1//===--- AnalyzerOptions.h - Analysis Engine Options ------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This header defines various options for the static analyzer that are set 11// by the frontend and are consulted throughout the analyzer. 12// 13//===----------------------------------------------------------------------===// 14 15#ifndef LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H 16#define LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H 17 18#include "clang/Basic/LLVM.h" 19#include "llvm/ADT/IntrusiveRefCntPtr.h" 20#include "llvm/ADT/Optional.h" 21#include "llvm/ADT/StringMap.h" 22#include <string> 23#include <vector> 24 25namespace clang { 26class ASTConsumer; 27class DiagnosticsEngine; 28class Preprocessor; 29class LangOptions; 30 31namespace ento { 32class CheckerBase; 33} 34 35/// Analysis - Set of available source code analyses. 36enum Analyses { 37#define ANALYSIS(NAME, CMDFLAG, DESC, SCOPE) NAME, 38#include "clang/StaticAnalyzer/Core/Analyses.def" 39NumAnalyses 40}; 41 42/// AnalysisStores - Set of available analysis store models. 43enum AnalysisStores { 44#define ANALYSIS_STORE(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 45#include "clang/StaticAnalyzer/Core/Analyses.def" 46NumStores 47}; 48 49/// AnalysisConstraints - Set of available constraint models. 50enum AnalysisConstraints { 51#define ANALYSIS_CONSTRAINTS(NAME, CMDFLAG, DESC, CREATFN) NAME##Model, 52#include "clang/StaticAnalyzer/Core/Analyses.def" 53NumConstraints 54}; 55 56/// AnalysisDiagClients - Set of available diagnostic clients for rendering 57/// analysis results. 58enum AnalysisDiagClients { 59#define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATFN) PD_##NAME, 60#include "clang/StaticAnalyzer/Core/Analyses.def" 61PD_NONE, 62NUM_ANALYSIS_DIAG_CLIENTS 63}; 64 65/// AnalysisPurgeModes - Set of available strategies for dead symbol removal. 66enum AnalysisPurgeMode { 67#define ANALYSIS_PURGE(NAME, CMDFLAG, DESC) NAME, 68#include "clang/StaticAnalyzer/Core/Analyses.def" 69NumPurgeModes 70}; 71 72/// AnalysisInlineFunctionSelection - Set of inlining function selection heuristics. 73enum AnalysisInliningMode { 74#define ANALYSIS_INLINING_MODE(NAME, CMDFLAG, DESC) NAME, 75#include "clang/StaticAnalyzer/Core/Analyses.def" 76NumInliningModes 77}; 78 79/// \brief Describes the different kinds of C++ member functions which can be 80/// considered for inlining by the analyzer. 81/// 82/// These options are cumulative; enabling one kind of member function will 83/// enable all kinds with lower enum values. 84enum CXXInlineableMemberKind { 85 // Uninitialized = 0, 86 87 /// A dummy mode in which no C++ inlining is enabled. 88 CIMK_None = 1, 89 90 /// Refers to regular member function and operator calls. 91 CIMK_MemberFunctions, 92 93 /// Refers to constructors (implicit or explicit). 94 /// 95 /// Note that a constructor will not be inlined if the corresponding 96 /// destructor is non-trivial. 97 CIMK_Constructors, 98 99 /// Refers to destructors (implicit or explicit). 100 CIMK_Destructors 101}; 102 103/// \brief Describes the different modes of inter-procedural analysis. 104enum IPAKind { 105 IPAK_NotSet = 0, 106 107 /// Perform only intra-procedural analysis. 108 IPAK_None = 1, 109 110 /// Inline C functions and blocks when their definitions are available. 111 IPAK_BasicInlining = 2, 112 113 /// Inline callees(C, C++, ObjC) when their definitions are available. 114 IPAK_Inlining = 3, 115 116 /// Enable inlining of dynamically dispatched methods. 117 IPAK_DynamicDispatch = 4, 118 119 /// Enable inlining of dynamically dispatched methods, bifurcate paths when 120 /// exact type info is unavailable. 121 IPAK_DynamicDispatchBifurcate = 5 122}; 123 124class AnalyzerOptions : public RefCountedBase<AnalyzerOptions> { 125public: 126 typedef llvm::StringMap<std::string> ConfigTable; 127 128 static std::vector<StringRef> 129 getRegisteredCheckers(bool IncludeExperimental = false); 130 131 /// \brief Pair of checker name and enable/disable. 132 std::vector<std::pair<std::string, bool> > CheckersControlList; 133 134 /// \brief A key-value table of use-specified configuration values. 135 ConfigTable Config; 136 AnalysisStores AnalysisStoreOpt; 137 AnalysisConstraints AnalysisConstraintsOpt; 138 AnalysisDiagClients AnalysisDiagOpt; 139 AnalysisPurgeMode AnalysisPurgeOpt; 140 141 std::string AnalyzeSpecificFunction; 142 143 /// \brief The maximum number of times the analyzer visits a block. 144 unsigned maxBlockVisitOnPath; 145 146 147 /// \brief Disable all analyzer checks. 148 /// 149 /// This flag allows one to disable analyzer checks on the code processed by 150 /// the given analysis consumer. Note, the code will get parsed and the 151 /// command-line options will get checked. 152 unsigned DisableAllChecks : 1; 153 154 unsigned ShowCheckerHelp : 1; 155 unsigned ShowEnabledCheckerList : 1; 156 unsigned AnalyzeAll : 1; 157 unsigned AnalyzerDisplayProgress : 1; 158 unsigned AnalyzeNestedBlocks : 1; 159 160 /// \brief The flag regulates if we should eagerly assume evaluations of 161 /// conditionals, thus, bifurcating the path. 162 /// 163 /// This flag indicates how the engine should handle expressions such as: 'x = 164 /// (y != 0)'. When this flag is true then the subexpression 'y != 0' will be 165 /// eagerly assumed to be true or false, thus evaluating it to the integers 0 166 /// or 1 respectively. The upside is that this can increase analysis 167 /// precision until we have a better way to lazily evaluate such logic. The 168 /// downside is that it eagerly bifurcates paths. 169 unsigned eagerlyAssumeBinOpBifurcation : 1; 170 171 unsigned TrimGraph : 1; 172 unsigned visualizeExplodedGraphWithGraphViz : 1; 173 unsigned visualizeExplodedGraphWithUbiGraph : 1; 174 unsigned UnoptimizedCFG : 1; 175 unsigned PrintStats : 1; 176 177 /// \brief Do not re-analyze paths leading to exhausted nodes with a different 178 /// strategy. We get better code coverage when retry is enabled. 179 unsigned NoRetryExhausted : 1; 180 181 /// \brief The inlining stack depth limit. 182 unsigned InlineMaxStackDepth; 183 184 /// \brief The mode of function selection used during inlining. 185 AnalysisInliningMode InliningMode; 186 187private: 188 /// \brief Describes the kinds for high-level analyzer mode. 189 enum UserModeKind { 190 UMK_NotSet = 0, 191 /// Perform shallow but fast analyzes. 192 UMK_Shallow = 1, 193 /// Perform deep analyzes. 194 UMK_Deep = 2 195 }; 196 197 /// Controls the high-level analyzer mode, which influences the default 198 /// settings for some of the lower-level config options (such as IPAMode). 199 /// \sa getUserMode 200 UserModeKind UserMode; 201 202 /// Controls the mode of inter-procedural analysis. 203 IPAKind IPAMode; 204 205 /// Controls which C++ member functions will be considered for inlining. 206 CXXInlineableMemberKind CXXMemberInliningMode; 207 208 /// \sa includeTemporaryDtorsInCFG 209 Optional<bool> IncludeTemporaryDtorsInCFG; 210 211 /// \sa mayInlineCXXStandardLibrary 212 Optional<bool> InlineCXXStandardLibrary; 213 214 /// \sa mayInlineTemplateFunctions 215 Optional<bool> InlineTemplateFunctions; 216 217 /// \sa mayInlineCXXAllocator 218 Optional<bool> InlineCXXAllocator; 219 220 /// \sa mayInlineCXXContainerMethods 221 Optional<bool> InlineCXXContainerMethods; 222 223 /// \sa mayInlineCXXSharedPtrDtor 224 Optional<bool> InlineCXXSharedPtrDtor; 225 226 /// \sa mayInlineObjCMethod 227 Optional<bool> ObjCInliningMode; 228 229 // Cache of the "ipa-always-inline-size" setting. 230 // \sa getAlwaysInlineSize 231 Optional<unsigned> AlwaysInlineSize; 232 233 /// \sa shouldSuppressNullReturnPaths 234 Optional<bool> SuppressNullReturnPaths; 235 236 // \sa getMaxInlinableSize 237 Optional<unsigned> MaxInlinableSize; 238 239 /// \sa shouldAvoidSuppressingNullArgumentPaths 240 Optional<bool> AvoidSuppressingNullArgumentPaths; 241 242 /// \sa shouldSuppressInlinedDefensiveChecks 243 Optional<bool> SuppressInlinedDefensiveChecks; 244 245 /// \sa shouldSuppressFromCXXStandardLibrary 246 Optional<bool> SuppressFromCXXStandardLibrary; 247 248 /// \sa reportIssuesInMainSourceFile 249 Optional<bool> ReportIssuesInMainSourceFile; 250 251 /// \sa StableReportFilename 252 Optional<bool> StableReportFilename; 253 254 /// \sa getGraphTrimInterval 255 Optional<unsigned> GraphTrimInterval; 256 257 /// \sa getMaxTimesInlineLarge 258 Optional<unsigned> MaxTimesInlineLarge; 259 260 /// \sa getMinCFGSizeTreatFunctionsAsLarge 261 Optional<unsigned> MinCFGSizeTreatFunctionsAsLarge; 262 263 /// \sa getMaxNodesPerTopLevelFunction 264 Optional<unsigned> MaxNodesPerTopLevelFunction; 265 266 /// \sa shouldInlineLambdas 267 Optional<bool> InlineLambdas; 268 269 /// \sa shouldWidenLoops 270 Optional<bool> WidenLoops; 271 272 /// \sa shouldDisplayNotesAsEvents 273 Optional<bool> DisplayNotesAsEvents; 274 275 /// A helper function that retrieves option for a given full-qualified 276 /// checker name. 277 /// Options for checkers can be specified via 'analyzer-config' command-line 278 /// option. 279 /// Example: 280 /// @code-analyzer-config unix.Malloc:OptionName=CheckerOptionValue @endcode 281 /// or @code-analyzer-config unix:OptionName=GroupOptionValue @endcode 282 /// for groups of checkers. 283 /// @param [in] CheckerName Full-qualified checker name, like 284 /// alpha.unix.StreamChecker. 285 /// @param [in] OptionName Name of the option to get. 286 /// @param [in] Default Default value if no option is specified. 287 /// @param [in] SearchInParents If set to true and the searched option was not 288 /// specified for the given checker the options for the parent packages will 289 /// be searched as well. The inner packages take precedence over the outer 290 /// ones. 291 /// @retval CheckerOptionValue An option for a checker if it was specified. 292 /// @retval GroupOptionValue An option for group if it was specified and no 293 /// checker-specific options were found. The closer group to checker, 294 /// the more priority it has. For example, @c coregroup.subgroup has more 295 /// priority than @c coregroup for @c coregroup.subgroup.CheckerName checker. 296 /// @retval Default If nor checker option, nor group option was found. 297 StringRef getCheckerOption(StringRef CheckerName, StringRef OptionName, 298 StringRef Default, 299 bool SearchInParents = false); 300 301public: 302 /// Interprets an option's string value as a boolean. The "true" string is 303 /// interpreted as true and the "false" string is interpreted as false. 304 /// 305 /// If an option value is not provided, returns the given \p DefaultVal. 306 /// @param [in] Name Name for option to retrieve. 307 /// @param [in] DefaultVal Default value returned if no such option was 308 /// specified. 309 /// @param [in] C The optional checker parameter that can be used to restrict 310 /// the search to the options of this particular checker (and its parents 311 /// dependening on search mode). 312 /// @param [in] SearchInParents If set to true and the searched option was not 313 /// specified for the given checker the options for the parent packages will 314 /// be searched as well. The inner packages take precedence over the outer 315 /// ones. 316 bool getBooleanOption(StringRef Name, bool DefaultVal, 317 const ento::CheckerBase *C = nullptr, 318 bool SearchInParents = false); 319 320 /// Variant that accepts a Optional value to cache the result. 321 /// 322 /// @param [in,out] V Return value storage, returned if parameter contains 323 /// an existing valid option, else it is used to store a return value 324 /// @param [in] Name Name for option to retrieve. 325 /// @param [in] DefaultVal Default value returned if no such option was 326 /// specified. 327 /// @param [in] C The optional checker parameter that can be used to restrict 328 /// the search to the options of this particular checker (and its parents 329 /// dependening on search mode). 330 /// @param [in] SearchInParents If set to true and the searched option was not 331 /// specified for the given checker the options for the parent packages will 332 /// be searched as well. The inner packages take precedence over the outer 333 /// ones. 334 bool getBooleanOption(Optional<bool> &V, StringRef Name, bool DefaultVal, 335 const ento::CheckerBase *C = nullptr, 336 bool SearchInParents = false); 337 338 /// Interprets an option's string value as an integer value. 339 /// 340 /// If an option value is not provided, returns the given \p DefaultVal. 341 /// @param [in] Name Name for option to retrieve. 342 /// @param [in] DefaultVal Default value returned if no such option was 343 /// specified. 344 /// @param [in] C The optional checker parameter that can be used to restrict 345 /// the search to the options of this particular checker (and its parents 346 /// dependening on search mode). 347 /// @param [in] SearchInParents If set to true and the searched option was not 348 /// specified for the given checker the options for the parent packages will 349 /// be searched as well. The inner packages take precedence over the outer 350 /// ones. 351 int getOptionAsInteger(StringRef Name, int DefaultVal, 352 const ento::CheckerBase *C = nullptr, 353 bool SearchInParents = false); 354 355 /// Query an option's string value. 356 /// 357 /// If an option value is not provided, returns the given \p DefaultVal. 358 /// @param [in] Name Name for option to retrieve. 359 /// @param [in] DefaultVal Default value returned if no such option was 360 /// specified. 361 /// @param [in] C The optional checker parameter that can be used to restrict 362 /// the search to the options of this particular checker (and its parents 363 /// dependening on search mode). 364 /// @param [in] SearchInParents If set to true and the searched option was not 365 /// specified for the given checker the options for the parent packages will 366 /// be searched as well. The inner packages take precedence over the outer 367 /// ones. 368 StringRef getOptionAsString(StringRef Name, StringRef DefaultVal, 369 const ento::CheckerBase *C = nullptr, 370 bool SearchInParents = false); 371 372 /// \brief Retrieves and sets the UserMode. This is a high-level option, 373 /// which is used to set other low-level options. It is not accessible 374 /// outside of AnalyzerOptions. 375 UserModeKind getUserMode(); 376 377 /// \brief Returns the inter-procedural analysis mode. 378 IPAKind getIPAMode(); 379 380 /// Returns the option controlling which C++ member functions will be 381 /// considered for inlining. 382 /// 383 /// This is controlled by the 'c++-inlining' config option. 384 /// 385 /// \sa CXXMemberInliningMode 386 bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K); 387 388 /// Returns true if ObjectiveC inlining is enabled, false otherwise. 389 bool mayInlineObjCMethod(); 390 391 /// Returns whether or not the destructors for C++ temporary objects should 392 /// be included in the CFG. 393 /// 394 /// This is controlled by the 'cfg-temporary-dtors' config option, which 395 /// accepts the values "true" and "false". 396 bool includeTemporaryDtorsInCFG(); 397 398 /// Returns whether or not C++ standard library functions may be considered 399 /// for inlining. 400 /// 401 /// This is controlled by the 'c++-stdlib-inlining' config option, which 402 /// accepts the values "true" and "false". 403 bool mayInlineCXXStandardLibrary(); 404 405 /// Returns whether or not templated functions may be considered for inlining. 406 /// 407 /// This is controlled by the 'c++-template-inlining' config option, which 408 /// accepts the values "true" and "false". 409 bool mayInlineTemplateFunctions(); 410 411 /// Returns whether or not allocator call may be considered for inlining. 412 /// 413 /// This is controlled by the 'c++-allocator-inlining' config option, which 414 /// accepts the values "true" and "false". 415 bool mayInlineCXXAllocator(); 416 417 /// Returns whether or not methods of C++ container objects may be considered 418 /// for inlining. 419 /// 420 /// This is controlled by the 'c++-container-inlining' config option, which 421 /// accepts the values "true" and "false". 422 bool mayInlineCXXContainerMethods(); 423 424 /// Returns whether or not the destructor of C++ 'shared_ptr' may be 425 /// considered for inlining. 426 /// 427 /// This covers std::shared_ptr, std::tr1::shared_ptr, and boost::shared_ptr, 428 /// and indeed any destructor named "~shared_ptr". 429 /// 430 /// This is controlled by the 'c++-shared_ptr-inlining' config option, which 431 /// accepts the values "true" and "false". 432 bool mayInlineCXXSharedPtrDtor(); 433 434 /// Returns whether or not paths that go through null returns should be 435 /// suppressed. 436 /// 437 /// This is a heuristic for avoiding bug reports with paths that go through 438 /// inlined functions that are more defensive than their callers. 439 /// 440 /// This is controlled by the 'suppress-null-return-paths' config option, 441 /// which accepts the values "true" and "false". 442 bool shouldSuppressNullReturnPaths(); 443 444 /// Returns whether a bug report should \em not be suppressed if its path 445 /// includes a call with a null argument, even if that call has a null return. 446 /// 447 /// This option has no effect when #shouldSuppressNullReturnPaths() is false. 448 /// 449 /// This is a counter-heuristic to avoid false negatives. 450 /// 451 /// This is controlled by the 'avoid-suppressing-null-argument-paths' config 452 /// option, which accepts the values "true" and "false". 453 bool shouldAvoidSuppressingNullArgumentPaths(); 454 455 /// Returns whether or not diagnostics containing inlined defensive NULL 456 /// checks should be suppressed. 457 /// 458 /// This is controlled by the 'suppress-inlined-defensive-checks' config 459 /// option, which accepts the values "true" and "false". 460 bool shouldSuppressInlinedDefensiveChecks(); 461 462 /// Returns whether or not diagnostics reported within the C++ standard 463 /// library should be suppressed. 464 /// 465 /// This is controlled by the 'suppress-c++-stdlib' config option, 466 /// which accepts the values "true" and "false". 467 bool shouldSuppressFromCXXStandardLibrary(); 468 469 /// Returns whether or not the diagnostic report should be always reported 470 /// in the main source file and not the headers. 471 /// 472 /// This is controlled by the 'report-in-main-source-file' config option, 473 /// which accepts the values "true" and "false". 474 bool shouldReportIssuesInMainSourceFile(); 475 476 /// Returns whether or not the report filename should be random or not. 477 /// 478 /// This is controlled by the 'stable-report-filename' config option, 479 /// which accepts the values "true" and "false". Default = false 480 bool shouldWriteStableReportFilename(); 481 482 /// Returns whether irrelevant parts of a bug report path should be pruned 483 /// out of the final output. 484 /// 485 /// This is controlled by the 'prune-paths' config option, which accepts the 486 /// values "true" and "false". 487 bool shouldPrunePaths(); 488 489 /// Returns true if 'static' initializers should be in conditional logic 490 /// in the CFG. 491 bool shouldConditionalizeStaticInitializers(); 492 493 // Returns the size of the functions (in basic blocks), which should be 494 // considered to be small enough to always inline. 495 // 496 // This is controlled by "ipa-always-inline-size" analyzer-config option. 497 unsigned getAlwaysInlineSize(); 498 499 // Returns the bound on the number of basic blocks in an inlined function 500 // (50 by default). 501 // 502 // This is controlled by "-analyzer-config max-inlinable-size" option. 503 unsigned getMaxInlinableSize(); 504 505 /// Returns true if the analyzer engine should synthesize fake bodies 506 /// for well-known functions. 507 bool shouldSynthesizeBodies(); 508 509 /// Returns how often nodes in the ExplodedGraph should be recycled to save 510 /// memory. 511 /// 512 /// This is controlled by the 'graph-trim-interval' config option. To disable 513 /// node reclamation, set the option to "0". 514 unsigned getGraphTrimInterval(); 515 516 /// Returns the maximum times a large function could be inlined. 517 /// 518 /// This is controlled by the 'max-times-inline-large' config option. 519 unsigned getMaxTimesInlineLarge(); 520 521 /// Returns the number of basic blocks a function needs to have to be 522 /// considered large for the 'max-times-inline-large' config option. 523 /// 524 /// This is controlled by the 'min-cfg-size-treat-functions-as-large' config 525 /// option. 526 unsigned getMinCFGSizeTreatFunctionsAsLarge(); 527 528 /// Returns the maximum number of nodes the analyzer can generate while 529 /// exploring a top level function (for each exploded graph). 530 /// 150000 is default; 0 means no limit. 531 /// 532 /// This is controlled by the 'max-nodes' config option. 533 unsigned getMaxNodesPerTopLevelFunction(); 534 535 /// Returns true if lambdas should be inlined. Otherwise a sink node will be 536 /// generated each time a LambdaExpr is visited. 537 bool shouldInlineLambdas(); 538 539 /// Returns true if the analysis should try to widen loops. 540 /// This is controlled by the 'widen-loops' config option. 541 bool shouldWidenLoops(); 542 543 /// Returns true if the bug reporter should transparently treat extra note 544 /// diagnostic pieces as event diagnostic pieces. Useful when the diagnostic 545 /// consumer doesn't support the extra note pieces. 546 /// 547 /// This is controlled by the 'extra-notes-as-events' option, which defaults 548 /// to false when unset. 549 bool shouldDisplayNotesAsEvents(); 550 551public: 552 AnalyzerOptions() : 553 AnalysisStoreOpt(RegionStoreModel), 554 AnalysisConstraintsOpt(RangeConstraintsModel), 555 AnalysisDiagOpt(PD_HTML), 556 AnalysisPurgeOpt(PurgeStmt), 557 DisableAllChecks(0), 558 ShowCheckerHelp(0), 559 ShowEnabledCheckerList(0), 560 AnalyzeAll(0), 561 AnalyzerDisplayProgress(0), 562 AnalyzeNestedBlocks(0), 563 eagerlyAssumeBinOpBifurcation(0), 564 TrimGraph(0), 565 visualizeExplodedGraphWithGraphViz(0), 566 visualizeExplodedGraphWithUbiGraph(0), 567 UnoptimizedCFG(0), 568 PrintStats(0), 569 NoRetryExhausted(0), 570 // Cap the stack depth at 4 calls (5 stack frames, base + 4 calls). 571 InlineMaxStackDepth(5), 572 InliningMode(NoRedundancy), 573 UserMode(UMK_NotSet), 574 IPAMode(IPAK_NotSet), 575 CXXMemberInliningMode() {} 576 577}; 578 579typedef IntrusiveRefCntPtr<AnalyzerOptions> AnalyzerOptionsRef; 580 581} 582 583#endif 584