1 //===--- AnalyzerOptions.h - Analysis Engine Options ------------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This header defines various options for the static analyzer that are set
11 // by the frontend and are consulted throughout the analyzer.
13 //===----------------------------------------------------------------------===//
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_ANALYZEROPTIONS_H
18 #include "clang/Basic/LLVM.h"
19 #include "llvm/ADT/IntrusiveRefCntPtr.h"
20 #include "llvm/ADT/Optional.h"
21 #include "llvm/ADT/StringMap.h"
27 class DiagnosticsEngine;
35 /// Analysis - Set of available source code analyses.
37 #define ANALYSIS(NAME, CMDFLAG, DESC, SCOPE) NAME,
38 #include "clang/StaticAnalyzer/Core/Analyses.def"
42 /// AnalysisStores - Set of available analysis store models.
44 #define ANALYSIS_STORE(NAME, CMDFLAG, DESC, CREATFN) NAME##Model,
45 #include "clang/StaticAnalyzer/Core/Analyses.def"
49 /// AnalysisConstraints - Set of available constraint models.
50 enum AnalysisConstraints {
51 #define ANALYSIS_CONSTRAINTS(NAME, CMDFLAG, DESC, CREATFN) NAME##Model,
52 #include "clang/StaticAnalyzer/Core/Analyses.def"
56 /// AnalysisDiagClients - Set of available diagnostic clients for rendering
58 enum AnalysisDiagClients {
59 #define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATFN) PD_##NAME,
60 #include "clang/StaticAnalyzer/Core/Analyses.def"
62 NUM_ANALYSIS_DIAG_CLIENTS
65 /// AnalysisPurgeModes - Set of available strategies for dead symbol removal.
66 enum AnalysisPurgeMode {
67 #define ANALYSIS_PURGE(NAME, CMDFLAG, DESC) NAME,
68 #include "clang/StaticAnalyzer/Core/Analyses.def"
72 /// AnalysisInlineFunctionSelection - Set of inlining function selection heuristics.
73 enum AnalysisInliningMode {
74 #define ANALYSIS_INLINING_MODE(NAME, CMDFLAG, DESC) NAME,
75 #include "clang/StaticAnalyzer/Core/Analyses.def"
79 /// \brief Describes the different kinds of C++ member functions which can be
80 /// considered for inlining by the analyzer.
82 /// These options are cumulative; enabling one kind of member function will
83 /// enable all kinds with lower enum values.
84 enum CXXInlineableMemberKind {
87 /// A dummy mode in which no C++ inlining is enabled.
90 /// Refers to regular member function and operator calls.
93 /// Refers to constructors (implicit or explicit).
95 /// Note that a constructor will not be inlined if the corresponding
96 /// destructor is non-trivial.
99 /// Refers to destructors (implicit or explicit).
103 /// \brief Describes the different modes of inter-procedural analysis.
107 /// Perform only intra-procedural analysis.
110 /// Inline C functions and blocks when their definitions are available.
111 IPAK_BasicInlining = 2,
113 /// Inline callees(C, C++, ObjC) when their definitions are available.
116 /// Enable inlining of dynamically dispatched methods.
117 IPAK_DynamicDispatch = 4,
119 /// Enable inlining of dynamically dispatched methods, bifurcate paths when
120 /// exact type info is unavailable.
121 IPAK_DynamicDispatchBifurcate = 5
124 class AnalyzerOptions : public RefCountedBase<AnalyzerOptions> {
126 typedef llvm::StringMap<std::string> ConfigTable;
128 static std::vector<StringRef>
129 getRegisteredCheckers(bool IncludeExperimental = false);
131 /// \brief Pair of checker name and enable/disable.
132 std::vector<std::pair<std::string, bool> > CheckersControlList;
134 /// \brief A key-value table of use-specified configuration values.
136 AnalysisStores AnalysisStoreOpt;
137 AnalysisConstraints AnalysisConstraintsOpt;
138 AnalysisDiagClients AnalysisDiagOpt;
139 AnalysisPurgeMode AnalysisPurgeOpt;
141 std::string AnalyzeSpecificFunction;
143 /// \brief The maximum number of times the analyzer visits a block.
144 unsigned maxBlockVisitOnPath;
147 /// \brief Disable all analyzer checks.
149 /// This flag allows one to disable analyzer checks on the code processed by
150 /// the given analysis consumer. Note, the code will get parsed and the
151 /// command-line options will get checked.
152 unsigned DisableAllChecks : 1;
154 unsigned ShowCheckerHelp : 1;
155 unsigned ShowEnabledCheckerList : 1;
156 unsigned AnalyzeAll : 1;
157 unsigned AnalyzerDisplayProgress : 1;
158 unsigned AnalyzeNestedBlocks : 1;
160 /// \brief The flag regulates if we should eagerly assume evaluations of
161 /// conditionals, thus, bifurcating the path.
163 /// This flag indicates how the engine should handle expressions such as: 'x =
164 /// (y != 0)'. When this flag is true then the subexpression 'y != 0' will be
165 /// eagerly assumed to be true or false, thus evaluating it to the integers 0
166 /// or 1 respectively. The upside is that this can increase analysis
167 /// precision until we have a better way to lazily evaluate such logic. The
168 /// downside is that it eagerly bifurcates paths.
169 unsigned eagerlyAssumeBinOpBifurcation : 1;
171 unsigned TrimGraph : 1;
172 unsigned visualizeExplodedGraphWithGraphViz : 1;
173 unsigned visualizeExplodedGraphWithUbiGraph : 1;
174 unsigned UnoptimizedCFG : 1;
175 unsigned PrintStats : 1;
177 /// \brief Do not re-analyze paths leading to exhausted nodes with a different
178 /// strategy. We get better code coverage when retry is enabled.
179 unsigned NoRetryExhausted : 1;
181 /// \brief The inlining stack depth limit.
182 unsigned InlineMaxStackDepth;
184 /// \brief The mode of function selection used during inlining.
185 AnalysisInliningMode InliningMode;
188 /// \brief Describes the kinds for high-level analyzer mode.
191 /// Perform shallow but fast analyzes.
193 /// Perform deep analyzes.
197 /// Controls the high-level analyzer mode, which influences the default
198 /// settings for some of the lower-level config options (such as IPAMode).
200 UserModeKind UserMode;
202 /// Controls the mode of inter-procedural analysis.
205 /// Controls which C++ member functions will be considered for inlining.
206 CXXInlineableMemberKind CXXMemberInliningMode;
208 /// \sa includeImplicitDtorsInCFG
209 Optional<bool> IncludeImplicitDtorsInCFG;
211 /// \sa includeTemporaryDtorsInCFG
212 Optional<bool> IncludeTemporaryDtorsInCFG;
214 /// \sa IncludeLifetimeInCFG
215 Optional<bool> IncludeLifetimeInCFG;
217 /// \sa mayInlineCXXStandardLibrary
218 Optional<bool> InlineCXXStandardLibrary;
220 /// \sa mayInlineTemplateFunctions
221 Optional<bool> InlineTemplateFunctions;
223 /// \sa mayInlineCXXAllocator
224 Optional<bool> InlineCXXAllocator;
226 /// \sa mayInlineCXXContainerMethods
227 Optional<bool> InlineCXXContainerMethods;
229 /// \sa mayInlineCXXSharedPtrDtor
230 Optional<bool> InlineCXXSharedPtrDtor;
232 /// \sa mayInlineObjCMethod
233 Optional<bool> ObjCInliningMode;
235 // Cache of the "ipa-always-inline-size" setting.
236 // \sa getAlwaysInlineSize
237 Optional<unsigned> AlwaysInlineSize;
239 /// \sa shouldSuppressNullReturnPaths
240 Optional<bool> SuppressNullReturnPaths;
242 // \sa getMaxInlinableSize
243 Optional<unsigned> MaxInlinableSize;
245 /// \sa shouldAvoidSuppressingNullArgumentPaths
246 Optional<bool> AvoidSuppressingNullArgumentPaths;
248 /// \sa shouldSuppressInlinedDefensiveChecks
249 Optional<bool> SuppressInlinedDefensiveChecks;
251 /// \sa shouldSuppressFromCXXStandardLibrary
252 Optional<bool> SuppressFromCXXStandardLibrary;
254 /// \sa reportIssuesInMainSourceFile
255 Optional<bool> ReportIssuesInMainSourceFile;
257 /// \sa StableReportFilename
258 Optional<bool> StableReportFilename;
260 /// \sa getGraphTrimInterval
261 Optional<unsigned> GraphTrimInterval;
263 /// \sa getMaxTimesInlineLarge
264 Optional<unsigned> MaxTimesInlineLarge;
266 /// \sa getMinCFGSizeTreatFunctionsAsLarge
267 Optional<unsigned> MinCFGSizeTreatFunctionsAsLarge;
269 /// \sa getMaxNodesPerTopLevelFunction
270 Optional<unsigned> MaxNodesPerTopLevelFunction;
272 /// \sa shouldInlineLambdas
273 Optional<bool> InlineLambdas;
275 /// \sa shouldWidenLoops
276 Optional<bool> WidenLoops;
278 /// \sa shouldDisplayNotesAsEvents
279 Optional<bool> DisplayNotesAsEvents;
281 /// A helper function that retrieves option for a given full-qualified
283 /// Options for checkers can be specified via 'analyzer-config' command-line
286 /// @code-analyzer-config unix.Malloc:OptionName=CheckerOptionValue @endcode
287 /// or @code-analyzer-config unix:OptionName=GroupOptionValue @endcode
288 /// for groups of checkers.
289 /// @param [in] CheckerName Full-qualified checker name, like
290 /// alpha.unix.StreamChecker.
291 /// @param [in] OptionName Name of the option to get.
292 /// @param [in] Default Default value if no option is specified.
293 /// @param [in] SearchInParents If set to true and the searched option was not
294 /// specified for the given checker the options for the parent packages will
295 /// be searched as well. The inner packages take precedence over the outer
297 /// @retval CheckerOptionValue An option for a checker if it was specified.
298 /// @retval GroupOptionValue An option for group if it was specified and no
299 /// checker-specific options were found. The closer group to checker,
300 /// the more priority it has. For example, @c coregroup.subgroup has more
301 /// priority than @c coregroup for @c coregroup.subgroup.CheckerName checker.
302 /// @retval Default If nor checker option, nor group option was found.
303 StringRef getCheckerOption(StringRef CheckerName, StringRef OptionName,
305 bool SearchInParents = false);
308 /// Interprets an option's string value as a boolean. The "true" string is
309 /// interpreted as true and the "false" string is interpreted as false.
311 /// If an option value is not provided, returns the given \p DefaultVal.
312 /// @param [in] Name Name for option to retrieve.
313 /// @param [in] DefaultVal Default value returned if no such option was
315 /// @param [in] C The optional checker parameter that can be used to restrict
316 /// the search to the options of this particular checker (and its parents
317 /// dependening on search mode).
318 /// @param [in] SearchInParents If set to true and the searched option was not
319 /// specified for the given checker the options for the parent packages will
320 /// be searched as well. The inner packages take precedence over the outer
322 bool getBooleanOption(StringRef Name, bool DefaultVal,
323 const ento::CheckerBase *C = nullptr,
324 bool SearchInParents = false);
326 /// Variant that accepts a Optional value to cache the result.
328 /// @param [in,out] V Return value storage, returned if parameter contains
329 /// an existing valid option, else it is used to store a return value
330 /// @param [in] Name Name for option to retrieve.
331 /// @param [in] DefaultVal Default value returned if no such option was
333 /// @param [in] C The optional checker parameter that can be used to restrict
334 /// the search to the options of this particular checker (and its parents
335 /// dependening on search mode).
336 /// @param [in] SearchInParents If set to true and the searched option was not
337 /// specified for the given checker the options for the parent packages will
338 /// be searched as well. The inner packages take precedence over the outer
340 bool getBooleanOption(Optional<bool> &V, StringRef Name, bool DefaultVal,
341 const ento::CheckerBase *C = nullptr,
342 bool SearchInParents = false);
344 /// Interprets an option's string value as an integer value.
346 /// If an option value is not provided, returns the given \p DefaultVal.
347 /// @param [in] Name Name for option to retrieve.
348 /// @param [in] DefaultVal Default value returned if no such option was
350 /// @param [in] C The optional checker parameter that can be used to restrict
351 /// the search to the options of this particular checker (and its parents
352 /// dependening on search mode).
353 /// @param [in] SearchInParents If set to true and the searched option was not
354 /// specified for the given checker the options for the parent packages will
355 /// be searched as well. The inner packages take precedence over the outer
357 int getOptionAsInteger(StringRef Name, int DefaultVal,
358 const ento::CheckerBase *C = nullptr,
359 bool SearchInParents = false);
361 /// Query an option's string value.
363 /// If an option value is not provided, returns the given \p DefaultVal.
364 /// @param [in] Name Name for option to retrieve.
365 /// @param [in] DefaultVal Default value returned if no such option was
367 /// @param [in] C The optional checker parameter that can be used to restrict
368 /// the search to the options of this particular checker (and its parents
369 /// dependening on search mode).
370 /// @param [in] SearchInParents If set to true and the searched option was not
371 /// specified for the given checker the options for the parent packages will
372 /// be searched as well. The inner packages take precedence over the outer
374 StringRef getOptionAsString(StringRef Name, StringRef DefaultVal,
375 const ento::CheckerBase *C = nullptr,
376 bool SearchInParents = false);
378 /// \brief Retrieves and sets the UserMode. This is a high-level option,
379 /// which is used to set other low-level options. It is not accessible
380 /// outside of AnalyzerOptions.
381 UserModeKind getUserMode();
383 /// \brief Returns the inter-procedural analysis mode.
384 IPAKind getIPAMode();
386 /// Returns the option controlling which C++ member functions will be
387 /// considered for inlining.
389 /// This is controlled by the 'c++-inlining' config option.
391 /// \sa CXXMemberInliningMode
392 bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K);
394 /// Returns true if ObjectiveC inlining is enabled, false otherwise.
395 bool mayInlineObjCMethod();
397 /// Returns whether or not the destructors for C++ temporary objects should
398 /// be included in the CFG.
400 /// This is controlled by the 'cfg-temporary-dtors' config option, which
401 /// accepts the values "true" and "false".
402 bool includeTemporaryDtorsInCFG();
404 /// Returns whether or not implicit destructors for C++ objects should
405 /// be included in the CFG.
407 /// This is controlled by the 'cfg-implicit-dtors' config option, which
408 /// accepts the values "true" and "false".
409 bool includeImplicitDtorsInCFG();
411 /// Returns whether or not end-of-lifetime information should be included in
414 /// This is controlled by the 'cfg-lifetime' config option, which accepts
415 /// the values "true" and "false".
416 bool includeLifetimeInCFG();
418 /// Returns whether or not C++ standard library functions may be considered
421 /// This is controlled by the 'c++-stdlib-inlining' config option, which
422 /// accepts the values "true" and "false".
423 bool mayInlineCXXStandardLibrary();
425 /// Returns whether or not templated functions may be considered for inlining.
427 /// This is controlled by the 'c++-template-inlining' config option, which
428 /// accepts the values "true" and "false".
429 bool mayInlineTemplateFunctions();
431 /// Returns whether or not allocator call may be considered for inlining.
433 /// This is controlled by the 'c++-allocator-inlining' config option, which
434 /// accepts the values "true" and "false".
435 bool mayInlineCXXAllocator();
437 /// Returns whether or not methods of C++ container objects may be considered
440 /// This is controlled by the 'c++-container-inlining' config option, which
441 /// accepts the values "true" and "false".
442 bool mayInlineCXXContainerMethods();
444 /// Returns whether or not the destructor of C++ 'shared_ptr' may be
445 /// considered for inlining.
447 /// This covers std::shared_ptr, std::tr1::shared_ptr, and boost::shared_ptr,
448 /// and indeed any destructor named "~shared_ptr".
450 /// This is controlled by the 'c++-shared_ptr-inlining' config option, which
451 /// accepts the values "true" and "false".
452 bool mayInlineCXXSharedPtrDtor();
454 /// Returns whether or not paths that go through null returns should be
457 /// This is a heuristic for avoiding bug reports with paths that go through
458 /// inlined functions that are more defensive than their callers.
460 /// This is controlled by the 'suppress-null-return-paths' config option,
461 /// which accepts the values "true" and "false".
462 bool shouldSuppressNullReturnPaths();
464 /// Returns whether a bug report should \em not be suppressed if its path
465 /// includes a call with a null argument, even if that call has a null return.
467 /// This option has no effect when #shouldSuppressNullReturnPaths() is false.
469 /// This is a counter-heuristic to avoid false negatives.
471 /// This is controlled by the 'avoid-suppressing-null-argument-paths' config
472 /// option, which accepts the values "true" and "false".
473 bool shouldAvoidSuppressingNullArgumentPaths();
475 /// Returns whether or not diagnostics containing inlined defensive NULL
476 /// checks should be suppressed.
478 /// This is controlled by the 'suppress-inlined-defensive-checks' config
479 /// option, which accepts the values "true" and "false".
480 bool shouldSuppressInlinedDefensiveChecks();
482 /// Returns whether or not diagnostics reported within the C++ standard
483 /// library should be suppressed.
485 /// This is controlled by the 'suppress-c++-stdlib' config option,
486 /// which accepts the values "true" and "false".
487 bool shouldSuppressFromCXXStandardLibrary();
489 /// Returns whether or not the diagnostic report should be always reported
490 /// in the main source file and not the headers.
492 /// This is controlled by the 'report-in-main-source-file' config option,
493 /// which accepts the values "true" and "false".
494 bool shouldReportIssuesInMainSourceFile();
496 /// Returns whether or not the report filename should be random or not.
498 /// This is controlled by the 'stable-report-filename' config option,
499 /// which accepts the values "true" and "false". Default = false
500 bool shouldWriteStableReportFilename();
502 /// Returns whether irrelevant parts of a bug report path should be pruned
503 /// out of the final output.
505 /// This is controlled by the 'prune-paths' config option, which accepts the
506 /// values "true" and "false".
507 bool shouldPrunePaths();
509 /// Returns true if 'static' initializers should be in conditional logic
511 bool shouldConditionalizeStaticInitializers();
513 // Returns the size of the functions (in basic blocks), which should be
514 // considered to be small enough to always inline.
516 // This is controlled by "ipa-always-inline-size" analyzer-config option.
517 unsigned getAlwaysInlineSize();
519 // Returns the bound on the number of basic blocks in an inlined function
522 // This is controlled by "-analyzer-config max-inlinable-size" option.
523 unsigned getMaxInlinableSize();
525 /// Returns true if the analyzer engine should synthesize fake bodies
526 /// for well-known functions.
527 bool shouldSynthesizeBodies();
529 /// Returns how often nodes in the ExplodedGraph should be recycled to save
532 /// This is controlled by the 'graph-trim-interval' config option. To disable
533 /// node reclamation, set the option to "0".
534 unsigned getGraphTrimInterval();
536 /// Returns the maximum times a large function could be inlined.
538 /// This is controlled by the 'max-times-inline-large' config option.
539 unsigned getMaxTimesInlineLarge();
541 /// Returns the number of basic blocks a function needs to have to be
542 /// considered large for the 'max-times-inline-large' config option.
544 /// This is controlled by the 'min-cfg-size-treat-functions-as-large' config
546 unsigned getMinCFGSizeTreatFunctionsAsLarge();
548 /// Returns the maximum number of nodes the analyzer can generate while
549 /// exploring a top level function (for each exploded graph).
550 /// 150000 is default; 0 means no limit.
552 /// This is controlled by the 'max-nodes' config option.
553 unsigned getMaxNodesPerTopLevelFunction();
555 /// Returns true if lambdas should be inlined. Otherwise a sink node will be
556 /// generated each time a LambdaExpr is visited.
557 bool shouldInlineLambdas();
559 /// Returns true if the analysis should try to widen loops.
560 /// This is controlled by the 'widen-loops' config option.
561 bool shouldWidenLoops();
563 /// Returns true if the bug reporter should transparently treat extra note
564 /// diagnostic pieces as event diagnostic pieces. Useful when the diagnostic
565 /// consumer doesn't support the extra note pieces.
567 /// This is controlled by the 'extra-notes-as-events' option, which defaults
568 /// to false when unset.
569 bool shouldDisplayNotesAsEvents();
573 AnalysisStoreOpt(RegionStoreModel),
574 AnalysisConstraintsOpt(RangeConstraintsModel),
575 AnalysisDiagOpt(PD_HTML),
576 AnalysisPurgeOpt(PurgeStmt),
579 ShowEnabledCheckerList(0),
581 AnalyzerDisplayProgress(0),
582 AnalyzeNestedBlocks(0),
583 eagerlyAssumeBinOpBifurcation(0),
585 visualizeExplodedGraphWithGraphViz(0),
586 visualizeExplodedGraphWithUbiGraph(0),
590 // Cap the stack depth at 4 calls (5 stack frames, base + 4 calls).
591 InlineMaxStackDepth(5),
592 InliningMode(NoRedundancy),
593 UserMode(UMK_NotSet),
594 IPAMode(IPAK_NotSet),
595 CXXMemberInliningMode() {}
599 typedef IntrusiveRefCntPtr<AnalyzerOptions> AnalyzerOptionsRef;