@@ -3,33 +3,14 @@ Cross Translation Unit (CTU) Analysis
33=====================================
44
55Normally, static analysis works in the boundary of one translation unit (TU).
6- However, with additional steps and configuration we can enable the analysis to inline the definition of a function from
7- another TU.
6+ However, with additional steps and configuration we can enable the analysis to inline the definition of a function from another TU.
87
98.. contents ::
109 :local:
1110
12- Overview
13- ________
14- CTU analysis can be used in a variety of ways. The importing of external TU definitions can work with pre-dumped PCH
15- files or generating the necessary AST structure on-demand, during the analysis of the main TU. Driving the static
16- analysis can also be implemented in multiple ways. The most direct way is to specify the necessary commandline options
17- of the Clang frontend manually (and generate the prerequisite dependencies of the specific import method by hand). This
18- process can be automated by other tools, like `CodeChecker <https://github.com/Ericsson/codechecker >`_ and scan-build-py
19- (preference for the former).
20-
21- PCH-based analysis
22- __________________
23- The analysis needs the PCH dumps of all the translations units used in the project.
24- These can be generated by the Clang Frontend itself, and must be arranged in a specific way in the filesystem.
25- The index, which maps symbols' USR names to PCH dumps containing them must also be generated by the
26- `clang-extdef-mapping `. This tool uses a :doc: `compilation database <../../JSONCompilationDatabase >` to
27- determine the compilation flags used.
28- The analysis invocation must be provided with the directory which contains the dumps and the mapping files.
29-
30-
3111Manual CTU Analysis
32- ###################
12+ -------------------
13+
3314Let's consider these source files in our minimal example:
3415
3516.. code-block :: cpp
@@ -66,8 +47,7 @@ And a compilation database:
6647 ]
6748
6849 We'd like to analyze `main.cpp ` and discover the division by zero bug.
69- In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file
70- of `foo.cpp `:
50+ In order to be able to inline the definition of `foo ` from `foo.cpp ` first we have to generate the `AST ` (or `PCH `) file of `foo.cpp `:
7151
7252.. code-block :: bash
7353
@@ -78,8 +58,7 @@ of `foo.cpp`:
7858 compile_commands.json foo.cpp.ast foo.cpp main.cpp
7959 $
8060
81- The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the
82- source files:
61+ The next step is to create a CTU index file which holds the `USR ` name and location of external definitions in the source files:
8362
8463.. code-block :: bash
8564
@@ -106,34 +85,47 @@ We have to feed Clang with CTU specific extra arguments:
10685
10786 $ pwd
10887 /path/to/your/project
109- $ clang++ --analyze \
110- -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
111- -Xclang -analyzer-config -Xclang ctu-dir=. \
112- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=false \
113- -Xclang -analyzer-output=plist-multi-file \
114- main.cpp
88+ $ clang++ --analyze -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true -Xclang -analyzer-config -Xclang ctu-dir=. -Xclang -analyzer-output=plist-multi-file main.cpp
11589 main.cpp:5:12: warning: Division by zero
11690 return 3 / foo ();
11791 ~ ~^~~~~~~
11892 1 warning generated.
11993 $ # The plist file with the result is generated.
120- $ ls -F
94+ $ ls
12195 compile_commands.json externalDefMap.txt foo.ast foo.cpp foo.cpp.ast main.cpp main.plist
12296 $
12397
124- This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
125- `CodeChecker ` or `scan-build-py `.
98+ This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use `CodeChecker ` or `scan-build-py `.
12699
127100Automated CTU Analysis with CodeChecker
128- #######################################
101+ ---------------------------------------
129102The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
130103Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
131104
132105.. code-block :: bash
133106
134107 $ CodeChecker analyze --ctu compile_commands.json -o reports
135- $ ls -F
136- compile_commands.json foo.cpp foo.cpp.ast main.cpp reports/
108+ [INFO 2019-07-16 17:21] - Pre-analysis started.
109+ [INFO 2019-07-16 17:21] - Collecting data for ctu analysis.
110+ [INFO 2019-07-16 17:21] - [1/2] foo.cpp
111+ [INFO 2019-07-16 17:21] - [2/2] main.cpp
112+ [INFO 2019-07-16 17:21] - Pre-analysis finished.
113+ [INFO 2019-07-16 17:21] - Starting static analysis ...
114+ [INFO 2019-07-16 17:21] - [1/2] clangsa analyzed foo.cpp successfully.
115+ [INFO 2019-07-16 17:21] - [2/2] clangsa analyzed main.cpp successfully.
116+ [INFO 2019-07-16 17:21] - ----==== Summary ====----
117+ [INFO 2019-07-16 17:21] - Successfully analyzed
118+ [INFO 2019-07-16 17:21] - clangsa: 2
119+ [INFO 2019-07-16 17:21] - Total analyzed compilation commands: 2
120+ [INFO 2019-07-16 17:21] - ----=================----
121+ [INFO 2019-07-16 17:21] - Analysis finished.
122+ [INFO 2019-07-16 17:21] - To view results in the terminal use the " CodeChecker parse" command.
123+ [INFO 2019-07-16 17:21] - To store results use the " CodeChecker store" command.
124+ [INFO 2019-07-16 17:21] - See --help and the user guide for further options about parsing and storing the reports.
125+ [INFO 2019-07-16 17:21] - ----=================----
126+ [INFO 2019-07-16 17:21] - Analysis length: 0.659618854523 sec.
127+ $ ls
128+ compile_commands.json foo.cpp foo.cpp.ast main.cpp reports
137129 $ tree reports
138130 reports
139131 ├── compile_cmd.json
@@ -182,9 +174,9 @@ Or we can use `CodeChecker parse -e html` to export the results into HTML format
182174 $ firefox html_out/index.html
183175
184176 Automated CTU Analysis with scan-build-py (don't do it)
185- #############################################################
186- We actively develop CTU with CodeChecker as the driver for this feature , `scan-build-py ` is not actively developed for CTU.
187- `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
177+ -------------------------------------------------------
178+ We actively develop CTU with CodeChecker as a "runner" script , `scan-build-py ` is not actively developed for CTU.
179+ `scan-build-py ` has various errors and issues, expect it to work with the very basic projects only.
188180
189181Example usage of scan-build-py:
190182
@@ -199,154 +191,3 @@ Example usage of scan-build-py:
199191 Opening in existing browser session.
200192 ^C
201193 $
202-
203- On-demand analysis
204- __________________
205- The analysis produces the necessary AST structure of external TUs during analysis. This requires the
206- compilation database in order to determine the exact compiler invocation used for each TU.
207- The index, which maps function USR names to source files containing them must also be generated by the
208- `clang-extdef-mapping `. The mapping of external definitions implicitly uses a
209- :doc: `compilation database <../../JSONCompilationDatabase >` to determine the compilation flags used.
210- Preferably the same compilation database should be used when generating the external definitions, and
211- during analysis. The analysis invocation must be provided with the directory which contains the mapping
212- files, and the compilation database which is used to determine compiler flags.
213-
214-
215- Manual CTU Analysis
216- ###################
217-
218- Let's consider these source files in our minimal example:
219-
220- .. code-block :: cpp
221-
222- // main.cpp
223- int foo();
224-
225- int main() {
226- return 3 / foo();
227- }
228-
229- .. code-block :: cpp
230-
231- // foo.cpp
232- int foo() {
233- return 0;
234- }
235-
236- And a compilation database:
237-
238- .. code-block :: bash
239-
240- [
241- {
242- " directory" : " /path/to/your/project" ,
243- " command" : " clang++ -c foo.cpp -o foo.o" ,
244- " file" : " foo.cpp"
245- },
246- {
247- " directory" : " /path/to/your/project" ,
248- " command" : " clang++ -c main.cpp -o main.o" ,
249- " file" : " main.cpp"
250- }
251- ]
252-
253- We'd like to analyze `main.cpp ` and discover the division by zero bug.
254- As we are using On-demand mode, we only need to create a CTU index file which holds the `USR ` name and location of
255- external definitions in the source files:
256-
257- .. code-block :: bash
258-
259- $ clang-extdef-mapping -p . foo.cpp
260- c:@F@foo# /path/to/your/project/foo.cpp
261- $ clang-extdef-mapping -p . foo.cpp > externalDefMap.txt
262-
263- Now everything is available for the CTU analysis.
264- We have to feed Clang with CTU specific extra arguments:
265-
266- .. code-block :: bash
267-
268- $ pwd
269- /path/to/your/project
270- $ clang++ --analyze \
271- -Xclang -analyzer-config -Xclang experimental-enable-naive-ctu-analysis=true \
272- -Xclang -analyzer-config -Xclang ctu-dir=. \
273- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing=true \
274- -Xclang -analyzer-config -Xclang ctu-on-demand-parsing-database=compile_commands.json \
275- -Xclang -analyzer-output=plist-multi-file \
276- main.cpp
277- main.cpp:5:12: warning: Division by zero
278- return 3 / foo ();
279- ~ ~^~~~~~~
280- 1 warning generated.
281- $ # The plist file with the result is generated.
282- $ ls -F
283- compile_commands.json externalDefMap.txt foo.cpp main.cpp main.plist
284- $
285-
286- This manual procedure is error-prone and not scalable, therefore to analyze real projects it is recommended to use
287- `CodeChecker ` or `scan-build-py `.
288-
289- Automated CTU Analysis with CodeChecker
290- #######################################
291- The `CodeChecker <https://github.com/Ericsson/codechecker >`_ project fully supports automated CTU analysis with Clang.
292- Once we have set up the `PATH ` environment variable and we activated the python `venv ` then it is all it takes:
293-
294- .. code-block :: bash
295-
296- $ CodeChecker analyze --ctu --ctu-on-demand compile_commands.json -o reports
297- $ ls -F
298- compile_commands.json foo.cpp main.cpp reports/
299- $ tree reports
300- reports
301- ├── compile_cmd.json
302- ├── compiler_info.json
303- ├── foo.cpp_53f6fbf7ab7ec9931301524b551959e2.plist
304- ├── main.cpp_23db3d8df52ff0812e6e5a03071c8337.plist
305- ├── metadata.json
306- └── unique_compile_commands.json
307-
308- 0 directories, 6 files
309- $
310-
311- The `plist ` files contain the results of the analysis, which may be viewed with the regular analysis tools.
312- E.g. one may use `CodeChecker parse ` to view the results in command line:
313-
314- .. code-block :: bash
315-
316- $ CodeChecker parse reports
317- [HIGH] /home/egbomrt/ctu_mini_raw_project/main.cpp:5:12: Division by zero [core.DivideZero]
318- return 3 / foo ();
319- ^
320-
321- Found 1 defect(s) in main.cpp
322-
323-
324- ----==== Summary ====----
325- -----------------------
326- Filename | Report count
327- -----------------------
328- main.cpp | 1
329- -----------------------
330- -----------------------
331- Severity | Report count
332- -----------------------
333- HIGH | 1
334- -----------------------
335- ----=================----
336- Total number of reports: 1
337- ----=================----
338-
339- Or we can use `CodeChecker parse -e html ` to export the results into HTML format:
340-
341- .. code-block :: bash
342-
343- $ CodeChecker parse -e html -o html_out reports
344- $ firefox html_out/index.html
345-
346- Automated CTU Analysis with scan-build-py (don't do it)
347- #######################################################
348- We actively develop CTU with CodeChecker as the driver for feature, `scan-build-py ` is not actively developed for CTU.
349- `scan-build-py ` has various errors and issues, expect it to work only with the very basic projects only.
350-
351- Currently On-demand analysis is not supported with `scan-build-py `.
352-
0 commit comments