| OLD | NEW |
| 1 # The Clang Static Analyzer | 1 # The Clang Static Analyzer |
| 2 | 2 |
| 3 See the [official clang static analyzer page](http://clang-analyzer.llvm.org/) | 3 See the [official clang static analyzer page](http://clang-analyzer.llvm.org/) |
| 4 for background. | 4 for background. |
| 5 | 5 |
| 6 We don't run this regularly (because the analyzer's | 6 As of early 2017, we have experimental support for the Clang static analysis |
| 7 [support for C++ isn't great yet](http://clang-analyzer.llvm.org/dev_cxx.html)), | 7 tool in the Chrome build. Warnings generated by the analysis tool are logged |
| 8 so everything on this page is likely broken. The last time I checked, the | 8 to stderr along with other compiler errors at build time. |
| 9 analyzer reported mostly uninteresting things. This assumes you're | |
| 10 [building chromium with clang](clang.md). | |
| 11 | 9 |
| 12 You need an llvm checkout to get `scan-build` and `scan-view`; the easiest way | 10 To enable static analysis for your build, add the following line to your |
| 13 to get that is to run | 11 output directory's `args.gn`: |
| 14 | 12 |
| 15 ```shell | 13 ``` |
| 16 tools/clang/scripts/update.py --force-local-build --without-android | 14 use_clang_static_analyzer = true |
| 17 ``` | 15 ``` |
| 18 | 16 |
| 19 ## With make | 17 The next time you rebuild, you should see static analysis warnings appear inline |
| 18 with the usual Clang build warnings and errors. |
| 20 | 19 |
| 21 To build base, if you use the make build: | 20 ## Future plans/potential issues |
| 22 | 21 * Support for running under GOMA is untested, but will be added shortly if |
| 23 ``` | 22 feasible. |
| 24 builddir_name=out_analyze \ | |
| 25 PATH=$PWD/third_party/llvm-build/Release+Asserts/bin:$PATH \ | |
| 26 third_party/llvm/tools/clang/tools/scan-build/scan-build \ | |
| 27 --keep-going --use-cc clang --use-c++ clang++ \ | |
| 28 make -j8 base | |
| 29 ``` | |
| 30 | |
| 31 (`builddir_name` is set to force a clobber build.) | |
| 32 | |
| 33 Once that's done, run `third_party/llvm/tools/clang/tools/scan-view/scan-view` | |
| 34 to see the results; pass in the pass that `scan-build` outputs. | |
| 35 | |
| 36 ## With ninja | |
| 37 | |
| 38 scan-build does its stuff by mucking with $CC/$CXX, which ninja ignores. gyp | |
| 39 does look at $CC/$CXX however, so you need to first run gyp\_chromium under | |
| 40 scan-build: | |
| 41 | |
| 42 ```shell | |
| 43 time GYP_GENERATORS=ninja \ | |
| 44 GYP_DEFINES='component=shared_library clang_use_chrome_plugins=0 \ | |
| 45 mac_strip_release=0 dcheck_always_on=1' \ | |
| 46 third_party/llvm/tools/clang/tools/scan-build/scan-build \ | |
| 47 --use-analyzer $PWD/third_party/llvm-build/Release+Asserts/bin/clang \ | |
| 48 build/gyp_chromium -Goutput_dir=out_analyze | |
| 49 ``` | |
| 50 | |
| 51 You then need to run the build under scan-build too, to get a HTML report: | |
| 52 | |
| 53 ```shell | |
| 54 time third_party/llvm/tools/clang/tools/scan-build/scan-build \ | |
| 55 --use-analyzer $PWD/third_party/llvm-build/Release+Asserts/bin/clang \ | |
| 56 ninja -C out_analyze/Release/ base | |
| 57 ``` | |
| 58 | |
| 59 Then run `scan-view` as described above. | |
| 60 | |
| 61 ## Known False Positives | |
| 62 | |
| 63 * http://llvm.org/bugs/show_bug.cgi?id=11425 | |
| 64 | |
| 65 ## Stuff found by the static analyzer | |
| 66 | |
| 67 * https://code.google.com/p/skia/issues/detail?id=399 | |
| 68 * https://code.google.com/p/skia/issues/detail?id=400 | |
| 69 * https://codereview.chromium.org/8308008/ | |
| 70 * https://codereview.chromium.org/8313008/ | |
| 71 * https://codereview.chromium.org/8308009/ | |
| 72 * https://codereview.chromium.org/10031018/ | |
| 73 * https://codereview.chromium.org/12390058/ | |
| OLD | NEW |