[chromium-dev] Current state of Static Analysis and Clang related issues

[s***@ncsu.edu]

I see from the webpage
<https://chromium.googlesource.com/chromium/src/+/master/docs/clang_static_analyzer.md> that
one can use Clang static analyzer locally while building chromium code.

Is there any metabug sort of thing that lists all the (or atleast some)
Clang static analyzer found isseus? The bugs listed (crbug.com/686838,
crbug.com/686829) in this discussion
<https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/IjTujTTCAqA> are
not maintained anymore.

Also, do I need to manually run the static analyzer locally? or I can go up
to some website to see the reports of a recent run by the analyzer?

I'm looking at how projects like chromium use static analyzers and what's
the rate and impact of False Positives reported by these analyzers.

Any useful link (i.e. list of bugs found by clang, clang build results)
would be very much helpful for me.

[Nico Weber]

Someone set up an FYI bot that ran the analyzer a few years ago, but nobody
really ever looked at the output. False positive rate back then was very
high. I hear the analyzer does better on C++ nowadays; I'm not sure anyone
has used it recently. You'd have to run it locally and manually for now.
Let us know how it goes!

Post by s***@ncsu.edu
I see from the webpage
<https://chromium.googlesource.com/chromium/src/+/master/docs/clang_static_analyzer.md> that
one can use Clang static analyzer locally while building chromium code.
Is there any metabug sort of thing that lists all the (or atleast some)
Clang static analyzer found isseus? The bugs listed (crbug.com/686838,
crbug.com/686829) in this discussion
<https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/IjTujTTCAqA> are
not maintained anymore.
Also, do I need to manually run the static analyzer locally? or I can go
up to some website to see the reports of a recent run by the analyzer?
I'm looking at how projects like chromium use static analyzers and what's
the rate and impact of False Positives reported by these analyzers.
Any useful link (i.e. list of bugs found by clang, clang build results)
would be very much helpful for me.
--
--
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups
"Chromium-dev" group.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org?utm_medium=email&utm_source=footer>
.

[Adam Rice]

Need to remove '-analyzer-eagerly-assume' flag
from clang_static_analyzer_wrapper.py to make it work. Output seems to be
mostly false positives. I did find one potential issue:
https://bugs.chromium.org/p/chromium/issues/detail?id=900505.

Post by Nico Weber
Someone set up an FYI bot that ran the analyzer a few years ago, but
nobody really ever looked at the output. False positive rate back then was
very high. I hear the analyzer does better on C++ nowadays; I'm not sure
anyone has used it recently. You'd have to run it locally and manually for
now. Let us know how it goes!

Post by s***@ncsu.edu
I see from the webpage
<https://chromium.googlesource.com/chromium/src/+/master/docs/clang_static_analyzer.md> that
one can use Clang static analyzer locally while building chromium code.
Is there any metabug sort of thing that lists all the (or atleast some)
Clang static analyzer found isseus? The bugs listed (crbug.com/686838,
crbug.com/686829) in this discussion
<https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/IjTujTTCAqA> are
not maintained anymore.
Also, do I need to manually run the static analyzer locally? or I can go
up to some website to see the reports of a recent run by the analyzer?
I'm looking at how projects like chromium use static analyzers and what's
the rate and impact of False Positives reported by these analyzers.
Any useful link (i.e. list of bugs found by clang, clang build results)
would be very much helpful for me.
--
--
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups
"Chromium-dev" group.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org?utm_medium=email&utm_source=footer>
.

--
--
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups
"Chromium-dev" group.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/CAMGbLiEfMQ9z_wR9oEjeWfqzgDRwdvgAPmZ6BPDscJe0uZZcvA%40mail.gmail.com
<https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/CAMGbLiEfMQ9z_wR9oEjeWfqzgDRwdvgAPmZ6BPDscJe0uZZcvA%40mail.gmail.com?utm_medium=email&utm_source=footer>
.

[s***@ncsu.edu]

In that case, is there any other static analyzer in use for Chromium
currently?

Post by Nico Weber
Someone set up an FYI bot that ran the analyzer a few years ago, but
nobody really ever looked at the output. False positive rate back then was
very high. I hear the analyzer does better on C++ nowadays; I'm not sure
anyone has used it recently. You'd have to run it locally and manually for
now. Let us know how it goes!

Post by s***@ncsu.edu
I see from the webpage
<https://chromium.googlesource.com/chromium/src/+/master/docs/clang_static_analyzer.md> that
one can use Clang static analyzer locally while building chromium code.
Is there any metabug sort of thing that lists all the (or atleast some)
Clang static analyzer found isseus? The bugs listed (crbug.com/686838,
crbug.com/686829) in this discussion
<https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/IjTujTTCAqA> are
not maintained anymore.
Also, do I need to manually run the static analyzer locally? or I can go
up to some website to see the reports of a recent run by the analyzer?
I'm looking at how projects like chromium use static analyzers and what's
the rate and impact of False Positives reported by these analyzers.
Any useful link (i.e. list of bugs found by clang, clang build results)
would be very much helpful for me.
--
--
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google Groups
"Chromium-dev" group.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org?utm_medium=email&utm_source=footer>
.

[Nasif Imtiaz]

Also, does anyone have any useful link to that FYI bot that ran Clang (or
any other static analyzer)?
It'd also be useful if anycone can refer me some material that explains how
to integrate such a bot to chromium build phase and where do they fit in
the overall chromium development workflow!

Post by s***@ncsu.edu
In that case, is there any other static analyzer in use for Chromium
currently?

Post by Nico Weber
Someone set up an FYI bot that ran the analyzer a few years ago, but
nobody really ever looked at the output. False positive rate back then was
very high. I hear the analyzer does better on C++ nowadays; I'm not sure
anyone has used it recently. You'd have to run it locally and manually for
now. Let us know how it goes!

Post by s***@ncsu.edu
I see from the webpage
<https://chromium.googlesource.com/chromium/src/+/master/docs/clang_static_analyzer.md> that
one can use Clang static analyzer locally while building chromium code.
Is there any metabug sort of thing that lists all the (or atleast some)
Clang static analyzer found isseus? The bugs listed (crbug.com/686838,
crbug.com/686829) in this discussion
<https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/IjTujTTCAqA> are
not maintained anymore.
Also, do I need to manually run the static analyzer locally? or I can go
up to some website to see the reports of a recent run by the analyzer?
I'm looking at how projects like chromium use static analyzers and
what's the rate and impact of False Positives reported by these analyzers.
Any useful link (i.e. list of bugs found by clang, clang build results)
would be very much helpful for me.
--
--
http://groups.google.com/a/chromium.org/group/chromium-dev
---
You received this message because you are subscribed to the Google
Groups "Chromium-dev" group.
To view this discussion on the web visit
https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org
<https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/b1de4902-df1c-4a68-b876-608afaa14130%40chromium.org?utm_medium=email&utm_source=footer>
.

--
Good Day,

Nasif