Simply compile and link your program with -faddress-sanitizer flag.
To get a reasonable performance add -O1 or higher.
To get nicer stack traces in error messages add
@@ -93,7 +93,7 @@
-#if defined(__has_feature) && __has_feature(address_sanitizer)
+#if defined(__has_feature) && __has_feature(address_sanitizer)
code that runs only under AddressSanitizer
#else
code that does not run under AddressSanitizer
diff --git a/docs/AnalyzerRegions.html b/docs/AnalyzerRegions.html
index 35708d57c970..f9d333792045 100644
--- a/docs/AnalyzerRegions.html
+++ b/docs/AnalyzerRegions.html
@@ -1,3 +1,5 @@
+
Static Analyzer Design Document: Memory Regions
@@ -59,7 +61,7 @@
Introduction
concerns not only isolates the core analysis engine from the details of
reasoning about program memory but also facilities the option of a client of the
path-sensitive engine to easily swap in different StoreManager implementations
-that internally reason about program memory in very different ways.
+that internally reason about program memory in very different ways.
The rest of this document is divided into two parts. We first discuss region
taxonomy and the semantics of regions. We then discuss the StoreManager
@@ -102,7 +104,7 @@
Because Core Foundation is a C API, the analyzer cannot always tell that a
pointer return value refers to a Core Foundation object. In contrast, it is
trivial for the analyzer to recognize if a pointer refers to a Cocoa object
- (given the Objective-C type system).
+ (given the Objective-C type system).
Placing on C functions: When placing the attribute
@@ -311,16 +311,16 @@
Attribute 'cf_returns_retained'
Running scan-build on this example produces the following output:
-
+
-When the above code is compiled using Objective-C garbage collection (i.e.,
+
When the above code is compiled using Objective-C garbage collection (i.e.,
code is compiled with the flag -fobjc-gc or -fobjc-gc-only),
scan-build produces both the above error (with slightly different text
to indicate the code uses garbage collection) as well as the following warning,
which indicates a leak that occurs only when using garbage
collection:
The Clang Static Analyzer is source code analysis tool that find bugs in C
-and Objective-C programs.
-
-
Currently it can be run either as a standalone
-tool or within Xcode. The standalone tool is
-invoked from the command-line, and is intended to be run in tandem with a build
-of a codebase.
-
-
The analyzer is 100% open source and is part of the Clang project. Like the rest of Clang, the
-analyzer is implemented as a C++ library that can be used by other tools and
-applications.
-
-
Download
-
-
+
-
+
+
+
+
+
+
+
+
+
+
+
+
Clang Static Analyzer
+
+
The Clang Static Analyzer is source code analysis tool that find bugs in C
+and Objective-C programs.
+
+
Currently it can be run either as a standalone
+tool or within Xcode. The standalone tool is
+invoked from the command-line, and is intended to be run in tandem with a build
+of a codebase.
+
+
The analyzer is 100% open source and is part of the Clang project. Like the rest of Clang, the
+analyzer is implemented as a C++ library that can be used by other tools and
+applications.
The Clang Static Analyzer runs in a reasonable amount of time by both
bounding the amount of checking work it will do as well as using clever
-algorithms to reduce the amount of work it must do to find bugs.
+algorithms to reduce the amount of work it must do to find bugs.
False Positives
diff --git a/www/analyzer/installation.html b/www/analyzer/installation.html
index b0e56f82c420..ebccd071cdce 100644
--- a/www/analyzer/installation.html
+++ b/www/analyzer/installation.html
@@ -3,8 +3,8 @@
Obtaining the Static Analyzer
-
-
+
+
diff --git a/www/analyzer/release_notes.html b/www/analyzer/release_notes.html
index 311c5aecd5c8..61546d70bd83 100644
--- a/www/analyzer/release_notes.html
+++ b/www/analyzer/release_notes.html
@@ -3,8 +3,8 @@
Release notes for checker-XXX builds
-
-
+
+
diff --git a/www/analyzer/scan-build.html b/www/analyzer/scan-build.html
index e257407d8658..710fa0f4958f 100644
--- a/www/analyzer/scan-build.html
+++ b/www/analyzer/scan-build.html
@@ -3,8 +3,8 @@
scan-build: running the analyzer from the command line
-
-
+
+
@@ -16,7 +16,7 @@
scan-build: running the analyzer from the command line
-
+
What is it?
@@ -45,11 +45,10 @@
Will it work with any build system?
aforementioned hack fails to work.
-
-
-
-
- Viewing static analyzer results in a web browser
+
+
+
+ Viewing static analyzer results in a web browser
Contents
@@ -101,7 +100,7 @@
Basic Usage
Operationally, scan-build literally runs <command> with all of the
-subsequent options passed to it. For example, one can pass -j4 to
+subsequent options passed to it. For example, one can pass -j4 to
make get a parallel build over 4 cores:
@@ -141,17 +140,17 @@
Other Options
-o
Target directory for HTML report files. Subdirectories
will be created as needed to represent separate "runs" of the analyzer. If this
option is not specified, a directory is created in /tmp to store the
-reports.
+reports.
-
-h (or no arguments)
Display all
+
-h (or no arguments)
Display all
scan-build options.
-
-k --keep-going
Add a "keep on
+
-k --keep-going
Add a "keep on
going" option to the specified build command.
This option currently supports
make and xcodebuild.
This is a convenience option; one
can specify this behavior directly using build options.
-
-v
Verbose output from scan-build and the analyzer. A
+
-v
Verbose output from scan-build and the analyzer. A
second and third "-v" increases verbosity, and is useful for filing bug
reports against the analyzer.
@@ -222,7 +221,7 @@
Run './configure' through scan-build
Running configure typically generates makefiles that have hardwired
paths to the compiler, and by running configure through
-scan-build that path is set to ccc-analyzer.
+scan-build that path is set to ccc-analyzer.
First, all diagnostics produced by clang include full column number
information. The clang command-line compiler driver uses this information
-to print "caret diagnostics".
+to print "point diagnostics".
(IDEs can use the information to display in-line error markup.)
Precise error location in the source is a feature provided by many commercial
compilers, but is generally missing from open source
compilers. This is nice because it makes it very easy to understand exactly
what is wrong in a particular piece of code
-
The caret (the blue "^" character) exactly shows where the problem is, even
+
The point (the blue "^" character) exactly shows where the problem is, even
inside of a string. This makes it really easy to jump to the problem and
helps when multiple instances of the same character occur on a line. (We'll
revisit this more in following examples.)
@@ -51,9 +55,9 @@
Column Numbers and Caret Diagnostics
$ gcc-4.2 -fsyntax-only -Wformat format-strings.c
format-strings.c:91: warning: too few arguments for format
$ clang -fsyntax-only format-strings.c
- format-strings.c:91:13: warning: '.*' specified field precision is missing a matching 'int' argument
- printf("%.*d");
- ^
+ format-strings.c:91:13: warning: '.*' specified field precision is missing a matching 'int' argument
+ printf("%.*d");
+ ^
Range Highlighting for Related Text
@@ -63,7 +67,7 @@
Range Highlighting for Related Text
diagnostics highlight related information. In the following somewhat
nonsensical example you can see that you don't even need to see the original source code to
understand what is wrong based on the Clang error. Because clang prints a
-caret, you know exactly which plus it is complaining about. The range
+point, you know exactly which plus it is complaining about. The range
information highlights the left and right side of the plus which makes it
immediately obvious what the compiler is talking about.
Range information is very useful for
@@ -73,9 +77,9 @@
Range Highlighting for Related Text
$ gcc-4.2 -fsyntax-only t.c
t.c:7: error: invalid operands to binary + (have 'int' and 'struct A')
$ clang -fsyntax-only t.c
- t.c:7:39: error: invalid operands to binary expression ('int' and 'struct A')
- return y + func(y ? ((SomeA.X + 40) + SomeA) / 42 + SomeA.X : SomeA.X);
- ~~~~~~~~~~~~~~ ^ ~~~~~
+ t.c:7:39: error: invalid operands to binary expression ('int' and 'struct A')
+ return y + func(y ? ((SomeA.X + 40) + SomeA) / 42 + SomeA.X : SomeA.X);
+ ~~~~~~~~~~~~~~ ^ ~~~~~
Precision in Wording
@@ -84,7 +88,7 @@
Precision in Wording
out of clang contain exactly the pertinent information about what is wrong and
why. In the example above, we tell you what the inferred types are for
the left and right hand sides, and we don't repeat what is obvious from the
-caret (e.g., that this is a "binary +").
+point (e.g., that this is a "binary +").
Many other examples abound. In the following example, not only do we tell you that there is a problem with the *
and point to it, we say exactly why and tell you what the type is (in case it is
@@ -96,9 +100,9 @@
Precision in Wording
$ gcc-4.2 -fsyntax-only t.c
t.c:5: error: invalid type argument of 'unary *'
$ clang -fsyntax-only t.c
- t.c:5:11: error: indirection requires pointer operand ('int' invalid)
- int y = *SomeA.X;
- ^~~~~~~~
+ t.c:5:11: error: indirection requires pointer operand ('int' invalid)
+ int y = *SomeA.X;
+ ^~~~~~~~
No Pretty Printing of Expressions in Diagnostics
@@ -111,9 +115,9 @@
No Pretty Printing of Expressions in Diagnostics
$ gcc-4.2 -fsyntax-only t.c
#'exact_div_expr' not supported by pp_c_expression#'t.c:12: error: called object is not a function
$ clang -fsyntax-only t.c
- t.c:12:8: error: called object type 'int' is not a function or function pointer
- (P-Q)();
- ~~~~~^
+ t.c:12:8: error: called object type 'int' is not a function or function pointer
+ (P-Q)();
+ ~~~~~^
This can be particularly bad in G++, which often emits errors
@@ -136,9 +140,9 @@
No Pretty Printing of Expressions in Diagnostics
t.cc:9: error: no match for 'operator+' in '(((a*)P) + (*(long int*)(P->foo::<anonymous>.a::_vptr$a + -0x00000000000000020)))->a::bar() + * P'
t.cc:9: error: return-statement with a value, in function returning 'void'
$ clang t.cc
- t.cc:9:18: error: invalid operands to binary expression ('int' and 'foo')
- return P->bar() + *P;
- ~~~~~~~~ ^ ~~
+ t.cc:9:18: error: invalid operands to binary expression ('int' and 'foo')
+ return P->bar() + *P;
+ ~~~~~~~~ ^ ~~
@@ -160,9 +164,9 @@
Typedef Preservation and Selective Unwrapping
$ gcc-4.2 -fsyntax-only t.c
t.c:15: error: invalid operands to binary / (have 'float __vector__' and 'const int *')
$ clang -fsyntax-only t.c
- t.c:15:11: error: can't convert between vector values of different size ('__m128' and 'int const *')
- myvec[1]/P;
- ~~~~~~~~^~
+ t.c:15:11: error: can't convert between vector values of different size ('__m128' and 'int const *')
+ myvec[1]/P;
+ ~~~~~~~~^~
The following example shows where it is useful for the compiler to expose
@@ -173,9 +177,9 @@
Typedef Preservation and Selective Unwrapping
$ gcc-4.2 -fsyntax-only t.c
t.c:13: error: request for member 'x' in something not a structure or union
$ clang -fsyntax-only t.c
- t.c:13:9: error: member reference base type 'pid_t' (aka 'int') is not a structure or union
- myvar = myvar.x;
- ~~~~~ ^
+ t.c:13:9: error: member reference base type 'pid_t' (aka 'int') is not a structure or union
+ myvar = myvar.x;
+ ~~~~~ ^
In C++, type preservation includes retaining any qualification written into type names. For example, if we take a small snippet of code such as:
@@ -204,9 +208,9 @@
Typedef Preservation and Selective Unwrapping
$ g++-4.2 -fsyntax-only t.cpp
t.cpp:9: error: no match for 'operator+=' in 'server += http'
$ clang -fsyntax-only t.cpp
- t.cpp:9:10: error: invalid operands to binary expression ('servers::Server const' and '::services::WebService const *')
- server += http;
- ~~~~~~ ^ ~~~~
+ t.cpp:9:10: error: invalid operands to binary expression ('servers::Server const' and '::services::WebService const *')
+ server += http;
+ ~~~~~~ ^ ~~~~
Naturally, type preservation extends to uses of templates, and Clang retains information about how a particular template specialization (like std::vector<Real>) was spelled within the source code. For example:
@@ -215,9 +219,9 @@
Typedef Preservation and Selective Unwrapping
$ g++-4.2 -fsyntax-only t.cpp
t.cpp:12: error: no match for 'operator=' in 'str = vec'
$ clang -fsyntax-only t.cpp
- t.cpp:12:7: error: incompatible type assigning 'vector<Real>', expected 'std::string' (aka 'class std::basic_string<char>')
- str = vec;
- ^ ~~~
+ t.cpp:12:7: error: incompatible type assigning 'vector<Real>', expected 'std::string' (aka 'class std::basic_string<char>')
+ str = vec;
+ ^ ~~~
Fix-it Hints
@@ -230,18 +234,18 @@
Fix-it Hints
problem. In the following example, Clang warns about the use of a GCC
extension that has been considered obsolete since 1993. The underlined
code should be removed, then replaced with the code below the
-caret line (".x =" or ".y =", respectively).
+point line (".x =" or ".y =", respectively).
$ clang t.c
- t.c:5:28: warning: use of GNU old-style field designator extension
- struct point origin = { x: 0.0, y: 0.0 };
- ~~ ^
- .x =
- t.c:5:36: warning: use of GNU old-style field designator extension
- struct point origin = { x: 0.0, y: 0.0 };
- ~~ ^
- .y =
+ t.c:5:28: warning: use of GNU old-style field designator extension
+ struct point origin = { x: 0.0, y: 0.0 };
+ ~~^
+ .x =
+ t.c:5:36: warning: use of GNU old-style field designator extension
+ struct point origin = { x: 0.0, y: 0.0 };
+ ~~^
+ .y =
"Fix-it" hints are most useful for
@@ -253,10 +257,10 @@
Here's another real world warning that occurs in the "window" Unix package (which
@@ -286,15 +290,15 @@
Automatic Macro Expansion
$ clang -fsyntax-only t.c
- t.c:22:2: warning: type specifier missing, defaults to 'int'
- ILPAD();
- ^
+ t.c:22:2: warning: type specifier missing, defaults to 'int'
+ ILPAD();
+ ^
t.c:17:17: note: instantiated from:
- #define ILPAD() PAD((NROW - tt.tt_row) * 10) /* 1 ms per char */
- ^
+ #define ILPAD() PAD((NROW - tt.tt_row) * 10) /* 1 ms per char */
+ ^
t.c:14:2: note: instantiated from:
- register i; \
- ^
+ register i; \
+ ^
In practice, we've found that Clang's treatment of macros is actually more useful in multiply nested
@@ -308,7 +312,7 @@
Quality of Implementation and Attention to Detail
The following example shows a trivial little tweak, where we tell you to put the semicolon at
the end of the line that is missing it (line 4) instead of at the beginning of
the following line (line 5). This is particularly important with fixit hints
-and caret diagnostics, because otherwise you don't get the important context.
+and point diagnostics, because otherwise you don't get the important context.
@@ -316,10 +320,10 @@
Quality of Implementation and Attention to Detail
t.c: In function 'foo':
t.c:5: error: expected ';' before '}' token
$ clang t.c
- t.c:4:8: error: expected ';' after expression
- bar()
- ^
- ;
+ t.c:4:8: error: expected ';' after expression
+ bar()
+ ^
+ ;
The following example shows much better error recovery than GCC. The message coming out
@@ -330,9 +334,9 @@
Quality of Implementation and Attention to Detail
$ gcc-4.2 t.c
t.c:3: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token
$ clang t.c
- t.c:3:1: error: unknown type name 'foo_t'
- foo_t *P = 0;
- ^
+ t.c:3:1: error: unknown type name 'foo_t'
+ foo_t *P = 0;
+ ^
The following example shows that we recover from the simple case of
@@ -352,14 +356,14 @@
Quality of Implementation and Attention to Detail
t.cc:4: error: invalid type in declaration before ';' token
t.cc:6: error: expected unqualified-id at end of input
$ clang t.cc
- t.cc:2:11: error: expected ';' after class
- class a {}
- ^
- ;
- t.cc:6:2: error: expected ';' after struct
- }
- ^
- ;
+ t.cc:2:11: error: expected ';' after class
+ class a {}
+ ^
+ ;
+ t.cc:6:2: error: expected ';' after struct
+ }
+ ^
+ ;
While each of these details is minor, we feel that they all add up to provide
diff --git a/www/features.html b/www/features.html
index 9e342ea0eca5..d55391a34fb4 100644
--- a/www/features.html
+++ b/www/features.html
@@ -2,10 +2,10 @@
"http://www.w3.org/TR/html4/strict.dtd">
-
+
Clang - Features and Goals
-
-
+
+
@@ -71,7 +71,8 @@
is significantly quicker than gcc and uses less memory For example, when
compiling "Carbon.h" on Mac OS/X, we see that clang is 2.5x faster than GCC:
-
+
Carbon.h is a monster: it transitively includes 558 files, 12.3M of code,
declares 10000 functions, has 2000 struct definitions, 8000 fields, 20000 enum
@@ -94,7 +95,8 @@
fit into memory at a time (useful for whole program analysis tools, for
example).
-
+
Here we see a huge advantage of clang: its ASTs take 5x less memory
than GCC's syntax trees, despite the fact that clang's ASTs capture far more
@@ -107,7 +109,8 @@
with it. This means that it is often possible to apply out-of-the-box thinking
and novel techniques to improve compilation in various ways.
-
+
This slide shows how the clang preprocessor can be used to make "distcc"
parallelization 3x more scalable than when using the GCC preprocessor.
@@ -149,8 +152,8 @@
and makes it easier for new developers to get involved (because they only need
to understand small pieces of the big picture).
-
+
"The world needs better compiler tools, tools which are built as libraries.
This design point allows reuse of the tools in new and novel ways. However,
building the tools as libraries isn't enough: they must have clean APIs, be as
decoupled from each other as possible, and be easy to modify/extend. This
requires clean layering, decent design, and keeping the libraries independent of
-any specific client."
+any specific client."
Currently, clang is divided into the following libraries and tool:
@@ -295,7 +298,7 @@
Clang has always been designed as a platform for experimentation,
allowing programmers to easily extend the compiler to support great
diff --git a/www/get_started.html b/www/get_started.html
index 8d91a1fa20e8..ca9911297164 100644
--- a/www/get_started.html
+++ b/www/get_started.html
@@ -2,10 +2,10 @@
"http://www.w3.org/TR/html4/strict.dtd">
Change directory to where you want the llvm directory placed.
svn co http://llvm.org/svn/llvm-project/llvm/trunk llvm
-
Checkout Clang:
+
+
Checkout Clang:
cd llvm/tools
svn co http://llvm.org/svn/llvm-project/cfe/trunk clang
-
Checkout Compiler-RT:
+
+
Checkout Compiler-RT:
cd llvm/projects
svn co http://llvm.org/svn/llvm-project/compiler-rt/trunk
compiler-rt
-
Build LLVM and Clang:
+
+
Build LLVM and Clang:
cd ../.. (back to where you started)
mkdir build (for building without polluting the source dir)
@@ -72,15 +75,15 @@
On Unix-like Systems
This builds both LLVM and Clang for debug mode.
Note: For subsequent Clang development, you can just do make at the
clang directory level.
+
It is also possible to use CMake instead of the makefiles. With CMake
+ it is also possible to generate project files for several IDEs: Eclipse
+ CDT4, CodeBlocks, Qt-Creator (use the CodeBlocks generator), KDevelop3.
-
-
It is also possible to use CMake instead of the makefiles. With CMake it
- is also possible to generate project files for several IDEs: Eclipse CDT4,
- CodeBlocks, Qt-Creator (use the CodeBlocks generator), KDevelop3.
+
If you intend to work on Clang C++ support, you may need to tell it how
to find your C++ standard library headers. If Clang cannot find your
- system libstdc++ headers, please follow these instructions:
+ system libstdc++ headers, please follow these instructions:
'gcc -v -x c++ /dev/null -fsyntax-only' to get the
path.
@@ -88,7 +91,8 @@
On Unix-like Systems
hard-coded paths" in clang/lib/Frontend/InitHeaderSearch.cpp and
change the lines below to include that path.
-
Try it out (assuming you add llvm/Debug+Asserts/bin to your path):
+
+
Try it out (assuming you add llvm/Debug+Asserts/bin to your path):
clang --help
clang file.c -fsyntax-only (check for correctness)
If you used the make VERBOSE=1 option, the terminal
output will reflect the error messages from the compiler and
@@ -210,10 +214,10 @@
Testing on the Command Line
To run all the tests from the command line, execute a command like
the following:
-
+
python (path to llvm)/llvm/utils/lit/lit.py -sv --no-progress-bar
(path to llvm)/llvm/tools/clang/test
-
+
For CMake builds e.g. on Windows with Visual Studio, you will need
to specify your build configuration (Debug, Release, etc.) via
@@ -221,31 +225,31 @@
Testing on the Command Line
To run a single test:
-
+
python (path to llvm)/llvm/utils/lit/lit.py -sv --no-progress-bar
(path to llvm)/llvm/tools/clang/test/(dir)/(test)
-
Measurements are done by serially processing each file in the
respective benchmark, using Clang, gcc, and llvm-gcc as compilers. In
order to track the performance of various subsystems the timings have
-been broken down into separate stages where possible:
+been broken down into separate stages where possible:
-Eonly: This option runs the preprocessor but does not
@@ -65,7 +64,6 @@
Unlike the Sketch timings, compilation of 176.gcc
involves a large amount of code generation. The time spent in Clang's
diff --git a/www/performance-2009-03-02.html b/www/performance-2009-03-02.html
index f76fc7a0094d..3e8c41110536 100644
--- a/www/performance-2009-03-02.html
+++ b/www/performance-2009-03-02.html
@@ -2,10 +2,10 @@
"http://www.w3.org/TR/html4/strict.dtd">
-
+
Clang - Performance
-
-
+
+
@@ -20,7 +20,7 @@
Clang - Performance
This page shows the compile time performance of Clang on two
-interesting benchmarks:
+interesting benchmarks:
Sketch: The Objective-C example application shipped on
Mac OS X as part of Xcode. Sketch is indicative of a
@@ -37,7 +37,6 @@
Clang - Performance
dependencies. This stresses the back-end's performance on generating
assembly code and debug information.
-
For previous performance numbers, please
@@ -57,7 +56,7 @@
have been broken down into separate stages where possible. This is
done by over-riding the CC environment variable used during the build
to point to one of a few simple shell scripts which may skip part of
-the build.
+the build.
non-compiler: The overhead of the build system itself;
@@ -78,7 +77,6 @@
+ assembler: Add assembler time to generate .o files.
+ linker: Add linker time.
-
This set of stages is chosen to be approximately additive, that is
each subsequent stage simply adds some additional processing. The
@@ -99,12 +97,12 @@
have been broken down into separate stages where possible. This is
done by over-riding the CC environment variable used during the build
to point to one of a few simple shell scripts which may skip part of
-the build.
+the build.
non-compiler: The overhead of the build system itself;
@@ -73,7 +72,6 @@
+ assembler: Add assembler time to generate .o files.
+ linker: Add linker time.
-
This set of stages is chosen to be approximately additive, that is each
subsequent stage simply adds some additional processing. The timings measure the
@@ -93,12 +91,12 @@