<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Yes, multiple bugs can be reported. For example:<br><br>$ cat test.c<br>void test(int flag) {<br> int *a, *b;<br> if (flag)<br> *a = 1;<br> else<br> *b = 1;<br>}<br><br>$ clang --analyze test.c<br>test.c:4:4: warning: Dereference of undefined pointer value<br> *a = 1;<br> ^<br>test.c:6:4: warning: Dereference of undefined pointer value<br> *b = 1;<br> ^<br>2 warnings generated.<br><br><br>However, if I had wrote the code as follows, only one is reported:<br><br>$ cat test2.c<br>void test(int flag) {<br> int *a, *b;<br> *a = 1;<br> *b = 1;<br>}<br><br>$ clang --analyze test2.c<br>test2.c:3:3: warning: Dereference of undefined pointer value<br> *a = 1;<br> ^<br>1 warning generated.<br><br><br>In the second case, the use of 'a' would constitute a fail-stop bug along the path, so further analysis is meaningless. Contrast this with the GCC's -Wuninitialized warning (which clang will also eventually support):<br><br>$ gcc -Wuninitialized -O2 test2.c<br>test2.c: In function ‘test’:<br>test2.c:3: warning: ‘a’ is used uninitialized in this function<br>test2.c:4: warning: ‘b’ is used uninitialized in this function<br><br><br>In GCC's case, it is doing a simple dataflow analysis that doesn't take into account value or path-dependencies, so it flags both issues. There's tradeoffs here; with the static analyzer, one will eventually find the second bug by fixing the first one, but it gets more reliable path results by doing the pruning.<div><br><div><div>On Nov 21, 2010, at 4:20 PM, J Green wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><br><br>
<div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">J Green</b> <span dir="ltr"><<a href="mailto:greenabc99@gmail.com">greenabc99@gmail.com</a>></span><br>Date: 2010/11/21<br>
Subject: Re: [cfe-dev] Does clang analyzer can only report one warning?<br>To: Ted Kremenek <<a href="mailto:kremenek@apple.com">kremenek@apple.com</a>><br><br><br>Hi, Ted<br> First of all, thank for your quick reply.<br>
But I still puzzled for such case: if there exists several same kind of bugs, such as uninitialized variables, for example, a and b is two uninitialized variables, they do not have any relationship (they are in different paths), would they be reported by clang at the same time(give two uninitialized warning messages at the same time)?<br>
<br>Thanks again.<br><br> <br><br>
<div class="gmail_quote">2010/11/19 Ted Kremenek <span dir="ltr"><<a href="mailto:kremenek@apple.com" target="_blank">kremenek@apple.com</a>></span>
<div>
<div></div>
<div class="h5"><br>
<blockquote style="border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid; margin-top: 0pt; margin-right: 0pt; margin-bottom: 0pt; margin-left: 0.8ex; padding-left: 1ex; position: static; z-index: auto; " class="gmail_quote">For some bugs, such as uses of uninitialized variables or a null dereference, the analyzer stops analyzing a given path because the semantics would potentially be meaningless after the point of the bug. If the second bug is dominated by one of these other fail stop bugs, it won't be reported until the other bug is resolved. It's a tradeoff; the idea is that people will fix issues, run the analyzer again and uncover new ones, etc.<br>
<br>Sent from my iPad<br>
<div>
<div></div>
<div><br>On Nov 18, 2010, at 9:18 PM, J Green <<a href="mailto:greenabc99@gmail.com" target="_blank">greenabc99@gmail.com</a>> wrote:<br><br>> Hi, all<br>><br>> I just want to use clang static analyzer, the command is : "clang --analyze xxx.c" to check xxx.c's errors. but I can only see one warning message,<br>
> for example, one variable is undefined, but there exists another null pointer dereference error after that, why the analyzer can not report null pointer deference warning? Do I miss dothing sth.(e.g. one or more options needed)? or clang analyzer can only report one warning message in one function?<br>
> In other words, How clang analyzer deal with different source errors? To one kind of errors, just report the first one? or To all kind of errors, just report the first one?<br>><br>> Thanks.<br>
> J Green<br></div></div>> _______________________________________________<br>> cfe-dev mailing list<br>> <a href="mailto:cfe-dev@cs.uiuc.edu" target="_blank">cfe-dev@cs.uiuc.edu</a><br>
> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br></blockquote></div></div></div><br></div><br>
_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></div><br></div></body></html>