<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Yeah, that's roughly what i meant.<br>
<br>
I don't know if you're going in the right direction because i've
never seen this approach used successfully in any actual checkers,
so i've no idea what you're trying to do. Because inventing new
static analysis techniques is a thing that's *very* easy to get
wrong, i suggest discussing the problem first, and only then
discussing the specific solution.<br>
<br>
<div class="moz-cite-prefix">On 6/27/19 10:44 AM, Алексеев Кирилл
via cfe-dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:23581111561657468@myt5-f1576e7b5bad.qloud-c.yandex.net">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div><br>
</div>
<div class="49d322fa18fbd16bb206f61f9a2a40f7normalize">
<div><br>
<br>
<div>11.06.2019, 04:12, "Artem Dergachev via cfe-dev" <<a
class="09f7ddcd78d17c479368795f67fe4443goto-anchor"
href="mailto:cfe-dev@lists.llvm.org"
moz-do-not-send="true">cfe-dev@lists.llvm.org</a>>:</div>
<blockquote>
<div>
<div bgcolor="#FFFFFF"> Multi-pass path-sensitive analysis
is indeed not a thing. However, you can do arbitrary
AST-based analysis before path-sensitive analysis or
after it by subscribing to the respective callback, and
you can also explore the whole path-sensitive analysis
graph at the end of the analysis. But none of this is
actually used actively; there's usually no need for
this.<br>
<br>
Also all path-sensitive checkers have a way to affect
other checkers and communicate to each other via
mutating the common program state. This is used much
more actively and allows conducting multiple
interconnected analysis in a single path.<br>
<br>
There's most likely an easier solution to what you're
trying to do; i recommend discussing it.<br>
<br>
<div
class="b7208f009a6f820cee2c5192307fe726ec38e6d876920c67a8c9c8bc184e51ca809314d0c4881d4841d185c08b152359b0bac06ac3581de2ec418ec92a0326fbmoz-cite-prefix">On
6/9/19 6:51 AM, Алексеев Кирилл via cfe-dev wrote:<br>
</div>
<blockquote>
<div><br>
</div>
<div>Hello, I'm beginner in CSA programming. I have
read clang SA a checker developer manual</div>
<div>and have some questions.</div>
<div>How can I pass command line options to CSA
checker? Does -Xanalyzer option can help me?</div>
<div>May be I need to see AnalyzerOptions.cpp, but
can't understand how to catch options from my
checker.</div>
<div><br>
</div>
<div>Also I want to know is it possible to realize
multi-pass analyzer with parallel or sequential
running of one or multiply checker with data
transfer between passes.</div>
<div>I need to run first checker that taint some
input, observes taint values and find some AST
expressions (or with path sensible analysis).</div>
<div>After this checker ends up I need to start the
second checker, that uses search results of 1'st in
analysis from begining of ExplodedGraph.</div>
<div><br>
</div>
<br>
<pre class="2d37031c8697c4d130862c0ea7e8d03c9db545f882dae13254e98a9ed235586f0182442e7908a18bc25d80212d9cd3cbe8d7c34db0da9e6370c8a87217a69d47moz-quote-pre">_______________________________________________
cfe-dev mailing list
<a class="cfb1ae18380cbba11f0099e20a6f9033379efc6ad8b91cc511f85dce0935ae1b053601db12d746f838298619f14d96a24eb93b68e5827e5e792ffe9c28d66818moz-txt-link-abbreviated 9213f2ab4648198c89ea527eda9dc692d79ea98dedda095a8d36c4f0ce5a3eff09f7ddcd78d17c479368795f67fe4443goto-anchor 09f7ddcd78d17c479368795f67fe4443goto-anchor" href="mailto:cfe-dev@lists.llvm.org" moz-do-not-send="true">cfe-dev@lists.llvm.org</a>
<a class="4589862b050412426868b222bb5ba737a683d5c14eb73bbd4661d8ffa811300fabc4448685a2998ff26ac1389283356e499caf9c18d52a041ed62b7164c9779dmoz-txt-link-freetext 9213f2ab4648198c89ea527eda9dc692d79ea98dedda095a8d36c4f0ce5a3eff09f7ddcd78d17c479368795f67fe4443goto-anchor 09f7ddcd78d17c479368795f67fe4443goto-anchor" href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" moz-do-not-send="true">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br>
</div>
</div>
<div>
<p>_______________________________________________<br>
cfe-dev mailing list<br>
<a
class="9213f2ab4648198c89ea527eda9dc692d79ea98dedda095a8d36c4f0ce5a3eff09f7ddcd78d17c479368795f67fe4443goto-anchor
09f7ddcd78d17c479368795f67fe4443goto-anchor"
href="mailto:cfe-dev@lists.llvm.org"
moz-do-not-send="true">cfe-dev@lists.llvm.org</a><br>
<a
class="9213f2ab4648198c89ea527eda9dc692d79ea98dedda095a8d36c4f0ce5a3eff09f7ddcd78d17c479368795f67fe4443goto-anchor
09f7ddcd78d17c479368795f67fe4443goto-anchor"
href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev"
moz-do-not-send="true">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
</div>
</blockquote>
<div>Thanks for you reply.</div>
<div>But how I can walk through whole path-sensitive analysis
graph at the end of the analysis?</div>
<div>Really, I need to collect some information based on first
step of analysis and rewrite some AST statements in origin
source code.<br>
</div>
<div><br>
</div>
<div>As I understood I must use checkEndAnalysis callback and
then iterate over ExplodedGraph nodes, as here:</div>
<div>for ( ExplodedGraph :: node_iterator I = </div>
<div> G . nodes_begin () ,</div>
<div> E = G . nodes_end (); </div>
<div> I != E ; ++ I ) { ... }</div>
<div><br>
</div>
<div>Next, I need to give some recommendations to user how he
can improve code.</div>
<div>Is the way I'm going right?<br>
</div>
<div><br>
</div>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
cfe-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cfe-dev@lists.llvm.org">cfe-dev@lists.llvm.org</a>
<a class="moz-txt-link-freetext" href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>