From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43594) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyGIP-0000LP-8y for qemu-devel@nongnu.org; Mon, 16 Nov 2015 04:41:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZyGIL-0007ew-HC for qemu-devel@nongnu.org; Mon, 16 Nov 2015 04:41:57 -0500 Received: from mail-wm0-x22a.google.com ([2a00:1450:400c:c09::22a]:37913) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyGIL-0007eq-BI for qemu-devel@nongnu.org; Mon, 16 Nov 2015 04:41:53 -0500 Received: by wmec201 with SMTP id c201so110910735wme.1 for ; Mon, 16 Nov 2015 01:41:52 -0800 (PST) Sender: Paolo Bonzini References: From: Paolo Bonzini Message-ID: <5649A4DE.4020605@redhat.com> Date: Mon, 16 Nov 2015 10:41:50 +0100 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] QEMU versus Facebook's Infer static analysis tool List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell , QEMU Developers On 14/11/2015 22:53, Peter Maydell wrote: > That's a shame, because it would have been nice to include another > kind of static analysis in what we run on QEMU (especially since > the coverity tests are "only runs every so often when we do a build"), > and the ability to do incremental analysis would have meant you could > include it in day to day workflow much more easily. > > In summary: worth keeping an eye on to see if it improves, but for > now I figured I'd just post this email to the list to save anybody > else running through the same process to come to the same conclusion. Great, thanks! Blue Swirl ran clang static analyzer back in the day. Now that we've fixed a lot of Coverity issues it's probably time to rerun it again and see whether free static analyzers can help us as much as Coverity does. However, we still have a few hundred flagged false positives in Coverity, so we can expect that any static analyzer will have a hard time finding real issues in the code. Paolo