Man1 - extraclangtools.1

This document contains the release notes for the Extra Clang Tools, part of the Clang release 13.0.0. Here we describe the status of the Extra Clang Tools in some detail, including major improvements from the previous release and new feature work. All LLVM releases may be downloaded from the LLVM releases web site.

For more information about Clang or LLVM, including information about the latest release, please see the Clang Web Site or the LLVM Web Site.

Note that if you are reading this file from a Git checkout or the main Clang web page, this document applies to the next release, not the current one. To see the release notes for a specific release, please see the releases page.

Some of the major new features and improvements to Extra Clang Tools are listed here. Generic improvements to Extra Clang Tools as a whole or to its underlying infrastructure are described first, followed by tool-specific sections.

…

The improvements are…

The improvements are…

The improvements are…

The improvements are…

• The run-clang-tidy.py helper script is now installed in bin/ as run-clang-tidy. It was previously installed in share/clang/.
• Added command line option –fix-notes to apply fixes found in notes attached to warnings. These are typically cases where we are less confident the fix will have the desired effect.
• libToolingCore and Clang-Tidy was refactored and now checks can produce highlights (^~~~~ under fragments of the source code) in diagnostics. Existing and new checks in the future can be expected to start implementing this functionality. This change only affects the visual rendering of diagnostics, and does not alter the behavior of generated fixes.

• New altera-id-dependent-backward-branch check.

Finds ID-dependent variables and fields that are used within loops. This causes branches to occur inside the loops, and thus leads to performance degradation.

• New altera-unroll-loops check.

Finds inner loops that have not been unrolled, as well as fully unrolled loops with unknown loops bounds or a large number of iterations.

• New bugprone-easily-swappable-parameters check.

Finds function definitions where parameters of convertible types follow each other directly, making call sites prone to calling the function with swapped (or badly ordered) arguments.

• New bugprone-implicit-widening-of-multiplication-result check.

Diagnoses instances of an implicit widening of multiplication result.

• New bugprone-unhandled-exception-at-new check.

Finds calls to new with missing exception handler for std::bad_alloc.

• New concurrency-thread-canceltype-asynchronous check.

Finds pthread_setcanceltype function calls where a thread’s cancellation type is set to asynchronous.

• New cppcoreguidelines-prefer-member-initializer check.

Finds member initializations in the constructor body which can be placed into the initialization list instead.

• New readability-suspicious-call-argument check.

Finds function calls where the arguments passed are provided out of order, based on the difference between the argument name and the parameter names of the function.

• New alias cert-pos47-c to concurrency-thread-canceltype-asynchronous was added.

• Improved bugprone-signal-handler check.

Added an option to choose the set of allowed functions.

• Improved cppcoreguidelines-init-variables check.

Removed generating fixes for enums because the code generated was broken, trying to initialize the enum from an integer.

The check now also warns for uninitialized scoped enums.

• Improved readability-uniqueptr-delete-release check.

Added an option to choose whether to refactor by calling the reset member function or assignment to nullptr. Added support for pointers to std::unique_ptr.

• The readability-deleted-default check has been removed.

The clang warning Wdefaulted-function-deleted will diagnose the same issues and is enabled by default.

The improvements are…

The improvements are…

The improvements are…

The improvements are…

• Clang-Tidy
  • Using clang-tidy
  • Suppressing Undesired Diagnostics

See also:

Check for cases where addition should be performed in the absl::Time domain. When adding two values, and one is known to be an absl::Time, we can infer that the other should be interpreted as an absl::Duration of a similar scale, and make that inference explicit.

Examples:

#+begin_quote

      // Original - Addition in the integer domain
      int x;
      absl::Time t;
      int result = absl::ToUnixSeconds(t) + x;

      // Suggestion - Addition in the absl::Time domain
      int result = absl::ToUnixSeconds(t + absl::Seconds(x));

#+end_quote

Checks for comparisons which should be in the absl::Duration domain instead of the floating point or integer domains.

N.B.: In cases where a Duration was being converted to an integer and then compared against a floating-point value, truncation during the Duration conversion might yield a different result. In practice this is very rare, and still indicates a bug which should be fixed.

Examples:

#+begin_quote

      // Original - Comparison in the floating point domain
      double x;
      absl::Duration d;
      if (x < absl::ToDoubleSeconds(d)) ...

      // Suggested - Compare in the absl::Duration domain instead
      if (absl::Seconds(x) < d) ...


      // Original - Comparison in the integer domain
      int x;
      absl::Duration d;
      if (x < absl::ToInt64Microseconds(d)) ...

      // Suggested - Compare in the absl::Duration domain instead
      if (absl::Microseconds(x) < d) ...

#+end_quote

Checks for casts of absl::Duration conversion functions, and recommends the right conversion function instead.

Examples:

#+begin_quote

      // Original - Cast from a double to an integer
      absl::Duration d;
      int i = static_cast<int>(absl::ToDoubleSeconds(d));

      // Suggested - Use the integer conversion function directly.
      int i = absl::ToInt64Seconds(d);


      // Original - Cast from a double to an integer
      absl::Duration d;
      double x = static_cast<double>(absl::ToInt64Seconds(d));

      // Suggested - Use the integer conversion function directly.
      double x = absl::ToDoubleSeconds(d);

#+end_quote

Note: In the second example, the suggested fix could yield a different result, as the conversion to integer could truncate. In practice, this is very rare, and you should use absl::Trunc to perform this operation explicitly instead.

absl::Duration arithmetic works like it does with integers. That means that division of two absl::Duration objects returns an int64 with any fractional component truncated toward 0. See this link for more information on arithmetic with absl::Duration.

For example:

#+begin_quote

      absl::Duration d = absl::Seconds(3.5);
      int64 sec1 = d / absl::Seconds(1);     // Truncates toward 0.
      int64 sec2 = absl::ToInt64Seconds(d);  // Equivalent to division.
      assert(sec1 == 3 && sec2 == 3);

      double dsec = d / absl::Seconds(1);  // WRONG: Still truncates toward 0.
      assert(dsec == 3.0);

#+end_quote

If you want floating-point division, you should use either the absl::FDivDuration() function, or one of the unit conversion functions such as absl::ToDoubleSeconds(). For example:

#+begin_quote

      absl::Duration d = absl::Seconds(3.5);
      double dsec1 = absl::FDivDuration(d, absl::Seconds(1));  // GOOD: No truncation.
      double dsec2 = absl::ToDoubleSeconds(d);                 // GOOD: No truncation.
      assert(dsec1 == 3.5 && dsec2 == 3.5);

#+end_quote

This check looks for uses of absl::Duration division that is done in a floating-point context, and recommends the use of a function that returns a floating-point value.

Checks for cases where the floating-point overloads of various absl::Duration factory functions are called when the more-efficient integer versions could be used instead.

This check will not suggest fixes for literals which contain fractional floating point values or non-literals. It will suggest removing superfluous casts.

Examples:

#+begin_quote

      // Original - Providing a floating-point literal.
      absl::Duration d = absl::Seconds(10.0);

      // Suggested - Use an integer instead.
      absl::Duration d = absl::Seconds(10);


      // Original - Explicitly casting to a floating-point type.
      absl::Duration d = absl::Seconds(static_cast<double>(10));

      // Suggested - Remove the explicit cast
      absl::Duration d = absl::Seconds(10);

#+end_quote

Checks for cases where arguments to absl::Duration factory functions are scaled internally and could be changed to a different factory function. This check also looks for arguments with a zero value and suggests using absl::ZeroDuration() instead.

Examples:

#+begin_quote

      // Original - Internal multiplication.
      int x;
      absl::Duration d = absl::Seconds(60 * x);

      // Suggested - Use absl::Minutes instead.
      absl::Duration d = absl::Minutes(x);


      // Original - Internal division.
      int y;
      absl::Duration d = absl::Milliseconds(y / 1000.);

      // Suggested - Use absl:::Seconds instead.
      absl::Duration d = absl::Seconds(y);


      // Original - Zero-value argument.
      absl::Duration d = absl::Hours(0);

      // Suggested = Use absl::ZeroDuration instead
      absl::Duration d = absl::ZeroDuration();

#+end_quote

Checks for cases where subtraction should be performed in the absl::Duration domain. When subtracting two values, and the first one is known to be a conversion from absl::Duration, we can infer that the second should also be interpreted as an absl::Duration, and make that inference explicit.

Examples:

#+begin_quote

      // Original - Subtraction in the double domain
      double x;
      absl::Duration d;
      double result = absl::ToDoubleSeconds(d) - x;

      // Suggestion - Subtraction in the absl::Duration domain instead
      double result = absl::ToDoubleSeconds(d - absl::Seconds(x));

      // Original - Subtraction of two Durations in the double domain
      absl::Duration d1, d2;
      double result = absl::ToDoubleSeconds(d1) - absl::ToDoubleSeconds(d2);

      // Suggestion - Subtraction in the absl::Duration domain instead
      double result = absl::ToDoubleSeconds(d1 - d2);

#+end_quote

Note: As with other clang-tidy checks, it is possible that multiple fixes may overlap (as in the case of nested expressions), so not all occurrences can be transformed in one run. In particular, this may occur for nested subtraction expressions. Running clang-tidy multiple times will find and fix these overlaps.

Finds and fixes cases where absl::Duration values are being converted to numeric types and back again.

Floating-point examples:

#+begin_quote

      // Original - Conversion to double and back again
      absl::Duration d1;
      absl::Duration d2 = absl::Seconds(absl::ToDoubleSeconds(d1));

      // Suggestion - Remove unnecessary conversions
      absl::Duration d2 = d1;

      // Original - Division to convert to double and back again
      absl::Duration d2 = absl::Seconds(absl::FDivDuration(d1, absl::Seconds(1)));

      // Suggestion - Remove division and conversion
      absl::Duration d2 = d1;

#+end_quote

Integer examples:

#+begin_quote

      // Original - Conversion to integer and back again
      absl::Duration d1;
      absl::Duration d2 = absl::Hours(absl::ToInt64Hours(d1));

      // Suggestion - Remove unnecessary conversions
      absl::Duration d2 = d1;

      // Original - Integer division followed by conversion
      absl::Duration d2 = absl::Seconds(d1 / absl::Seconds(1));

      // Suggestion - Remove division and conversion
      absl::Duration d2 = d1;

#+end_quote

Unwrapping scalar operations:

#+begin_quote

      // Original - Multiplication by a scalar
      absl::Duration d1;
      absl::Duration d2 = absl::Seconds(absl::ToInt64Seconds(d1) * 2);

      // Suggestion - Remove unnecessary conversion
      absl::Duration d2 = d1 * 2;

#+end_quote

Note: Converting to an integer and back to an absl::Duration might be a truncating operation if the value is not aligned to the scale of conversion. In the rare case where this is the intended result, callers should use absl::Trunc to truncate explicitly.

Finds instances of absl::StrSplit() or absl::MaxSplits() where the delimiter is a single character string literal and replaces with a character. The check will offer a suggestion to change the string literal into a character. It will also catch code using absl::ByAnyChar() for just a single character and will transform that into a single character as well.

These changes will give the same result, but using characters rather than single character string literals is more efficient and readable.

Examples:

#+begin_quote

      // Original - the argument is a string literal.
      for (auto piece : absl::StrSplit(str, "B")) {

      // Suggested - the argument is a character, which causes the more efficient
      // overload of absl::StrSplit() to be used.
      for (auto piece : absl::StrSplit(str, 'B')) {


      // Original - the argument is a string literal inside absl::ByAnyChar call.
      for (auto piece : absl::StrSplit(str, absl::ByAnyChar("B"))) {

      // Suggested - the argument is a character, which causes the more efficient
      // overload of absl::StrSplit() to be used and we do not need absl::ByAnyChar
      // anymore.
      for (auto piece : absl::StrSplit(str, 'B')) {


      // Original - the argument is a string literal inside absl::MaxSplits call.
      for (auto piece : absl::StrSplit(str, absl::MaxSplits("B", 1))) {

      // Suggested - the argument is a character, which causes the more efficient
      // overload of absl::StrSplit() to be used.
      for (auto piece : absl::StrSplit(str, absl::MaxSplits('B', 1))) {

#+end_quote

subl.. title:: clang-tidy - abseil-no-internal-dependencies

Warns if code using Abseil depends on internal details. If something is in a namespace that includes the word “internal”, code is not allowed to depend upon it beaucse it’s an implementation detail. They cannot friend it, include it, you mention it or refer to it in any way. Doing so violates Abseil’s compatibility guidelines and may result in breakage. See https://abseil.io/about/compatibility for more information.

The following cases will result in warnings:

#+begin_quote

      absl::strings_internal::foo();
      // warning triggered on this line
      class foo {
        friend struct absl::container_internal::faa;
        // warning triggered on this line
      };
      absl::memory_internal::MakeUniqueResult();
      // warning triggered on this line

#+end_quote

Ensures code does not open namespace absl as that violates Abseil’s compatibility guidelines. Code should not open namespace absl as that conflicts with Abseil’s compatibility guidelines and may result in breakage.

Any code that uses:

#+begin_quote

      namespace absl {
       ...
      }

#+end_quote

will be prompted with a warning.

See the full Abseil compatibility guidelines for more information.

Suggests removal of unnecessary calls to absl::StrCat when the result is being passed to another call to absl::StrCat or absl::StrAppend.

The extra calls cause unnecessary temporary strings to be constructed. Removing them makes the code smaller and faster.

Examples:

#+begin_quote

      std::string s = absl::StrCat("A", absl::StrCat("B", absl::StrCat("C", "D")));
      //before

      std::string s = absl::StrCat("A", "B", "C", "D");
      //after

      absl::StrAppend(&s, absl::StrCat("E", "F", "G"));
      //before

      absl::StrAppend(&s, "E", "F", "G");
      //after

#+end_quote

Flags uses of absl::StrCat() to append to a std::string. Suggests absl::StrAppend() should be used instead.

The extra calls cause unnecessary temporary strings to be constructed. Removing them makes the code smaller and faster.

#+begin_quote

      a = absl::StrCat(a, b); // Use absl::StrAppend(&a, b) instead.

#+end_quote

Does not diagnose cases where absl::StrCat() is used as a template argument for a functor.

Checks whether a std::string::find() result is compared with 0, and suggests replacing with absl::StartsWith(). This is both a readability and performance issue.

#+begin_quote

      string s = "...";
      if (s.find("Hello World") == 0) { /* do something */ }

#+end_quote

becomes

#+begin_quote

      string s = "...";
      if (absl::StartsWith(s, "Hello World")) { /* do something */ }

#+end_quote

StringLikeClasses

Semicolon-separated list of names of string-like classes. By default only std::basic_string is considered. The list of methods to considered is fixed.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

AbseilStringsMatchHeader

The location of Abseil’s strings/match.h. Defaults to absl/strings/match.h.

Finds s.find(…) == string::npos comparisons (for various string-like types) and suggests replacing with absl::StrContains().

This improves readability and reduces the likelihood of accidentally mixing find() and npos from different string-like types.

By default, “string-like types” includes ::std::basic_string, ::std::basic_string_view, and ::absl::string_view. See the StringLikeClasses option to change this.

#+begin_quote

      std::string s = "...";
      if (s.find("Hello World") == std::string::npos) { /* do something */ }

      absl::string_view a = "...";
      if (absl::string_view::npos != a.find("Hello World")) { /* do something */ }

#+end_quote

becomes

#+begin_quote

      std::string s = "...";
      if (!absl::StrContains(s, "Hello World")) { /* do something */ }

      absl::string_view a = "...";
      if (absl::StrContains(a, "Hello World")) { /* do something */ }

#+end_quote

StringLikeClasses

Semicolon-separated list of names of string-like classes. By default includes ::std::basic_string, ::std::basic_string_view, and ::absl::string_view.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

AbseilStringsMatchHeader

The location of Abseil’s strings/match.h. Defaults to absl/strings/match.h.

Prefer comparisons in the absl::Time domain instead of the integer domain.

N.B.: In cases where an absl::Time is being converted to an integer, alignment may occur. If the comparison depends on this alignment, doing the comparison in the absl::Time domain may yield a different result. In practice this is very rare, and still indicates a bug which should be fixed.

Examples:

#+begin_quote

      // Original - Comparison in the integer domain
      int x;
      absl::Time t;
      if (x < absl::ToUnixSeconds(t)) ...

      // Suggested - Compare in the absl::Time domain instead
      if (absl::FromUnixSeconds(x) < t) ...

#+end_quote

Finds and fixes absl::Time subtraction expressions to do subtraction in the Time domain instead of the numeric domain.

There are two cases of Time subtraction in which deduce additional type information:

• When the result is an absl::Duration and the first argument is an absl::Time.
• When the second argument is a absl::Time.

In the first case, we must know the result of the operation, since without that the second operand could be either an absl::Time or an absl::Duration. In the second case, the first operand must be an absl::Time, because subtracting an absl::Time from an absl::Duration is not defined.

Examples:

#+begin_quote

      int x;
      absl::Time t;

      // Original - absl::Duration result and first operand is a absl::Time.
      absl::Duration d = absl::Seconds(absl::ToUnixSeconds(t) - x);

      // Suggestion - Perform subtraction in the Time domain instead.
      absl::Duration d = t - absl::FromUnixSeconds(x);


      // Original - Second operand is an absl::Time.
      int i = x - absl::ToUnixSeconds(t);

      // Suggestion - Perform subtraction in the Time domain instead.
      int i = absl::ToInt64Seconds(absl::FromUnixSeconds(x) - t);

#+end_quote

Finds calls to absl::Duration arithmetic operators and factories whose argument needs an explicit cast to continue compiling after upcoming API changes.

The operators *=, /=, *, and / for absl::Duration currently accept an argument of class type that is convertible to an arithmetic type. Such a call currently converts the value to an int64_t, even in a case such as std::atomic<float> that would result in lossy conversion.

Additionally, the absl::Duration factory functions (absl::Hours, absl::Minutes, etc) currently accept an int64_t or a floating-point type. Similar to the arithmetic operators, calls with an argument of class type that is convertible to an arithmetic type go through the int64_t path.

These operators and factories will be changed to only accept arithmetic types to prevent unintended behavior. After these changes are released, passing an argument of class type will no longer compile, even if the type is implicitly convertible to an arithmetic type.

Here are example fixes created by this check:

#+begin_quote

      std::atomic<int> a;
      absl::Duration d = absl::Milliseconds(a);
      d *= a;

#+end_quote

becomes

#+begin_quote

      std::atomic<int> a;
      absl::Duration d = absl::Milliseconds(static_cast<int64_t>(a));
      d *= static_cast<int64_t>(a);

#+end_quote

Note that this check always adds a cast to int64_t in order to preserve the current behavior of user code. It is possible that this uncovers unintended behavior due to types implicitly convertible to a floating-point type.

Finds ID-dependent variables and fields that are used within loops. This causes branches to occur inside the loops, and thus leads to performance degradation.

#+begin_quote

      // The following code will produce a warning because this ID-dependent
      // variable is used in a loop condition statement.
      int ThreadID = get_local_id(0);

      // The following loop will produce a warning because the loop condition
      // statement depends on an ID-dependent variable.
      for (int i = 0; i < ThreadID; ++i) {
        std::cout << i << std::endl;
      }

      // The following loop will not produce a warning, because the ID-dependent
      // variable is not used in the loop condition statement.
      for (int i = 0; i < 100; ++i) {
        std::cout << ThreadID << std::endl;
      }

#+end_quote

Based on the Altera SDK for OpenCL: Best Practices Guide.

Finds kernel files and include directives whose filename is kernel.cl, Verilog.cl, or VHDL.cl. The check is case insensitive.

Such kernel file names cause the offline compiler to generate intermediate design files that have the same names as certain internal files, which leads to a compilation error.

Based on the Guidelines for Naming the Kernel section in the Intel FPGA SDK for OpenCL Pro Edition: Programming Guide.

Finds OpenCL kernel functions that call a barrier function but do not call an ID function (get_local_id, get_local_id, get_group_id, or get_local_linear_id).

These kernels may be viable single work-item kernels, but will be forced to execute as NDRange kernels if using a newer version of the Altera Offline Compiler (>= v17.01).

If using an older version of the Altera Offline Compiler, these kernel functions will be treated as single work-item kernels, which could be inefficient or lead to errors if NDRange semantics were intended.

Based on the Altera SDK for OpenCL: Best Practices Guide.

Examples:

#+begin_quote

      // error: function calls barrier but does not call an ID function.
      void __kernel barrier_no_id(__global int * foo, int size) {
        for (int i = 0; i < 100; i++) {
          foo[i] += 5;
        }
        barrier(CLK_GLOBAL_MEM_FENCE);
      }

      // ok: function calls barrier and an ID function.
      void __kernel barrier_with_id(__global int * foo, int size) {
        for (int i = 0; i < 100; i++) {
          int tid = get_global_id(0);
          foo[tid] += 5;
        }
        barrier(CLK_GLOBAL_MEM_FENCE);
      }

      // ok with AOC Version 17.01: the reqd_work_group_size turns this into
      // an NDRange.
      __attribute__((reqd_work_group_size(2,2,2)))
      void __kernel barrier_with_id(__global int * foo, int size) {
        for (int i = 0; i < 100; i++) {
          foo[tid] += 5;
        }
        barrier(CLK_GLOBAL_MEM_FENCE);
      }

#+end_quote

AOCVersion

Defines the version of the Altera Offline Compiler. Defaults to 1600 (corresponding to version 16.00).

Finds structs that are inefficiently packed or aligned, and recommends packing and/or aligning of said structs as needed.

Structs that are not packed take up more space than they should, and accessing structs that are not well aligned is inefficient.

Fix-its are provided to fix both of these issues by inserting and/or amending relevant struct attributes.

Based on the Altera SDK for OpenCL: Best Practices Guide.

#+begin_quote

      // The following struct is originally aligned to 4 bytes, and thus takes up
      // 12 bytes of memory instead of 10. Packing the struct will make it use
      // only 10 bytes of memory, and aligning it to 16 bytes will make it
      // efficient to access.
      struct example {
        char a;    // 1 byte
        double b;  // 8 bytes
        char c;    // 1 byte
      };

      // The following struct is arranged in such a way that packing is not needed.
      // However, it is aligned to 4 bytes instead of 8, and thus needs to be
      // explicitly aligned.
      struct implicitly_packed_example {
        char a;  // 1 byte
        char b;  // 1 byte
        char c;  // 1 byte
        char d;  // 1 byte
        int e;   // 4 bytes
      };

      // The following struct is explicitly aligned and packed.
      struct good_example {
        char a;    // 1 byte
        double b;  // 8 bytes
        char c;    // 1 byte
      } __attribute__((packed)) __attribute__((aligned(16));

      // Explicitly aligning a struct to the wrong value will result in a warning.
      // The following example should be aligned to 16 bytes, not 32.
      struct badly_aligned_example {
        char a;    // 1 byte
        double b;  // 8 bytes
        char c;    // 1 byte
      } __attribute__((packed)) __attribute__((aligned(32)));

#+end_quote

Finds inner loops that have not been unrolled, as well as fully unrolled loops with unknown loop bounds or a large number of iterations.

Unrolling inner loops could improve the performance of OpenCL kernels. However, if they have unknown loop bounds or a large number of iterations, they cannot be fully unrolled, and should be partially unrolled.

Notes:

• This check is unable to determine the number of iterations in a while or do..while loop; hence if such a loop is fully unrolled, a note is emitted advising the user to partially unroll instead.
• In for loops, our check only works with simple arithmetic increments ( +, -, *, /). For all other increments, partial unrolling is advised.
• Depending on the exit condition, the calculations for determining if the number of iterations is large may be off by 1. This should not be an issue since the cut-off is generally arbitrary.

Based on the Altera SDK for OpenCL: Best Practices Guide.

#+begin_quote

      for (int i = 0; i < 10; i++) {  // ok: outer loops should not be unrolled
         int j = 0;
         do {  // warning: this inner do..while loop should be unrolled
            j++;
         } while (j < 15);

         int k = 0;
         #pragma unroll
         while (k < 20) {  // ok: this inner loop is already unrolled
            k++;
         }
      }

      int A[1000];
      #pragma unroll
      // warning: this loop is large and should be partially unrolled
      for (int a : A) {
         printf("%d", a);
      }

      #pragma unroll 5
      // ok: this loop is large, but is partially unrolled
      for (int a : A) {
         printf("%d", a);
      }

      #pragma unroll
      // warning: this loop is large and should be partially unrolled
      for (int i = 0; i < 1000; ++i) {
         printf("%d", i);
      }

      #pragma unroll 5
      // ok: this loop is large, but is partially unrolled
      for (int i = 0; i < 1000; ++i) {
         printf("%d", i);
      }

      #pragma unroll
      // warning: << operator not supported, recommend partial unrolling
      for (int i = 0; i < 1000; i<<1) {
         printf("%d", i);
      }

      std::vector<int> someVector (100, 0);
      int i = 0;
      #pragma unroll
      // note: loop may be large, recommend partial unrolling
      while (i < someVector.size()) {
         someVector[i]++;
      }

      #pragma unroll
      // note: loop may be large, recommend partial unrolling
      while (true) {
         printf("In loop");
      }

      #pragma unroll 5
      // ok: loop may be large, but is partially unrolled
      while (i < someVector.size()) {
         someVector[i]++;
      }

#+end_quote

MaxLoopIterations

Defines the maximum number of loop iterations that a fully unrolled loop can have. By default, it is set to 100.

In practice, this refers to the integer value of the upper bound within the loop statement’s condition expression.

The usage of accept() is not recommended, it’s better to use accept4(). Without this flag, an opened sensitive file descriptor would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      accept(sockfd, addr, addrlen);

      // becomes

      accept4(sockfd, addr, addrlen, SOCK_CLOEXEC);

#+end_quote

accept4() should include SOCK_CLOEXEC in its type argument to avoid the file descriptor leakage. Without this flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      accept4(sockfd, addr, addrlen, SOCK_NONBLOCK);

      // becomes

      accept4(sockfd, addr, addrlen, SOCK_NONBLOCK | SOCK_CLOEXEC);

#+end_quote

The usage of creat() is not recommended, it’s better to use open().

Examples:

#+begin_quote

      int fd = creat(path, mode);

      // becomes

      int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, mode);

#+end_quote

The usage of dup() is not recommended, it’s better to use fcntl(), which can set the close-on-exec flag. Otherwise, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      int fd = dup(oldfd);

      // becomes

      int fd = fcntl(oldfd, F_DUPFD_CLOEXEC);

#+end_quote

The usage of epoll_create() is not recommended, it’s better to use epoll_create1(), which allows close-on-exec.

Examples:

#+begin_quote

      epoll_create(size);

      // becomes

      epoll_create1(EPOLL_CLOEXEC);

#+end_quote

epoll_create1() should include EPOLL_CLOEXEC in its type argument to avoid the file descriptor leakage. Without this flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      epoll_create1(0);

      // becomes

      epoll_create1(EPOLL_CLOEXEC);

#+end_quote

fopen() should include e in their mode string; so re would be valid. This is equivalent to having set FD_CLOEXEC on that descriptor.

Examples:

#+begin_quote

      fopen("fn", "r");

      // becomes

      fopen("fn", "re");

#+end_quote

The usage of inotify_init() is not recommended, it’s better to use inotify_init1().

Examples:

#+begin_quote

      inotify_init();

      // becomes

      inotify_init1(IN_CLOEXEC);

#+end_quote

inotify_init1() should include IN_CLOEXEC in its type argument to avoid the file descriptor leakage. Without this flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      inotify_init1(IN_NONBLOCK);

      // becomes

      inotify_init1(IN_NONBLOCK | IN_CLOEXEC);

#+end_quote

memfd_create() should include MFD_CLOEXEC in its type argument to avoid the file descriptor leakage. Without this flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      memfd_create(name, MFD_ALLOW_SEALING);

      // becomes

      memfd_create(name, MFD_ALLOW_SEALING | MFD_CLOEXEC);

#+end_quote

A common source of security bugs is code that opens a file without using the O_CLOEXEC flag. Without that flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain, leaking that sensitive data. Open-like functions including open(), openat(), and open64() should include O_CLOEXEC in their flags argument.

Examples:

#+begin_quote

      open("filename", O_RDWR);
      open64("filename", O_RDWR);
      openat(0, "filename", O_RDWR);

      // becomes

      open("filename", O_RDWR | O_CLOEXEC);
      open64("filename", O_RDWR | O_CLOEXEC);
      openat(0, "filename", O_RDWR | O_CLOEXEC);

#+end_quote

This check detects usage of pipe(). Using pipe() is not recommended, pipe2() is the suggested replacement. The check also adds the O_CLOEXEC flag that marks the file descriptor to be closed in child processes. Without this flag a sensitive file descriptor can be leaked to a child process, potentially into a lower-privileged SELinux domain.

Examples:

#+begin_quote

      pipe(pipefd);

#+end_quote

Suggested replacement:

#+begin_quote

      pipe2(pipefd, O_CLOEXEC);

#+end_quote

This checks ensures that pipe2() is called with the O_CLOEXEC flag. The check also adds the O_CLOEXEC flag that marks the file descriptor to be closed in child processes. Without this flag a sensitive file descriptor can be leaked to a child process, potentially into a lower-privileged SELinux domain.

Examples:

#+begin_quote

      pipe2(pipefd, O_NONBLOCK);

#+end_quote

Suggested replacement:

#+begin_quote

      pipe2(pipefd, O_NONBLOCK | O_CLOEXEC);

#+end_quote

socket() should include SOCK_CLOEXEC in its type argument to avoid the file descriptor leakage. Without this flag, an opened sensitive file would remain open across a fork+exec to a lower-privileged SELinux domain.

Examples:

#+begin_quote

      socket(domain, type, SOCK_STREAM);

      // becomes

      socket(domain, type, SOCK_STREAM | SOCK_CLOEXEC);

#+end_quote

Diagnoses comparisons that appear to be incorrectly placed in the argument to the TEMP_FAILURE_RETRY macro. Having such a use is incorrect in the vast majority of cases, and will often silently defeat the purpose of the TEMP_FAILURE_RETRY macro.

For context, TEMP_FAILURE_RETRY is a convenience macro provided by both glibc and Bionic. Its purpose is to repeatedly run a syscall until it either succeeds, or fails for reasons other than being interrupted.

Example buggy usage looks like:

#+begin_quote

      char cs[1];
      while (TEMP_FAILURE_RETRY(read(STDIN_FILENO, cs, sizeof(cs)) != 0)) {
        // Do something with cs.
      }

#+end_quote

Because TEMP_FAILURE_RETRY will check for whether the result of the comparison is -1, and retry if so.

If you encounter this, the fix is simple: lift the comparison out of the TEMP_FAILURE_RETRY argument, like so:

#+begin_quote

      char cs[1];
      while (TEMP_FAILURE_RETRY(read(STDIN_FILENO, cs, sizeof(cs))) != 0) {
        // Do something with cs.
      }

#+end_quote

RetryMacros

A comma-separated list of the names of retry macros to be checked.

This check finds conversion from integer type like int to std::string or std::wstring using boost::lexical_cast, and replace it with calls to std::to_string and std::to_wstring.

It doesn’t replace conversion from floating points despite the to_string overloads, because it would change the behaviour.

#+begin_quote

      auto str = boost::lexical_cast<std::string>(42);
      auto wstr = boost::lexical_cast<std::wstring>(2137LL);

      // Will be changed to
      auto str = std::to_string(42);
      auto wstr = std::to_wstring(2137LL);

#+end_quote

Checks that argument comments match parameter names.

The check understands argument comments in the form parameter_name= that are placed right before the argument.

#+begin_quote

      void f(bool foo);

      ...

      f(/*bar=*/true);
      // warning: argument name 'bar' in comment does not match parameter name 'foo'

#+end_quote

The check tries to detect typos and suggest automated fixes for them.

StrictMode

When false (default value), the check will ignore leading and trailing underscores and case when comparing names – otherwise they are taken into account.

IgnoreSingleArgument

When true, the check will ignore the single argument.

CommentBoolLiterals

When true, the check will add argument comments in the format ParameterName= right before the boolean literal argument.

Before:

#+begin_quote

      void foo(bool TurnKey, bool PressButton);

      foo(true, false);

#+end_quote

After:

#+begin_quote

      void foo(bool TurnKey, bool PressButton);

      foo(/*TurnKey=*/true, /*PressButton=*/false);

#+end_quote

CommentIntegerLiterals

When true, the check will add argument comments in the format ParameterName= right before the integer literal argument.

Before:

#+begin_quote

      void foo(int MeaningOfLife);

      foo(42);

#+end_quote

After:

#+begin_quote

      void foo(int MeaningOfLife);

      foo(/*MeaningOfLife=*/42);

#+end_quote

CommentFloatLiterals

When true, the check will add argument comments in the format ParameterName= right before the float/double literal argument.

Before:

#+begin_quote

      void foo(float Pi);

      foo(3.14159);

#+end_quote

After:

#+begin_quote

      void foo(float Pi);

      foo(/*Pi=*/3.14159);

#+end_quote

CommentStringLiterals

When true, the check will add argument comments in the format ParameterName= right before the string literal argument.

Before:

#+begin_quote

      void foo(const char *String);
      void foo(const wchar_t *WideString);

      foo("Hello World");
      foo(L"Hello World");

#+end_quote

After:

#+begin_quote

      void foo(const char *String);
      void foo(const wchar_t *WideString);

      foo(/*String=*/"Hello World");
      foo(/*WideString=*/L"Hello World");

#+end_quote

CommentCharacterLiterals

When true, the check will add argument comments in the format ParameterName= right before the character literal argument.

Before:

#+begin_quote

      void foo(char *Character);

      foo('A');

#+end_quote

After:

#+begin_quote

      void foo(char *Character);

      foo(/*Character=*/'A');

#+end_quote

CommentUserDefinedLiterals

When true, the check will add argument comments in the format ParameterName= right before the user defined literal argument.

Before:

#+begin_quote

      void foo(double Distance);

      double operator"" _km(long double);

      foo(402.0_km);

#+end_quote

After:

#+begin_quote

      void foo(double Distance);

      double operator"" _km(long double);

      foo(/*Distance=*/402.0_km);

#+end_quote

CommentNullPtrs

When true, the check will add argument comments in the format ParameterName= right before the nullptr literal argument.

Before:

#+begin_quote

      void foo(A* Value);

      foo(nullptr);

#+end_quote

After:

#+begin_quote

      void foo(A* Value);

      foo(/*Value=*/nullptr);

#+end_quote

Finds assert() with side effect.

The condition of assert() is evaluated only in debug builds so a condition with side effect can cause different behavior in debug / release builds.

AssertMacros

A comma-separated list of the names of assert macros to be checked.

CheckFunctionCalls

Whether to treat non-const member and non-member functions as they produce side effects. Disabled by default because it can increase the number of false positive warnings.

Finds pthread_kill function calls when a thread is terminated by raising SIGTERM signal and the signal kills the entire process, not just the individual thread. Use any signal except SIGTERM.

This check corresponds to the CERT C Coding Standard rule POS44-C. Do not use signals to terminate threads.

Checks for conditions based on implicit conversion from a bool pointer to bool.

Example:

#+begin_quote

      bool *p;
      if (p) {
        // Never used in a pointer-specific way.
      }

#+end_quote

Checks for repeated branches in if/else if/else chains, consecutive repeated branches in switch statements and identical true and false branches in conditional operators.

#+begin_quote

      if (test_value(x)) {
        y++;
        do_something(x, y);
      } else {
        y++;
        do_something(x, y);
      }

#+end_quote

In this simple example (which could arise e.g. as a copy-paste error) the then and else branches are identical and the code is equivalent the following shorter and cleaner code:

#+begin_quote

      test_value(x); // can be omitted unless it has side effects
      y++;
      do_something(x, y);

#+end_quote

If this is the intended behavior, then there is no reason to use a conditional statement; otherwise the issue can be solved by fixing the branch that is handled incorrectly.

The check also detects repeated branches in longer if/else if/else chains where it would be even harder to notice the problem.

In switch statements the check only reports repeated branches when they are consecutive, because it is relatively common that the case: labels have some natural ordering and rearranging them would decrease the readability of the code. For example:

#+begin_quote

      switch (ch) {
      case 'a':
        return 10;
      case 'A':
        return 10;
      case 'b':
        return 11;
      case 'B':
        return 11;
      default:
        return 10;
      }

#+end_quote

Here the check reports that the ’a’ and ’A’ branches are identical (and that the ’b’ and ’B’ branches are also identical), but does not report that the default: branch is also identical to the first two branches. If this is indeed the correct behavior, then it could be implemented as:

#+begin_quote

      switch (ch) {
      case 'a':
      case 'A':
        return 10;
      case 'b':
      case 'B':
        return 11;
      default:
        return 10;
      }

#+end_quote

Here the check does not warn for the repeated return 10;, which is good if we want to preserve that ’a’ is before ’b’ and default: is the last branch.

Finally, the check also examines conditional operators and reports code like:

#+begin_quote

      return test_value(x) ? x : x;

#+end_quote

Unlike if statements, the check does not detect chains of conditional operators.

Note: This check also reports situations where branches become identical only after preprocession.

Finds copy constructors where the constructor doesn’t call the copy constructor of the base class.

#+begin_quote

      class Copyable {
      public:
        Copyable() = default;
        Copyable(const Copyable &) = default;
      };
      class X2 : public Copyable {
        X2(const X2 &other) {} // Copyable(other) is missing
      };

#+end_quote

Also finds copy constructors where the constructor of the base class don’t have parameter.

#+begin_quote

      class X4 : public Copyable {
        X4(const X4 &other) : Copyable() {} // other is missing
      };

#+end_quote

The check also suggests a fix-its in some cases.

Detect dangling references in value handles like std::string_view. These dangling references can be a result of constructing handles from temporary values, where the temporary is destroyed soon after the handle is created.

Examples:

#+begin_quote

      string_view View = string();  // View will dangle.
      string A;
      View = A + "A";  // still dangle.

      vector<string_view> V;
      V.push_back(string());  // V[0] is dangling.
      V.resize(3, string());  // V[1] and V[2] will also dangle.

      string_view f() {
        // All these return values will dangle.
        return string();
        string S;
        return S;
        char Array[10]{};
        return Array;
      }

#+end_quote

HandleClasses

A semicolon-separated list of class names that should be treated as handles. By default only std::basic_string_view and std::experimental::basic_string_view are considered.

Finds instances of static variables that are dynamically initialized in header files.

This can pose problems in certain multithreaded contexts. For example, when disabling compiler generated synchronization instructions for static variables initialized at runtime (e.g. by -fno-threadsafe-statics), even if a particular project takes the necessary precautions to prevent race conditions during initialization by providing their own synchronization, header files included from other projects may not. Therefore, such a check is helpful for ensuring that disabling compiler generated synchronization for static variable initialization will not cause problems.

Consider the following code:

#+begin_quote

      int foo() {
        static int k = bar();
        return k;
      }

#+end_quote

When synchronization of static initialization is disabled, if two threads both call foo for the first time, there is the possibility that k will be double initialized, creating a race condition.

Finds function definitions where parameters of convertible types follow each other directly, making call sites prone to calling the function with swapped (or badly ordered) arguments.

#+begin_quote

      void drawPoint(int X, int Y) { /* ... */ }
      FILE *open(const char *Dir, const char *Name, Flags Mode) { /* ... */ }

#+end_quote

A potential call like drawPoint(-2, 5) or openPath(“a.txt”, “tmp”, Read) is perfectly legal from the language’s perspective, but might not be what the developer of the function intended.

More elaborate and type-safe constructs, such as opaque typedefs or strong types should be used instead, to prevent a mistaken order of arguments.

#+begin_quote

      struct Coord2D { int X; int Y; };
      void drawPoint(const Coord2D Pos) { /* ... */ }

      FILE *open(const Path &Dir, const Filename &Name, Flags Mode) { /* ... */ }

#+end_quote

Due to the potentially elaborate refactoring and API-breaking that is necessary to strengthen the type safety of a project, no automatic fix-its are offered.

Relaxation (or extension) options can be used to broaden the scope of the analysis and fine-tune the enabling of more mixes between types. Some mixes may depend on coding style or preference specific to a project, however, it should be noted that enabling all of these relaxations model the way of mixing at call sites the most. These options are expected to make the check report for more functions, and report longer mixable ranges.

QualifiersMix

Whether to consider parameters of some cvr-qualified T and a differently cvr-qualified T (i.e. T and const T, const T and volatile T, etc.) mixable between one another. If false, the check will consider differently qualified types unmixable. True turns the warnings on. Defaults to false.

The following example produces a diagnostic only if QualifiersMix is enabled:

#+begin_quote

#+begin_quote

        void *memcpy(const void *Destination, void *Source, std::size_t N) { /* ... */ }

#+end_quote #+end_quote

ModelImplicitConversions

Whether to consider parameters of type T and U mixable if there exists an implicit conversion from T to U and U to T. If false, the check will not consider implicitly convertible types for mixability. True turns warnings for implicit conversions on. Defaults to true.

The following examples produce a diagnostic only if ModelImplicitConversions is enabled:

#+begin_quote

#+begin_quote

        void fun(int Int, double Double) { /* ... */ }
        void compare(const char *CharBuf, std::string String) { /* ... */ }

#+end_quote

NOTE:

#+begin_quote Changing the qualifiers of an expression’s type (e.g. from int to const int) is defined as an implicit conversion in the C++ Standard. However, the check separates this decision-making on the mixability of differently qualified types based on whether QualifiersMix was enabled.

For example, the following code snippet will only produce a diagnostic if both QualifiersMix and ModelImplicitConversions are enabled:

#+begin_quote

#+begin_quote

            void fun2(int Int, const double Double) { /* ... */ }

#+end_quote #+end_quote #+end_quote #+end_quote

Filtering options can be used to lessen the size of the diagnostics emitted by the checker, whether the aim is to ignore certain constructs or dampen the noisiness.

MinimumLength

The minimum length required from an adjacent parameter sequence to be diagnosed. Defaults to 2. Might be any positive integer greater or equal to 2. If 0 or 1 is given, the default value 2 will be used instead.

For example, if 3 is specified, the examples above will not be matched.

IgnoredParameterNames

The list of parameter names that should never be considered part of a swappable adjacent parameter sequence. The value is a ;-separated list of names. To ignore unnamed parameters, add “” to the list verbatim (not the empty string, but the two quotes, potentially escaped!). This options is case-sensitive!

By default, the following parameter names, and their Uppercase-initial variants are ignored: “” (unnamed parameters), iterator, begin, end, first, last, lhs, rhs.

IgnoredParameterTypeSuffixes

The list of parameter type name suffixes that should never be considered part of a swappable adjacent parameter sequence. Parameters which type, as written in the source code, end with an element of this option will be ignored. The value is a ;-separated list of names. This option is case-sensitive!

By default, the following, and their lowercase-initial variants are ignored: bool, It, Iterator, InputIt, ForwardIt, BidirIt, RandomIt, random_iterator, ReverseIt, reverse_iterator, reverse_const_iterator, RandomIt, random_iterator, ReverseIt, reverse_iterator, reverse_const_iterator, Const_Iterator, ConstIterator, const_reverse_iterator, ConstReverseIterator. In addition, _Bool (but not _bool) is also part of the default value.

SuppressParametersUsedTogether

Suppresses diagnostics about parameters that are used together or in a similar fashion inside the function’s body. Defaults to true. Specifying false will turn off the heuristics.

Currently, the following heuristics are implemented which will suppress the warning about the parameter pair involved:

#+begin_quote

• The parameters are used in the same expression, e.g. f(a, b) or a < b.
• The parameters are further passed to the same function to the same parameter of that function, of the same overload. E.g. f(a, 1) and f(b, 2) to some f(T, int).

NOTE:

#+begin_quote

#+begin_quote The check does not perform path-sensitive analysis, and as such, “same function” in this context means the same function declaration. If the same member function of a type on two distinct instances are called with the parameters, it will still be regarded as “same function”.

#+end_quote

• The same member field is accessed, or member method is called of the two parameters, e.g. a.foo() and b.foo().
• Separate return statements return either of the parameters on different code paths.

#+end_quote #+end_quote

NamePrefixSuffixSilenceDissimilarityTreshold

The number of characters two parameter names might be different on either the head or the tail end with the rest of the name the same so that the warning about the two parameters are silenced. Defaults to 1. Might be any positive integer. If 0, the filtering heuristic based on the parameters’ names is turned off.

This option can be used to silence warnings about parameters where the naming scheme indicates that the order of those parameters do not matter.

For example, the parameters LHS and RHS are 1-dissimilar suffixes of each other: L and R is the different character, while HS is the common suffix. Similarly, parameters text1, text2, text3 are 1-dissimilar prefixes of each other, with the numbers at the end being the dissimilar part. If the value is at least 1, such cases will not be reported.

This check is designed to check function signatures!

The check does not investigate functions that are generated by the compiler in a context that is only determined from a call site. These cases include variadic functions, functions in C code that do not have an argument list, and C++ template instantiations. Most of these cases, which are otherwise swappable from a caller’s standpoint, have no way of getting “fixed” at the definition point. In the case of C++ templates, only primary template definitions and explicit specialisations are matched and analysed.

None of the following cases produce a diagnostic:

#+begin_quote

      int printf(const char *Format, ...) { /* ... */ }
      int someOldCFunction() { /* ... */ }

      template <typename T, typename U>
      int add(T X, U Y) { return X + Y };

      void theseAreNotWarnedAbout() {
          printf("%d %d\n", 1, 2);   // Two ints passed, they could be swapped.
          someOldCFunction(1, 2, 3); // Similarly, multiple ints passed.

          add(1, 2); // Instantiates 'add<int, int>', but that's not a user-defined function.
      }

#+end_quote

Due to the limitation above, parameters which type are further dependent upon template instantiations to prove that they mix with another parameter’s is not diagnosed.

#+begin_quote

      template <typename T>
      struct Vector {
        typedef T element_type;
      };

      // Diagnosed: Explicit instantiation was done by the user, we can prove it
      // is the same type.
      void instantiated(int A, Vector<int>::element_type B) { /* ... */ }

      // Diagnosed: The two parameter types are exactly the same.
      template <typename T>
      void exact(typename Vector<T>::element_type A,
                 typename Vector<T>::element_type B) { /* ... */ }

      // Skipped: The two parameters are both 'T' but we can not prove this
      // without actually instantiating.
      template <typename T>
      void falseNegative(T A, typename Vector<T>::element_type B) { /* ... */ }

#+end_quote

In the context of implicit conversions (when ModelImplicitConversions is enabled), the modelling performed by the check warns if the parameters are swappable and the swapped order matches implicit conversions. It does not model whether there exists an unrelated third type from which both parameters can be given in a function call. This means that in the following example, even while strs() clearly carries the possibility to be called with swapped arguments (as long as the arguments are string literals), will not be warned about.

#+begin_quote

      struct String {
          String(const char *Buf);
      };

      struct StringView {
          StringView(const char *Buf);
          operator const char *() const;
      };

      // Skipped: Directly swapping expressions of the two type cannot mix.
      // (Note: StringView -> const char * -> String would be **two**
      // user-defined conversions, which is disallowed by the language.)
      void strs(String Str, StringView SV) { /* ... */ }

      // Diagnosed: StringView implicitly converts to and from a buffer.
      void cStr(StringView SV, const char *Buf() { /* ... */ }

#+end_quote

Finds functions which may throw an exception directly or indirectly, but they should not. The functions which should not throw exceptions are the following:

• Destructors
• Move constructors
• Move assignment operators
• The main() functions
• swap() functions
• Functions marked with throw() or noexcept
• Other functions given as option

A destructor throwing an exception may result in undefined behavior, resource leaks or unexpected termination of the program. Throwing move constructor or move assignment also may result in undefined behavior or resource leak. The swap() operations expected to be non throwing most of the cases and they are always possible to implement in a non throwing way. Non throwing swap() operations are also used to create move operations. A throwing main() function also results in unexpected termination.

WARNING! This check may be expensive on large source files.

FunctionsThatShouldNotThrow

Comma separated list containing function names which should not throw. An example value for this parameter can be WinMain which adds function WinMain() in the Windows API to the list of the functions which should not throw. Default value is an empty string.

IgnoredExceptions

Comma separated list containing type names which are not counted as thrown exceptions in the check. Default value is an empty string.

The check flags type mismatches in folds like std::accumulate that might result in loss of precision. std::accumulate folds an input range into an initial value using the type of the latter, with operator+ by default. This can cause loss of precision through:

• Truncation: The following code uses a floating point range and an int initial value, so trucation will happen at every application of operator+ and the result will be 0, which might not be what the user expected.

#+begin_quote

      auto a = {0.5f, 0.5f, 0.5f, 0.5f};
      return std::accumulate(std::begin(a), std::end(a), 0);

#+end_quote

• Overflow: The following code also returns 0.

#+begin_quote

      auto a = {65536LL * 65536 * 65536};
      return std::accumulate(std::begin(a), std::end(a), 0);

#+end_quote

Checks if an unused forward declaration is in a wrong namespace.

The check inspects all unused forward declarations and checks if there is any declaration/definition with the same name existing, which could indicate that the forward declaration is in a potentially wrong namespace.

#+begin_quote

      namespace na { struct A; }
      namespace nb { struct A {}; }
      nb::A a;
      // warning : no definition found for 'A', but a definition with the same name
      // 'A' found in another namespace 'nb::'

#+end_quote

This check can only generate warnings, but it can’t suggest a fix at this point.

The check looks for perfect forwarding constructors that can hide copy or move constructors. If a non const lvalue reference is passed to the constructor, the forwarding reference parameter will be a better match than the const reference parameter of the copy constructor, so the perfect forwarding constructor will be called, which can be confusing. For detailed description of this issue see: Scott Meyers, Effective Modern C++, Item 26.

Consider the following example:

#+begin_quote

      class Person {
      public:
        // C1: perfect forwarding ctor
        template<typename T>
        explicit Person(T&& n) {}

        // C2: perfect forwarding ctor with parameter default value
        template<typename T>
        explicit Person(T&& n, int x = 1) {}

        // C3: perfect forwarding ctor guarded with enable_if
        template<typename T, typename X = enable_if_t<is_special<T>,void>>
        explicit Person(T&& n) {}

        // (possibly compiler generated) copy ctor
        Person(const Person& rhs);
      };

#+end_quote

The check warns for constructors C1 and C2, because those can hide copy and move constructors. We suppress warnings if the copy and the move constructors are both disabled (deleted or private), because there is nothing the perfect forwarding constructor could hide in this case. We also suppress warnings for constructors like C3 that are guarded with an enable_if, assuming the programmer was aware of the possible hiding.

For deciding whether a constructor is guarded with enable_if, we consider the default values of the type parameters and the types of the constructor parameters. If any part of these types is std::enable_if or std::enable_if_t, we assume the constructor is guarded.

The check diagnoses instances where a result of a multiplication is implicitly widened, and suggests (with fix-it) to either silence the code by making widening explicit, or to perform the multiplication in a wider type, to avoid the widening afterwards.

This is mainly useful when operating on a very large buffers. For example, consider:

#+begin_quote

      void zeroinit(char* base, unsigned width, unsigned height) {
        for(unsigned row = 0; row != height; ++row) {
          for(unsigned col = 0; col != width; ++col) {
            char* ptr = base + row * width + col;
            *ptr = 0;
          }
        }
      }

#+end_quote

This is fine in general, but iff width * height overflows, you end up wrapping back to the beginning of base instead of processing the entire requested buffer.

Indeed, this only matters for pretty large buffers (4GB+), but that can happen very easily for example in image processing, where for that to happen you “only” need a ~269MPix image.

UseCXXStaticCastsInCppSources

When suggesting fix-its for C++ code, should C++-style static_cast<>()’s be suggested, or C-style casts. Defaults to true.

UseCXXHeadersInCppSources

When suggesting to include the appropriate header in C++ code, should <cstddef> header be suggested, or <stddef.h>. Defaults to true.

Examples:

#+begin_quote

      long mul(int a, int b) {
        return a * b; // warning: performing an implicit widening conversion to type 'long' of a multiplication performed in type 'int'
      }

      char* ptr_add(char *base, int a, int b) {
        return base + a * b; // warning: result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ssize_t'
      }

      char ptr_subscript(char *base, int a, int b) {
        return base[a * b]; // warning: result of multiplication in type 'int' is used as a pointer offset after an implicit widening conversion to type 'ssize_t'
      }

#+end_quote

Checks for inaccurate use of the erase() method.

Algorithms like remove() do not actually remove any element from the container but return an iterator to the first redundant element at the end of the container. These redundant elements must be removed using the erase() method. This check warns when not all of the elements will be removed due to using an inappropriate overload.

For example, the following code erases only one element:

#+begin_quote

      std::vector<int> xs;
      ...
      xs.erase(std::remove(xs.begin(), xs.end(), 10));

#+end_quote

Call the two-argument overload of erase() to remove the subrange:

#+begin_quote

      std::vector<int> xs;
      ...
      xs.erase(std::remove(xs.begin(), xs.end(), 10), xs.end());

#+end_quote

Checks the usage of patterns known to produce incorrect rounding. Programmers often use:

#+begin_quote

      (int)(double_expression + 0.5)

#+end_quote

to round the double expression to an integer. The problem with this:

1. It is unnecessarily slow.
2. It is incorrect. The number 0.499999975 (smallest representable float number below 0.5) rounds to 1.0. Even worse behavior for negative numbers where both -0.5f and -1.4f both round to 0.0.

Finds obvious infinite loops (loops where the condition variable is not changed at all).

Finding infinite loops is well-known to be impossible (halting problem). However, it is possible to detect some obvious infinite loops, for example, if the loop condition is not changed. This check detects such loops. A loop is considered infinite if it does not have any loop exit statement (break, continue, goto, return, throw or a call to a function called as ) and all of the following conditions hold for every variable in the condition:

• It is a local variable.
• It has no reference or pointer aliases.
• It is not a structure or class member.

Furthermore, the condition must not contain a function call to consider the loop infinite since functions may return different values for different calls.

For example, the following loop is considered infinite i is not changed in the body:

#+begin_quote

      int i = 0, j = 0;
      while (i < 10) {
        ++j;
      }

#+end_quote

Finds cases where integer division in a floating point context is likely to cause unintended loss of precision.

No reports are made if divisions are part of the following expressions:

• operands of operators expecting integral or bool types,
• call expressions of integral or bool types, and
• explicit cast expressions to integral or bool types,

as these are interpreted as signs of deliberateness from the programmer.

Examples:

#+begin_quote

      float floatFunc(float);
      int intFunc(int);
      double d;
      int i = 42;

      // Warn, floating-point values expected.
      d = 32 * 8 / (2 + i);
      d = 8 * floatFunc(1 + 7 / 2);
      d = i / (1 << 4);

      // OK, no integer division.
      d = 32 * 8.0 / (2 + i);
      d = 8 * floatFunc(1 + 7.0 / 2);
      d = (double)i / (1 << 4);

      // OK, there are signs of deliberateness.
      d = 1 << (i / 2);
      d = 9 + intFunc(6 * i / 32);
      d = (int)(i / 32) - 8;

#+end_quote

Checks for attempts to get the name of a function from within a lambda expression. The name of a lambda is always something like operator(), which is almost never what was intended.

Example:

#+begin_quote

      void FancyFunction() {
        [] { printf("Called from %s\n", __func__); }();
        [] { printf("Now called from %s\n", __FUNCTION__); }();
      }

#+end_quote

Output:

#+begin_quote

      Called from operator()
      Now called from operator()

#+end_quote

Likely intended output:

#+begin_quote

      Called from FancyFunction
      Now called from FancyFunction

#+end_quote

Finds macros that can have unexpected behaviour due to missing parentheses.

Macros are expanded by the preprocessor as-is. As a result, there can be unexpected behaviour; operators may be evaluated in unexpected order and unary operators may become binary operators, etc.

When the replacement list has an expression, it is recommended to surround it with parentheses. This ensures that the macro result is evaluated completely before it is used.

It is also recommended to surround macro arguments in the replacement list with parentheses. This ensures that the argument value is calculated properly.

Checks for repeated argument with side effects in macros.

Finds cases where 1 is added to the string in the argument to strlen(), strnlen(), strnlen_s(), wcslen(), wcsnlen(), and wcsnlen_s() instead of the result and the value is used as an argument to a memory allocation function (malloc(), calloc(), realloc(), alloca()) or the new[] operator in C++. The check detects error cases even if one of these functions (except the new[] operator) is called by a constant function pointer. Cases where 1 is added both to the parameter and the result of the strlen()-like function are ignored, as are cases where the whole addition is surrounded by extra parentheses.

C example code:

#+begin_quote

      void bad_malloc(char *str) {
        char *c = (char*) malloc(strlen(str + 1));
      }

#+end_quote

The suggested fix is to add 1 to the return value of strlen() and not to its argument. In the example above the fix would be

#+begin_quote

      char *c = (char*) malloc(strlen(str) + 1);

#+end_quote

C++ example code:

#+begin_quote

      void bad_new(char *str) {
        char *c = new char[strlen(str + 1)];
      }

#+end_quote

As in the C code with the malloc() function, the suggested fix is to add 1 to the return value of strlen() and not to its argument. In the example above the fix would be

#+begin_quote

      char *c = new char[strlen(str) + 1];

#+end_quote

Example for silencing the diagnostic:

#+begin_quote

      void bad_malloc(char *str) {
        char *c = (char*) malloc(strlen((str + 1)));
      }

#+end_quote

Finds cases where an integer expression is added to or subtracted from the result of a memory allocation function (malloc(), calloc(), realloc(), alloca()) instead of its argument. The check detects error cases even if one of these functions is called by a constant function pointer.

Example code:

#+begin_quote

      void bad_malloc(int n) {
        char *p = (char*) malloc(n) + 10;
      }

#+end_quote

The suggested fix is to add the integer expression to the argument of malloc and not to its result. In the example above the fix would be

#+begin_quote

      char *p = (char*) malloc(n + 10);

#+end_quote

This check will warn when there is a cast of a calculation result to a bigger type. If the intention of the cast is to avoid loss of precision then the cast is misplaced, and there can be loss of precision. Otherwise the cast is ineffective.

Example code:

#+begin_quote

      long f(int x) {
          return (long)(x * 1000);
      }

#+end_quote

The result x * 1000 is first calculated using int precision. If the result exceeds int precision there is loss of precision. Then the result is casted to long.

If there is no loss of precision then the cast can be removed or you can explicitly cast to int instead.

If you want to avoid loss of precision then put the cast in a proper location, for instance:

#+begin_quote

      long f(int x) {
          return (long)x * 1000;
      }

#+end_quote

Forgetting to place the cast at all is at least as dangerous and at least as common as misplacing it. If CheckImplicitCasts is enabled the check also detects these cases, for instance:

#+begin_quote

      long f(int x) {
          return x * 1000;
      }

#+end_quote

Currently warnings are only written for integer conversion. No warning is written for this code:

#+begin_quote

      double f(float x) {
          return (double)(x * 10.0f);
      }

#+end_quote

CheckImplicitCasts

If true, enables detection of implicit casts. Default is false.

Warns if std::move is called on a forwarding reference, for example:

#+begin_quote

      template <typename T>
      void foo(T&& t) {
        bar(std::move(t));
      }

#+end_quote

Forwarding references should typically be passed to std::forward instead of std::move, and this is the fix that will be suggested.

(A forwarding reference is an rvalue reference of a type that is a deduced function template argument.)

In this example, the suggested fix would be

#+begin_quote

      bar(std::forward<T>(t));

#+end_quote

Code like the example above is sometimes written with the expectation that T&& will always end up being an rvalue reference, no matter what type is deduced for T, and that it is therefore not possible to pass an lvalue to foo(). However, this is not true. Consider this example:

#+begin_quote

      std::string s = "Hello, world";
      foo(s);

#+end_quote

This code compiles and, after the call to foo(), s is left in an indeterminate state because it has been moved from. This may be surprising to the caller of foo() because no std::move was used when calling foo().

The reason for this behavior lies in the special rule for template argument deduction on function templates like foo() – i.e. on function templates that take an rvalue reference argument of a type that is a deduced function template argument. (See section [temp.deduct.call]/3 in the C++11 standard.)

If foo() is called on an lvalue (as in the example above), then T is deduced to be an lvalue reference. In the example, T is deduced to be std::string &. The type of the argument t therefore becomes std::string& &&; by the reference collapsing rules, this collapses to std::string&.

This means that the foo(s) call passes s as an lvalue reference, and foo() ends up moving s and thereby placing it into an indeterminate state.

Detect multiple statement macros that are used in unbraced conditionals. Only the first statement of the macro will be inside the conditional and the other ones will be executed unconditionally.

Example:

#+begin_quote

      #define INCREMENT_TWO(x, y) (x)++; (y)++
      if (do_increment)
        INCREMENT_TWO(a, b);  // (b)++ will be executed unconditionally.

#+end_quote

Finds pointers with the noescape attribute that are captured by an asynchronously-executed block. The block arguments in dispatch_async() and dispatch_after() are guaranteed to escape, so it is an error if a pointer with the noescape attribute is captured by one of these blocks.

The following is an example of an invalid use of the noescape attribute.

#+begin_quote

#+begin_quote

#+begin_quote

          void foo(__attribute__((noescape)) int *p) {
            dispatch_async(queue, ^{
              *p = 123;
            });
          });

#+end_quote #+end_quote #+end_quote

Finds function calls where it is possible to cause a not null-terminated result. Usually the proper length of a string is strlen(src) + 1 or equal length of this expression, because the null terminator needs an extra space. Without the null terminator it can result in undefined behaviour when the string is read.

The following and their respective wchar_t based functions are checked:

memcpy, memcpy_s, memchr, memmove, memmove_s, strerror_s, strncmp, strxfrm

The following is a real-world example where the programmer forgot to increase the passed third argument, which is size_t length. That is why the length of the allocated memory is not enough to hold the null terminator.

#+begin_quote

      static char *stringCpy(const std::string &str) {
        char *result = reinterpret_cast<char *>(malloc(str.size()));
        memcpy(result, str.data(), str.size());
        return result;
      }

#+end_quote

In addition to issuing warnings, fix-it rewrites all the necessary code. It also tries to adjust the capacity of the destination array:

#+begin_quote

      static char *stringCpy(const std::string &str) {
        char *result = reinterpret_cast<char *>(malloc(str.size() + 1));
        strcpy(result, str.data());
        return result;
      }

#+end_quote

Note: It cannot guarantee to rewrite every of the path-sensitive memory allocations.

It is possible to rewrite the memcpy() and memcpy_s() calls as the following four functions: strcpy(), strncpy(), strcpy_s(), strncpy_s(), where the latter two are the safer versions of the former two. It rewrites the wchar_t based memory handler functions respectively.

• If copy to the destination array cannot overflow [1] the new function should be the older copy function (ending with cpy), because it is more efficient than the safe version.
• If copy to the destination array can overflow [1] and WantToUseSafeFunctions is set to true and it is possible to obtain the capacity of the destination array then the new function could be the safe version (ending with cpy_s).
• If the new function is could be safe version and C++ files are analysed and the destination array is plain char*/*wchar_t without un/signed then the length of the destination array can be omitted.
• If the new function is could be safe version and the destination array is un/signed it needs to be casted to plain char **/*wchar_t *.

[1] It is possible to overflow:

• If the capacity of the destination array is unknown.
• If the given length is equal to the destination array’s capacity.

• If the given length is strlen(source) or equal length of this expression then the new function should be the older copy function (ending with cpy), as it is more efficient than the safe version (ending with cpy_s).
• Otherwise we assume that the programmer wanted to copy ’N’ characters, so the new function is ncpy-like which copies ’N’ characters.

It transforms the wchar_t based memory and string handler functions respectively (where only strerror_s does not have wchar_t based alias).

memcpy Please visit the Transformation rules of ’memcpy()’ section.

memchr Usually there is a C-style cast and it is needed to be removed, because the new function strchr’s return type is correct. The given length is going to be removed.

memmove If safe functions are available the new function is memmove_s, which has a new second argument which is the length of the destination array, it is adjusted, and the length of the source string is incremented by one. If safe functions are not available the given length is incremented by one.

memmove_s The given length is incremented by one.

strerror_s The given length is incremented by one.

strncmp If the third argument is the first or the second argument’s length + 1 it has to be truncated without the + 1 operation.

strxfrm The given length is incremented by one.

WantToUseSafeFunctions

The value true specifies that the target environment is considered to implement ’_s’ suffixed memory and string handler functions which are safer than older versions (e.g. ’memcpy_s()’). The default value is true.

Detects and fixes calls to grand-…parent virtual methods instead of calls to overridden parent’s virtual methods.

#+begin_quote

      struct A {
        int virtual foo() {...}
      };

      struct B: public A {
        int foo() override {...}
      };

      struct C: public B {
        int foo() override { A::foo(); }
      //                     ^^^^^^^^
      // warning: qualified name A::foo refers to a member overridden in subclass; did you mean 'B'?  [bugprone-parent-virtual-call]
      };

#+end_quote

Checks if any calls to pthread_* or posix_* functions (except posix_openpt) expect negative return values. These functions return either 0 on success or an errno on failure, which is positive only.

Example buggy usage looks like:

#+begin_quote

      if (posix_fadvise(...) < 0) {

#+end_quote

This will never happen as the return value is always non-negative. A simple fix could be:

#+begin_quote

      if (posix_fadvise(...) > 0) {

#+end_quote

Finds condition variables in nested if statements that were also checked in the outer if statement and were not changed.

Simple example:

#+begin_quote

      bool onFire = isBurning();
      if (onFire) {
        if (onFire)
          scream();
      }

#+end_quote

Here onFire is checked both in the outer if and the inner if statement without a possible change between the two checks. The check warns for this code and suggests removal of the second checking of variable onFire.

The checker also detects redundant condition checks if the condition variable is an operand of a logical “and” (&&) or a logical “or” (||) operator:

#+begin_quote

      bool onFire = isBurning();
      if (onFire) {
        if (onFire && peopleInTheBuilding > 0)
          scream();
      }

#+end_quote

#+begin_quote

      bool onFire = isBurning();
      if (onFire) {
        if (onFire || isCollapsing())
          scream();
      }

#+end_quote

In the first case (logical “and”) the suggested fix is to remove the redundant condition variable and keep the other side of the &&. In the second case (logical “or”) the whole if is removed similarily to the simple case on the top.

The condition of the outer if statement may also be a logical “and” (&&) expression:

#+begin_quote

      bool onFire = isBurning();
      if (onFire && fireFighters < 10) {
        if (someOtherCondition()) {
          if (onFire)
            scream();
        }
      }

#+end_quote

The error is also detected if both the outer statement is a logical “and” (&&) and the inner statement is a logical “and” (&&) or “or” (||). The inner if statement does not have to be a direct descendant of the outer one.

No error is detected if the condition variable may have been changed between the two checks:

#+begin_quote

      bool onFire = isBurning();
      if (onFire) {
        tryToExtinguish(onFire);
        if (onFire && peopleInTheBuilding > 0)
          scream();
      }

#+end_quote

Every possible change is considered, thus if the condition variable is not a local variable of the function, it is a volatile or it has an alias (pointer or reference) then no warning is issued.

The else branch is not checked currently for negated condition variable:

#+begin_quote

      bool onFire = isBurning();
      if (onFire) {
        scream();
      } else {
        if (!onFire) {
          continueWork();
        }
      }

#+end_quote

The checker currently only detects redundant checking of single condition variables. More complex expressions are not checked:

#+begin_quote

      if (peopleInTheBuilding == 1) {
        if (peopleInTheBuilding == 1) {
          doSomething();
        }
      }

#+end_quote

cert-dcl37-c and cert-dcl51-cpp redirect here as an alias for this check.

Checks for usages of identifiers reserved for use by the implementation.

The C and C++ standards both reserve the following names for such use:

• identifiers that begin with an underscore followed by an uppercase letter;
• identifiers in the global namespace that begin with an underscore.

The C standard additionally reserves names beginning with a double underscore, while the C++ standard strengthens this to reserve names with a double underscore occurring anywhere.

Violating the naming rules above results in undefined behavior.

#+begin_quote

      namespace NS {
        void __f(); // name is not allowed in user code
        using _Int = int; // same with this
        #define cool__macro // also this
      }
      int _g(); // disallowed in global namespace only

#+end_quote

The check can also be inverted, i.e. it can be configured to flag any identifier that is not a reserved identifier. This mode is for use by e.g. standard library implementors, to ensure they don’t infringe on the user namespace.

This check does not (yet) check for other reserved names, e.g. macro names identical to language keywords, and names specifically reserved by language standards, e.g. C++ ’zombie names’ and C future library directions.

This check corresponds to CERT C Coding Standard rule DCL37-C. Do not declare or define a reserved identifier as well as its C++ counterpart, DCL51-CPP. Do not declare or define a reserved identifier.

Invert

If true, inverts the check, i.e. flags names that are not reserved. Default is false.

AllowedIdentifiers

Semicolon-separated list of names that the check ignores. Default is an empty list.

Finds functions registered as signal handlers that call non asynchronous-safe functions. Any function that cannot be determined to be an asynchronous-safe function call is assumed to be non-asynchronous-safe by the checker, including user functions for which only the declaration is visible. User function calls with visible definition are checked recursively. The check handles only C code. Only the function names are considered and the fact that the function is a system-call, but no other restrictions on the arguments passed to the functions (the signal call is allowed without restrictions).

This check corresponds to the CERT C Coding Standard rule SIG30-C. Call only asynchronous-safe functions within signal handlers and has an alias name cert-sig30-c.

AsyncSafeFunctionSet

Selects wich set of functions is considered as asynchronous-safe (and therefore allowed in signal handlers). Value minimal selects a minimal set that is defined in the CERT SIG30-C rule and includes functions abort(), _Exit(), quick_exit() and signal(). Value POSIX selects a larger set of functions that is listed in POSIX.1-2017 (see this link for more information). The function quick_exit is not included in the shown list. It is assumable that the reason is that the list was not updated for C11. The checker includes quick_exit in the set of safe functions. Functions registered as exit handlers are not checked.

Default is POSIX.

cert-str34-c redirects here as an alias for this check. For the CERT alias, the DiagnoseSignedUnsignedCharComparisons option is set to false.

Finds those signed char -> integer conversions which might indicate a programming error. The basic problem with the signed char, that it might store the non-ASCII characters as negative values. This behavior can cause a misunderstanding of the written code both when an explicit and when an implicit conversion happens.

When the code contains an explicit signed char -> integer conversion, the human programmer probably expects that the converted value matches with the character code (a value from [0..255]), however, the actual value is in [-128..127] interval. To avoid this kind of misinterpretation, the desired way of converting from a signed char to an integer value is converting to unsigned char first, which stores all the characters in the positive [0..255] interval which matches the known character codes.

In case of implicit conversion, the programmer might not actually be aware that a conversion happened and char value is used as an integer. There are some use cases when this unawareness might lead to a functionally imperfect code. For example, checking the equality of a signed char and an unsigned char variable is something we should avoid in C++ code. During this comparison, the two variables are converted to integers which have different value ranges. For signed char, the non-ASCII characters are stored as a value in [-128..-1] interval, while the same characters are stored in the [128..255] interval for an unsigned char.

It depends on the actual platform whether plain char is handled as signed char by default and so it is caught by this check or not. To change the default behavior you can use -funsigned-char and -fsigned-char compilation options.

Currently, this check warns in the following cases: - signed char is assigned to an integer variable - signed char and unsigned char are compared with equality/inequality operator - signed char is converted to an integer in the array subscript

See also: STR34-C. Cast characters to unsigned char before converting to larger integer sizes

A good example from the CERT description when a char variable is used to read from a file that might contain non-ASCII characters. The problem comes up when the code uses the -1 integer value as EOF, while the 255 character code is also stored as -1 in two’s complement form of char type. See a simple example of this bellow. This code stops not only when it reaches the end of the file, but also when it gets a character with the 255 code.

#+begin_quote

      #define EOF (-1)

      int read(void) {
        char CChar;
        int IChar = EOF;

        if (readChar(CChar)) {
          IChar = CChar;
        }
        return IChar;
      }

#+end_quote

A proper way to fix the code above is converting the char variable to an unsigned char value first.

#+begin_quote

      #define EOF (-1)

      int read(void) {
        char CChar;
        int IChar = EOF;

        if (readChar(CChar)) {
          IChar = static_cast<unsigned char>(CChar);
        }
        return IChar;
      }

#+end_quote

Another use case is checking the equality of two char variables with different signedness. Inside the non-ASCII value range this comparison between a signed char and an unsigned char always returns false.

#+begin_quote

      bool compare(signed char SChar, unsigned char USChar) {
        if (SChar == USChar)
          return true;
        return false;
      }

#+end_quote

The easiest way to fix this kind of comparison is casting one of the arguments, so both arguments will have the same type.

#+begin_quote

      bool compare(signed char SChar, unsigned char USChar) {
        if (static_cast<unsigned char>(SChar) == USChar)
          return true;
        return false;
      }

#+end_quote

CharTypdefsToIgnore

A semicolon-separated list of typedef names. In this list, we can list typedefs for char or signed char, which will be ignored by the check. This is useful when a typedef introduces an integer alias like sal_Int8 or int8_t. In this case, human misinterpretation is not an issue.

DiagnoseSignedUnsignedCharComparisons

When true, the check will warn on signed char*/*unsigned char comparisons, otherwise these comparisons are ignored. By default, this option is set to true.

The check finds usages of sizeof on expressions of STL container types. Most likely the user wanted to use .size() instead.

All class/struct types declared in namespace std:: having a const size() method are considered containers, with the exception of std::bitset and std::array.

Examples:

#+begin_quote

      std::string s;
      int a = 47 + sizeof(s); // warning: sizeof() doesn't return the size of the container. Did you mean .size()?

      int b = sizeof(std::string); // no warning, probably intended.

      std::string array_of_strings[10];
      int c = sizeof(array_of_strings) / sizeof(array_of_strings[0]); // no warning, definitely intended.

      std::array<int, 3> std_array;
      int d = sizeof(std_array); // no warning, probably intended.

#+end_quote

The check finds usages of sizeof expressions which are most likely errors.

The sizeof operator yields the size (in bytes) of its operand, which may be an expression or the parenthesized name of a type. Misuse of this operator may be leading to errors and possible software vulnerabilities.

A common mistake is to query the sizeof of an integer literal. This is equivalent to query the size of its type (probably int). The intent of the programmer was probably to simply get the integer and not its size.

#+begin_quote

      #define BUFLEN 42
      char buf[BUFLEN];
      memset(buf, 0, sizeof(BUFLEN));  // sizeof(42) ==> sizeof(int)

#+end_quote

In cases, where there is an enum or integer to represent a type, a common mistake is to query the sizeof on the integer or enum that represents the type that should be used by sizeof. This results in the size of the integer and not of the type the integer represents:

#+begin_quote

      enum data_type {
        FLOAT_TYPE,
        DOUBLE_TYPE
      };

      struct data {
        data_type type;
        void* buffer;
        data_type get_type() {
          return type;
        }
      };

      void f(data d, int numElements) {
        // should be sizeof(float) or sizeof(double), depending on d.get_type()
        int numBytes = numElements * sizeof(d.get_type());
        ...
      }

#+end_quote

The this keyword is evaluated to a pointer to an object of a given type. The expression sizeof(this) is returning the size of a pointer. The programmer most likely wanted the size of the object and not the size of the pointer.

#+begin_quote

      class Point {
        [...]
        size_t size() { return sizeof(this); }  // should probably be sizeof(*this)
        [...]
      };

#+end_quote

There is a subtle difference between declaring a string literal with char A = “”* and char A[] = “”. The first case has the type char* instead of the aggregate type char[]. Using sizeof on an object declared with char* type is returning the size of a pointer instead of the number of characters (bytes) in the string literal.

#+begin_quote

      const char* kMessage = "Hello World!";      // const char kMessage[] = "...";
      void getMessage(char* buf) {
        memcpy(buf, kMessage, sizeof(kMessage));  // sizeof(char*)
      }

#+end_quote

A common mistake is to compute the size of a pointer instead of its pointee. These cases may occur because of explicit cast or implicit conversion.

#+begin_quote

      int A[10];
      memset(A, 0, sizeof(A + 0));

      struct Point point;
      memset(point, 0, sizeof(&point));

#+end_quote

Dividing sizeof expressions is typically used to retrieve the number of elements of an aggregate. This check warns on incompatible or suspicious cases.

In the following example, the entity has 10-bytes and is incompatible with the type int which has 4 bytes.

#+begin_quote

      char buf[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };  // sizeof(buf) => 10
      void getMessage(char* dst) {
        memcpy(dst, buf, sizeof(buf) / sizeof(int));  // sizeof(int) => 4  [incompatible sizes]
      }

#+end_quote

In the following example, the expression sizeof(Values) is returning the size of char*. One can easily be fooled by its declaration, but in parameter declaration the size ’10’ is ignored and the function is receiving a char*.

#+begin_quote

      char OrderedValues[10] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };
      return CompareArray(char Values[10]) {
        return memcmp(OrderedValues, Values, sizeof(Values)) == 0;  // sizeof(Values) ==> sizeof(char*) [implicit cast to char*]
      }

#+end_quote

Multiplying sizeof expressions typically makes no sense and is probably a logic error. In the following example, the programmer used

Getting the sizeof of a sizeof makes no sense and is typically an error hidden through macros.

#+begin_quote

      #define INT_SZ sizeof(int)
      int buf[] = { 42 };
      void getInt(int* dst) {
        memcpy(dst, buf, sizeof(INT_SZ));  // sizeof(sizeof(int)) is suspicious.
      }

#+end_quote

WarnOnSizeOfConstant

When true, the check will warn on an expression like sizeof(CONSTANT). Default is true.

WarnOnSizeOfIntegerExpression

When true, the check will warn on an expression like sizeof(expr) where the expression results in an integer. Default is false.

WarnOnSizeOfThis

When true, the check will warn on an expression like sizeof(this). Default is true.

WarnOnSizeOfCompareToConstant

When true, the check will warn on an expression like sizeof(epxr) <= k for a suspicious constant k while k is 0 or greater than 0x8000. Default is true.

Finds cnd_wait, cnd_timedwait, wait, wait_for, or wait_until function calls when the function is not invoked from a loop that checks whether a condition predicate holds or the function has a condition parameter.

This check corresponds to the CERT C++ Coding Standard rule CON54-CPP. Wrap functions that can spuriously wake up in a loop. and CERT C Coding Standard rule CON36-C. Wrap functions that can spuriously wake up in a loop.

Finds string constructors that are suspicious and probably errors.

A common mistake is to swap parameters to the ’fill’ string-constructor.

Examples:

#+begin_quote

      std::string str('x', 50); // should be str(50, 'x')

#+end_quote

Calling the string-literal constructor with a length bigger than the literal is suspicious and adds extra random characters to the string.

Examples:

#+begin_quote

      std::string("test", 200);   // Will include random characters after "test".
      std::string_view("test", 200);

#+end_quote

Creating an empty string from constructors with parameters is considered suspicious. The programmer should use the empty constructor instead.

Examples:

#+begin_quote

      std::string("test", 0);   // Creation of an empty string.
      std::string_view("test", 0);

#+end_quote

WarnOnLargeLength

When true, the check will warn on a string with a length greater than LargeLengthThreshold. Default is true.

LargeLengthThreshold

An integer specifying the large length threshold. Default is 0x800000.

StringNames

Default is ::std::basic_string;::std::basic_string_view.

Semicolon-delimited list of class names to apply this check to. By default ::std::basic_string applies to std::string and std::wstring. Set to e.g. ::std::basic_string;llvm::StringRef;QString to perform this check on custom classes.

The check finds assignments of an integer to std::basic_string<CharT> (std::string, std::wstring, etc.). The source of the problem is the following assignment operator of std::basic_string<CharT>:

#+begin_quote

      basic_string& operator=( CharT ch );

#+end_quote

Numeric types can be implicitly casted to character types.

#+begin_quote

      std::string s;
      int x = 5965;
      s = 6;
      s = x;

#+end_quote

Use the appropriate conversion functions or character literals.

#+begin_quote

      std::string s;
      int x = 5965;
      s = '6';
      s = std::to_string(x);

#+end_quote

In order to suppress false positives, use an explicit cast.

#+begin_quote

      std::string s;
      s = static_cast<char>(6);

#+end_quote

Finds occurrences of string literal with embedded NUL character and validates their usage.

Special characters can be escaped within a string literal by using their hexadecimal encoding like \x42. A common mistake is to escape them like this \0x42 where the \0 stands for the NUL character.

#+begin_quote

      const char* Example[] = "Invalid character: \0x12 should be \x12";
      const char* Bytes[] = "\x03\0x02\0x01\0x00\0xFF\0xFF\0xFF";

#+end_quote

String-like classes can manipulate strings with embedded NUL as they are keeping track of the bytes and the length. This is not the case for a char* (NUL-terminated) string.

A common mistake is to pass a string-literal with embedded NUL to a string constructor expecting a NUL-terminated string. The bytes after the first NUL character are truncated.

#+begin_quote

      std::string str("abc\0def");  // "def" is truncated
      str += "\0";                  // This statement is doing nothing
      if (str == "\0abc") return;   // This expression is always true

#+end_quote

The checker detects various cases when an enum is probably misused (as a bitmask ).

1. When “ADD” or “bitwise OR” is used between two enum which come from different types and these types value ranges are not disjoint.

The following cases will be investigated only using StrictMode. We regard the enum as a (suspicious) bitmask if the three conditions below are true at the same time:

• at most half of the elements of the enum are non pow-of-2 numbers (because of short enumerations)
• there is another non pow-of-2 number than the enum constant representing all choices (the result “bitwise OR” operation of all enum elements)
• enum type variable/enumconstant is used as an argument of a + or “bitwise OR ” operator

So whenever the non pow-of-2 element is used as a bitmask element we diagnose a misuse and give a warning.

1. Investigating the right hand side of += and |= operator.
2. Check only the enum value side of a | and + operator if one of them is not enum val.
3. Check both side of | or + operator where the enum values are from the same enum type.

Examples:

#+begin_quote

      enum { A, B, C };
      enum { D, E, F = 5 };
      enum { G = 10, H = 11, I = 12 };

      unsigned flag;
      flag =
          A |
          H; // OK, disjoint value intervals in the enum types ->probably good use.
      flag = B | F; // Warning, have common values so they are probably misused.

      // Case 2:
      enum Bitmask {
        A = 0,
        B = 1,
        C = 2,
        D = 4,
        E = 8,
        F = 16,
        G = 31 // OK, real bitmask.
      };

      enum Almostbitmask {
        AA = 0,
        BB = 1,
        CC = 2,
        DD = 4,
        EE = 8,
        FF = 16,
        GG // Problem, forgot to initialize.
      };

      unsigned flag = 0;
      flag |= E; // OK.
      flag |=
          EE; // Warning at the decl, and note that it was used here as a bitmask.

#+end_quote

StrictMode

Default value: 0. When non-null the suspicious bitmask usage will be investigated additionally to the different enum usage check.

The check detects various cases when an include refers to what appears to be an implementation file, which often leads to hard-to-track-down ODR violations.

Examples:

#+begin_quote

      #include "Dinosaur.hpp"     // OK, .hpp files tend not to have definitions.
      #include "Pterodactyl.h"    // OK, .h files tend not to have definitions.
      #include "Velociraptor.cpp" // Warning, filename is suspicious.
      #include_next <stdio.c>     // Warning, filename is suspicious.

#+end_quote

HeaderFileExtensions

Default value: “;h;hh;hpp;hxx” A semicolon-separated list of filename extensions of header files (the filename extensions should not contain a “.” prefix). For extension-less header files, use an empty string or leave an empty string between “;” if there are other filename extensions.

ImplementationFileExtensions

Default value: “c;cc;cpp;cxx” Likewise, a semicolon-separated list of filename extensions of implementation files.

This check finds memset() calls with potential mistakes in their arguments. Considering the function as void memset(void* destination, int fill_value,* size_t byte_count), the following cases are covered:

Case 1: Fill value is a character ``’0’``

Filling up a memory area with ASCII code 48 characters is not customary, possibly integer zeroes were intended instead. The check offers a replacement of ’0’ with 0. Memsetting character pointers with ’0’ is allowed.

Case 2: Fill value is truncated

Memset converts fill_value to unsigned char before using it. If fill_value is out of unsigned character range, it gets truncated and memory will not contain the desired pattern.

Case 3: Byte count is zero

Calling memset with a literal zero in its byte_count argument is likely to be unintended and swapped with fill_value. The check offers to swap these two arguments.

Corresponding cpplint.py check name: runtime/memset.

Examples:

#+begin_quote

      void foo() {
        int i[5] = {1, 2, 3, 4, 5};
        int *ip = i;
        char c = '1';
        char *cp = &c;
        int v = 0;

        // Case 1
        memset(ip, '0', 1); // suspicious
        memset(cp, '0', 1); // OK

        // Case 2
        memset(ip, 0xabcd, 1); // fill value gets truncated
        memset(ip, 0x00, 1);   // OK

        // Case 3
        memset(ip, sizeof(int), v); // zero length, potentially swapped
        memset(ip, 0, 1);           // OK
      }

#+end_quote

String literals placed side-by-side are concatenated at translation phase 6 (after the preprocessor). This feature is used to represent long string literal on multiple lines.

For instance, the following declarations are equivalent:

#+begin_quote

      const char* A[] = "This is a test";
      const char* B[] = "This" " is a "    "test";

#+end_quote

A common mistake done by programmers is to forget a comma between two string literals in an array initializer list.

#+begin_quote

      const char* Test[] = {
        "line 1",
        "line 2"     // Missing comma!
        "line 3",
        "line 4",
        "line 5"
      };

#+end_quote

The array contains the string “line 2line3” at offset 1 (i.e. Test[1]). Clang won’t generate warnings at compile time.

This check may warn incorrectly on cases like:

#+begin_quote

      const char* SupportedFormat[] = {
        "Error %s",
        "Code " PRIu64,   // May warn here.
        "Warning %s",
      };

#+end_quote

SizeThreshold

An unsigned integer specifying the minimum size of a string literal to be considered by the check. Default is 5U.

RatioThreshold

A string specifying the maximum threshold ratio [0, 1.0] of suspicious string literals to be considered. Default is “.2”.

MaxConcatenatedTokens

An unsigned integer specifying the maximum number of concatenated tokens. Default is 5U.

Finds most instances of stray semicolons that unexpectedly alter the meaning of the code. More specifically, it looks for if, while, for and for-range statements whose body is a single semicolon, and then analyzes the context of the code (e.g. indentation) in an attempt to determine whether that is intentional.

#+begin_quote

      if (x < y);
      {
        x++;
      }

#+end_quote

Here the body of the if statement consists of only the semicolon at the end of the first line, and x will be incremented regardless of the condition.

#+begin_quote

      while ((line = readLine(file)) != NULL);
        processLine(line);

#+end_quote

As a result of this code, processLine() will only be called once, when the while loop with the empty body exits with line == NULL. The indentation of the code indicates the intention of the programmer.

#+begin_quote

      if (x >= y);
      x -= y;

#+end_quote

While the indentation does not imply any nesting, there is simply no valid reason to have an if statement with an empty body (but it can make sense for a loop). So this check issues a warning for the code above.

To solve the issue remove the stray semicolon or in case the empty body is intentional, reflect this using code indentation or put the semicolon in a new line. For example:

#+begin_quote

      while (readWhitespace());
        Token t = readNextToken();

#+end_quote

Here the second line is indented in a way that suggests that it is meant to be the body of the while loop - whose body is in fact empty, because of the semicolon at the end of the first line.

Either remove the indentation from the second line:

#+begin_quote

      while (readWhitespace());
      Token t = readNextToken();

#+end_quote

… or move the semicolon from the end of the first line to a new line:

#+begin_quote

      while (readWhitespace())
        ;

        Token t = readNextToken();

#+end_quote

In this case the check will assume that you know what you are doing, and will not raise a warning.

Find suspicious usage of runtime string comparison functions. This check is valid in C and C++.

Checks for calls with implicit comparator and proposed to explicitly add it.

#+begin_quote

      if (strcmp(...))       // Implicitly compare to zero
      if (!strcmp(...))      // Won't warn
      if (strcmp(...) != 0)  // Won't warn

#+end_quote

Checks that compare function results (i,e, strcmp) are compared to valid constant. The resulting value is

#+begin_quote

      <  0    when lower than,
      >  0    when greater than,
      == 0    when equals.

#+end_quote

A common mistake is to compare the result to 1 or -1.

#+begin_quote

      if (strcmp(...) == -1)  // Incorrect usage of the returned value.

#+end_quote

Additionally, the check warns if the results value is implicitly cast to a suspicious non-integer type. It’s happening when the returned value is used in a wrong context.

#+begin_quote

      if (strcmp(...) < 0.)  // Incorrect usage of the returned value.

#+end_quote

WarnOnImplicitComparison

When true, the check will warn on implicit comparison. true by default.

WarnOnLogicalNotComparison

When true, the check will warn on logical not comparison. false by default.

StringCompareLikeFunctions

A string specifying the comma-separated names of the extra string comparison functions. Default is an empty string. The check will detect the following string comparison functions: __builtin_memcmp, __builtin_strcasecmp, __builtin_strcmp, __builtin_strncasecmp, __builtin_strncmp, _mbscmp, _mbscmp_l, _mbsicmp, _mbsicmp_l, _mbsnbcmp, _mbsnbcmp_l, _mbsnbicmp, _mbsnbicmp_l, _mbsncmp, _mbsncmp_l, _mbsnicmp, _mbsnicmp_l, _memicmp, _memicmp_l, _stricmp, _stricmp_l, _strnicmp, _strnicmp_l, _wcsicmp, _wcsicmp_l, _wcsnicmp, _wcsnicmp_l, lstrcmp, lstrcmpi, memcmp, memicmp, strcasecmp, strcmp, strcmpi, stricmp, strncasecmp, strncmp, strnicmp, wcscasecmp, wcscmp, wcsicmp, wcsncmp, wcsnicmp, wmemcmp.

Finds potentially swapped arguments by looking at implicit conversions.

Detects do while loops with a condition always evaluating to false that have a continue statement, as this continue terminates the loop effectively.

#+begin_quote

      void f() {
      do {
        // some code
        continue; // terminating continue
        // some other code
      } while(false);

#+end_quote

Warns about a potentially missing throw keyword. If a temporary object is created, but the object’s type derives from (or is the same as) a class that has ’EXCEPTION’, ’Exception’ or ’exception’ in its name, we can assume that the programmer’s intention was to throw that object.

Example:

#+begin_quote

      void f(int i) {
        if (i < 0) {
          // Exception is created but is not thrown.
          std::runtime_error("Unexpected argument");
        }
      }

#+end_quote

Detects those for loops that have a loop variable with a “too small” type which means this type can’t represent all values which are part of the iteration range.

#+begin_quote

      int main() {
        long size = 294967296l;
        for (short i = 0; i < size; ++i) {}
      }

#+end_quote

This for loop is an infinite loop because the short type can’t represent all values in the [0..size] interval.

In a real use case size means a container’s size which depends on the user input.

#+begin_quote

      int doSomething(const std::vector& items) {
        for (short i = 0; i < items.size(); ++i) {}
      }

#+end_quote

This algorithm works for small amount of objects, but will lead to freeze for a a larger user input.

MagnitudeBitsUpperLimit

Upper limit for the magnitude bits of the loop variable. If it’s set the check filters out those catches in which the loop variable’s type has more magnitude bits as the specified upper limit. The default value is 16. For example, if the user sets this option to 31 (bits), then a 32-bit unsigend int is ignored by the check, however a 32-bit int is not (A 32-bit signed int has 31 magnitude bits).

#+begin_quote

      int main() {
        long size = 294967296l;
        for (unsigned i = 0; i < size; ++i) {} // no warning with MagnitudeBitsUpperLimit = 31 on a system where unsigned is 32-bit
        for (int i = 0; i < size; ++i) {} // warning with MagnitudeBitsUpperLimit = 31 on a system where int is 32-bit
      }

#+end_quote

Finds calls of memory manipulation functions memset(), memcpy() and memmove() on not TriviallyCopyable objects resulting in undefined behavior.

Finds creation of temporary objects in constructors that look like a function call to another constructor of the same class.

The user most likely meant to use a delegating constructor or base class initializer.

Finds calls to new with missing exception handler for std::bad_alloc.

#+begin_quote

      int *f() noexcept {
        int *p = new int[1000];
        // ...
        return p;
      }

#+end_quote

Calls to new can throw exceptions of type std::bad_alloc that should be handled by the code. Alternatively, the nonthrowing form of new can be used. The check verifies that the exception is handled in the function that calls new, unless a nonthrowing version is used or the exception is allowed to propagate out of the function (exception handler is checked for types std::bad_alloc, std::exception, and catch-all handler). The check assumes that any user-defined operator new is either noexcept or may throw an exception of type std::bad_alloc (or derived from it). Other exception types or exceptions occuring in the objects’s constructor are not taken into account.

cert-oop54-cpp redirects here as an alias for this check. For the CERT alias, the WarnOnlyIfThisHasSuspiciousField option is set to false.

Finds user-defined copy assignment operators which do not protect the code against self-assignment either by checking self-assignment explicitly or using the copy-and-swap or the copy-and-move method.

By default, this check searches only those classes which have any pointer or C array field to avoid false positives. In case of a pointer or a C array, it’s likely that self-copy assignment breaks the object if the copy assignment operator was not written with care.

See also: OOP54-CPP. Gracefully handle self-copy assignment

A copy assignment operator must prevent that self-copy assignment ruins the object state. A typical use case is when the class has a pointer field and the copy assignment operator first releases the pointed object and then tries to assign it:

#+begin_quote

      class T {
      int* p;

      public:
        T(const T &rhs) : p(rhs.p ? new int(*rhs.p) : nullptr) {}
        ~T() { delete p; }

        // ...

        T& operator=(const T &rhs) {
          delete p;
          p = new int(*rhs.p);
          return *this;
        }
      };

#+end_quote

There are two common C++ patterns to avoid this problem. The first is the self-assignment check:

#+begin_quote

      class T {
      int* p;

      public:
        T(const T &rhs) : p(rhs.p ? new int(*rhs.p) : nullptr) {}
        ~T() { delete p; }

        // ...

        T& operator=(const T &rhs) {
          if(this == &rhs)
            return *this;

          delete p;
          p = new int(*rhs.p);
          return *this;
        }
      };

#+end_quote

The second one is the copy-and-swap method when we create a temporary copy (using the copy constructor) and then swap this temporary object with this:

#+begin_quote

      class T {
      int* p;

      public:
        T(const T &rhs) : p(rhs.p ? new int(*rhs.p) : nullptr) {}
        ~T() { delete p; }

        // ...

        void swap(T &rhs) {
          using std::swap;
          swap(p, rhs.p);
        }

        T& operator=(const T &rhs) {
          T(rhs).swap(*this);
          return *this;
        }
      };

#+end_quote

There is a third pattern which is less common. Let’s call it the copy-and-move method when we create a temporary copy (using the copy constructor) and then move this temporary object into this (needs a move assignment operator):

#+begin_quote

      class T {
      int* p;

      public:
        T(const T &rhs) : p(rhs.p ? new int(*rhs.p) : nullptr) {}
        ~T() { delete p; }

        // ...

        T& operator=(const T &rhs) {
          T t = rhs;
          *this = std::move(t);
          return *this;
        }

        T& operator=(T &&rhs) {
          p = rhs.p;
          rhs.p = nullptr;
          return *this;
        }
      };

#+end_quote

WarnOnlyIfThisHasSuspiciousField

When true, the check will warn only if the container class of the copy assignment operator has any suspicious fields (pointer or C array). This option is set to true by default.

Finds temporaries that look like RAII objects.

The canonical example for this is a scoped lock.

#+begin_quote

      {
        scoped_lock(&global_mutex);
        critical_section();
      }

#+end_quote

The destructor of the scoped_lock is called before the critical_section is entered, leaving it unprotected.

We apply a number of heuristics to reduce the false positive count of this check:

• Ignore code expanded from macros. Testing frameworks make heavy use of this.
• Ignore types with trivial destructors. They are very unlikely to be RAII objects and there’s no difference when they are deleted.
• Ignore objects at the end of a compound statement (doesn’t change behavior).
• Ignore objects returned from a call.

Warns on unused function return values. The checked functions can be configured.

CheckedFunctions

Semicolon-separated list of functions to check. Defaults to ::std::async;::std::launder;::std::remove;::std::remove_if;::std::unique;::std::unique_ptr::release;::std::basic_string::empty;::std::vector::empty. This means that the calls to following functions are checked by default:

• std::async(). Not using the return value makes the call synchronous.
• std::launder(). Not using the return value usually means that the function interface was misunderstood by the programmer. Only the returned pointer is “laundered”, not the argument.
• std::remove(), std::remove_if() and std::unique(). The returned iterator indicates the boundary between elements to keep and elements to be removed. Not using the return value means that the information about which elements to remove is lost.
• std::unique_ptr::release(). Not using the return value can lead to resource leaks if the same pointer isn’t stored anywhere else. Often, ignoring the release() return value indicates that the programmer confused the function with reset().
• std::basic_string::empty() and std::vector::empty(). Not using the return value often indicates that the programmer confused the function with clear().

Warns if an object is used after it has been moved, for example:

#+begin_quote

      std::string str = "Hello, world!\n";
      std::vector<std::string> messages;
      messages.emplace_back(std::move(str));
      std::cout << str;

#+end_quote

The last line will trigger a warning that str is used after it has been moved.

The check does not trigger a warning if the object is reinitialized after the move and before the use. For example, no warning will be output for this code:

#+begin_quote

      messages.emplace_back(std::move(str));
      str = "Greetings, stranger!\n";
      std::cout << str;

#+end_quote

Subsections below explain more precisely what exactly the check considers to be a move, use, and reinitialization.

The check takes control flow into account. A warning is only emitted if the use can be reached from the move. This means that the following code does not produce a warning:

#+begin_quote

      if (condition) {
        messages.emplace_back(std::move(str));
      } else {
        std::cout << str;
      }

#+end_quote

On the other hand, the following code does produce a warning:

#+begin_quote

      for (int i = 0; i < 10; ++i) {
        std::cout << str;
        messages.emplace_back(std::move(str));
      }

#+end_quote

(The use-after-move happens on the second iteration of the loop.)

In some cases, the check may not be able to detect that two branches are mutually exclusive. For example (assuming that i is an int):

#+begin_quote

      if (i == 1) {
        messages.emplace_back(std::move(str));
      }
      if (i == 2) {
        std::cout << str;
      }

#+end_quote

In this case, the check will erroneously produce a warning, even though it is not possible for both the move and the use to be executed. More formally, the analysis is flow-sensitive but not path-sensitive.

An erroneous warning can be silenced by reinitializing the object after the move:

#+begin_quote

      if (i == 1) {
        messages.emplace_back(std::move(str));
        str = "";
      }
      if (i == 2) {
        std::cout << str;
      }

#+end_quote

If you want to avoid the overhead of actually reinitializing the object, you can create a dummy function that causes the check to assume the object was reinitialized:

#+begin_quote

      template <class T>
      void IS_INITIALIZED(T&) {}

#+end_quote

You can use this as follows:

#+begin_quote

      if (i == 1) {
        messages.emplace_back(std::move(str));
      }
      if (i == 2) {
        IS_INITIALIZED(str);
        std::cout << str;
      }

#+end_quote

The check will not output a warning in this case because passing the object to a function as a non-const pointer or reference counts as a reinitialization (see section Reinitialization below).

In many cases, C++ does not make any guarantees about the order in which sub-expressions of a statement are evaluated. This means that in code like the following, it is not guaranteed whether the use will happen before or after the move:

#+begin_quote

      void f(int i, std::vector<int> v);
      std::vector<int> v = { 1, 2, 3 };
      f(v[1], std::move(v));

#+end_quote

In this kind of situation, the check will note that the use and move are unsequenced.

The check will also take sequencing rules into account when reinitializations occur in the same statement as moves or uses. A reinitialization is only considered to reinitialize a variable if it is guaranteed to be evaluated after the move and before the use.

The check currently only considers calls of std::move on local variables or function parameters. It does not check moves of member variables or global variables.

Any call of std::move on a variable is considered to cause a move of that variable, even if the result of std::move is not passed to an rvalue reference parameter.

This means that the check will flag a use-after-move even on a type that does not define a move constructor or move assignment operator. This is intentional. Developers may use std::move on such a type in the expectation that the type will add move semantics in the future. If such a std::move has the potential to cause a use-after-move, we want to warn about it even if the type does not implement move semantics yet.

Furthermore, if the result of std::move is passed to an rvalue reference parameter, this will always be considered to cause a move, even if the function that consumes this parameter does not move from it, or if it does so only conditionally. For example, in the following situation, the check will assume that a move always takes place:

#+begin_quote

      std::vector<std::string> messages;
      void f(std::string &&str) {
        // Only remember the message if it isn't empty.
        if (!str.empty()) {
          messages.emplace_back(std::move(str));
        }
      }
      std::string str = "";
      f(std::move(str));

#+end_quote

The check will assume that the last line causes a move, even though, in this particular case, it does not. Again, this is intentional.

There is one special case: A call to std::move inside a try_emplace call is conservatively assumed not to move. This is to avoid spurious warnings, as the check has no way to reason about the bool returned by try_emplace.

When analyzing the order in which moves, uses and reinitializations happen (see section Unsequenced moves, uses, and reinitializations), the move is assumed to occur in whichever function the result of the std::move is passed to.

Any occurrence of the moved variable that is not a reinitialization (see below) is considered to be a use.

An exception to this are objects of type std::unique_ptr, std::shared_ptr and std::weak_ptr, which have defined move behavior (objects of these classes are guaranteed to be empty after they have been moved from). Therefore, an object of these classes will only be considered to be used if it is dereferenced, i.e. if operator*, operator-> or operator[] (in the case of std::unique_ptr<T []>) is called on it.

If multiple uses occur after a move, only the first of these is flagged.

The check considers a variable to be reinitialized in the following cases:

#+begin_quote

#+begin_quote

• The variable occurs on the left-hand side of an assignment.
• The variable is passed to a function as a non-const pointer or non-const lvalue reference. (It is assumed that the variable may be an out-parameter for the function.)
• clear() or assign() is called on the variable and the variable is of one of the standard container types basic_string, vector, deque, forward_list, list, set, map, multiset, multimap, unordered_set, unordered_map, unordered_multiset, unordered_multimap.
• reset() is called on the variable and the variable is of type std::unique_ptr, std::shared_ptr or std::weak_ptr.
• A member function marked with the attribute is called on the variable.

#+end_quote #+end_quote

If the variable in question is a struct and an individual member variable of that struct is written to, the check does not consider this to be a reinitialization – even if, eventually, all member variables of the struct are written to. For example:

#+begin_quote

      struct S {
        std::string str;
        int i;
      };
      S s = { "Hello, world!\n", 42 };
      S s_other = std::move(s);
      s.str = "Lorem ipsum";
      s.i = 99;

#+end_quote

The check will not consider s to be reinitialized after the last line; instead, the line that assigns to s.str will be flagged as a use-after-move. This is intentional as this pattern of reinitializing a struct is error-prone. For example, if an additional member variable is added to S, it is easy to forget to add the reinitialization for this additional member. Instead, it is safer to assign to the entire struct in one go, and this will also avoid the use-after-move warning.

Warn if a function is a near miss (ie. the name is very similar and the function signature is the same) to a virtual function from a base class.

Example:

#+begin_quote

      struct Base {
        virtual void func();
      };

      struct Derived : Base {
        virtual funk();
        // warning: 'Derived::funk' has a similar name and the same signature as virtual method 'Base::func'; did you mean to override it?
      };

#+end_quote

The cert-con36-c check is an alias, please see bugprone-spuriously-wake-up-functions for more information.

The cert-con54-cpp check is an alias, please see bugprone-spuriously-wake-up-functions for more information.

The cert-dcl03-c check is an alias, please see misc-static-assert for more information.

The cert-dcl16-c check is an alias, please see readability-uppercase-literal-suffix for more information.

This check flags postfix operator++ and operator-- declarations if the return type is not a const object. This also warns if the return type is a reference type.

The object returned by a postfix increment or decrement operator is supposed to be a snapshot of the object’s value prior to modification. With such an implementation, any modifications made to the resulting object from calling operator++(int) would be modifying a temporary object. Thus, such an implementation of a postfix increment or decrement operator should instead return a const object, prohibiting accidental mutation of a temporary object. Similarly, it is unexpected for the postfix operator to return a reference to its previous state, and any subsequent modifications would be operating on a stale object.

This check corresponds to the CERT C++ Coding Standard recommendation DCL21-CPP. Overloaded postfix increment and decrement operators should return a const object. However, all of the CERT recommendations have been removed from public view, and so their justification for the behavior of this check requires an account on their wiki to view.

The cert-dcl37-c check is an alias, please see bugprone-reserved-identifier for more information.

This check flags all function definitions (but not declarations) of C-style variadic functions.

This check corresponds to the CERT C++ Coding Standard rule DCL50-CPP. Do not define a C-style variadic function.

The cert-dcl51-cpp check is an alias, please see bugprone-reserved-identifier for more information.

The cert-dcl54-cpp check is an alias, please see misc-new-delete-overloads for more information.

Modification of the std or posix namespace can result in undefined behavior. This check warns for such modifications.

Examples:

#+begin_quote

      namespace std {
        int x; // May cause undefined behavior.
      }

#+end_quote

This check corresponds to the CERT C++ Coding Standard rule DCL58-CPP. Do not modify the standard namespaces.

The cert-dcl59-cpp check is an alias, please see google-build-namespaces for more information.

This check flags calls to system(), popen(), and _popen(), which execute a command processor. It does not flag calls to system() with a null pointer argument, as such a call checks for the presence of a command processor but does not actually attempt to execute a command.

This check corresponds to the CERT C Coding Standard rule ENV33-C. Do not call system().

The cert-err09-cpp check is an alias, please see misc-throw-by-value-catch-by-reference for more information.

This check corresponds to the CERT C++ Coding Standard recommendation ERR09-CPP. Throw anonymous temporaries. However, all of the CERT recommendations have been removed from public view, and so their justification for the behavior of this check requires an account on their wiki to view.

This check flags calls to string-to-number conversion functions that do not verify the validity of the conversion, such as atoi() or scanf(). It does not flag calls to strtol(), or other, related conversion functions that do perform better error checking.

#+begin_quote

      #include <stdlib.h>

      void func(const char *buff) {
        int si;

        if (buff) {
          si = atoi(buff); /* 'atoi' used to convert a string to an integer, but function will
                               not report conversion errors; consider using 'strtol' instead. */
        } else {
          /* Handle error */
        }
      }

#+end_quote

This check corresponds to the CERT C Coding Standard rule ERR34-C. Detect errors when converting a string to a number.

This check flags all call expressions involving setjmp() and longjmp().

This check corresponds to the CERT C++ Coding Standard rule ERR52-CPP. Do not use setjmp() or longjmp().

This check flags all static or thread_local variable declarations where the initializer for the object may throw an exception.

This check corresponds to the CERT C++ Coding Standard rule ERR58-CPP. Handle all exceptions thrown before main() begins executing.

This check flags all throw expressions where the exception object is not nothrow copy constructible.

This check corresponds to the CERT C++ Coding Standard rule ERR60-CPP. Exception objects must be nothrow copy constructible.

The cert-err61-cpp check is an alias, please see misc-throw-by-value-catch-by-reference for more information.

The cert-fio38-c check is an alias, please see misc-non-copyable-objects for more information.

This check flags for loops where the induction expression has a floating-point type.

This check corresponds to the CERT C Coding Standard rule FLP30-C. Do not use floating-point variables as loop counters.

This check flags uses of default operator new where the type has extended alignment (an alignment greater than the fundamental alignment). (The default operator new is guaranteed to provide the correct alignment if the requested alignment is less or equal to the fundamental alignment). Only cases are detected (by design) where the operator new is not user-defined and is not a placement new (the reason is that in these cases we assume that the user provided the correct memory allocation).

This check corresponds to the CERT C++ Coding Standard rule MEM57-CPP. Avoid using default operator new for over-aligned types.

The cert-msc30-c check is an alias, please see cert-msc50-cpp for more information.

The cert-msc32-c check is an alias, please see cert-msc51-cpp for more information.

Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random. The std::rand() function takes a seed (number), runs a mathematical operation on it and returns the result. By manipulating the seed the result can be predictable. This check warns for the usage of std::rand().

This check flags all pseudo-random number engines, engine adaptor instantiations and srand() when initialized or seeded with default argument, constant expression or any user-configurable type. Pseudo-random number engines seeded with a predictable value may cause vulnerabilities e.g. in security protocols. This is a CERT security rule, see MSC51-CPP. Ensure your random number generator is properly seeded and MSC32-C. Properly seed pseudorandom number generators.

Examples:

#+begin_quote

      void foo() {
        std::mt19937 engine1; // Diagnose, always generate the same sequence
        std::mt19937 engine2(1); // Diagnose
        engine1.seed(); // Diagnose
        engine2.seed(1); // Diagnose

        std::time_t t;
        engine1.seed(std::time(&t)); // Diagnose, system time might be controlled by user

        int x = atoi(argv[1]);
        std::mt19937 engine3(x);  // Will not warn
      }

#+end_quote

DisallowedSeedTypes

A comma-separated list of the type names which are disallowed. Default values are time_t, std::time_t.

The cert-oop11-cpp check is an alias, please see performance-move-constructor-init for more information.

This check corresponds to the CERT C++ Coding Standard recommendation OOP11-CPP. Do not copy-initialize members or base classes from a move constructor. However, all of the CERT recommendations have been removed from public view, and so their justification for the behavior of this check requires an account on their wiki to view.

The cert-oop54-cpp check is an alias, please see bugprone-unhandled-self-assignment for more information.

#+begin_quote Flags use of the C standard library functions memset, memcpy and memcmp and similar derivatives on non-trivial types.

#+end_quote

MemSetNames

Specify extra functions to flag that act similarily to memset. Specify names in a semicolon delimited list. Default is an empty string. The check will detect the following functions: memset, std::memset.

MemCpyNames

Specify extra functions to flag that act similarily to memcpy. Specify names in a semicolon delimited list. Default is an empty string. The check will detect the following functions: std::memcpy, memcpy, std::memmove, memmove, std::strcpy, strcpy, memccpy, stpncpy, strncpy.

MemCmpNames

Specify extra functions to flag that act similarily to memcmp. Specify names in a semicolon delimited list. Default is an empty string. The check will detect the following functions: std::memcmp, memcmp, std::strcmp, strcmp, strncmp.

This check corresponds to the CERT C++ Coding Standard rule OOP57-CPP. Prefer special member functions and overloaded operators to C Standard Library functions.

Finds assignments to the copied object and its direct or indirect members in copy constructors and copy assignment operators.

This check corresponds to the CERT C Coding Standard rule OOP58-CPP. Copy operations must not mutate the source object.

The cert-pos44-c check is an alias, please see bugprone-bad-signal-to-kill-thread for more information.

The cert-pos47-c check is an alias, please see concurrency-thread-canceltype-asynchronous for more information.

The cert-sig30-c check is an alias, please see bugprone-signal-handler for more information.

The cert-str34-c check is an alias, please see bugprone-signed-char-misuse for more information.

The clang-analyzer-core.CallAndMessage check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.DivideZero check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Generate dynamic type information

The clang-analyzer-core.NonNullParamChecker check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.NullDereference check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.StackAddressEscape check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.UndefinedBinaryOperatorResult check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.VLASize check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.uninitialized.ArraySubscript check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.uninitialized.Assign check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-core.uninitialized.Branch check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Check for blocks that capture uninitialized values

The clang-analyzer-core.uninitialized.UndefReturn check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Check for inner pointers of C++ containers used after re/deallocation

The clang-analyzer-cplusplus.Move check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-cplusplus.NewDelete check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-cplusplus.NewDeleteLeaks check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-deadcode.DeadStores check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-nullability.NullPassedToNonnull check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-nullability.NullReturnedFromNonnull check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-nullability.NullableDereferenced check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-nullability.NullablePassedToNonnull check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Warns when a nullable pointer is returned from a function that has _Nonnull return type.

The clang-analyzer-optin.cplusplus.UninitializedObject check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-optin.cplusplus.VirtualCall check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-optin.mpi.MPI-Checker check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Checker for C-style casts of OSObjects

The clang-analyzer-optin.osx.cocoa.localizability.EmptyLocalizationContextChecker check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-optin.osx.cocoa.localizability.NonLocalizedStringChecker check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Check for performance anti-patterns when using Grand Central Dispatch

Check for excessively padded structs.

Finds implementation-defined behavior in UNIX/Posix functions

The clang-analyzer-osx.API check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Find violations of the Mach Interface Generator calling convention

Check for erroneous conversions of objects representing numbers into numbers

Check for leaks and improper reference count management for OSObject

Check for proper uses of Objective-C properties

The clang-analyzer-osx.SecKeychainAPI check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.AtSync check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Warn about potentially crashing writes to autoreleasing objects from different autoreleasing pools in Objective-C

The clang-analyzer-osx.cocoa.ClassRelease check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.Dealloc check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.IncompatibleMethodTypes check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Improved modeling of loops using Cocoa collection types

Warn about Objective-C methods that lack a necessary call to super

The clang-analyzer-osx.cocoa.NSAutoreleasePool check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.NSError check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.NilArg check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Model the APIs that are guaranteed to return a non-nil value

The clang-analyzer-osx.cocoa.ObjCGenerics check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.RetainCount check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Check for leaked memory in autorelease pools that will never be drained

The clang-analyzer-osx.cocoa.SelfInit check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.SuperDealloc check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.UnusedIvars check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.cocoa.VariadicMethodTypes check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.coreFoundation.CFError check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.coreFoundation.CFNumber check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.coreFoundation.CFRetainRelease check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.coreFoundation.containers.OutOfBounds check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-osx.coreFoundation.containers.PointerSizedValues check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.FloatLoopCounter check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.UncheckedReturn check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.bcmp check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.bcopy check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.bzero check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.getpw check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.gets check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.mkstemp check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.mktemp check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.rand check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.strcpy check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-security.insecureAPI.vfork check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.API check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.Malloc check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.MallocSizeof check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.MismatchedDeallocator check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.Vfork check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.cstring.BadSizeArg check is an alias, please see Clang Static Analyzer Available Checkers for more information.

The clang-analyzer-unix.cstring.NullArg check is an alias, please see Clang Static Analyzer Available Checkers for more information.

Check for va_lists which are copied onto itself.

Check for usages of uninitialized (or already released) va_lists.

Check for va_lists which are not released by a va_end call.

Checks for some thread-unsafe functions against a black list of known-to-be-unsafe functions. Usually they access static variables without synchronization (e.g. gmtime(3)) or utilize signals in a racy way. The set of functions to check is specified with the FunctionSet option.

Note that using some thread-unsafe functions may be still valid in concurrent programming if only a single thread is used (e.g. setenv(3)), however, some functions may track a state in global variables which would be clobbered by subsequent (non-parallel, but concurrent) calls to a related function. E.g. the following code suffers from unprotected accesses to a global state:

#+begin_quote

      // getnetent(3) maintains global state with DB connection, etc.
      // If a concurrent green thread calls getnetent(3), the global state is corrupted.
      netent = getnetent();
      yield();
      netent = getnetent();

#+end_quote

Examples:

#+begin_quote

      tm = gmtime(timep); // uses a global buffer

      sleep(1); // implementation may use SIGALRM

#+end_quote

FunctionSet

Specifies which functions in libc should be considered thread-safe, possible values are posix, glibc, or any.

posix means POSIX defined thread-unsafe functions. POSIX.1-2001 in “2.9.1 Thread-Safety” defines that all functions specified in the standard are thread-safe except a predefined list of thread-unsafe functions.

Glibc defines some of them as thread-safe (e.g. dirname(3)), but adds non-POSIX thread-unsafe ones (e.g. getopt_long(3)). Glibc’s list is compiled from GNU web documentation with a search for MT-Safe tag: https://www.gnu.org/software/libc/manual/html_node/POSIX-Safety-Concepts.html

If you want to identify thread-unsafe API for at least one libc or unsure which libc will be used, use any (default).

Finds pthread_setcanceltype function calls where a thread’s cancellation type is set to asynchronous. Asynchronous cancellation type (PTHREAD_CANCEL_ASYNCHRONOUS) is generally unsafe, use type PTHREAD_CANCEL_DEFERRED instead which is the default. Even with deferred cancellation, a cancellation point in an asynchronous signal handler may still be acted upon and the effect is as if it was an asynchronous cancellation.

This check corresponds to the CERT C Coding Standard rule POS47-C. Do not use threads that can be canceled asynchronously.

The cppcoreguidelines-avoid-c-arrays check is an alias, please see modernize-avoid-c-arrays for more information.

The usage of goto for control flow is error prone and should be replaced with looping constructs. Only forward jumps in nested loops are accepted.

This check implements ES.76 from the CppCoreGuidelines and 6.3.1 from High Integrity C++.

For more information on why to avoid programming with goto you can read the famous paper A Case against the GO TO Statement..

The check diagnoses goto for backward jumps in every language mode. These should be replaced with C/C++ looping constructs.

#+begin_quote

      // Bad, handwritten for loop.
      int i = 0;
      // Jump label for the loop
      loop_start:
      do_some_operation();

      if (i < 100) {
        ++i;
        goto loop_start;
      }

      // Better
      for(int i = 0; i < 100; ++i)
        do_some_operation();

#+end_quote

Modern C++ needs goto only to jump out of nested loops.

#+begin_quote

      for(int i = 0; i < 100; ++i) {
        for(int j = 0; j < 100; ++j) {
          if (i * j > 500)
            goto early_exit;
        }
      }

      early_exit:
      some_operation();

#+end_quote

All other uses of goto are diagnosed in C++.

The cppcoreguidelines-avoid-magic-numbers check is an alias, please see readability-magic-numbers for more information.

Finds non-const global variables as described in I.2 of C++ Core Guidelines . As R.6 of C++ Core Guidelines is a duplicate of rule I.2 it also covers that rule.

#+begin_quote

      char a;  // Warns!
      const char b =  0;

      namespace some_namespace
      {
          char c;  // Warns!
          const char d = 0;
      }

      char * c_ptr1 = &some_namespace::c;  // Warns!
      char *const c_const_ptr = &some_namespace::c;  // Warns!
      char & c_reference = some_namespace::c;  // Warns!

      class Foo  // No Warnings inside Foo, only namespace scope is covered
      {
      public:
          char e = 0;
          const char f = 0;
      protected:
          char g = 0;
      private:
          char h = 0;
      };

#+end_quote

Variables: a, c, c_ptr1, c_ptr2, c_const_ptr and c_reference, will all generate warnings since they are either: a globally accessible variable and non-const, a pointer or reference providing global access to non-const data or both.

The cppcoreguidelines-c-copy-assignment-signature check is an alias, please see misc-unconventional-assign-operator for more information.

The cppcoreguidelines-explicit-virtual-functions check is an alias, please see modernize-use-override for more information.

Checks whether there are local variables that are declared without an initial value. These may lead to unexpected behaviour if there is a code path that reads the variable before assigning to it.

Only integers, booleans, floats, doubles and pointers are checked. The fix option initializes all detected values with the value of zero. An exception is float and double types, which are initialized to NaN.

As an example a function that looks like this:

#+begin_quote

      void function() {
        int x;
        char *txt;
        double d;

        // Rest of the function.
      }

#+end_quote

Would be rewritten to look like this:

#+begin_quote

      #include <math.h>

      void function() {
        int x = 0;
        char *txt = nullptr;
        double d = NAN;

        // Rest of the function.
      }

#+end_quote

It warns for the uninitialized enum case, but without a FixIt:

#+begin_quote

      enum A {A1, A2, A3};
      enum A_c : char { A_c1, A_c2, A_c3 };
      enum class B { B1, B2, B3 };
      enum class B_i : int { B_i1, B_i2, B_i3 };
      void function() {
        A a;     // Warning: variable 'a' is not initialized
        A_c a_c; // Warning: variable 'a_c' is not initialized
        B b;     // Warning: variable 'b' is not initialized
        B_i b_i; // Warning: variable 'b_i' is not initialized
      }

#+end_quote

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

MathHeader

A string specifying the header to include to get the definition of NAN. Default is <math.h>.

This check flags initializers of globals that access extern objects, and therefore can lead to order-of-initialization problems.

This rule is part of the “Interfaces” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Ri-global-init

Note that currently this does not flag calls to non-constexpr functions, and therefore globals could still be accessed from functions themselves.

Finds macro usage that is considered problematic because better language constructs exist for the task.

The relevant sections in the C++ Core Guidelines are Enum.1, ES.30, ES.31 and ES.33.

AllowedRegexp

A regular expression to filter allowed macros. For example DEBUG*|LIBTORRENT*|TORRENT*|UNI* could be applied to filter libtorrent. Default value is ^DEBUG_*.

CheckCapsOnly

Boolean flag to warn on all macros except those with CAPS_ONLY names. This option is intended to ease introduction of this check into older code bases. Default value is false.

IgnoreCommandLineMacros

Boolean flag to toggle ignoring command-line-defined macros. Default value is true.

Checks for silent narrowing conversions, e.g: int i = 0; i += 0.1;. While the issue is obvious in this former example, it might not be so in the following: void MyClass::f(double d) { int_member_ += d; }.

This rule is part of the “Expressions and statements” profile of the C++ Core Guidelines, corresponding to rule ES.46. See

https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#es46-avoid-lossy-narrowing-truncating-arithmetic-conversions.

• We enforce only part of the guideline, more specifically, we flag narrowing conversions from: ::
  • an integer to a narrower integer (e.g. char to unsigned char) if WarnOnIntegerNarrowingConversion Option is set,
  • an integer to a narrower floating-point (e.g. uint64_t to float),
  • a floating-point to an integer (e.g. double to int),
  • a floating-point to a narrower floating-point (e.g. double to float) if WarnOnFloatingPointNarrowingConversion Option is set.
• • All narrowing conversions that are not marked by an explicit cast (c-style or static_cast). For example: int i = 0; i += 0.1;, void f(int); f(0.1);,
  • All applications of binary operators with a narrowing conversions. For example: int i; i+= 0.1;.

WarnOnIntegerNarrowingConversion

When true, the check will warn on narrowing integer conversion (e.g. int to size_t). true by default.

WarnOnFloatingPointNarrowingConversion

When true, the check will warn on narrowing floating point conversion (e.g. double to float). true by default.

WarnWithinTemplateInstantiation

When true, the check will warn on narrowing conversions within template instantations. false by default.

WarnOnEquivalentBitWidth

When true, the check will warn on narrowing conversions that arise from casting between types of equivalent bit width. (e.g. int n = uint(0); or long long n = double(0);) true by default.

IgnoreConversionFromTypes

Narrowing conversions from any type in this semicolon-separated list will be ignored. This may be useful to weed out commonly occurring, but less commonly problematic assignments such as int n = std::vector<char>().size(); or int n = std::difference(it1, it2);. The default list is empty, but one suggested list for a legacy codebase would be size_t;ptrdiff_t;size_type;difference_type.

PedanticMode

When true, the check will warn on assigning a floating point constant to an integer value even if the floating point value is exactly representable in the destination type (e.g. int i = 1.0;). false by default.

#+begin_quote

#+begin_quote

• What does “narrowing conversion from ‘int’ to ‘float’” mean?

#+end_quote #+end_quote

An IEEE754 Floating Point number can represent all integer values in the range [-2^PrecisionBits, 2^PrecisionBits] where PrecisionBits is the number of bits in the mantissa.

For float this would be [-2^23, 2^23], where int can represent values in the range [-2^31, 2^31-1].

#+begin_quote

#+begin_quote

• What does “implementation-defined” mean?

#+end_quote #+end_quote

You may have encountered messages like “narrowing conversion from ‘unsigned int’ to signed type ‘int’ is implementation-defined”. The C/C++ standard does not mandate two’s complement for signed integers, and so the compiler is free to define what the semantics are for converting an unsigned integer to signed integer. Clang’s implementation uses the two’s complement format.

This check handles C-Style memory management using malloc(), realloc(), calloc() and free(). It warns about its use and tries to suggest the use of an appropriate RAII object. Furthermore, it can be configured to check against a user-specified list of functions that are used for memory management (e.g. posix_memalign()). See C++ Core Guidelines.

There is no attempt made to provide fix-it hints, since manual resource management isn’t easily transformed automatically into RAII.

#+begin_quote

      // Warns each of the following lines.
      // Containers like std::vector or std::string should be used.
      char* some_string = (char*) malloc(sizeof(char) * 20);
      char* some_string = (char*) realloc(sizeof(char) * 30);
      free(some_string);

      int* int_array = (int*) calloc(30, sizeof(int));

      // Rather use a smartpointer or stack variable.
      struct some_struct* s = (struct some_struct*) malloc(sizeof(struct some_struct));

#+end_quote

Allocations

Semicolon-separated list of fully qualified names of memory allocation functions. Defaults to ::malloc;::calloc.

Deallocations

Semicolon-separated list of fully qualified names of memory allocation functions. Defaults to ::free.

Reallocations

Semicolon-separated list of fully qualified names of memory allocation functions. Defaults to ::realloc.

The cppcoreguidelines-non-private-member-variables-in-classes check is an alias, please see misc-non-private-member-variables-in-classes for more information.

This check implements the type-based semantics of gsl::owner<T*>, which allows static analysis on code, that uses raw pointers to handle resources like dynamic memory, but won’t introduce RAII concepts.

The relevant sections in the C++ Core Guidelines are I.11, C.33, R.3 and GSL.Views The definition of a gsl::owner<T*> is straight forward

#+begin_quote

      namespace gsl { template <typename T> owner = T; }

#+end_quote

It is therefore simple to introduce the owner even without using an implementation of the Guideline Support Library.

All checks are purely type based and not (yet) flow sensitive.

The following examples will demonstrate the correct and incorrect initializations of owners, assignment is handled the same way. Note that both new and malloc()-like resource functions are considered to produce resources.

#+begin_quote

      // Creating an owner with factory functions is checked.
      gsl::owner<int*> function_that_returns_owner() { return gsl::owner<int*>(new int(42)); }

      // Dynamic memory must be assigned to an owner
      int* Something = new int(42); // BAD, will be caught
      gsl::owner<int*> Owner = new int(42); // Good
      gsl::owner<int*> Owner = new int[42]; // Good as well

      // Returned owner must be assigned to an owner
      int* Something = function_that_returns_owner(); // Bad, factory function
      gsl::owner<int*> Owner = function_that_returns_owner(); // Good, result lands in owner

      // Something not a resource or owner should not be assigned to owners
      int Stack = 42;
      gsl::owner<int*> Owned = &Stack; // Bad, not a resource assigned

#+end_quote

In the case of dynamic memory as resource, only gsl::owner<T*> variables are allowed to be deleted.

#+begin_quote

      // Example Bad, non-owner as resource handle, will be caught.
      int* NonOwner = new int(42); // First warning here, since new must land in an owner
      delete NonOwner; // Second warning here, since only owners are allowed to be deleted

      // Example Good, Ownership correctly stated
      gsl::owner<int*> Owner = new int(42); // Good
      delete Owner; // Good as well, statically enforced, that only owners get deleted

#+end_quote

The check will furthermore ensure, that functions, that expect a gsl::owner<T*> as argument get called with either a gsl::owner<T*> or a newly created resource.

#+begin_quote

      void expects_owner(gsl::owner<int*> o) { delete o; }

      // Bad Code
      int NonOwner = 42;
      expects_owner(&NonOwner); // Bad, will get caught

      // Good Code
      gsl::owner<int*> Owner = new int(42);
      expects_owner(Owner); // Good
      expects_owner(new int(42)); // Good as well, recognized created resource

      // Port legacy code for better resource-safety
      gsl::owner<FILE*> File = fopen("my_file.txt", "rw+");
      FILE* BadFile = fopen("another_file.txt", "w"); // Bad, warned

      // ... use the file

      fclose(File); // Ok, File is annotated as 'owner<>'
      fclose(BadFile); // BadFile is not an 'owner<>', will be warned

#+end_quote

LegacyResourceProducers

Semicolon-separated list of fully qualified names of legacy functions that create resources but cannot introduce gsl::owner<>. Defaults to ::malloc;::aligned_alloc;::realloc;::calloc;::fopen;::freopen;::tmpfile.

LegacyResourceConsumers

Semicolon-separated list of fully qualified names of legacy functions expecting resource owners as pointer arguments but cannot introduce gsl::owner<>. Defaults to ::free;::realloc;::freopen;::fclose.

Using gsl::owner<T*> in a typedef or alias is not handled correctly.

#+begin_quote

      using heap_int = gsl::owner<int*>;
      heap_int allocated = new int(42); // False positive!

#+end_quote

The gsl::owner<T*> is declared as a templated type alias. In template functions and classes, like in the example below, the information of the type aliases gets lost. Therefore using gsl::owner<T*> in a heavy templated code base might lead to false positives.

Known code constructs that do not get diagnosed correctly are:

• std::exchange
• std::vector<gsl::owner<T*>>

#+begin_quote

      // This template function works as expected. Type information doesn't get lost.
      template <typename T>
      void delete_owner(gsl::owner<T*> owned_object) {
        delete owned_object; // Everything alright
      }

      gsl::owner<int*> function_that_returns_owner() { return gsl::owner<int*>(new int(42)); }

      // Type deduction does not work for auto variables.
      // This is caught by the check and will be noted accordingly.
      auto OwnedObject = function_that_returns_owner(); // Type of OwnedObject will be int*

      // Problematic function template that looses the typeinformation on owner
      template <typename T>
      void bad_template_function(T some_object) {
        // This line will trigger the warning, that a non-owner is assigned to an owner
        gsl::owner<T*> new_owner = some_object;
      }

      // Calling the function with an owner still yields a false positive.
      bad_template_function(gsl::owner<int*>(new int(42)));


      // The same issue occurs with templated classes like the following.
      template <typename T>
      class OwnedValue {
      public:
        const T getValue() const { return _val; }
      private:
        T _val;
      };

      // Code, that yields a false positive.
      OwnedValue<gsl::owner<int*>> Owner(new int(42)); // Type deduction yield T -> int *
      // False positive, getValue returns int* and not gsl::owner<int*>
      gsl::owner<int*> OwnedInt = Owner.getValue();

#+end_quote

Another limitation of the current implementation is only the type based checking. Suppose you have code like the following:

#+begin_quote

      // Two owners with assigned resources
      gsl::owner<int*> Owner1 = new int(42);
      gsl::owner<int*> Owner2 = new int(42);

      Owner2 = Owner1; // Conceptual Leak of initial resource of Owner2!
      Owner1 = nullptr;

#+end_quote

The semantic of a gsl::owner<T*> is mostly like a std::unique_ptr<T>, therefore assignment of two gsl::owner<T*> is considered a move, which requires that the resource Owner2 must have been released before the assignment. This kind of condition could be caught in later improvements of this check with flowsensitive analysis. Currently, the Clang Static Analyzer catches this bug for dynamic memory, but not for general types of resources.

Finds member initializations in the constructor body which can be converted into member initializers of the constructor instead. This not only improves the readability of the code but also positively affects its performance. Class-member assignments inside a control statement or following the first control statement are ignored.

This check implements C.49 from the CppCoreGuidelines.

If the language version is C++ 11 or above, the constructor is the default constructor of the class, the field is not a bitfield (only in case of earlier language version than C++ 20), furthermore the assigned value is a literal, negated literal or enum constant then the preferred place of the initialization is at the class member declaration.

This latter rule is C.48 from CppCoreGuidelines.

Please note, that this check does not enforce this latter rule for initializations already implemented as member initializers. For that purpose see check modernize-use-default-member-init.

#+begin_quote

      class C {
        int n;
        int m;
      public:
        C() {
          n = 1; // Literal in default constructor
          if (dice())
            return;
          m = 1;
        }
      };

#+end_quote

Here n can be initialized using a default member initializer, unlike m, as m’s initialization follows a control statement (if):

#+begin_quote

      class C {
        int n{1};
        int m;
      public:
        C() {
          if (dice())
            return;
          m = 1;
        }

#+end_quote

#+begin_quote

      class C {
        int n;
        int m;
      public:
        C(int nn, int mm) {
          n = nn; // Neither default constructor nor literal
          if (dice())
            return;
          m = mm;
        }
      };

#+end_quote

Here n can be initialized in the constructor initialization list, unlike m, as m’s initialization follows a control statement (if):

#+begin_quote

      C(int nn, int mm) : n(nn) {
        if (dice())
          return;
        m = mm;
      }

#+end_quote

UseAssignment

If this option is set to true (default is false), the check will initialize members with an assignment. In this case the fix of the first example looks like this:

#+begin_quote

      class C {
        int n = 1;
        int m;
      public:
        C() {
          if (dice())
            return;
          m = 1;
        }
      };

#+end_quote

This check flags all array to pointer decays.

Pointers should not be used as arrays. span<T> is a bounds-checked, safe alternative to using pointers to access arrays.

This rule is part of the “Bounds safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-bounds-decay.

This check flags all array subscript expressions on static arrays and std::arrays that either do not have a constant integer expression index or are out of bounds (for std::array). For out-of-bounds checking of static arrays, see the -Warray-bounds Clang diagnostic.

This rule is part of the “Bounds safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-bounds-arrayindex.

GslHeader

The check can generate fixes after this option has been set to the name of the include file that contains gsl::at(), e.g. “gsl/gsl.h”.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

This check flags all usage of pointer arithmetic, because it could lead to an invalid pointer. Subtraction of two pointers is not flagged by this check.

Pointers should only refer to single objects, and pointer arithmetic is fragile and easy to get wrong. span<T> is a bounds-checked, safe type for accessing arrays of data.

This rule is part of the “Bounds safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-bounds-arithmetic.

This check flags all uses of const_cast in C++ code.

Modifying a variable that was declared const is undefined behavior, even with const_cast.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-constcast.

This check flags all use of C-style casts that perform a static_cast downcast, const_cast, or reinterpret_cast.

Use of these casts can violate type safety and cause the program to access a variable that is actually of type X to be accessed as if it were of an unrelated type Z. Note that a C-style (T)expression cast means to perform the first of the following that is possible: a const_cast, a static_cast, a static_cast followed by a const_cast, a reinterpret_cast, or a reinterpret_cast followed by a const_cast. This rule bans (T)expression only when used to perform an unsafe cast.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-cstylecast.

The check flags user-defined constructor definitions that do not initialize all fields that would be left in an undefined state by default construction, e.g. builtins, pointers and record types without user-provided default constructors containing at least one such type. If these fields aren’t initialized, the constructor will leave some of the memory in an undefined state.

For C++11 it suggests fixes to add in-class field initializers. For older versions it inserts the field initializers into the constructor initializer list. It will also initialize any direct base classes that need to be zeroed in the constructor initializer list.

The check takes assignment of fields in the constructor body into account but generates false positives for fields initialized in methods invoked in the constructor body.

The check also flags variables with automatic storage duration that have record types without a user-provided constructor and are not initialized. The suggested fix is to zero initialize the variable via {} for C++11 and beyond or = {} for older language versions.

IgnoreArrays

If set to true, the check will not warn about array members that are not zero-initialized during construction. For performance critical code, it may be important to not initialize fixed-size array members. Default is false.

UseAssignment

If set to true, the check will provide fix-its with literal initializers ( int i = 0; ) instead of curly braces ( int i{}; ).

This rule is part of the “Type safety” profile of the C++ Core Guidelines, corresponding to rule Type.6. See https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-memberinit.

This check flags all uses of reinterpret_cast in C++ code.

Use of these casts can violate type safety and cause the program to access a variable that is actually of type X to be accessed as if it were of an unrelated type Z.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-reinterpretcast.

This check flags all usages of static_cast, where a base class is casted to a derived class. In those cases, a fix-it is provided to convert the cast to a dynamic_cast.

Use of these casts can violate type safety and cause the program to access a variable that is actually of type X to be accessed as if it were of an unrelated type Z.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-downcast.

This check flags all access to members of unions. Passing unions as a whole is not flagged.

Reading from a union member assumes that member was the last one written, and writing to a union member assumes another member with a nontrivial destructor had its destructor called. This is fragile because it cannot generally be enforced to be safe in the language and so relies on programmer discipline to get it right.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-unions.

This check flags all calls to c-style vararg functions and all use of va_arg.

To allow for SFINAE use of vararg functions, a call is not flagged if a literal 0 is passed as the only vararg argument.

Passing to varargs assumes the correct type will be read. This is fragile because it cannot generally be enforced to be safe in the language and so relies on programmer discipline to get it right.

This rule is part of the “Type safety” profile of the C++ Core Guidelines, see https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#Pro-type-varargs.

Flags slicing of member variables or vtable. Slicing happens when copying a derived object into a base object: the members of the derived object (both member variables and virtual member functions) will be discarded. This can be misleading especially for member function slicing, for example:

#+begin_quote

      struct B { int a; virtual int f(); };
      struct D : B { int b; int f() override; };

      void use(B b) {  // Missing reference, intended?
        b.f();  // Calls B::f.
      }

      D d;
      use(d);  // Slice.

#+end_quote

See the relevant C++ Core Guidelines sections for details: https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#es63-dont-slice https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#c145-access-polymorphic-objects-through-pointers-and-references

The check finds classes where some but not all of the special member functions are defined.

By default the compiler defines a copy constructor, copy assignment operator, move constructor, move assignment operator and destructor. The default can be suppressed by explicit user-definitions. The relationship between which functions will be suppressed by definitions of other functions is complicated and it is advised that all five are defaulted or explicitly defined.

Note that defining a function with = delete is considered to be a definition.

This rule is part of the “Constructors, assignments, and destructors” profile of the C++ Core Guidelines, corresponding to rule C.21. See

https://github.com/isocpp/CppCoreGuidelines/blob/master/CppCoreGuidelines.md#c21-if-you-define-or-delete-any-default-operation-define-or-delete-them-all.

AllowSoleDefaultDtor

When set to true (default is false), this check doesn’t flag classes with a sole, explicitly defaulted destructor. An example for such a class is:

#+begin_quote

        struct A {
          virtual ~A() = default;
        };

#+end_quote

AllowMissingMoveFunctions

When set to true (default is false), this check doesn’t flag classes which define no move operations at all. It still flags classes which define only one of either move constructor or move assignment operator. With this option enabled, the following class won’t be flagged:

#+begin_quote

        struct A {
          A(const A&);
          A& operator=(const A&);
          ~A();
        };

#+end_quote

AllowMissingMoveFunctionsWhenCopyIsDeleted

When set to true (default is false), this check doesn’t flag classes which define deleted copy operations but don’t define move operations. This flags is related to Google C++ Style Guide https://google.github.io/styleguide/cppguide.html#Copyable_Movable_Types. With this option enabled, the following class won’t be flagged:

#+begin_quote

        struct A {
          A(const A&) = delete;
          A& operator=(const A&) = delete;
          ~A();
        };

#+end_quote

Finds usages of OSSpinlock, which is deprecated due to potential livelock problems.

This check will detect following function invocations:

• OSSpinlockLock
• OSSpinlockTry
• OSSpinlockUnlock

The corresponding information about the problem of OSSpinlock: https://blog.postmates.com/why-spinlocks-are-bad-on-ios-b69fc5221058

Finds declarations of dispatch_once_t variables without static or global storage. The behavior of using dispatch_once_t predicates with automatic or dynamic storage is undefined by libdispatch, and should be avoided.

It is a common pattern to have functions initialize internal static or global data once when the function runs, but programmers have been known to miss the static on the dispatch_once_t predicate, leading to an uninitialized flag value at the mercy of the stack.

Programmers have also been known to make dispatch_once_t variables be members of structs or classes, with the intent to lazily perform some expensive struct or class member initialization only once; however, this violates the libdispatch requirements.

See the discussion section of Apple’s dispatch_once documentation for more information.

Warns if a function or method is called with default arguments.

For example, given the declaration:

#+begin_quote

      int foo(int value = 5) { return value; }

#+end_quote

A function call expression that uses a default argument will be diagnosed. Calling it without defaults will not cause a warning:

#+begin_quote

      foo();  // warning
      foo(0); // no warning

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Warns if a function or method is declared with default parameters.

For example, the declaration:

#+begin_quote

      int foo(int value = 5) { return value; }

#+end_quote

will cause a warning.

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

The fuchsia-header-anon-namespaces check is an alias, please see google-build-namespace for more information.

Warns if a class inherits from multiple classes that are not pure virtual.

For example, declaring a class that inherits from multiple concrete classes is disallowed:

#+begin_quote

      class Base_A {
      public:
        virtual int foo() { return 0; }
      };

      class Base_B {
      public:
        virtual int bar() { return 0; }
      };

      // Warning
      class Bad_Child1 : public Base_A, Base_B {};

#+end_quote

A class that inherits from a pure virtual is allowed:

#+begin_quote

      class Interface_A {
      public:
        virtual int foo() = 0;
      };

      class Interface_B {
      public:
        virtual int bar() = 0;
      };

      // No warning
      class Good_Child1 : public Interface_A, Interface_B {
        virtual int foo() override { return 0; }
        virtual int bar() override { return 0; }
      };

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Warns if an operator is overloaded, except for the assignment (copy and move) operators.

For example:

#+begin_quote

      int operator+(int);     // Warning

      B &operator=(const B &Other);  // No warning
      B &operator=(B &&Other) // No warning

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Warns if global, non-trivial objects with static storage are constructed, unless the object is statically initialized with a constexpr constructor or has no explicit constructor.

For example:

#+begin_quote

      class A {};

      class B {
      public:
        B(int Val) : Val(Val) {}
      private:
        int Val;
      };

      class C {
      public:
        C(int Val) : Val(Val) {}
        constexpr C() : Val(0) {}

      private:
        int Val;
      };

      static A a;         // No warning, as there is no explicit constructor
      static C c(0);      // No warning, as constructor is constexpr

      static B b(0);      // Warning, as constructor is not constexpr
      static C c2(0, 1);  // Warning, as constructor is not constexpr

      static int i;       // No warning, as it is trivial

      extern int get_i();
      static C(get_i())   // Warning, as the constructor is dynamically initialized

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Functions that have trailing returns are disallowed, except for those using decltype specifiers and lambda with otherwise unutterable return types.

For example:

#+begin_quote

      // No warning
      int add_one(const int arg) { return arg; }

      // Warning
      auto get_add_one() -> int (*)(const int) {
        return add_one;
      }

#+end_quote

Exceptions are made for lambdas and decltype specifiers:

#+begin_quote

      // No warning
      auto lambda = [](double x, double y) -> double {return x + y;};

      // No warning
      template <typename T1, typename T2>
      auto fn(const T1 &lhs, const T2 &rhs) -> decltype(lhs + rhs) {
        return lhs + rhs;
      }

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Warns if classes are defined with virtual inheritance.

For example, classes should not be defined with virtual inheritance:

#+begin_quote

      class B : public virtual A {};   // warning

#+end_quote

See the features disallowed in Fuchsia at https://fuchsia.googlesource.com/zircon/+/master/docs/cxx.md

Check that make_pair’s template arguments are deduced.

G++ 4.6 in C++11 mode fails badly if make_pair’s template arguments are specified explicitly, and such use isn’t intended in any case.

Corresponding cpplint.py check name: build/explicit_make_pair.

cert-dcl59-cpp redirects here as an alias for this check. fuchsia-header-anon-namespaces redirects here as an alias for this check.

Finds anonymous namespaces in headers.

https://google.github.io/styleguide/cppguide.html#Namespaces

Corresponding cpplint.py check name: build/namespaces.

HeaderFileExtensions

A comma-separated list of filename extensions of header files (the filename extensions should not include “.” prefix). Default is “h,hh,hpp,hxx”. For header files without an extension, use an empty string (if there are no other desired extensions) or leave an empty element in the list. e.g., “h,hh,hpp,hxx,” (note the trailing comma).

Finds using namespace directives.

The check implements the following rule of the Google C++ Style Guide:

#+begin_quote You may not use a using-directive to make all names from a namespace available.

#+end_quote

#+begin_quote

      // Forbidden -- This pollutes the namespace.
      using namespace foo;

#+end_quote

Corresponding cpplint.py check name: build/namespaces.

Checks that default arguments are not given for virtual methods.

See https://google.github.io/styleguide/cppguide.html#Default_Arguments

Checks that constructors callable with a single argument and conversion operators are marked explicit to avoid the risk of unintentional implicit conversions.

Consider this example:

#+begin_quote

      struct S {
        int x;
        operator bool() const { return true; }
      };

      bool f() {
        S a{1};
        S b{2};
        return a == b;
      }

#+end_quote

The function will return true, since the objects are implicitly converted to bool before comparison, which is unlikely to be the intent.

The check will suggest inserting explicit before the constructor or conversion operator declaration. However, copy and move constructors should not be explicit, as well as constructors taking a single initializer_list argument.

This code:

#+begin_quote

      struct S {
        S(int a);
        explicit S(const S&);
        operator bool() const;
        ...

#+end_quote

will become

#+begin_quote

      struct S {
        explicit S(int a);
        S(const S&);
        explicit operator bool() const;
        ...

#+end_quote

See https://google.github.io/styleguide/cppguide.html#Explicit_Constructors

Flag global namespace pollution in header files. Right now it only triggers on using declarations and directives.

The relevant style guide section is https://google.github.io/styleguide/cppguide.html#Namespaces.

HeaderFileExtensions

A comma-separated list of filename extensions of header files (the filename extensions should not contain “.” prefix). Default is “h”. For header files without an extension, use an empty string (if there are no other desired extensions) or leave an empty element in the list. e.g., “h,hh,hpp,hxx,” (note the trailing comma).

Finds calls to +new or overrides of it, which are prohibited by the Google Objective-C style guide.

The Google Objective-C style guide forbids calling +new or overriding it in class implementations, preferring +alloc and -init methods to instantiate objects.

An example:

#+begin_quote

      NSDate *now = [NSDate new];
      Foo *bar = [Foo new];

#+end_quote

Instead, code should use +alloc*/-init* or class factory methods.

#+begin_quote

      NSDate *now = [NSDate date];
      Foo *bar = [[Foo alloc] init];

#+end_quote

This check corresponds to the Google Objective-C Style Guide rule Do Not Use +new.

Finds uses of throwing exceptions usages in Objective-C files.

For the same reason as the Google C++ style guide, we prefer not throwing exceptions from Objective-C code.

The corresponding C++ style guide rule: https://google.github.io/styleguide/cppguide.html#Exceptions

Instead, prefer passing in NSError ** and return BOOL to indicate success or failure.

A counterexample:

#+begin_quote

      - (void)readFile {
        if ([self isError]) {
          @throw [NSException exceptionWithName:...];
        }
      }

#+end_quote

Instead, returning an error via NSError ** is preferred:

#+begin_quote

      - (BOOL)readFileWithError:(NSError **)error {
        if ([self isError]) {
          *error = [NSError errorWithDomain:...];
          return NO;
        }
        return YES;
      }

#+end_quote

The corresponding style guide rule: https://google.github.io/styleguide/objcguide.html#avoid-throwing-exceptions

Finds function declarations in Objective-C files that do not follow the pattern described in the Google Objective-C Style Guide.

The corresponding style guide rule can be found here: https://google.github.io/styleguide/objcguide.html#function-names

All function names should be in Pascal case. Functions whose storage class is not static should have an appropriate prefix.

The following code sample does not follow this pattern:

#+begin_quote

      static bool is_positive(int i) { return i > 0; }
      bool IsNegative(int i) { return i < 0; }

#+end_quote

The sample above might be corrected to the following code:

#+begin_quote

      static bool IsPositive(int i) { return i > 0; }
      bool *ABCIsNegative(int i) { return i < 0; }

#+end_quote

Finds global variable declarations in Objective-C files that do not follow the pattern of variable names in Google’s Objective-C Style Guide.

The corresponding style guide rule: https://google.github.io/styleguide/objcguide.html#variable-names

All the global variables should follow the pattern of g[A-Z].* (variables) or k[A-Z].* (constants). The check will suggest a variable name that follows the pattern if it can be inferred from the original name.

For code:

#+begin_quote

      static NSString* myString = @"hello";

#+end_quote

The fix will be:

#+begin_quote

      static NSString* gMyString = @"hello";

#+end_quote

Another example of constant:

#+begin_quote

      static NSString* const myConstString = @"hello";

#+end_quote

The fix will be:

#+begin_quote

      static NSString* const kMyConstString = @"hello";

#+end_quote

However for code that prefixed with non-alphabetical characters like:

#+begin_quote

      static NSString* __anotherString = @"world";

#+end_quote

The check will give a warning message but will not be able to suggest a fix. The user needs to fix it on their own.

Checks whether there are underscores in googletest test and test case names in test macros:

• TEST
• TEST_F
• TEST_P
• TYPED_TEST
• TYPED_TEST_P

The FRIEND_TEST macro is not included.

For example:

#+begin_quote

      TEST(TestCaseName, Illegal_TestName) {}
      TEST(Illegal_TestCaseName, TestName) {}

#+end_quote

would trigger the check. Underscores are not allowed in test names nor test case names.

The DISABLED_ prefix, which may be used to disable individual tests, is ignored when checking test names, but the rest of the rest of the test name is still checked.

This check does not propose any fixes.

The google-readability-braces-around-statements check is an alias, please see readability-braces-around-statements for more information.

Finds usages of C-style casts.

https://google.github.io/styleguide/cppguide.html#Casting

Corresponding cpplint.py check name: readability/casting.

This check is similar to -Wold-style-cast, but it suggests automated fixes in some cases. The reported locations should not be different from the ones generated by -Wold-style-cast.

The google-readability-function-size check is an alias, please see readability-function-size for more information.

The google-readability-namespace-comments check is an alias, please see llvm-namespace-comment for more information.

Finds TODO comments without a username or bug number.

The relevant style guide section is https://google.github.io/styleguide/cppguide.html#TODO_Comments.

Corresponding cpplint.py check: readability/todo

Finds uses of short, long and long long and suggest replacing them with u?intXX(_t)?.

The corresponding style guide rule: https://google.github.io/styleguide/cppguide.html#Integer_Types.

Corresponding cpplint.py check: runtime/int.

UnsignedTypePrefix

A string specifying the unsigned type prefix. Default is uint.

SignedTypePrefix

A string specifying the signed type prefix. Default is int.

TypeSuffix

A string specifying the type suffix. Default is an empty string.

Finds overloads of unary operator &.

https://google.github.io/styleguide/cppguide.html#Operator_Overloading

Corresponding cpplint.py check name: runtime/operator.

Finds uses of deprecated Google Test version 1.9 APIs with names containing case and replaces them with equivalent APIs with suite.

All names containing case are being replaced to be consistent with the meanings of “test case” and “test suite” as used by the International Software Testing Qualifications Board and ISO 29119.

The new names are a part of Google Test version 1.9 (release pending). It is recommended that users update their dependency to version 1.9 and then use this check to remove deprecated names.

The affected APIs are:

• Member functions of testing::Test, testing::TestInfo, testing::TestEventListener, testing::UnitTest, and any type inheriting from these types
• The macros TYPED_TEST_CASE, TYPED_TEST_CASE_P, REGISTER_TYPED_TEST_CASE_P, and INSTANTIATE_TYPED_TEST_CASE_P
• The type alias testing::TestCase

Examples of fixes created by this check:

#+begin_quote

      class FooTest : public testing::Test {
      public:
        static void SetUpTestCase();
        static void TearDownTestCase();
      };

      TYPED_TEST_CASE(BarTest, BarTypes);

#+end_quote

becomes

#+begin_quote

      class FooTest : public testing::Test {
      public:
        static void SetUpTestSuite();
        static void TearDownTestSuite();
      };

      TYPED_TEST_SUITE(BarTest, BarTypes);

#+end_quote

For better consistency of user code, the check renames both virtual and non-virtual member functions with matching names in derived types. The check tries to provide a only warning when a fix cannot be made safely, as is the case with some template and macro uses.

The hicpp-avoid-c-arrays check is an alias, please see modernize-avoid-c-arrays for more information.

The hicpp-avoid-goto check is an alias to cppcoreguidelines-avoid-goto. Rule 6.3.1 High Integrity C++ requires that goto only skips parts of a block and is not used for other reasons.

Both coding guidelines implement the same exception to the usage of goto.

The hicpp-braces-around-statements check is an alias, please see readability-braces-around-statements for more information. It enforces the rule 6.1.1.

The hicpp-deprecated-headers check is an alias, please see modernize-deprecated-headers for more information. It enforces the rule 1.3.3.

Ensure that every value that in a throw expression is an instance of std::exception.

This enforces rule 15.1 of the High Integrity C++ Coding Standard.

#+begin_quote

      class custom_exception {};

      void throwing() noexcept(false) {
        // Problematic throw expressions.
        throw int(42);
        throw custom_exception();
      }

      class mathematical_error : public std::exception {};

      void throwing2() noexcept(false) {
        // These kind of throws are ok.
        throw mathematical_error();
        throw std::runtime_error();
        throw std::exception();
      }

#+end_quote

This check is an alias for google-explicit-constructor. Used to enforce parts of rule 5.4.1. This check will enforce that constructors and conversion operators are marked explicit. Other forms of casting checks are implemented in other places. The following checks can be used to check for more forms of casting:

• cppcoreguidelines-pro-type-static-cast-downcast
• cppcoreguidelines-pro-type-reinterpret-cast
• cppcoreguidelines-pro-type-const-cast
• cppcoreguidelines-pro-type-cstyle-cast

This check is an alias for readability-function-size. Useful to enforce multiple sections on function complexity.

• rule 8.2.2
• rule 8.3.1
• rule 8.3.2

This check is an alias for bugprone-use-after-move.

Implements parts of the rule 8.4.1 to check if moved-from objects are accessed.

This check is an alias for cppcoreguidelines-pro-type-member-init. Implements the check for rule 12.4.2 to initialize class members in the right order.

The hicpp-move-const-arg check is an alias, please see performance-move-const-arg for more information. It enforces the rule 17.3.1.

This check discovers situations where code paths are not fully-covered. It furthermore suggests using if instead of switch if the code will be more clear. The rule 6.1.2 and rule 6.1.4 of the High Integrity C++ Coding Standard are enforced.

if-else if chains that miss a final else branch might lead to unexpected program execution and be the result of a logical error. If the missing else branch is intended you can leave it empty with a clarifying comment. This warning can be noisy on some code bases, so it is disabled by default.

#+begin_quote

      void f1() {
        int i = determineTheNumber();

         if(i > 0) {
           // Some Calculation
         } else if (i < 0) {
           // Precondition violated or something else.
         }
         // ...
      }

#+end_quote

Similar arguments hold for switch statements which do not cover all possible code paths.

#+begin_quote

      // The missing default branch might be a logical error. It can be kept empty
      // if there is nothing to do, making it explicit.
      void f2(int i) {
        switch (i) {
        case 0: // something
          break;
        case 1: // something else
          break;
        }
        // All other numbers?
      }

      // Violates this rule as well, but already emits a compiler warning (-Wswitch).
      enum Color { Red, Green, Blue, Yellow };
      void f3(enum Color c) {
        switch (c) {
        case Red: // We can't drive for now.
          break;
        case Green:  // We are allowed to drive.
          break;
        }
        // Other cases missing
      }

#+end_quote

The rule 6.1.4 requires every switch statement to have at least two case labels other than a default label. Otherwise, the switch could be better expressed with an if statement. Degenerated switch statements without any labels are caught as well.

#+begin_quote

      // Degenerated switch that could be better written as `if`
      int i = 42;
      switch(i) {
        case 1: // do something here
        default: // do somethe else here
      }

      // Should rather be the following:
      if (i == 1) {
        // do something here
      }
      else {
        // do something here
      }

#+end_quote

#+begin_quote

      // A completely degenerated switch will be diagnosed.
      int i = 42;
      switch(i) {}

#+end_quote

WarnOnMissingElse

Boolean flag that activates a warning for missing else branches. Default is false.

This check is an alias for readability-named-parameter.

Implements rule 8.2.1.

This check is an alias for misc-new-delete-overloads. Implements rule 12.3.1 to ensure the new and delete operators have the correct signature.

The hicpp-no-array-decay check is an alias, please see cppcoreguidelines-pro-bounds-array-to-pointer-decay for more information. It enforces the rule 4.1.1.

Check for assembler statements. No fix is offered.

Inline assembler is forbidden by the High Intergrity C++ Coding Standard as it restricts the portability of code.

The hicpp-no-malloc check is an alias, please see cppcoreguidelines-no-malloc for more information. It enforces the rule 5.3.2.

This check is an alias for performance-noexcept-move-constructor. Checks rule 12.5.4 to mark move assignment and move construction noexcept.

Finds uses of bitwise operations on signed integer types, which may lead to undefined or implementation defined behaviour.

The according rule is defined in the High Integrity C++ Standard, Section 5.6.1.

IgnorePositiveIntegerLiterals

If this option is set to true, the check will not warn on bitwise operations with positive integer literals, e.g. ~0, 2 << 1, etc. Default value is false.

This check is an alias for cppcoreguidelines-special-member-functions. Checks that special member functions have the correct signature, according to rule 12.5.7.

The hicpp-static-assert check is an alias, please see misc-static-assert for more information. It enforces the rule 7.1.10.

This check is an alias for bugprone-undelegated-constructor. Partially implements rule 12.4.5 to find misplaced constructor calls inside a constructor.

#+begin_quote

      struct Ctor {
        Ctor();
        Ctor(int);
        Ctor(int, int);
        Ctor(Ctor *i) {
          // All Ctor() calls result in a temporary object
          Ctor(); // did you intend to call a delegated constructor?
          Ctor(0); // did you intend to call a delegated constructor?
          Ctor(1, 2); // did you intend to call a delegated constructor?
          foo();
        }
      };

#+end_quote

The hicpp-uppercase-literal-suffix check is an alias, please see readability-uppercase-literal-suffix for more information.

The hicpp-use-auto check is an alias, please see modernize-use-auto for more information. It enforces the rule 7.1.8.

The hicpp-use-emplace check is an alias, please see modernize-use-emplace for more information. It enforces the rule 17.4.2.

This check is an alias for modernize-use-equals-default. Implements rule 12.5.1 to explicitly default special member functions.

This check is an alias for modernize-use-equals-delete. Implements rule 12.5.1 to explicitly default or delete special member functions.

The hicpp-use-noexcept check is an alias, please see modernize-use-noexcept for more information. It enforces the rule 1.3.5.

The hicpp-use-nullptr check is an alias, please see modernize-use-nullptr for more information. It enforces the rule 2.5.3.

This check is an alias for modernize-use-override. Implements rule 10.2.1 to declare a virtual function override when overriding.

The hicpp-vararg check is an alias, please see cppcoreguidelines-pro-type-vararg for more information. It enforces the rule 14.1.1.

Checks Linux kernel code to see if it uses the results from the functions in linux/err.h. Also checks to see if code uses the results from functions that directly return a value from one of these error functions.

This is important in the Linux kernel because ERR_PTR, PTR_ERR, IS_ERR, IS_ERR_OR_NULL, ERR_CAST, and PTR_ERR_OR_ZERO return values must be checked, since positive pointers and negative error codes are being used in the same context. These functions are marked with __attribute__((warn_unused_result)), but some kernel versions do not have this warning enabled for clang.

Examples:

#+begin_quote

      /* Trivial unused call to an ERR function */
      PTR_ERR_OR_ZERO(some_function_call());

      /* A function that returns ERR_PTR. */
      void *fn() { ERR_PTR(-EINVAL); }

      /* An invalid use of fn. */
      fn();

#+end_quote

The llvm-else-after-return check is an alias, please see readability-else-after-return for more information.

Finds and fixes header guards that do not adhere to LLVM style.

HeaderFileExtensions

A comma-separated list of filename extensions of header files (the filename extensions should not include “.” prefix). Default is “h,hh,hpp,hxx”. For header files without an extension, use an empty string (if there are no other desired extensions) or leave an empty element in the list. e.g., “h,hh,hpp,hxx,” (note the trailing comma).

Checks the correct order of #includes.

See https://llvm.org/docs/CodingStandards.html#include-style

google-readability-namespace-comments redirects here as an alias for this check.

Checks that long namespaces have a closing comment.

https://llvm.org/docs/CodingStandards.html#namespace-indentation

https://google.github.io/styleguide/cppguide.html#Namespaces

#+begin_quote

      namespace n1 {
      void f();
      }

      // becomes

      namespace n1 {
      void f();
      }  // namespace n1

#+end_quote

ShortNamespaceLines

Requires the closing brace of the namespace definition to be followed by a closing comment if the body of the namespace has more than ShortNamespaceLines lines of code. The value is an unsigned integer that defaults to 1U.

SpacesBeforeComments

An unsigned integer specifying the number of spaces before the comment closing a namespace definition. Default is 1U.

Looks at conditionals and finds and replaces cases of cast<>, which will assert rather than return a null pointer, and dyn_cast<> where the return value is not captured. Additionally, finds and replaces cases that match the pattern var && isa<X>(var), where var is evaluated twice.

#+begin_quote

      // Finds these:
      if (auto x = cast<X>(y)) {}
      // is replaced by:
      if (auto x = dyn_cast<X>(y)) {}

      if (cast<X>(y)) {}
      // is replaced by:
      if (isa<X>(y)) {}

      if (dyn_cast<X>(y)) {}
      // is replaced by:
      if (isa<X>(y)) {}

      if (var && isa<T>(var)) {}
      // is replaced by:
      if (isa_and_nonnull<T>(var.foo())) {}

      // Other cases are ignored, e.g.:
      if (auto f = cast<Z>(y)->foo()) {}
      if (cast<Z>(y)->foo()) {}
      if (X.cast(y)) {}

#+end_quote

Finds historical use of unsigned to hold vregs and physregs and rewrites them to use Register.

Currently this works by finding all variables of unsigned integer type whose initializer begins with an implicit cast from Register to unsigned.

#+begin_quote

      void example(MachineOperand &MO) {
        unsigned Reg = MO.getReg();
        ...
      }

#+end_quote

becomes:

#+begin_quote

      void example(MachineOperand &MO) {
        Register Reg = MO.getReg();
        ...
      }

#+end_quote

The llvm-qualified-auto check is an alias, please see readability-qualified-auto for more information.

Looks for local Twine variables which are prone to use after frees and should be generally avoided.

#+begin_quote

      static Twine Moo = Twine("bark") + "bah";

      // becomes

      static std::string Moo = (Twine("bark") + "bah").str();

#+end_quote

Checks all calls resolve to functions within __llvm_libc namespace.

#+begin_quote

      namespace __llvm_libc {

      // Allow calls with the fully qualified name.
      __llvm_libc::strlen("hello");

      // Allow calls to compiler provided functions.
      (void)__builtin_abs(-1);

      // Bare calls are allowed as long as they resolve to the correct namespace.
      strlen("world");

      // Disallow calling into functions in the global namespace.
      ::strlen("!");

      } // namespace __llvm_libc

#+end_quote

Checks that all declarations in the llvm-libc implementation are within the correct namespace.

#+begin_quote

      // Correct: implementation inside the correct namespace.
      namespace __llvm_libc {
          void LLVM_LIBC_ENTRYPOINT(strcpy)(char *dest, const char *src) {}
          // Namespaces within __llvm_libc namespace are allowed.
          namespace inner{
              int localVar = 0;
          }
          // Functions with C linkage are allowed.
          extern "C" void str_fuzz(){}
      }

      // Incorrect: implementation not in a namespace.
      void LLVM_LIBC_ENTRYPOINT(strcpy)(char *dest, const char *src) {}

      // Incorrect: outer most namespace is not correct.
      namespace something_else {
          void LLVM_LIBC_ENTRYPOINT(strcpy)(char *dest, const char *src) {}
      }

#+end_quote

Finds includes of system libc headers not provided by the compiler within llvm-libc implementations.

#+begin_quote

      #include <stdio.h>            // Not allowed because it is part of system libc.
      #include <stddef.h>           // Allowed because it is provided by the compiler.
      #include "internal/stdio.h"   // Allowed because it is NOT part of system libc.

#+end_quote

This check is necessary because accidentally including system libc headers can lead to subtle and hard to detect bugs. For example consider a system libc whose dirent struct has slightly different field ordering than llvm-libc. While this will compile successfully, this can cause issues during runtime because they are ABI incompatible.

Includes

A string containing a comma separated glob list of allowed include filenames. Similar to the -checks glob list for running clang-tidy itself, the two wildcard characters are * and -, to include and exclude globs, respectively. The default is -*, which disallows all includes.

This can be used to allow known safe includes such as Linux development headers. See portability-restrict-system-includes for more details.

Finds non-extern non-inline function and variable definitions in header files, which can lead to potential ODR violations in case these headers are included from multiple translation units.

#+begin_quote

      // Foo.h
      int a = 1; // Warning: variable definition.
      extern int d; // OK: extern variable.

      namespace N {
        int e = 2; // Warning: variable definition.
      }

      // Warning: variable definition.
      const char* str = "foo";

      // OK: internal linkage variable definitions are ignored for now.
      // Although these might also cause ODR violations, we can be less certain and
      // should try to keep the false-positive rate down.
      static int b = 1;
      const int c = 1;
      const char* const str2 = "foo";
      constexpr int k = 1;

      // Warning: function definition.
      int g() {
        return 1;
      }

      // OK: inline function definition is allowed to be defined multiple times.
      inline int e() {
        return 1;
      }

      class A {
      public:
        int f1() { return 1; } // OK: implicitly inline member function definition is allowed.
        int f2();

        static int d;
      };

      // Warning: not an inline member function definition.
      int A::f2() { return 1; }

      // OK: class static data member declaration is allowed.
      int A::d = 1;

      // OK: function template is allowed.
      template<typename T>
      T f3() {
        T a = 1;
        return a;
      }

      // Warning: full specialization of a function template is not allowed.
      template <>
      int f3() {
        int a = 1;
        return a;
      }

      template <typename T>
      struct B {
        void f1();
      };

      // OK: member function definition of a class template is allowed.
      template <typename T>
      void B<T>::f1() {}

      class CE {
        constexpr static int i = 5; // OK: inline variable definition.
      };

      inline int i = 5; // OK: inline variable definition.

      constexpr int f10() { return 0; } // OK: constexpr function implies inline.

      // OK: C++14 variable templates are inline.
      template <class T>
      constexpr T pi = T(3.1415926L);

#+end_quote

HeaderFileExtensions

A comma-separated list of filename extensions of header files (the filename extensions should not include “.” prefix). Default is “h,hh,hpp,hxx”. For header files without an extension, use an empty string (if there are no other desired extensions) or leave an empty element in the list. e.g., “h,hh,hpp,hxx,” (note the trailing comma).

UseHeaderFileExtension

When true, the check will use the file extension to distinguish header files. Default is true.

This check diagnoses when a const qualifier is applied to a typedef*/ *using to a pointer type rather than to the pointee, because such constructs are often misleading to developers because the const applies to the pointer rather than the pointee.

For instance, in the following code, the resulting type is int * const rather than const int *:

#+begin_quote

      typedef int *int_ptr;
      void f(const int_ptr ptr) {
        *ptr = 0; // potentially quite unexpectedly the int can be modified here
        ptr = 0; // does not compile
      }

#+end_quote

The check does not diagnose when the underlying typedef*/*using type is a pointer to a const type or a function pointer type. This is because the const qualifier is less likely to be mistaken because it would be redundant (or disallowed) on the underlying pointee type.

cert-dcl54-cpp redirects here as an alias for this check.

The check flags overloaded operator new() and operator delete() functions that do not have a corresponding free store function defined within the same scope. For instance, the check will flag a class implementation of a non-placement operator new() when the class does not also define a non-placement operator delete() function as well.

The check does not flag implicitly-defined operators, deleted or private operators, or placement operators.

This check corresponds to CERT C++ Coding Standard rule DCL54-CPP. Overload allocation and deallocation functions as a pair in the same scope.

Finds strongly connected functions (by analyzing the call graph for SCC’s (Strongly Connected Components) that are loops), diagnoses each function in the cycle, and displays one example of a possible call graph loop (recursion).

References:

• CERT C++ Coding Standard rule DCL56-CPP. Avoid cycles during initialization of static objects.
• JPL Institutional Coding Standard for the C Programming Language (JPL DOCID D-60411) rule 2.4 Do not use direct or indirect recursion.
• OpenCL Specification, Version 1.2 rule 6.9 Restrictions: i. Recursion is not supported..

Limitations:

• The check does not handle calls done through function pointers
• The check does not handle C++ destructors

cert-fio38-c redirects here as an alias for this check.

The check flags dereferences and non-pointer declarations of objects that are not meant to be passed by value, such as C FILE objects or POSIX pthread_mutex_t objects.

This check corresponds to CERT C++ Coding Standard rule FIO38-C. Do not copy a FILE object.

cppcoreguidelines-non-private-member-variables-in-classes redirects here as an alias for this check.

Finds classes that contain non-static data members in addition to user-declared non-static member functions and diagnose all data members declared with a non-public access specifier. The data members should be declared as private and accessed through member functions instead of exposed to derived classes or class consumers.

IgnoreClassesWithAllMemberVariablesBeingPublic

Allows to completely ignore classes if all the member variables in that class a declared with a public access specifier.

IgnorePublicMemberVariables

Allows to ignore (not diagnose) all the member variables declared with a public access specifier.

Detect redundant expressions which are typically errors due to copy-paste.

Depending on the operator expressions may be

• redundant,
• always true,
• always false,
• always a constant (zero or one).

Examples:

#+begin_quote

      ((x+1) | (x+1))             // (x+1) is redundant
      (p->x == p->x)              // always true
      (p->x < p->x)               // always false
      (speed - speed + 1 == 12)   // speed - speed is always zero

#+end_quote

cert-dcl03-c redirects here as an alias for this check.

Replaces assert() with static_assert() if the condition is evaluatable at compile time.

The condition of static_assert() is evaluated at compile time which is safer and more efficient.

cert-err09-cpp redirects here as an alias for this check. cert-err61-cpp redirects here as an alias for this check.

Finds violations of the rule “Throw by value, catch by reference” presented for example in “C++ Coding Standards” by H. Sutter and A. Alexandrescu, as well as the CERT C++ Coding Standard rule ERR61-CPP. Catch exceptions by lvalue reference.

Exceptions:

• Throwing string literals will not be flagged despite being a pointer. They are not susceptible to slicing and the usage of string literals is idomatic.
• Catching character pointers (char, wchar_t, unicode character types) will not be flagged to allow catching sting literals.
• Moved named values will not be flagged as not throwing an anonymous temporary. In this case we can be sure that the user knows that the object can’t be accessed outside catch blocks handling the error.
• Throwing function parameters will not be flagged as not throwing an anonymous temporary. This allows helper functions for throwing.
• Re-throwing caught exception variables will not be flragged as not throwing an anonymous temporary. Although this can usually be done by just writing throw; it happens often enough in real code.

CheckThrowTemporaries

Triggers detection of violations of the CERT recommendation ERR09-CPP. Throw anonymous temporaries. Default is true.

WarnOnLargeObject

Also warns for any large, trivial object caught by value. Catching a large object by value is not dangerous but affects the performance negatively. The maximum size of an object allowed to be caught without warning can be set using the MaxSize option. Default is false.

MaxSize

Determines the maximum size of an object allowed to be caught without warning. Only applicable if WarnOnLargeObject is set to true. If the option is set by the user to std::numeric_limits<uint64_t>::max() then it reverts to the default value. Default is the size of size_t.

Finds declarations of assign operators with the wrong return and/or argument types and definitions with good return type but wrong return statements.

#+begin_quote

#+begin_quote

• The return type must be Class&.
• Works with move-assign and assign by value.
• Private and deleted operators are ignored.
• The operator must always return *this.

#+end_quote #+end_quote

Find and replace unique_ptr::reset(release()) with std::move().

Example:

#+begin_quote

      std::unique_ptr<Foo> x, y;
      x.reset(y.release()); -> x = std::move(y);

#+end_quote

If y is already rvalue, std::move() is not added. x and y can also be std::unique_ptr<Foo>*.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

Finds unused namespace alias declarations.

#+begin_quote

      namespace my_namespace {
      class C {};
      }
      namespace unused_alias = ::my_namespace;

#+end_quote

Finds unused function parameters. Unused parameters may signify a bug in the code (e.g. when a different parameter is used instead). The suggested fixes either comment parameter name out or remove the parameter completely, if all callers of the function are in the same translation unit and can be updated.

The check is similar to the -Wunused-parameter compiler diagnostic and can be used to prepare a codebase to enabling of that diagnostic. By default the check is more permissive (see StrictMode).

#+begin_quote

      void a(int i) { /*some code that doesn't use `i`*/ }

      // becomes

      void a(int  /*i*/) { /*some code that doesn't use `i`*/ }

#+end_quote

#+begin_quote

      static void staticFunctionA(int i);
      static void staticFunctionA(int i) { /*some code that doesn't use `i`*/ }

      // becomes

      static void staticFunctionA()
      static void staticFunctionA() { /*some code that doesn't use `i`*/ }

#+end_quote

StrictMode

When false (default value), the check will ignore trivially unused parameters, i.e. when the corresponding function has an empty body (and in case of constructors - no constructor initializers). When the function body is empty, an unused parameter is unlikely to be unnoticed by a human reader, and there’s basically no place for a bug to hide.

Finds unused using declarations.

Example:

#+begin_quote

      namespace n { class C; }
      using n::C;  // Never actually used.

#+end_quote

The check finds uses of std::bind and boost::bind and replaces them with lambdas. Lambdas will use value-capture unless reference capture is explicitly requested with std::ref or boost::ref.

It supports arbitrary callables including member functions, function objects, and free functions, and all variations thereof. Anything that you can pass to the first argument of bind should be diagnosable. Currently, the only known case where a fix-it is unsupported is when the same placeholder is specified multiple times in the parameter list.

Given:

#+begin_quote

      int add(int x, int y) { return x + y; }

#+end_quote

Then:

#+begin_quote

      void f() {
        int x = 2;
        auto clj = std::bind(add, x, _1);
      }

#+end_quote

is replaced by:

#+begin_quote

      void f() {
        int x = 2;
        auto clj = [=](auto && arg1) { return add(x, arg1); };
      }

#+end_quote

std::bind can be hard to read and can result in larger object files and binaries due to type information that will not be produced by equivalent lambdas.

PermissiveParameterList

If the option is set to true, the check will append auto&&… to the end of every placeholder parameter list. Without this, it is possible for a fix-it to perform an incorrect transformation in the case where the result of the bind is used in the context of a type erased functor such as std::function which allows mismatched arguments. For example:

#+begin_quote

      int add(int x, int y) { return x + y; }
      int foo() {
        std::function<int(int,int)> ignore_args = std::bind(add, 2, 2);
        return ignore_args(3, 3);
      }

#+end_quote

is valid code, and returns 4. The actual values passed to ignore_args are simply ignored. Without PermissiveParameterList, this would be transformed into

#+begin_quote

      int add(int x, int y) { return x + y; }
      int foo() {
        std::function<int(int,int)> ignore_args = [] { return add(2, 2); }
        return ignore_args(3, 3);
      }

#+end_quote

which will not compile, since the lambda does not contain an operator() that that accepts 2 arguments. With permissive parameter list, it instead generates

#+begin_quote

      int add(int x, int y) { return x + y; }
      int foo() {
        std::function<int(int,int)> ignore_args = [](auto&&...) { return add(2, 2); }
        return ignore_args(3, 3);
      }

#+end_quote

which is correct.

This check requires using C++14 or higher to run.

cppcoreguidelines-avoid-c-arrays redirects here as an alias for this check.

hicpp-avoid-c-arrays redirects here as an alias for this check.

Finds C-style array types and recommend to use std::array<> / std::vector<>. All types of C arrays are diagnosed.

However, fix-it are potentially dangerous in header files and are therefore not emitted right now.

#+begin_quote

      int a[] = {1, 2}; // warning: do not declare C-style arrays, use std::array<> instead

      int b[1]; // warning: do not declare C-style arrays, use std::array<> instead

      void foo() {
        int c[b[0]]; // warning: do not declare C VLA arrays, use std::vector<> instead
      }

      template <typename T, int Size>
      class array {
        T d[Size]; // warning: do not declare C-style arrays, use std::array<> instead

        int e[1]; // warning: do not declare C-style arrays, use std::array<> instead
      };

      array<int[4], 2> d; // warning: do not declare C-style arrays, use std::array<> instead

      using k = int[4]; // warning: do not declare C-style arrays, use std::array<> instead

#+end_quote

However, the extern “C” code is ignored, since it is common to share such headers between C code, and C++ code.

#+begin_quote

      // Some header
      extern "C" {

      int f[] = {1, 2}; // not diagnosed

      int j[1]; // not diagnosed

      inline void bar() {
        {
          int j[j[0]]; // not diagnosed
        }
      }

      }

#+end_quote

Similarly, the main() function is ignored. Its second and third parameters can be either char argv[]* or char* argv*, but can not be std::array<>.

Checks for use of nested namespaces such as namespace a { namespace b { … } } and suggests changing to the more concise syntax introduced in C++17: namespace a::b { … }. Inline namespaces are not modified.

For example:

#+begin_quote

      namespace n1 {
      namespace n2 {
      void t();
      }
      }

      namespace n3 {
      namespace n4 {
      namespace n5 {
      void t();
      }
      }
      namespace n6 {
      namespace n7 {
      void t();
      }
      }
      }

#+end_quote

Will be modified to:

#+begin_quote

      namespace n1::n2 {
      void t();
      }

      namespace n3 {
      namespace n4::n5 {
      void t();
      }
      namespace n6::n7 {
      void t();
      }
      }

#+end_quote

Some headers from C library were deprecated in C++ and are no longer welcome in C++ codebases. Some have no effect in C++. For more details refer to the C++ 14 Standard [depr.c.headers] section.

This check replaces C standard library headers with their C++ alternatives and removes redundant ones.

Important note: the Standard doesn’t guarantee that the C++ headers declare all the same functions in the global namespace. The check in its current form can break the code that uses library symbols from the global namespace.

• <assert.h>
• <complex.h>
• <ctype.h>
• <errno.h>
• <fenv.h> // deprecated since C++11
• <float.h>
• <inttypes.h>
• <limits.h>
• <locale.h>
• <math.h>
• <setjmp.h>
• <signal.h>
• <stdarg.h>
• <stddef.h>
• <stdint.h>
• <stdio.h>
• <stdlib.h>
• <string.h>
• <tgmath.h> // deprecated since C++11
• <time.h>
• <uchar.h> // deprecated since C++11
• <wchar.h>
• <wctype.h>

If the specified standard is older than C++11 the check will only replace headers deprecated before C++11, otherwise – every header that appeared in the previous list.

These headers don’t have effect in C++:

• <iso646.h>
• <stdalign.h>
• <stdbool.h>

Detects usage of the deprecated member types of std::ios_base and replaces those that have a non-deprecated equivalent.

This check converts for(…; …; …) loops to use the new range-based loops in C++11.

Three kinds of loops can be converted:

• Loops over statically allocated arrays.
• Loops over containers, using iterators.
• Loops over array-like containers, using operator[] and at().

In loops where the container expression is more complex than just a reference to a declared expression (a variable, function, enum, etc.), and some part of it appears elsewhere in the loop, we lower our confidence in the transformation due to the increased risk of changing semantics. Transformations for these loops are marked as risky, and thus will only be converted if the minimum required confidence level is set to risky.

#+begin_quote

      int arr[10][20];
      int l = 5;

      for (int j = 0; j < 20; ++j)
        int k = arr[l][j] + l; // using l outside arr[l] is considered risky

      for (int i = 0; i < obj.getVector().size(); ++i)
        obj.foo(10); // using 'obj' is considered risky

#+end_quote

See Range-based loops evaluate end() only once for an example of an incorrect transformation when the minimum required confidence level is set to risky.

If a loop calls .end() or .size() after each iteration, the transformation for that loop is marked as reasonable, and thus will be converted if the required confidence level is set to reasonable (default) or lower.

#+begin_quote

      // using size() is considered reasonable
      for (int i = 0; i < container.size(); ++i)
        cout << container[i];

#+end_quote

Any other loops that do not match the above criteria to be marked as risky or reasonable are marked safe, and thus will be converted if the required confidence level is set to safe or lower.

#+begin_quote

      int arr[] = {1,2,3};

      for (int i = 0; i < 3; ++i)
        cout << arr[i];

#+end_quote

Original:

#+begin_quote

      const int N = 5;
      int arr[] = {1,2,3,4,5};
      vector<int> v;
      v.push_back(1);
      v.push_back(2);
      v.push_back(3);

      // safe conversion
      for (int i = 0; i < N; ++i)
        cout << arr[i];

      // reasonable conversion
      for (vector<int>::iterator it = v.begin(); it != v.end(); ++it)
        cout << *it;

      // reasonable conversion
      for (int i = 0; i < v.size(); ++i)
        cout << v[i];

#+end_quote

After applying the check with minimum confidence level set to reasonable (default):

#+begin_quote

      const int N = 5;
      int arr[] = {1,2,3,4,5};
      vector<int> v;
      v.push_back(1);
      v.push_back(2);
      v.push_back(3);

      // safe conversion
      for (auto & elem : arr)
        cout << elem;

      // reasonable conversion
      for (auto & elem : v)
        cout << elem;

      // reasonable conversion
      for (auto & elem : v)
        cout << elem;

#+end_quote

The converter is also capable of transforming iterator loops which use rbegin and rend for looping backwards over a container. Out of the box this will automatically happen in C++20 mode using the ranges library, however the check can be configured to work without C++20 by specifying a function to reverse a range and optionally the header file where that function lives.

UseCxx20ReverseRanges

When set to true convert loops when in C++20 or later mode using std::ranges::reverse_view. Default value is true.

MakeReverseRangeFunction

Specify the function used to reverse an iterator pair, the function should accept a class with rbegin and rend methods and return a class with begin and end methods methods that call the rbegin and rend methods respectively. Common examples are ranges::reverse_view and llvm::reverse. Default value is an empty string.

MakeReverseRangeHeader

Specifies the header file where MakeReverseRangeFunction is declared. For the previous examples this option would be set to range/v3/view/reverse.hpp and llvm/ADT/STLExtras.h respectively. If this is an empty string and MakeReverseRangeFunction is set, the check will proceed on the assumption that the function is already available in the translation unit. This can be wrapped in angle brackets to signify to add the include as a system include. Default value is an empty string.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

There are certain situations where the tool may erroneously perform transformations that remove information and change semantics. Users of the tool should be aware of the behaviour and limitations of the check outlined by the cases below.

Comments inside the original loop header are ignored and deleted when transformed.

#+begin_quote

      for (int i = 0; i < N; /* This will be deleted */ ++i) { }

#+end_quote

The C++11 range-based for loop calls .end() only once during the initialization of the loop. If in the original loop .end() is called after each iteration the semantics of the transformed loop may differ.

#+begin_quote

      // The following is semantically equivalent to the C++11 range-based for loop,
      // therefore the semantics of the header will not change.
      for (iterator it = container.begin(), e = container.end(); it != e; ++it) { }

      // Instead of calling .end() after each iteration, this loop will be
      // transformed to call .end() only once during the initialization of the loop,
      // which may affect semantics.
      for (iterator it = container.begin(); it != container.end(); ++it) { }

#+end_quote

As explained above, calling member functions of the container in the body of the loop is considered risky. If the called member function modifies the container the semantics of the converted loop will differ due to .end() being called only once.

#+begin_quote

      bool flag = false;
      for (vector<T>::iterator it = vec.begin(); it != vec.end(); ++it) {
        // Add a copy of the first element to the end of the vector.
        if (!flag) {
          // This line makes this transformation 'risky'.
          vec.push_back(*it);
          flag = true;
        }
        cout << *it;
      }

#+end_quote

The original code above prints out the contents of the container including the newly added element while the converted loop, shown below, will only print the original contents and not the newly added element.

#+begin_quote

      bool flag = false;
      for (auto & elem : vec) {
        // Add a copy of the first element to the end of the vector.
        if (!flag) {
          // This line makes this transformation 'risky'
          vec.push_back(elem);
          flag = true;
        }
        cout << elem;
      }

#+end_quote

Semantics will also be affected if .end() has side effects. For example, in the case where calls to .end() are logged the semantics will change in the transformed loop if .end() was originally called after each iteration.

#+begin_quote

      iterator end() {
        num_of_end_calls++;
        return container.end();
      }

#+end_quote

Similarly, if operator->() was overloaded to have side effects, such as logging, the semantics will change. If the iterator’s operator->() was used in the original loop it will be replaced with <container element>.<member> instead due to the implicit dereference as part of the range-based for loop. Therefore any side effect of the overloaded operator->() will no longer be performed.

#+begin_quote

      for (iterator it = c.begin(); it != c.end(); ++it) {
        it->func(); // Using operator->()
      }
      // Will be transformed to:
      for (auto & elem : c) {
        elem.func(); // No longer using operator->()
      }

#+end_quote

While most of the check’s risk analysis is dedicated to determining whether the iterator or container was modified within the loop, it is possible to circumvent the analysis by accessing and modifying the container through a pointer or reference.

If the container were directly used instead of using the pointer or reference the following transformation would have only been applied at the risky level since calling a member function of the container is considered risky. The check cannot identify expressions associated with the container that are different than the one used in the loop header, therefore the transformation below ends up being performed at the safe level.

#+begin_quote

      vector<int> vec;

      vector<int> *ptr = &vec;
      vector<int> &ref = vec;

      for (vector<int>::iterator it = vec.begin(), e = vec.end(); it != e; ++it) {
        if (!flag) {
          // Accessing and modifying the container is considered risky, but the risk
          // level is not raised here.
          ptr->push_back(*it);
          ref.push_back(*it);
          flag = true;
        }
      }

#+end_quote

As range-based for loops are only available since OpenMP 5, this check should not been used on code with a compatibility requirements of OpenMP prior to version 5. It is intentional that this check does not make any attempts to exclude incorrect diagnostics on OpenMP for loops prior to OpenMP 5.

To prevent this check to be applied (and to break) OpenMP for loops but still be applied to non-OpenMP for loops the usage of NOLINT (see clang-tidy-nolint) on the specific for loops is recommended.

This check finds the creation of std::shared_ptr objects by explicitly calling the constructor and a new expression, and replaces it with a call to std::make_shared.

#+begin_quote

      auto my_ptr = std::shared_ptr<MyPair>(new MyPair(1, 2));

      // becomes

      auto my_ptr = std::make_shared<MyPair>(1, 2);

#+end_quote

This check also finds calls to std::shared_ptr::reset() with a new expression, and replaces it with a call to std::make_shared.

#+begin_quote

      my_ptr.reset(new MyPair(1, 2));

      // becomes

      my_ptr = std::make_shared<MyPair>(1, 2);

#+end_quote

MakeSmartPtrFunction

A string specifying the name of make-shared-ptr function. Default is std::make_shared.

MakeSmartPtrFunctionHeader

A string specifying the corresponding header of make-shared-ptr function. Default is memory.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

IgnoreMacros

If set to true, the check will not give warnings inside macros. Default is true.

IgnoreDefaultInitialization

If set to non-zero, the check does not suggest edits that will transform default initialization into value initialization, as this can cause performance regressions. Default is 1.

This check finds the creation of std::unique_ptr objects by explicitly calling the constructor and a new expression, and replaces it with a call to std::make_unique, introduced in C++14.

#+begin_quote

      auto my_ptr = std::unique_ptr<MyPair>(new MyPair(1, 2));

      // becomes

      auto my_ptr = std::make_unique<MyPair>(1, 2);

#+end_quote

This check also finds calls to std::unique_ptr::reset() with a new expression, and replaces it with a call to std::make_unique.

#+begin_quote

      my_ptr.reset(new MyPair(1, 2));

      // becomes

      my_ptr = std::make_unique<MyPair>(1, 2);

#+end_quote

MakeSmartPtrFunction

A string specifying the name of make-unique-ptr function. Default is std::make_unique.

MakeSmartPtrFunctionHeader

A string specifying the corresponding header of make-unique-ptr function. Default is <memory>.

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

IgnoreMacros

If set to true, the check will not give warnings inside macros. Default is true.

IgnoreDefaultInitialization

If set to non-zero, the check does not suggest edits that will transform default initialization into value initialization, as this can cause performance regressions. Default is 1.

With move semantics added to the language and the standard library updated with move constructors added for many types it is now interesting to take an argument directly by value, instead of by const-reference, and then copy. This check allows the compiler to take care of choosing the best way to construct the copy.

The transformation is usually beneficial when the calling code passes an rvalue and assumes the move construction is a cheap operation. This short example illustrates how the construction of the value happens:

#+begin_quote

      void foo(std::string s);
      std::string get_str();

      void f(const std::string &str) {
        foo(str);       // lvalue  -> copy construction
        foo(get_str()); // prvalue -> move construction
      }

#+end_quote

NOTE:

#+begin_quote Currently, only constructors are transformed to make use of pass-by-value. Contributions that handle other situations are welcome!

#+end_quote

Replaces the uses of const-references constructor parameters that are copied into class fields. The parameter is then moved with std::move().

Since std::move() is a library function declared in <utility> it may be necessary to add this include. The check will add the include directive when necessary.

#+begin_quote

       #include <string>

       class Foo {
       public:
      -  Foo(const std::string &Copied, const std::string &ReadOnly)
      -    : Copied(Copied), ReadOnly(ReadOnly)
      +  Foo(std::string Copied, const std::string &ReadOnly)
      +    : Copied(std::move(Copied)), ReadOnly(ReadOnly)
         {}

       private:
         std::string Copied;
         const std::string &ReadOnly;
       };

       std::string get_cwd();

       void f(const std::string &Path) {
         // The parameter corresponding to 'get_cwd()' is move-constructed. By
         // using pass-by-value in the Foo constructor we managed to avoid a
         // copy-construction.
         Foo foo(get_cwd(), Path);
       }

#+end_quote

If the parameter is used more than once no transformation is performed since moved objects have an undefined state. It means the following code will be left untouched:

#+begin_quote

      #include <string>

      void pass(const std::string &S);

      struct Foo {
        Foo(const std::string &S) : Str(S) {
          pass(S);
        }

        std::string Str;
      };

#+end_quote

A situation where the generated code can be wrong is when the object referenced is modified before the assignment in the init-list through a “hidden” reference.

Example:

#+begin_quote

       std::string s("foo");

       struct Base {
         Base() {
           s = "bar";
         }
       };

       struct Derived : Base {
      -  Derived(const std::string &S) : Field(S)
      +  Derived(std::string S) : Field(std::move(S))
         { }

         std::string Field;
       };

       void f() {
      -  Derived d(s); // d.Field holds "bar"
      +  Derived d(s); // d.Field holds "foo"
       }

#+end_quote

When delayed template parsing is enabled, constructors part of templated contexts; templated constructors, constructors in class templates, constructors of inner classes of template classes, etc., are not transformed. Delayed template parsing is enabled by default on Windows as a Microsoft extension: Clang Compiler User’s Manual - Microsoft extensions.

Delayed template parsing can be enabled using the -fdelayed-template-parsing flag and disabled using -fno-delayed-template-parsing.

Example:

#+begin_quote

        template <typename T> class C {
          std::string S;

        public:
      =  // using -fdelayed-template-parsing (default on Windows)
      =  C(const std::string &S) : S(S) {}

      +  // using -fno-delayed-template-parsing (default on non-Windows systems)
      +  C(std::string S) : S(std::move(S)) {}
        };

#+end_quote

SEE ALSO:

#+begin_quote For more information about the pass-by-value idiom, read: Want Speed? Pass by Value.

#+end_quote

IncludeStyle

A string specifying which include-style is used, llvm or google. Default is llvm.

ValuesOnly

When true, the check only warns about copied parameters that are already passed by value. Default is false.

This check selectively replaces string literals containing escaped characters with raw string literals.

Example:

#+begin_quote

      const char *const Quotes{"embedded \"quotes\""};
      const char *const Paragraph{"Line one.\nLine two.\nLine three.\n"};
      const char *const SingleLine{"Single line.\n"};
      const char *const TrailingSpace{"Look here -> \n"};
      const char *const Tab{"One\tTwo\n"};
      const char *const Bell{"Hello!\a  And welcome!"};
      const char *const Path{"C:\\Program Files\\Vendor\\Application.exe"};
      const char *const RegEx{"\\w\\([a-z]\\)"};

#+end_quote

becomes

#+begin_quote

      const char *const Quotes{R"(embedded "quotes")"};
      const char *const Paragraph{"Line one.\nLine two.\nLine three.\n"};
      const char *const SingleLine{"Single line.\n"};
      const char *const TrailingSpace{"Look here -> \n"};
      const char *const Tab{"One\tTwo\n"};
      const char *const Bell{"Hello!\a  And welcome!"};
      const char *const Path{R"(C:\Program Files\Vendor\Application.exe)"};
      const char *const RegEx{R"(\w\([a-z]\))"};

#+end_quote

The presence of any of the following escapes can cause the string to be converted to a raw string literal:
, \’, \“, \?, and octal or hexadecimal escapes for printable ASCII characters.

A string literal containing only escaped newlines is a common way of writing lines of text output. Introducing physical newlines with raw string literals in this case is likely to impede readability. These string literals are left unchanged.

An escaped horizontal tab, form feed, or vertical tab prevents the string literal from being converted. The presence of a horizontal tab, form feed or vertical tab in source code is not visually obvious.

Find and remove redundant void argument lists.

Examples:

_
Initial code	Code with applied fixes
_
int f(void);	int f();
_
int (*f(void))(void);	int (*f())();
_
typedef int (*f_t(void))(void);	typedef int (*f_t())();
_
void (C::*p)(void);	void (C::*p)();
_
C::C(void) {}	C::C() {}
_
C::~C(void) {}	C::~C() {}
_