<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Apr 6, 2013, at 11:30 PM, Arthur Yoo <<a href="mailto:phjy007@gmail.com">phjy007@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div dir="ltr"><p class="">Hi all,</p><p class="">Now I am focusing on the execution path of Clang Static Analyzer. Firstly, I did some tests on<span class="Apple-converted-space"> </span><i>code_1.c</i>. <br></p><p class=""><font face="comic sans ms, sans-serif">//<i>code_1.c</i></font></p><p class=""><font face="comic sans ms, sans-serif">void func(int arg) {</font></p><p class=""><font face="comic sans ms, sans-serif"> int v;</font></p><p class=""><font face="comic sans ms, sans-serif"> v = 0; </font></p><p class=""><font face="comic sans ms, sans-serif"> int i;</font></p><p class=""><font face="comic sans ms, sans-serif"> for(i = 0; i < arg; i++) {</font></p><p class=""><font face="comic sans ms, sans-serif"> v = v + 1;</font></p><p class=""><font face="comic sans ms, sans-serif"> } </font></p><p class=""><font face="comic sans ms, sans-serif"> int a, b;<span class=""></span></font></p><p class=""><font face="comic sans ms, sans-serif"> a = v;<span class=""></span></font></p><p class=""><font face="comic sans ms, sans-serif"> b = a;</font></p><p class=""><font face="comic sans ms, sans-serif">}</font></p><p class="">The CFG of<span class="Apple-converted-space"> </span><i>code_1</i>.c is<span class="Apple-converted-space"> </span><a href="http://ww3.sinaimg.cn/large/a74e55b4jw1e3h14gvh8vj.jpg">http://ww3.sinaimg.cn/large/a74e55b4jw1e3h14gvh8vj.jpg</a>. </p><p class="">Then I tried to get the corresponding execution path sequence. Through test I got its execution path sequence, which is B5-B4-B1-B3-B2-B4-B1-B3-B2-B4-B1-B3-B2-B4-B1-B3-B2. (In<span class="Apple-converted-space"> </span><i>code_1.c,</i><span class="Apple-converted-space"> </span>the variable arg, which determines the loop times, is a symbolic value. And I used the default max_loop value in Clang Static Anaylzer, which equals 4.) </p><p class=""><br></p><p class="">I tried to do the same tests on<span class="Apple-converted-space"> </span><i>code_2.c</i>. </p><p class=""><font face="comic sans ms, sans-serif">//<i>code_2.c</i></font></p><p class=""><font face="comic sans ms, sans-serif">void func(int arg) {</font></p><p class=""><font face="comic sans ms, sans-serif"> int v;</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 1;</font></p><p class=""><font face="comic sans ms, sans-serif"> if(arg < 314) {</font></p><p class=""><font face="comic sans ms, sans-serif"> for(int i = 0; i < arg; i++) {</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 33; </font></p><p class=""><font face="comic sans ms, sans-serif"> } </font></p><p class=""><font face="comic sans ms, sans-serif"> } else {</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 11; </font></p><p class=""><font face="comic sans ms, sans-serif"> } </font></p><p class=""><font face="comic sans ms, sans-serif"> int a, b;</font></p><p class=""><font face="comic sans ms, sans-serif"> a = 62951413;</font></p><p class=""><font face="comic sans ms, sans-serif"> b = v;</font></p><p class=""><font face="comic sans ms, sans-serif">}</font></p><p class="">The CFG of<span class="Apple-converted-space"> </span><i>code_2.c</i><span class="Apple-converted-space"> </span>is<span class="Apple-converted-space"> </span><a href="http://ww2.sinaimg.cn/large/a74eed94jw1e3h13zu3raj.jpg">http://ww2.sinaimg.cn/large/a74eed94jw1e3h13zu3raj.jpg</a>. And its execution path sequence is B7-B2-B1-B6-B5-B1-B4-B3-B5-B1-B4-B3-B5-B1-B4-B3-B5-B1-B4-B3. The rule of tracing path in<span class="Apple-converted-space"> </span><i>code_2</i>.c is consistent with the rule in<span class="Apple-converted-space"> </span><i>code_1.c</i>.</p><p class=""><br></p><p class="">However, when I tried to do the same tests on<span class="Apple-converted-space"> </span><i>code_3.c</i>. <br></p><p class=""><font face="comic sans ms, sans-serif">//<i>code_3.c</i></font></p><p class=""><font face="comic sans ms, sans-serif">void func(int arg) {</font></p><p class=""><font face="comic sans ms, sans-serif"> int v;</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 1;</font></p><p class=""><font face="comic sans ms, sans-serif"> if(arg < 314) {</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 11; </font></p><p class=""><font face="comic sans ms, sans-serif"> } else {</font></p><p class=""><font face="comic sans ms, sans-serif"> for(int i = 0; i < arg; i++) {</font></p><p class=""><font face="comic sans ms, sans-serif"> v = arg + 33; </font></p><p class=""><font face="comic sans ms, sans-serif"> }</font></p><p class=""><font face="comic sans ms, sans-serif"> }</font></p><p class=""><font face="comic sans ms, sans-serif"> int a, b;</font></p><p class=""><font face="comic sans ms, sans-serif"> a = 62951413;</font></p><p class=""><font face="comic sans ms, sans-serif"> b = v;</font></p><p class=""><font face="comic sans ms, sans-serif">}</font></p><p class="">The CFG of<span class="Apple-converted-space"> </span><i>code_3.c</i><span class="Apple-converted-space"> </span>is<span class="Apple-converted-space"> </span><a href="http://ww4.sinaimg.cn/large/a74ecc4cjw1e3h13ae2xtj.jpg">http://ww4.sinaimg.cn/large/a74ecc4cjw1e3h13ae2xtj.jpg</a>. It seems that some strange things happened. Through test I got its execution path sequence, which is B7-B5-B4-B3-B2-B4-B3-B2-B4-B3-B2-B4-B3-B2-B6-B1. In fact, I expected the execution sequence should be B7-B5-B4-B1-B3-B2-B4-B1-B3-B2-B4-B1-B3-B2-B4-B1-B3-B2-B6-B1. </p><p class=""><br></p></div></div></blockquote>Are you saying that <span style="font-family: 'comic sans ms', sans-serif;"> 'v = arg + 11;' </span>is executed twice on the path you are observing? </div><div>How are you observing the execution path sequences? You cannot see the paths by observing the callbacks from the checkers since the analyzer does not make any guarantees on the order in which statements from different paths are processed. In this example, there are more than 2 paths through this program. You might be observing parts of different paths.</div><div><br></div><div>Cheers,</div><div>Anna.<br><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div dir="ltr"><p class="">So, is there anybody can help me explain the execution path of Clang Static Analyzer in<span class="Apple-converted-space"> </span><i>code_3.c</i>?</p><p class="">Am I doing something stupid here? Any help will be greatly appreciated.</p><p class="">P.S. The version number of LLVM and Clang in my tests is 3.3.<br></p>------<br>Best regards,<br>Arthur Yoo</div>_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br><a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a></div></blockquote></div><br></body></html>