Cppcheck reports

From The Document Foundation Wiki
Jump to: navigation, search

This page documents how to generate cppcheck reports in the form of a browseable tree of sources files.

What's cppcheck

Cppcheck is an open source static code analyzer tool for C/C++ programming languages. So its goal is to detect some bugs (other than syntax errors).

Example results

Example generated results can be found here: https://dev-builds.libreoffice.org/cppcheck_reports/

Generated by this script: https://gerrit.libreoffice.org/gitweb?p=dev-tools.git;a=blob;f=cppcheck/cppcheck-report.sh


Retrieve LibreOffice sources

Retrieve LibreOffice sources in a <LO sources> directory with this command:

$ git clone git://anongit.freedesktop.org/libreoffice/core libo

(see Development/Native Build for more details)

Retrieve and build cppcheck sources

You can install cppcheck from distribution packages but it's better to retrieve last sources with git since there are improvements everyday. So choose and go into <cppcheck directory> then run these commands to retrieve sources and build cppcheck:

$ git clone git://github.com/danmar/cppcheck.git
$ cd cppcheck
$ make

Building takes less than a minute, but it can be sped up with -j4 make option.

Finally install python-pygments required by cppcheck-htmlreport report builder.

Generate reports

To summarize, you've got to generate an xml file containing all the warnings/errors detected by cppcheck. Then you must launch a script to generate a browseable tree from the xml file + LibreOffice sources. Cppcheck allows a lot of options but here are some simple steps: - go to <LO sources> directory - create a file named "cppcheck_supp.txt" which contains only unusedFunction - run this command to launch cppcheck detection:

$ <cppcheck directory>/cppcheck  -i external/ -i workdir/ --xml --suppressions-list=cppcheck_supp.txt --enable=all --max-configs=25 ./ 2> ./err.xml

(-i option allows to remove some directories to check, --suppressions-list allows to disable some types of detection, --enable=all allows to detect every types of detections, removing it allows to have only errors) Notice that on i5 with 6Gb, it takes several hours to have the result - run this command to generate the browseable tree:

$ <cppcheck directory>/htmlreport/cppcheck-htmlreport  --file=err.xml --title=LibreOffice --report-dir=cppcheck_reports --source-dir=.

You'll get a new directory called cppcheck_reports in your LO sources. The main page to browse in it is index.html With the configuration mentioned above, this part only takes a few minutes.

Future Work

Checking cppcheck's configuration

The above starter example reports ~9000 errors, nearly all of which are false positives. To see why you can add the --check-config parameter to analyse includes. The resulting report shows that cppcheck cannot find any of our header files.

Include paths

Headers can be included 2 ways

1) -I include/ Adding this parameter alone, eliminates ~ 1 thousand false positives, but it leaves out all of the headers in inc/

2) --includes-file=inc.txt with something like this: find . -type d \( -name "inc" -o -name "include" \) |sort > inc.txt

Teaching cppcheck about all of our header locations drops the number of errors found from 7K to a few hundred. However it also creates 2 new problems: speed and ~10K "toomanyconfigs" warnings. This may be fixed switching to project files to teach cppcheck about include folders and preprocessor defines.


An example of 2 configurations defined by A is this:

#ifdef A
    x = y;
    x = z;

By default cppcheck will check all preprocessor configurations (except those that have #error in them). So the above code will be analyzed both when A is defined and when it is not

We can speed things up by not checking our DEBUG configurations. We can also eliminate even more false positives by not checking configurations that are missing the system header files. For example on Linux, we should add -U_WIN32 to not check Windows configs.

Here is the result of my tweaking:

$ cppcheck -DNDEBUG -U_WIN32 -i external/ -i workdir/ --includes-file=inc.txt --xml --suppressions-list=cppcheck_supp.txt --enable=all --max-configs=100  ./  2> ./err.xml

This command is not perfect, but it greatly improved the signal-to-noise ratio, only showing a few hundred errors. The run time went from about from approx. 2 hours to 8, but I'm sure that can be by further by reducing the number of configurations checked (-D and -U).

Project Files

In Windows, you can generate a `LibreOffice.sln` to eliminate the need to configure anything.

$ ../cppcheck/bin/cppcheck -j 4 --xml --enable=style --project=LibreOffice.sln --cppcheck-build-dir=cppcheck-tmp 2> ./e

The problem with this route is that it only tests the Windows configuration and is very slow.

After you run any IDE integration, you'll find in workdir/GbuildToJson/Executable/soffice.bin

   "INCLUDE": "-I/core/include  -I/usr/lib/jvm/java-11-openjdk-amd64/include -I/usr/lib/jvm/java-11-openjdk-amd64/include/linux -I/core/config_host  -I/core/desktop/source/inc ", 

These configurations and include paths could be passed to cppcheck.

All of these commands are explained in detail on the cppcheck manual: http://cppcheck.sourceforge.net/manual.pdf