1//===-- AnalyzerOptions.def - Metadata about Static Analyses ----*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines the analyzer options avaible with -analyzer-config.
10//
11//===----------------------------------------------------------------------===//
12
13#ifndef LLVM_ADT_STRINGREF_H
14#error This .def file is expected to be included in translation units where \
15"llvm/ADT/StringRef.h" is already included!
16#endif
17
18#ifdef ANALYZER_OPTION
19#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE
20#error If you didnt include this file with the intent of generating methods, \
21define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros!
22#endif
23#endif
24
25#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE
26#ifdef ANALYZER_OPTION
27#error If you didnt include this file with the intent of generating methods, \
28define both 'ANALYZER_OPTION' and 'ANALYZER_OPTION_DEPENDS_ON_USER_MODE' macros!
29#endif
30#endif
31
32#ifndef ANALYZER_OPTION
33/// Create a new analyzer option, but dont generate a method for it in
34/// AnalyzerOptions.
35///
36/// TYPE - The type of the option object that will be stored in
37/// AnalyzerOptions. This file is expected to be icluded in translation
38/// units where AnalyzerOptions.h is included, so types from that
39/// header should be used.
40/// NAME - The name of the option object.
41/// CMDFLAG - The command line flag for the option.
42/// (-analyzer-config CMDFLAG=VALUE)
43/// DESC - Description of the flag.
44/// DEFAULT_VAL - The default value for CMDFLAG.
45#define ANALYZER_OPTION(TYPE, NAME, CMDFLAG, DESC, DEFAULT_VAL)
46#endif
47
48#ifndef ANALYZER_OPTION_DEPENDS_ON_USER_MODE
49/// Create a new analyzer option, but dont generate a method for it in
50/// AnalyzerOptions. It's value depends on the option "user-mode".
51///
52/// TYPE - The type of the option object that will be stored in
53/// AnalyzerOptions. This file is expected to be icluded in translation
54/// units where AnalyzerOptions.h is included, so types from that
55/// header should be used.
56/// NAME - The name of the option object.
57/// CMDFLAG - The command line flag for the option.
58/// (-analyzer-config CMDFLAG=VALUE)
59/// DESC - Description of the flag.
60/// SHALLOW_VAL - The default value for CMDFLAG, when "user-mode" was set to
61/// "shallow".
62/// DEEP_VAL - The default value for CMDFLAG, when "user-mode" was set to
63/// "deep".
64#define ANALYZER_OPTION_DEPENDS_ON_USER_MODE(TYPE, NAME, CMDFLAG, DESC, \
65 SHALLOW_VAL, DEEP_VAL)
66#endif
67
68//===----------------------------------------------------------------------===//
69// The "mode" option. Since some options depend on this, we list it on top of
70// this file in order to make sure that the generated field for it is
71// initialized before the rest.
72//===----------------------------------------------------------------------===//
73
74ANALYZER_OPTION(
75 StringRef, UserMode, "mode",
76 "(string) Controls the high-level analyzer mode, which influences the "
77 "default settings for some of the lower-level config options (such as "
78 "IPAMode). Value: \"deep\", \"shallow\".",
79 "deep")
80
81//===----------------------------------------------------------------------===//
82// Boolean analyzer options.
83//===----------------------------------------------------------------------===//
84
85ANALYZER_OPTION(bool, ShouldIncludeImplicitDtorsInCFG, "cfg-implicit-dtors",
86 "Whether or not implicit destructors for C++ objects "
87 "should be included in the CFG.",
88 true)
89
90ANALYZER_OPTION(bool, ShouldIncludeTemporaryDtorsInCFG, "cfg-temporary-dtors",
91 "Whether or not the destructors for C++ temporary "
92 "objects should be included in the CFG.",
93 true)
94
95ANALYZER_OPTION(
96 bool, ShouldIncludeLifetimeInCFG, "cfg-lifetime",
97 "Whether or not end-of-lifetime information should be included in the CFG.",
98 false)
99
100ANALYZER_OPTION(bool, ShouldIncludeLoopExitInCFG, "cfg-loopexit",
101 "Whether or not the end of the loop information should "
102 "be included in the CFG.",
103 false)
104
105ANALYZER_OPTION(bool, ShouldIncludeRichConstructorsInCFG,
106 "cfg-rich-constructors",
107 "Whether or not construction site information should be "
108 "included in the CFG C++ constructor elements.",
109 true)
110
111ANALYZER_OPTION(
112 bool, ShouldIncludeScopesInCFG, "cfg-scopes",
113 "Whether or not scope information should be included in the CFG.", false)
114
115ANALYZER_OPTION(bool, ShouldIncludeDefaultInitForAggregates,
116 "cfg-expand-default-aggr-inits",
117 "Whether or not inline CXXDefaultInitializers for aggregate "
118 "initialization in the CFG.",
119 false)
120
121ANALYZER_OPTION(
122 bool, MayInlineTemplateFunctions, "c++-template-inlining",
123 "Whether or not templated functions may be considered for inlining.", true)
124
125ANALYZER_OPTION(bool, MayInlineCXXStandardLibrary, "c++-stdlib-inlining",
126 "Whether or not C++ standard library functions may be "
127 "considered for inlining.",
128 true)
129
130ANALYZER_OPTION(bool, MayInlineCXXAllocator, "c++-allocator-inlining",
131 "Whether or not allocator call may be considered for inlining.",
132 true)
133
134ANALYZER_OPTION(
135 bool, MayInlineCXXSharedPtrDtor, "c++-shared_ptr-inlining",
136 "Whether or not the destructor of C++ 'shared_ptr' may be considered for "
137 "inlining. This covers std::shared_ptr, std::tr1::shared_ptr, and "
138 "boost::shared_ptr, and indeed any destructor named '~shared_ptr'.",
139 false)
140
141ANALYZER_OPTION(bool, MayInlineCXXTemporaryDtors, "c++-temp-dtor-inlining",
142 "Whether C++ temporary destructors should be inlined "
143 "during analysis. If temporary destructors are disabled "
144 "in the CFG via the 'cfg-temporary-dtors' option, "
145 "temporary destructors would not be inlined anyway.",
146 true)
147
148ANALYZER_OPTION(
149 bool, ShouldSuppressNullReturnPaths, "suppress-null-return-paths",
150 "Whether or not paths that go through null returns should be suppressed. "
151 "This is a heuristic for avoiding bug reports with paths that go through "
152 "inlined functions that are more defensive than their callers.",
153 true)
154
155ANALYZER_OPTION(
156 bool, ShouldAvoidSuppressingNullArgumentPaths,
157 "avoid-suppressing-null-argument-paths",
158 "Whether a bug report should not be suppressed if its path includes a call "
159 "with a null argument, even if that call has a null return. This option "
160 "has no effect when ShouldSuppressNullReturnPaths is false. This is a "
161 "counter-heuristic to avoid false negatives.",
162 false)
163
164ANALYZER_OPTION(bool, ShouldSuppressInlinedDefensiveChecks,
165 "suppress-inlined-defensive-checks",
166 "Whether or not diagnostics containing inlined "
167 "defensive NULL checks should be suppressed.",
168 true)
169
170ANALYZER_OPTION(bool, MayInlineCXXContainerMethods, "c++-container-inlining",
171 "Whether or not methods of C++ container objects may be "
172 "considered for inlining.",
173 false)
174
175ANALYZER_OPTION(bool, ShouldSuppressFromCXXStandardLibrary,
176 "suppress-c++-stdlib",
177 "Whether or not diagnostics reported within the C++ "
178 "standard library should be suppressed.",
179 true)
180
181ANALYZER_OPTION(bool, ShouldCrosscheckWithZ3, "crosscheck-with-z3",
182 "Whether bug reports should be crosschecked with the Z3 "
183 "constraint manager backend.",
184 false)
185
186ANALYZER_OPTION(bool, ShouldReportIssuesInMainSourceFile,
187 "report-in-main-source-file",
188 "Whether or not the diagnostic report should be always "
189 "reported in the main source file and not the headers.",
190 false)
191
192ANALYZER_OPTION(bool, ShouldWriteStableReportFilename, "stable-report-filename",
193 "Whether or not the report filename should be random or not.",
194 false)
195
196ANALYZER_OPTION(
197 bool, ShouldSerializeStats, "serialize-stats",
198 "Whether the analyzer should serialize statistics to plist output. "
199 "Statistics would be serialized in JSON format inside the main dictionary "
200 "under the statistics key. Available only if compiled in assert mode or "
201 "with LLVM statistics explicitly enabled.",
202 false)
203
204ANALYZER_OPTION(bool, MayInlineObjCMethod, "objc-inlining",
205 "Whether ObjectiveC inlining is enabled, false otherwise.",
206 true)
207
208ANALYZER_OPTION(bool, ShouldPrunePaths, "prune-paths",
209 "Whether irrelevant parts of a bug report path should "
210 "be pruned out of the final output.",
211 true)
212
213ANALYZER_OPTION(bool, ShouldAddPopUpNotes, "add-pop-up-notes",
214 "Whether pop-up notes should be added to the final output.",
215 true)
216
217ANALYZER_OPTION(
218 bool, ShouldConditionalizeStaticInitializers,
219 "cfg-conditional-static-initializers",
220 "Whether 'static' initializers should be in conditional logic in the CFG.",
221 true)
222
223ANALYZER_OPTION(bool, ShouldSynthesizeBodies, "faux-bodies",
224 "Whether the analyzer engine should synthesize fake "
225 "bodies for well-known functions.",
226 true)
227
228ANALYZER_OPTION(
229 bool, ShouldElideConstructors, "elide-constructors",
230 "Whether elidable C++ copy-constructors and move-constructors should be "
231 "actually elided during analysis. Both behaviors are allowed by the C++ "
232 "standard, and the analyzer, like CodeGen, defaults to eliding. Starting "
233 "with C++17 some elisions become mandatory, and in these cases the option "
234 "will be ignored.",
235 true)
236
237ANALYZER_OPTION(
238 bool, ShouldInlineLambdas, "inline-lambdas",
239 "Whether lambdas should be inlined. Otherwise a sink node will be "
240 "generated each time a LambdaExpr is visited.",
241 true)
242
243ANALYZER_OPTION(bool, ShouldWidenLoops, "widen-loops",
244 "Whether the analysis should try to widen loops.", false)
245
246ANALYZER_OPTION(
247 bool, ShouldUnrollLoops, "unroll-loops",
248 "Whether the analysis should try to unroll loops with known bounds.", false)
249
250ANALYZER_OPTION(
251 bool, ShouldDisplayNotesAsEvents, "notes-as-events",
252 "Whether the bug reporter should transparently treat extra note diagnostic "
253 "pieces as event diagnostic pieces. Useful when the diagnostic consumer "
254 "doesn't support the extra note pieces.",
255 false)
256
257ANALYZER_OPTION(
258 bool, ShouldAggressivelySimplifyBinaryOperation,
259 "aggressive-binary-operation-simplification",
260 "Whether SValBuilder should rearrange comparisons and additive operations "
261 "of symbolic expressions which consist of a sum of a symbol and a concrete "
262 "integer into the format where symbols are on the left-hand side and the "
263 "integer is on the right. This is only done if both symbols and both "
264 "concrete integers are signed, greater than or equal to the quarter of the "
265 "minimum value of the type and less than or equal to the quarter of the "
266 "maximum value of that type. A + n <OP> B + m becomes A - B <OP> m - n, "
267 "where A and B symbolic, n and m are integers. <OP> is any of '==', '!=', "
268 "'<', '<=', '>', '>=', '+' or '-'. The rearrangement also happens with '-' "
269 "instead of '+' on either or both side and also if any or both integers "
270 "are missing.",
271 false)
272
273ANALYZER_OPTION(
274 bool, ShouldEagerlyAssume, "eagerly-assume",
275 "Whether we should eagerly assume evaluations of conditionals, thus, "
276 "bifurcating the path. This indicates how the engine should handle "
277 "expressions such as: 'x = (y != 0)'. When this is true then the "
278 "subexpression 'y != 0' will be eagerly assumed to be true or false, thus "
279 "evaluating it to the integers 0 or 1 respectively. The upside is that "
280 "this can increase analysis precision until we have a better way to lazily "
281 "evaluate such logic. The downside is that it eagerly bifurcates paths.",
282 true)
283
284ANALYZER_OPTION(
285 bool, IsNaiveCTUEnabled, "experimental-enable-naive-ctu-analysis",
286 "Whether naive cross translation unit analysis is enabled. This is an "
287 "experimental feature to inline functions from other translation units.",
288 false)
289
290ANALYZER_OPTION(bool, ShouldDisplayMacroExpansions, "expand-macros",
291 "Whether macros related to the bugpath should be "
292 "expanded and included in the plist output.",
293 false)
294
295ANALYZER_OPTION(bool, DisplayCTUProgress, "display-ctu-progress",
296 "Whether to emit verbose output about "
297 "the analyzer's progress related to ctu.",
298 false)
299
300ANALYZER_OPTION(bool, ShouldTrackConditions, "track-conditions",
301 "Whether to track conditions that are a control dependency of "
302 "an already tracked variable.",
303 true)
304
305ANALYZER_OPTION(bool, ShouldTrackConditionsDebug, "track-conditions-debug",
306 "Whether to place an event at each tracked condition.",
307 false)
308
309ANALYZER_OPTION(bool, ShouldApplyFixIts, "apply-fixits",
310 "Apply the fix-it hints to the files",
311 false)
312
313ANALYZER_OPTION(bool, ShouldDisplayCheckerNameForText, "display-checker-name",
314 "Display the checker name for textual outputs",
315 true)
316
317//===----------------------------------------------------------------------===//
318// Unsigned analyzer options.
319//===----------------------------------------------------------------------===//
320
321ANALYZER_OPTION(unsigned, CTUImportThreshold, "ctu-import-threshold",
322 "The maximal amount of translation units that is considered "
323 "for import when inlining functions during CTU analysis. "
324 "Lowering this threshold can alleviate the memory burden of "
325 "analysis with many interdependent definitions located in "
326 "various translation units. This is valid only for non C++ "
327 "source files.",
328 24u)
329
330ANALYZER_OPTION(unsigned, CTUImportCppThreshold, "ctu-import-cpp-threshold",
331 "The maximal amount of translation units that is considered "
332 "for import when inlining functions during CTU analysis of C++ "
333 "source files.",
334 8u)
335
336ANALYZER_OPTION(
337 unsigned, AlwaysInlineSize, "ipa-always-inline-size",
338 "The size of the functions (in basic blocks), which should be considered "
339 "to be small enough to always inline.",
340 3)
341
342ANALYZER_OPTION(
343 unsigned, GraphTrimInterval, "graph-trim-interval",
344 "How often nodes in the ExplodedGraph should be recycled to save memory. "
345 "To disable node reclamation, set the option to 0.",
346 1000)
347
348ANALYZER_OPTION(
349 unsigned, MinCFGSizeTreatFunctionsAsLarge,
350 "min-cfg-size-treat-functions-as-large",
351 "The number of basic blocks a function needs to have to be considered "
352 "large for the 'max-times-inline-large' config option.",
353 14)
354
355ANALYZER_OPTION(unsigned, MaxSymbolComplexity, "max-symbol-complexity",
356 "The maximum complexity of symbolic constraint.", 35)
357
358ANALYZER_OPTION(unsigned, MaxTimesInlineLarge, "max-times-inline-large",
359 "The maximum times a large function could be inlined.", 32)
360
361ANALYZER_OPTION_DEPENDS_ON_USER_MODE(
362 unsigned, MaxInlinableSize, "max-inlinable-size",
363 "The bound on the number of basic blocks in an inlined function.",
364 /* SHALLOW_VAL */ 4, /* DEEP_VAL */ 100)
365
366ANALYZER_OPTION_DEPENDS_ON_USER_MODE(
367 unsigned, MaxNodesPerTopLevelFunction, "max-nodes",
368 "The maximum number of nodes the analyzer can generate while exploring a "
369 "top level function (for each exploded graph). 0 means no limit.",
370 /* SHALLOW_VAL */ 75000, /* DEEP_VAL */ 225000)
371
372ANALYZER_OPTION(
373 unsigned, RegionStoreSmallStructLimit, "region-store-small-struct-limit",
374 "The largest number of fields a struct can have and still be considered "
375 "small This is currently used to decide whether or not it is worth forcing "
376 "a LazyCompoundVal on bind. To disable all small-struct-dependent "
377 "behavior, set the option to 0.",
378 2)
379
380//===----------------------------------------------------------------------===//
381// String analyzer options.
382//===----------------------------------------------------------------------===//
383
384ANALYZER_OPTION(StringRef, CTUDir, "ctu-dir",
385 "The directory containing the CTU related files.", "")
386
387ANALYZER_OPTION(StringRef, CTUIndexName, "ctu-index-name",
388 "The name of the file containing the CTU index of definitions. "
389 "The index file maps USR-names to identifiers. An identifier "
390 "can end with an '.ast' suffix, indicating the indentifier is "
391 "a path to a pch-dump. Otherwise the identifier is regarded as "
392 "path to a source file which is parsed on-demand. Relative "
393 "paths are prefixed with ctu-dir, absolute paths are used "
394 "unmodified during lookup.",
395 "externalDefMap.txt")
396
397ANALYZER_OPTION(
398 StringRef, CTUInvocationList, "ctu-invocation-list",
399 "The path to the YAML format file containing a mapping from source file "
400 "paths to command-line invocations represented as a list of arguments. "
401 "This invocation is used produce the source-file's AST in case on-demand "
402 "loading is performed. Example file-content: "
403 "{/main.cpp: [clang++, /main.cpp], other.cpp: [clang++, /other.cpp]}",
404 "invocations.yaml")
405
406ANALYZER_OPTION(
407 StringRef, ModelPath, "model-path",
408 "The analyzer can inline an alternative implementation written in C at the "
409 "call site if the called function's body is not available. This is a path "
410 "where to look for those alternative implementations (called models).",
411 "")
412
413ANALYZER_OPTION(
414 StringRef, CXXMemberInliningMode, "c++-inlining",
415 "Controls which C++ member functions will be considered for inlining. "
416 "Value: \"constructors\", \"destructors\", \"methods\".",
417 "destructors")
418
419ANALYZER_OPTION(
420 StringRef, ExplorationStrategy, "exploration_strategy",
421 "Value: \"dfs\", \"bfs\", \"unexplored_first\", "
422 "\"unexplored_first_queue\", \"unexplored_first_location_queue\", "
423 "\"bfs_block_dfs_contents\".",
424 "unexplored_first_queue")
425
426ANALYZER_OPTION(
427 StringRef, RawSilencedCheckersAndPackages, "silence-checkers",
428 "A semicolon separated list of checker and package names to silence. "
429 "Silenced checkers will not emit reports, but the modeling remain enabled.",
430 "")
431
432ANALYZER_OPTION_DEPENDS_ON_USER_MODE(
433 StringRef, IPAMode, "ipa",
434 "Controls the mode of inter-procedural analysis. Value: \"none\", "
435 "\"basic-inlining\", \"inlining\", \"dynamic\", \"dynamic-bifurcate\".",
436 /* SHALLOW_VAL */ "inlining", /* DEEP_VAL */ "dynamic-bifurcate")
437
438#undef ANALYZER_OPTION_DEPENDS_ON_USER_MODE
439#undef ANALYZER_OPTION
440