[clang-tidy] Not possible to disable specific clang-analyzer checks

[carlosgalvezp]

Running clang-tidy as:

clang-tidy main.cpp -checks=-*,clang-analyzer-core*,-clang-analyzer-core.uninitialized.Assign --list-checks

Displays:

    clang-analyzer-core.CallAndMessage
    clang-analyzer-core.CallAndMessageModeling
    clang-analyzer-core.DivideZero
    clang-analyzer-core.DynamicTypePropagation
    clang-analyzer-core.NonNullParamChecker
    clang-analyzer-core.NonnilStringConstants
    clang-analyzer-core.NullDereference
    clang-analyzer-core.StackAddrEscapeBase
    clang-analyzer-core.StackAddressEscape
    clang-analyzer-core.UndefinedBinaryOperatorResult
    clang-analyzer-core.VLASize
    clang-analyzer-core.builtin.BuiltinFunctions
    clang-analyzer-core.builtin.NoReturnFunctions
    clang-analyzer-core.uninitialized.ArraySubscript
    clang-analyzer-core.uninitialized.Assign                                   <<<<<<<<<< Should be removed
    clang-analyzer-core.uninitialized.Branch
    clang-analyzer-core.uninitialized.CapturedBlockVariable
    clang-analyzer-core.uninitialized.NewArraySize
    clang-analyzer-core.uninitialized.UndefReturn

This behavior does not happen on other checks.

[llvmbot]

@llvm/issue-subscribers-bug

[llvmbot]

@llvm/issue-subscribers-clang-tidy

[firewave]

They can be disabled as a whole via -checks=-clang-analyzer-* though.

[carlosgalvezp]

Yep. I do want to disable only specific checks that are problematic/have false positives, not all of them...

Could it be the dots in the name of the check which is the problem? The other checks don't have dots in the name.

[carlosgalvezp]

If I add --explain-config, I see something interesting:

'clang-analyzer-core.uninitialized.ArraySubscript' is enabled in the command-line option '-checks'.
'clang-analyzer-core.uninitialized.Assign' is enabled in the clang-tidy binary.

So the check is enabled in the binary, not via -checks, and can't be overriden.

[carlosgalvezp]

Digging deep into the code, I find:

  // Always add all core checkers if any other static analyzer check is enabled.
  // This is currently necessary, as other path sensitive checks rely on the
  // core checkers.

I don't quite understand the comment. What are path sensitive checks?

[firewave]

That appears to be a certain type of static analyzer check - hence https://github.com/llvm/llvm-project/tree/main/clang/include/clang/StaticAnalyzer/Core/PathSensitive.

[carlosgalvezp]

@haoNoQ Do you have any insight as to why core CSA checks must be enabled for all other checks to work? Is the comment still valid nowadays?

  // List all static analyzer checkers that our filter enables.
  //
  // Always add all core checkers if any other static analyzer check is enabled.
  // This is currently necessary, as other path sensitive checks rely on the
  // core checkers.
  for (StringRef CheckName : RegisteredCheckers) {
    std::string ClangTidyCheckName((AnalyzerCheckNamePrefix + CheckName).str());

    if (CheckName.startswith("core") ||
        Context.isCheckEnabled(ClangTidyCheckName)) {
      List.emplace_back(std::string(CheckName), true);
    }
  }

[carlosgalvezp]

This was first introduced around 10 years ago here. I don't see many details in the commit message to tell what exactly is it that was failing in the past that needed this to be added. @r4nt do you recall? Is this comment valid today? If I were to remove it, how can I test that things still work as expected? ninja check-clang-tools works just fine without it.