Static Analyzer (annotations, path sensitive analysis)

Clang Frontend
1

Hi all!

Are there any other or newer possibilities to suppress a specific analyzer warning?

I checked the FAQ and there are two possibilities right now

  • analyzer annotations

  • clang_analzyer macro

I’m interested in C++ code analysis. I found some annotations at the clang analyzer webpage but if I understand it right for C++ I can only use the attribute nonnull or anlyzer_noreturn. Are there other source code annotation I could use?

Is it possible to create some annotation which will suppress only warnings for a given check?

Using the scan-build which checkers are enabled by default?

My last question is in connection with the path sensitive analysis. Could you give me some details how the exploded graph exploration is made or where can i find some information about it? The traversal is made parallel for each path?

Thanks in advance!

Best regards,

George

2

Hi,

There was some discussion several weeks ago about implementing a generalized attribute for the static analyzer. You should look it up, as I recall, it touched the same subjects you’re interested in. I do not think any of it is implemented yet though.

Using the scan-build which checkers are enabled by default?

Any checkers that are not experimental. See lib/StaticAnalyzer/Checkers/Checkers.td for the classification of the checkers.

Gabor

3

Hi all!

Are there any other or newer possibilities to suppress a specific analyzer warning?

I checked the FAQ and there are two possibilities right now

  • analyzer annotations

  • clang_analzyer macro

I’m interested in C++ code analysis. I found some annotations at the clang analyzer webpage but if I understand it right for C++ I can only use the attribute nonnull or anlyzer_noreturn. Are there other source code annotation I could use?

Is it possible to create some annotation which will suppress only warnings for a given check?

Currently, there is no such annotation. I’d say it’s more interesting to allow the user to specify that a given warning is a false positive and ensure that it’s not reported when the project is analyzed in the future. This is something that should be implemented outside of the analyzer itself as part of a continuous integration infrastructure that runs the analyzer. In such a setting the analyzer would need to somehow issue identifiers for bugs, which would persist as the codebase evolves. (CmpRuns.py script is a first step in that direction.)

Is there a specific checker you are having problems with?

Using the scan-build which checkers are enabled by default?

You can disable the specific checkers using -disable-checker [checker name]

My last question is in connection with the path sensitive analysis. Could you give me some details how the exploded graph exploration is made or where can i find some information about it? The traversal is made parallel for each path?

I am not sure if you’ve read the Developer Manual and watched the talk presented at the LLVMDev meeting (http://clang-analyzer.llvm.org/checker_dev_manual.html). These do not go into a lot of detail about the algorithm, but are worth reading. Other than that, your best bets are the code (ExplodedGraph.cpp, CoreEngine,cpp, ExprEngine.cpp) and archives of this mailing list. We also have a couple of specific documents in the docs subfolder of clang.