Home | History | Annotate | Line # | Download | only in scripts 
      1 #!/usr/bin/env bash
      2 set -euo pipefail
      3 
      4 git clean -Xfd
      5 
      6 export CC='clang'
      7 export CXX='clang++'
      8 compile_time_malloc_conf='background_thread:true,'\
      9 'metadata_thp:auto,'\
     10 'abort_conf:true,'\
     11 'muzzy_decay_ms:0,'\
     12 'zero_realloc:free,'\
     13 'prof_unbias:false,'\
     14 'prof_time_resolution:high'
     15 extra_flags=(
     16 	-Wmissing-prototypes
     17 	-Wmissing-variable-declarations
     18 	-Wstrict-prototypes
     19 	-Wunreachable-code
     20 	-Wunreachable-code-aggressive
     21 	-Wunused-macros
     22 )
     23 
     24 EXTRA_CFLAGS="${extra_flags[*]}" EXTRA_CXXFLAGS="${extra_flags[*]}" ./autogen.sh \
     25 	--with-private-namespace=jemalloc_ \
     26 	--disable-cache-oblivious \
     27 	--enable-prof \
     28 	--enable-prof-libunwind \
     29 	--with-malloc-conf="$compile_time_malloc_conf" \
     30 	--enable-readlinkat \
     31 	--enable-opt-safety-checks \
     32 	--enable-uaf-detection \
     33 	--enable-force-getenv \
     34 	--enable-debug # Enabling debug for static analysis is important,
     35 	               # otherwise you'll get tons of warnings for things
     36 	               # that are already covered by `assert`s.
     37 
     38 bear -- make -s -j "$(nproc)"
     39 # We end up with lots of duplicate entries in the compilation database, one for
     40 # each output file type (e.g. .o, .d, .sym, etc.). There must be exactly one
     41 # entry for each file in the compilation database in order for
     42 # cross-translation-unit analysis to work, so we deduplicate the database here.
     43 jq '[.[] | select(.output | test("/[^./]*\\.o$"))]' compile_commands.json > compile_commands.json.tmp
     44 mv compile_commands.json.tmp compile_commands.json
     45 
     46 # CodeChecker has a bug where it freaks out if you supply the skipfile via process substitution,
     47 # so we resort to manually creating a temporary file
     48 skipfile=$(mktemp)
     49 # The single-quotes are deliberate here, you want `$skipfile` to be evaluated upon exit
     50 trap 'rm -f $skipfile' EXIT
     51 echo '-**/stdlib.h' > "$skipfile"
     52 CC_ANALYZERS_FROM_PATH=1 CodeChecker analyze compile_commands.json --jobs "$(nproc)" \
     53 	--ctu --compile-uniqueing strict --output static_analysis_raw_results \
     54 	--analyzers clangsa clang-tidy --skip "$skipfile" \
     55 	--enable readability-inconsistent-declaration-parameter-name \
     56 	--enable performance-no-int-to-ptr \
     57 	--disable clang-diagnostic-reserved-macro-identifier
     58 	# `--enable` is additive, the vast majority of the checks we want are
     59 	# enabled by default.
     60 
     61 html_output_dir="${1:-static_analysis_results}"
     62 result=${2:-/dev/null}
     63 # We're echoing a value because we want to indicate whether or not any errors
     64 # were found, but we always want the script to have a successful exit code so
     65 # that we actually reach the step in the GitHub action where we upload the results.
     66 if CodeChecker parse --export html --output "$html_output_dir" static_analysis_raw_results
     67 then
     68 	echo "HAS_STATIC_ANALYSIS_RESULTS=0" >> "$result"
     69 else
     70 	echo "HAS_STATIC_ANALYSIS_RESULTS=1" >> "$result"
     71 fi
     72