5 ms·

Clearly we can have compilers and static analyzers that can catch a lot of what's UB in the standards. To me the only real question is: what should the default

Clearly we can have compilers and static analyzers that can catch a lot of what's UB in the standards. To me the only real question is: what should the default be for your compiler? I don't want to be flooded with warnings when I'm working on a small file of handcrafted near-assembly code but I'm willing to change my compiler/tool options away from some more conservative, non-standard default settings.

eatonphil 3y ago
It isn't super obvious as someone interested in C or C++ what compiler flags and static analyzers I should turn on. I mean (and I'm asking because I'd genuinely like to bookmark someplace) is there a group that keeps an up-to-date list of aggressive flags and static analyzers to use?
- zwieback 3y ago
  Not that I know of, probably something you'll have to dig into based on your use case. I've used Coverity for static analysis, which is great but pricey. We have a corporate license so no-brainer for me.
- soulbadguy 3y ago
  -Wall -Werror (in cland and in think on GCC) is a good way to start. In general, clang is great at warning at UB. Also, address-san is a great tool
- yaantc 3y ago
  For static analysis I use CodeChecker, it's a wrapper on top of the Clang static analyzer and Clang tidy (linter). Now also supports cppcheck, but I disabled it (too many false alarms). It's free and open source, and I find it useful. Make sure you use it with a version of LLVM/Clang with support of Microsoft z3 enabled (it's the case in Debian stable, so should be OK in most distros). For the flags I would start with "-Wall -Werror", then maybe disable some warnings based on the code base / use. All this assuming a GCC/Clang friendly code base.
- dbremner 3y ago
  I'm not sure about static analyzers, but here are the clang warnings I use for my personal C++20 projects. You will get an enormous number of warnings from typical C++ code. I fix all of them, but doubt it would make sense to do so in a commercial environment. -Weverything - this enables every clang warning -Wno-c++98-compat - warns about using newer C++ features -Wno-c++98-compat-pedantic - warns about using newer C++ features -Wno-padded - warns about alignment padding. I optimize struct layout, so this warning only reports on cases I couldn't resolve. -Wno-poison-system-directories - I'm not cross-compiling anything. -Wno-pre-c++20-compat-pedantic - warns about using newer C++ features

eatonphil 3y ago

It isn't super obvious as someone interested in C or C++ what compiler flags and static analyzers I should turn on. I mean (and I'm asking because I'd genuinely like to bookmark someplace) is there a group that keeps an up-to-date list of aggressive flags and static analyzers to use?

zwieback 3y ago
Not that I know of, probably something you'll have to dig into based on your use case. I've used Coverity for static analysis, which is great but pricey. We have a corporate license so no-brainer for me.
soulbadguy 3y ago
-Wall -Werror (in cland and in think on GCC) is a good way to start. In general, clang is great at warning at UB. Also, address-san is a great tool
yaantc 3y ago
For static analysis I use CodeChecker, it's a wrapper on top of the Clang static analyzer and Clang tidy (linter). Now also supports cppcheck, but I disabled it (too many false alarms). It's free and open source, and I find it useful. Make sure you use it with a version of LLVM/Clang with support of Microsoft z3 enabled (it's the case in Debian stable, so should be OK in most distros). For the flags I would start with "-Wall -Werror", then maybe disable some warnings based on the code base / use. All this assuming a GCC/Clang friendly code base.
dbremner 3y ago
I'm not sure about static analyzers, but here are the clang warnings I use for my personal C++20 projects. You will get an enormous number of warnings from typical C++ code. I fix all of them, but doubt it would make sense to do so in a commercial environment. -Weverything - this enables every clang warning -Wno-c++98-compat - warns about using newer C++ features -Wno-c++98-compat-pedantic - warns about using newer C++ features -Wno-padded - warns about alignment padding. I optimize struct layout, so this warning only reports on cases I couldn't resolve. -Wno-poison-system-directories - I'm not cross-compiling anything. -Wno-pre-c++20-compat-pedantic - warns about using newer C++ features