clang-diagnostic-error

[ningboRainbow]

Describe the bug
A clear and concise description of what the bug is.
There are 3367 serious errors named clang-diagnostic-error in my scan report,but most of these errors come from the third-party source code.

And I checked the errors in our self-developed code,like "use of undeclared identifier 'components_argument'", but we can compile it successfully，it means that the variable may be defined in other files. Therefore, is this codechecker unable to handle cross file dependency and scanning well?

[csordasmarton]

@ningboRainbow CodeChecker analyze command is able to run the analysis in Cross Translation Unit (ctu) mode with the --ctu option:

cross translation unit analysis arguments:
  
  These arguments are only available if the Clang Static Analyzer supports
  Cross-TU analysis. By default, no CTU analysis is run when
  'CodeChecker analyze' is called.

  --ctu, --ctu-all      Perform Cross Translation Unit (CTU) analysis, both 'collect' and 'analyze' phases. In this mode, the extra files created by 'collect' are cleaned up after the analysis.
  --ctu-collect         Perform the first, 'collect' phase of Cross-TU analysis. This phase generates extra files needed by CTU analysis, and puts them into '<OUTPUT_DIR>/ctu-dir'. NOTE: If this
                        argument is present, CodeChecker will NOT execute the analyzers!
  --ctu-analyze         Perform the second, 'analyze' phase of Cross-TU analysis, using already available extra files in '<OUTPUT_DIR>/ctu-dir'. (These files will not be cleaned up in this
                        mode.)
  --ctu-reanalyze-on-failure
                        DEPRECATED. The flag will be removed. If Cross-TU analysis is enabled and fails for some reason, try to re analyze the same translation unit without Cross-TU enabled.
  --ctu-ast-mode {load-from-pch,parse-on-demand}
                        Choose the way ASTs are loaded during CTU analysis. Only available if CTU mode is enabled. Mode 'load-from-pch' generates PCH format serialized ASTs during the 'collect'
                        phase. Mode 'parse-on-demand' only generates the invocations needed to parse the ASTs. Mode 'load-from-pch' can use significant disk-space for the serialized ASTs, while
                        mode 'parse-on-demand' can incur some runtime CPU overhead in the second phase of the analysis. (default: parse-on-demand)

Also if you don't want to see reports from a third party library, you can use skip files during the analysis to skip these reports:

-i SKIPFILE, --ignore SKIPFILE, --skip SKIPFILE
                        Path to the Skipfile dictating which project files should be omitted from analysis. Please consult the User guide on how a Skipfile should be laid out.

[whisperity]

CodeChecker uses Clang under the hood for analysis. It could be that your project compiles with GCC but doesn't compile with Clang, because it depends on some GCC-specific things.

[ningboRainbow]

@ningboRainbow CodeChecker analyze command is able to run the analysis in Cross Translation Unit (ctu) mode with the --ctu option:

cross translation unit analysis arguments:
  
  These arguments are only available if the Clang Static Analyzer supports
  Cross-TU analysis. By default, no CTU analysis is run when
  'CodeChecker analyze' is called.

  --ctu, --ctu-all      Perform Cross Translation Unit (CTU) analysis, both 'collect' and 'analyze' phases. In this mode, the extra files created by 'collect' are cleaned up after the analysis.
  --ctu-collect         Perform the first, 'collect' phase of Cross-TU analysis. This phase generates extra files needed by CTU analysis, and puts them into '<OUTPUT_DIR>/ctu-dir'. NOTE: If this
                        argument is present, CodeChecker will NOT execute the analyzers!
  --ctu-analyze         Perform the second, 'analyze' phase of Cross-TU analysis, using already available extra files in '<OUTPUT_DIR>/ctu-dir'. (These files will not be cleaned up in this
                        mode.)
  --ctu-reanalyze-on-failure
                        DEPRECATED. The flag will be removed. If Cross-TU analysis is enabled and fails for some reason, try to re analyze the same translation unit without Cross-TU enabled.
  --ctu-ast-mode {load-from-pch,parse-on-demand}
                        Choose the way ASTs are loaded during CTU analysis. Only available if CTU mode is enabled. Mode 'load-from-pch' generates PCH format serialized ASTs during the 'collect'
                        phase. Mode 'parse-on-demand' only generates the invocations needed to parse the ASTs. Mode 'load-from-pch' can use significant disk-space for the serialized ASTs, while
                        mode 'parse-on-demand' can incur some runtime CPU overhead in the second phase of the analysis. (default: parse-on-demand)

Also if you don't want to see reports from a third party library, you can use skip files during the analysis to skip these reports:

-i SKIPFILE, --ignore SKIPFILE, --skip SKIPFILE
                        Path to the Skipfile dictating which project files should be omitted from analysis. Please consult the User guide on how a Skipfile should be laid out.

it doesn't work,my command following this:
CodeChecker analyze --ctu ./compile_commands.json --enable sensitive --output ./reports

[ningboRainbow]

In addition, I have another question, after summarizing the current scanning results, i found that the most of types of defects scanned are as follows:

1. unused parameter 'xxx'
2. use of undeclared identifier 'xxx'
3. invalid suffix 'rdparty_xxx' on integer constant
4. comparison of integers of different signs: 'int' and 'unsigned int'
   But after scanning my project with another tool, i can find some other defect types,such as:
5. memleak
6. nullpointer
7. arrayIndexOutOfBounds
8. bufferAccessOutOfBounds
9. logic
   and i checked my project code and found that these errors were exists. so why these errors were not scanned by codechecker?
   Can it support these defect types to be scanned?

[whisperity]

use of undeclared identifier 'xxx'
invalid suffix 'rdparty_xxx' on integer constant

These are compiler issues, or issues of layout of the code. It might be that a third-party library is not picked up properly, an include directive is missing which your local compiler automatically puts or understands there, but Clang doesn't.

The problem is that if Clang cannot compile the code at hand, it cannot start the analysis properly.

with another tool

For C/C++ projects, CodeChecker uses the Clang Static Analyser and Clang-Tidy as the two analysis routines. The clang binaries are run from your system's install and PATH, so what Clang is capable of depends on which version you have it installed.

There are several checkers, and checker profiles, which can be individually enabled or disabled. There are descriptions about this in the user guide.

arrayIndexOutOfBounds
bufferAccessOutOfBounds

These two classes of errors are supported by the Clang Static Analyser, and these should be enabled by default.