Subversion Repositories QNX 8.QNX8 LLVM/Clang compiler suite

//===-- AnalyzerOptions.def - Metadata about Static Analyses ----*- C++ -*-===//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

//

//  This file defines the analyzer options avaible with -analyzer-config.

//

//===----------------------------------------------------------------------===//

#ifndef LLVM_ADT_STRINGREF_H

#error This .def file is expected to be included in translation units where \

"llvm/ADT/StringRef.h" is already included!

#endif

#ifdef ANALYZER_OPTION

#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE

#error If you didnt include this file with the intent of generating methods, \

define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros!

#endif

#endif

#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE

#ifdef ANALYZER_OPTION

#error If you didnt include this file with the intent of generating methods, \

define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros!

#endif

#endif

#ifndef ANALYZER_OPTION

/// Create a new analyzer option, but dont generate a method for it in

/// AnalyzerOptions.

///

///   TYPE - The type of the option object that will be stored in

///          AnalyzerOptions. This file is expected to be icluded in translation

///          units where AnalyzerOptions.h is included, so types from that

///          header should be used.

///   NAME - The name of the option object.

///   CMDFLAG - The command line flag for the option.

///             (-analyzer-config CMDFLAG=VALUE)

///   DESC - Description of the flag.

///   DEFAULT_VAL - The default value for CMDFLAG.

#define ANALYZER_OPTION(TYPE, NAME, CMDFLAG, DESC, DEFAULT_VAL)

#endif

#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE

/// Create a new analyzer option, but dont generate a method for it in

/// AnalyzerOptions. It's value depends on the option "user-mode".

///

///   TYPE - The type of the option object that will be stored in

///          AnalyzerOptions. This file is expected to be icluded in translation

///          units where AnalyzerOptions.h is included, so types from that

///          header should be used.

///   NAME - The name of the option object.

///   CMDFLAG - The command line flag for the option.

///             (-analyzer-config CMDFLAG=VALUE)

///   DESC - Description of the flag.

///   SHALLOW_VAL - The default value for CMDFLAG, when "user-mode" was set to

///                 "shallow".

///   DEEP_VAL - The default value for CMDFLAG, when "user-mode" was set to

///              "deep".

#define ANALYZER_OPTION_DEPENDS_ON_USER_MODE(TYPE, NAME, CMDFLAG, DESC,        \

                                             SHALLOW_VAL, DEEP_VAL)

#endif

//===----------------------------------------------------------------------===//

// The "mode" option. Since some options depend on this, we list it on top of

// this file in order to make sure that the generated field for it is

// initialized before the rest.

//===----------------------------------------------------------------------===//

ANALYZER_OPTION(

    StringRef, UserMode, "mode",

    "(string) Controls the high-level analyzer mode, which influences the "

    "default settings for some of the lower-level config options (such as "

    "IPAMode). Value: \"deep\", \"shallow\".",

    "deep")

//===----------------------------------------------------------------------===//

// Boolean analyzer options.

//===----------------------------------------------------------------------===//

ANALYZER_OPTION(bool, ShouldIncludeImplicitDtorsInCFG, "cfg-implicit-dtors",

                "Whether or not implicit destructors for C++ objects "

                "should be included in the CFG.",

                true)

ANALYZER_OPTION(bool, ShouldIncludeTemporaryDtorsInCFG, "cfg-temporary-dtors",

                "Whether or not the destructors for C++ temporary "

                "objects should be included in the CFG.",

                true)

ANALYZER_OPTION(

    bool, ShouldIncludeLifetimeInCFG, "cfg-lifetime",

    "Whether or not end-of-lifetime information should be included in the CFG.",

    false)

ANALYZER_OPTION(bool, ShouldIncludeLoopExitInCFG, "cfg-loopexit",

                "Whether or not the end of the loop information should "

                "be included in the CFG.",

                false)

ANALYZER_OPTION(bool, ShouldIncludeRichConstructorsInCFG,

                "cfg-rich-constructors",

                "Whether or not construction site information should be "

                "included in the CFG C++ constructor elements.",

                true)

ANALYZER_OPTION(

    bool, ShouldIncludeScopesInCFG, "cfg-scopes",

    "Whether or not scope information should be included in the CFG.", false)

ANALYZER_OPTION(bool, ShouldIncludeDefaultInitForAggregates,

                "cfg-expand-default-aggr-inits",

                "Whether or not inline CXXDefaultInitializers for aggregate "

                "initialization in the CFG.",

                false)

ANALYZER_OPTION(

    bool, MayInlineTemplateFunctions, "c++-template-inlining",

    "Whether or not templated functions may be considered for inlining.", true)

ANALYZER_OPTION(bool, MayInlineCXXStandardLibrary, "c++-stdlib-inlining",

                "Whether or not C++ standard library functions may be "

                "considered for inlining.",

                true)

ANALYZER_OPTION(bool, MayInlineCXXAllocator, "c++-allocator-inlining",

                "Whether or not allocator and deallocator calls may be "

                "considered for inlining.",

                true)

ANALYZER_OPTION(

    bool, MayInlineCXXSharedPtrDtor, "c++-shared_ptr-inlining",

    "Whether or not the destructor of C++ 'shared_ptr' may be considered for "

    "inlining. This covers std::shared_ptr, std::tr1::shared_ptr, and "

    "boost::shared_ptr, and indeed any destructor named '~shared_ptr'.",

    false)

ANALYZER_OPTION(bool, MayInlineCXXTemporaryDtors, "c++-temp-dtor-inlining",

                "Whether C++ temporary destructors should be inlined "

                "during analysis. If temporary destructors are disabled "

                "in the CFG via the 'cfg-temporary-dtors' option, "

                "temporary destructors would not be inlined anyway.",

                true)

ANALYZER_OPTION(

    bool, ShouldSuppressNullReturnPaths, "suppress-null-return-paths",

    "Whether or not paths that go through null returns should be suppressed. "

    "This is a heuristic for avoiding bug reports with paths that go through "

    "inlined functions that are more defensive than their callers.",

    true)

ANALYZER_OPTION(

    bool, ShouldAvoidSuppressingNullArgumentPaths,

    "avoid-suppressing-null-argument-paths",

    "Whether a bug report should not be suppressed if its path includes a call "

    "with a null argument, even if that call has a null return. This option "

    "has no effect when ShouldSuppressNullReturnPaths is false. This is a "

    "counter-heuristic to avoid false negatives.",

    false)

ANALYZER_OPTION(bool, ShouldSuppressInlinedDefensiveChecks,

                "suppress-inlined-defensive-checks",

                "Whether or not diagnostics containing inlined "

                "defensive NULL checks should be suppressed.",

                true)

ANALYZER_OPTION(bool, MayInlineCXXContainerMethods, "c++-container-inlining",

                "Whether or not methods of C++ container objects may be "

                "considered for inlining.",

                false)

ANALYZER_OPTION(bool, ShouldSuppressFromCXXStandardLibrary,

                "suppress-c++-stdlib",

                "Whether or not diagnostics reported within the C++ "

                "standard library should be suppressed.",

                true)

ANALYZER_OPTION(bool, ShouldCrosscheckWithZ3, "crosscheck-with-z3",

                "Whether bug reports should be crosschecked with the Z3 "

                "constraint manager backend.",

                false)

ANALYZER_OPTION(bool, ShouldReportIssuesInMainSourceFile,

                "report-in-main-source-file",

                "Whether or not the diagnostic report should be always "

                "reported in the main source file and not the headers.",

                false)

ANALYZER_OPTION(bool, ShouldWriteStableReportFilename, "stable-report-filename",

                "Deprecated: report filenames are now always stable. "

                "See also 'verbose-report-filename'.",

                false)

ANALYZER_OPTION(bool, ShouldWriteVerboseReportFilename, "verbose-report-filename",

                "Whether or not the report filename should contain extra "

                "information about the issue.",

                false)

ANALYZER_OPTION(

    bool, ShouldSerializeStats, "serialize-stats",

    "Whether the analyzer should serialize statistics to plist output. "

    "Statistics would be serialized in JSON format inside the main dictionary "

    "under the statistics key. Available only if compiled in assert mode or "

    "with LLVM statistics explicitly enabled.",

    false)

ANALYZER_OPTION(bool, MayInlineObjCMethod, "objc-inlining",

                "Whether ObjectiveC inlining is enabled, false otherwise.",

                true)

ANALYZER_OPTION(bool, ShouldPrunePaths, "prune-paths",

                "Whether irrelevant parts of a bug report path should "

                "be pruned out of the final output.",

                true)

ANALYZER_OPTION(bool, ShouldAddPopUpNotes, "add-pop-up-notes",

                "Whether pop-up notes should be added to the final output.",

                true)

ANALYZER_OPTION(

    bool, ShouldConditionalizeStaticInitializers,

    "cfg-conditional-static-initializers",

    "Whether 'static' initializers should be in conditional logic in the CFG.",

    true)

ANALYZER_OPTION(bool, ShouldSynthesizeBodies, "faux-bodies",

                "Whether the analyzer engine should synthesize fake "

                "bodies for well-known functions.",

                true)

ANALYZER_OPTION(

    bool, ShouldElideConstructors, "elide-constructors",

    "Whether elidable C++ copy-constructors and move-constructors should be "

    "actually elided during analysis. Both behaviors are allowed by the C++ "

    "standard, and the analyzer, like CodeGen, defaults to eliding. Starting "

    "with C++17 some elisions become mandatory, and in these cases the option "

    "will be ignored.",

    true)

ANALYZER_OPTION(

    bool, ShouldInlineLambdas, "inline-lambdas",

    "Whether lambdas should be inlined. Otherwise a sink node will be "

    "generated each time a LambdaExpr is visited.",

    true)

ANALYZER_OPTION(bool, ShouldWidenLoops, "widen-loops",

                "Whether the analysis should try to widen loops.", false)

ANALYZER_OPTION(

    bool, ShouldUnrollLoops, "unroll-loops",

    "Whether the analysis should try to unroll loops with known bounds.", false)

ANALYZER_OPTION(

    bool, ShouldDisplayNotesAsEvents, "notes-as-events",

    "Whether the bug reporter should transparently treat extra note diagnostic "

    "pieces as event diagnostic pieces. Useful when the diagnostic consumer "

    "doesn't support the extra note pieces.",

    false)

ANALYZER_OPTION(

    bool, ShouldAggressivelySimplifyBinaryOperation,

    "aggressive-binary-operation-simplification",

    "Whether SValBuilder should rearrange comparisons and additive operations "

    "of symbolic expressions which consist of a sum of a symbol and a concrete "

    "integer into the format where symbols are on the left-hand side and the "

    "integer is on the right. This is only done if both symbols and both "

    "concrete integers are signed, greater than or equal to the quarter of the "

    "minimum value of the type and less than or equal to the quarter of the "

    "maximum value of that type. A + n <OP> B + m becomes A - B <OP> m - n, "

    "where A and B symbolic, n and m are integers. <OP> is any of '==', '!=', "

    "'<', '<=', '>', '>=', '+' or '-'. The rearrangement also happens with '-' "

    "instead of '+' on either or both side and also if any or both integers "

    "are missing.",

    false)

ANALYZER_OPTION(

    bool, ShouldEagerlyAssume, "eagerly-assume",

    "Whether we should eagerly assume evaluations of conditionals, thus, "

    "bifurcating the path. This indicates how the engine should handle "

    "expressions such as: 'x = (y != 0)'. When this is true then the "

    "subexpression 'y != 0' will be eagerly assumed to be true or false, thus "

    "evaluating it to the integers 0 or 1 respectively. The upside is that "

    "this can increase analysis precision until we have a better way to lazily "

    "evaluate such logic. The downside is that it eagerly bifurcates paths.",

    true)

ANALYZER_OPTION(

    bool, IsNaiveCTUEnabled, "experimental-enable-naive-ctu-analysis",

    "Whether naive cross translation unit analysis is enabled. This is an "

    "experimental feature to inline functions from other translation units.",

    false)

ANALYZER_OPTION(bool, ShouldDisplayMacroExpansions, "expand-macros",

                "Whether macros related to the bugpath should be "

                "expanded and included in the plist output.",

                false)

ANALYZER_OPTION(bool, DisplayCTUProgress, "display-ctu-progress",

                "Whether to emit verbose output about "

                "the analyzer's progress related to ctu.",

                false)

ANALYZER_OPTION(bool, ShouldTrackConditions, "track-conditions",

                "Whether to track conditions that are a control dependency of "

                "an already tracked variable.",

                true)

ANALYZER_OPTION(bool, ShouldTrackConditionsDebug, "track-conditions-debug",

                "Whether to place an event at each tracked condition.",

                false)

ANALYZER_OPTION(bool, ShouldApplyFixIts, "apply-fixits",

                "Apply the fix-it hints to the files",

                false)

ANALYZER_OPTION(bool, ShouldDisplayCheckerNameForText, "display-checker-name",

                "Display the checker name for textual outputs",

                true)

ANALYZER_OPTION(bool, ShouldSupportSymbolicIntegerCasts,

                "support-symbolic-integer-casts",

                "Produce cast symbols for integral types.",

                false)

ANALYZER_OPTION(

    bool, ShouldConsiderSingleElementArraysAsFlexibleArrayMembers,

    "consider-single-element-arrays-as-flexible-array-members",

    "Consider single element arrays as flexible array member candidates. "

    "This will prevent the analyzer from assuming that a single element array "

    "holds a single element. [DEPRECATED, removing in clang-17; "

    "use '-fstrict-flex-arrays=<N>' instead]",

    true)

ANALYZER_OPTION(

    bool, ShouldAssumeControlledEnvironment, "assume-controlled-environment",

    "Whether the analyzed application runs in a controlled environment. "

    "We will assume that environment variables exist in queries and they hold "

    "no malicious data. For instance, if this option is enabled, 'getenv()' "

    "might be modeled by the analyzer to never return NULL.",

    false)

ANALYZER_OPTION(

    bool, ShouldIgnoreBisonGeneratedFiles, "ignore-bison-generated-files",

    "If enabled, any files containing the \"/* A Bison parser, made by\" "

    "won't be analyzed.",

    true)

ANALYZER_OPTION(

    bool, ShouldIgnoreFlexGeneratedFiles, "ignore-flex-generated-files",

    "If enabled, any files containing the \"/* A lexical scanner generated by "

    "flex\" won't be analyzed.",

    true)

//===----------------------------------------------------------------------===//

// Unsigned analyzer options.

//===----------------------------------------------------------------------===//

ANALYZER_OPTION(unsigned, CTUImportThreshold, "ctu-import-threshold",

                "The maximal amount of translation units that is considered "

                "for import when inlining functions during CTU analysis. "

                "Lowering this threshold can alleviate the memory burden of "

                "analysis with many interdependent definitions located in "

                "various translation units. This is valid only for non C++ "

                "source files.",

                24u)

ANALYZER_OPTION(unsigned, CTUImportCppThreshold, "ctu-import-cpp-threshold",

                "The maximal amount of translation units that is considered "

                "for import when inlining functions during CTU analysis of C++ "

                "source files.",

                8u)

ANALYZER_OPTION(

    unsigned, AlwaysInlineSize, "ipa-always-inline-size",

    "The size of the functions (in basic blocks), which should be considered "

    "to be small enough to always inline.",

    3)

ANALYZER_OPTION(

    unsigned, GraphTrimInterval, "graph-trim-interval",

    "How often nodes in the ExplodedGraph should be recycled to save memory. "

    "To disable node reclamation, set the option to 0.",

    1000)

ANALYZER_OPTION(

    unsigned, MinCFGSizeTreatFunctionsAsLarge,

    "min-cfg-size-treat-functions-as-large",

    "The number of basic blocks a function needs to have to be considered "

    "large for the 'max-times-inline-large' config option.",

    14)

ANALYZER_OPTION(unsigned, MaxSymbolComplexity, "max-symbol-complexity",

                "The maximum complexity of symbolic constraint.", 35)

ANALYZER_OPTION(unsigned, MaxTimesInlineLarge, "max-times-inline-large",

                "The maximum times a large function could be inlined.", 32)

ANALYZER_OPTION_DEPENDS_ON_USER_MODE(

    unsigned, MaxInlinableSize, "max-inlinable-size",

    "The bound on the number of basic blocks in an inlined function.",

    /* SHALLOW_VAL */ 4, /* DEEP_VAL */ 100)

ANALYZER_OPTION_DEPENDS_ON_USER_MODE(

    unsigned, MaxNodesPerTopLevelFunction, "max-nodes",

    "The maximum number of nodes the analyzer can generate while exploring a "

    "top level function (for each exploded graph). 0 means no limit.",

    /* SHALLOW_VAL */ 75000, /* DEEP_VAL */ 225000)

ANALYZER_OPTION(

    unsigned, CTUMaxNodesPercentage, "ctu-max-nodes-pct",

    "The percentage of single-TU analysed nodes that the CTU analysis is "

    "allowed to visit.", 50)

ANALYZER_OPTION(

    unsigned, CTUMaxNodesMin, "ctu-max-nodes-min",

    "The maximum number of nodes in CTU mode is determinded by "

    "'ctu-max-nodes-pct'. However, if the number of nodes in single-TU "

    "analysis is too low, it is meaningful to provide a minimum value that "

    "serves as an upper bound instead.", 10000)

ANALYZER_OPTION(

    StringRef, CTUPhase1InliningMode, "ctu-phase1-inlining",

    "Controls which functions will be inlined during the first phase of the ctu "

    "analysis. "

    "If the value is set to 'all' then all foreign functions are inlinied "

    "immediately during the first phase, thus rendering the second phase a noop. "

    "The 'ctu-max-nodes-*' budge has no effect in this case. "

    "If the value is 'small' then only functions with a linear CFG and with a "

    "limited number of statements would be inlined during the first phase. The "

    "long and/or nontrivial functions are handled in the second phase and are "

    "controlled by the 'ctu-max-nodes-*' budge. "

    "The value 'none' means that all foreign functions are inlined only in the "

    "second phase, 'ctu-max-nodes-*' budge limits the second phase. "

    "Value: \"none\", \"small\", \"all\".",

    "small")

ANALYZER_OPTION(

    unsigned, RegionStoreSmallStructLimit, "region-store-small-struct-limit",

    "The largest number of fields a struct can have and still be considered "

    "small. This is currently used to decide whether or not it is worth forcing "

    "a LazyCompoundVal on bind. To disable all small-struct-dependent "

    "behavior, set the option to 0.",

    2)

ANALYZER_OPTION(

    unsigned, RegionStoreSmallArrayLimit, "region-store-small-array-limit",

    "The largest number of elements an array can have and still be considered "

    "small. This is currently used to decide whether or not it is worth forcing "

    "a LazyCompoundVal on bind. To disable all small-array-dependent "

    "behavior, set the option to 0.",

    5)

//===----------------------------------------------------------------------===//

// String analyzer options.

//===----------------------------------------------------------------------===//

ANALYZER_OPTION(StringRef, CTUDir, "ctu-dir",

                "The directory containing the CTU related files.", "")

ANALYZER_OPTION(StringRef, CTUIndexName, "ctu-index-name",

                "The name of the file containing the CTU index of definitions. "

                "The index file maps USR-names to identifiers. An identifier "

                "can end with an '.ast' suffix, indicating the indentifier is "

                "a path to a pch-dump. Otherwise the identifier is regarded as "

                "path to a source file which is parsed on-demand. Relative "

                "paths are prefixed with ctu-dir, absolute paths are used "

                "unmodified during lookup.",

                "externalDefMap.txt")

ANALYZER_OPTION(

    StringRef, CTUInvocationList, "ctu-invocation-list",

    "The path to the YAML format file containing a mapping from source file "

    "paths to command-line invocations represented as a list of arguments. "

    "This invocation is used produce the source-file's AST in case on-demand "

    "loading is performed. Example file-content: "

    "{/main.cpp: [clang++, /main.cpp], other.cpp: [clang++, /other.cpp]}",

    "invocations.yaml")

ANALYZER_OPTION(

    StringRef, ModelPath, "model-path",

    "The analyzer can inline an alternative implementation written in C at the "

    "call site if the called function's body is not available. This is a path "

    "where to look for those alternative implementations (called models).",

    "")

ANALYZER_OPTION(

    StringRef, CXXMemberInliningMode, "c++-inlining",

    "Controls which C++ member functions will be considered for inlining. "

    "Value: \"constructors\", \"destructors\", \"methods\".",

    "destructors")

ANALYZER_OPTION(

    StringRef, ExplorationStrategy, "exploration_strategy",

    "Value: \"dfs\", \"bfs\", \"unexplored_first\", "

    "\"unexplored_first_queue\", \"unexplored_first_location_queue\", "

    "\"bfs_block_dfs_contents\".",

    "unexplored_first_queue")

ANALYZER_OPTION(

    StringRef, RawSilencedCheckersAndPackages, "silence-checkers",

    "A semicolon separated list of checker and package names to silence. "

    "Silenced checkers will not emit reports, but the modeling remain enabled.",

    "")

ANALYZER_OPTION_DEPENDS_ON_USER_MODE(

    StringRef, IPAMode, "ipa",

    "Controls the mode of inter-procedural analysis. Value: \"none\", "

    "\"basic-inlining\", \"inlining\", \"dynamic\", \"dynamic-bifurcate\".",

    /* SHALLOW_VAL */ "inlining", /* DEEP_VAL */ "dynamic-bifurcate")

#undef ANALYZER_OPTION_DEPENDS_ON_USER_MODE

#undef ANALYZER_OPTION