@@ -3,33 +3,14 @@ Cross Translation Unit (CTU) Analysis
3
3
=====================================
4
4
5
5
Normally, static analysis works in the boundary of one translation unit (TU).
6
- However, with additional steps and configuration we can enable the analysis to inline the definition of a function from
7
- another TU.
6
+ However, with additional steps and configuration we can enable the analysis to inline the definition of a function from another TU.
8
7
9
8
.. contents ::
10
9
:local:
11
10
12
- Overview
13
- ________
14
- CTU analysis can be used in a variety of ways. The importing of external TU definitions can work with pre-dumped PCH
15
- files or generating the necessary AST structure on-demand, during the analysis of the main TU. Driving the static
16
- analysis can also be implemented in multiple ways. The most direct way is to specify the necessary commandline options
17
- of the Clang frontend manually (and generate the prerequisite dependencies of the specific import method by hand). This
18
- process can be automated by other tools, like `CodeChecker <https://github.com/Ericsson/codechecker >`_ and scan-build-py
19
- (preference for the former).
20
-
21
- PCH-based analysis
22
- __________________
23
- The analysis needs the PCH dumps of all the translations units used in the project.
24
- These can be generated by the Clang Frontend itself, and must be arranged in a specific way in the filesystem.
25
- The index, which maps symbols' USR names to PCH dumps containing them must also be generated by the
26
- `clang-extdef-mapping `. This tool uses a :doc: `compilation database <../../JSONCompilationDatabase >` to
27
- determine the compilation flags used.
28
- The analysis invocation must be provided with the directory which contains the dumps and the mapping files.
29
-
30
-
31
11
Manual CTU Analysis
32
- ###################
12
+ -------------------
13
+
33
14
Let's consider these source files in our minimal example:
34
15
35
16
.. code-block :: cpp
@@ -66,8 +47,7 @@ And a compilation database:
66
47
]
67
48
68
49
We'd like to analyze `main.cpp ` and discover the division by zero bug.
69
- In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file
70
- of `foo.cpp `:
50
+ In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file of `foo.cpp `:
71
51
72
52
.. code-block :: bash
73
53
@@ -78,8 +58,7 @@ of `foo.cpp`:
78
58
compile_commands.json foo.cpp.ast foo.cpp main.cpp
79
59
$
80
60
81
- The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the
82
- source files:
61
+ The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the source files:
83
62
84
63
.. code-block :: bash
85
64
@@ -106,34 +85,47 @@ We have to feed Clang with CTU specific extra arguments:
106
85
107
86
$ pwd
108
87
/path/to/your/project
109
- $ clang++ --analyze \
110
- -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
111
- -Xclang -analyzer-config -Xclang ctu-dir=. \
112
- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=false \
113
- -Xclang -analyzer-output=plist-multi-file \
114
- main.cpp
88
+ $ clang++ --analyze -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true -Xclang -analyzer-config -Xclang ctu-dir=. -Xclang -analyzer-output=plist-multi-file main.cpp
115
89
main.cpp:5:12: warning: Division by zero
116
90
return 3 / foo ();
117
91
~ ~^~~~~~~
118
92
1 warning generated.
119
93
$ # The plist file with the result is generated.
120
- $ ls -F
94
+ $ ls
121
95
compile_commands.json externalDefMap.txt foo.ast foo.cpp foo.cpp.ast main.cpp main.plist
122
96
$
123
97
124
- This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
125
- `CodeChecker ` or `scan-build-py `.
98
+ This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use `CodeChecker ` or `scan-build-py `.
126
99
127
100
Automated CTU Analysis with CodeChecker
128
- #######################################
101
+ ---------------------------------------
129
102
The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
130
103
Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
131
104
132
105
.. code-block :: bash
133
106
134
107
$ CodeChecker analyze --ctu compile_commands.json -o reports
135
- $ ls -F
136
- compile_commands.json foo.cpp foo.cpp.ast main.cpp reports/
108
+ [INFO 2019-07-16 17:21] - Pre-analysis started.
109
+ [INFO 2019-07-16 17:21] - Collecting data for ctu analysis.
110
+ [INFO 2019-07-16 17:21] - [1/2] foo.cpp
111
+ [INFO 2019-07-16 17:21] - [2/2] main.cpp
112
+ [INFO 2019-07-16 17:21] - Pre-analysis finished.
113
+ [INFO 2019-07-16 17:21] - Starting static analysis ...
114
+ [INFO 2019-07-16 17:21] - [1/2] clangsa analyzed foo.cpp successfully.
115
+ [INFO 2019-07-16 17:21] - [2/2] clangsa analyzed main.cpp successfully.
116
+ [INFO 2019-07-16 17:21] - ----==== Summary ====----
117
+ [INFO 2019-07-16 17:21] - Successfully analyzed
118
+ [INFO 2019-07-16 17:21] - clangsa: 2
119
+ [INFO 2019-07-16 17:21] - Total analyzed compilation commands: 2
120
+ [INFO 2019-07-16 17:21] - ----=================----
121
+ [INFO 2019-07-16 17:21] - Analysis finished.
122
+ [INFO 2019-07-16 17:21] - To view results in the terminal use the " CodeChecker parse" command.
123
+ [INFO 2019-07-16 17:21] - To store results use the " CodeChecker store" command.
124
+ [INFO 2019-07-16 17:21] - See --help and the user guide for further options about parsing and storing the reports.
125
+ [INFO 2019-07-16 17:21] - ----=================----
126
+ [INFO 2019-07-16 17:21] - Analysis length: 0.659618854523 sec.
127
+ $ ls
128
+ compile_commands.json foo.cpp foo.cpp.ast main.cpp reports
137
129
$ tree reports
138
130
reports
139
131
├── compile_cmd.json
@@ -182,9 +174,9 @@ Or we can use `CodeChecker parse -e html` to export the results into HTML format
182
174
$ firefox html_out/index.html
183
175
184
176
Automated CTU Analysis with scan-build-py (don't do it)
185
- #############################################################
186
- We actively develop CTU with CodeChecker as the driver for this feature , `scan-build-py ` is not actively developed for CTU.
187
- `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
177
+ -------------------------------------------------------
178
+ We actively develop CTU with CodeChecker as a "runner" script , `scan-build-py ` is not actively developed for CTU.
179
+ `scan-build-py ` has various errors and issues, expect it to work with the very basic projects only.
188
180
189
181
Example usage of scan-build-py:
190
182
@@ -199,154 +191,3 @@ Example usage of scan-build-py:
199
191
Opening in existing browser session.
200
192
^C
201
193
$
202
-
203
- On-demand analysis
204
- __________________
205
- The analysis produces the necessary AST structure of external TUs during analysis. This requires the
206
- compilation database in order to determine the exact compiler invocation used for each TU.
207
- The index, which maps function USR names to source files containing them must also be generated by the
208
- `clang-extdef-mapping `. The mapping of external definitions implicitly uses a
209
- :doc: `compilation database <../../JSONCompilationDatabase >` to determine the compilation flags used.
210
- Preferably the same compilation database should be used when generating the external definitions, and
211
- during analysis. The analysis invocation must be provided with the directory which contains the mapping
212
- files, and the compilation database which is used to determine compiler flags.
213
-
214
-
215
- Manual CTU Analysis
216
- ###################
217
-
218
- Let's consider these source files in our minimal example:
219
-
220
- .. code-block :: cpp
221
-
222
- // main.cpp
223
- int foo();
224
-
225
- int main() {
226
- return 3 / foo();
227
- }
228
-
229
- .. code-block :: cpp
230
-
231
- // foo.cpp
232
- int foo() {
233
- return 0;
234
- }
235
-
236
- And a compilation database:
237
-
238
- .. code-block :: bash
239
-
240
- [
241
- {
242
- " directory" : " /path/to/your/project" ,
243
- " command" : " clang++ -c foo.cpp -o foo.o" ,
244
- " file" : " foo.cpp"
245
- },
246
- {
247
- " directory" : " /path/to/your/project" ,
248
- " command" : " clang++ -c main.cpp -o main.o" ,
249
- " file" : " main.cpp"
250
- }
251
- ]
252
-
253
- We'd like to analyze `main.cpp ` and discover the division by zero bug.
254
- As we are using On-demand mode, we only need to create a CTU index file which holds the `USR ` name and location of
255
- external definitions in the source files:
256
-
257
- .. code-block :: bash
258
-
259
- $ clang-extdef-mapping -p . foo.cpp
260
- c:@F@foo# /path/to/your/project/foo.cpp
261
- $ clang-extdef-mapping -p . foo.cpp > externalDefMap.txt
262
-
263
- Now everything is available for the CTU analysis.
264
- We have to feed Clang with CTU specific extra arguments:
265
-
266
- .. code-block :: bash
267
-
268
- $ pwd
269
- /path/to/your/project
270
- $ clang++ --analyze \
271
- -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
272
- -Xclang -analyzer-config -Xclang ctu-dir=. \
273
- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=true \
274
- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing-database=compile_commands.json \
275
- -Xclang -analyzer-output=plist-multi-file \
276
- main.cpp
277
- main.cpp:5:12: warning: Division by zero
278
- return 3 / foo ();
279
- ~ ~^~~~~~~
280
- 1 warning generated.
281
- $ # The plist file with the result is generated.
282
- $ ls -F
283
- compile_commands.json externalDefMap.txt foo.cpp main.cpp main.plist
284
- $
285
-
286
- This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
287
- `CodeChecker ` or `scan-build-py `.
288
-
289
- Automated CTU Analysis with CodeChecker
290
- #######################################
291
- The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
292
- Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
293
-
294
- .. code-block :: bash
295
-
296
- $ CodeChecker analyze --ctu --ctu-on-demand compile_commands.json -o reports
297
- $ ls -F
298
- compile_commands.json foo.cpp main.cpp reports/
299
- $ tree reports
300
- reports
301
- ├── compile_cmd.json
302
- ├── compiler_info.json
303
- ├── foo.cpp_53f6fbf7ab7ec9931301524b551959e2.plist
304
- ├── main.cpp_23db3d8df52ff0812e6e5a03071c8337.plist
305
- ├── metadata.json
306
- └── unique_compile_commands.json
307
-
308
- 0 directories, 6 files
309
- $
310
-
311
- The `plist ` files contain the results of the analysis, which may be viewed with the regular analysis tools.
312
- E.g. one may use `CodeChecker parse ` to view the results in command line:
313
-
314
- .. code-block :: bash
315
-
316
- $ CodeChecker parse reports
317
- [HIGH] /home/egbomrt/ctu_mini_raw_project/main.cpp:5:12: Division by zero [core.DivideZero]
318
- return 3 / foo ();
319
- ^
320
-
321
- Found 1 defect(s) in main.cpp
322
-
323
-
324
- ----==== Summary ====----
325
- -----------------------
326
- Filename | Report count
327
- -----------------------
328
- main.cpp | 1
329
- -----------------------
330
- -----------------------
331
- Severity | Report count
332
- -----------------------
333
- HIGH | 1
334
- -----------------------
335
- ----=================----
336
- Total number of reports: 1
337
- ----=================----
338
-
339
- Or we can use `CodeChecker parse -e html ` to export the results into HTML format:
340
-
341
- .. code-block :: bash
342
-
343
- $ CodeChecker parse -e html -o html_out reports
344
- $ firefox html_out/index.html
345
-
346
- Automated CTU Analysis with scan-build-py (don't do it)
347
- #######################################################
348
- We actively develop CTU with CodeChecker as the driver for feature, `scan-build-py ` is not actively developed for CTU.
349
- `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
350
-
351
- Currently On-demand analysis is not supported with `scan-build-py `.
352
-
0 commit comments