[cfe-dev] Miscellaneous Clang Static Analyzer Questions

[Gianluca Gross via cfe-dev]

Hello all,

I am a student at the University of Pennsylvania, and my senior design 
team is looking to use the Clang Static Analyzer as the basis for our 
code quality app project. We have a few questions about the analyzer if 
you don't mind. Apologies if any of these questions are unclear (I could 
certainly try to clarify in a future email), but we would really 
appreciate it if anyone could provide answers or point us to resources 
that might be helpful.

First off, we are curious how scan-build interacts with build processes 
other than Makefiles. For example, we are considering integrating our 
app with the Travis CI build tool, and we were wondering if there might 
be any resources or previous examples that might help us better 
understand how scan-build interacts with other build commands. I 
understand that this is a vague request, but we would definitely 
appreciate any help!

We are also curious about the differences between the "scan-build" and 
"clang-check" commands for running the analyzer. It seems that 
scan-build is the preferred way to run the analyzer, but is clang-check 
also worth considering? The clang-check command seems useful because it 
allows you to simply run the analyzer on source code rather than 
requiring a build command. Is there any way to make the clang-check 
command output the same HTML output files that are produced by 
scan-build?

Also, for our project, we are looking to parse the "logical traces" that 
the analyzer outputs to report bug alarms (e.g. assuming variable is 
NULL, taking true branch, etc.). Would it be most reliable to parse the 
plist/XML files which are output by scan-build? Since our project will 
rely heavily on this information, we would like to make sure that our 
app is not too sensitive to future changes in the static analyzer. Is 
there some kind of fundamental underlying schema in which this logical 
information is stored, or will the XML files always remain consistent in 
the future?

We also discovered that scan-build has an experimental Cross Translation 
Unit analysis, which seems like it could be great for our project. Is 
there any way we could follow future plans/updates and learn more 
information about the CTU?

Apologies for the long list of questions. Any and all help would be 
appreciated, and thank you in advance!

Best,
Gianluca