{"id":16765662,"url":"https://github.com/awruef/crab-clang","last_synced_at":"2025-04-10T18:44:40.794Z","repository":{"id":80426025,"uuid":"99456843","full_name":"awruef/crab-clang","owner":"awruef","description":"translate clang AST into CRAB","archived":false,"fork":false,"pushed_at":"2018-11-20T08:19:53.000Z","size":88,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-24T16:34:06.885Z","etag":null,"topics":["abstract-interpretation","clang","llvm","verification"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/awruef.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-08-06T01:19:50.000Z","updated_at":"2021-02-21T14:56:16.000Z","dependencies_parsed_at":null,"dependency_job_id":"5001fadf-f284-4a32-9812-852a6a605ef3","html_url":"https://github.com/awruef/crab-clang","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awruef%2Fcrab-clang","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awruef%2Fcrab-clang/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awruef%2Fcrab-clang/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awruef%2Fcrab-clang/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/awruef","download_url":"https://codeload.github.com/awruef/crab-clang/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248271923,"owners_count":21075800,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["abstract-interpretation","clang","llvm","verification"],"created_at":"2024-10-13T05:43:09.610Z","updated_at":"2025-04-10T18:44:40.787Z","avatar_url":"https://github.com/awruef.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crab-clang\n\nAttempt at generating a CRAB CFG from the clang AST. \n\n# why?\n\nUsability of verification tools is an interesting story. A typical story for \nthese kinds of tools is a workflow that looks something like this: \n\n1. Compile the program to LLVM using `clang -g -c -emit-llvm`.\n2. Run a tool on the resulting pile of LLVM to pre-process the LLVM, usually \n   to ensure it's in SSA (or, better still, some SSA variant that isn't part \n   of LLVM), run a points-to analysis, perform constant folding, or something\n   else.\n3. Run another tool on this pre-processed pile of LLVM to generate some \n   representation suitable for analysis. For example, generate some other \n   mid-level IR, generate SMT formulas for verification conditions, and so on.\n4. Actually get some results out and analyze them for bugs. \n5. Communicate those bugs to the user by projecting back through your analyzer\n   results to the LLVM to the original source code, probably relying on debug\n   meta-data emitted in the first place by clang and hopefully preserved by the\n   pre-processing and analysis pipeline. \n\nThis is long and involved. The story also sucks for end users of these tools. \nWhat if instead we did the analysis much closer to the programs text? \n\nAlso, this way, we can integrate analyses that CRAB has into analysis and \ndeveloper tool chains that use clang `libtooling`. For example, automatic \nre-factoring tools could benefit from a sound inter-procedural nullity \nanalysis, or integer range analysis. \n\n# how?\n\nCRAB provides a simple IR for its fixpoint engine and abstract domains. We \nwill write a `RecursiveASTVisitor` that converts the clang AST into a CRAB\nprogram. Then, frontends can instantiate that `RecursiveASTVisitor` \nparameterized by the analysis they want. \n\nclang provides a representation of the CFG at the AST level. This CFG is very\nclose to compatible to CRAB, it has one entry and one exit, and it represents\nsuccessors and predecessors and statements contained within each block. \nWe just need to iterate over the clang CFG to build up a CRAB CFG, translating\nthe structure into CRAB.\n\nSince CRAB incorporates an inter-procedural analysis as well, perhaps we will\ndo this in a two-step process, where one `RecursiveASTVisitor` builds a CRAB\nrepresentation of the whole program and then we run the inter-procedural \nanalysis on the whole program, across all compilation units. \n\n# risks?\n\nCRAB-LLVM uses a phased analysis, where an up-front points-to analysis on the \nLLVM guides the creation of CRAB arrays and pointers. By running on the AST,\nwe can't benefit from this analysis, and we're stuck with the source code. \nMaybe this will be a precision problem later, but I'm not really sure how \nwe're that worse off. \n\n# progress?\n\nVery skeletal so far. We are exploring how to represent the AST in CRAB. \nRight now, it only works for the ludicrously simple example programs. \n\n# to do\n\n1. Re-treat types, right now everything is `INT_TYPE` of 32 bit width. \n   We should go back to pulling out types from `QualType`.\n2. How do we represent struct types? \n3. Add tests with multiple functions and instantiate an interprocedural \n   analyzer.\n4. Project analyzer results onto the original source code via re-writing.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fawruef%2Fcrab-clang","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fawruef%2Fcrab-clang","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fawruef%2Fcrab-clang/lists"}