More static analysis reports (was: llvm / clang / scan-build of the Hurd)

[Justus Winter]

Quoting Thomas Schwinge (2013-10-25 15:48:06)
> > > The static analyzer is good at spotting errors, see [0] for a partial
> > > build of the Hurd using scan-build.
> > 
> > They seem worth having a look at indeed.
> 
> Absolutely!  As well as... obviously... dare I say it: GCC compiler
> warnings.  (I'm aware you fixed several of these already/recently.)
> <http://www.gnu.org/software/hurd/open_issues/code_analysis.html>.

I agree, we should bring the gcc compiler warnings down. I just
finished an almost complete build of the Hurd with the clang static
analyzer, as well as a gnumach build. The results are here:

https://teythoon.cryptobitch.de/qa/2013-11-02

For Hurd I also captured the build log containing all gcc
warnings. The gnumach build log was lost though :/

Two Hurd components fail to build with scan-build, pfinet and
console-client. Something strange is going on there, I bet scan-build
is screwing with the preprocessing step producing colliding function
declarations.

> When I recently read about it somewhere, I've also had the idea about
> feeding the Hurd code into the Coverity scanner, which I think offers
> such a service for Free Software projects.  I also thought about dping
> the same for GNU Mach and glibc, and for each of these, including the
> stub files generated by MIG, for "self-containedness".

Well, with static analysis one needs all the help one can get ;)

There are some quite interesting projects in llvm-land. One is
AddressSanitizer (which crossed into gcc-land with 4.8), a tool
similar to valgrind but using compile time code instrumentation. The
best part is that the compiler part inside gcc already works on the
Hurd, we "just" have to port the runtime library libasan.

The other one is https://github.com/xiw/stack . stack is quite young,
but very promising. It finds optimization-unstable code, i.e. code
that can be optimized away by the compiler exploiting undefined
behavior. stack works fine on my Linux box compiled with llvm-3.4, but
it fails to compile using the llvm-3.2 avaliable on Debian/Hurd.

Cheers,
Justus