https://github.com/steakhal created https://github.com/llvm/llvm-project/pull/207433
The commits were gathered using: ```sh git log --reverse --oneline llvmorg-23-init..llvm/main \ clang/lib/StaticAnalyzer clang/include/clang/StaticAnalyzer | \ grep -v NFC | grep -v OpenACC | grep -v -i revert | grep -v -i "webkit" ``` I used the `LLVM_ENABLE_SPHINX=ON` and `LLVM_ENABLE_DOXYGEN=ON` cmake options to enable the `docs-clang-html` build target, which generates the html into `build/tools/clang/docs/html/ReleaseNotes.html` of which I attach the screenshots to let you judge if it looks all good or not. I've swapped the PR links to the issue links when a PR was fixing an open GitHub issue. Those issues anyway have a link to the PR inside. Assisted-by: Claude Opus 4.8 From 3c53a0d99b4980e29a4cac8f7491a3088580f212 Mon Sep 17 00:00:00 2001 From: Balazs Benics <[email protected]> Date: Thu, 2 Jul 2026 15:17:09 +0100 Subject: [PATCH] [analyzer][docs] CSA release notes for clang-23 The commits were gathered using: ```sh git log --reverse --oneline llvmorg-23-init..llvm/main \ clang/lib/StaticAnalyzer clang/include/clang/StaticAnalyzer | \ grep -v NFC | grep -v OpenACC | grep -v -i revert | grep -v -i "webkit" ``` I used the `LLVM_ENABLE_SPHINX=ON` and `LLVM_ENABLE_DOXYGEN=ON` cmake options to enable the `docs-clang-html` build target, which generates the html into `build/tools/clang/docs/html/ReleaseNotes.html` of which I attach the screenshots to let you judge if it looks all good or not. I've swapped the PR links to the issue links when a PR was fixing an open GitHub issue. Those issues anyway have a link to the PR inside. Assisted-by: Claude Opus 4.8 --- clang/docs/ReleaseNotes.md | 78 +++++++++++++++++++++++++++++--------- 1 file changed, 60 insertions(+), 18 deletions(-) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 3e6c10666ca16..e9df88cac3306 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -1074,33 +1074,75 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the ### Static Analyzer -- The `-analyzer-constraints` option `z3` was renamed to `unsupported-z3` - because the Z3-based (constraint) solver was known for crashing for years now. - Didn't receive support, so it was marked unsupported. +% comment: +% This is for the Static Analyzer. +% Subsections (using `####`), in this order, only when they have content: +% - New checkers and features +% - Crash and bug fixes +% - Improvements +% - Moved checkers +% - Removed checkers +% - Diagnostic changes + +#### New checkers and features + +- Introduced the experimental `alpha.cplusplus.UseAfterLifetimeEnd` checker to detect dangling pointers and references bound to local variables that go out of scope, using the `[[clang::lifetimebound]]` annotation. (#GH205521) +- Introduced the `optin.core.UnconditionalVAArg` checker to report variadic functions that unconditionally use `va_arg()`, which is undefined behavior when the function is called without any variadic arguments (SEI-CERT EXP47-C). (#GH175602) +- The `unix.DynamicMemoryModeling` modeling gained a new option to create branches where a memory allocation fails and returns a null pointer. It is disabled by default. (#GH205371) +- The `security.insecureAPI.DeprecatedOrUnsafeBufferHandling` checker gained a new `ReportInC99AndEarlier` option. When enabled, deprecated buffer-handling functions (`memcpy`, `memset`, `memmove`, etc.) are also reported when not compiling for C11 or later. It is disabled by default. (#GH168704, #GH177379) +- The `optin.taint.TaintPropagation` checker gained a new `EnableDefaultConfig` option, which makes it possible to disable the built-in taint configuration and use a fully custom configuration instead. (#GH176185) #### Crash and bug fixes -- Fixed `security.VAList` checker producing false positives when analyzing - C23 code where `va_start` expands to `__builtin_c23_va_start`. -- Fixed a compiler crash when combining `_Atomic` and `__auto_type` - in C, for example `_Atomic __auto_type x = expr`. (#GH118058) +- Fixed the `security.VAList` checker producing false positives when analyzing C23 code where `va_start` expands to `__builtin_c23_va_start`. (#GH192024) +- Fixed a crash when copying uninitialized data in a function named `swap`. (#GH178797) +- Fixed a compiler crash when combining `_Atomic` and `__auto_type` in C, for example `_Atomic __auto_type x = expr`. (#GH118058) +- Fixed a crash in the `unix.Malloc` checker when a function is annotated with both `ownership_returns` and `ownership_takes` (or `ownership_holds`). (#GH183344) +- Fixed a crash in the `alpha.unix.cstring` checkers on zero-size element types (for example an empty struct in C). (#GH190457) +- Fixed a use-after-free in `CheckerContext::getMacroNameOrSpelling`. (#GH194174) +- Fixed a false positive in the `alpha.unix.cstring` checkers when the buffer argument points into the middle of an array, such as `memcpy(dst, &arr[i], size)`. (#GH198346) +- Fixed the default binding of union aggregates being overwritten when initializing array elements with union members. (#GH178694) +- The analyzer no longer rules out the equality of a pointer to the stack and a symbolic pointer in unknown space, because a function may return a pointer to some other stack frame (for example one received as an argument). (#GH187080) +- Fixed bad logic in `VisitArrayInitLoopExpr` that used the wrong parent node when binding the expression value. (#GH196974) +- Fixed bad logic in `ExprEngine::evalBind` so that both the `check::Bind` and the pointer-escape checkers get a chance to run when binding to an `Unknown` or `Undefined` memory location. (#GH196313) +- Fixed an unjustified early return in `ExprEngine::processCallExit` that could drop execution paths produced by `removeDead`. (#GH205656) +- Fixed `CallEvent::getReturnValueUnderConstruction` to use the `LocationContext` and `CFGElementRef` stored in the `CallEvent` instead of the currently analyzed ones. (#GH187020) +- Fixed the `getcwd` summary in the `unix.StdCLibraryFunctions` checker. (#GH175136) #### Improvements -- `alpha.unix.PthreadLock` now emits path notes on lock, unlock, destroy, - and init operations. - -% comment: -% This is for the Static Analyzer. -% Using the caret `^^^` underlining for subsections: -% - Crash and bug fixes -% - New checkers and features -% - Improvements -% - Moved checkers +- The unmaintained and crash-prone Z3 constraint-manager backend selected via `-analyzer-constraints=z3` was renamed to `-analyzer-constraints=unsupported-z3` to make its unsupported status explicit. (#GH205370) +- The conservative call-invalidation logic now invalidates the object of an opaque constructor call regardless of whether an argument refers to it. (#GH170887) +- Improved the resolution of constant values from initializers in RegionStore, including preserving default bindings for aggregate-like cases, generalized field-initializer resolution for arbitrary nesting, and normalized sub-array indices. (#GH199271) +- The analyzer now conservatively evaluates `std::sort`, `std::stable_sort`, and `std::inplace_merge` to prevent false positives caused by complex STL internals that cannot be modeled adequately by the engine. (#GH177804) +- The `optin.cplusplus.VirtualCall` checker no longer reports virtual method calls during construction/destruction when the call site is in a system header. (#GH184178) +- Reduced false positives of the `unix.MallocSizeof` checker for layout-compatible types, such as `malloc(sizeof(std::atomic<int32_t>))` assigned to an `int32_t *`. (#GH200253) +- The `optin.core.FixedAddressDereference` checker no longer reports dereferences of a fixed address when the pointee is `volatile`. (#GH181644) +- Improved `[[clang::suppress]]` handling for tricky template specializations, nested templates, and friend function templates that are forward-declared at namespace scope. (#GH182659, #GH178441, #GH183727, #GH187043) +- The `unix.BlockInCriticalSection` checker now understands `std::scoped_lock` in addition to `std::lock_guard` and `std::unique_lock`. (#GH176134) +- The `alpha.unix.cstring` sub-checkers were untangled so that each one models and reports independently instead of relying on another sub-checker being enabled. (#GH186802) +- The analyzer now detects reads of uninitialized dynamically-allocated objects. (#GH193001) +- The `cplusplus.Move` checker can now detect a use-after-move for the three-argument `std::move` on containers (when `alpha.cplusplus.IteratorModeling` is also enabled). (#GH137157) +- The condition of a `switch` statement now triggers the `check::BranchCondition` callback, so checkers like `core.uninitialized.Branch` can report an undefined `switch` condition. (#GH182058) +- Improved handling of multiple `[[assume]]` attributes on a single statement. (#GH198618) +- When the execution environment is untrusted, the `argv`, `argc`, and `envp` parameters of `main` are now treated as taint sources. (#GH178054) +- The `alpha.unix.PthreadLock` checker now emits path notes on lock, unlock, destroy, and init operations. (#GH202473) +- Added a new `check::LifetimeEnd` callback that fires for each `CFGLifetimeEnds` element, which is useful for detecting dangling pointers. (#GH201123) +- The `unix.StdCLibraryFunctions` standard-library summaries were optimized for binary size. (#GH202662) +- Fixed the alignment of entries printed by `clang -cc1 -analyzer-print-analyzer-options` / `-analyzer-help`. (#GH190570) #### Moved checkers -- The checker `unix.cstring.UninitializedRead` is now out of alpha. +- The checker `unix.cstring.UninitializedRead` is now out of alpha. (#GH196292) + +#### Removed checkers + +- The `alpha.core.FixedAddr` checker was removed. It was overly simplistic and is largely superseded by the `optin.core.FixedAddressDereference` checker. (#GH182033) + +#### Diagnostic changes + +- Cross Translation Unit (CTU) import failures are now reported at the location where the imported symbol would be used, making it easier to understand why a cross-TU bug was missed. (#GH188795) +- Uninitialized-value diagnostics no longer emit a misleading "initialized here" note for a variable that was declared without an initializer; the note now reads "declared without an initial value". (#GH198345) (release-notes-sanitizers)= _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
