3 ms·
Which ones did you try? The only static analyzers that I am allowed to say have stood out to me are: * Clang's static analyzer * GCC's static analyzer with -
by ryao 4y ago
Which ones did you try?
The only static analyzers that I am allowed to say have stood out to me are:
* Clang's static analyzer
* GCC's static analyzer with -Wno-analyzer-malloc-leak -Wno-analyzer-use-of-uninitialized-value -Wno-analyzer-null-dereference because those three checks are uniquely buggy. `-Wanalyzer-null-dereference` fails to understand assertions. `-Wanalyzer-use-of-uninitialized-value` fails to recognize initialization from pass by pointer. `-Wanalyzer-malloc-leak` is so buggy that out of the 32 reports it made, only 1 was real, but it was right before an `exit()` call in a test suite, so it was not a particularly interesting report. Unfortunately, I do not have notes describing why that check is buggy.
Note that I am restricted by Coverity's Scan User Agreement from saying anything involving Coverity that could constitute a comparison. I suggest that you look at the public information about its use by myself and draw your own conclusions. Keep in mind, your conclusions are not things that I said.
- WalterBright 4y agoI think it was PC-something, but it was several years ago. I once told the Coverity staff that the purpose of D was to put Coverity out of business (!)
- ryao 4y agoWas it PC-Lint? That was probably a bad choice. John Carmack did not rate it very highly: http://www.sevangelatos.com/john-carmack-on-static-code-analysis/ http://www.sevangelatos.com/john-carmack-on-static-code-anal...
- WalterBright 4y agoNo, not that one. Maybe PVS-xxxx
- ryao 4y agoHere is a list of almost every known static analysis tool for C++: https://analysis-tools.dev/tag/cpp https://analysis-tools.dev/tag/cpp The only one I know to exist absent from that list is Microsoft’s /analyze. That said, I am surprised that D only has 1 tool listed: https://analysis-tools.dev/tag/dlang https://analysis-tools.dev/tag/dlang
- mre 4y agoMaintainer of the list here. Thanks for mentioning it. I have not heard of Microsoft's analyze. Could you paste a link here? I will add it to the list, then. Alternatively you could send a pull request to the repository. ;) https://github.com/analysis-tools-dev/static-analysis https://github.com/analysis-tools-dev/static-analysis
- ryao 4y agoIt is a static analyzer built into Microsoft Visual Studio: https://learn.microsoft.com/en-us/cpp/build/reference/analyze-code-analysis?view=msvc-170 https://learn.microsoft.com/en-us/cpp/build/reference/analyz... The only reason I know about it is that John Carmack rated it highly: http://www.sevangelatos.com/john-carmack-on-static-code-analysis/ http://www.sevangelatos.com/john-carmack-on-static-code-anal...