Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Artur Skawina via Digitalmars-d
On 04/24/14 04:56, Marco Leise via Digitalmars-d wrote: But »1 size_t« doesn't always yield an int result! Compare to It does. That expression *always* yields an int [1]. Assigning the result to a wider type does not affect the value (the overflow has already happened by then). size_t x = 1

Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Marco Leise via Digitalmars-d
Am Thu, 24 Apr 2014 13:11:18 +0200 schrieb Artur Skawina via Digitalmars-d digitalmars-d@puremagic.com: `size_t x = 1 shiftAmount` is definitely not something that should be recommended, see above. Just use the correct type on the lhs of shift operators. auto x = cast(size_t) 1 shiftAmount;

Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Artur Skawina via Digitalmars-d
On 04/24/14 14:49, Marco Leise via Digitalmars-d wrote: Am Thu, 24 Apr 2014 13:11:18 +0200 schrieb Artur Skawina via Digitalmars-d digitalmars-d@puremagic.com: `size_t x = 1 shiftAmount` is definitely not something that should be recommended, see above. Just use the correct type on the

Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Steven Schveighoffer via Digitalmars-d
On Wed, 23 Apr 2014 23:15:01 -0400, Marco Leise marco.le...@gmx.de wrote: Am Wed, 23 Apr 2014 22:56:27 -0400 schrieb Steven Schveighoffer schvei...@yahoo.com: On Wed, 23 Apr 2014 22:56:54 -0400, Marco Leise marco.le...@gmx.de wrote: Am Tue, 21 Jan 2014 04:34:56 + schrieb Brian Schott

Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Marco Leise via Digitalmars-d
Am Thu, 24 Apr 2014 10:26:48 -0400 schrieb Steven Schveighoffer schvei...@yahoo.com: On Wed, 23 Apr 2014 23:15:01 -0400, Marco Leise marco.le...@gmx.de wrote: Am Wed, 23 Apr 2014 22:56:27 -0400 schrieb Steven Schveighoffer schvei...@yahoo.com: On Wed, 23 Apr 2014 22:56:54 -0400, Marco

Re: Static Analysis Tooling / Effective D

2014-04-24 Thread Steven Schveighoffer via Digitalmars-d
On Thu, 24 Apr 2014 15:40:23 -0400, Marco Leise marco.le...@gmx.de wrote: Am Thu, 24 Apr 2014 10:26:48 -0400 schrieb Steven Schveighoffer schvei...@yahoo.com: On Wed, 23 Apr 2014 23:15:01 -0400, Marco Leise marco.le...@gmx.de wrote: Am Wed, 23 Apr 2014 22:56:27 -0400 schrieb Steven

Re: Static Analysis Tooling / Effective D

2014-04-23 Thread Marco Leise via Digitalmars-d
Am Tue, 21 Jan 2014 04:34:56 + schrieb Brian Schott briancsch...@gmail.com: There's a small feature wishlist in the project's README, but I'd like to get some opinions from the newsgroup: What kinds of errors have you seen in your code that you think a static analysis tool could help

Re: Static Analysis Tooling / Effective D

2014-04-23 Thread Steven Schveighoffer via Digitalmars-d
On Wed, 23 Apr 2014 22:56:54 -0400, Marco Leise marco.le...@gmx.de wrote: Am Tue, 21 Jan 2014 04:34:56 + schrieb Brian Schott briancsch...@gmail.com: There's a small feature wishlist in the project's README, but I'd like to get some opinions from the newsgroup: What kinds of errors have

Re: Static Analysis Tooling / Effective D

2014-04-23 Thread Marco Leise via Digitalmars-d
Am Wed, 23 Apr 2014 22:56:27 -0400 schrieb Steven Schveighoffer schvei...@yahoo.com: On Wed, 23 Apr 2014 22:56:54 -0400, Marco Leise marco.le...@gmx.de wrote: Am Tue, 21 Jan 2014 04:34:56 + schrieb Brian Schott briancsch...@gmail.com: There's a small feature wishlist in the

Re: Static Analysis Tooling / Effective D

2014-04-22 Thread Kagamin via Digitalmars-d
Implicit conversion long - size_t - int. Null dereference can sometimes be detected statically, e.g. when the variable is not initialized. Possible null dereference after downcast, though this one can be annoying. I suggest to configure warnings with a config file, as the configuration can

Re: Static Analysis Tooling / Effective D

2014-04-22 Thread Kagamin via Digitalmars-d
Also escape analysis. Bug found by frama-c: http://blog.frama-c.com/index.php?post/2014/02/23/CVE-2013-5914 Quote: Allow me to put it this way: if the Apple SSL bug is a coup from the NSA, then you US citizens are lucky. Our spy agency in Europe is so much better that it does not even have a

Re: Static Analysis Tooling / Effective D

2014-04-21 Thread Brian Schott via Digitalmars-d
I just added two new rules, a check for if/else blocks that are identical and a check for assign expressions where the left and right side of the '=' operator are the same. It found two bugs in Phobos: https://issues.dlang.org/show_bug.cgi?id=12609

Re: Static Analysis Tooling / Effective D

2014-01-23 Thread Walter Bright
On 1/20/2014 8:34 PM, Brian Schott wrote: There's a small feature wishlist in the project's README, but I'd like to get some opinions from the newsgroup: What kinds of errors have you seen in your code that you think a static analysis tool could help with? Here's a great source of potential

Re: Static Analysis Tooling / Effective D

2014-01-22 Thread Jacob Carlborg
On 2014-01-21 22:07, Brian Schott wrote: test.d(10): Error: undefined identifier coverity_warnings In order for this to work the analysis tool would have to distribute a .d or .di file that is imported by any module that needs to suppress warnings. Java has the SuppressWarnings annotation in

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/20/2014 8:34 PM, Brian Schott wrote: I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation, classes with

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Dicebot
On Tuesday, 21 January 2014 at 08:01:47 UTC, Walter Bright wrote: Automated source code formatting would be nice (and it's not as easy as it looks). It has nothing to do with static analysis.

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Dicebot
On Tuesday, 21 January 2014 at 04:34:57 UTC, Brian Schott wrote: I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation,

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Brian Schott
On Tuesday, 21 January 2014 at 08:58:19 UTC, Dicebot wrote: That reminds me about related topic - do we have any pragma / attribute reserved for external tools? So that one could, for example, disable analysis error for specific part of sourc code without disabling it globally? I assume

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Dicebot
On Tuesday, 21 January 2014 at 09:11:37 UTC, Brian Schott wrote: On Tuesday, 21 January 2014 at 08:58:19 UTC, Dicebot wrote: That reminds me about related topic - do we have any pragma / attribute reserved for external tools? So that one could, for example, disable analysis error for specific

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Dicebot
On Tuesday, 21 January 2014 at 09:22:16 UTC, Walter Bright wrote: Coverity (a static analyzer) does checks based on whitespace indentation. It's not a great leap from there to just format it. One can also say that it is not a huge leap for compiler to do the same. Of course all those tool can

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/21/2014 12:54 AM, Dicebot wrote: On Tuesday, 21 January 2014 at 08:01:47 UTC, Walter Bright wrote: Automated source code formatting would be nice (and it's not as easy as it looks). It has nothing to do with static analysis. Coverity (a static analyzer) does checks based on whitespace

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/20/2014 8:34 PM, Brian Schott wrote: I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation, classes with

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/21/2014 12:58 AM, Dicebot wrote: That reminds me about related topic - do we have any pragma / attribute reserved for external tools? So that one could, for example, disable analysis error for specific part of sourc code without disabling it globally? Since we have user defined

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Dicebot
On Tuesday, 21 January 2014 at 09:30:45 UTC, Walter Bright wrote: On 1/21/2014 12:58 AM, Dicebot wrote: That reminds me about related topic - do we have any pragma / attribute reserved for external tools? So that one could, for example, disable analysis error for specific part of sourc code

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Jacob Carlborg
On 2014-01-21 10:33, Dicebot wrote: See reserved namespace reference. It does not need any special support from the language itself but some support from spec that will ensure that those attributes won't conflict with user code and other tools will be helpful. Probably even in form of

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Jacob Carlborg
On 2014-01-21 05:34, Brian Schott wrote: I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation, classes with

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Daniel Murphy
Walter Bright wrote in message news:lbl9ha$i85$1...@digitalmars.com... Automated source code formatting would be nice (and it's not as easy as it looks). That would be great, we could run it on the generated ddmd source and I wouldn't have to fix all the remaining formatting bugs!

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread bearophile
Walter Bright: Coverity (a static analyzer) does checks based on whitespace indentation. This is good to have. Perhaps splitting the compiler in some parts could help people create such tools. Bye, bearophile

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/21/2014 1:33 AM, Dicebot wrote: See reserved namespace reference. It does not need any special support from the language itself but some support from spec that will ensure that those attributes won't conflict with user code and other tools will be helpful. Probably even in form of

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Brian Schott
On Tuesday, 21 January 2014 at 20:26:57 UTC, Walter Bright wrote: On 1/21/2014 1:33 AM, Dicebot wrote: See reserved namespace reference. It does not need any special support from the language itself but some support from spec that will ensure that those attributes won't conflict with user code

Re: Static Analysis Tooling / Effective D

2014-01-21 Thread Walter Bright
On 1/21/2014 1:07 PM, Brian Schott wrote: On Tuesday, 21 January 2014 at 20:26:57 UTC, Walter Bright wrote: @coverity_warnings should do fine (i.e. prefix with your tool name). It's not any harder than coming up with names for your third party library. test.d(10): Error: undefined identifier

Static Analysis Tooling / Effective D

2014-01-20 Thread Brian Schott
I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation, classes with lowercase_names, catching Exception, and a few other

Re: Static Analysis Tooling / Effective D

2014-01-20 Thread Suliman
It would be perfect have plugin for any Text Editor like Sublime

Re: Static Analysis Tooling / Effective D

2014-01-20 Thread Volcz
On Tuesday, 21 January 2014 at 04:34:57 UTC, Brian Schott wrote: I've checked in code to the DScanner project that gives it some basic static analysis capabilities. When run with the --styleCheck option, it will warn about a few things like empty declarations, implicit string concatenation,