<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 1, 2012, at 6:36 PM, Karl Mazurak wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi all -<br><br>Our group is considering using Clang for some program analysis, <br>primarily aimed at bug-hunting. We're targeting C++, which I understand <br>means the static analyzer isn't an option just yet, </div></blockquote><blockquote type="cite"><div>but it looks like <br>there's still plenty there that could be useful - so much that I'm not <br>sure what to start experimenting with.<br><br>The plugin tutorial uses a PluginASTAction and links to an example with <br>a RecursiveASTVisitor, but of course we'd like to avoid reinventing the <br>wheel (at coding time or at run time) as much as possible. For <br>instance, are CFGs pre-constructed somewhere? </div></blockquote><div><br></div><div>CFG is part of Analyzes library and is used by both clang and the analyzer.</div><div>You can use ViewCFG and DumpCFG checkers to see how C++ statements are modeled (and what the deficiencies are):</div><div><b style="color: rgb(0, 0, 0); font-family: monospace; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: 18px; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); font-size: small; ">clang -cc1 -analyze -analyzer-checker=debug.ViewCFG test.c</b></div><br><blockquote type="cite"><div> Does the dataflow <br>framework in Analysis/FlowSensitive work with C++? </div></blockquote>The analyzer's C++ support is work in progress. You can run the analyzer's path sensitive checkers on C++ code, however, it does not reason about many C++ concepts. </div><div><br><blockquote type="cite"><div> Is this Sema of any <br>use outside the path-sensitive analyzer? </div></blockquote><div><br></div>You can write a non-path-sensitive checkers, which visit different AST nodes (AST does have full C++ support). See AST Visitors in <a href="http://clang-analyzer.llvm.org/checker_dev_manual.html#ast">http://clang-analyzer.llvm.org/checker_dev_manual.html#ast</a>. </div><div><br></div><div><blockquote type="cite"><div>And is there anything in Clang <br>that could be useful in aggregating results together in whole program <br>analysis?<br><br></div></blockquote><div><br></div>The static analyzer does not currently support whole program analysis. </div><div><br><blockquote type="cite"><div>Thanks!<br><br>-- <br>Karl<br>_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></div></blockquote></div><br></body></html>