[cfe-commits] r159397 - in /cfe/trunk: include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/TraversalChecker.cpp lib/StaticAnalyzer/Core/CoreEngine.cpp test/Analysis/traversal-algorithm.mm
Jordan Rose
jordan_rose at apple.com
Thu Jun 28 17:33:10 PDT 2012
Author: jrose
Date: Thu Jun 28 19:33:10 2012
New Revision: 159397
URL: http://llvm.org/viewvc/llvm-project?rev=159397&view=rev
Log:
[analyzer] Add a test that we are, in fact, doing a DFS on the ExplodedGraph.
Previously:
...the comment said DFS...
...the WorkList being instantiated said BFS...
...and the implementation was actually DFS...
...due to an unintentional change in 2010...
...and everything kept working anyway.
This fixes our std::deque implementation of BFS, but switches back to a
SmallVector-based implementation of DFS.
We should probably still investigate the ramifications of DFS vs. BFS,
especially for large functions (and especially when we hit our block path
limit), since this might completely change our memory use. It can also mask
some bugs and reveal others depending on when we halt analysis. But at least
we will not have this kind of little mistake creep in again.
Added:
cfe/trunk/lib/StaticAnalyzer/Checkers/TraversalChecker.cpp
cfe/trunk/test/Analysis/traversal-algorithm.mm
Modified:
cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt
cfe/trunk/lib/StaticAnalyzer/Checkers/Checkers.td
cfe/trunk/lib/StaticAnalyzer/Core/CoreEngine.cpp
Modified: cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h?rev=159397&r1=159396&r2=159397&view=diff
==============================================================================
--- cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h (original)
+++ cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h Thu Jun 28 19:33:10 2012
@@ -65,7 +65,7 @@
/// WList - A set of queued nodes that need to be processed by the
/// worklist algorithm. It is up to the implementation of WList to decide
/// the order that nodes are processed.
- WorkList* WList;
+ OwningPtr<WorkList> WList;
/// BCounterFactory - A factory object for created BlockCounter objects.
/// These are used to record for key nodes in the ExplodedGraph the
@@ -107,20 +107,15 @@
ExplodedNode *generateCallExitBeginNode(ExplodedNode *N);
public:
- /// Construct a CoreEngine object to analyze the provided CFG using
- /// a DFS exploration of the exploded graph.
+ /// Construct a CoreEngine object to analyze the provided CFG.
CoreEngine(SubEngine& subengine, SetOfConstDecls *VisitedCallees,
FunctionSummariesTy *FS)
: SubEng(subengine), G(new ExplodedGraph()),
- WList(WorkList::makeBFS()),
+ WList(WorkList::makeDFS()),
BCounterFactory(G->getAllocator()),
AnalyzedCallees(VisitedCallees),
FunctionSummaries(FS){}
- ~CoreEngine() {
- delete WList;
- }
-
/// getGraph - Returns the exploded graph.
ExplodedGraph& getGraph() { return *G.get(); }
@@ -156,7 +151,7 @@
blocksAborted.push_back(std::make_pair(block, node));
}
- WorkList *getWorkList() const { return WList; }
+ WorkList *getWorkList() const { return WList.get(); }
BlocksExhausted::const_iterator blocks_exhausted_begin() const {
return blocksExhausted.begin();
Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt?rev=159397&r1=159396&r2=159397&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/CMakeLists.txt Thu Jun 28 19:33:10 2012
@@ -58,6 +58,7 @@
StackAddrEscapeChecker.cpp
StreamChecker.cpp
TaintTesterChecker.cpp
+ TraversalChecker.cpp
UndefBranchChecker.cpp
UndefCapturedBlockVarChecker.cpp
UndefResultChecker.cpp
Modified: cfe/trunk/lib/StaticAnalyzer/Checkers/Checkers.td
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/Checkers.td?rev=159397&r1=159396&r2=159397&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/Checkers.td (original)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/Checkers.td Thu Jun 28 19:33:10 2012
@@ -479,6 +479,10 @@
HelpText<"Display Call Graph">,
DescFile<"DebugCheckers.cpp">;
+def TraversalDumper : Checker<"DumpTraversal">,
+ HelpText<"Print branch conditions as they are traversed by the engine">,
+ DescFile<"TraversalChecker.cpp">;
+
def AnalyzerStatsChecker : Checker<"Stats">,
HelpText<"Emit warnings with analyzer statistics">,
DescFile<"AnalyzerStatsChecker.cpp">;
Added: cfe/trunk/lib/StaticAnalyzer/Checkers/TraversalChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Checkers/TraversalChecker.cpp?rev=159397&view=auto
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/TraversalChecker.cpp (added)
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/TraversalChecker.cpp Thu Jun 28 19:33:10 2012
@@ -0,0 +1,57 @@
+//== TraversalChecker.cpp -------------------------------------- -*- C++ -*--=//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This checker prints branch statements to llvm::outs as they are encountered.
+// This lets us see exactly how the ExprEngine is traversing the graph.
+//
+//===----------------------------------------------------------------------===//
+#include "ClangSACheckers.h"
+#include "clang/AST/ParentMap.h"
+#include "clang/AST/StmtObjC.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+class TraversalDumper : public Checker< check::BranchCondition,
+ check::EndPath > {
+public:
+ void checkBranchCondition(const Stmt *Condition, CheckerContext &C) const;
+ void checkEndPath(CheckerContext &C) const;
+};
+}
+
+void TraversalDumper::checkBranchCondition(const Stmt *Condition,
+ CheckerContext &C) const {
+ // Special-case Objective-C's for-in loop, which uses the entire loop as its
+ // condition. We just print the collection expression.
+ const Stmt *Parent = dyn_cast<ObjCForCollectionStmt>(Condition);
+ if (!Parent) {
+ const ParentMap &Parents = C.getLocationContext()->getParentMap();
+ Parent = Parents.getParent(Condition);
+ }
+
+ // It is mildly evil to print directly to llvm::outs() rather than emitting
+ // warnings, but this ensures things do not get filtered out by the rest of
+ // the static analyzer machinery.
+ SourceLocation Loc = Parent->getLocStart();
+ llvm::outs() << C.getSourceManager().getSpellingLineNumber(Loc) << " "
+ << Parent->getStmtClassName() << "\n";
+}
+
+void TraversalDumper::checkEndPath(CheckerContext &C) const {
+ llvm::outs() << "--END PATH--\n";
+}
+
+void ento::registerTraversalDumper(CheckerManager &mgr) {
+ mgr.registerChecker<TraversalDumper>();
+}
Modified: cfe/trunk/lib/StaticAnalyzer/Core/CoreEngine.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/CoreEngine.cpp?rev=159397&r1=159396&r2=159397&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/CoreEngine.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/CoreEngine.cpp Thu Jun 28 19:33:10 2012
@@ -76,7 +76,7 @@
}
virtual void enqueue(const WorkListUnit& U) {
- Queue.push_front(U);
+ Queue.push_back(U);
}
virtual WorkListUnit dequeue() {
Added: cfe/trunk/test/Analysis/traversal-algorithm.mm
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/traversal-algorithm.mm?rev=159397&view=auto
==============================================================================
--- cfe/trunk/test/Analysis/traversal-algorithm.mm (added)
+++ cfe/trunk/test/Analysis/traversal-algorithm.mm Thu Jun 28 19:33:10 2012
@@ -0,0 +1,97 @@
+// RUN: %clang_cc1 -analyze -analyzer-checker=debug.DumpTraversal -std=c++11 %s | FileCheck -check-prefix=DFS %s
+
+int a();
+int b();
+int c();
+
+int work();
+
+void test(id input) {
+ if (a()) {
+ if (a())
+ b();
+ else
+ c();
+ } else {
+ if (b())
+ a();
+ else
+ c();
+ }
+
+ if (a())
+ work();
+}
+
+// This ordering assumes that true cases happen before the false cases.
+
+// BFS: 10 IfStmt
+// BFS-NEXT: 11 IfStmt
+// BFS-NEXT: 16 IfStmt
+// BFS-NEXT: 22 IfStmt
+// BFS-NEXT: 22 IfStmt
+// BFS-NEXT: 22 IfStmt
+// BFS-NEXT: 22 IfStmt
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+// BFS-NEXT: --END PATH--
+
+// And this ordering assumes that false cases happen before the true cases.
+
+// DFS: 10 IfStmt
+// DFS-NEXT: 16 IfStmt
+// DFS-NEXT: 22 IfStmt
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: 22 IfStmt
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: 11 IfStmt
+// DFS-NEXT: 22 IfStmt
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: 22 IfStmt
+// DFS-NEXT: --END PATH--
+// DFS-NEXT: --END PATH--
+
+
+void testLoops(id input) {
+ while (a()) {
+ work();
+ work();
+ work();
+ }
+
+ for (int i = 0; i != b(); ++i) {
+ work();
+ }
+
+ for (id x in input) {
+ work();
+ work();
+ work();
+ }
+
+ int z[] = {1,2,3};
+ for (int y : z) {
+ work();
+ work();
+ work();
+ }
+}
+
+// BFS: 64 WhileStmt
+// BFS: 70 ForStmt
+// BFS-NOT-NEXT: ObjCForCollectionStmt
+// BFS: 74 ObjCForCollectionStmt
+// BFS: 81 CXXForRangeStmt
+
+// DFS: 64 While
+// DFS-NEXT: 70 ForStmt
+// DFS-NEXT: 74 ObjCForCollectionStmt
+// DFS-NEXT: 81 CXXForRangeStmt
More information about the cfe-commits
mailing list