[analyzer] Add missing documentation for static analyzer checkers

[szdominik]

Summary

Some checks did not have documentation in the www/analyzer/ folder, and also some alpha checks became non-alpha.

[zaks.anna]

Great cleanup! Some comments below.

www/analyzer/alpha_checks.html

91 ↗

(On Diff #100607)

for function calls -> in function calls?
After briefly looking into this, the checker only reports the use of uninitialized arguments in calls, not the other issues (like null function pointers). Could you double check this?

152 ↗

(On Diff #100607)

sign/precision -> sign or precision

www/analyzer/available_checks.html

1423 ↗

(On Diff #100607)

I cannot find MallocWithAnnotations checker. Also if it exists, it should not be on by default, it should be alpha.

(I do not know if anyone is using Optimistic=true and think we should just remove that mode..)

1556 ↗

(On Diff #100607)

I do not think we should list "modeling" checkers here.

[szdominik]

Delete modeling checkers (unix.StdCLibraryFunctions, cplusplus.SelfAssignment).
Delete unix.MallocWithAnnotations.

[szdominik]

www/analyzer/alpha_checks.html

91 ↗

(On Diff #100607)

As I see here
https://github.com/llvm-mirror/clang/blob/master/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp#L341
there are checks for null pointers too.

[zaks.anna]

www/analyzer/alpha_checks.html

91 ↗

(On Diff #100607)

The file implements 2 checkers and only one of them is in alpha:
REGISTER_CHECKER(CallAndMessageUnInitRefArg)
REGISTER_CHECKER(CallAndMessageChecker)

You can search for "CallAndMessageUnInitRefArg" to see that it effects uninitialized parameters warnings.

[szdominik]

Fixed alpha.core.CallAndMessageUnInitRefArg.

[NoQ]

I think next time we should add examples of warning messages here - not just "//warn" but how they literally may look - so that people were able to find this page, and not doxygen/github source code, when they google up their warning messages.

[dcoughlin]

Thanks for the patch. It is really great to see these documented!

Who is the target of this documentation? Is it developers of the analyzer or is it end users of the analyzer? If it is end users, it is unfortunate that we've been just grabbing examples from the regression tests. These tests are usually not idiomatic and, since they're designed for testing, they typically won't explain the check well to an end user.

I've suggested some more idiomatic examples inline for for some of the Objective-C targeted checkers -- but it is probably worth thinking about the remaining examples from the perspective of an end user.

www/analyzer/alpha_checks.html

180 ↗

(On Diff #103378)

I'd suggest replacing all of this with the following, which is more idiomatic:

id date = [NSDate date];

// Warning: Object has a dynamic type 'NSDate *' which is incompatible with static type 'NSNumber *'"
NSNumber *number = date;
[number doubleValue];

563 ↗

(On Diff #103378)

Let's replace all of this with:

NSString *reminderText = NSLocalizedString(@"None", @"Indicates no reminders");
if (reminderCount == 1) {
  // Warning: Plural cases are not supported accross all languages. Use a .stringsdict file instead
  reminderText = NSLocalizedString(@"1 Reminder", @"Indicates single reminder");
} else if (reminderCount >= 2) {
  // Warning: Plural cases are not supported accross all languages. Use a .stringsdict file instead
  reminderText = [NSString stringWithFormat:
                      NSLocalizedString(@"%@ Reminders", @"Indicates multiple reminders"),
                       reminderCount];
}

www/analyzer/available_checks.html

475 ↗

(On Diff #103378)

How about:

if (name != nil)
  return;
// Warning: nil passed to a callee that requires a non-null 1st parameter
NSString *greeting = [@"Hello " stringByAppendingString:name];

492 ↗

(On Diff #103378)

How about:

- (nonnull id)firstChild {
  id result = nil;
  if ([_children count] > 0)
    result = _children[0];

  // Warning: nil returned from a method that is expected to return a non-null value
  return result;
}

507 ↗

(On Diff #103378)

How about:

struct LinkedList {
  int data;
  struct LinkedList *next;
};

struct LinkedList * _Nullable getNext(struct LinkedList *l);

void updateNextData(struct LinkedList *list, int newData) {
  struct LinkedList *next = getNext(list);
  // Warning: Nullable pointer is dereferenced
  next->data = 7;
}

597 ↗

(On Diff #103378)

How about:

NSString *alarmText = NSLocalizedString(@"Enabled", @"Indicates alarm is turned on");
if (!isEnabled) {
  alarmText = @"Disabled";
}
UILabel *alarmStateLabel = [[UILabel alloc] init];

// Warning: User-facing text should use localized string macro
[alarmStateLabel setText:alarmText];

639 ↗

(On Diff #103378)

Here is an idiomatic example:

NSNumber *photoCount = [albumDescriptor objectForKey:@"PhotoCount"];
// Warning: Comparing a pointer value of type 'NSNumber *' to a scalar integer value
if (photoCount > 0) {
  [self displayPhotos];
}

951 ↗

(On Diff #103378)

The example for this checker should have Objective-C generics in it.

How about:

NSMutableArray<NSString *> *names = [NSMutableArray array];
NSMutableArray *birthDates = names;

// Warning: Conversion from value of type 'NSDate *' to incompatible type 'NSString *'
[birthDates addObject: [NSDate date]];

1038 ↗

(On Diff #103378)

I don't think it is necessary to include the -initWithIvar: method in this example; just -dealloc is enough.

[szdominik]

In D33645#805920, @dcoughlin wrote:

Who is the target of this documentation? Is it developers of the analyzer or is it end users of the analyzer? If it is end users, it is unfortunate that we've been just grabbing examples from the regression tests. These tests are usually not idiomatic and, since they're designed for testing, they typically won't explain the check well to an end user.

I've suggested some more idiomatic examples inline for for some of the Objective-C targeted checkers -- but it is probably worth thinking about the remaining examples from the perspective of an end user.

Thank you for the examples, I'll update the patch.
I think the target is the end users, so you're right, probably more idiomatic examples would be better. (And @NoQ is right with warning messages too - but it should be reconsider the whole documentation, because it doesn't have really recognizable convention for that.)
However I'm not very good with Objective-C, so probably I'm not the best for this task :)

[szdominik]

Update with more idiomatic examples (from @dcoughlin).

[dcoughlin]

LGTM. Thanks!

Do you have commit access, or do you need someone to commit it for you?

[szdominik]

In D33645#806852, @dcoughlin wrote:

Do you have commit access, or do you need someone to commit it for you?

Thank you.
I don't have, I'm quite new at this project. :)

[dcoughlin]

Committed in r308242. Thanks Dominik!

cfe/trunk/www/analyzer/alpha_checks.html

 <div id="content">
 <h1>Alpha Checkers</h1>
 Experimental checkers in addition to the <a href = "available_checks.html">
 Default Checkers</a>. These are checkers with known issues or limitations that
 keep them from being on by default. They are likely to have false positives.
 Bug reports are welcome but will likely not be investigated for some time.
 Patches welcome!
 <ul>
+<li><a href="#clone_alpha_checkers">Clone Alpha Checkers</a></li>
 <li><a href="#core_alpha_checkers">Core Alpha Checkers</a></li>
 <li><a href="#cplusplus_alpha_checkers">C++ Alpha Checkers</a></li>
 <li><a href="#valist_alpha_checkers">Variable Argument Alpha Checkers</a></li>
 <li><a href="#deadcode_alpha_checkers">Dead Code Alpha Checkers</a></li>
 <li><a href="#osx_alpha_checkers">OS X Alpha Checkers</a></li>
 <li><a href="#security_alpha_checkers">Security Alpha Checkers</a></li>
 <li><a href="#unix_alpha_checkers">Unix Alpha Checkers</a></li>
 </ul>
 
+<!-- ============================= clone alpha ============================= -->
+
+<h3 id="clone_alpha_checkers">Clone Alpha Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.clone.CloneChecker</span><span class="lang">
+(C, C++, ObjC)</span><div class="descr">
+Reports similar pieces of code.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void log();
+
+int max(int a, int b) { // warn
+  log();
+  if (a > b)
+    return a;
+  return b;
+}
+
+int maxClone(int x, int y) { // similar code here
+  log();
+  if (x > y)
+    return x;
+  return y;
+}
+</pre></div></div></td></tr>
+</tbody></table>
+
 <!-- ============================= core alpha ============================= -->
 <h3 id="core_alpha_checkers">Core Alpha Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 alpha.core.BoolAssignment</span><span class="lang">
 (ObjC)</span><div class="descr">
 Warn about assigning non-{0,1} values to boolean variables.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   BOOL b = -1; // warn
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.CallAndMessageUnInitRefArg</span><span class="lang">
+(C, C++)</span><div class="descr">
+Check for uninitialized arguments in function calls and Objective-C 
+message expressions.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(void) {
+  int t;
+  int &p = t;
+  int &s = p;
+  int &q = s;
+  foo(q); // warn
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test(void) {
+  int x;
+  foo(&x); // warn
+}
+</pre></div></div></td></tr>
+
+<tr><td><div class="namedescr expandable"><span class="name">
 alpha.core.CastSize</span><span class="lang">
 (C)</span><div class="descr">
 Check when casting a malloc'ed type T, whether the size is a multiple of the 
 size of T (Works only with <span class="name">unix.Malloc</span>
 or <span class="name">alpha.unix.MallocWithAnnotations</span> 
 checks enabled).</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>

 
 void test(int *p) {
   c *pc = (c *) p; // warn
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.Conversion</span><span class="lang">
+(C, C++, ObjC)</span><div class="descr">
+Loss of sign or precision in implicit conversions</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(unsigned U, signed S) {
+  if (S > 10) {
+    if (U < S) {
+    }
+  }
+  if (S < -10) {
+    if (U < S) { // warn (loss of sign)
+    }
+  }
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  long long A = 1LL << 60;
+  short X = A; // warn (loss of precision)
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.DynamicTypeChecker</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check for cases where the dynamic and the static type of an 
+object are unrelated.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+id date = [NSDate date];
+
+// Warning: Object has a dynamic type 'NSDate *' which is 
+// incompatible with static type 'NSNumber *'"
+NSNumber *number = date;
+[number doubleValue];
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 alpha.core.FixedAddr</span><span class="lang">
 (C)</span><div class="descr">
 Check for assignment of a fixed address to a pointer.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   int *p;
   p = (int *) 0x10000; // warn

 struct s {};
 
 int test(struct s *p) {
   return sizeof(p); 
     // warn: sizeof(ptr) can produce an unexpected result
 }
 </pre></div></div></td></tr>
 
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.core.TestAfterDivZero</span><span class="lang">
+(C, C++, ObjC)</span><div class="descr">
+Check for division by variable that is later compared against 0. 
+Either the comparison is useless or there is division by zero.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test(int x) {
+  var = 77 / x;
+  if (x == 0) { } // warn 
+}
+</pre></div></div></td></tr>
+
 </tbody></table>
 
 <!-- =========================== cplusplus alpha =========================== -->
 <h3 id="cplusplus_alpha_checkers">C++ Alpha Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
-alpha.cplusplus.NewDeleteLeaks</span><span class="lang">
-(C++)</span><div class="descr">
-Check for memory leaks. Traces memory managed by <code>new</code>/<code>
-delete</code>.</div></div></td>
-<td><div class="exampleContainer expandable">
-<div class="example"><pre>
-void test() {
-  int *p = new int;
-} // warn
-</pre></div></div></td></tr>
-
-
-<tr><td><div class="namedescr expandable"><span class="name">
 alpha.cplusplus.VirtualCall</span><span class="lang">
 (C++)</span><div class="descr">
 Check virtual member function calls during construction or 
 destruction.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 class A {
 public:

 <!-- ============================== OS X alpha ============================== -->
 <h3 id="osx_alpha_checkers">OS X Alpha Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
-alpha.osx.cocoa.Dealloc</span><span class="lang">
-(ObjC)</span><div class="descr">
-Warn about Objective-C classes that lack a correct implementation 
-of <code>-dealloc</code>.
-</div></div></td>
-<td><div class="exampleContainer expandable">
-<div class="example"><pre>
-@interface MyObject : NSObject {
-  id _myproperty;  
-}
-@end
-
-@implementation MyObject // warn: lacks 'dealloc'
-@end
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-@interface MyObject : NSObject {}
-@property(assign) id myproperty;
-@end
-
-@implementation MyObject // warn: does not send 'dealloc' to super
-- (void)dealloc {
-  self.myproperty = 0;
-}
-@end
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-@interface MyObject : NSObject {
-  id _myproperty;
-}
-@property(retain) id myproperty;
-@end
-
-@implementation MyObject
-@synthesize myproperty = _myproperty;
-  // warn: var was retained but wasn't released
-- (void)dealloc {
-  [super dealloc];
-}
-@end
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-@interface MyObject : NSObject {
-  id _myproperty;
-}
-@property(assign) id myproperty;
-@end
-
-@implementation MyObject
-@synthesize myproperty = _myproperty;
-  // warn: var wasn't retained but was released
-- (void)dealloc {
-  [_myproperty release];
-  [super dealloc];
-}
-@end
-</pre></div></div></td></tr>
-
-
-<tr><td><div class="namedescr expandable"><span class="name">
 alpha.osx.cocoa.DirectIvarAssignment</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check that Objective C properties follow the following rule: the property 
 should be set with the setter, not though a direct assignment.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 @interface MyClass : NSObject {}
 @property (readonly) id A;
@interface MissingInvalidationMethodDecl : NSObject {
   NeedInvalidation *Var; // warn
 }
 @end
 
 @implementation MissingInvalidationMethodDecl
 @end
 </pre></div></div></td></tr>
 
+
+<tr><td><div class="namedescr expandable"><span class="name">
+alpha.osx.cocoa.localizability.PluralMisuseChecker</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns against using one vs. many plural pattern in code 
+when generating localized strings.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+NSString *reminderText = 
+  NSLocalizedString(@"None", @"Indicates no reminders");
+if (reminderCount == 1) {
+  // Warning: Plural cases are not supported accross all languages. 
+  // Use a .stringsdict file instead
+  reminderText = 
+    NSLocalizedString(@"1 Reminder", @"Indicates single reminder");
+} else if (reminderCount >= 2) {
+  // Warning: Plural cases are not supported accross all languages.
+  // Use a .stringsdict file instead
+  reminderText = 
+    [NSString stringWithFormat:
+      NSLocalizedString(@"%@ Reminders", @"Indicates multiple reminders"),
+        reminderCount];
+}
+</pre></div></div></td></tr>
+
 </tbody></table>
 
 <!-- =========================== security alpha =========================== -->
 <h3 id="security_alpha_checkers">Security Alpha Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 

 void f();
 
 void test() {
   chroot("/usr/local");
   f(); // warn: no call of chdir("/") immediately after chroot
 }
 </pre></div></div></td></tr>
 
-
-<tr><td><div class="namedescr expandable"><span class="name">
-alpha.unix.MallocWithAnnotations</span><span class="lang">
-(C)</span><div class="descr">
-Check for memory leaks, double free, and use-after-free problems. Assumes that
-all user-defined functions which might free a pointer are
-annotated.</div></div></td>
-<td><div class="exampleContainer expandable">
-<div class="example"><pre>
-void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
-
-void test() {
-  int *p = my_malloc(1);
-} // warn: potential leak
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
-void __attribute((ownership_takes(malloc, 1))) my_free(void *);
-
-void test() {
-  int *p = my_malloc(1);
-  my_free(p);
-  my_free(p); // warn: attempt to free released
-}
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
-void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
-
-void test() {
-  int *p = my_malloc(1);
-  my_hold(p);
-  free(p); // warn: attempt to free non-owned memory
-}
-</pre></div><div class="separator"></div>
-<div class="example"><pre>
-void __attribute((ownership_takes(malloc, 1))) my_free(void *);
-
-void test() {
-  int *p = malloc(1);
-  my_free(p);
-  *p = 1; // warn: use after free
-}
-</pre></div></div></td></tr>
-
-
 <tr><td><div class="namedescr expandable"><span class="name">
 alpha.unix.PthreadLock</span><span class="lang">
 (C)</span><div class="descr">
 Simple lock -> unlock checker; applies to:<div class=functions>
 pthread_mutex_lock<br>
 pthread_rwlock_rdlock<br>
 pthread_rwlock_wrlock<br>
 lck_mtx_lock<br>

 <div class="example"><pre>
 void test(char *y) {
   char x[4];
   if (strlen(y) == 4)
     strncpy(x, y, 5); // warn
 }
 </pre></div></div></td></tr>
 
-
-<tr><td><div class="namedescr expandable"><span class="name">
-alpha.unix.cstring.BlockInCriticalSection</span><span class="lang">
-(C)</span><div class="descr">
-Check for calls to blocking functions inside a critical section; applies
-to:<div class=functions>
-lock, unlock<br>
-sleep<br>
-getc<br>
-fgets<br>
-read<br>
-recv<br>
-pthread_mutex_lock, pthread_mutex_trylock, pthread_mutex_unlock<br>
-mtx_lock, mtx_timedlock, mtx_trylock, mtx_unlock<br>
-</div></div></div></td>
-<td><div class="exampleContainer expandable">
-<div class="example"><pre>
-void testBlockInCriticalSection() {
-  std::mutex m;
-  m.lock();
-  sleep(3); // warn
-  m.unlock();
-}
-</pre></div></div></td></tr>
 </tbody></table>
 
 </div> <!-- page -->
 </div> <!-- content -->
 </body>
 </html>

cfe/trunk/www/analyzer/available_checks.html

 <li><a href="http://www.mikeash.com/?page=pyblog/friday-qa-2009-03-06-using-the-clang-static-analyzer.html">Mike Ash - Using the Clang Static Analyzer</a></li>
 </ul>
 
 <h2 id="default_checkers">Default Checkers</h2>
 <ul>
 <li><a href="#core_checkers">Core Checkers</a> model core language features and perform general-purpose checks such as division by zero, null pointer dereference, usage of uninitialized values, etc.</li>
 <li><a href="#cplusplus_checkers">C++ Checkers</a> perform C++-specific checks</li>
 <li><a href="#deadcode_checkers">Dead Code Checkers</a> check for unused code</li>
+<li><a href="#nullability_checkers">Nullability Checkers</a> </li>
+<li><a href="#optin_checkers">Optin Checkers</a> </li>
 <li><a href="#osx_checkers">OS X Checkers</a> perform Objective-C-specific checks and check the use of Apple's SDKs (OS X and iOS)</li>
 <li><a href="#security_checkers">Security Checkers</a> check for insecure API usage and perform checks based on the CERT Secure Coding Standards</li>
 <li><a href="#unix_checkers">Unix Checkers</a> check the use of Unix and POSIX APIs</li>
 </ul>
 
-<!------------------------------------ core ----------------------------------->
+<!-- =========================== core =========================== -->
 <h3 id="core_checkers">Core Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 core.CallAndMessage</span><span class="lang">

 int test() {
   int x;
   return x; // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
-<!------------------------------------ C++ ------------------------------------>
+<!-- =========================== C++ =========================== -->
 <h3 id="cplusplus_checkers">C++ Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 cplusplus.NewDelete</span><span class="lang">

 void test() {
   int *p = new int[1];
   delete[] (++p);
     // warn: argument to 'delete[]' is offset by 4 bytes
     // from the start of memory allocated by 'new[]'
 }
 </pre></div></div></td></tr>
 
+<tr><td><div class="namedescr expandable"><span class="name">
+cplusplus.NewDeleteLeaks</span><span class="lang">
+(C++)</span><div class="descr">
+Check for memory leaks. Traces memory managed by <code>new</code>/<code>
+delete</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  int *p = new int;
+} // warn
+</pre></div></div></td></tr>
+
 </tbody></table>
 
-<!--------------------------------- dead code --------------------------------->
+<!-- =========================== dead code =========================== -->
 <h3 id="deadcode_checkers">Dead Code Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 deadcode.DeadStores</span><span class="lang">
 (C)</span><div class="descr">
 Check for values stored to variables that are never read afterwards.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   int x;
   x = 1; // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
-<!---------------------------------- OS X ------------------------------------>
+<!-- =========================== nullability =========================== -->
+<h3 id="nullability_checkers">Nullability Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+nullability.NullPassedToNonnull</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns when a null pointer is passed to a pointer which has a 
+_Nonnull type.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+if (name != nil)
+  return;
+// Warning: nil passed to a callee that requires a non-null 1st parameter
+NSString *greeting = [@"Hello " stringByAppendingString:name];
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+nullability.NullReturnedFromNonnull</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns when a null pointer is returned from a function that has 
+_Nonnull return type.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+- (nonnull id)firstChild {
+  id result = nil;
+  if ([_children count] > 0)
+    result = _children[0];
+
+  // Warning: nil returned from a method that is expected 
+  // to return a non-null value
+  return result;
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+nullability.NullableDereferenced</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns when a nullable pointer is dereferenced.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+struct LinkedList {
+  int data;
+  struct LinkedList *next;
+};
+
+struct LinkedList * _Nullable getNext(struct LinkedList *l);
+
+void updateNextData(struct LinkedList *list, int newData) {
+  struct LinkedList *next = getNext(list);
+  // Warning: Nullable pointer is dereferenced
+  next->data = 7;
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+nullability.NullablePassedToNonnull</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns when a nullable pointer is passed to a pointer which has a _Nonnull type.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+typedef struct Dummy { int val; } Dummy;
+Dummy *_Nullable returnsNullable();
+void takesNonnull(Dummy *_Nonnull);
+
+void test() {
+  Dummy *p = returnsNullable();
+  takesNonnull(p); // warn
+}
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!-- =========================== optin =========================== -->
+<h3 id="optin_checkers">Optin Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.mpi.MPI-Checker</span><span class="lang">
+(C)</span><div class="descr">
+Checks MPI code</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void test() {
+  double buf = 0;
+  MPI_Request sendReq1;
+  MPI_Ireduce(MPI_IN_PLACE, &buf, 1, MPI_DOUBLE, MPI_SUM, 
+      0, MPI_COMM_WORLD, &sendReq1);
+} // warn: request 'sendReq1' has no matching wait.
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void test() {
+  double buf = 0;
+  MPI_Request sendReq;
+  MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq);
+  MPI_Irecv(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
+  MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
+  MPI_Wait(&sendReq, MPI_STATUS_IGNORE);
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+void missingNonBlocking() {
+  int rank = 0;
+  MPI_Comm_rank(MPI_COMM_WORLD, &rank);
+  MPI_Request sendReq1[10][10][10];
+  MPI_Wait(&sendReq1[1][7][9], MPI_STATUS_IGNORE); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.osx.cocoa.localizability.EmptyLocalizationContextChecker</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check that NSLocalizedString macros include a comment for context.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+- (void)test {
+  NSString *string = NSLocalizedString(@"LocalizedString", nil); // warn
+  NSString *string2 = NSLocalizedString(@"LocalizedString", @" "); // warn
+  NSString *string3 = NSLocalizedStringWithDefaultValue(
+    @"LocalizedString", nil, [[NSBundle alloc] init], nil,@""); // warn
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.osx.cocoa.localizability.NonLocalizedStringChecker</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns about uses of non-localized NSStrings passed to UI methods 
+expecting localized NSStrings</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+NSString *alarmText = 
+  NSLocalizedString(@"Enabled", @"Indicates alarm is turned on");
+if (!isEnabled) {
+  alarmText = @"Disabled";
+}
+UILabel *alarmStateLabel = [[UILabel alloc] init];
+
+// Warning: User-facing text should use localized string macro
+[alarmStateLabel setText:alarmText];
+</pre></div></div></td></tr>
+
+</tbody></table>
+
+<!-- =========================== OS X =========================== -->
 <h3 id="osx_checkers">OS X Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.API</span><span class="lang">
 (C)</span><div class="descr">
 Check for proper uses of various Apple APIs:<div class=functions>
 dispatch_once</div></div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   dispatch_once_t pred = 0;
   dispatch_once(&amp;pred, ^(){}); // warn: dispatch_once uses local
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.NumberObjectConversion</span><span class="lang">
+(C, C++, ObjC)</span><div class="descr">
+Check for erroneous conversions of objects representing numbers 
+into numbers</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+NSNumber *photoCount = [albumDescriptor objectForKey:@"PhotoCount"];
+// Warning: Comparing a pointer value of type 'NSNumber *' 
+// to a scalar integer value
+if (photoCount > 0) {
+  [self displayPhotos];
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.SecKeychainAPI</span><span class="lang">
 (C)</span><div class="descr">
 Check for improper uses of the Security framework's Keychain APIs:<div class=functions>
 SecKeychainItemCopyContent<br>
 SecKeychainFindGenericPassword<br>
 SecKeychainFindInternetPassword<br>
 SecKeychainItemFreeContent<br>
 SecKeychainItemCopyAttributesAndData<br>

 
 void test(void) {
   [MyClass release]; // warn
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.Dealloc</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warn about Objective-C classes that lack a correct implementation 
+of <code>-dealloc</code>.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;  
+}
+@end
+
+@implementation MyObject // warn: lacks 'dealloc'
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {}
+@property(assign) id myproperty;
+@end
+
+@implementation MyObject // warn: does not send 'dealloc' to super
+- (void)dealloc {
+  self.myproperty = 0;
+}
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;
+}
+@property(retain) id myproperty;
+@end
+
+@implementation MyObject
+@synthesize myproperty = _myproperty;
+  // warn: var was retained but wasn't released
+- (void)dealloc {
+  [super dealloc];
+}
+@end
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+@interface MyObject : NSObject {
+  id _myproperty;
+}
+@property(assign) id myproperty;
+@end
+
+@implementation MyObject
+@synthesize myproperty = _myproperty;
+  // warn: var wasn't retained but was released
+- (void)dealloc {
+  [_myproperty release];
+  [super dealloc];
+}
+@end
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.IncompatibleMethodTypes</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check for an incompatible type signature when overriding an Objective-C method.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 @interface MyClass1 : NSObject
 - (int)foo;
 @end
NSComparisonResult test(NSString *s) {
   return [s caseInsensitiveCompare:aString];
     // warn: argument to 'NSString' method
     // 'caseInsensitiveCompare:' cannot be nil
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.ObjCGenerics</span><span class="lang">
+(ObjC)</span><div class="descr">
+Check for type errors when using Objective-C generics</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+NSMutableArray<NSString *> *names = [NSMutableArray array];
+NSMutableArray *birthDates = names;
+
+// Warning: Conversion from value of type 'NSDate *' 
+// to incompatible type 'NSString *'
+[birthDates addObject: [NSDate date]];
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.RetainCount</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check for leaks and violations of the Cocoa Memory Management rules.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   NSString *s = [[NSString alloc] init]; // warn
 }
- (id)init {
   [super init];
   return self; // warn: returning uninitialized 'self'
 }
 @end
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.SuperDealloc</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warn about improper use of '[super dealloc]' in Objective-C</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+@interface SuperDeallocThenReleaseIvarClass : NSObject {
+  NSObject *_ivar;
+}
+@end
+
+@implementation SuperDeallocThenReleaseIvarClass
+- (void)dealloc {
+  [super dealloc];
+  [_ivar release]; // warn
+}
+@end
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.UnusedIvars</span><span class="lang">
 (ObjC)</span><div class="descr">
 Warn about private ivars that are never used.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 @interface MyObj : NSObject {
 @private
   id x; // warn
void test() {
   int x[] = { 1 };
   CFArrayRef A = CFArrayCreate(0, (const void **)x, 1,
                                &amp;kCFTypeArrayCallBacks); // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
-<!------------------------------- security ------------------------------------>
+<!-- =========================== security =========================== -->
 <h3 id="security_checkers">Security Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 security.FloatLoopCounter</span><span class="lang">

 <div class="example"><pre>
 void test() {
   vfork(); // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
-<!--------------------------------- unix -------------------------------------->
+<!-- =========================== unix =========================== -->
 <h3 id="unix_checkers">Unix Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 unix.API</span><span class="lang">
NSData *d = [NSData dataWithBytesNoCopy:p
                length:sizeof(int) freeWhenDone:1];
     // warn +dataWithBytesNoCopy:length:freeWhenDone: cannot take
     // ownership of memory allocated by 'new'
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+unix.Vfork</span><span class="lang">
+(C)</span><div class="descr">
+Check for proper usage of vfork</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+int test(int x) {
+  pid_t pid = vfork(); // warn
+  if (pid != 0)
+    return 0;
+
+  switch (x) {
+  case 0:
+    pid = 1;
+    execl("", "", 0);
+    _exit(1);
+    break;
+  case 1:
+    x = 0; // warn: this assignment is prohibited
+    break;
+  case 2:
+    foo(); // warn: this function call is prohibited
+    break;
+  default:
+    return 0; // warn: return is prohibited
+  }
+
+  while(1);
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 unix.cstring.BadSizeArg</span><span class="lang">
 (C)</span><div class="descr">
 Check the size argument passed to <code>strncat</code> for common erroneous
 patterns. Use <code>-Wno-strncat-size</code> compiler option to mute other
 <code>strncat</code>-related compiler warnings.
 </div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>

cfe/trunk/www/analyzer/implicit_checks.html

 support the analyzer core and model known APIs. See also 
 <a href = "available_checks.html">Default Checkers</a>
 and <a href = "alpha_checks.html">Experimental (Alpha) Checkers</a>.
 <ul>
 <li><a href="#core_implicit_checkers">Core Implicit Checkers</a></li>
 <li><a href="#osx_implicit_checkers">OS X Implicit Checkers</a></li>
 </ul>
 
-<!------------------------------- core implicit ------------------------------->
+<!-- =========================== core implicit =========================== -->
 <h3 id="core_implicit_checkers">Core Implicit Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 core.DynamicTypePropagation</span><span class="lang">
[[NSAssertionHandler currentHandler] handleFailureInMethod:_cmd
                                        description:(@"some text")];
     // generate sink
 }
 @end
 </pre></div></div></td></tr>
 
 </tbody></table>
 
-<!---------------------------- OS X implicit ---------------------------------->
+<!-- =========================== OS X implicit =========================== -->
 <h3 id="osx_implicit_checkers">OS X Implicit Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.Loops</span><span class="lang">