[prev in list] [next in list] [prev in thread] [next in thread]
List: cfe-dev
Subject: Re: [cfe-dev] getting visit methods right
From: Jordan Rose <jordan_rose () apple ! com>
Date: 2012-11-28 18:14:13
Message-ID: FC5F4EDD-3E3C-41EF-9A81-2748AEA92561 () apple ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
On Nov 27, 2012, at 19:28 , Rajendra <rks@cse.iitb.ac.in> wrote:
> Hi Jordon,
>
> Are you saying that using visitor methods of RecursiveASTVisitor is not correct way \
> for static analysis of conditions (if-else) and loops (while)? or not recommended?
That's correct. It's the difference between reading your program and running it.
> What about getting control flow information from successors of a basic block for \
> IfStmt, WhileStmt from CFGTerminator? I think this is the way basic blocks in CFG \
> keep information about control flow. Please correct me if this doesn't sound good.
Yes, that's what the CFG is for, and you can use that for flow-sensitive warnings \
(and we do). However, no path-sensitive information persists; that is, the CFG is \
perfectly happy to say you can go down both if-conditions here.
if (x > 1) {
foo();
}
if (x < 0) {
bar();
}
Again, AnalysisBasedWarnings has some very simple logic to do a little of this, but \
if you actually want to simulate program execution, that's what the static analyzer \
is for.
Best,
Jordan
> On 27-11-2012 11:09 PM, Jordan Rose wrote:
> > Write a static analyzer plugin instead.
> >
> > The RecursiveASTVisitor interface is for syntactic checking; it won't
> > be able to do a good job with propagating information forward with,
> > say, loops. If you're looking for a "fast" flow-sensitive analysis,
> > Sema's AnalysisBasedWarnings shows how it's done, but if you want more
> > precision in actually determining which paths are feasible, you're
> > going to need the full power of the static analyzer. You're basically
> > reinventing the entire analyzer core if you're trying to track the
> > flow of data from assignments to conditions and then to which branch
> > is taken.
> >
> > Unfortunately, the documentation on how to write a static analyzer
> > "checker" is still a bit limited, but you can find information at
> > http://clang-analyzer.llvm.org/checker_dev_manual.html and the slides
> > from our talk at the LLVM Develeopers' Meeting at
> > http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf
> >
> > Best,
> > Jordan
> >
> >
> > On Nov 27, 2012, at 1:24 , Rajendra <rks@cse.iitb.ac.in> wrote:
> >
> > > Any suggestion on this topic, please?
> > >
> > > - Rajendra
> > >
> > > On 26-11-2012 03:21 PM, Rajendra wrote:
> > > > Hi,
> > > >
> > > > I have overridden VisitIfStmt(Stmt* s) and some visit methods for
> > > > binary operators:
> > > > - VisitBinAssign(),
> > > > - VisitBinAdd() and other arithmetic operators,
> > > > - VisitBinGT() and other relational operators
> > > >
> > > > My dilemma is how do I return from different visit methods (or call
> > > > them explicitly)
> > > > so that I can perform some analysis on binary operators and use them
> > > > in condition part,
> > > > then clause and else clause for IfStmt? e.g. I want to analyze
> > > > following C program:
> > > > int main() {
> > > > int x, y;
> > > > x = 10;
> > > > if (x > 0)
> > > > y = 1;
> > > > else if (x == 0)
> > > > y = 0;
> > > > else
> > > > y = -1;
> > > > return 0;
> > > > }
> > > >
> > > > Basic block contains:
> > > > 1: int x;
> > > > 2: int y;
> > > > 3: x = 10
> > > > 4: x > 0
> > > > T: if [B6.4]
> > > >
> > > > Now, for condition x > 0 (line 3:) due to VisitBinGT() can get
> > > > following info:
> > > > Relational Op >
> > > > LHS identifier = x
> > > > type: int
> > > > RHS value: 0
> > > > From VisitIfStmt() I can get pointer to condition part, then and else
> > > > clauses.
> > > > so, how should I combine IfStmt and information I have due to visit
> > > > to other methods?
> > > >
> > > > Please advise.
> > > >
> > > > - Rajendra
> > >
> > > _______________________________________________
> > > cfe-dev mailing list
> > > cfe-dev@cs.uiuc.edu
> > > http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev
>
[Attachment #5 (text/html)]
<html><head><meta http-equiv="Content-Type" content="text/html \
charset=us-ascii"><meta http-equiv="Content-Type" content="text/html \
charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: \
space; -webkit-line-break: after-white-space; "><br><div><div>On Nov 27, 2012, at \
19:28 , Rajendra <<a href="mailto:rks@cse.iitb.ac.in">rks@cse.iitb.ac.in</a>> \
wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi \
Jordon,<br><br>Are you saying that using visitor methods of RecursiveASTVisitor is \
not correct way for static analysis of conditions (if-else) and loops (while)? or not \
recommended?<br></blockquote><div><br></div><div>That's correct. It's the difference \
between <i>reading</i> your program and \
<i>running</i> it.</div><div><br></div><br><blockquote type="cite">What about \
getting control flow information from successors of a basic block for IfStmt, \
WhileStmt from CFGTerminator? I think this is the way basic blocks in CFG keep \
information about control flow. Please correct me if this doesn't sound \
good.<br></blockquote><div><br></div><div>Yes, that's what the CFG is for, and you \
can use that for flow-sensitive warnings (and we do). However, no path-sensitive \
information persists; that is, the CFG is perfectly happy to say you can go down both \
if-conditions here.</div><div><br></div><div>if (x > 1) {</div><div> \
foo();</div><div>}</div><div>if (x < 0) {</div><div> \
bar();</div><div>}</div><div><br></div><div>Again, AnalysisBasedWarnings has some \
very simple logic to do a <i>little</i> of this, but if you actually want to \
simulate program execution, that's what the static analyzer is \
for.</div><div><br></div><div>Best,</div><div>Jordan</div><div><br></div><br><blockquote \
type="cite">On 27-11-2012 11:09 PM, Jordan Rose wrote:<br><blockquote \
type="cite">Write a static analyzer plugin instead.<br><br>The RecursiveASTVisitor \
interface is for syntactic checking; it won't<br>be able to do a good job with \
propagating information forward with,<br>say, loops. If you're looking for a "fast" \
flow-sensitive analysis,<br>Sema's AnalysisBasedWarnings shows how it's done, but if \
you want more<br>precision in actually determining which paths are feasible, \
you're<br>going to need the full power of the static analyzer. You're \
basically<br>reinventing the entire analyzer core if you're trying to track \
the<br>flow of data from assignments to conditions and then to which branch<br>is \
taken.<br><br>Unfortunately, the documentation on how to write a static \
analyzer<br>"checker" is still a bit limited, but you can find information at<br><a \
href="http://clang-analyzer.llvm.org/checker_dev_manual.html">http://clang-analyzer.llvm.org/checker_dev_manual.html</a> \
and the slides<br>from our talk at the LLVM Develeopers' Meeting at<br><a \
href="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">http://llvm.org/dev \
mtg/2012-11/Zaks-Rose-Checker24Hours.pdf</a><br><br>Best,<br>Jordan<br><br><br>On Nov \
27, 2012, at 1:24 , Rajendra <<a \
href="mailto:rks@cse.iitb.ac.in">rks@cse.iitb.ac.in</a>> wrote:<br><br><blockquote \
type="cite">Any suggestion on this topic, please?<br><br>- Rajendra<br><br>On \
26-11-2012 03:21 PM, Rajendra wrote:<br><blockquote type="cite">Hi,<br><br>I have \
overridden VisitIfStmt(Stmt* s) and some visit methods for<br>binary operators:<br>- \
VisitBinAssign(),<br>- VisitBinAdd() and other arithmetic operators,<br>- \
VisitBinGT() and other relational operators<br><br>My dilemma is how do I return from \
different visit methods (or call<br>them explicitly)<br>so that I can perform some \
analysis on binary operators and use them<br>in condition part,<br>then clause and \
else clause for IfStmt? e.g. I want to analyze<br>following C program:<br>int \
main() {<br> int x, y;<br> x = 10;<br> if (x > \
0)<br> y = 1;<br> else if (x == \
0)<br> y = 0;<br> else<br> \
y = -1;<br> return \
0;<br>}<br><br>Basic block contains:<br> 1: int x;<br> 2: int y;<br> \
3: x = 10<br> 4: x > 0<br> T: if [B6.4]<br><br>Now, for \
condition x > 0 (line 3:) due to VisitBinGT() can get<br>following info:<br> \
Relational Op ><br> \
LHS identifier = x<br> \
type: int<br> \
RHS value: 0<br>From VisitIfStmt() I can get \
pointer to condition part, then and else<br>clauses.<br>so, how should I combine \
IfStmt and information I have due to visit<br>to other methods?<br><br>Please \
advise.<br><br>- Rajendra<br></blockquote><br>_______________________________________________<br>cfe-dev \
mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http:/ \
/lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></blockquote><br></blockquote></div><br></body></html>
_______________________________________________
cfe-dev mailing list
cfe-dev@cs.uiuc.edu
http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic