[clang-tidy][analyzer][WIP] Clang-tidy reverse integration into Static Analyzer.

[NoQ]

Summary

This patch allows building a clang binary that has clang-tidy checks embedded into the static analyzer. I discussed these plans briefly in https://lists.llvm.org/pipermail/cfe-dev/2020-October/067002.html.

WIP because i haven't handled any build-time settings yet. This new facility will be under a CMake flag and most likely off by default (unless everybody suddenly loves this option, but even then, I still have to turn it into an option). I'll make sure to implement (and hopefully test) a reasonable behavior for all various combinations of CMake flags (eg., clang-tidy enabled/disabled, static analyzer enabled/disabled, static-analyzer-into-clang-tidy integration enabled/disabled, etc.).

This patch introduces a frontend flag -analyzer-tidy-checker=... that accepts clang-tidy checker strings (eg., -analyzer-tidy-checker=bugprone-*,-cert-*,cert-env33-c). As long as at least one such flag is supplied, ClangTidyContext is instantiated with the given checker list and a clang-tidy AST consumer gets multiplexed with AnalysisConsumer so that to run clang-tidy checkers. Diagnostics from these checks are pumped into a PathDiagnosticConverterDiagnosticConsumer (D94476) and displayed similarly to static analyzer diagnostics, eg. as HTML or Plist reports:

This patch suggests enabling a few clang-tidy checks by default in Clang Driver (under the --analyze flag, obviously, and the new reverse integration should be enabled first). Requirements for enabling a clang-tidy check by default would be similar to requirements of enabling a static analyzer check by default (finds real bugs by design, understandable diagnostics, etc.). Additionally, on-by-default clang-tidy checks should have static analyzer bug categories assigned to them (eg., "Logic error", "Memory error", etc.) in the diagnostic converter (a relatively convenient way to do so is provided).

If bug categories aren't assigned, the default bug category for clang-tidy check x-y-z is Clang-Tidy [x] and the default bug type is Clang-Tidy [x-y-z]. This looks pretty ok in scan-build's index.html:

That said, we should probably provide an option to disable bug category conversion and use it whenever an arbitrary clang-tidy config is expected. As usual, we're optimizing for a reasonable default rather than for configurability.

I've considered a different approach to enabling/disabling clang-tidy checks (but didn't implement it in this patch) that's more static analyzer-like: -analyzer-checker tidy.bugprone.assert-side-effect etc. Here we treat x in x-y-z as a static analyzer package, hence the dot. This approach is less flexible because it doesn't allow arbitrary wildcards, so we still have to have the current approach but we should probably implement both. One thing to think about here would be to figure out whether each individual off-by-default clang-tidy check is treated as "alpha" ("we're not supporting it, don't use it") or opt-in ("we're supporting it but it's still of by default"). Probably we could additionally separate them into alpha.tidy.* and optin.tidy.*.

Clang-tidy check-specific options are not implemented yet. Again, we could provide a separate frontend flag, or we could interface them through AnalyzerOptions like this: -analyzer-config tidy.bugprone.assert-side-effect:AssertMacros=assert,Assert,ASSERT. And, again, we should probably do both.

[NoQ]

Unforget to git add tests.

[alexfh]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

54–60

Isn't this a layering violation, since clang-tidy depends on clangStaticAnalyzerCore and clangStaticAnalyzerFrontend?

[NoQ]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

54–60

Yes, absolutely.

That said, the only purpose of clang-tidy's dependency on libStaticAnalyzer* is integration of static analyzer into clang tidy which is definitely not something we want to enable when we're baking clang-tidy back into clang. It never makes sense to run static analyzer through clang-tidy integration into static analyzer.

So ideally these two dependencies are temporally separated. I could make these dependencies mutually exclusive by making the upcoming option of baking clang-tidy into clang explicitly incompatible with CLANG_TIDY_ENABLE_STATIC_ANALYZER.

But if we want to support building both clang-tidy with static analyzer and static analyzer with clang-tidy from the same sources into the same build directory, that'll probably involve either building two variants of clang-tidy (one with static analyzer for standalone clang-tidy binary and one without to use inside clang binary only) or two variants of static analyzer (one with clang-tidy for the clang binary and one without to use inside clang-tidy binary only).

Do you have any preference on how should i untangle this?

[aaron.ballman]

Thank you for working on this, I think it's fantastic effort!

I'll make sure to implement (and hopefully test) a reasonable behavior for all various combinations of CMake flags (eg., clang-tidy enabled/disabled, static analyzer enabled/disabled, static-analyzer-into-clang-tidy integration enabled/disabled, etc.).

Will we be able to stand up a buildbot to explicitly test this configuration?

This patch introduces a frontend flag -analyzer-tidy-checker=...

FWIW, the usual clang-tidy nomenclature is to call these "checks" rather than "checkers", so it might make sense to expose -analyzer-tidy-checks=... to be analogous to clang-tidy -checks=...

As long as at least one such flag is supplied, ClangTidyContext is instantiated with the given checker list and a clang-tidy AST consumer gets multiplexed with AnalysisConsumer so that to run clang-tidy checkers.

clang-tidy currently runs the clang static analyzer, so I worry a little bit about duplicated diagnostics. I assume that we'll disable running the static analyzer checks a second time through clang-tidy?

[alexfh]

Artem, could you set the repository to rG LLVM Github Monorepo when uploading patches as mentioned in https://llvm.org/docs/Phabricator.html#requesting-a-review-via-the-web-interface ? This way you'll allow pre-merge checks to run.

In D95403#2534714, @aaron.ballman wrote:

This patch introduces a frontend flag -analyzer-tidy-checker=...

FWIW, the usual clang-tidy nomenclature is to call these "checks" rather than "checkers", so it might make sense to expose -analyzer-tidy-checks=... to be analogous to clang-tidy -checks=...

I vaguely remember discussing (most probably, with @gribozavr2) this difference and coming to a conclusion that there's no strong reason to keep the nomenclature difference between the static analyzer and clang-tidy. This didn't go much farther beyond creating the clang-tools-extra/test/clang-tidy/checkers/ directory, but we could revisit this, since we're looking into more interaction between the tools.

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

54–60

I hope we could break the dependency cycle without "flipping" the direction of dependencies based on a CMake switch. This way it would be easier to replicate the dependency structure in other BUILD systems.

Now the dependencies look very roughly like this:

clangStaticAnalyzerCore:
clangStaticAnalyzerCheckers: clangStaticAnalyzerCore
clangStaticAnalyzerFrontend: clangStaticAnalyzerCheckers clangStaticAnalyzerCore
clangFrontendTool: clangStaticAnalyzerFrontend

clangTidy: clangStaticAnalyzerCore clangStaticAnalyzerFrontend
clang-tidy check libraries gathered under $ALL_CLANG_TIDY_CHECKS
clangTidyMain: clangTidy
clang-tidy: clangTidyMain clangTidy $ALL_CLANG_TIDY_CHECKS

Untangled version could look like this:

clangStaticAnalyzerCore:
clangStaticAnalyzerCheckers: clangStaticAnalyzerCore
clangStaticAnalyzerFrontend: clangStaticAnalyzerCheckers clangStaticAnalyzerCore clangTidyInterface
clangStaticAnalyzerFrontendWithClangTidy: clangTidyImpl $ALL_CLANG_TIDY_CHECKS
clangFrontendTool: clangStaticAnalyzerFrontendWithClangTidy

clangTidyInterface: (with ClangTidy.h, ClangTidyOptions.h, ClangTidyDiagnosticConsumer.h and ClangTidyProfiling.h, for example)
clangTidyImpl: clangTidyInterface clangStaticAnalyzerCore clangStaticAnalyzerFrontend
clang-tidy check libraries gathered under $ALL_CLANG_TIDY_CHECKS
clangTidyMain: clangTidyImpl
clang-tidy: clangTidyMain clangTidyImpl $ALL_CLANG_TIDY_CHECKS

What do you think?

[jansvoboda11]

clang/lib/Frontend/CompilerInvocation.cpp

640

Can you please use the option marshalling infrastructure instead? https://clang.llvm.org/docs/InternalsManual.html#adding-new-command-line-option

clang/include/clang/Driver/Options.td

def analyzer_disable_checker : Separate<["-"], "analyzer-disable-checker">,
   HelpText<"Choose analyzer checkers to disable">;
 def analyzer_disable_checker_EQ : Joined<["-"], "analyzer-disable-checker=">,
   Alias<analyzer_disable_checker>;
 
 def analyzer_disable_all_checks : Flag<["-"], "analyzer-disable-all-checks">,
   HelpText<"Disable all static analyzer checks">,
   MarshallingInfoFlag<"AnalyzerOpts->DisableAllCheckers">;
 
+def analyzer_tidy_checker : Separate<["-"], "analyzer-tidy-checker">,
+  HelpText<"Add clang-tidy check string (enable, -disable, comma-separated)">;
+def analyzer_tidy_checker_EQ : Joined<["-"], "analyzer-tidy-checker=">,
+  Alias<analyzer_tidy_checker>;
+
 def analyzer_checker_help : Flag<["-"], "analyzer-checker-help">,
   HelpText<"Display the list of analyzer checkers that are available">,
   MarshallingInfoFlag<"AnalyzerOpts->ShowCheckerHelp">;
 
 def analyzer_checker_help_alpha : Flag<["-"], "analyzer-checker-help-alpha">,
   HelpText<"Display the list of in development analyzer checkers. These "
            "are NOT considered safe, they are unstable and will emit incorrect "
            "reports. Enable ONLY FOR DEVELOPMENT purposes">,

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

static void printFormattedEntry(llvm::raw_ostream &Out,
                                   size_t MinLineWidth = 0);
 
   /// Pairs of checker/package name and enable/disable.
   std::vector<std::pair<std::string, bool>> CheckersAndPackages;
 
   /// Vector of checker/package names which will not emit warnings.
   std::vector<std::string> SilencedCheckersAndPackages;
 
+  /// Vector of clang-tidy check flags.
+  std::vector<std::string> TidyChecks;
+
   /// A key-value table of use-specified configuration values.
   // TODO: This shouldn't be public.
   ConfigTable Config;
   AnalysisStores AnalysisStoreOpt = RegionStoreModel;
   AnalysisConstraints AnalysisConstraintsOpt = RangeConstraintsModel;
   AnalysisDiagClients AnalysisDiagOpt = PD_HTML;
   AnalysisPurgeMode AnalysisPurgeOpt = PurgeStmt;
 

clang/include/clang/StaticAnalyzer/Frontend/AnalysisConsumer.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_STATICANALYZER_FRONTEND_ANALYSISCONSUMER_H
 #define LLVM_CLANG_STATICANALYZER_FRONTEND_ANALYSISCONSUMER_H
 
 #include "clang/AST/ASTConsumer.h"
 #include "clang/Basic/LLVM.h"
+#include "clang/Frontend/MultiplexConsumer.h"
 #include <functional>
 #include <memory>
 
 namespace clang {
 
 class Preprocessor;
 class DiagnosticsEngine;
 class CodeInjector;
 class CompilerInstance;
 
 namespace ento {
 class PathDiagnosticConsumer;
 class CheckerManager;
 class CheckerRegistry;
 
-class AnalysisASTConsumer : public ASTConsumer {
+class AnalysisASTConsumer : public MultiplexConsumer {
 public:
+  AnalysisASTConsumer(std::vector<std::unique_ptr<ASTConsumer>> V)
+      : MultiplexConsumer(std::move(V)) {}
+
   virtual void AddDiagnosticConsumer(PathDiagnosticConsumer *Consumer) = 0;
 
   /// This method allows registering statically linked custom checkers that are
   /// not a part of the Clang tree. It employs the same mechanism that is used
   /// by plugins.
   ///
   /// Example:
   ///

clang/lib/Driver/ToolChains/Clang.cpp

if (!Triple.isPS4CPU()) {
       CmdArgs.push_back("-analyzer-checker=security.insecureAPI.mktemp");
       CmdArgs.push_back("-analyzer-checker=security.insecureAPI.mkstemp");
       CmdArgs.push_back("-analyzer-checker=security.insecureAPI.vfork");
     }
 
     // Default nullability checks.
     CmdArgs.push_back("-analyzer-checker=nullability.NullPassedToNonnull");
     CmdArgs.push_back("-analyzer-checker=nullability.NullReturnedFromNonnull");
+
+    // Default clang-tidy checks.
+    CmdArgs.push_back("-analyzer-tidy-checker=bugprone-assert-side-effect");
+    CmdArgs.push_back("-analyzer-tidy-checker=bugprone-infinite-loop");
+    CmdArgs.push_back(
+        "-analyzer-tidy-checker=bugprone-move-forwarding-reference");
   }
 
   // Set the output format. The default is plist, for (lame) historical reasons.
   CmdArgs.push_back("-analyzer-output");
   if (Arg *A = Args.getLastArg(options::OPT__analyzer_output))
     CmdArgs.push_back(A->getValue());
   else
     CmdArgs.push_back("plist");

clang/lib/Frontend/CompilerInvocation.cpp

for (const Arg *A :
     StringRef CheckerAndPackageList = A->getValue();
     SmallVector<StringRef, 16> CheckersAndPackages;
     CheckerAndPackageList.split(CheckersAndPackages, ",");
     for (const StringRef &CheckerOrPackage : CheckersAndPackages)
       Opts.CheckersAndPackages.emplace_back(std::string(CheckerOrPackage),
                                             IsEnabled);
   }
 
+  Opts.TidyChecks.clear();
+  for (const Arg *A : Args.filtered(OPT_analyzer_tidy_checker)) {
+    StringRef CheckList = A->getValue();
+    Opts.TidyChecks.emplace_back(CheckList);
+  }
+
   // Go through the analyzer configuration options.
   for (const auto *A : Args.filtered(OPT_analyzer_config)) {
 
     // We can have a list of comma separated config names, e.g:
     // '-analyzer-config key1=val1,key2=val2'
     StringRef configList = A->getValue();
     SmallVector<StringRef, 4> configVals;
     configList.split(configVals, ",");

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
 #include "ModelInjector.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/RecursiveASTVisitor.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/CallGraph.h"
 #include "clang/Analysis/CodeInjector.h"
 #include "clang/Analysis/PathDiagnostic.h"
 #include "clang/Analysis/PathDiagnosticConsumers.h"
+#include "clang/Analysis/PathDiagnosticConverterDiagnosticConsumer.h"
+#include "clang/Basic/FileManager.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/CrossTU/CrossTranslationUnit.h"
 #include "clang/Frontend/CompilerInstance.h"
+#include "clang/Frontend/MultiplexConsumer.h"
+#include "clang/Frontend/TextDiagnosticPrinter.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Rewrite/Core/Rewriter.h"
 #include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/PostOrderIterator.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Program.h"
+#include "llvm/Support/Registry.h"
+#include "llvm/Support/SmallVectorMemoryBuffer.h"
 #include "llvm/Support/Timer.h"
 #include "llvm/Support/raw_ostream.h"
 #include <memory>
 #include <queue>
 #include <utility>
 
+#include "../../clang-tools-extra/clang-tidy/ClangTidyCheck.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyDiagnosticConsumer.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyForceLinker.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyModule.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyModuleRegistry.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyOptions.h"
+#include "../../clang-tools-extra/clang-tidy/ClangTidyProfiling.h"
+
+LLVM_INSTANTIATE_REGISTRY(clang::tidy::ClangTidyModuleRegistry)
+
 using namespace clang;
 using namespace ento;
+using namespace tidy;
+using namespace llvm;
 
 #define DEBUG_TYPE "AnalysisConsumer"
 
 STATISTIC(NumFunctionTopLevel, "The # of functions at top level.");
 STATISTIC(NumFunctionsAnalyzed,
-                      "The # of functions and blocks analyzed (as top level "
-                      "with inlining turned on).");
 STATISTIC(NumBlocksInAnalyzedFunctions,
                       "The # of basic blocks in the analyzed functions.");
 STATISTIC(NumVisitedBlocksInAnalyzedFunctions,
           "The # of visited basic blocks in the analyzed functions.");
 STATISTIC(PercentReachableBlocks, "The % of reachable basic blocks.");
 STATISTIC(MaxCFGSize, "The maximum number of basic blocks in a function.");
 
 //===----------------------------------------------------------------------===//
 // AnalysisConsumer declaration.
 //===----------------------------------------------------------------------===//
 
 namespace {
 
-class AnalysisConsumer : public AnalysisASTConsumer,
+class AnalysisConsumer : public ASTConsumer,
                          public RecursiveASTVisitor<AnalysisConsumer> {
   enum {
     AM_None = 0,
     AM_Syntax = 0x1,
     AM_Path = 0x2
   };
   typedef unsigned AnalysisMode;
 
   /// Mode of the analyzes while recursively visiting Decls.
   AnalysisMode RecVisitorMode;
   /// Bug Reporter to use while recursively visiting Decls.
   BugReporter *RecVisitorBR;
 
   std::vector<std::function<void(CheckerRegistry &)>> CheckerRegistrationFns;
 
 public:
-  ASTContext *Ctx;
+  ASTContext &Ctx;
   Preprocessor &PP;
   const std::string OutDir;
   AnalyzerOptionsRef Opts;
   ArrayRef<std::string> Plugins;
   CodeInjector *Injector;
   cross_tu::CrossTranslationUnitContext CTU;
 
   /// Stores the declarations from the local translation unit.
public:
   std::unique_ptr<llvm::Timer> SyntaxCheckTimer;
   std::unique_ptr<llvm::Timer> ExprEngineTimer;
   std::unique_ptr<llvm::Timer> BugReporterTimer;
 
   /// The information about analyzed functions shared throughout the
   /// translation unit.
   FunctionSummariesTy FunctionSummaries;
 
+private: // Clang-tidy integration.
+  ClangTidyGlobalOptions ClangTidyGlobalOpts{};
+  std::unique_ptr<ClangTidyContext> ClangTidyCtx;
+  std::unique_ptr<ClangTidyProfiling> ClangTidyProfile;
+
+  // Provide bug types and categories for clang-tidy, also convert
+  // check names to checker names.
+  struct OwningBugTypeInfo {
+    const std::string CheckName;
+    const std::string BugType;
+    const std::string BugCategory;
+
+    PathDiagnosticConverterDiagnosticConsumer::BugTypeInfo toBugTypeInfo() {
+      // Take a non-owning reference to the same data. Very fast.
+      return PathDiagnosticConverterDiagnosticConsumer::BugTypeInfo{
+          CheckName, BugType, BugCategory};
+    }
+
+    OwningBugTypeInfo(std::string &&CheckName, std::string &&BugType,
+                      std::string &&BugCategory)
+        : CheckName(std::move(CheckName)), BugType(std::move(BugType)),
+          BugCategory(std::move(BugCategory)) {}
+
+    // Move-only. We don't want the cache to copy strings and then delete
+    // original strings that we have references to.
+    OwningBugTypeInfo(const OwningBugTypeInfo &) = delete;
+    OwningBugTypeInfo(OwningBugTypeInfo &&) = default;
+    OwningBugTypeInfo &operator=(const OwningBugTypeInfo &) = delete;
+  };
+
+  std::map<unsigned, OwningBugTypeInfo> BugTypeCache;
+
+  // Fold clang-tidy check categories into common static analyzer categories.
+  std::map<std::string, std::string> OverriddenCategories{
+      {"bugprone-assert-side-effect", categories::LogicError},
+      {"bugprone-infinite-loop", categories::LogicError},
+      {"bugprone-move-forwarding-reference", categories::CXXMoveSemantics},
+  };
+
+  PathDiagnosticConverterDiagnosticConsumer::BugTypeInfo
+  defaultBugTypeInfoProvider(const Diagnostic &Info) {
+    unsigned ID = Info.getID();
+    auto I = BugTypeCache.find(ID);
+    if (I != BugTypeCache.end())
+      return I->second.toBugTypeInfo();
+
+    std::string CheckName = ClangTidyCtx->getCheckName(Info.getID());
+    assert(!CheckName.empty() &&
+           "No check name available for clang-tidy diagnostic");
+    // Eg., Clang-Tidy [bugprone-assert-side-effect].
+    std::string Bugtype = "Clang-Tidy [" + CheckName + "]";
+
+    std::string Category;
+    auto J = OverriddenCategories.find(CheckName);
+    if (J != OverriddenCategories.end()) {
+      Category = J->second;
+    } else {
+      auto I = CheckName.find('-');
+      assert(I != std::string::npos && "Clang-tidy check name isn't dashed");
+      std::string CheckCategory =
+          (I != std::string::npos) ? CheckName.substr(0, I) : CheckName;
+      // Eg., Clang-Tidy [bugprone]
+      Category = "Clang-Tidy [" + CheckCategory + "]";
+    }
+
+    auto IF = BugTypeCache.insert(std::make_pair(
+        ID, OwningBugTypeInfo(std::move(CheckName), std::move(Bugtype),
+                              std::move(Category))));
+    return IF.first->second.toBugTypeInfo();
+  }
+
+  PathDiagnosticConverterDiagnosticConsumer ClangTidyDiagConsumer{
+      PathConsumers,
+      [this](const Diagnostic &Info) {
+        return defaultBugTypeInfoProvider(Info);
+      },
+      /*ShouldDisplayNotesAsEvents=*/true,
+      /*ShouldTrimCheckerName=*/true};
+  DiagnosticsEngine ClangTidyDiagEngine{
+      new DiagnosticIDs, new DiagnosticOptions, &ClangTidyDiagConsumer,
+      /*ShouldOwnClient=*/false};
+  ClangTidyCheckFactories ClangTidyChkFactories{};
+  std::unique_ptr<ast_matchers::MatchFinder> ClangTidyMatchFinder;
+  std::vector<std::unique_ptr<ClangTidyCheck>> ClangTidyChecks{};
+
+public:
   AnalysisConsumer(CompilerInstance &CI, const std::string &outdir,
                    AnalyzerOptionsRef opts, ArrayRef<std::string> plugins,
                    CodeInjector *injector)
-      : RecVisitorMode(0), RecVisitorBR(nullptr), Ctx(nullptr),
+      : RecVisitorMode(0), RecVisitorBR(nullptr), Ctx(CI.getASTContext()),
         PP(CI.getPreprocessor()), OutDir(outdir), Opts(std::move(opts)),
         Plugins(plugins), Injector(injector), CTU(CI) {
     DigestAnalyzerOptions();
     if (Opts->PrintStats || Opts->ShouldSerializeStats) {
       AnalyzerTimers = std::make_unique<llvm::TimerGroup>(
           "analyzer", "Analyzer timers");
       SyntaxCheckTimer = std::make_unique<llvm::Timer>(
           "syntaxchecks", "Syntax-based analysis time", *AnalyzerTimers);
if (Loc.isValid()) {
         assert(Mode == (AM_Syntax | AM_Path) && "Unexpected mode!");
 
       llvm::errs() << ": " << Loc.getFilename() << ' ' << getFunctionName(D)
                    << '\n';
     }
   }
 
   void Initialize(ASTContext &Context) override {
-    Ctx = &Context;
-    checkerMgr = std::make_unique<CheckerManager>(*Ctx, *Opts, PP, Plugins,
+    checkerMgr = std::make_unique<CheckerManager>(Ctx, *Opts, PP, Plugins,
                                                   CheckerRegistrationFns);
 
-    Mgr = std::make_unique<AnalysisManager>(*Ctx, PP, PathConsumers,
+    Mgr = std::make_unique<AnalysisManager>(Ctx, PP, PathConsumers,
                                             CreateStoreMgr, CreateConstraintMgr,
                                             checkerMgr.get(), *Opts, Injector);
   }
 
   /// Store the top level decls in the set to be processed later on.
   /// (Doing this pre-processing avoids deserialization of data from PCH.)
   bool HandleTopLevelDecl(DeclGroupRef D) override;
   void HandleTopLevelDeclInObjCContainer(DeclGroupRef D) override;
bool VisitDecl(Decl *D) {
     return true;
   }
 
   bool VisitVarDecl(VarDecl *VD) {
     if (!Opts->IsNaiveCTUEnabled)
       return true;
 
     if (VD->hasExternalStorage() || VD->isStaticDataMember()) {
-      if (!cross_tu::containsConst(VD, *Ctx))
+      if (!cross_tu::containsConst(VD, Ctx))
         return true;
     } else {
       // Cannot be initialized in another TU.
       return true;
     }
 
     if (VD->getAnyInitializer())
       return true;
if (BD->hasBody()) {
       // declared in those functions as well.
       if (!BD->isDependentContext()) {
         HandleCode(BD, RecVisitorMode);
       }
     }
     return true;
   }
 
-  void AddDiagnosticConsumer(PathDiagnosticConsumer *Consumer) override {
-    PathConsumers.push_back(Consumer);
+  friend class AnalysisMultiplexConsumer;
+
+  std::unique_ptr<ASTConsumer> createClangTidyConsumer() {
+    SmallString<128> Buf;
+    raw_svector_ostream ClangTidyConfig(Buf);
+    ClangTidyConfig << "Checks: '-*";
+    if (Opts->TidyChecks.size() == 0) {
+      // TODO: Detect if no checks are enabled even when some flags are present.
+      return nullptr;
+    }
+    for (const std::string &TidyCheck: Opts->TidyChecks) {
+      // Should we try to prevent config injections?
+      ClangTidyConfig << "," << TidyCheck;
+    }
+    ClangTidyConfig << "'\n";
+    // raw_svector_ostream doesn't need flush.
+    SmallVectorMemoryBuffer ClangTidyConfigBuffer{std::move(Buf)};
+    ClangTidyCtx = std::make_unique<ClangTidyContext>(
+        std::make_unique<DefaultOptionsProvider>(
+            ClangTidyGlobalOpts, *parseConfiguration(ClangTidyConfigBuffer)));
+
+    ClangTidyCtx->setDiagnosticsEngine(&ClangTidyDiagEngine);
+
+    SourceManager &SM = Ctx.getSourceManager();
+    ClangTidyCtx->setSourceManager(&SM);
+    ClangTidyCtx->setCurrentFile(
+        SM.getFileEntryForID(SM.getMainFileID())->getName());
+    ClangTidyCtx->setASTContext(&Ctx);
+
+    for (ClangTidyModuleRegistry::entry E :
+         ClangTidyModuleRegistry::entries()) {
+      std::unique_ptr<ClangTidyModule> Module = E.instantiate();
+      Module->addCheckFactories(ClangTidyChkFactories);
     }
+    ClangTidyChecks = ClangTidyChkFactories.createChecks(&*ClangTidyCtx);
 
-  void AddCheckerRegistrationFn(std::function<void(CheckerRegistry&)> Fn) override {
-    CheckerRegistrationFns.push_back(std::move(Fn));
+    ast_matchers::MatchFinder::MatchFinderOptions MatchFinderOpts{};
+    if (Opts->PrintStats) {
+      ClangTidyCtx->setEnableProfiling(true);
+      ClangTidyCtx->setProfileStoragePrefix("");
+      ClangTidyProfile = std::make_unique<ClangTidyProfiling>(
+          ClangTidyCtx->getProfileStorageParams());
+      MatchFinderOpts.CheckProfiling.emplace(ClangTidyProfile->Records);
+    }
+
+    ClangTidyMatchFinder = std::make_unique<ast_matchers::MatchFinder>(
+        MatchFinderOpts);
+
+    for (auto &Check : ClangTidyChecks) {
+      if (!Check->isLanguageVersionSupported(Ctx.getLangOpts()))
+        continue;
+      Check->registerMatchers(&*ClangTidyMatchFinder);
+      Check->registerPPCallbacks(SM, &PP, &PP);
+    }
+
+    return ClangTidyMatchFinder->newASTConsumer();
   }
 
 private:
   void storeTopLevelDecls(DeclGroupRef DG);
   std::string getFunctionName(const Decl *D);
 
   /// Check if we should skip (not analyze) the given function.
   AnalysisMode getModeForDecl(Decl *D, AnalysisMode Mode);
   void runAnalysisOnTranslationUnit(ASTContext &C);
 
   /// Print \p S to stderr if \c Opts->AnalyzerDisplayProgress is set.
   void reportAnalyzerProgress(StringRef S);
 }; // namespace
-} // end anonymous namespace
 
+class AnalysisMultiplexConsumer : public AnalysisASTConsumer {
+  AnalysisConsumer *Impl;
+
+  std::vector<std::unique_ptr<ASTConsumer>>
+  hijackImplAndMultiplex(std::unique_ptr<AnalysisConsumer> Consumer1,
+                         std::unique_ptr<ASTConsumer> Consumer2) {
+    Impl = Consumer1.get();
+    std::vector<std::unique_ptr<ASTConsumer>> Consumers;
+    if (Consumer2)
+      Consumers.push_back(std::move(Consumer2));
+    Consumers.push_back(std::move(Consumer1));
+    return Consumers;
+  }
+
+public:
+  AnalysisMultiplexConsumer(std::unique_ptr<AnalysisConsumer> Consumer1,
+                            std::unique_ptr<ASTConsumer> Consumer2)
+      : AnalysisASTConsumer(hijackImplAndMultiplex(std::move(Consumer1),
+                                                   std::move(Consumer2))) {
+    assert(Impl);
+  }
+
+  void AddDiagnosticConsumer(PathDiagnosticConsumer *Consumer) override {
+    Impl->PathConsumers.push_back(Consumer);
+  }
+
+  void
+  AddCheckerRegistrationFn(std::function<void(CheckerRegistry &)> Fn) override {
+    Impl->CheckerRegistrationFns.push_back(std::move(Fn));
+  }
+};
+} // end anonymous namespace
 
 //===----------------------------------------------------------------------===//
 // AnalysisConsumer implementation.
 //===----------------------------------------------------------------------===//
 bool AnalysisConsumer::HandleTopLevelDecl(DeclGroupRef DG) {
   storeTopLevelDecls(DG);
   return true;
 }
void AnalysisConsumer::HandleTranslationUnit(ASTContext &C) {
   NumBlocksInAnalyzedFunctions = FunctionSummaries.getTotalNumBasicBlocks();
   NumVisitedBlocksInAnalyzedFunctions =
       FunctionSummaries.getTotalNumVisitedBasicBlocks();
   if (NumBlocksInAnalyzedFunctions > 0)
     PercentReachableBlocks =
       (FunctionSummaries.getTotalNumVisitedBasicBlocks() * 100) /
         NumBlocksInAnalyzedFunctions;
 
+  // No more notes are coming in for the last warning.
+  ClangTidyDiagConsumer.finish();
+
   // Explicitly destroy the PathDiagnosticConsumer.  This will flush its output.
   // FIXME: This should be replaced with something that doesn't rely on
   // side-effects in PathDiagnosticConsumer's destructor. This is required when
   // used with option -disable-free.
   Mgr.reset();
 }
 
 std::string AnalysisConsumer::getFunctionName(const Decl *D) {
   std::string Str;
   llvm::raw_string_ostream OS(Str);
 
   if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
     OS << FD->getQualifiedNameAsString();
 
     // In C++, there are overloads.
-    if (Ctx->getLangOpts().CPlusPlus) {
+    if (Ctx.getLangOpts().CPlusPlus) {
       OS << '(';
       for (const auto &P : FD->parameters()) {
         if (P != *FD->param_begin())
           OS << ", ";
         OS << P->getType().getAsString();
       }
       OS << ')';
     }
 
   } else if (isa<BlockDecl>(D)) {
-    PresumedLoc Loc = Ctx->getSourceManager().getPresumedLoc(D->getLocation());
+    PresumedLoc Loc = Ctx.getSourceManager().getPresumedLoc(D->getLocation());
 
     if (Loc.isValid()) {
       OS << "block (line: " << Loc.getLine() << ", col: " << Loc.getColumn()
          << ')';
     }
 
   } else if (const ObjCMethodDecl *OMD = dyn_cast<ObjCMethodDecl>(D)) {
 
if (!Opts->AnalyzeSpecificFunction.empty() &&
       getFunctionName(D) != Opts->AnalyzeSpecificFunction)
     return AM_None;
 
   // Unless -analyze-all is specified, treat decls differently depending on
   // where they came from:
   // - Main source file: run both path-sensitive and non-path-sensitive checks.
   // - Header files: run non-path-sensitive checks only.
   // - System headers: don't run any checks.
-  SourceManager &SM = Ctx->getSourceManager();
+  SourceManager &SM = Ctx.getSourceManager();
   const Stmt *Body = D->getBody();
   SourceLocation SL = Body ? Body->getBeginLoc() : D->getLocation();
   SL = SM.getExpansionLoc(SL);
 
   if (!Opts->AnalyzeAll && !Mgr->isInCodeFile(SL)) {
     if (SL.isInvalid() || SM.isInSystemHeader(SL))
       return AM_None;
     return Mode & ~AM_Path;

 std::unique_ptr<AnalysisASTConsumer>
 ento::CreateAnalysisConsumer(CompilerInstance &CI) {
   // Disable the effects of '-Werror' when using the AnalysisConsumer.
   CI.getPreprocessor().getDiagnostics().setWarningsAsErrors(false);
 
   AnalyzerOptionsRef analyzerOpts = CI.getAnalyzerOpts();
   bool hasModelPath = analyzerOpts->Config.count("model-path") > 0;
 
-  return std::make_unique<AnalysisConsumer>(
+  auto StaticAnalyzerConsumer = std::make_unique<AnalysisConsumer>(
       CI, CI.getFrontendOpts().OutputFile, analyzerOpts,
       CI.getFrontendOpts().Plugins,
       hasModelPath ? new ModelInjector(CI) : nullptr);
+
+  std::unique_ptr<ASTConsumer> ClangTidyConsumer =
+      StaticAnalyzerConsumer->createClangTidyConsumer();
+
+  return std::make_unique<AnalysisMultiplexConsumer>(
+      std::move(StaticAnalyzerConsumer), std::move(ClangTidyConsumer));
 }

clang/lib/StaticAnalyzer/Frontend/CMakeLists.txt

+configure_file(
+  ${CMAKE_SOURCE_DIR}/../clang-tools-extra/clang-tidy/clang-tidy-config.h.cmake
+  ${CMAKE_CURRENT_BINARY_DIR}/clang-tidy-config.h)
+
 include_directories( ${CMAKE_CURRENT_BINARY_DIR}/../Checkers )
 
 set(LLVM_LINK_COMPONENTS
   Support
   )
 
 add_clang_library(clangStaticAnalyzerFrontend
   AnalysisConsumer.cpp
add_clang_library(clangStaticAnalyzerFrontend
   clangASTMatchers
   clangAnalysis
   clangBasic
   clangCrossTU
   clangFrontend
   clangLex
   clangStaticAnalyzerCheckers
   clangStaticAnalyzerCore
+  clangTidy
+  clangTidyAbseilModule
+  clangTidyAndroidModule
+  clangTidyAlteraModule
+  clangTidyBoostModule
+  clangTidyBugproneModule
+  clangTidyCERTModule
+  clangTidyConcurrencyModule
+  clangTidyCppCoreGuidelinesModule
+  clangTidyDarwinModule
+  clangTidyFuchsiaModule
+  clangTidyGoogleModule
+  clangTidyHICPPModule
+  clangTidyLinuxKernelModule
+  clangTidyLLVMModule
+  clangTidyLLVMLibcModule
+  clangTidyMiscModule
+  clangTidyModernizeModule
+  clangTidyMPIModule
+  clangTidyObjCModule
+  clangTidyOpenMPModule
+  clangTidyPerformanceModule
+  clangTidyPortabilityModule
+  clangTidyReadabilityModule
+  clangTidyZirconModule
 
   DEPENDS
   omp_gen
   )

clang/test/Analysis/tidy-integration.c

+// RUN: %clang_analyze_cc1 %s \
+// RUN:     -analyzer-tidy-checker=bugprone-assert-side-effect \
+// RUN:     -verify=bugprone-assert-side-effect
+
+// RUN: %clang_analyze_cc1 %s \
+// RUN:     -analyzer-tidy-checker=bugprone-infinite-loop \
+// RUN:     -verify=bugprone-infinite-loop
+
+// RUN: %clang_analyze_cc1 %s \
+// RUN:     -analyzer-tidy-checker=cppcoreguidelines-init-variables \
+// RUN:     -verify=cppcoreguidelines-init-variables
+
+// Test multiple conflicting -analyzer-tidy-checker flags.
+// RUN: %clang_analyze_cc1 %s \
+// RUN:     -analyzer-tidy-checker=bugprone-infinite-loop \
+// RUN:     -analyzer-tidy-checker=-bugprone-* \
+// RUN:     -analyzer-tidy-checker=cppcoreguidelines-init-variables \
+// RUN:     -verify=cppcoreguidelines-init-variables
+
+// Test enabling checkers by default.
+// RUN: %clang --analyze %s \
+// RUN:     -Xclang -verify=bugprone-assert-side-effect,bugprone-infinite-loop
+
+void test_bugprone_assert_side_effect() {
+  void exit(int);
+  #define assert(x) if (!(x)) exit(1);
+  int x = 0;
+  assert((++x) == 1); // bugprone-assert-side-effect-warning-re{{{{^}}Found assert() with side effect [bugprone-assert-side-effect]{{$}}}}
+}
+
+void test_bugprone_infinite_loop(int y) {
+  for (int x = 0; x < 10; ++y) { // bugprone-infinite-loop-warning-re{{{{^}}This loop is infinite; none of its condition variables (x) are updated in the loop body [bugprone-infinite-loop]{{$}}}}
+  }
+}
+
+void test_cppcoreguidelines_init_variables() {
+  int x; // cppcoreguidelines-init-variables-warning-re{{{{^}}Variable 'x' is not initialized [cppcoreguidelines-init-variables]{{$}}}}
+}