@@ -3,14 +3,33 @@ Cross Translation Unit (CTU) Analysis
33=====================================
44
55Normally, static analysis works in the boundary of one translation unit (TU).
6- However, with additional steps and configuration we can enable the analysis to inline the definition of a function from another TU.
6+ However, with additional steps and configuration we can enable the analysis to inline the definition of a function from
7+ another TU.
78
89.. contents ::
910 :local:
1011
11- Manual CTU Analysis
12- -------------------
12+ Overview
13+ ________
14+ CTU analysis can be used in a variety of ways. The importing of external TU definitions can work with pre-dumped PCH
15+ files or generating the necessary AST structure on-demand, during the analysis of the main TU. Driving the static
16+ analysis can also be implemented in multiple ways. The most direct way is to specify the necessary commandline options
17+ of the Clang frontend manually (and generate the prerequisite dependencies of the specific import method by hand). This
18+ process can be automated by other tools, like `CodeChecker <https://github.com/Ericsson/codechecker >`_ and scan-build-py
19+ (preference for the former).
20+
21+ PCH-based analysis
22+ __________________
23+ The analysis needs the PCH dumps of all the translations units used in the project.
24+ These can be generated by the Clang Frontend itself, and must be arranged in a specific way in the filesystem.
25+ The index, which maps symbols' USR names to PCH dumps containing them must also be generated by the
26+ `clang-extdef-mapping `. This tool uses a :doc: `compilation database <../../JSONCompilationDatabase >` to
27+ determine the compilation flags used.
28+ The analysis invocation must be provided with the directory which contains the dumps and the mapping files.
29+
1330
31+ Manual CTU Analysis
32+ ###################
1433Let's consider these source files in our minimal example:
1534
1635.. code-block :: cpp
@@ -47,7 +66,8 @@ And a compilation database:
4766 ]
4867
4968 We'd like to analyze `main.cpp ` and discover the division by zero bug.
50- In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file of `foo.cpp `:
69+ In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file
70+ of `foo.cpp `:
5171
5272.. code-block :: bash
5373
@@ -58,7 +78,8 @@ In order to be able to inline the definition of `foo` from `foo.cpp` first we ha
5878 compile_commands.json foo.cpp.ast foo.cpp main.cpp
5979 $
6080
61- The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the source files:
81+ The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the
82+ source files:
6283
6384.. code-block :: bash
6485
@@ -85,47 +106,34 @@ We have to feed Clang with CTU specific extra arguments:
85106
86107 $ pwd
87108 /path/to/your/project
88- $ clang++ --analyze -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true -Xclang -analyzer-config -Xclang ctu-dir=. -Xclang -analyzer-output=plist-multi-file main.cpp
109+ $ clang++ --analyze \
110+ -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
111+ -Xclang -analyzer-config -Xclang ctu-dir=. \
112+ -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=false \
113+ -Xclang -analyzer-output=plist-multi-file \
114+ main.cpp
89115 main.cpp:5:12: warning: Division by zero
90116 return 3 / foo ();
91117 ~ ~^~~~~~~
92118 1 warning generated.
93119 $ # The plist file with the result is generated.
94- $ ls
120+ $ ls -F
95121 compile_commands.json externalDefMap.txt foo.ast foo.cpp foo.cpp.ast main.cpp main.plist
96122 $
97123
98- This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use `CodeChecker ` or `scan-build-py `.
124+ This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
125+ `CodeChecker ` or `scan-build-py `.
99126
100127Automated CTU Analysis with CodeChecker
101- ---------------------------------------
128+ #######################################
102129The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
103130Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
104131
105132.. code-block :: bash
106133
107134 $ CodeChecker analyze --ctu compile_commands.json -o reports
108- [INFO 2019-07-16 17:21] - Pre-analysis started.
109- [INFO 2019-07-16 17:21] - Collecting data for ctu analysis.
110- [INFO 2019-07-16 17:21] - [1/2] foo.cpp
111- [INFO 2019-07-16 17:21] - [2/2] main.cpp
112- [INFO 2019-07-16 17:21] - Pre-analysis finished.
113- [INFO 2019-07-16 17:21] - Starting static analysis ...
114- [INFO 2019-07-16 17:21] - [1/2] clangsa analyzed foo.cpp successfully.
115- [INFO 2019-07-16 17:21] - [2/2] clangsa analyzed main.cpp successfully.
116- [INFO 2019-07-16 17:21] - ----==== Summary ====----
117- [INFO 2019-07-16 17:21] - Successfully analyzed
118- [INFO 2019-07-16 17:21] - clangsa: 2
119- [INFO 2019-07-16 17:21] - Total analyzed compilation commands: 2
120- [INFO 2019-07-16 17:21] - ----=================----
121- [INFO 2019-07-16 17:21] - Analysis finished.
122- [INFO 2019-07-16 17:21] - To view results in the terminal use the " CodeChecker parse" command.
123- [INFO 2019-07-16 17:21] - To store results use the " CodeChecker store" command.
124- [INFO 2019-07-16 17:21] - See --help and the user guide for further options about parsing and storing the reports.
125- [INFO 2019-07-16 17:21] - ----=================----
126- [INFO 2019-07-16 17:21] - Analysis length: 0.659618854523 sec.
127- $ ls
128- compile_commands.json foo.cpp foo.cpp.ast main.cpp reports
135+ $ ls -F
136+ compile_commands.json foo.cpp foo.cpp.ast main.cpp reports/
129137 $ tree reports
130138 reports
131139 ├── compile_cmd.json
@@ -174,9 +182,9 @@ Or we can use `CodeChecker parse -e html` to export the results into HTML format
174182 $ firefox html_out/index.html
175183
176184 Automated CTU Analysis with scan-build-py (don't do it)
177- -------------------------------------------------------
178- We actively develop CTU with CodeChecker as a "runner" script , `scan-build-py ` is not actively developed for CTU.
179- `scan-build-py ` has various errors and issues, expect it to work with the very basic projects only.
185+ #############################################################
186+ We actively develop CTU with CodeChecker as the driver for this feature , `scan-build-py ` is not actively developed for CTU.
187+ `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
180188
181189Example usage of scan-build-py:
182190
@@ -191,3 +199,154 @@ Example usage of scan-build-py:
191199 Opening in existing browser session.
192200 ^C
193201 $
202+
203+ On-demand analysis
204+ __________________
205+ The analysis produces the necessary AST structure of external TUs during analysis. This requires the
206+ compilation database in order to determine the exact compiler invocation used for each TU.
207+ The index, which maps function USR names to source files containing them must also be generated by the
208+ `clang-extdef-mapping `. The mapping of external definitions implicitly uses a
209+ :doc: `compilation database <../../JSONCompilationDatabase >` to determine the compilation flags used.
210+ Preferably the same compilation database should be used when generating the external definitions, and
211+ during analysis. The analysis invocation must be provided with the directory which contains the mapping
212+ files, and the compilation database which is used to determine compiler flags.
213+
214+
215+ Manual CTU Analysis
216+ ###################
217+
218+ Let's consider these source files in our minimal example:
219+
220+ .. code-block :: cpp
221+
222+ // main.cpp
223+ int foo();
224+
225+ int main() {
226+ return 3 / foo();
227+ }
228+
229+ .. code-block :: cpp
230+
231+ // foo.cpp
232+ int foo() {
233+ return 0;
234+ }
235+
236+ And a compilation database:
237+
238+ .. code-block :: bash
239+
240+ [
241+ {
242+ " directory" : " /path/to/your/project" ,
243+ " command" : " clang++ -c foo.cpp -o foo.o" ,
244+ " file" : " foo.cpp"
245+ },
246+ {
247+ " directory" : " /path/to/your/project" ,
248+ " command" : " clang++ -c main.cpp -o main.o" ,
249+ " file" : " main.cpp"
250+ }
251+ ]
252+
253+ We'd like to analyze `main.cpp ` and discover the division by zero bug.
254+ As we are using On-demand mode, we only need to create a CTU index file which holds the `USR ` name and location of
255+ external definitions in the source files:
256+
257+ .. code-block :: bash
258+
259+ $ clang-extdef-mapping -p . foo.cpp
260+ c:@F@foo# /path/to/your/project/foo.cpp
261+ $ clang-extdef-mapping -p . foo.cpp > externalDefMap.txt
262+
263+ Now everything is available for the CTU analysis.
264+ We have to feed Clang with CTU specific extra arguments:
265+
266+ .. code-block :: bash
267+
268+ $ pwd
269+ /path/to/your/project
270+ $ clang++ --analyze \
271+ -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
272+ -Xclang -analyzer-config -Xclang ctu-dir=. \
273+ -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=true \
274+ -Xclang -analyzer-config -Xclang ctu-on-demand-parsing-database=compile_commands.json \
275+ -Xclang -analyzer-output=plist-multi-file \
276+ main.cpp
277+ main.cpp:5:12: warning: Division by zero
278+ return 3 / foo ();
279+ ~ ~^~~~~~~
280+ 1 warning generated.
281+ $ # The plist file with the result is generated.
282+ $ ls -F
283+ compile_commands.json externalDefMap.txt foo.cpp main.cpp main.plist
284+ $
285+
286+ This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
287+ `CodeChecker ` or `scan-build-py `.
288+
289+ Automated CTU Analysis with CodeChecker
290+ #######################################
291+ The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
292+ Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
293+
294+ .. code-block :: bash
295+
296+ $ CodeChecker analyze --ctu --ctu-on-demand compile_commands.json -o reports
297+ $ ls -F
298+ compile_commands.json foo.cpp main.cpp reports/
299+ $ tree reports
300+ reports
301+ ├── compile_cmd.json
302+ ├── compiler_info.json
303+ ├── foo.cpp_53f6fbf7ab7ec9931301524b551959e2.plist
304+ ├── main.cpp_23db3d8df52ff0812e6e5a03071c8337.plist
305+ ├── metadata.json
306+ └── unique_compile_commands.json
307+
308+ 0 directories, 6 files
309+ $
310+
311+ The `plist ` files contain the results of the analysis, which may be viewed with the regular analysis tools.
312+ E.g. one may use `CodeChecker parse ` to view the results in command line:
313+
314+ .. code-block :: bash
315+
316+ $ CodeChecker parse reports
317+ [HIGH] /home/egbomrt/ctu_mini_raw_project/main.cpp:5:12: Division by zero [core.DivideZero]
318+ return 3 / foo ();
319+ ^
320+
321+ Found 1 defect(s) in main.cpp
322+
323+
324+ ----==== Summary ====----
325+ -----------------------
326+ Filename | Report count
327+ -----------------------
328+ main.cpp | 1
329+ -----------------------
330+ -----------------------
331+ Severity | Report count
332+ -----------------------
333+ HIGH | 1
334+ -----------------------
335+ ----=================----
336+ Total number of reports: 1
337+ ----=================----
338+
339+ Or we can use `CodeChecker parse -e html ` to export the results into HTML format:
340+
341+ .. code-block :: bash
342+
343+ $ CodeChecker parse -e html -o html_out reports
344+ $ firefox html_out/index.html
345+
346+ Automated CTU Analysis with scan-build-py (don't do it)
347+ #######################################################
348+ We actively develop CTU with CodeChecker as the driver for feature, `scan-build-py ` is not actively developed for CTU.
349+ `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
350+
351+ Currently On-demand analysis is not supported with `scan-build-py `.
352+
0 commit comments