<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Hi, Arthur. The analyzer does a couple things to keep from running out of memory. First, it uniques ProgramStates (and ExplodedNodes) that represent the same state reached along different paths. Second, each top-level function is analyzed separately, so even if you have a lot of functions in one file, the analyzer won't need to keep all paths for all functions in memory at once. Third, the analyzer limits the amount of possible nodes along a path in various ways: by bailing out of a loop after a few iterations, and by giving up on a path if it goes on too long. And fourth, if a particular analysis happens to be going on for long enough (measured by the number of nodes generated), the analyzer will give up on the function altogether.</div><div><br></div><div>These restrictions definitely restrict the power of the analyzer, and we've had many bugs filed about that, but we do want to make sure we don't tie up the user's whole computer. Furthermore, it's still an explicit goal for the analyzer that you should be able to analyze a small project in a reasonable amount of time, i.e. something that's not relegated to a nightly check.</div><div><br></div><div>As for your code, I'm wondering how it's valid at all (what type accepts an integer assignment and a pointer addition to that?), but please file a bug at <a href="http://llvm.org/bugs/">http://llvm.org/bugs/</a> with a self-contained test case, because no matter how bad things are the analyzer still ought not to crash.</div><div><br></div><div>Jordan</div><div><br></div><br><div><div>On Jan 8, 2014, at 5:38 , Arthur Yoo <<a href="mailto:phjy007@gmail.com">phjy007@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><p class="MsoNormal">Hi all,</p><p class="MsoNormal"><br></p><p class="MsoNormal"><i>ProgramStates</i> are
immutable. Every <i>ExplodedNode</i> has its
<i>ProgramPoint</i> and <i>ProgramState</i>. If the source code file is very very large, does the
Analyzer can hold all of the <i>PopgramStates</i>
for all paths? </p><p class="MsoNormal"><br></p><p class="MsoNormal">In addition, I found it is strange when Analyzer evaluating
‘+=’ for some cases. My test codes are like below:</p><p class="MsoNormal"><i>po = &obj;</i></p><p class="MsoNormal"><i>a = 8;</i></p><p class="MsoNormal"><i>a += po;</i></p><p class="MsoNormal">In my test, evaluating ‘<i>a += po</i>’ makes the Analyzer crash. However, if I try to evaluate
the codes below, the Analyzer doesn’t crash. </p><p class="MsoNormal"><i>po = &obj;</i></p><p class="MsoNormal"><i>a = 8;</i></p><p class="MsoNormal"><i>a = a + po;</i></p><p class="MsoNormal">So how can I solve this problem? Thanks a lot.</p>
<div><br></div>-- <br><div dir="ltr"><font color="#444444">Best regards,</font><div><font color="#444444">Arthur Yoo</font></div></div>
</div>
_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></div><br></body></html>