[cfe-dev] Proposal for statistic UncheckedReturnValue checker

[Ted Kremenek]

On Oct 25, 2010, at 7:25 PM, 章磊 wrote:

> Thanks very much for your reply.
> 
> The statistical checkers are more complicate than i thought. I think more background research is needed for me.
> 
> According to your words, i think we can separate statistical check to two steps: First begin a statistical check from analyzing a translation unit, and then move to the entire codebase.
> 
> It's something like what need in inter-procedural analysis and whole program analysis(inter-file analysis). But statistical check needs much less information than the latter(in statistical check we don't need function summary or serialized AST, right?), so maybe we need a mechanism independent of the "inter" analysis?
> 

In most cases the information for a statistical check can be acquired from doing intra-procedural analysis to sample the data (e.g., analyze functions individually and gather observations).  The problem is you just need to post-process all that data after analyzing a translation unit or an entire codebase.  So it isn't whole-program analysis in the traditional program analysis sense (e.g., using summary based analysis, etc.), just some data crunching afterwards.  Note that this kind of preprocessing doesn't have to be sophisticated.  Prototyping something is simple; just write a script that post-processes some data that you store on the side.  Integrating this completely into clang, however, is advantageous from an integration perspective (e.g., all error reporting goes through the same machinery).

One step I'm interested in taking the existing AnalysisConsumer and Checker objects is having Checker objects (potentially) live through the analysis of all functions (i.e., live through multiple instances of GRExprEngine).  Such checkers would then be able to accrue data across multiple functions, and then do the kind of analysis you are talking about.  This seems like a potentially essential step on the road to more sophisticated analyses, but the details are not fleshed out.