Re: GSoC thoughts on C++ static analyzer support

[David Malcolm <dmalcolm@redhat.com>]

On Fri, 2022-04-15 at 22:27 +0300, Φώτης Βαλασιάδης via Gcc wrote:
> Hello all,

Hi!

> 
> I am interested in said project, and I'd like to ask.
> 
> Is said project limited to providing static analysis for heap
> allocations
> and file handles?  To be clear I am asking whether or not there are
> goals
> beyond these two.
> 
> This pattern could pretty much be used for all resource-like objects
> such
> as sockets, mutexes et cetera and point is that said problems in C++
> are
> already tackled by using RAII
> <https://en.cppreference.com/w/cpp/language/raii>. Now I understand
> that
> RAII isn't always an option nor does it solve all problems (for
> example,
> dangling references) so I am still fascinated by all of it and would
> like
> to share my thoughts.
> 
> C++11 mutexes(locks, and generally speaking all thread header
> facilities)
> could really use a static analyzer. Not only for the standard lock(),
> unlock() checks but also for "enforcing" lock ordering and other
> important
> guidelines. Read Anthony William's "Concurrency in Action" a while ago
> and
> honestly if I had a compiler that performed all those checks he
> describes
> in the book for me, which half of them I don't even remember anymore,
> THAT
> would be something else.
> 
> Now I understand that this might be really complicated for a GSoC
> project,
> but food for thought. Looking forward to hearing your thoughts on this.

This sounds fascinating, but unfortunately, the analyzer doesn't fully
support all of C++ yet, and so there's a lot of work to be done before
such a project could be attempted; some of that could make for a GSoC
project.

FWIW, there's a tracker bug for C++ support in the analyzer here:
  https://gcc.gnu.org/bugzilla/showdependencytree.cgi?id=97110
and some of those things (e.g. exception-handling) are challenging.

In addition to those specific things, before we can really say that we
"support C++" I think there would also need to be a lot of simply using
the analyzer on C++ codebases to see what happens (including using it
on GCC's code itself) - the "unknown unknowns", as it were.

BTW, I'm about to go on a week-long trip, and will be away from my
computer during that time, so I probably won't be able to send further
emails before the application deadline.

Hope this is helpful
Dave