c++linuxcommand-lineclangclang-static-analyzer

How to make the Clang Static Analyzer output its working from command line?


I'm running Clang 3.4 on Ubuntu 12.10 (from http://llvm.org/apt/). I ran the analyzer (clang --analyze) over some code, and it found a couple of issues:

Blah.C:429:9: warning: Declared variable-length array (VLA) has zero size
        unsigned char separatedData[groupDataLength];
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~

But the specific issue isn't important. I want to know the steps of how it came to that conclusion (the code is complex enough for me not to see it within 15 mins).

I see a screenshot from the Clang site that shows steps of working viewed in a web browser:

screenshot

That's probably obtained from Xcode.

The question is: how do I get Clang to output such steps of working from the command line? Or even output results to a browser if it so wishes? This would make the analyzer significantly more useful, and make fixing things much quicker.

(I have noticed that GCC's documentation is very excellent, but Clang/LLVM's documentation is very poor. I've tried "clang --analyze -Xanalyzer '-v'" as a stab in the dark to tell the analyzer to be more verbose -- the -Xanalyzer switch was from the man pages.)


Solution

  • In addition to text output on the console:

    clang++ --analyze -Xanalyzer -analyzer-output=text main.cpp
    

    You can get the full html output:

    clang++ --analyze -Xanalyzer -analyzer-output=html -o html-dir main.cpp
    

    Additionally, you can select specific checkers to enable. This page lists available checks. For example, you can enable all of the C++ checks in the alpha group using the flags:

    -Xanalyzer -analyzer-checker=alpha.cplusplus
    

    http://coliru.stacked-crooked.com/a/7746c4004704d4a7

    main.cpp:5:1: warning: Potential leak of memory pointed to by 'x'
    }
    ^
    main.cpp:4:12: note: Memory is allocated
      int *x = new int;
               ^~~~~~~
    main.cpp:5:1: note: Potential leak of memory pointed to by 'x'
    }
    ^
    

    Apparently the front end exposes

    -analyzer-config <Option Name>=<Value>

    E.g.

    -analyzer-config -analyzer-checker=alpha.cplusplus
    

    which might be better supported than -Xanalyzer and may be getting extended to support options to individual checkers: http://lists.cs.uiuc.edu/pipermail/cfe-dev/2014-October/039552.html