Hi clang,<br><div style="margin-left: 40px;"><br></div>While testing the
UncheckedReturn Checker, i got a path explosion problem while clang
static-analyzer analyze a giant function that has a huge mounts of
paths.<br><br>
For example the function BZ2_decompress in "bzip2.c". The source code of "bzip2.c" can be found here <a href="http://pastebin.com/BzzPEWrs">http://pastebin.com/BzzPEWrs</a>.<br><br>When i executed static-analyzer with the command line "-cc1 -analyze -analyzer-checker=core.<div id=":vv">
experimental.UncheckedReturn -analyzer-store region /home/polo/test/largetest/bzip2.c",
it worked OK. But the result was not exactly what i want, since the
analyzer reached the maximum number of exploded nodes. So i added
"-analyzer-max-nodes 0" to the command line, after a while the
static-analyzer crashed because exhausted all my memory(about 3G).<br>
<br>I thought it was my fault in the UncheckedReturn checker, but after i
tried some other checkers with the same command line i found it was a
path explotion. And i found with "-analyze-function BZ2_decompress" the
analyzer still crashed.<br>
<br><div style="margin-left: 40px; color: rgb(0, 0, 153);"><font size="1">terminate called after throwing an instance of 'std::bad_alloc'<br> what(): std::bad_alloc<br>0 clang 0x09fc26a7<br>1 clang 0x09fc2434<br>
2 0x007c3400 __kernel_sigreturn + 0<br>3 libc.so.6 0x0021aa82 abort + 386<br>4 libstdc++.so.6 0x009e152f __gnu_cxx::__verbose_terminate_handler() + 335<br>5 libstdc++.so.6 0x009df465<br>6 libstdc++.so.6 0x009df4a2<br>
7 libstdc++.so.6 0x009df5e1<br>8 libstdc++.so.6 0x009dfc5f operator new(unsigned int) + 127<br>9 clang 0x092a7da0<br>10 clang 0x092a7345<br>11 clang 0x092a648d<br>12 clang 0x092a53da<br>
13 clang 0x092a4489<br>14 clang 0x092a39b0<br>15 clang 0x092a1ece<br>16 clang 0x092a2895<br>17 clang 0x0927546f clang::ento::GRStateManager::removeDeadBindings(clang::ento::GRState const*, clang::StackFrameContext const*, clang::ento::SymbolReaper&) + 239<br>
18 clang 0x092577fb clang::ento::ExprEngine::ProcessStmt(clang::CFGStmt, clang::ento::StmtNodeBuilder&) + 371<br>19 clang 0x09257610 clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::StmtNodeBuilder&) + 150<br>
20 clang 0x092474ae clang::ento::CoreEngine::HandlePostStmt(clang::CFGBlock const*, unsigned int, clang::ento::ExplodedNode*) + 266<br>21 clang 0x092468a0 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, clang::ento::GRState const*) + 1102<br>
22 clang 0x0917e9e0 clang::ento::ExprEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int) + 54<br>23 clang 0x0917d1c6<br>24 clang 0x0917d2bd<br>25 clang 0x0917d343<br>26 clang 0x0917d090<br>
27 clang 0x0917ca97<br>28 clang 0x0917cd31<br>29 clang 0x08e6698f clang::ParseAST(clang::Sema&, bool) + 617<br>30 clang 0x08bcdf63 clang::ASTFrontendAction::ExecuteAction() + 253<br>
31 clang 0x08bcdbbe clang::FrontendAction::Execute() + 328<br>32 clang 0x08bb5fe7 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 779<br>33 clang 0x08b5ccb7 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) + 835<br>
34 clang 0x08b4f485 cc1_main(char const**, char const**, char const*, void*) + 1014<br>35 clang 0x08b588d7 main + 521<br>36 libc.so.6 0x00203bd6 __libc_start_main + 230<br>37 clang 0x08b4eb61<br>
Stack dump:<br>0. Program arguments: clang -cc1 -analyze -analyzer-checker=unix.experimental.Chroot -analyzer-store region -analyze-function BZ2_decompress -analyzer-max-nodes 0 /home/polo/test/largetest/bzip2.c <br>1. <eof> parser at end of file<br>
2. /home/polo/test/largetest/bzip2.c:3443:4: Error evaluating statement<br>[1]- Killed emacs<br>Aborted<br></font></div><br>So
here's my problem, if we want to gather path-sensitive statistical
infomation, we probably need to analyze all the paths. But the upper
problem didn't allow us to do so.<br>
<br>IMO, there may be several ways overcome this:<br><ol><li>Increase my computer's memory...but i think it may not solve the problem.</li><li>Change
the worklist Algorithm form BFS to DFS, and after a path was analyzed,
release the memory generated in current path analyze. Is this feasible
or useful?</li><li>Or is there any other way to compromise?</li></ol>ps: We should not let clang crashed even if the memory exhausted, right?<br><br clear="all"></div>-- <br>Best regards!<br><br>Lei Zhang<br>