[cfe-dev] exhaustiveness of CSA checkers

[Gábor Horváth via cfe-dev]

Hi!

The clang static analyzer does not give you any guarantees regarding the
coverage/exhaustiveness. There is no way to ensure exhaustive analysis
(such analysis is likely to be unbounded for most non-trivial programs, so
this is not only about runtime, but also termination). For this reason all
the checks have to be implemented with non-exhaustiveness in mind.

Could you share what you are trying to achieve? Maybe symbolic execution is
not the right tool for that problem.

Cheers,
Gabor

On Wed, Jan 15, 2020 at 12:58 AM Fernandez, Matthew via cfe-dev <
cfe-dev at lists.llvm.org> wrote:

> Hello cfe-dev,
>
>
>
> In prototyping a custom checker for the Clang Static Analyzer, I’ve found
> analysis terminates at some complexity limit. That is, when your target
> function exceeds some complexity bound, CSA stops path traversal and your
> checker does not receive callbacks for any remaining unvisited nodes. The
> two specific scenarios where I’ve run into this are high-iteration-count
> loops and complex conditionals (multiple short circuiting && and ||
> operators). The first I can work around by rephrasing the target loops or
> something like -analyzer-max-loop, but I can’t find a way to affect the
> behavior of the second. To compound the situation, I cannot see how the
> checker can detect that path exploration was incomplete.
>
>
>
> Is there a way to control the complexity limit enforced for conditionals?
> Or, failing that, to detect within the checker when path exploration was
> incomplete?
>
>
>
> To give some more context, my checker is an experiment and not something I
> am intending to upstream. Runtime is not an issue; I am fine with the
> analyzer taking multiple hours for a single run. Though I understand why
> the existing CSA bound choices have been made, as most users do not want
> their compiler to run for this long.
>
>
>
> Please CC me in replies as I’m not subscribed.
>
>
>
> Thanks,
>
> Matthew
> _______________________________________________
> cfe-dev mailing list
> cfe-dev at lists.llvm.org
> https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20200115/a2e9de86/attachment-0001.html>