The project in a nutshell: I have fixed the most annoying false positives and
added support for the custom RTTI of LLVM which became a huge true positive
boost as we now emit warnings on misuse of LLVM casting APIs. All of my patches
(except one D65239) are upstreamed and on by default. The remaining work is to
fix the less annoying and not so common false positives.
I suggest that from now on we pay more attention to these reports, because even though there are still a lot of them, and still definitely not all of them constitute real crashes, they make *much* more sense today than they used to some three months ago. Almost all warnings are actionable and promote better, safer code.
I just spent 2-3 hours cleaning up ~20 warnings on the static analyzer itself, which included writing a test for one real crash that i found that way (and attempting to do the same for a few more potential crashes). The results are in https://reviews.llvm.org/D66847. My (heavily biased) opinion is that it was worth every minute and i basically encourage everybody to try this out again.
Sylvestre Ledru looks after the scan-build web report, but I understand it hit a few issues back in June (it normally updates a few times a week). We also discussed whether there was an automated way for those updates to email the summary to the cfe/llvm dev lists, indicating total warnings, and highlighting any new ones (we punted that discussion until the GSoC was done - btw thank you all!!!).
Improving documentation (and support scripts) on how to get a analyzer report on local builds would be very useful - I've found it tricky to work with on my WSL builds and I tended to just browse the scan-build web report when it was up to date. At the moment I'm just keeping an eye on cppcheck and MSVC analysis reports that I have running in visual studio.
Sylvestre, is there anything i can help you with in order to get the reports page back up?
I'd also indeed love to spam people with warnings that they introduced, even if in the form of a weekly summary. We already have scripts that compare scan-build outputs, but we mostly use them for testing the analyzer itself.
> Improving documentation (and support scripts) on how to get a analyzer report on local builds
(running cmake under scan-build as veeeeery vaguely hinted in http://clang-analyzer.llvm.org/scan-build.html#recommended_autoconf is indeed necessary; it should also be roughly equivalent to -DCMAKE_C_COMPILER_LAUNCHER=ccc-analyzer -DCMAKE_CXX_COMPILER_LAUNCHER=c++-analyzer)
I'm fairly ignorant about Windows specifics though.
I'd also indeed love to spam people with warnings that they introduced, even if in the form of a weekly summary. We already have scripts that compare scan-build outputs, but we mostly use them for testing the analyzer itself.
sure, it would be great to have. Do you have a way to do that currently ?
For Firefox, I have been using codechecker for this: