Expand description
Function summaries for compositional analysis.
A FunctionSummary is a compact, serializable description of a function’s
pointer and memory behavior. Summaries serve as the universal exchange format
between:
- YAML specs (hand-written for external/library functions)
- Analysis results (computed by PTA, value-flow, etc.)
- Compositional analysis (bottom-up summary composition)
Access paths (AccessPath) describe memory locations relative to function
parameters and globals, enabling field-sensitive and context-sensitive
summaries without concrete ValueId bindings.
§Persistence
Summaries support JSON serialization to disk via FunctionSummary::save and
FunctionSummary::load, stored at {cache_dir}/summaries/{function_id_hex}.json.
Structs§
- Allocation
Effect - Describes an allocation performed by a function.
- Function
Summary - A compact, serializable description of a function’s pointer and memory behavior.
- Memory
Effect - Describes a memory side-effect of a function.
- Return
Effect - Describes the effect of a function on its return value.
- Summary
Computed Bound - A computed return bound: return interval depends on a parameter property.
- Summary
Taint Propagation - Taint propagation rule within a function summary.
Enums§
- Access
Path - Describes a memory access location relative to function parameters or globals.
- Access
Path Parse Error - Errors that can occur when parsing an
AccessPathfrom a string. - Callee
Ref - Reference to a callee from within a function body.
- Summary
Bound Mode - How a return value is bounded by a parameter property.
- Summary
Nullness - Nullness classification for a pointer value.
- Summary
Precision - Precision guarantee of a function summary.
- Summary
Role - High-level role of a function in the summary system.
- Summary
Source - How a function summary was produced.