| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| // Test how BOLT handles indirect branch sequence of instructions in | ||
| // AArch64MCPlus builder. | ||
|
|
||
| // clang-format off | ||
|
|
||
| // REQUIRES: system-linux | ||
| // RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %s -o %t.o | ||
| // RUN: %clang %cflags --target=aarch64-unknown-linux %t.o -o %t.exe -Wl,-q | ||
| // RUN: llvm-bolt %t.exe -o %t.bolt --print-cfg --strict\ | ||
| // RUN: -v=1 2>&1 | FileCheck %s | ||
|
|
||
| // Pattern 1: there is no shift amount after the 'add' instruction. | ||
| // | ||
| // adr x6, 0x219fb0 <sigall_set+0x88> | ||
| // add x6, x6, x14, lsl #2 | ||
| // ldr w7, [x6] | ||
| // add x6, x6, w7, sxtw => no shift amount | ||
| // br x6 | ||
| // | ||
|
|
||
| // Pattern 2: nop/adr pair is used in place of adrp/add | ||
| // | ||
| // nop => nop/adr instead of adrp/add | ||
| // adr x13, 0x215a18 <_nl_value_type_LC_COLLATE+0x50> | ||
| // ldrh w13, [x13, w12, uxtw #1] | ||
| // adr x12, 0x247b30 <__gettextparse+0x5b0> | ||
| // add x13, x12, w13, sxth #2 | ||
| // br x13 | ||
|
|
||
| .section .text | ||
| .align 4 | ||
| .globl _start | ||
| .type _start, %function | ||
| _start: | ||
| bl test1 | ||
| bl test2 | ||
| // mov x0, #4 | ||
| // mov w8, #93 | ||
| // svc #0 | ||
|
|
||
| // Pattern 1 | ||
| // CHECK: BOLT-WARNING: Failed to match indirect branch: ShiftVAL != 2 | ||
| .globl test1 | ||
| .type test1, %function | ||
| test1: | ||
| mov x1, #0 | ||
| adr x3, datatable | ||
| add x3, x3, x1, lsl #2 | ||
| ldr w2, [x3] | ||
| add x3, x3, w2, sxtw | ||
| br x3 | ||
| test1_0: | ||
| ret | ||
| test1_1: | ||
| ret | ||
| test1_2: | ||
| ret | ||
|
|
||
| // Pattern 2 | ||
| // CHECK: BOLT-WARNING: Failed to match indirect branch: nop/adr instead of adrp/add | ||
| .globl test2 | ||
| .type test2, %function | ||
| test2: | ||
| nop | ||
| adr x3, jump_table | ||
| ldrh w3, [x3, x1, lsl #1] | ||
| adr x1, test2_0 | ||
| add x3, x1, w3, sxth #2 | ||
| br x3 | ||
| test2_0: | ||
| ret | ||
| test2_1: | ||
| ret | ||
|
|
||
| .section .rodata,"a",@progbits | ||
| datatable: | ||
| .word test1_0-datatable | ||
| .word test1_1-datatable | ||
| .word test1_2-datatable | ||
|
|
||
| jump_table: | ||
| .hword (test2_0-test2_0)>>2 | ||
| .hword (test2_1-test2_0)>>2 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| ## Tests function matching in YAMLProfileReader by name similarity. | ||
|
|
||
| # REQUIRES: system-linux | ||
| # RUN: split-file %s %t | ||
| # RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %t/main.s -o %t.o | ||
| # RUN: %clang %cflags %t.o -o %t.exe -Wl,-q -nostdlib | ||
| # RUN: llvm-bolt %t.exe -o %t.out --data %t/yaml -v=2 \ | ||
| # RUN: --print-cfg --name-similarity-function-matching-threshold=1 --funcs=main --profile-ignore-hash=0 2>&1 | FileCheck %s | ||
|
|
||
| # CHECK: BOLT-INFO: matched 1 functions with similar names | ||
|
|
||
| #--- main.s | ||
| .globl main | ||
| .type main, @function | ||
| main: | ||
| .cfi_startproc | ||
| .LBB00: | ||
| pushq %rbp | ||
| movq %rsp, %rbp | ||
| subq $16, %rsp | ||
| testq %rax, %rax | ||
| js .LBB03 | ||
| .LBB01: | ||
| jne .LBB04 | ||
| .LBB02: | ||
| nop | ||
| .LBB03: | ||
| xorl %eax, %eax | ||
| addq $16, %rsp | ||
| popq %rbp | ||
| retq | ||
| .LBB04: | ||
| xorl %eax, %eax | ||
| addq $16, %rsp | ||
| popq %rbp | ||
| retq | ||
| ## For relocations against .text | ||
| .reloc 0, R_X86_64_NONE | ||
| .cfi_endproc | ||
| .size main, .-main | ||
|
|
||
| #--- yaml | ||
| --- | ||
| header: | ||
| profile-version: 1 | ||
| binary-name: 'hashing-based-function-matching.s.tmp.exe' | ||
| binary-build-id: '<unknown>' | ||
| profile-flags: [ lbr ] | ||
| profile-origin: branch profile reader | ||
| profile-events: '' | ||
| dfs-order: false | ||
| hash-func: xxh3 | ||
| functions: | ||
| - name: main2 | ||
| fid: 0 | ||
| hash: 0x0000000000000001 | ||
| exec: 1 | ||
| nblocks: 5 | ||
| blocks: | ||
| - bid: 1 | ||
| insns: 1 | ||
| succ: [ { bid: 3, cnt: 1} ] | ||
| ... |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| //===--- PointerArithmeticOnPolymorphicObjectCheck.cpp - clang-tidy--------===// | ||
| // | ||
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. | ||
| // See https://llvm.org/LICENSE.txt for license information. | ||
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | ||
| // | ||
| //===----------------------------------------------------------------------===// | ||
|
|
||
| #include "PointerArithmeticOnPolymorphicObjectCheck.h" | ||
| #include "clang/AST/ASTContext.h" | ||
| #include "clang/ASTMatchers/ASTMatchFinder.h" | ||
|
|
||
| using namespace clang::ast_matchers; | ||
|
|
||
| namespace clang::tidy::bugprone { | ||
|
|
||
| namespace { | ||
| AST_MATCHER(CXXRecordDecl, isAbstract) { return Node.isAbstract(); } | ||
| AST_MATCHER(CXXRecordDecl, isPolymorphic) { return Node.isPolymorphic(); } | ||
| } // namespace | ||
|
|
||
| PointerArithmeticOnPolymorphicObjectCheck:: | ||
| PointerArithmeticOnPolymorphicObjectCheck(StringRef Name, | ||
| ClangTidyContext *Context) | ||
| : ClangTidyCheck(Name, Context), | ||
| IgnoreInheritedVirtualFunctions( | ||
| Options.get("IgnoreInheritedVirtualFunctions", false)) {} | ||
|
|
||
| void PointerArithmeticOnPolymorphicObjectCheck::storeOptions( | ||
| ClangTidyOptions::OptionMap &Opts) { | ||
| Options.store(Opts, "IgnoreInheritedVirtualFunctions", | ||
| IgnoreInheritedVirtualFunctions); | ||
| } | ||
|
|
||
| void PointerArithmeticOnPolymorphicObjectCheck::registerMatchers( | ||
| MatchFinder *Finder) { | ||
| const auto PolymorphicPointerExpr = | ||
| expr(hasType(hasCanonicalType(pointerType(pointee(hasCanonicalType( | ||
| hasDeclaration(cxxRecordDecl(unless(isFinal()), isPolymorphic()) | ||
| .bind("pointee")))))))) | ||
| .bind("pointer"); | ||
|
|
||
| const auto PointerExprWithVirtualMethod = | ||
| expr(hasType(hasCanonicalType( | ||
| pointerType(pointee(hasCanonicalType(hasDeclaration( | ||
| cxxRecordDecl( | ||
| unless(isFinal()), | ||
| anyOf(hasMethod(isVirtualAsWritten()), isAbstract())) | ||
| .bind("pointee")))))))) | ||
| .bind("pointer"); | ||
|
|
||
| const auto SelectedPointerExpr = IgnoreInheritedVirtualFunctions | ||
| ? PointerExprWithVirtualMethod | ||
| : PolymorphicPointerExpr; | ||
|
|
||
| const auto ArraySubscript = arraySubscriptExpr(hasBase(SelectedPointerExpr)); | ||
|
|
||
| const auto BinaryOperators = | ||
| binaryOperator(hasAnyOperatorName("+", "-", "+=", "-="), | ||
| hasEitherOperand(SelectedPointerExpr)); | ||
|
|
||
| const auto UnaryOperators = unaryOperator( | ||
| hasAnyOperatorName("++", "--"), hasUnaryOperand(SelectedPointerExpr)); | ||
|
|
||
| Finder->addMatcher(ArraySubscript, this); | ||
| Finder->addMatcher(BinaryOperators, this); | ||
| Finder->addMatcher(UnaryOperators, this); | ||
| } | ||
|
|
||
| void PointerArithmeticOnPolymorphicObjectCheck::check( | ||
| const MatchFinder::MatchResult &Result) { | ||
| const auto *PointerExpr = Result.Nodes.getNodeAs<Expr>("pointer"); | ||
| const auto *PointeeDecl = Result.Nodes.getNodeAs<CXXRecordDecl>("pointee"); | ||
|
|
||
| diag(PointerExpr->getBeginLoc(), | ||
| "pointer arithmetic on polymorphic object of type %0 can result in " | ||
| "undefined behavior if the dynamic type differs from the pointer type") | ||
| << PointeeDecl << PointerExpr->getSourceRange(); | ||
| } | ||
|
|
||
| } // namespace clang::tidy::bugprone |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| //===--- PointerArithmeticOnPolymorphicObjectCheck.h ------------*- C++ -*-===// | ||
| // | ||
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. | ||
| // See https://llvm.org/LICENSE.txt for license information. | ||
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | ||
| // | ||
| //===----------------------------------------------------------------------===// | ||
|
|
||
| #ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_BUGPRONE_POINTERARITHMETICONPOLYMORPHICOBJECTCHECK_H | ||
| #define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_BUGPRONE_POINTERARITHMETICONPOLYMORPHICOBJECTCHECK_H | ||
|
|
||
| #include "../ClangTidyCheck.h" | ||
|
|
||
| namespace clang::tidy::bugprone { | ||
|
|
||
| /// Finds pointer arithmetic performed on classes that contain a | ||
| /// virtual function. | ||
| /// | ||
| /// For the user-facing documentation see: | ||
| /// http://clang.llvm.org/extra/clang-tidy/checks/bugprone/pointer-arithmetic-on-polymorphic-object.html | ||
| class PointerArithmeticOnPolymorphicObjectCheck : public ClangTidyCheck { | ||
| public: | ||
| PointerArithmeticOnPolymorphicObjectCheck(StringRef Name, | ||
| ClangTidyContext *Context); | ||
| void storeOptions(ClangTidyOptions::OptionMap &Opts) override; | ||
| void registerMatchers(ast_matchers::MatchFinder *Finder) override; | ||
| void check(const ast_matchers::MatchFinder::MatchResult &Result) override; | ||
| bool isLanguageVersionSupported(const LangOptions &LangOpts) const override { | ||
| return LangOpts.CPlusPlus; | ||
| } | ||
| std::optional<TraversalKind> getCheckTraversalKind() const override { | ||
| return TK_IgnoreUnlessSpelledInSource; | ||
| } | ||
|
|
||
| private: | ||
| const bool IgnoreInheritedVirtualFunctions; | ||
| }; | ||
|
|
||
| } // namespace clang::tidy::bugprone | ||
|
|
||
| #endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_BUGPRONE_POINTERARITHMETICONPOLYMORPHICOBJECTCHECK_H |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| .. title:: clang-tidy - bugprone-pointer-arithmetic-on-polymorphic-object | ||
|
|
||
| bugprone-pointer-arithmetic-on-polymorphic-object | ||
| ================================================= | ||
|
|
||
| Finds pointer arithmetic performed on classes that contain a virtual function. | ||
|
|
||
| Pointer arithmetic on polymorphic objects where the pointer's static type is | ||
| different from its dynamic type is undefined behavior, as the two types could | ||
| have different sizes, and thus the vtable pointer could point to an | ||
| invalid address. | ||
|
|
||
| Finding pointers where the static type contains a virtual member function is a | ||
| good heuristic, as the pointer is likely to point to a different, | ||
| derived object. | ||
|
|
||
| Example: | ||
|
|
||
| .. code-block:: c++ | ||
|
|
||
| struct Base { | ||
| virtual void ~Base(); | ||
| }; | ||
|
|
||
| struct Derived : public Base {}; | ||
|
|
||
| void foo() { | ||
| Base *b = new Derived[10]; | ||
| b += 1; | ||
| // warning: pointer arithmetic on class that declares a virtual function can | ||
| // result in undefined behavior if the dynamic type differs from the | ||
| // pointer type | ||
|
|
||
| delete[] static_cast<Derived*>(b); | ||
| } | ||
|
|
||
| Options | ||
| ------- | ||
|
|
||
| .. option:: IgnoreInheritedVirtualFunctions | ||
|
|
||
| When `true`, objects that only inherit a virtual function are not checked. | ||
| Classes that do not declare a new virtual function are excluded | ||
| by default, as they make up the majority of false positives. | ||
| Default: `false`. | ||
|
|
||
| .. code-block:: c++ | ||
|
|
||
| void bar() { | ||
| Base *b = new Base[10]; | ||
| b += 1; // warning, as Base declares a virtual destructor | ||
| delete[] b; | ||
|
|
||
| Derived *d = new Derived[10]; // Derived overrides the destructor, and | ||
| // declares no other virtual functions | ||
| d += 1; // warning only if IgnoreVirtualDeclarationsOnly is set to false | ||
| delete[] d; | ||
| } | ||
|
|
||
| References | ||
| ---------- | ||
|
|
||
| This check corresponds to the SEI Cert rule | ||
| `CTR56-CPP. Do not use pointer arithmetic on polymorphic objects | ||
| <https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR56-CPP.+Do+not+use+pointer+arithmetic+on+polymorphic+objects>`_. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| .. title:: clang-tidy - cert-ctr56-cpp | ||
| .. meta:: | ||
| :http-equiv=refresh: 5;URL=../bugprone/pointer-arithmetic-on-polymorphic-object.html | ||
|
|
||
| cert-ctr56-cpp | ||
| ============== | ||
|
|
||
| The `cert-ctr56-cpp` check is an alias, please see | ||
| :doc:`bugprone-pointer-arithmetic-on-polymorphic-object | ||
| <../bugprone/pointer-arithmetic-on-polymorphic-object>` for more information. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| // RUN: %check_clang_tidy %s bugprone-pointer-arithmetic-on-polymorphic-object %t -- | ||
|
|
||
| class Base { | ||
| public: | ||
| virtual ~Base() {} | ||
| }; | ||
|
|
||
| class Derived : public Base {}; | ||
|
|
||
| class FinalDerived final : public Base {}; | ||
|
|
||
| class AbstractBase { | ||
| public: | ||
| virtual void f() = 0; | ||
| virtual ~AbstractBase() {} | ||
| }; | ||
|
|
||
| class AbstractInherited : public AbstractBase {}; | ||
|
|
||
| class AbstractOverride : public AbstractInherited { | ||
| public: | ||
| void f() override {} | ||
| }; | ||
|
|
||
| void operators() { | ||
| Base *b = new Derived[10]; | ||
|
|
||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b = b + 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:7: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b++; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| --b; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:5: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b[1]; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| delete[] static_cast<Derived*>(b); | ||
| } | ||
|
|
||
| void subclassWarnings() { | ||
| Base *b = new Base[10]; | ||
|
|
||
| // False positive that's impossible to distinguish without | ||
| // path-sensitive analysis, but the code is bug-prone regardless. | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| delete[] b; | ||
|
|
||
| // Common false positive is a class that overrides all parent functions. | ||
| // Is a warning because of the check configuration. | ||
| Derived *d = new Derived[10]; | ||
|
|
||
| d += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Derived' | ||
|
|
||
| delete[] d; | ||
|
|
||
| // Final classes cannot have a dynamic type. | ||
| FinalDerived *fd = new FinalDerived[10]; | ||
|
|
||
| fd += 1; | ||
| // no-warning | ||
|
|
||
| delete[] fd; | ||
| } | ||
|
|
||
| void abstractWarnings() { | ||
| // Classes with an abstract member funtion are always matched. | ||
| AbstractBase *ab = new AbstractOverride[10]; | ||
|
|
||
| ab += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'AbstractBase' | ||
|
|
||
| delete[] static_cast<AbstractOverride*>(ab); | ||
|
|
||
| AbstractInherited *ai = new AbstractOverride[10]; | ||
|
|
||
| ai += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'AbstractInherited' | ||
|
|
||
| delete[] static_cast<AbstractOverride*>(ai); | ||
|
|
||
| // Is a warning because of the check configuration. | ||
| AbstractOverride *ao = new AbstractOverride[10]; | ||
|
|
||
| ao += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'AbstractOverride' | ||
|
|
||
| delete[] ao; | ||
| } | ||
|
|
||
| template <typename T> | ||
| void templateWarning(T *t) { | ||
| // FIXME: Tidy doesn't support template instantiation locations properly. | ||
| t += 1; | ||
| // no-warning | ||
| } | ||
|
|
||
| void functionArgument(Base *b) { | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| templateWarning(b); | ||
| } | ||
|
|
||
| using BaseAlias = Base; | ||
| using DerivedAlias = Derived; | ||
| using FinalDerivedAlias = FinalDerived; | ||
|
|
||
| using BasePtr = Base*; | ||
| using DerivedPtr = Derived*; | ||
| using FinalDerivedPtr = FinalDerived*; | ||
|
|
||
| void typeAliases(BaseAlias *b, DerivedAlias *d, FinalDerivedAlias *fd, | ||
| BasePtr bp, DerivedPtr dp, FinalDerivedPtr fdp) { | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| d += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Derived' | ||
|
|
||
| fd += 1; | ||
| // no-warning | ||
|
|
||
| bp += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| dp += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Derived' | ||
|
|
||
| fdp += 1; | ||
| // no-warning | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| // RUN: %check_clang_tidy %s bugprone-pointer-arithmetic-on-polymorphic-object %t -- \ | ||
| // RUN: -config="{CheckOptions: \ | ||
| // RUN: {bugprone-pointer-arithmetic-on-polymorphic-object.IgnoreInheritedVirtualFunctions: true}}" | ||
|
|
||
| class Base { | ||
| public: | ||
| virtual ~Base() {} | ||
| }; | ||
|
|
||
| class Derived : public Base {}; | ||
|
|
||
| class FinalDerived final : public Base {}; | ||
|
|
||
| class AbstractBase { | ||
| public: | ||
| virtual void f() = 0; | ||
| virtual ~AbstractBase() {} | ||
| }; | ||
|
|
||
| class AbstractInherited : public AbstractBase {}; | ||
|
|
||
| class AbstractOverride : public AbstractInherited { | ||
| public: | ||
| void f() override {} | ||
| }; | ||
|
|
||
| void operators() { | ||
| Base *b = new Derived[10]; | ||
|
|
||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b = b + 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:7: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b++; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| --b; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:5: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| b[1]; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' can result in undefined behavior if the dynamic type differs from the pointer type [bugprone-pointer-arithmetic-on-polymorphic-object] | ||
|
|
||
| delete[] static_cast<Derived*>(b); | ||
| } | ||
|
|
||
| void subclassWarnings() { | ||
| Base *b = new Base[10]; | ||
|
|
||
| // False positive that's impossible to distinguish without | ||
| // path-sensitive analysis, but the code is bug-prone regardless. | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| delete[] b; | ||
|
|
||
| // Common false positive is a class that overrides all parent functions. | ||
| Derived *d = new Derived[10]; | ||
|
|
||
| d += 1; | ||
| // no-warning | ||
|
|
||
| delete[] d; | ||
|
|
||
| // Final classes cannot have a dynamic type. | ||
| FinalDerived *fd = new FinalDerived[10]; | ||
|
|
||
| fd += 1; | ||
| // no-warning | ||
|
|
||
| delete[] fd; | ||
| } | ||
|
|
||
| void abstractWarnings() { | ||
| // Classes with an abstract member funtion are always matched. | ||
| AbstractBase *ab = new AbstractOverride[10]; | ||
|
|
||
| ab += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'AbstractBase' | ||
|
|
||
| delete[] static_cast<AbstractOverride*>(ab); | ||
|
|
||
| AbstractInherited *ai = new AbstractOverride[10]; | ||
|
|
||
| ai += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'AbstractInherited' | ||
|
|
||
| delete[] static_cast<AbstractOverride*>(ai); | ||
|
|
||
| // If all abstract member functions are overridden, the class is not matched. | ||
| AbstractOverride *ao = new AbstractOverride[10]; | ||
|
|
||
| ao += 1; | ||
| // no-warning | ||
|
|
||
| delete[] ao; | ||
| } | ||
|
|
||
| template <typename T> | ||
| void templateWarning(T *t) { | ||
| // FIXME: Tidy doesn't support template instantiation locations properly. | ||
| t += 1; | ||
| // no-warning | ||
| } | ||
|
|
||
| void functionArgument(Base *b) { | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| templateWarning(b); | ||
| } | ||
|
|
||
| using BaseAlias = Base; | ||
| using DerivedAlias = Derived; | ||
| using FinalDerivedAlias = FinalDerived; | ||
|
|
||
| using BasePtr = Base*; | ||
| using DerivedPtr = Derived*; | ||
| using FinalDerivedPtr = FinalDerived*; | ||
|
|
||
| void typeAliases(BaseAlias *b, DerivedAlias *d, FinalDerivedAlias *fd, | ||
| BasePtr bp, DerivedPtr dp, FinalDerivedPtr fdp) { | ||
| b += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| d += 1; | ||
| // no-warning | ||
|
|
||
| fd += 1; | ||
| // no-warning | ||
|
|
||
| bp += 1; | ||
| // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: pointer arithmetic on polymorphic object of type 'Base' | ||
|
|
||
| dp += 1; | ||
| // no-warning | ||
|
|
||
| fdp += 1; | ||
| // no-warning | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,239 @@ | ||
| Command Line Usage: scan-build and CodeChecker | ||
| ============================================== | ||
|
|
||
| This document provides guidelines for running the static analyzer from the command line on whole projects. | ||
| CodeChecker and scan-build are two CLI tools for using CSA on multiple files (tranlation units). | ||
| Both provide a way of driving the analyzer, detecting compilation flags, and generating reports. | ||
| CodeChecker is more actively maintained, provides heuristics for working with multiple versions of popular compilers and it also comes with a web-based GUI for viewing, filtering, categorizing and suppressing the results. | ||
| Therefore CodeChecker is recommended in case you need any of the above features or just more customizability in general. | ||
|
|
||
| Comparison of CodeChecker and scan-build | ||
| ---------------------------------------- | ||
|
|
||
| The static analyzer is by design a GUI tool originally intended to be consumed by the XCode IDE. | ||
| Its purpose is to find buggy execution paths in the program, and such paths are very hard to comprehend by looking at a non-interactive standard output. | ||
| It is possible, however, to invoke the static analyzer from the command line in order to obtain analysis results, and then later view them interactively in a graphical interface. | ||
| The following tools are used commonly to run the analyzer from the command line. | ||
| Both tools are wrapper scripts to drive the analysis and the underlying invocations of the Clang compiler: | ||
|
|
||
| 1. scan-build_ is an old and simple command line tool that emits static analyzer warnings as HTML files while compiling your project. You can view the analysis results in your web browser. | ||
| - Useful for individual developers who simply want to view static analysis results at their desk, or in a very simple collaborative environment. | ||
| - Works on all major platforms (Windows, Linux, macOS) and is available as a package in many Linux distributions. | ||
| - Does not include support for cross-translation-unit analysis. | ||
|
|
||
| 2. CodeChecker_ is a driver and web server that runs the static analyzer on your projects on demand and maintains a database of issues. | ||
| - Perfect for managing large amounts of thee static analyzer warnings in a collaborative environment. | ||
| - Generally much more feature-rich than scan-build. | ||
| - Supports incremental analysis: Results can be stored in a database, subsequent analysis runs can be compared to list the newly added defects. | ||
| - :doc:`CrossTranslationUnit` is supported fully on Linux via CodeChecker. | ||
| - Can run clang-tidy checkers too. | ||
| - Open source, but out-of-tree, i.e. not part of the LLVM project. | ||
|
|
||
| scan-build | ||
| ---------- | ||
|
|
||
| **scan-build** is a command line utility that enables a user to run the static analyzer over their codebase as part of performing a regular build (from the command line). | ||
|
|
||
| How does it work? | ||
| ~~~~~~~~~~~~~~~~~ | ||
|
|
||
| During a project build, as source files are compiled they are also analyzed in tandem by the static analyzer. | ||
|
|
||
| Upon completion of the build, results are then presented to the user within a web browser. | ||
|
|
||
| Will it work with any build system? | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| **scan-build** has little or no knowledge about how you build your code. It works by overriding the ``CC`` and ``CXX`` environment variables to (hopefully) change your build to use a "fake" compiler instead of the one that would normally build your project. This fake compiler executes either ``clang`` or ``gcc`` (depending on the platform) to compile your code and then executes the static analyzer to analyze your code. | ||
|
|
||
| This "poor man's interposition" works amazingly well in many cases and falls down in others. Please consult the information on this page on making the best use of **scan-build**, which includes getting it to work when the aforementioned hack fails to work. | ||
|
|
||
| .. image:: ../images/scan_build_cmd.png | ||
|
|
||
| .. image:: ../images/analyzer_html.png | ||
|
|
||
| **Viewing static analyzer results in a web browser** | ||
|
|
||
| Basic Usage | ||
| ~~~~~~~~~~~ | ||
|
|
||
| Basic usage of ``scan-build`` is designed to be simple: just place the word "scan-build" in front of your build command:: | ||
|
|
||
| $ scan-build make | ||
| $ scan-build xcodebuild | ||
|
|
||
| In the first case ``scan-build`` analyzes the code of a project built with ``make`` and in the second case ``scan-build`` analyzes a project built using ``xcodebuild``. | ||
|
|
||
| Here is the general format for invoking ``scan-build``:: | ||
|
|
||
| $ scan-build [scan-build options] <command> [command options] | ||
|
|
||
| Operationally, ``scan-build`` literally runs <command> with all of the subsequent options passed to it. For example, one can pass ``-j4`` to ``make`` get a parallel build over 4 cores:: | ||
|
|
||
| $ scan-build make -j4 | ||
|
|
||
| In almost all cases, ``scan-build`` makes no effort to interpret the options after the build command; it simply passes them through. In general, ``scan-build`` should support parallel builds, but **not distributed builds**. | ||
|
|
||
| It is also possible to use ``scan-build`` to analyze specific files:: | ||
|
|
||
| $ scan-build gcc -c t1.c t2.c | ||
|
|
||
| This example causes the files ``t1.c`` and ``t2.c`` to be analyzed. | ||
|
|
||
| For Windows Users | ||
| ~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Windows users must have Perl installed to use scan-build. | ||
|
|
||
| ``scan-build.bat`` script allows you to launch scan-build in the same way as it described in the Basic Usage section above. To invoke scan-build from an arbitrary location, add the path to the folder containing scan-build.bat to your PATH environment variable. | ||
|
|
||
| If you have unexpected compilation/make problems when running scan-build with MinGW/MSYS the following information may be helpful: | ||
|
|
||
| - If getting unexpected ``"fatal error: no input files"`` while building with MSYS make from the Windows cmd, try one of these solutions: | ||
| - Use MinGW ``mingw32-make`` instead of MSYS ``make`` and exclude the path to MSYS from PATH to prevent ``mingw32-make`` from using MSYS utils. MSYS utils are dependent on the MSYS runtime and they are not intended for being run from the Windows cmd. Specifically, makefile commands with backslashed quotes may be heavily corrupted when passed for execution. | ||
| - Run ``make`` from the sh shell:: | ||
|
|
||
| $ scan-build [scan-build options] sh -c "make [make options]" | ||
|
|
||
| - If getting ``"Error : *** target pattern contains no `%'"`` while using GNU Make 3.81, try to use another version of make. | ||
|
|
||
| Other Options | ||
| ~~~~~~~~~~~~~ | ||
|
|
||
| As mentioned above, extra options can be passed to ``scan-build``. These options prefix the build command. For example:: | ||
|
|
||
| $ scan-build -k -V make | ||
| $ scan-build -k -V xcodebuild | ||
|
|
||
| Here is a subset of useful options: | ||
|
|
||
| - **-o**: Target directory for HTML report files. Subdirectories will be created as needed to represent separate "runs" of the analyzer. If this option is not specified, a directory is created in ``/tmp`` to store the reports. | ||
| - **-h** *(or no arguments)*: Display all ``scan-build`` options. | ||
| - **-k**, **--keep-going**: Add a "keep on going" option to the specified build command. This option currently supports ``make`` and ``xcodebuild``. This is a convenience option; one can specify this behavior directly using build options. | ||
| - **-v**: Verbose output from scan-build and the analyzer. **A second and third "-v" increases verbosity**, and is useful for filing bug reports against the analyzer. | ||
| - **-V**: View analysis results in a web browser when the build command completes. | ||
| - **--use-analyzer Xcode** *(or)* **--use-analyzer [path to clang]**: ``scan-build`` uses the 'clang' executable relative to itself for static analysis. One can override this behavior with this option by using the 'clang' packaged with Xcode (on OS X) or from the PATH. | ||
|
|
||
| A complete list of options can be obtained by running ``scan-build`` with no arguments. | ||
|
|
||
| Output of scan-build | ||
| ~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| The output of scan-build is a set of HTML files, each one which represents a separate bug report. A single ``index.html`` file is generated for surveying all of the bugs. You can then just open ``index.html`` in a web browser to view the bug reports. | ||
|
|
||
| Where the HTML files are generated is specified with a **-o** option to ``scan-build``. If **-o** isn't specified, a directory in ``/tmp`` is created to store the files (``scan-build`` will print a message telling you where they are). If you want to view the reports immediately after the build completes, pass **-V** to ``scan-build``. | ||
|
|
||
| Recommended Usage Guidelines | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| This section describes a few recommendations with running the analyzer. | ||
|
|
||
| Always Analyze a Project in its "Debug" Configuration | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Most projects can be built in a "debug" mode that enables assertions. Assertions are picked up by the static analyzer to prune infeasible paths, which in some cases can greatly reduce the number of false positives (bogus error reports) emitted by the tool. | ||
|
|
||
| Another option is to use ``--force-analyze-debug-code`` flag of **scan-build** tool which would enable assertions automatically. | ||
|
|
||
| Use Verbose Output when Debugging scan-build | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| ``scan-build`` takes a **-v** option to emit verbose output about what it's doing; two **-v** options emit more information. Redirecting the output of ``scan-build`` to a text file (make sure to redirect standard error) is useful for filing bug reports against ``scan-build`` or the analyzer, as we can see the exact options (and files) passed to the analyzer. For more comprehensible logs, don't perform a parallel build. | ||
|
|
||
| Run './configure' through scan-build | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| If an analyzed project uses an autoconf generated ``configure`` script, you will probably need to run ``configure`` script through ``scan-build`` in order to analyze the project. | ||
|
|
||
| **Example**:: | ||
|
|
||
| $ scan-build ./configure | ||
| $ scan-build --keep-cc make | ||
|
|
||
| The reason ``configure`` also needs to be run through ``scan-build`` is because ``scan-build`` scans your source files by *interposing* on the compiler. This interposition is currently done by ``scan-build`` temporarily setting the environment variable ``CC`` to ``ccc-analyzer``. The program ``ccc-analyzer`` acts like a fake compiler, forwarding its command line arguments over to the compiler to perform regular compilation and ``clang`` to perform static analysis. | ||
|
|
||
| Running ``configure`` typically generates makefiles that have hardwired paths to the compiler, and by running ``configure`` through ``scan-build`` that path is set to ``ccc-analyzer``. | ||
|
|
||
| Analyzing iPhone Projects | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Conceptually Xcode projects for iPhone applications are nearly the same as their cousins for desktop applications. **scan-build** can analyze these projects as well, but users often encounter problems with just building their iPhone projects from the command line because there are a few extra preparative steps they need to take (e.g., setup code signing). | ||
|
|
||
| Recommendation: use "Build and Analyze" | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| The absolute easiest way to analyze iPhone projects is to use the `Analyze feature in Xcode <https://developer.apple.com/library/ios/recipes/xcode_help-source_editor/chapters/Analyze.html#//apple_ref/doc/uid/TP40009975-CH4-SW1>`_ (which is based on the static analyzer). There a user can analyze their project right from a menu without most of the setup described later. | ||
|
|
||
| `Instructions are available <../xcode.html>`_ on this website on how to use open source builds of the analyzer as a replacement for the one bundled with Xcode. | ||
|
|
||
| Using scan-build directly | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| If you wish to use **scan-build** with your iPhone project, keep the following things in mind: | ||
|
|
||
| - Analyze your project in the ``Debug`` configuration, either by setting this as your configuration with Xcode or by passing ``-configuration Debug`` to ``xcodebuild``. | ||
| - Analyze your project using the ``Simulator`` as your base SDK. It is possible to analyze your code when targeting the device, but this is much easier to do when using Xcode's *Build and Analyze* feature. | ||
| - Check that your code signing SDK is set to the simulator SDK as well, and make sure this option is set to ``Don't Code Sign``. | ||
|
|
||
| Note that you can most of this without actually modifying your project. For example, if your application targets iPhoneOS 2.2, you could run **scan-build** in the following manner from the command line:: | ||
|
|
||
| $ scan-build xcodebuild -configuration Debug -sdk iphonesimulator2.2 | ||
|
|
||
| Alternatively, if your application targets iPhoneOS 3.0:: | ||
|
|
||
| $ scan-build xcodebuild -configuration Debug -sdk iphonesimulator3.0 | ||
|
|
||
| Gotcha: using the right compiler | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Recall that **scan-build** analyzes your project by using a compiler to compile the project and ``clang`` to analyze your project. The script uses simple heuristics to determine which compiler should be used (it defaults to ``clang`` on Darwin and ``gcc`` on other platforms). When analyzing iPhone projects, **scan-build** may pick the wrong compiler than the one Xcode would use to build your project. For example, this could be because multiple versions of a compiler may be installed on your system, especially if you are developing for the iPhone. | ||
|
|
||
| When compiling your application to run on the simulator, it is important that **scan-build** finds the correct version of ``gcc/clang``. Otherwise, you may see strange build errors that only happen when you run ``scan-build``. | ||
|
|
||
| **scan-build** provides the ``--use-cc`` and ``--use-c++`` options to hardwire which compiler scan-build should use for building your code. Note that although you are chiefly interested in analyzing your project, keep in mind that running the analyzer is intimately tied to the build, and not being able to compile your code means it won't get fully analyzed (if at all). | ||
|
|
||
| If you aren't certain which compiler Xcode uses to build your project, try just running ``xcodebuild`` (without **scan-build**). You should see the full path to the compiler that Xcode is using, and use that as an argument to ``--use-cc``. | ||
|
|
||
| CodeChecker | ||
| ----------- | ||
|
|
||
| Basic Usage | ||
| ~~~~~~~~~~~ | ||
|
|
||
| Install CodeChecker as described here: `CodeChecker Install Guide <https://github.com/Ericsson/codechecker/#Install-guide>`_. | ||
|
|
||
| Create a compilation database. If you use cmake then pass the ``-DCMAKE_EXPORT_COMPILE_COMMANDS=1`` parameter to cmake. Cmake will create a ``compile_commands.json`` file. | ||
| If you have a Makefile based or similar build system then you can log the build commands with the help of CodeChecker:: | ||
|
|
||
| make clean | ||
| CodeChecker log -b "make" -o compile_commands.json | ||
|
|
||
| Analyze your project:: | ||
|
|
||
| CodeChecker analyze compile_commands.json -o ./reports | ||
|
|
||
| View the analysis results. | ||
| Print the detailed results in the command line:: | ||
|
|
||
| CodeChecker parse --print-steps ./reports | ||
|
|
||
| Or view the detailed results in a browser:: | ||
|
|
||
| CodeChecker parse ./reports -e html -o ./reports_html | ||
| firefox ./reports_html/index.html | ||
|
|
||
| Optional: store the analysis results in a DB:: | ||
|
|
||
| mkdir ./ws | ||
| CodeChecker server -w ./ws -v 8555 & | ||
| CodeChecker store ./reports --name my-project --url http://localhost:8555/Default | ||
|
|
||
| Optional: manage (categorize, suppress) the results in your web browser:: | ||
|
|
||
| firefox http://localhost:8555/Default | ||
|
|
||
| Detailed Usage | ||
| ~~~~~~~~~~~~~~ | ||
|
|
||
| For extended documentation please refer to the `official site of CodeChecker <https://github.com/Ericsson/codechecker/blob/master/docs/usage.md>`_! | ||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| Filing Bugs and Feature Requests | ||
| ================================ | ||
|
|
||
| We encourage users to file bug reports for any problems that they encounter. | ||
| We also welcome feature requests. When filing a bug report, please do the | ||
| following: | ||
|
|
||
| - Include the checker build (for prebuilt Mac OS X binaries) or the git hash. | ||
|
|
||
| - Provide a self-contained, reduced test case that exhibits the issue you are | ||
| experiencing. | ||
|
|
||
| - Test cases don't tell us everything. Please briefly describe the problem you | ||
| are seeing, including what you thought should have been the expected behavior | ||
| and why. | ||
|
|
||
| Please `file bugs and feature requests <https://llvm.org/docs/HowToSubmitABug.html>`_ | ||
| in `LLVM's issue tracker <https://github.com/llvm/llvm-project/issues>`_ and label the report with the ``clang:static analyzer`` label. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| Obtaining the Static Analyzer | ||
| ============================= | ||
|
|
||
| This page describes how to download and install the analyzer. Once the analyzer is installed, follow the :doc:`CommandLineUsage` on using the command line to get started analyzing your code. | ||
|
|
||
| .. contents:: | ||
| :local: | ||
|
|
||
|
|
||
| Building the Analyzer from Source | ||
| --------------------------------- | ||
|
|
||
| Currently there are no officially supported binary distributions for the static analyzer. | ||
| You must build Clang and LLVM manually. | ||
| To do so, please follow the instructions for `building Clang from source code <https://clang.llvm.org/get_started.html#build>`_. | ||
|
|
||
| Once the Clang is built, you need to add the location of the ``clang`` binary and the locations of the command line utilities (`CodeChecker` or ``scan-build`` and ``scan-view``) to you PATH for :doc:`CommandLineUsage`. | ||
|
|
||
| [Legacy] Packaged Builds (Mac OS X) | ||
| ----------------------------------- | ||
|
|
||
| Semi-regular pre-built binaries of the analyzer used to be available on Mac OS X. These were built to run on OS X 10.7 and later. | ||
|
|
||
| For older builds for MacOS visit https://clang-analyzer.llvm.org/release_notes.html. | ||
|
|
||
| Packaged builds for other platforms may eventually be provided, but we need volunteers who are willing to help provide such regular builds. If you wish to help contribute regular builds of the analyzer on other platforms, please get in touch via `LLVM Discourse <https://discourse.llvm.org/>`_. | ||
|
|
||
| [Legacy] Using Packaged Builds | ||
| ------------------------------ | ||
|
|
||
| To use the legacy pacakge builds, simply unpack it anywhere. If the build archive has the name **``checker-XXX.tar.bz2``** then the archive will expand to a directory called **``checker-XXX``**. You do not need to place this directory or the contents of this directory in any special place. Uninstalling the analyzer is as simple as deleting this directory. | ||
|
|
||
| Most of the files in the **``checker-XXX``** directory will be supporting files for the analyzer that you can simply ignore. Most users will only care about two files, which are located at the top of the **``checker-XXX``** directory: | ||
|
|
||
| * **scan-build**: ``scan-build`` is the high-level command line utility for running the analyzer | ||
| * **scan-view**: ``scan-view`` a companion command line utility to ``scan-build``, ``scan-view`` is used to view analysis results generated by ``scan-build``. There is an option that one can pass to ``scan-build`` to cause ``scan-view`` to run as soon as it the analysis of a build completes | ||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| Running the analyzer within Xcode | ||
| ================================= | ||
|
|
||
| .. contents:: | ||
| :local: | ||
|
|
||
| Since Xcode 3.2, users have been able to run the static analyzer `directly within Xcode <https://developer.apple.com/library/ios/recipes/xcode_help-source_editor/chapters/Analyze.html#//apple_ref/doc/uid/TP40009975-CH4-SW1>`_. | ||
|
|
||
| It integrates directly with the Xcode build system and presents analysis results directly within Xcode's editor. | ||
|
|
||
| Can I use the open source analyzer builds with Xcode? | ||
| ----------------------------------------------------- | ||
|
|
||
| **Yes**. Instructions are included below. | ||
|
|
||
| .. image:: ../images/analyzer_xcode.png | ||
|
|
||
| **Viewing static analyzer results in Xcode** | ||
|
|
||
| Key features: | ||
| ------------- | ||
|
|
||
| - **Integrated workflow:** Results are integrated within Xcode. There is no experience of using a separate tool, and activating the analyzer requires a single keystroke or mouse click. | ||
| - **Transparency:** Works effortlessly with Xcode projects (including iPhone projects). | ||
| - **Cons:** Doesn't work well with non-Xcode projects. For those, consider :doc:`CommandLineUsage`. | ||
|
|
||
| Getting Started | ||
| --------------- | ||
|
|
||
| Xcode is available as a free download from Apple on the `Mac App Store <https://itunes.apple.com/us/app/xcode/id497799835?mt=12>`_, with `instructions available <https://developer.apple.com/library/ios/recipes/xcode_help-source_editor/chapters/Analyze.html#//apple_ref/doc/uid/TP40009975-CH4-SW1>`_ for using the analyzer. | ||
|
|
||
| Using open source analyzer builds with Xcode | ||
| -------------------------------------------- | ||
|
|
||
| By default, Xcode uses the version of ``clang`` that came bundled with it to analyze your code. It is possible to change Xcode's behavior to use an alternate version of ``clang`` for this purpose while continuing to use the ``clang`` that came with Xcode for compiling projects. | ||
|
|
||
| Why try open source builds? | ||
| ---------------------------- | ||
|
|
||
| The advantage of using open source analyzer builds (provided on this website) is that they are often newer than the analyzer provided with Xcode, and thus can contain bug fixes, new checks, or simply better analysis. | ||
|
|
||
| On the other hand, new checks can be experimental, with results of variable quality. Users are encouraged to file bug reports (for any version of the analyzer) where they encounter false positives or other issues here: :doc:`FilingBugs`. | ||
|
|
||
| set-xcode-analyzer | ||
| ------------------ | ||
|
|
||
| Starting with analyzer build checker-234, analyzer builds contain a command line utility called ``set-xcode-analyzer`` that allows users to change what copy of ``clang`` that Xcode uses for analysis:: | ||
|
|
||
| $ set-xcode-analyzer -h | ||
| Usage: set-xcode-analyzer [options] | ||
|
|
||
| Options: | ||
| -h, --help show this help message and exit | ||
| --use-checker-build=PATH | ||
| Use the Clang located at the provided absolute path, | ||
| e.g. /Users/foo/checker-1 | ||
| --use-xcode-clang Use the Clang bundled with Xcode | ||
|
|
||
| Operationally, **set-xcode-analyzer** edits Xcode's configuration files to point it to use the version of ``clang`` you specify for static analysis. Within this model it provides you two basic modes: | ||
|
|
||
| - **--use-xcode-clang:** Switch Xcode (back) to using the ``clang`` that came bundled with it for static analysis. | ||
| - **--use-checker-build:** Switch Xcode to using the ``clang`` provided by the specified analyzer build. | ||
|
|
||
| Things to keep in mind | ||
| ---------------------- | ||
|
|
||
| - You should quit Xcode prior to running ``set-xcode-analyzer``. | ||
| - You will need to run ``set-xcode-analyzer`` under **``sudo``** in order to have write privileges to modify the Xcode configuration files. | ||
|
|
||
| Examples | ||
| -------- | ||
|
|
||
| **Example 1**: Telling Xcode to use checker-235:: | ||
|
|
||
| $ pwd | ||
| /tmp | ||
| $ tar xjf checker-235.tar.bz2 | ||
| $ sudo checker-235/set-xcode-analyzer --use-checker-build=/tmp/checker-235 | ||
|
|
||
| Note that you typically won't install an analyzer build in ``/tmp``, but the point of this example is that ``set-xcode-analyzer`` just wants a full path to an untarred analyzer build. | ||
|
|
||
| **Example 2**: Telling Xcode to use a very specific version of ``clang``:: | ||
|
|
||
| $ sudo set-xcode-analyzer --use-checker-build=~/mycrazyclangbuild/bin/clang | ||
|
|
||
| **Example 3**: Resetting Xcode to its default behavior:: | ||
|
|
||
| $ sudo set-xcode-analyzer --use-xcode-clang |
