How to make the Clang Static Analyzer output its working from command line?

Question

I'm running Clang 3.4 on Ubuntu 12.10 (from http://llvm.org/apt/). I ran the analyzer (clang --analyze) over some code, and it found a couple of issues:

Blah.C:429:9: warning: Declared variable-length array (VLA) has zero size         unsigned char separatedData[groupDataLength];         ^~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~ 

But the specific issue isn't important. I want to know the steps of how it came to that conclusion (the code is complex enough for me not to see it within 15 mins).

I see a screenshot from the Clang site that shows steps of working viewed in a web browser:

That's probably obtained from Xcode.

The question is: how do I get Clang to output such steps of working from the command line? Or even output results to a browser if it so wishes? This would make the analyzer significantly more useful, and make fixing things much quicker.

(I have noticed that GCC's documentation is very excellent, but Clang/LLVM's documentation is very poor. I've tried "clang --analyze -Xanalyzer '-v'" as a stab in the dark to tell the analyzer to be more verbose -- the -Xanalyzer switch was from the man pages.)

Answer 1

In addition to text output on the console:

clang++ --analyze -Xanalyzer -analyzer-output=text main.cpp 

You can get the full html output:

clang++ --analyze -Xanalyzer -analyzer-output=html -o html-dir main.cpp 

Additionally, you can select specific checkers to enable. This page lists available checks. For example, you can enable all of the C++ checks in the alpha group using the flags:

-Xanalyzer -analyzer-checker=alpha.cplusplus 

http://coliru.stacked-crooked.com/a/7746c4004704d4a7

main.cpp:5:1: warning: Potential leak of memory pointed to by 'x' } ^ main.cpp:4:12: note: Memory is allocated   int *x = new int;            ^~~~~~~ main.cpp:5:1: note: Potential leak of memory pointed to by 'x' } ^ 

---

Apparently the front end exposes

-analyzer-config <Option Name>=<Value>

E.g.

-analyzer-config -analyzer-checker=alpha.cplusplus 

which might be better supported than -Xanalyzer and may be getting extended to support options to individual checkers: http://lists.cs.uiuc.edu/pipermail/cfe-dev/2014-October/039552.html