[all-commits] [llvm/llvm-project] 78f97e: [analyzer] Limit `isTainted()` by skipping complic...

[Balazs Benics via All-commits]

  Branch: refs/heads/release/19.x
  Home:   https://github.com/llvm/llvm-project
  Commit: 78f97e22e5d87f9efc6b2c0ec76f60667458ca8a
      https://github.com/llvm/llvm-project/commit/78f97e22e5d87f9efc6b2c0ec76f60667458ca8a
  Author: Balazs Benics <benicsbalazs at gmail.com>
  Date:   2024-09-01 (Sun, 01 Sep 2024)

  Changed paths:
    M clang/docs/ReleaseNotes.rst
    M clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def
    M clang/lib/StaticAnalyzer/Checkers/Taint.cpp
    M clang/test/Analysis/analyzer-config.c
    M clang/test/Analysis/taint-generic.c

  Log Message:
  -----------
  [analyzer] Limit `isTainted()` by skipping complicated symbols (#105493)

As discussed in

https://discourse.llvm.org/t/rfc-make-istainted-and-complex-symbols-friends/79570/10

Some `isTainted()` queries can blow up the analysis times, and
effectively halt the analysis under specific workloads.

We don't really have the time now to do a caching re-implementation of
`isTainted()`, so we need to workaround the case.

The workaround with the smallest blast radius was to limit what symbols
`isTainted()` does the query (by walking the SymExpr). So far, the
threshold 10 worked for us, but this value can be overridden using the
"max-tainted-symbol-complexity" config value.

This new option is "deprecated" from the getgo, as I expect this issue
to be fixed within the next few months and I don't want users to
override this value anyways. If they do, this message will let them know
that they are on their own, and the next release may break them (as we
no longer recognize this option if we drop it).

Mitigates #89720

CPP-5414

(cherry picked from commit 848658955a9d2d42ea3e319d191e2dcd5d76c837)



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications