[cfe-dev] [analyzer] Summary IPA thoughts +code
Artem Dergachev via cfe-dev
cfe-dev at lists.llvm.org
Mon Oct 26 08:31:39 PDT 2015
We've published a snapshot of one of our development branches, which
contains the Summary IPA prototype preview. As we mentioned, there are a
lot of problems with it, including,
- it's branched from clang-3.4,
- it includes quite a bit of unrelated changes, including our
inter-unit draft, in a single blob;
so even though it's in no way ready for any sort of review, i guess it
could help a bit as a temporary reference in discussing issues.
We deeply apologize for the mess; of course the code will be changed
significantly if/once we decide to put it on actual review for accepting
into the base clang repo, but at least we got it at least somehow
working and got a chance to make properly :)
The github branch with a single blob for everything is at:
=== Places to look at, with necessary pre-cautions :) ===
Most of the calling bureaucracy is coded there, such as storing
summaries, creating auxiliary ExprEngine's for constructing
ExplodedGraphs for summaries, etc.
These files include the alpha-renaming stuff (the "Summarizer"
object and its "compose***()" methods), and the procedure of applying
the summary ("CallFunction()"). The latter includes summary-apply
procedures for store bindings (TODO - move to ***StoreManager.cpp, fix
the necessary abstractions, fix HandleBinding() accordingly), return
values, and calling checkers. TODO - the procedure for alpha-renaming
CXXTempObjectRegion will be fixed, do not look there yet :)
The procedure of applying the summary for range constraints, which
includes finding pre-conditions for the summary and handling unreachable
The two checkers, with necessary modifications for running under
summary IPA, which were used for gathering experimental data. The
IntegerOverflow checker was also discussed in
http://reviews.llvm.org/D4066 , authored by Julia Trofimovich, another
colleague of ours, and the ConstModified checker was created by Alexey,
also corresponding to one of the items in the list of potential checkers.
Some fancy tests which we pass. They don't cover everything (TODO -
we'd have to cover most of the paths during the refactoring, of course),
but these tests already have some fancy examples we had to dig through.
More information about the cfe-dev