Struct AnalysisOptions 

pub struct AnalysisOptions {
    pub constraint_solving: bool,
    pub abstract_interpretation: bool,
    pub context_sensitive: bool,
    pub symex: SymexOptions,
    pub backwards_analysis: bool,
    pub parse_timeout_ms: u64,
    pub max_origins: u32,
    pub max_pointsto: u32,
}

Stable configuration for the analysis engine.

Fields

constraint_solving: bool

Path-constraint solving. Prunes infeasible paths from the taint worklist and records unsat contexts in findings.

abstract_interpretation: bool

Abstract interpretation: interval/string/bit domains carried through the SSA worklist and used to suppress provably safe sinks.

context_sensitive: bool

k=1 context-sensitive inlining for intra-file callees.

symex: SymexOptions

Symbolic-execution pipeline.

backwards_analysis: bool

Demand-driven backwards taint analysis from sinks.

When enabled, after forward pass 2 completes, a backwards walk runs from each sink’s tainted SSA operands to corroborate or rule out the forward finding. Corroborated findings get a backwards-confirmed note; flows the backward walk proves infeasible get a backwards-infeasible note that caps confidence. Defaults off.

parse_timeout_ms: u64

Per-file tree-sitter parse timeout in milliseconds. 0 disables the cap entirely (not recommended outside of controlled benchmarks).

max_origins: u32

Maximum taint origins retained per lattice value.

Controls both crate::taint::domain::VarTaint::origins and the equivalent per-object bound inside the heap state. When a merge would exceed this bound, origins are dropped deterministically (sorted by source location) and an crate::engine_notes::EngineNote::OriginsTruncated note is recorded on the affected finding. Raising this reduces the chance of silent under-reporting at the cost of slightly wider lattice values. See DEFAULT_MAX_ORIGINS.

max_pointsto: u32

Maximum abstract heap objects retained per intra-procedural points-to set.

When an allocation-site union would exceed this bound, the largest-keyed heap objects are dropped and an crate::engine_notes::EngineNote::PointsToTruncated note is recorded. Taint flows that should have reached the dropped objects via this aliasing path are lost (under-report). Raise for factory-heavy codebases where truncation is observed; lower only when points-to width is a measured bottleneck. See DEFAULT_MAX_POINTSTO.

Trait Implementations

impl Clone for AnalysisOptions

fn clone(&self) -> AnalysisOptions

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnalysisOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AnalysisOptions

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AnalysisOptions

where AnalysisOptions: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AnalysisOptions

fn eq(&self, other: &AnalysisOptions) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AnalysisOptions

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for AnalysisOptions

impl Eq for AnalysisOptions

impl StructuralPartialEq for AnalysisOptions