Interpret Polyspace Code Prover Results in Polyspace Platform User Interface

When you open the results of a Polyspace^® Code Prover™ analysis, you see a list on the Results List pane. The list consists of run-time checks, coding rule violations, code metrics, and global variable usage.

You can first narrow down the focus of your review:

• Use filters in the Filters section of the toolstrip to narrow down the list. For example, use the High Severity filter to focus on high severity defects.

• Organize results by result family. Click a column title to sort the column. Use the Show only and Filter out options to include or exclude entire result families.

  Because the results of a Code Prover run-time check are dependent on the results of previous checks, reviewing run-time checks from the beginning to the end of a function helps you interpret the results.

See also Filter and Sort Results in Polyspace Platform User Interface. Once you narrow down the list, you can begin reviewing individual results.

This topic describes how to review and interpret a result of a Polyspace Code Prover analysis in the Polyspace Platform user interface.

To begin your review, select a result in the list.

Interpret Result

The first step is to understand the nature of the issue. Read the message on the Result Details pane and the related line of code on the Source Code pane.

You can use the message to decide whether to fix the issue.

The message consists of several parts:

• The color and icon of the check: See Code Prover Result and Source Code Colors. In cases of checks for run-time errors:

  • — Red indicates a definite error.

  • — Orange indicates a possible error.

  • — Gray indicates unreachable code.

  • — Green indicates that a specific error cannot happen.

• The description of the run-time check.

  In the example, the check determines if an array index goes outside the array bounds.

• Values relevant to the run-time check.

  In the example, the message states the array size (127), the array bounds (0..126), and the range of values that the array index variable can take at that point in the code (0..555).

• Relevant sources of imprecision (for orange checks).

  In the example, the message states that two volatile variables might be responsible for the check.

See Variable Ranges in Source Code Tooltips

On the Source Code pane, variables and operations with tooltips are underlined.

In this example, tooltips appear on:

• s8_ret: You see its data type and range of values before the + operation.

  If a data type conversion occurs during the + operation, you also see this conversion in the tooltip.

• +: You see the value of the left and right operand, and the result.

• =: You see any data type conversion that occurs during the assignment and the result.

Get Additional Help

Sometimes, you need additional help for certain results. To open a help page for the selected result, click the icon in the Result Details pane. The code examples in the help page illustrate the result.

Find Root Cause of Result

Sometimes, the root cause might be located far from the location in the code where you see the result. For instance, a variable that you read might be noninitialized because the initialization is not reachable by the code. Polyspace displays this defect when you read the variable, but the root cause can be a previous if or while condition that is always false.

Navigate in Source Code

Sometimes, the Result Details pane shows one sequence of events that leads to the result. However, in most situations, you have to find your own navigation pathways through the code. Use tooltips on variables to follow the propagation of variable ranges as you navigate through the code.

int func (int var) { /* Initial range of var */
     … 
     var -= get ();  /* New range of var */
     …
     set(&var);     /* New range of var */
}

Use these quick navigation pathways:

• Search for all references to a variable and browse through them.

  Highlight and right-click the variable name on the Source Code pane and select Search For All References. Alternatively, double-click the variable. These options perform more than a string match. The options show only instances of a specific variable and not other variables with the same name in other scopes.

• Navigate from a function call to its definition.

  Right-click the function name on the Source Code pane. Select Go To Definition.

• Navigate from a function to its callers and callees.

  Click the icon on the Result Details pane to open the Call Hierarchy pane. You see the function containing the result with its callers and callees. Click a caller or callee name to navigate to the call site in the Source Code pane. Double-click a name to navigate to the definition.

  Alternatively, click the icon to open the Error Call Graph pane which shows a graphical representation of the call sequence leading to the result. To navigate to functions in this sequence, click through nodes in the graph.

• Navigate from a function call or loop keyword to an error in the function or loop body.

  If the error occurs only in a specific function call or specific loop iteration, the function call or loop iteration is highlighted in red. Right-click the red function call or loop keyword. Select Go To Cause if the option is available.

• Navigate across all instances of a global variable.

  Click the icon on the Result Details pane to open the Global Variables Usage pane. See all global variables in the result and read/write operations on them.

Before you begin navigating through pathways in your code, determine what you are looking for and choose the appropriate navigation tool. For instance:

• To investigate a Non-initialized variable defect, you might want to make sure that the variable is not initialized at all in the code. To look for previous instances of the variable, on the Source Code pane, select and right-click the variable and select Search For All References. This shows only instances of a specific variable and not other variables with the same name in other scopes.

• To investigate a rule violation, you can navigate from a function call to a function definition. Right-click the function and select Go To Definition.

For other examples of what to look for, see Reviewing Code Prover Run-Time Checks.