<div dir="auto"><div>Well, technically you can do this by changing some config values but we have not turned these on by default yet. Mainly, because we have yet to see strong evidence that the additional false positives worth the gain in coverage. <br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jul 31, 2020, 6:26 PM Denis Petrov <<a href="mailto:dpetrov@accesssoftek.com">dpetrov@accesssoftek.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<div><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)"><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)">Gabor</span>,
thank you.</span></div>
<div><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)"><br>
</span></div>
<p>Well, as I see there's no way to do this without changes/improvements in the core for now.<br>
</p>
<p><br>
</p>
<div id="m_-5033280035502893088Signature">
<div name="divtagdefaultwrapper">
<hr>
<div><b>Denys Petrov</b></div>
<div>Senior С++ Developer | Kharkiv, Ukraine</div>
<div><br>
</div>
<div></div>
</div>
</div>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div id="m_-5033280035502893088divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>От:</b> Gábor Horváth <<a href="mailto:xazax.hun@gmail.com" target="_blank" rel="noreferrer">xazax.hun@gmail.com</a>><br>
<b>Отправлено:</b> 30 июля 2020 г. 15:48<br>
<b>Кому:</b> Denis Petrov<br>
<b>Копия:</b> Artem Dergachev; cfe-dev<br>
<b>Тема:</b> Re: [cfe-dev] [analyzer] How to analyzer the code after an indefinite loop?</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi!</div>
<div><br>
</div>
<div>There are two tools in the analyzer to help these problems but both are off by default as they would need some additional improvements and testing.
<br>
</div>
<div><br>
</div>
<div>One is loop unrolling which (when turned on) will detect specific loop patterns and unroll them completely (instead of stopping after 4 iterations).</div>
<div>The other is loop widening which involves restarting the analysis after the loop. While this increases the coverage of the analysis it can also trigger additional false positives as a large portion of the state needs to be invalidated to restart the analysis.
Making this invalidation less severe is one way to improve the situation.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Gabor<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, 30 Jul 2020 at 14:32, Denis Petrov via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" rel="noreferrer">cfe-dev@lists.llvm.org</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<p>In addition to my previous letter. I'm very concerned that we may have no chance to analyze a big chunk of code in this case:<br>
</p>
<blockquote style="margin:0px 0px 0px 40px;border:medium none;padding:0px">
<div><span style="font-family:Consolas,monospace;font-size:9pt"></span></div>
<div><span style="font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">void clang_analyzer_warnIfReached();</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">int f()</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">{</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> int i = 0;</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> for(int i = 0; i < 100; i++){</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> if(i > 10){</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> clang_analyzer_warnIfReached();</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> // a lot of code will never be analyzed</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> }</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> }</span></span><br style="font-family:Consolas,monospace">
<span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">}</span></span></span></div>
</blockquote>
<p>Why don't we analyze loop bodies as functions, just substitute a var `i` <span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)">
with </span><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)">s</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:16px;background-color:rgb(255,255,255)">ymbols(or constraint
ranges)</span> after reaching the limits, not generating a sinks instead?<br>
</p>
<p>Or there are somewhere already disscussed plans for improvement?<br>
</p>
<p><br>
</p>
<div id="m_-5033280035502893088gmail-m_-4775467890160906839Signature">
<div name="divtagdefaultwrapper">
<hr>
<div><b>Denys Petrov</b></div>
<div>Senior С++ Developer | Kharkiv, Ukraine</div>
<div><br>
</div>
<div></div>
</div>
</div>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div id="m_-5033280035502893088gmail-m_-4775467890160906839divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>От:</b> Artem Dergachev <<a href="mailto:noqnoqneo@gmail.com" target="_blank" rel="noreferrer">noqnoqneo@gmail.com</a>><br>
<b>Отправлено:</b> 28 июля 2020 г. 22:34<br>
<b>Кому:</b> Denis Petrov; cfe-dev<br>
<b>Тема:</b> Re: [cfe-dev] [analyzer] How to analyzer the code after an indefinite loop?</font>
<div> </div>
</div>
<div>
<div style="font-size:9pt;font-family:"Calibri",sans-serif">
<h3 style="background-color:rgb(255,255,255);font-size:10pt;border:1px dotted rgb(0,51,51);padding:0.8em">
<span style="color:rgb(255,102,0)">CAUTION:<strong> </strong></span>This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If you suspect potential phishing
or spam email, report it to <a href="mailto:ReportSpam@accesssoftek.com" target="_blank" rel="noreferrer">ReportSpam@accesssoftek.com</a></h3>
</div>
<div>Here's how you can find this out with the help of ExprInspection:<br>
<br>
<br>
$ cat test.c<br>
<br>
int f(int x, int flag)<br>
{<br>
int i = 0;<br>
while(i < x)<br>
i++;<br>
<br>
clang_analyzer_warnIfReached();<br>
}<br>
<br>
<br>
$ clang --analyze -Xclang -analyzer-checker=debug.ExprInspection test.c<br>
<br>
test.c:7:3: warning: REACHABLE [debug.ExprInspection]<br>
clang_analyzer_warnIfReached();<br>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
1 warning generated.<br>
<br>
<br>
Here's a slightly more interesting experiment:<br>
<br>
<br>
$ cat test.c<br>
<br>
int f(int x, int flag)<br>
{<br>
int i = 0;<br>
while(i < x)<br>
i++;<br>
<br>
if (flag) {<br>
clang_analyzer_warnIfReached();<br>
clang_analyzer_numTimesReached();<br>
return i;<br>
} else {<br>
clang_analyzer_warnIfReached();<br>
clang_analyzer_numTimesReached();<br>
return 0;<br>
}<br>
}<br>
<br>
<br>
$ clang --analyze -Xclang -analyzer-checker=debug.ExprInspection test.c<br>
<br>
test.c:8:5: warning: REACHABLE [debug.ExprInspection]<br>
clang_analyzer_warnIfReached();<br>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
test.c:9:5: warning: 4 [debug.ExprInspection]<br>
clang_analyzer_numTimesReached();<br>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
test.c:12:5: warning: REACHABLE [debug.ExprInspection]<br>
clang_analyzer_warnIfReached();<br>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
test.c:13:5: warning: 1 [debug.ExprInspection]<br>
clang_analyzer_numTimesReached();<br>
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
4 warnings generated.<br>
<br>
<br>
Will you be able to figure out why is one branch reached 4 times while the other branch is reached only once? You can find all your answers on the exploded graph dump.<br>
<br>
<br>
<div>On 7/28/20 5:59 AM, Denis Petrov via cfe-dev wrote:<br>
</div>
<blockquote type="cite">
<p>Hi, community!<br>
</p>
<p><br>
</p>
<p>A quick question.<br>
</p>
<p><br>
</p>
<p>Is CSA Core able to analyze the code after some indefinite loop?<br>
</p>
<p>E.g.<br>
</p>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">void f(int x)</span></span></span></span></div>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">{</span></span></span></span><br style="font-family:Consolas,monospace">
</span></div>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> int i = 0;</span></span></span></span><br style="font-family:Consolas,monospace">
</span></div>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> while(i < x)</span></span></span></span></div>
<div><span style="font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> i++;</span></span><br style="font-family:Consolas,monospace">
</span></div>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"> // Interested
in some code here!!</span></span></span></span><br style="font-family:Consolas,monospace">
</span></div>
<div><span style="font-family:Consolas,monospace;font-size:9pt"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace"><span style="font-family:Consolas,monospace">}</span></span></span></span><br>
</div>
<p><br>
</p>
<p>I found that Exploded graph grows going through the loop 4 times and then stops to analyze the code further.<br>
</p>
<p>P.S. I know about -<span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(255,255,255)">analyzer-max-loop</span>(4).<br>
</p>
<div id="m_-5033280035502893088gmail-m_-4775467890160906839Signature">
<div name="divtagdefaultwrapper">
<hr>
<div><b>Denys Petrov</b></div>
<div>Senior С++ Developer | Kharkiv, Ukraine</div>
<div><br>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
cfe-dev mailing list
<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" rel="noreferrer">cfe-dev@lists.llvm.org</a>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" target="_blank" rel="noreferrer">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br>
</div>
</div>
</div>
</div>
_______________________________________________<br>
cfe-dev mailing list<br>
<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" rel="noreferrer">cfe-dev@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div></div></div>