docs/clang_static_analyzer.md

   1 # The Clang Static Analyzer
   2
   3 See the [official clang static analyzer page](http://clang-analyzer.llvm.org/)
   4 for background.
   5
   6 We don't run this regularly (because the analyzer's
   7 [support for C++ isn't great yet](http://clang-analyzer.llvm.org/dev_cxx.html)),
   8 so everything on this page is likely broken. The last time I checked, the
   9 analyzer reported mostly uninteresting things. This assumes you're
  10 [building chromium with clang](clang.md).
  11
  12 You need an llvm checkout to get `scan-build` and `scan-view`; the easiest way
  13 to get that is to run
  14
  15 ```shell
  16 tools/clang/scripts/update.sh --force-local-build --without-android
  17 ```
  18
  19 ## With make
  20
  21 To build base, if you use the make build:
  22
  23 ```
  24 builddir_name=out_analyze \
  25 PATH=$PWD/third_party/llvm-build/Release+Asserts/bin:$PATH  \
  26 third_party/llvm/tools/clang/tools/scan-build/scan-build  \
  27     --keep-going --use-cc clang --use-c++ clang++ \
  28     make -j8 base
  29 ```
  30
  31 (`builddir_name` is set to force a clobber build.)
  32
  33 Once that's done, run `third_party/llvm/tools/clang/tools/scan-view/scan-view`
  34 to see the results; pass in the pass that `scan-build` outputs.
  35
  36 ## With ninja
  37
  38 scan-build does its stuff by mucking with $CC/$CXX, which ninja ignores. gyp
  39 does look at $CC/$CXX however, so you need to first run gyp\_chromium under
  40 scan-build:
  41
  42 ```shell
  43 time GYP_GENERATORS=ninja \
  44 GYP_DEFINES='component=shared_library clang_use_chrome_plugins=0 \
  45     mac_strip_release=0 dcheck_always_on=1' \
  46 third_party/llvm/tools/clang/tools/scan-build/scan-build \
  47     --use-analyzer $PWD/third_party/llvm-build/Release+Asserts/bin/clang \
  48     build/gyp_chromium -Goutput_dir=out_analyze
  49 ```
  50
  51 You then need to run the build under scan-build too, to get a HTML report:
  52
  53 ```shell
  54 time third_party/llvm/tools/clang/tools/scan-build/scan-build \
  55     --use-analyzer $PWD/third_party/llvm-build/Release+Asserts/bin/clang \
  56     ninja -C out_analyze/Release/ base
  57 ```
  58
  59 Then run `scan-view` as described above.
  60
  61 ## Known False Positives
  62
  63 * http://llvm.org/bugs/show_bug.cgi?id=11425
  64
  65 ## Stuff found by the static analyzer
  66
  67 *   https://code.google.com/p/skia/issues/detail?id=399
  68 *   https://code.google.com/p/skia/issues/detail?id=400
  69 *   https://codereview.chromium.org/8308008/
  70 *   https://codereview.chromium.org/8313008/
  71 *   https://codereview.chromium.org/8308009/
  72 *   https://codereview.chromium.org/10031018/
  73 *   https://codereview.chromium.org/12390058/