Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-10 Thread Martijn van Oosterhout
On Wed, Mar 08, 2006 at 10:34:38PM -0800, Ben Chelf wrote: On 3/8/06, Josh Berkus josh ( at ) agliodbs ( dot ) com wrote: Actually, I thougth that Neil/eDB did this with their copy. Is there any way to get a copy of that training configuration? Just to jump in on this thread, we

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Martijn van Oosterhout
On Wed, Mar 08, 2006 at 06:42:45PM -0500, Greg Stark wrote: Ben Chelf [EMAIL PROTECTED] writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \ (errfinish rest) : (void) 0), (elevel = ERROR ? exit(0) :

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Bruce Momjian
Martijn van Oosterhout wrote: -- Start of PGP signed section. On Wed, Mar 08, 2006 at 06:42:45PM -0500, Greg Stark wrote: Ben Chelf [EMAIL PROTECTED] writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Tom Lane
Marc G. Fournier [EMAIL PROTECTED] writes: Why? I don't think we are able to run 'embedded' now as it is, so its not like we're dealign with system with small disk spaces :) how much bigger would adding that exit() make the binary? It's not only the exit(), as the elevel parameter isn't

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Bruce Momjian
Tom Lane wrote: Marc G. Fournier [EMAIL PROTECTED] writes: Why? I don't think we are able to run 'embedded' now as it is, so its not like we're dealign with system with small disk spaces :) how much bigger would adding that exit() make the binary? It's not only the exit(), as the

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Stephen Frost
* Bruce Momjian (pgman@candle.pha.pa.us) wrote: It's been asserted that Coverity can be taught to understand about elog/ereport without this sort of hack, so I'd rather take that tack. Agreed. The idea of modifying our binary in any way to help a sanity tool not complain is totally

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Marc G. Fournier
On Thu, 9 Mar 2006, Tom Lane wrote: Marc G. Fournier [EMAIL PROTECTED] writes: Why? I don't think we are able to run 'embedded' now as it is, so its not like we're dealign with system with small disk spaces :) how much bigger would adding that exit() make the binary? It's not only the

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-09 Thread Ben Chelf
On 3/8/06, Josh Berkus josh ( at ) agliodbs ( dot ) com wrote: Actually, I thougth that Neil/eDB did this with their copy. Is there any way to get a copy of that training configuration? Just to jump in on this thread, we can absolutely configure elog -- if you have the config already,

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-08 Thread Martijn van Oosterhout
On Tue, Mar 07, 2006 at 05:39:18PM -0500, Tom Lane wrote: Martijn van Oosterhout kleptog@svana.org writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \ (errfinish rest) : (void) 0), (elevel = ERROR ?

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-08 Thread Ben Chelf
Martijn van Oosterhout wrote: On Tue, Mar 07, 2006 at 05:39:18PM -0500, Tom Lane wrote: Martijn van Oosterhout kleptog@svana.org writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \ (errfinish rest) :

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-08 Thread Josh Berkus
Folks, As for Coverity, if the elevel that's passed to the ereport is really a constant, the above #ifdef should absolutely do the trick for us so we know to stop analyzing on that path...Let me know if it doesn't actually do that ;) Um, I think the answer is to train Coverity, not change our

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-08 Thread Jonah H. Harris
On 3/8/06, Josh Berkus josh@agliodbs.com wrote: Actually, I thougth that Neil/eDB did this with their copy.Is there anyway to get a copy of that training configuration? I think we have a backup of it somewhere. I'll look into it. -- Jonah H. Harris, Database Internals ArchitectEnterpriseDB

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-08 Thread Greg Stark
Ben Chelf [EMAIL PROTECTED] writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \ (errfinish rest) : (void) 0), (elevel = ERROR ? exit(0) : 0) #else /* Normal def */ #endif As for Coverity, if the

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-07 Thread Martijn van Oosterhout
On Mon, Mar 06, 2006 at 12:50:15PM -0400, Marc G. Fournier wrote: I thought we ran the Converity analysis a year ago and cleaned up the warnings, so I am surprised at our high number, but I assume they are mostly noise. Got an account and will take a look at the details this evening ... :)

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-07 Thread Alvaro Herrera
Neil Conway wrote: I'm a bit surprised to see that there are ~300 unfixed defects: AFAIR I fixed all the issues the EDB guys passed on to me, with the exception of some false positives and a handful of minor issues in ECPG that I couldn't be bothered fixing (frankly I would rather not touch

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-07 Thread Greg Stark
Alvaro Herrera [EMAIL PROTECTED] writes: but they do make the mistake of not noticing that ereport(ERROR) does not continue execution. There is a way in gcc to indicate that a function never returns. But in Postgres it's a bit weird since elog()/ereport() sometimes return and sometimes

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-07 Thread Martijn van Oosterhout
On Tue, Mar 07, 2006 at 05:10:44PM -0500, Greg Stark wrote: Alvaro Herrera [EMAIL PROTECTED] writes: but they do make the mistake of not noticing that ereport(ERROR) does not continue execution. There is a way in gcc to indicate that a function never returns. But in Postgres it's a

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-07 Thread Tom Lane
Martijn van Oosterhout kleptog@svana.org writes: #ifdef STATIC_ANALYSIS #define ereport(elevel, rest) \ (errstart(elevel, __FILE__, __LINE__, PG_FUNCNAME_MACRO) ? \ (errfinish rest) : (void) 0), (elevel = ERROR ? exit(0) : 0) #else /* Normal def */ #endif Hmm, neat idea

[HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Ben Chelf
Hello PostgreSQL Developers, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford (the Stanford Checker). The reason I'm writing is because we have set up a

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Andreas Pflug
Ben Chelf wrote: Hello PostgreSQL Developers, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford (the Stanford Checker). The reason I'm writing is because we

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Bruce Momjian
Andreas Pflug wrote: Ben Chelf wrote: Hello PostgreSQL Developers, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford (the Stanford Checker). The

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Alvaro Herrera
Andreas Pflug wrote: Ben Chelf wrote: Hello PostgreSQL Developers, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford (the Stanford Checker). The reason I'm

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Lukas Smith
Alvaro Herrera wrote: AFAIR they got a private scan done and they fixed the reported defects. After that they issued a press release telling how little defects they got, or something ... OTOH neither JBoss, BerkeleyDB, Qt are listed. Is there a pattern here? I guess the pattern is obvious

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread David Boreham
OTOH neither JBoss, BerkeleyDB, Qt are listed. Is there a pattern here? http://www.coverity.com/news/news_02_15_05_story_6.html ---(end of broadcast)--- TIP 6: explain analyze is your friend

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Marc G. Fournier
On Mon, 6 Mar 2006, Bruce Momjian wrote: Andreas Pflug wrote: Ben Chelf wrote: Hello PostgreSQL Developers, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Neil Conway
On Mon, 2006-03-06 at 11:55 -0300, Alvaro Herrera wrote: AFAIR they got a private scan done and they fixed the reported defects. Indeed: EnterpriseDB paid for a license for the Coverity static analysis tool, and then ran that tool on the open-source Postgres tree. One of their engineers then

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Andrew Dunstan
Neil Conway wrote: On Mon, 2006-03-06 at 11:55 -0300, Alvaro Herrera wrote: AFAIR they got a private scan done and they fixed the reported defects. Indeed: EnterpriseDB paid for a license for the Coverity static analysis tool, and then ran that tool on the open-source Postgres tree.

Re: [HACKERS] Coverity Open Source Defect Scan of PostgreSQL

2006-03-06 Thread Josh Berkus
Ben, I'm the CTO of Coverity, Inc., a company that does static source code analysis to look for defects in code. You may have heard of us or of our technology from its days at Stanford (the Stanford Checker). The reason I'm writing is because we have set up a framework internally to