[analyzer][Review request] Improved checker lists.

[ayartsev]

Summary

Here are the renewed checker lists we started to switch to a long time ago. The last suggestion was to split examples to produce one warning per example. Attached patch addresses this. It also contain lots of new improvements. Since the last review:

• made the list of actual checkers to look like the list of potential checkers, added examples;
• tested, reviewed and updated examples, removed odd and outdated ones, added new;
• split examples to produce a single warning per example;
• improved html structure and markup;
• added the improved expand/collapse feature;
• reviewed and improved descriptions, added missing <code> tegs, added missing periods;
• pointed to the sources related to the problem the checker evolves;

[jordan_rose]

I committed most of this for you in r207478, just to split it up. (Sorry if that was presumptuous.) Among the modifications I made were replacing the <div class="separator"></div> with slightly cleverer CSS, tweaking the ZeroAllocDereference checker to have an example that wasn't just a bounds check, making the categories slightly clearer, and commenting out undefbehavior.DeadReferenced.

Why the last one? Because a lot of the examples didn't show uses of the previous object, but rather uses of the new object that might look like uses of the previous object. I didn't want to spend all of our time cleaning it up before getting the rest of the improvements in, though, so I just hid it inside a comment for now.

I also dropped the link from checker_dev_manual.html because implicit_checks.html doesn't seem to exist. What was that change intended to do?

[ayartsev]

Thanks for committing this! My fault, did not included alpha_checks.html, implicit_checks.html and expandcollapse.js to the previous patch.
Additionally fixed table headers in available_checks.html, fixed paddings/margins of all table headers and updated undefbehavior.DeadReferenced.

[jordan_rose]

I'm still not sold on undefbehavior.DeadReferenced. Except for the delete, none of these are actually trying to use the old object...they're using the new object. (In some cases incorrectly, but still.) Using the old object would involve just calling the destructor, or keeping a pointer to a field within the object, or similar.

[ayartsev]

Not sure that I've got the idea. Each example is designed for the particular case of a dangerous pointer usage. In order:
The first example illustrates the usage of a pointer as an operand of a delete-expression - OK.
The second example is a modified example from the C++ spec - a call to a virtual function of an object whose lifetime has ended. Did you mean to call a destructor or keep a pointer to a field within the object instead? Isn't a call to a virtual function a usage of an old object?
The last three examples illustrate the following cases:

• the pointer is implicitly converted to a pointer to a base class type
• the pointer is used as the operand of a static_cast (except when the conversion is to void*, or to void* and subsequently to char*, or unsigned char*)
• the pointer is used as the operand of a dynamic_cast

Do you think the corresponding tests should be modified somehow?

[jordan_rose]

Okay, let's look at this example:

class A {
public:
  virtual void f();
};

class B : public A {
public:
  void f();
};

void test() {
  A *a = new A;
  new(a) B;
  a->f(); // warn
}

Both A and B have f() methods, so it's okay to invoke f() on an instance of type B (whether through an A* or a B*). This code is perfectly acceptable:

void test() {
  A *a = new A;
  a->~A();
  static_assert(sizeof(A) == sizeof(B) && alignof(A) == alignof(B),
                "different allocation requirements");
  new(a) B;
  a->f(); // okay, calls B::f.
}

In fact, this would be okay even if A::f weren't virtual.

I think the interesting thing to check is whether you are reinitializing an object whose destructor hasn't been called, and if there are any references to sub-objects used after the destructor has been called. Simply accessed members of the new object through the existing pointer is not an error.

[ayartsev]

Substituted the second example with the one that uses a destructor call.
References to sub-objects used after the destructor has been called are the matter of undefbehavior.MemberRefAfterDtor. Reinitialization of an object whose destructor hasn't been called is a good idea for an another checker!
This checker is designed for the particular cases described in C++03 3.8p5, p7 and C++11 3.8p5, p7.

C++11 3.8p5: Before the lifetime of an object has started but after the storage which the object will occupy has been
allocated or, after the lifetime of an object has ended and before the storage which the object occupied is
reused or released, any pointer that refers to the storage location where the object will be or was located
may be used but only in limited ways. For an object under construction or destruction, see 12.7. Otherwise,
such a pointer refers to allocated storage (3.7.4.2), and using the pointer as if the pointer were of type void*,
is well-defined. Such a pointer may be dereferenced but the resulting lvalue may only be used in limited
ways, as described below. The program has undefined behavior if:
— the object will be or was of a class type with a non-trivial destructor and the pointer is used as the
operand of a delete-expression,
— the pointer is used to access a non-static data member or call a non-static member function of the
object, or
— the pointer is implicitly converted (4.10) to a pointer to a base class type, or
— the pointer is used as the operand of a static_cast (5.2.9) (except when the conversion is to void*,
or to void* and subsequently to char*, or unsigned char*), or
— the pointer is used as the operand of a dynamic_cast (5.2.7). [ Example:
#include <cstdlib>
struct B {
virtual void f();
void mutate();
virtual ~B();
};
struct D1 : B { void f(); };
struct D2 : B { void f(); };
void B::mutate() {
new (this) D2; reuses storage — ends the lifetime of *this
f(); undefined behavior
... = this; OK, this points to valid memory
}
void g() {
void* p = std::malloc(sizeof(D1) + sizeof(D2));
B* pb = new (p) D1;
pb->mutate();
&pb; OK: pb points to valid memory
void* q = pb; OK: pb points to valid memory
pb->f(); undefined behavior, lifetime of *pb has ended
}

[ayartsev]

Update to the patch after r207995. Enabling of the expandcollapse feature added.

[ayartsev]

Ping!

[jordan_rose]

Did you write expandcollapse.js yourself? Or does it have a license we need to mention? Don't forget the images when you commit.

Content looks good! (with a few inline comments, of course). If there are no issues with the license thing, please commit.

www/analyzer/alpha_checks.html

21

We should probably include something like: "These are checkers with known issues or limitations that keep them from being on by default. They are likely to have false positives. Bug reports are welcome but will likely not be investigated for some time. Patches welcome!"

104

It supports more than just operators now. "Warn about suspicious uses of identical expressions"?

[ayartsev]

The expandcollapse.js is written by me from scratch as well as button images. Committed as r209131.

www/analyzer/alpha_checks.html

+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+          "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+  <title>Alpha Checks</title>
+  <link type="text/css" rel="stylesheet" href="menu.css">
+  <link type="text/css" rel="stylesheet" href="content.css">
+  <script type="text/javascript" src="scripts/menu.js"></script>
+  <script type="text/javascript" src="scripts/expandcollapse.js"></script>
+  <style type="text/css">
+  tr:first-child { width:20%; }
+  </style>
+</head>
+<body onload="initExpandCollapse()">
+
+<div id="page">
+<!--#include virtual="menu.html.incl"-->
+
+<div id="content">
+<h1>Alpha Checkers</h1>
+Experimental checkers in addition to the <a href = "available_checks.html">Default Checkers</a>.
+<ul>
+<li><a href="#core_alpha_checkers">Core Alpha Checkers</a></li>
+<li><a href="#cplusplus_alpha_checkers">C++ Alpha Checkers</a></li>
+<li><a href="#deadcode_alpha_checkers">Dead Code Alpha Checkers</a></li>
+<li><a href="#osx_alpha_checkers">OS X Alpha Checkers</a></li>
+<li><a href="#security_alpha_checkers">Security Alpha Checkers</a></li>
+<li><a href="#unix_alpha_checkers">Unix Alpha Checkers</a></li>
+</ul>
+
+<!------------------------------ core alpha ----------------------------------->
+<h3 id="core_alpha_checkers">Core Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.BoolAssignment</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warn about assigning non-{0,1} values to boolean variables.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  BOOL b = -1; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.CastSize</span><span class="lang">
+(C)</span><div class="descr">
+Check when casting a malloc'ed type T, whether the size is a multiple of the 
+size of T (Works only with <span class="name">unix.Malloc</span>
+or <span class="name">alpha.unix.MallocWithAnnotations</span> 
+checks enabled).</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int *x = (int *)malloc(11); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.CastToStruct</span><span class="lang">
+(C, C++)</span><div class="descr">
+Check for cast from non-struct pointer to struct pointer.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// C
+struct s {};
+
+void test(int *p) {
+  struct s *ps = (struct s *) p; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// C++
+class c {};
+
+void test(int *p) {
+  c *pc = (c *) p; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.FixedAddr</span><span class="lang">
+(C)</span><div class="descr">
+Check for assignment of a fixed address to a pointer.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int *p;
+  p = (int *) 0x10000; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.IdenticalExpr</span><span class="lang">
+(C, C++)</span><div class="descr">
+Warn about unintended use of identical expressions in operators.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// C
+void test() {
+  int a = 5;
+  int b = a | 4 | a; // warn: identical expr on both sides
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// C++
+bool f(void);
+
+void test(bool b) {
+  int i = 10;
+  if (f()) { // warn: true and false branches are identical
+    do {
+      i--;
+    } while (f());
+  } else {
+    do {
+      i--;
+    } while (f());
+  }
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.PointerArithm</span><span class="lang">
+(C)</span><div class="descr">
+Check for pointer arithmetic on locations other than array elements.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int x;
+  int *p;
+  p = &amp;x + 1; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.PointerSub</span><span class="lang">
+(C)</span><div class="descr">
+Check for pointer subtractions on two pointers pointing to different memory 
+chunks.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int x, y;
+  int d = &amp;y - &amp;x; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.SizeofPtr</span><span class="lang">
+(C)</span><div class="descr">
+Warn about unintended use of <code>sizeof()</code> on pointer 
+expressions.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+struct s {};
+
+int test(struct s *p) {
+  return sizeof(p); 
+    // warn: sizeof(ptr) can produce an unexpected result
+}
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!--------------------------- cplusplus alpha --------------------------------->
+<h3 id="cplusplus_alpha_checkers">C++ Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.cplusplus.NewDeleteLeaks</span><span class="lang">
+(C++)</span><div class="descr">
+Check for memory leaks. Traces memory managed by <code>new</code>/<code>
+delete</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int *p = new int;
+} // warn
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.cplusplus.VirtualCall</span><span class="lang">
+(C++)</span><div class="descr">
+Check virtual member function calls during construction or destruction.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+class A {
+public:
+  A() { 
+    f(); // warn
+  }
+  virtual void f();
+};
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+class A {
+public:
+  ~A() {
+    this-&gt;f(); // warn
+  }
+  virtual void f();
+};
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!--------------------------- dead code alpha --------------------------------->
+<h3 id="deadcode_alpha_checkers">Dead Code Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.deadcode.UnreachableCode</span><span class="lang">
+(C, C++, ObjC)</span><div class="descr">
+Check unreachable code.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// C
+int test() {
+  int x = 1;
+  while(x);
+  return x; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// C++
+void test() {
+  int a = 2;
+
+  while (a > 1)
+    a--;
+
+  if (a > 1)
+    a++; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// Objective-C
+void test(id x) {
+  return;
+  [x retain]; // warn
+}
+</pre></div></div></td></tr>
+</tbody></table>
+
+<!---------------------------- OS X alpha -------------------------------------->
+<h3 id="osx_alpha_checkers">OS X Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.Dealloc</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warn about Objective-C classes that lack a correct implementation 
+of <code>-dealloc</code>.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;  
+}
+@end
+
+@implementation MyObject // warn: lacks 'dealloc'
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {}
+@property(assign) id myproperty;
+@end
+
+@implementation MyObject // warn: does not send 'dealloc' to super
+- (void)dealloc {
+  self.myproperty = 0;
+}
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;
+}
+@property(retain) id myproperty;
+@end
+
+@implementation MyObject
+@synthesize myproperty = _myproperty;
+  // warn: var was retained but wasn't released
+- (void)dealloc {
+  [super dealloc];
+}
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;
+}
+@property(assign) id myproperty;
+@end
+
+@implementation MyObject
+@synthesize myproperty = _myproperty;
+  // warn: var wasn't retained but was released
+- (void)dealloc {
+  [_myproperty release];
+  [super dealloc];
+}
+@end
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.DirectIvarAssignment</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check that Objective C properties follow the following rule: the property 
+should be set with the setter, not though a direct assignment.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@interface MyClass : NSObject {}
+@property (readonly) id A;
+- (void) foo;
+@end
+
+@implementation MyClass
+- (void) foo {
+  _A = 0; // warn
+}
+@end
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.DirectIvarAssignmentForAnnotatedFunctions</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check for direct assignments to instance variables in the methods annotated 
+with <code>objc_no_direct_instance_variable_assignment</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@interface MyClass : NSObject {}
+@property (readonly) id A;
+- (void) fAnnotated __attribute__((
+    annotate("objc_no_direct_instance_variable_assignment")));
+- (void) fNotAnnotated;
+@end
+
+@implementation MyClass
+- (void) fAnnotated {
+  _A = 0; // warn
+}
+- (void) fNotAnnotated {
+  _A = 0; // no warn
+}
+@end
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.InstanceVariableInvalidation</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check that the invalidatable instance variables are invalidated in the methods
+annotated with <code>objc_instance_variable_invalidator</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@protocol Invalidation &lt;NSObject&gt;
+- (void) invalidate 
+  __attribute__((annotate("objc_instance_variable_invalidator")));
+@end 
+
+@interface InvalidationImpObj : NSObject &lt;Invalidation&gt;
+@end
+
+@interface SubclassInvalidationImpObj : InvalidationImpObj {
+  InvalidationImpObj *var;
+}
+- (void)invalidate;
+@end
+
+@implementation SubclassInvalidationImpObj
+- (void) invalidate {}
+@end
+// warn: var needs to be invalidated or set to nil
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.MissingInvalidationMethod</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check that the invalidation methods are present in classes that contain 
+invalidatable instance variables.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@protocol Invalidation &lt;NSObject&gt;
+- (void)invalidate 
+  __attribute__((annotate("objc_instance_variable_invalidator")));
+@end
+
+@interface NeedInvalidation : NSObject &lt;Invalidation&gt;
+@end
+
+@interface MissingInvalidationMethodDecl : NSObject {
+  NeedInvalidation *Var; // warn
+}
+@end
+
+@implementation MissingInvalidationMethodDecl
+@end
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!------------------------- security alpha ------------------------------------>
+<h3 id="security_alpha_checkers">Security Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.security.ArrayBound</span><span class="lang">
+(C)</span><div class="descr">
+Warn about buffer overflows (older checker).</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  char *s = "";
+  char c = s[1]; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+struct seven_words {
+  int c[7];
+};
+
+void test() {
+  struct seven_words a, *p;
+  p = &a;
+  p[0] = a;
+  p[1] = a;
+  p[2] = a; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// note: requires unix.Malloc or 
+// alpha.unix.MallocWithAnnotations checks enabled.
+void test() {
+  int *p = malloc(12);
+  p[3] = 4; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  char a[2];
+  int *b = (int*)a;
+  b[1] = 3; // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.security.ArrayBoundV2</span><span class="lang">
+(C)</span><div class="descr">
+Warn about buffer overflows (newer checker).</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  char *s = "";
+  char c = s[1]; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  int buf[100];
+  int *p = buf;
+  p = p + 99;
+  p[1] = 1; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// note: compiler has internal check for this.
+// Use -Wno-array-bounds to suppress compiler warning.
+void test() {
+  int buf[100][100];
+  buf[0][-1] = 1; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// note: requires alpha.security.taint check turned on.
+void test() {
+  char s[] = "abc";
+  int x = getchar();
+  char c = s[x]; // warn: index is tainted
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.security.MallocOverflow</span><span class="lang">
+(C)</span><div class="descr">
+Check for overflows in the arguments to <code>malloc()</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(int n) {
+  void *p = malloc(n * sizeof(int)); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.security.ReturnPtrRange</span><span class="lang">
+(C)</span><div class="descr">
+Check for an out-of-bound pointer being returned to callers.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+static int A[10];
+
+int *test() {
+  int *p = A + 10;
+  return p; // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+int test(void) {
+  int x;
+  return x; // warn: undefined or garbage returned
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.security.taint.TaintPropagation</span><span class="lang">
+(C)</span><div class="descr">
+Generate taint information used by other checkers.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  char x = getchar(); // 'x' marked as tainted
+  system(&x); // warn: untrusted data is passed to a system call
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// note: compiler internally checks if the second param to
+// sprintf is a string literal or not. 
+// Use -Wno-format-security to suppress compiler warning.
+void test() {
+  char s[10], buf[10];
+  fscanf(stdin, "%s", s); // 's' marked as tainted
+
+  sprintf(buf, s); // warn: untrusted data as a format string
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  size_t ts;
+  scanf("%zd", &ts); // 'ts' marked as tainted
+  int *p = (int *)malloc(ts * sizeof(int)); 
+    // warn: untrusted data as bufer size
+}
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!--------------------------- unix alpha -------------------------------------->
+<h3 id="unix_alpha_checkers">Unix Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.Chroot</span><span class="lang">
+(C)</span><div class="descr">
+Check improper use of <code>chroot</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void f();
+
+void test() {
+  chroot("/usr/local");
+  f(); // warn: no call of chdir("/") immediately after chroot
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.MallocWithAnnotations</span><span class="lang">
+(C)</span><div class="descr">
+Check for memory leaks, double free, and use-after-free problems. Assumes that 
+all user-defined functions which might free a pointer are annotated.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
+
+void test() {
+  int *p = my_malloc(1);
+} // warn: potential leak
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
+void __attribute((ownership_takes(malloc, 1))) my_free(void *);
+
+void test() {
+  int *p = my_malloc(1);
+  my_free(p);
+  my_free(p); // warn: attempt to free released
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
+void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
+
+void test() {
+  int *p = my_malloc(1);
+  my_hold(p);
+  free(p); // warn: attempt to free non-owned memory
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void __attribute((ownership_takes(malloc, 1))) my_free(void *);
+
+void test() {
+  int *p = malloc(1);
+  my_free(p);
+  *p = 1; // warn: use after free
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.PthreadLock</span><span class="lang">
+(C)</span><div class="descr">
+Simple lock -> unlock checker; applies to:<div class=functions>
+pthread_mutex_lock<br>
+pthread_rwlock_rdlock<br>
+pthread_rwlock_wrlock<br>
+lck_mtx_lock<br>
+lck_rw_lock_exclusive<br>
+lck_rw_lock_shared<br>
+pthread_mutex_trylock<br>
+pthread_rwlock_tryrdlock<br>
+pthread_rwlock_tryrwlock<br>
+lck_mtx_try_lock<br>
+lck_rw_try_lock_exclusive<br>
+lck_rw_try_lock_shared<br>
+pthread_mutex_unlock<br>
+pthread_rwlock_unlock<br>
+lck_mtx_unlock<br>
+lck_rw_done</div></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+pthread_mutex_t mtx;
+
+void test() {
+  pthread_mutex_lock(&mtx);
+  pthread_mutex_lock(&mtx); 
+    // warn: this lock has already been acquired
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+lck_mtx_t lck1, lck2;
+
+void test() {
+  lck_mtx_lock(&lck1);
+  lck_mtx_lock(&lck2);
+  lck_mtx_unlock(&lck1); 
+    // warn: this was not the most recently acquired lock
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+lck_mtx_t lck1, lck2;
+
+void test() {
+  if (lck_mtx_try_lock(&lck1) == 0)
+    return;
+
+  lck_mtx_lock(&lck2);
+  lck_mtx_unlock(&lck1);
+    // warn: this was not the most recently acquired lock
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.SimpleStream</span><span class="lang">
+(C)</span><div class="descr">
+Check for misuses of stream APIs:<div class=functions>
+fopen<br>
+fclose</div>(demo checker, the subject of the demo
+(<a href="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">Slides</a>
+,<a href="http://llvm.org/devmtg/2012-11/videos/Zaks-Rose-Checker24Hours.mp4">Video</a>) 
+by Anna Zaks and Jordan Rose presented at the <a href="http://llvm.org/devmtg/2012-11/">
+2012 LLVM Developers' Meeting).</a></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  FILE *F = fopen("myfile.txt", "w");
+} // warn: opened file is never closed
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  FILE *F = fopen("myfile.txt", "w");
+
+  if (F)
+    fclose(F);
+
+  fclose(F); // warn: closing a previously closed file stream
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.Stream</span><span class="lang">
+(C)</span><div class="descr">
+Check stream handling functions:<div class=functions>fopen<br>
+tmpfile<br>
+fclose<br>
+fread<br>
+fwrite<br>
+fseek<br>
+ftell<br>
+rewind<br>
+fgetpos<br>
+fsetpos<br>
+clearerr<br>
+feof<br>
+ferror<br>
+fileno</div></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  FILE *p = fopen("foo", "r");
+} // warn: opened file is never closed
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  FILE *p = fopen("foo", "r");
+  fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL
+  fclose(p); 
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  FILE *p = fopen("foo", "r");
+
+  if (p)
+    fseek(p, 1, 3);
+     // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR
+
+  fclose(p); 
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  FILE *p = fopen("foo", "r");
+  fclose(p); 
+  fclose(p); // warn: already closed
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  FILE *p = tmpfile();
+  ftell(p); // warn: stream pointer might be NULL
+  fclose(p);
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.cstring.BufferOverlap</span><span class="lang">
+(C)</span><div class="descr">
+Checks for overlap in two buffer arguments; applies to:<div class=functions>
+memcpy<br>
+mempcpy</div></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int a[4] = {0};
+  memcpy(a + 2, a + 1, 8); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.cstring.NotNullTerminated</span><span class="lang">
+(C)</span><div class="descr">
+Check for arguments which are not null-terminated strings; applies to:<div class=functions>
+strlen<br>
+strnlen<br>
+strcpy<br>
+strncpy<br>
+strcat<br>
+strncat</div></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int y = strlen((char *)&test); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.unix.cstring.OutOfBounds</span><span class="lang">
+(C)</span><div class="descr">
+Check for out-of-bounds access in string functions; applies to:<div class=functions>
+strncopy<br>
+strncat</div></div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(char *y) {
+  char x[4];
+  if (strlen(y) == 4)
+    strncpy(x, y, 5); // warn
+}
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+</div> <!-- page -->
+</div> <!-- content -->
+</body>
+</html>

www/analyzer/available_checks.html

 <li><a href="#security_checkers">Security Checkers</a> check for insecure API usage and perform checks based on the CERT Secure Coding Standards</li>
 <li><a href="#unix_checkers">Unix Checkers</a> check the use of Unix and POSIX APIs</li>
 </ul>
 
 <!------------------------------------ core ----------------------------------->
 <h3 id="core_checkers">Core Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
-
-
 <tr><td><div class="namedescr expandable"><span class="name">
 core.CallAndMessage</span><span class="lang">
 (C, C++, ObjC)</span><div class="descr">
 Check for logical errors for function calls and Objective-C message expressions
 (e.g., uninitialized arguments, null function pointers).</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 // C

 </pre></div></div></td></tr>
 
 </tbody></table>
 
 <!------------------------------------ C++ ------------------------------------>
 <h3 id="cplusplus_checkers">C++ Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 cplusplus.NewDelete</span><span class="lang">
 (C++)</span><div class="descr">
 Check for double-free, use-after-free and offset problems involving C++ <code>
 delete</code>.</div></div></td>
 <td><div class="exampleContainer expandable">

 </pre></div></div></td></tr>
 
 </tbody></table>
 
 <!--------------------------------- dead code --------------------------------->
 <h3 id="deadcode_checkers">Dead Code Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 deadcode.DeadStores</span><span class="lang">
 (C)</span><div class="descr">
 Check for values stored to variables that are never read afterwards.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   int x;
   x = 1; // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
 <!---------------------------------- OS X ------------------------------------>
 <h3 id="osx_checkers">OS X Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.API</span><span class="lang">
 (C)</span><div class="descr">
 Check for proper uses of various Apple APIs:<div class=functions>
 dispatch_once</div></div></div></td>
 <td><div class="exampleContainer expandable">

 </pre></div></div></td></tr>
 
 </tbody></table>
 
 <!------------------------------- security ------------------------------------>
 <h3 id="security_checkers">Security Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 security.FloatLoopCounter</span><span class="lang">
 (C)</span><div class="descr">
 Warn on using a floating point value as a loop counter (CERT: FLP30-C,
 FLP30-CPP).</div></div></td>
 <td><div class="exampleContainer expandable">

 </pre></div></div></td></tr>
 
 </tbody></table>
 
 <!--------------------------------- unix -------------------------------------->
 <h3 id="unix_checkers">Unix Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
-
-<thead>
-<tr><td><div class="namedescr">Name, Description</div></td>
-<td><div class="example">Example</div></td></tr>
-</thead>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 unix.API</span><span class="lang">
 (C)</span><div class="descr">
 Check calls to various UNIX/POSIX functions:<div class=functions>
 open<br>
 pthread_once<br>

www/analyzer/checker_dev_manual.html

<ul>
       <li><a href="#registration">Checker Registration</a></li>
       <li><a href="#events_callbacks">Events, Callbacks, and Checker Class Structure</a></li>
       <li><a href="#extendingstates">Custom Program States</a></li>
       <li><a href="#bugs">Bug Reports</a></li>
       <li><a href="#ast">AST Visitors</a></li>
       <li><a href="#testing">Testing</a></li>
       <li><a href="#commands">Useful Commands/Debugging Hints</a></li>
       <li><a href="#additioninformation">Additional Sources of Information</a></li>
+      <li><a href="#links">Useful Links</a></li>
     </ul>
 
 <h2 id=start>Getting Started</h2>
   <ul>
     <li>To check out the source code and build the project, follow steps 1-4 of 
     the <a href="http://clang.llvm.org/get_started.html">Clang Getting Started</a> 
   page.</li>
 

 href="http://llvm.org/devmtg/2012-11">November 2012 LLVM Developer's
 meeting</a>. Describes the construction of SimpleStreamChecker. <a
 href="http://llvm.org/devmtg/2012-11/Zaks-Rose-Checker24Hours.pdf">Slides</a>
 and <a
 href="http://llvm.org/devmtg/2012-11/videos/Zaks-Rose-Checker24Hours.mp4">video</a>
 are available.
 </ul>
 
+<h2 id=links>Useful Links</h2>
+<ul>
+<li>The list of <a href="implicit_checks.html">Implicit Checkers</a></li>
+</ul>
+
 </div>
 </div>
 </body>
 </html>

www/analyzer/content.css

table.checkers thead {
   border-bottom: 2px solid #cccccc;
   font-weight: bold; font-family: Verdana;
 }
 table.checkers td { border-right: 1px #cccccc dotted; border-bottom: 1px #cccccc dotted; }
 table.checkers td.aligned { text-align: center; vertical-align: middle; }
 table.checkers col.namedescr { width: 45% }
 table.checkers col.example { width: 55% }
 table.checkers col.progress { width: 84px }
-table.checkers thead div.example,
+table.checkers thead td,
 table.checkers div.namedescr,
 table.checkers div.exampleContainer { overflow: hidden; padding: 5px 8px 10px 8px }
 /* table.checkers tbody div.example { font-family: monospace; white-space: pre } */
 table.checkers div.example { border-top:1px #cccccc dashed; width:100%; padding-top: 5px; margin-top: 5px }
-table.checkers tbody div.example:first-child { border-top:none; padding-top: 0px; margin-top: 0px }
+table.checkers div.example:first-child { border-top:none; padding-top: 0px; margin-top: 0px }
 table.checkers span.name { font-weight: bold }
 table.checkers span.lang { font-weight: bold; padding-left: 7px; /* display:block; */ }
 table.checkers div.descr { margin-top:7px }
 table.checkers div.functions { margin-top: 2px; font-style: italic; font-size: 90%; color:#00B }
 table.checkers pre { margin: 1px; font-size: 100%; word-wrap: break-word }
 table.checkers p { margin: 10px 0px 0px 0px; }
+table.checkers ul, li { margin: 0 }
 

www/analyzer/implicit_checks.html

+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+          "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+  <title>Implicit Checks</title>
+  <link type="text/css" rel="stylesheet" href="menu.css">
+  <link type="text/css" rel="stylesheet" href="content.css">
+  <script type="text/javascript" src="scripts/menu.js"></script>
+  <script type="text/javascript" src="scripts/expandcollapse.js"></script>
+  <style type="text/css">
+  tr:first-child { width:20%; }
+  </style>
+</head>
+<body onload="initExpandCollapse()">
+
+<div id="page">
+<!--#include virtual="menu.html.incl"-->
+
+<div id="content">
+<h1>Implicit Checkers</h1>
+Even though the implicit checkers do not produce any warnings, they are used to 
+support the analyzer core and model known APIs. See also 
+<a href = "available_checks.html">Default Checkers</a>
+and <a href = "alpha_checks.html">Experimental (Alpha) Checkers</a>.
+<ul>
+<li><a href="#core_implicit_checkers">Core Implicit Checkers</a></li>
+<li><a href="#osx_implicit_checkers">OS X Implicit Checkers</a></li>
+</ul>
+
+<!------------------------------- core implicit ------------------------------->
+<h3 id="core_implicit_checkers">Core Implicit Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+core.DynamicTypePropagation</span><span class="lang">
+(C++, ObjC)</span><div class="descr">
+Generate dynamic type information.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// C++
+class A {
+public:
+  A(int x) {}
+  virtual int foo();
+};
+
+class B: public A {
+public:
+  B()
+  :A(foo()) 
+  // DynamicTypeInfo for 'this' rigion will wrap type 'A'
+  // unless the base constructor call expression is processed
+  {} 
+  virtual int foo();
+};
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// Objective-C
+@interface MyClass : NSObject {}
+@end
+
+@implementation MyClass
++ (void)foo {
+  MyClass *x = [[self alloc] init];
+  // DynamicTypeInfo from a cast: from 'id' to 'MyClass *'
+}
+@end
+
+void test() {
+  MyClass *x = [MyClass alloc];
+  // DynamicTypeInfo from a call to alloc:
+  // from 'id' to 'MyClass *'
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+core.builtin.BuiltinFunctions</span><span class="lang">
+(C)</span><div class="descr">
+Evaluate compiler builtin functions (e.g., <code>alloca()</code>)</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(int x) {
+  int *p = (int *)__builtin_alloca(8);
+    // evaluates to AllocaRegion
+
+  if(__builtin_expect(x > 10, 0)) // evaluates to 'x > 10'
+    x = 0;
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+core.builtin.NoReturnFunctions</span><span class="lang">
+(C, ObjC)</span><div class="descr">
+Evaluate "panic" functions that are known to not return to the caller.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// C
+void test() {
+  panic(); // generate sink
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// Objective-C
+@interface MyObj : NSObject {}
+- (void)foo;
+@end
+
+@implementation MyObj
+- (void)foo {
+  [[NSAssertionHandler currentHandler] handleFailureInMethod:_cmd 
+                                       object:self 
+                                       file:(@"somefile.m") 
+                                       lineNumber:1 
+                                       description:(@"some text")];
+    // generate sink
+}
+@end
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!---------------------------- OS X implicit ---------------------------------->
+<h3 id="osx_implicit_checkers">OS X Implicit Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.Loops</span><span class="lang">
+(ObjC)</span><div class="descr">
+Improved modeling of loops using Cocoa collection types.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  id x;
+  for (x in [NSArray testObject]) { 
+    // assume the value of 'x' is non-nil
+  }
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.NonNilReturnValue</span><span class="lang">
+(ObjC)</span><div class="descr">
+Model the APIs that are guaranteed to return a non-nil value.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(NSArray *A) {
+  id subscriptObj = A[1]; // assume the value is non-nil
+}
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+</div> <!-- page -->
+</div> <!-- content -->
+</body>
+</html>

www/analyzer/potential_checkers.html

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
           "http://www.w3.org/TR/html4/strict.dtd">
 <html>
 <head>
   <title>List of potential checkers</title>
   <link type="text/css" rel="stylesheet" href="content.css">
   <link type="text/css" rel="stylesheet" href="menu.css">
+  <script type="text/javascript" src="scripts/expandcollapse.js"></script>
   <script type="text/javascript" src="scripts/menu.js"></script>
 </head>
+<body onload="initExpandCollapse()">
 
 <div id="page">
 
 <!-- menu -->
 <!--#include virtual="menu.html.incl"-->
 <!-- page content -->
 <div id="content">
 <h1>List of potential checkers</h1>

 </pre></div>
 <div class="example"><pre>
 int *p = new int{};
 int i = *p; // warn
 </pre></div></div></td>
 <td class="aligned"></td></tr>
 
 
-<!--<tr><td><div class="namedescr expandable"><span class="name">
+<tr><td><div class="namedescr expandable"><span class="name">
 undefbehavior.DeadReferenced</span><span class="lang">
 (C++)</span><div class="descr">
-Undefined behavior: the following usage of the pointer to the object whose 
-lifetime has ended can result in undefined behavior.
+Undefined behavior: the following usage of the pointer to the object whose
+lifetime has ended can result in undefined behavior:<br>
+The object will be or was of a class type with a non-trivial destructor and
+<ul><li>the pointer is used as the operand of a delete-expression</li></ul>
+The object will be or was of a non-POD class type (C++11: any class type) and
+<ul><li>the pointer is used to access a non-static data member or call a
+non-static member function of the object</li>
+<li>the pointer is implicitly converted to a pointer to a base class
+type</li>
+<li>the pointer is used as the operand of a <code>static_cast</code> (except
+when the conversion is to <code>void*</code>, or to <code>void*</code> and 
+subsequently to <code>char*</code>, or <code>unsigned char*</code>)</li>
+<li>the pointer is used as the operand of a <code>dynamic_cast</code></li></ul>
 <p>Source: C++03 3.8p5, p7; C++11 3.8p5, p7.</p></div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 #include &lt;new&gt;
 
 class A {
 public:
-  int i;
+  ~A();
 };
 
 class B : public A {};
 
-int test() {
-  B *b = new B;
-  new(b) A;
-  return b-&gt;i; // warn
+void test() {
+  A *a = new A;
+  new(a) B;
+  delete a; // warn
 }
 </pre></div>
 <div class="example"><pre>
 #include &lt;new&gt;
 
 class A {
 public:
-  void f() {};
+  ~A();
 };
 
-class B : public A {};
+class B {};
 
 void test() {
-  B *b = new B;
-  new(b) A;
-  b-&gt;f(); // warn
+  A *a = new A;
+  new(a) B;
+  a->~A();
 }
 </pre></div>
 <div class="example"><pre>
 #include &lt;new&gt;
 
-class A {};
+class A {
+public:
+  ~A();
+};
 
 class B : public A {};
 
-A* test() {
-  B *b = new B;
-  new(b) A;
-  static_cast&lt;A*&gt;(b); // warn
-}
-</pre></div>
-<div class="example"><pre>
-#include &lt;new&gt;
-
-class A {};
+class C {};
 
-class B : public A {};
+void f(A*);
 
-A* test() {
+void test() {
   B *b = new B;
-  new(b) A;
-  dynamic_cast&lt;A*&gt;(b); // warn
+  new(b) C;
+  f(b); // warn
 }
 </pre></div>
 <div class="example"><pre>
 #include &lt;new&gt;
 
-class A {};
+class A {
+public:
+  ~A();
+};
 
 class B : public A {};
 
-A* test() {
-  B *b = new B;
-  new(b) A;
-  dynamic_cast&lt;A*&gt;(b); // warn
-}
-</pre></div>
-<div class="example"><pre>
-#include &lt;new&gt;
-
-class A {};
-
-class B : public A {};
+class C {};
 
-void test() {
+A* test() {
   B *b = new B;
-  new(b) A;
-  delete b; // warn
+  new(b) C;
+  return static_cast&lt;A*&gt;(b); // warn
 }
 </pre></div>
 <div class="example"><pre>
-// C++11
 #include &lt;new&gt;
 
 class A {
 public:
-  int i;
+  ~A();
 };
 
-class B : public A {
-public:
-  ~B() {};
-};
+class B : public A {};
 
-int test() {
-  A *a = new A;
-  new(a) B;
-  return a-&gt;i; // warn
+class C {};
+
+A* test() {
+  B *b = new B;
+  new(b) C;
+  return dynamic_cast&lt;A*&gt;(b); // warn
 }
 </pre></div></div></td>
-<td class="aligned"></td></tr>-->
+<td class="aligned"></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
 undefbehavior.ObjLocChanges</span><span class="lang">
 (C++)</span><div class="descr">
 Undefined behavior: the program must ensure that an object occupies the same 
 storage location when the implicit or explicit destructor call takes place.
 <p>Source: C++11 3.8p8.</p></div></div></td>

www/analyzer/scripts/expandcollapse.js

+// expand/collapse button (expander) is added if height of a cell content 
+// exceeds CLIP_HEIGHT px.
+var CLIP_HEIGHT = 135;
+
+// Height in pixels of an expander image.
+var EXPANDER_HEIGHT = 13;
+
+// Path to images for an expander.
+var imgPath = "./images/expandcollapse/";
+
+// array[group][cell] of { 'height', 'expanded' }.
+// group: a number; cells of the same group belong to the same table row.
+// cell: a number; unique index of a cell in a group.
+// height: a number, px; original height of a cell in a table.
+// expanded: boolean; is a cell expanded or collapsed?
+var CellsInfo = [];
+
+// Extracts group and cell indices from an id of the form identifier_group_cell.
+function getCellIdx(id) {
+  var idx = id.substr(id.indexOf("_") + 1).split("_");
+  return { 'group': idx[0], 'cell': idx[1] };
+}
+
+// Returns { 'height', 'expanded' } info for a cell with a given id.
+function getCellInfo(id) { 
+  var idx = getCellIdx(id); 
+  return CellsInfo[idx.group][idx.cell]; 
+}
+
+// Initialization, add nodes, collect info.
+function initExpandCollapse() {
+  if (!document.getElementById)
+    return;
+
+  var groupCount = 0;
+
+  // Examine all table rows in the document.
+  var rows = document.body.getElementsByTagName("tr");
+  for (var i=0; i<rows.length; i+=1) {
+
+    var cellCount=0, newGroupCreated = false;
+
+    // Examine all divs in a table row.
+    var divs = rows[i].getElementsByTagName("div");
+    for (var j=0; j<divs.length; j+=1) {
+
+      var expandableDiv = divs[j];
+
+      if (expandableDiv.className.indexOf("expandable") == -1)
+        continue;
+
+      if (expandableDiv.offsetHeight <= CLIP_HEIGHT)
+        continue;
+
+      // We found a div wrapping a cell content whose height exceeds 
+      // CLIP_HEIGHT.
+      var originalHeight = expandableDiv.offsetHeight;
+      // Unique postfix for ids for generated nodes for a given cell.
+      var idxStr = "_" + groupCount + "_" + cellCount;
+      // Create an expander and an additional wrapper for a cell content.
+      //
+      //                                --- expandableDiv ----
+      //  --- expandableDiv ---         | ------ data ------ |
+      //  |    cell content   |   ->    | |  cell content  | | 
+      //  ---------------------         | ------------------ |
+      //                                | ---- expander ---- |
+      //                                ----------------------
+      var data = document.createElement("div");
+      data.className = "data";
+      data.id = "data" + idxStr;
+      data.innerHTML = expandableDiv.innerHTML;
+      with (data.style) { height = (CLIP_HEIGHT - EXPANDER_HEIGHT) + "px";
+                          overflow = "hidden" }
+
+      var expander = document.createElement("img");
+      with (expander.style) { display = "block"; paddingTop = "5px"; }
+      expander.src = imgPath + "ellipses_light.gif";
+      expander.id = "expander" + idxStr;
+
+      // Add mouse calbacks to expander.
+      expander.onclick = function() {
+        expandCollapse(this.id);
+        // Hack for Opera - onmouseout callback is not invoked when page 
+        // content changes dinamically and mouse pointer goes out of an element.
+        this.src = imgPath + 
+                   (getCellInfo(this.id).expanded ? "arrows_light.gif"
+                                                  : "ellipses_light.gif");
+      }
+      expander.onmouseover = function() { 
+        this.src = imgPath + 
+                   (getCellInfo(this.id).expanded ? "arrows_dark.gif"
+                                                  : "ellipses_dark.gif");
+      }
+      expander.onmouseout = function() { 
+        this.src = imgPath + 
+                   (getCellInfo(this.id).expanded ? "arrows_light.gif"
+                                                  : "ellipses_light.gif");
+      }
+
+      expandableDiv.innerHTML = "";
+      expandableDiv.appendChild(data);
+      expandableDiv.appendChild(expander);
+      expandableDiv.style.height = CLIP_HEIGHT + "px";
+      expandableDiv.id = "cell"+ idxStr;
+
+      // Keep original cell height and its ecpanded/cpllapsed state.
+      if (!newGroupCreated) {
+        CellsInfo[groupCount] = [];
+        newGroupCreated = true;
+      }
+      CellsInfo[groupCount][cellCount] = { 'height' : originalHeight,
+                                           'expanded' : false };
+      cellCount += 1;
+    }
+    groupCount += newGroupCreated ? 1 : 0;
+  }
+}
+
+function isElemTopVisible(elem) {
+  var body = document.body,
+      html = document.documentElement,
+      // Calculate expandableDiv absolute Y coordinate from the top of body.
+      bodyRect = body.getBoundingClientRect(),
+      elemRect = elem.getBoundingClientRect(),
+      elemOffset = Math.floor(elemRect.top - bodyRect.top),
+      // Calculate the absoute Y coordinate of visible area.
+      scrollTop = html.scrollTop || body && body.scrollTop || 0;
+  scrollTop -= html.clientTop; // IE<8
+
+  
+  if (elemOffset < scrollTop)
+    return false;
+
+  return true;
+}
+
+// Invoked when an expander is pressed; expand/collapse a cell.
+function expandCollapse(id) {
+  var cellInfo = getCellInfo(id);
+  var idx = getCellIdx(id);
+
+  // New height of a row.
+  var newHeight;
+  // Smart page scrolling may be done after collapse.
+  var mayNeedScroll;
+
+  if (cellInfo.expanded) {
+    // Cell is expanded - collapse the row height to CLIP_HEIGHT.
+    newHeight = CLIP_HEIGHT;
+    mayNeedScroll = true;
+  }
+  else {
+    // Cell is collapsed - expand the row height to the cells original height.
+    newHeight = cellInfo.height;
+    mayNeedScroll = false;
+  }
+
+  // Update all cells (height and expanded/collapsed state) in a row according 
+  // to the new height of the row.
+  for (var i = 0; i < CellsInfo[idx.group].length; i++) {
+    var idxStr = "_" + idx.group + "_" + i;
+    var expandableDiv = document.getElementById("cell" + idxStr);
+    expandableDiv.style.height = newHeight + "px";
+    var data = document.getElementById("data" + idxStr);
+    var expander = document.getElementById("expander" + idxStr);
+    var state = CellsInfo[idx.group][i];
+
+    if (state.height > newHeight) {
+      // Cell height exceeds row height - collapse a cell.
+      data.style.height = (newHeight - EXPANDER_HEIGHT) + "px";
+      expander.src = imgPath + "ellipses_light.gif";
+      CellsInfo[idx.group][i].expanded = false;
+    } else {
+      // Cell height is less then or equal to row height - expand a cell.
+      data.style.height = "";
+      expander.src = imgPath + "arrows_light.gif";
+      CellsInfo[idx.group][i].expanded = true;
+    }
+  }
+
+  if (mayNeedScroll) {
+    var idxStr = "_" + idx.group + "_" + idx.cell;
+    var clickedExpandableDiv = document.getElementById("cell" + idxStr);
+    // Scroll page up if a row is collapsed and the rows top is above the 
+    // viewport. The amount of scroll is the difference between a new and old 
+    // row height.
+    if (!isElemTopVisible(clickedExpandableDiv)) {
+      window.scrollBy(0, newHeight - cellInfo.height);
+    }
+  }
+}