Lines Matching +full:case +full:- +full:sensitive
5 inlining. The major one is -analyzer-config ipa:
7 -analyzer-config ipa=none - All inlining is disabled. This is the only mode
10 -analyzer-config ipa=basic-inlining - Turns on inlining for C functions, C++
11 static member functions, and blocks -- essentially, the calls that behave
15 -analyzer-config ipa=inlining - Turns on inlining when we can confidently find
17 functions, devirtualized C++ methods, Objective-C class methods, Objective-C
21 -analyzer-config ipa=dynamic - Inline instance methods for which the type is
25 -analyzer-config ipa=dynamic-bifurcate - Same as -analyzer-config ipa=dynamic,
30 Currently, -analyzer-config ipa=dynamic-bifurcate is the default mode.
32 While -analyzer-config ipa determines in general how aggressively the analyzer
34 functions can inlined, in an all-or-nothing way. These options use the
37 -analyzer-config OPTION=VALUE
39 ### c++-inlining ###
43 -analyzer-config c++-inlining=[none | methods | constructors | destructors]
49 The default c++-inlining mode is 'destructors', meaning that all member
53 Note that under 'constructors', constructors for types with non-trivial
55 inlined under -analyzer-config ipa=none or -analyzer-config ipa=basic-inlining,
56 regardless of the setting of the c++-inlining mode.
58 ### c++-template-inlining ###
62 -analyzer-config c++-template-inlining=[true | false]
71 ### c++-stdlib-inlining ###
77 -analyzer-config c++-stdlib-inlining=[true | false]
88 ### c++-container-inlining ###
93 -analyzer-config c++-container-inlining=[true | false]
101 fairly poor job of modeling certain data structure invariants of container-like
115 -----------------------
117 The low-level mechanism of inlining a function is handled in
134 call. (In the case of calls without origin expressions, such as destructors,
143 5. Custom post-call checks are processed and the final nodes are pushed back
147 ----------------------
152 Currently, we use this technique to recover coverage in case we stop
159 path is then re-analyzed from that point without inlining that particular call.
162 -----------------------
168 - If there is no definition available for the called function or method. In
169 this case, there is no opportunity to inline.
171 - If the CFG cannot be constructed for a called function, or the liveness
175 - If the LocationContext chain for a given ExplodedNode reaches a maximum cutoff
179 - If the function is variadic. This is not a hard limitation, but an engineering
184 - In C++, constructors are not inlined unless the destructor call will be
191 - In C++, ExprEngine does not inline custom implementations of operator 'new'
195 - Calls resulting in "dynamic dispatch" are specially handled. See more below.
197 - The FunctionSummaries map stores additional information about declarations,
205 ----------------------------------
208 method calls and Objective-C message sends. Due to the path-sensitive nature of
212 This path-sensitive devirtualization occurs when the analyzer can determine what
214 information is constrained enough for a simulated C++/Objective-C object that
223 Such type information is tracked as DynamicTypeInfo. This is path-sensitive
249 ProgramState to attempt to devirtualize the call. In the case of no dynamic
254 In the case of dynamic dispatch where our information is not perfect, CallEvent
257 corresponding to the object being called (i.e., the "receiver" in Objective-C
263 The -analyzer-config ipa option has five different modes: none, basic-inlining,
264 inlining, dynamic, and dynamic-bifurcate. Under -analyzer-config ipa=dynamic,
266 actually be the definition used at runtime. Under -analyzer-config ipa=inlining,
267 only "near-perfect" devirtualized calls are inlined*, and other dynamic calls
270 * Currently, no Objective-C messages are not inlined under
271 -analyzer-config ipa=inlining, even if we are reasonably confident of the type
275 The last option, -analyzer-config ipa=dynamic-bifurcate, behaves similarly to
276 "dynamic", but performs a conservative invalidation in the general virtual case
279 As stated above, -analyzer-config ipa=basic-inlining does not inline any C++
280 member functions or Objective-C method calls, even if they are non-virtual or
285 -----------
287 ExprEngine::BifurcateCall implements the -analyzer-config ipa=dynamic-bifurcate
293 RuntimeDefinition object) with a path-sensitive "mode" in the ProgramState.
297 DynamicDispatchModeInlined - Models the case where the dynamic type information
304 DynamicDispatchModeConservative - Models the case where the dynamic type
321 Objective-C Message Heuristics
322 ------------------------------
324 ExprEngine relies on a set of heuristics to partition the set of Objective-C
329 - If the object was created with +alloc or +new and initialized with an -init
332 - If the calls are property accesses using dot syntax. This is based on the
336 - If the class interface is declared inside the main source file. In this case
339 - If the method is not declared outside of main source file, either by the
343 --------------------
352 - Temporaries are poorly modeled right now because we're not confident in the
357 - 'new' is poorly modeled due to some nasty CFG/design issues. This is tracked
360 - Arrays of objects are modeled very poorly right now. ExprEngine currently
369 code. It is path-sensitive, containing both the current state (ProgramStateRef)
383 CallEvents are reference-counted objects managed by a CallEventManager. While
385 they are intended for short-lived use, and can be recreated from CFGElements or
386 non-top-level StackFrameContexts fairly easily.