clang AST based static analysers - Booster's experience
Dear Boost Devs, I was wondering what the experience of the list is with clang AST based static analysers? They need not be clang AST based of course, so long as they are based on the frontend of a real compiler rather than trying their own implementation based on regex or something even worse. For this list's information, here are the three clang AST based static analysers I know of: 1. Clang's static analyser http://clang-analyzer.llvm.org/ 2. OCLint http://oclint.org/ 3. The commercial tool CppDepend can now use a clang AST (http://blog.llvm.org/2013/04/static-analysis-tools-using-clang-in.html). Some quick notes of mine which may be of dubious accuracy: Clang's static analyser is the more mature tool, but according to http://code.google.com/p/chromium/wiki/ClangStaticAnalyzer which was updated Mar 2013 it feels its default bundled C++ tests is lacking. The real strength in the clang static analyser is for writing your own tests (http://clang-analyzer.llvm.org/checker_dev_manual.html) which enforce specific coding patterns or constraints (usually on others, and usually pre-commit with commit rejection if fail). OCLint is a newer tool, but appears to have fuller support for C++ (http://docs.oclint.org/en/dev/rules/index.html), though many of those rules appear to check C syntax only (which also covers Objective C). Similar to clang's static analyser, new custom rules are easy to write (http://docs.oclint.org/en/dev/internals/rules.html). This project, at least from the outside, seems to have more legs than clang's static analyser. CppDepend I have no experience of, but there is a reasonably positive review at http://www.asawicki.info/news_1511_cppdepend.html. One of the CppDepend developers talks about how they added clang's AST at http://www.codeproject.com/Articles/475254/ClangplusRocks. Niall --- Opinions expressed here are my own and do not necessarily represent those of BlackBerry Inc.
participants (1)
-
Niall Douglas