This tutorial is about getting around the internals of the static analyzer. You'll learn how to figure out what exactly is the static analyzer thinking when it analyzes any particular code. You'll learn how to debug false positives and other bugs in a methodical, principled manner. We'll show how the analyzer represents program behavior as a graph and walk through a few such graphs step-by-step and then see how to debug it further when we believe that anything about these graphs is incorrect. This tutorial will be useful to anybody who wants to get involved in the development of the static analyzer, sub-project of LLVM that is both complex and also friendly to newcomers. The tutorial is a complement to the talk “How to Write a Checker in 24 Hours” from LLVM DevMtg'2012; here we will focus on getting started contributing to the analyzer core.
