This is an archive of the discontinued LLVM Phabricator instance.

[analyzer] Exploration strategy prioritizing unexplored nodes first
ClosedPublic

Authored by george.karpenkov on Feb 15 2018, 2:31 PM.

Details

Summary

See D42775 for discussion.
Turns out, just exploring nodes which weren't explored first is not quite enough, as e.g. the first quick traversal resulting in a report can mark everything as "visited", and then subsequent traversals of the same region will get all the pitfalls of DFS.
Priority queue-based approach in comparison shows much greater increase in coverage and even performance, without sacrificing memory.

Diff Detail

Repository
rC Clang

Event Timeline

NoQ added a comment.Feb 23 2018, 1:42 PM

Looks great. Do you have any tests to demonstrate the difference?

lib/StaticAnalyzer/Core/CoreEngine.cpp
198

Uhm, this should have been typedef-ed in CFGBlock.

241

Because nobody knows what type -NumVIsited is and if it's going to be properly sign-extended and truncated into int, maybe lets just make all of these ints?

Do you have any tests to demonstrate the difference?

Not on small files, unfortunately. Differences on large projects in performance, coverage and path lengths are very noticeable though.

george.karpenkov marked an inline comment as done.
NoQ accepted this revision.Feb 26 2018, 1:13 PM

All right, so at least we know that it works. I guess we need a better testing system to test exploration order, and please keep us informed if you manage to reduce an example for us :)

This revision is now accepted and ready to land.Feb 26 2018, 1:13 PM
This revision was automatically updated to reflect the committed changes.