[analyzer][www] Update avaible_checks.html

[Szelethus]

Summary

Title says it all. I never ever used ObjC, so I couldn't really add examples on many occasions.

These checkers are still in existence that aren't on the website just yet:

• apiModeling.StdCLibraryFunctions
• apiModeling.TrustNonnull
• apiModeling.google.GTest
• cplusplus.SelfAssignment
• core.DynamicTypePropagation
• core.NonnilStringConstants
• osx.cocoa.NonNilReturnValue

These checkers we don't have a good description for:

• osx.ObjCProperty

I suspect these are implicit checks, and should be placed in implicit_checks.html, but I'll make sure that that page isn't as well hidden as it is now.

[Szelethus]

www/analyzer/available_checks.html

375–392

@rnkovacs Is this a good description of your checker?

[xazax.hun]

I am not sure what to do about implcit checks. Those are probably should never be turned on or off by the user, but they should be on or off by default based on the set of checks the user enabled and the platform she is using. Thus, I am perfectly ok with the implicit_checks.html only being accessible from the checker development manual. Maybe we should extend the checker list with a notice that the user should never disable the core checks.

[Szelethus]

Thats a great idea.

About implicit checks, they are so well hidden, I didn't even find them until I wanted to update the website (although, this is at least in part my fault, but why would anyone carefully read through a website that hasn't been touched for years?). I think with a big enough warning that it shouldn't be touched by normal users, it should be on this page.

[rnkovacs]

www/analyzer/available_checks.html

375–392

Hmm, how about:

void log(const char *str);

void test(int value) {
  const char *msg = std::to_string(value).c_str();
  // msg points to the buffer of a temporary that is now destroyed
  log(msg);  // warn: inner pointer of container used after re/deallocation
}

Most of the issues it found in real code looked like this.
Thanks a lot!

[george.karpenkov]

Great idea, thanks!

Should be good to go once examples are added, and implicit checks are removed.

www/analyzer/available_checks.html

781

proper uses is not particularly descriptive?

888

Yep, not very useful without an example. I'm pretty sure the code and tests have one.

1013

Yeah, doesn't seem useful to the user.

[Szelethus]

Well, the reason why I didn't add tests for these, is that I know so little of ObjC, I am not even sure when a test case begins and ends. I could go ahead and google something about the language, but for a site that advertises to find bugs, maybe someone with more expertise should do the explanation.

Can someone fill those couple bits in? I tried, but fell flat on my face.

www/analyzer/available_checks.html

781

Well, I copied it from the actual checker description :/ I genuinely have no idea how properties work in ObjC, so I can't really update it on my own.

[Szelethus]

• Removed osx.cocoa.Loops

I still didn't add more description to objc checkers for the reasons stated above.

[george.karpenkov]

@Szelethus Also you have without a doubt noticed that a "Download" section on the index page could be improved :P

[NoQ]

I guess maybe let's skip stuff without examples and leave Objective-C descriptions waiting on us?

www/analyzer/available_checks.html

482

Wow, i never noticed this one. It seems to contain a syntactic (local) check for the StringRef problem.

[george.karpenkov]

www/analyzer/available_checks.html

458

Spurious newline

495

If we don't have a description, let's just drop it.

658

I have a longer description:

This checker finds a common performance anti-pattern in a code that uses Grand Central dispatch.
The anti-pattern involves emulating a synchronous call from an asynchronous API using semaphores,
as in the snippet below, where the requestCurrentTaskName function makes an XPC call and then uses the semaphore to
block until the XPC call returns:

+ (NSString *)requestCurrentTaskName {
    __block NSString *taskName = nil;
    dispatch_semaphore_t sema = dispatch_semaphore_create(0);
    NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:@"MyConnection"];
    id remoteObjectProxy = connection.remoteObjectProxy;
    [remoteObjectProxy requestCurrentTaskName:^(NSString *task) {
        taskName = task;
        dispatch_semaphore_signal(sema);
    }];
    dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
    return taskName;
}

Usage of such a pattern in production code running on the main thread is discouraged, as the main queue gets blocked waiting for the background queue,
which could be running at a lower priority, and unnecessary threads are spawned in the process.

In order to avoid the anti-pattern, the available alternatives are:

• Use the synchronous version of the API, if available.

In the example above, the synchronous XPC proxy object can be used:

+ (NSString *)requestCurrentTaskName {
    __block NSString *taskName = nil;
    NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:@"MyConnection"];
    id remoteObjectProxy = [connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
      NSLog(@"Error = %@", error);

    }];
    [remoteObjectProxy requestCurrentTaskName:^(NSString *task) {
        taskName = task;
    }];
    return taskName;
}

• Alternatively, the API can be used in the asynchronous way.

782

If we don't have proper description, let's drop.

884

I have a longer description:

Under ARC, function parameters which are pointers to pointers (e.g. NSError**) are __autoreleasing.
Writing to such parameters inside autoreleasing pools might crash whenever the parameter outlives the pool. Detecting such crashes may be difficult, as usage of autorelease pool is usually hidden inside the called functions implementation. Examples include:

BOOL writeToErrorWithIterator(NSError *__autoreleasing* error, NSArray *a) { [a enumerateObjectsUsingBlock:^{
    *error = [NSError errorWithDomain:1];
    }];
}

and

BOOL writeToErrorInBlockFromCFunc(NSError *__autoreleasing* error) {
    dispatch_semaphore_t sem = dispatch_semaphore_create(0l);
    dispatch_async(queue, ^{
        if (error) {
            *error = [NSError errorWithDomain:1];
        }
        dispatch_semaphore_signal(sem);
    });
 
    dispatch_semaphore_wait(sem, 100);
  return 0;
}

1099

Probably should be dropped.

1136

Top of the checker file has a somewhat reasonable description:

A checker for detecting leaks resulting from allocating temporary
autoreleased objects before starting the main run loop.

Checks for two antipatterns:
1. ObjCMessageExpr followed by [[NSRunLoop mainRunLoop] run] in the same
autorelease pool.
2. ObjCMessageExpr followed by [[NSRunLoop mainRunLoop] run] in no
autorelease pool.

Any temporary objects autoreleased in code called in those expressions
// will not be deallocated until the program exits, and are effectively leaks.

[Szelethus]

www/analyzer/available_checks.html

458

Actually, in this section of the code, entries are separated with 2 newlines. But it's not super consistent.

495

I added a description, I'd strongly prefer keeping this in.

[george.karpenkov]

Good to go provided you will add an example.
If we want to be serious about this page, it really has to be auto-generated (like clang-tidy one), but I understand that this is a larger undertaking.

www/analyzer/available_checks.html

495

Also would need a short example. Usually one can be found in tests.

[Szelethus]

www/analyzer/available_checks.html

1136

Should be come up with an example for this one too then?

[Szelethus]

Excuse my informality, but llvm.Conventions fell flat on its face in my eyes (details: D53856), so I'm no longer insisting on including it on this page.

[Szelethus]

In D53069#1274554, @george.karpenkov wrote:

If we want to be serious about this page, it really has to be auto-generated (like clang-tidy one), but I understand that this is a larger undertaking.

Since sphinx is on the way, hopefully, let's just look for a long term solution.

[whisperity]

Let's register the ID...

Superseded by D54429.

www/analyzer/available_checks.html

 <li><a href="#core_checkers">Core Checkers</a> model core language features and perform general-purpose checks such as division by zero, null pointer dereference, usage of uninitialized values, etc.</li>
 <li><a href="#cplusplus_checkers">C++ Checkers</a> perform C++-specific checks</li>
 <li><a href="#deadcode_checkers">Dead Code Checkers</a> check for unused code</li>
 <li><a href="#nullability_checkers">Nullability Checkers</a> </li>
 <li><a href="#optin_checkers">Optin Checkers</a> </li>
 <li><a href="#osx_checkers">OS X Checkers</a> perform Objective-C-specific checks and check the use of Apple's SDKs (OS X and iOS)</li>
 <li><a href="#security_checkers">Security Checkers</a> check for insecure API usage and perform checks based on the CERT Secure Coding Standards</li>
 <li><a href="#unix_checkers">Unix Checkers</a> check the use of Unix and POSIX APIs</li>
+<li><a href="#valist_checkers">Variable Argument Checkers</a></li>
 </ul>
 
 <!-- =========================== core =========================== -->
 <h3 id="core_checkers">Core Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 

 
 <!-- =========================== C++ =========================== -->
 <h3 id="cplusplus_checkers">C++ Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+cplusplus.InnerPointer</span><span class="lang">
+(C++)</span><div class="descr">
+Check for inner pointers of C++ containers used after re/deallocation.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void log(const char *str);
+
+void test(int value) {
+  const char *msg = std::to_string(value).c_str();
+  // msg points to the buffer of a temporary that is now destroyed
+  log(msg);  // warn: inner pointer of container used after re/deallocation
+}
+</pre></div></div></td></tr>
+
+
 <tr><td><div class="namedescr expandable"><span class="name">
 cplusplus.NewDelete</span><span class="lang">
 (C++)</span><div class="descr">
 Check for double-free, use-after-free and offset problems involving C++ <code>
 delete</code>.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void f(int *p);
 

 delete</code>.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   int *p = new int;
 } // warn
 </pre></div></div></td></tr>
 
+
 </tbody></table>
 
 <!-- =========================== dead code =========================== -->
 <h3 id="deadcode_checkers">Dead Code Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 deadcode.DeadStores</span><span class="lang">
 (C)</span><div class="descr">
 Check for values stored to variables that are never read afterwards.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test() {
   int x;
   x = 1; // warn
 }
 </pre></div></div></td></tr>
 
 </tbody></table>
 
+
 <!-- =========================== nullability =========================== -->
 <h3 id="nullability_checkers">Nullability Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
 <tbody>
 <tr><td><div class="namedescr expandable"><span class="name">
 nullability.NullPassedToNonnull</span><span class="lang">
 (ObjC)</span><div class="descr">
 Warns when a null pointer is passed to a pointer which has a 
 _Nonnull type.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 if (name != nil)
   return;
 // Warning: nil passed to a callee that requires a non-null 1st parameter
 NSString *greeting = [@"Hello " stringByAppendingString:name];
 </pre></div></div></td></tr>
 
 

 void takesNonnull(Dummy *_Nonnull);
 
 void test() {
   Dummy *p = returnsNullable();
   takesNonnull(p); // warn
 }
 </pre></div></div></td></tr>
 
+
+<tr><td><div class="namedescr expandable"><span class="name">
+nullability.NullableReturnedFromNonnull</span><span class="lang">
+(ObjC)</span><div class="descr">
+Warns when a nullable pointer is returned from a function that has _Nonnull return type.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+typedef struct Dummy { int val; } Dummy;
+
+Dummy *_Nonnull test(Dummy *_Nullable a) {
+  Dummy *p = a;
+  return p; // warn
+}
+</pre></div></div></td></tr>
+
 </tbody></table>
 
 <!-- =========================== optin =========================== -->
 <h3 id="optin_checkers">Optin Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 
if (!isEnabled) {
   alarmText = @"Disabled";
 }
 UILabel *alarmStateLabel = [[UILabel alloc] init];
 
 // Warning: User-facing text should use localized string macro
 [alarmStateLabel setText:alarmText];
 </pre></div></div></td></tr>
 
+
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.performance.GCDAntipattern</span><span class="lang">
+(ObjC)</span><div class="descr">
+This checker finds a common performance anti-pattern in a code that uses Grand
+Central dispatch. The anti-pattern involves emulating a synchronous call from an
+asynchronous API using semaphores, as in the snippet below, where the
+<code>requestCurrentTaskName</code> function makes an XPC call and then uses the
+semaphore to block until the XPC call returns (example 1.).<br>
+Usage of such a pattern in production code running on the main thread is
+discouraged, as the main queue gets blocked waiting for the background queue,
+which could be running at a lower priority, and unnecessary threads are spawned
+in the process.<br>
+In order to avoid the anti-pattern, the available alternatives are:
+<ul>
+  <li>Use the synchronous version of the API, if available (as seen on example
+  2.)</li>
+  <li>Alternatively, the API can be used in the asynchronous way.</li>
+</ul>
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+// Example 1.
++ (NSString *)requestCurrentTaskName {
+    __block NSString *taskName = nil;
+    dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+    NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:@"MyConnection"];
+    id remoteObjectProxy = connection.remoteObjectProxy;
+    [remoteObjectProxy requestCurrentTaskName:^(NSString *task) {
+        taskName = task;
+        dispatch_semaphore_signal(sema);
+    }];
+    dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
+    return taskName;
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+// Example 2.
++ (NSString *)requestCurrentTaskName {
+    __block NSString *taskName = nil;
+    NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:@"MyConnection"];
+    id remoteObjectProxy = [connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
+      NSLog(@"Error = %@", error);
+
+    }];
+    [remoteObjectProxy requestCurrentTaskName:^(NSString *task) {
+        taskName = task;
+    }];
+    return taskName;
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.performance.Padding</span><span class="lang">
+(C)</span><div class="descr">
+Check for excessively padded structs.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+class PaddedA { // warn: excessive padding
+  char c1;
+  int i;
+  char c2;
+};
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
+optin.portability.UnixAPI</span><span class="lang">
+(C)</span><div class="descr">
+Finds implementation-defined behavior in UNIX/Posix functions.
+<div class=functions>
+calloc<br>
+malloc<br>
+realloc<br>
+reallocf<br>
+alloca, __builtin_alloca<br>
+__builtin_alloca_with_align<br>
+valloc</div>
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+void *f(int n) {
+  return malloc(n * 0 * sizeof(int)); // warn: Call to 'malloc' has an
+                                      //       allocation size of 0 bytes
+}
+</pre></div></div></td></tr>
+
 </tbody></table>
 
 <!-- =========================== OS X =========================== -->
 <h3 id="osx_checkers">OS X Checkers</h3>
 <table class="checkers">
 <colgroup><col class="namedescr"><col class="example"></colgroup>
 <thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
 

 // Warning: Comparing a pointer value of type 'NSNumber *' 
 // to a scalar integer value
 if (photoCount > 0) {
   [self displayPhotos];
 }
 </pre></div></div></td></tr>
 
 
+<!-- Describe osx.ObjCProperty. -->
+
+
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.SecKeychainAPI</span><span class="lang">
 (C)</span><div class="descr">
 Check for improper uses of the Security framework's Keychain APIs:<div class=functions>
 SecKeychainItemCopyContent<br>
 SecKeychainFindGenericPassword<br>
 SecKeychainFindInternetPassword<br>
 SecKeychainItemFreeContent<br>
 SecKeychainItemCopyAttributesAndData<br>
 SecKeychainItemFreeAttributesAndData</div></div></div></td>
SecKeychainItemFreeContent(attrList, outData);
     // warn: deallocator doesn't match the allocator
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.AtSync</span><span class="lang">
 (ObjC)</span><div class="descr">
-Check for nil pointers used as mutexes for <code>@synchronized</code>.</div></div></td>
+Check for nil pointers used as mutexes for <code>@synchronized</code>.
+</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test(id x) {
   if (!x)
     @synchronized(x) {} // warn: nil value used as mutex
 }
 </pre></div>
 <div class="example"><pre>
 void test() {
   id y;
   @synchronized(y) {} // warn: uninitialized value used as mutex
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.AutoreleaseWrite</span><span class="lang">
+(ObjC)</span><div class="descr">
+Under ARC, function parameters which are pointers to pointers (e.g.
+<code>NSError **</code>) are <code>__autoreleasing</code>. Writing to such
+parameters inside autoreleasing pools might crash whenever the parameter
+outlives the pool. Detecting such crashes may be difficult, as usage of
+autorelease pool is usually hidden inside the called functions implementation.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+BOOL writeToErrorWithIterator(NSError *__autoreleasing* error, NSArray *a) { [a enumerateObjectsUsingBlock:^{
+    *error = [NSError errorWithDomain:1];
+    }];
+}
+</pre></div><div class="separator"></div>
+<div class="example"><pre>
+BOOL writeToErrorInBlockFromCFunc(NSError *__autoreleasing* error) {
+    dispatch_semaphore_t sem = dispatch_semaphore_create(0l);
+    dispatch_async(queue, ^{
+        if (error) {
+            *error = [NSError errorWithDomain:1];
+        }
+        dispatch_semaphore_signal(sem);
+    });
+
+    dispatch_semaphore_wait(sem, 100);
+  return 0;
+}
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.ClassRelease</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check for sending <code>retain</code>, <code>release</code>, or <code>
 autorelease</code> directly to a class.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 @interface MyClass : NSObject
 @end

 @end
 
 @implementation MyClass2
 - (float)foo { return 1.0; } // warn
 @end
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
 alpha.osx.cocoa.MissingSuperCall</span><span class="lang">
 (ObjC)</span><div class="descr">
 Warn about Objective-C methods that lack a necessary call to super. (Note: The
 compiler now has a warning for methods annotated with <code>objc_requires_super</code>
 attribute. The checker exists to check methods in the Cocoa frameworks
 that haven't yet adopted this attribute.)</div></div></td>
 <td><div class="example"><pre>
 @interface Test : UIViewController
return [s caseInsensitiveCompare:aString];
     // 'caseInsensitiveCompare:' cannot be nil
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.ObjCGenerics</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check for type errors when using Objective-C generics</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 NSMutableArray<NSString *> *names = [NSMutableArray array];
 NSMutableArray *birthDates = names;
 
 // Warning: Conversion from value of type 'NSDate *' 
 // to incompatible type 'NSString *'
 [birthDates addObject: [NSDate date]];

 CFStringRef test(char *bytes) {
   return CFStringCreateWithCStringNoCopy(
            0, bytes, NSNEXTSTEPStringEncoding, 0); // warn
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
+osx.cocoa.RunLoopAutoreleaseLeak</span><span class="lang">
+(ObjC)</span><div class="descr">
+Detects leaks resulting from allocating temporary autoreleased objects before
+starting the main run loop.
+
+Checks for two antipatterns:
+<ul>
+  <li>ObjCMessageExpr followed by <code>[[NSRunLoop mainRunLoop] run]</code> in
+  the same autorelease pool.</li>
+  <li>ObjCMessageExpr followed by <code>[[NSRunLoop mainRunLoop] run]</code> in
+  no autorelease pool.</li>
+</ul>
+
+Any temporary objects autoreleased in code called in those expressions will not
+be deallocated until the program exits, and are effectively leaks.
+</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+<!-- TODO: Add examples. -->
+</pre></div></div></td></tr>
+
+
+<tr><td><div class="namedescr expandable"><span class="name">
 osx.cocoa.SelfInit</span><span class="lang">
 (ObjC)</span><div class="descr">
 Check that <code>self</code> is properly initialized inside an initializer
 method.</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 @interface MyObj : NSObject {
   id x;

 <td><div class="example"><pre>
 int test() {
   return strlen(0); // warn
 }
 </pre></div></td></tr>
 
 </tbody></table>
 
+
+<!-- =============================== va_list =============================== -->
+<h3 id="valist_checkers">Variable Argument Checkers</h3>
+<table class="checkers">
+<colgroup><col class="namedescr"><col class="example"></colgroup>
+<thead><tr><td>Name, Description</td><td>Example</td></tr></thead>
+
+<tbody>
+<tr><td><div class="namedescr expandable"><span class="name">
+valist.CopyToSelf</span><span class="lang">
+(C)</span><div class="descr">
+Calls to the <code>va_copy</code> macro should not copy onto itself.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+#include &lt;stdarg.h&gt;
+
+void test(int x, ...) {
+  va_list args;
+  va_start(args, x);
+  va_copy(args, args); // warn
+  va_end(args);
+}
+</pre></div></div></td></tr>
+
+<tr><td><div class="namedescr expandable"><span class="name">
+valist.Uninitialized</span><span class="lang">
+(C)</span><div class="descr">
+Calls to the <code>va_arg</code>, <code>va_copy</code>, or
+<code>va_end</code> macro must happen after calling <code>va_start</code> and
+before calling <code>va_end</code>.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+#include &lt;stdarg.h&gt;
+
+void test(int x, ...) {
+  va_list args;
+  int y = va_arg(args, int); // warn
+}
+</pre></div>
+<div class="example"><pre>
+#include &lt;stdarg.h&gt;
+
+void test(int x, ...) {
+  va_list args;
+  va_start(args, x);
+  va_end(args);
+  int z = va_arg(args, int); // warn
+}
+</pre></div></div></td></tr>
+
+<tr><td><div class="namedescr expandable"><span class="name">
+valist.Unterminated</span><span class="lang">
+(C)</span><div class="descr">
+Every <code>va_start</code> must be matched by a <code>va_end</code>. A va_list
+can only be ended once.</div></div></td>
+<td><div class="exampleContainer expandable">
+<div class="example"><pre>
+#include &lt;stdarg.h&gt;
+
+void test(int x, ...) {
+  va_list args;
+  va_start(args, x);
+  int y = x + va_arg(args, int);
+} // warn: missing va_end
+</pre></div></div></td></tr>
+
+</tbody></table>
+
 </div> <!-- page -->
 </div> <!-- content -->
 </body>
 </html>