 328 /// 329 /// This is controlled by the 'suppress-null-return-paths' config option, 330 /// which accepts the values "true" and "false". 331 bool shouldSuppressNullReturnPaths(); 332 333 /// Returns whether a bug report should \em not be suppressed if its path 334 /// includes a call with a null argument, even if that call has a null return. 335 /// 336 /// This option has no effect when #shouldSuppressNullReturnPaths() is false. 337 /// 338 /// This is a counter-heuristic to avoid false negatives. 339 /// 340 /// This is controlled by the 'avoid-suppressing-null-argument-paths' config 341 /// option, which accepts the values "true" and "false". 342 bool shouldAvoidSuppressingNullArgumentPaths(); 343 344 /// Returns whether or not diagnostics containing inlined defensive NULL 345 /// checks should be suppressed. 346 /// 347 /// This is controlled by the 'suppress-inlined-defensive-checks' config 348 /// option, which accepts the values "true" and "false". 349 bool shouldSuppressInlinedDefensiveChecks(); 350 351 /// Returns whether or not diagnostics reported within the C++ standard 352 /// library should be suppressed. 353 /// 354 /// This is controlled by the 'suppress-c++-stdlib' config option, 355 /// which accepts the values "true" and "false". 356 bool shouldSuppressFromCXXStandardLibrary(); 357 358 /// Returns whether or not the diagnostic report should be always reported 359 /// in the main source file and not the headers. 360 /// 361 /// This is controlled by the 'report-in-main-source-file' config option, 362 /// which accepts the values "true" and "false". 363 bool shouldReportIssuesInMainSourceFile(); 364 365 /// Returns whether or not the report filename should be random or not. 366 /// 367 /// This is controlled by the 'stable-report-filename' config option, 368 /// which accepts the values "true" and "false". Default = false 369 bool shouldWriteStableReportFilename(); 370 371 /// Returns whether irrelevant parts of a bug report path should be pruned 372 /// out of the final output. 373 /// 374 /// This is controlled by the 'prune-paths' config option, which accepts the 375 /// values "true" and "false". 376 bool shouldPrunePaths(); 377 378 /// Returns true if 'static' initializers should be in conditional logic 379 /// in the CFG. 380 bool shouldConditionalizeStaticInitializers(); 381 382 // Returns the size of the functions (in basic blocks), which should be 383 // considered to be small enough to always inline. 384 // 385 // This is controlled by "ipa-always-inline-size" analyzer-config option. 386 unsigned getAlwaysInlineSize(); 387 388 // Returns the bound on the number of basic blocks in an inlined function 389 // (50 by default). 390 // 391 // This is controlled by "-analyzer-config max-inlinable-size" option. 392 unsigned getMaxInlinableSize(); 393 394 /// Returns true if the analyzer engine should synthesize fake bodies 395 /// for well-known functions. 396 bool shouldSynthesizeBodies(); 397 398 /// Returns how often nodes in the ExplodedGraph should be recycled to save 399 /// memory. 400 /// 401 /// This is controlled by the 'graph-trim-interval' config option. To disable 402 /// node reclamation, set the option to "0". 403 unsigned getGraphTrimInterval(); 404 405 /// Returns the maximum times a large function could be inlined. 406 /// 407 /// This is controlled by the 'max-times-inline-large' config option. 408 unsigned getMaxTimesInlineLarge(); 409 410 /// Returns the maximum number of nodes the analyzer can generate while 411 /// exploring a top level function (for each exploded graph). 412 /// 150000 is default; 0 means no limit. 413 /// 414 /// This is controlled by the 'max-nodes' config option. 415 unsigned getMaxNodesPerTopLevelFunction(); 416 417 public: AnalyzerOptions()418 AnalyzerOptions() : 419 AnalysisStoreOpt(RegionStoreModel), 420 AnalysisConstraintsOpt(RangeConstraintsModel), 421 AnalysisDiagOpt(PD_HTML), 422 AnalysisPurgeOpt(PurgeStmt), 423 ShowCheckerHelp(0), 424 AnalyzeAll(0), 425 AnalyzerDisplayProgress(0), 426 AnalyzeNestedBlocks(0), 427 eagerlyAssumeBinOpBifurcation(0), 428 TrimGraph(0), 429 visualizeExplodedGraphWithGraphViz(0), 430 visualizeExplodedGraphWithUbiGraph(0), 431 UnoptimizedCFG(0), 432 PrintStats(0), 433 NoRetryExhausted(0), 434 // Cap the stack depth at 4 calls (5 stack frames, base + 4 calls). 435 InlineMaxStackDepth(5), 436 InliningMode(NoRedundancy), 437 UserMode(UMK_NotSet), 438 IPAMode(IPAK_NotSet), 439 CXXMemberInliningMode() {} 440 441 }; 442 443 typedef IntrusiveRefCntPtr<AnalyzerOptions> AnalyzerOptionsRef; 444 445 } 446 447 #endif 448