infer-analyze - +
infer-analyze - analyze the files captured by infer
infer +
infer
analyze [options]
infer [options]
Analyze the +
Analyze the files captured in the project results directory and report.
@@ -71,9 +71,9 @@--annotation-reachability
+--annotation-reachability
-Activates: +
Activates: annotation-reachability checker: Given pairs of source and sink annotations, e.g. ‘@A‘ and ‘@B‘, this checker will warn whenever some @@ -90,105 +90,104 @@
--annotation-reachability-only
+--annotation-reachability-only
-Activates: Enable +
Activates: Enable annotation-reachability and disable all other checkers (Conversely: --no-annotation-reachability-only)
---biabduction
+--biabduction
-Activates: biabduction +
Activates: biabduction checker: This analysis deals with a range of issues, many linked to memory safety.
-DEPRECATED: This has
-been replaced by Pulse and will be removed
+
DEPRECATED: This has been
+replaced by Pulse and will be removed
in the next release.
(Conversely: --no-biabduction)
--biabduction-only
Activates: Enable +
Activates: Enable biabduction and disable all other checkers (Conversely: --no-biabduction-only)
---biabduction-write-dotty
+--biabduction-write-dotty
-Activates: Produce dotty files +
Activates: Produce dotty files for specs and retain cycles reports in infer-out/captured. (Conversely: --no-biabduction-write-dotty)
---bufferoverrun
+--bufferoverrun
-Activates: bufferoverrun +
Activates: bufferoverrun checker: InferBO is a detector for out-of-bounds array accesses. (Conversely: --no-bufferoverrun)
+--bufferoverrun-only
---bufferoverrun-only
- -Activates: Enable +
Activates: Enable bufferoverrun and disable all other checkers (Conversely: --no-bufferoverrun-only)
---changed-files-index +
--changed-files-index file
-Specify the file containing the +
Specify the file containing the list of source files from which reactive analysis should start. Source files should be specified relative to project root or be absolute
---config-impact-analysis
+--config-impact-analysis
-Activates: +
Activates: config-impact-analysis checker: [EXPERIMENTAL] Collects function that are called without config checks. (Conversely: --no-config-impact-analysis)
---config-impact-analysis-only
+--config-impact-analysis-only
-Activates: Enable +
Activates: Enable config-impact-analysis and disable all other checkers (Conversely: --no-config-impact-analysis-only)
---continue-analysis
+--continue-analysis
-Activates: Continue the +
Activates: Continue the analysis after more targets are captured by --continue. The other analysis options should be given the same before. Not compatible with --reanalyze and --incremental-analysis. (Conversely: --no-continue-analysis)
---cost
+--cost
-Activates: cost checker: +
Activates: cost checker: Computes the asymptotic complexity of functions with respect to execution cost or other user defined resources. Can be used to detect changes in the complexity with ‘infer reportdiff‘. (Conversely: --no-cost)
---cost-only
+--cost-only
-Activates: Enable cost +
Activates: Enable cost and disable all other checkers (Conversely: --no-cost-only)
---no-cost-suppress-func-ptr
+--no-cost-suppress-func-ptr
-Deactivates: Suppress printing +
Deactivates: Suppress printing function pointers in cost reports (Conversely: --cost-suppress-func-ptr)
---debug,-g
+--debug,-g
-Activates: Debug mode (also +
Activates: Debug mode (also sets --debug-level 2, --developer-mode, --print-buckets, --print-types, --reports-include-ml-loc, @@ -196,45 +195,45 @@
--debug-level +
--debug-level level
-Debug level (sets +
Debug level (sets --bo-debug level, --debug-level-analysis level, --debug-level-capture level):
-- 0: only basic debugging +
- 0: only basic debugging
enabled
- 1: verbose debugging enabled
- 2: very verbose debugging enabled
--debug-level-analysis int
Debug level for the analysis. +
Debug level for the analysis. See --debug-level for accepted values.
---debug-level-capture +
--debug-level-capture int
-Debug level for the capture. +
Debug level for the capture. See --debug-level for accepted values.
---debug-level-report +
--debug-level-report int
-Debug level for the report. See +
Debug level for the report. See --debug-level for accepted values.
---no-deduplicate
+--no-deduplicate
-Deactivates: Apply +
Deactivates: Apply issue-specific deduplication during analysis and/or reporting. (Conversely: --deduplicate)
---no-default-checkers
+--no-default-checkers
-Deactivates: Default checkers: +
Deactivates: Default checkers: --static-constructor-stall-checker, --fragment-retains-view, --inefficient-keyset-iterator, --liveness, @@ -244,9 +243,9 @@
--detach-analysis-dependency
+--detach-analysis-dependency
-Activates: Detach analysis +
Activates: Detach analysis dependencies of checkers during the analysis, so that each checker triggers themselves only when analyzing a callee. This can save unnecessary analyses on the situation that NOT @@ -255,89 +254,88 @@
--dict-missing-key-var-block-list +
--dict-missing-key-var-block-list +string
-Skip analyzing the variables in +
Skip analyzing the variables in the dict-missing-key checker.
- ---files-to-analyze-index +
--files-to-analyze-index file
-File containing a list of +
File containing a list of source files where analysis should start from. When used, the set of files given to this argument must be a subset of that passed to --changed-files-index (which must be specified).
---no-fragment-retains-view
+--no-fragment-retains-view
-Deactivates: +
Deactivates: fragment-retains-view checker: Detects when Android fragments are not explicitly nullified before becoming unreachable. (Conversely: --fragment-retains-view)
---fragment-retains-view-only
+--fragment-retains-view-only
-Activates: Enable +
Activates: Enable fragment-retains-view and disable all other checkers (Conversely: --no-fragment-retains-view-only)
---help
+--help
-Show this manual
+Show this manual
---help-format { auto -| groff | pager | plain }
+--help-format { auto | +groff | pager | plain }
-Show this help in the specified +
Show this help in the specified format. auto sets the format to plain if the environment variable TERM is "dumb" or undefined, and to pager otherwise.
---help-full
+--help-full
-Show this manual with all +
Show this manual with all internal options in the INTERNAL OPTIONS section
---impurity
+--impurity
-Activates: impurity +
Activates: impurity checker: Detects functions with potential side-effects. Same as "purity", but implemented on top of Pulse.
-ACTIVATES: pulse +
ACTIVATES: pulse
(Conversely: --no-impurity)
--impurity-only
Activates: Enable +
Activates: Enable impurity and disable all other checkers (Conversely: --no-impurity-only)
---impurity-report-immutable-modifications
+--impurity-report-immutable-modifications
-Activates: Report modifications +
Activates: Report modifications to immutable fields in the Impurity checker (Conversely: --no-impurity-report-immutable-modifications)
---incremental-analysis
+--incremental-analysis
-Activates: Use incremental +
Activates: Use incremental analysis for changed files. Not compatible with --reanalyze and --continue-analysis. Also sets --mark-unchanged-procs. (Conversely: --no-incremental-analysis)
---no-inefficient-keyset-iterator
+--no-inefficient-keyset-iterator
-Deactivates: +
Deactivates: inefficient-keyset-iterator checker: Check for inefficient uses of iterators that iterate on keys then lookup their values, instead of iterating on key-value pairs @@ -345,157 +343,160 @@
--inefficient-keyset-iterator-only
+--inefficient-keyset-iterator-only
-Activates: Enable +
Activates: Enable inefficient-keyset-iterator and disable all other checkers (Conversely: --no-inefficient-keyset-iterator-only)
---invalidate-only
+--invalidate-only
-Activates: Remove any summaries +
Activates: Remove any summaries from the results database that transitively depend on a changed procedure, then exit without doing any actual analysis. (Conversely: --no-invalidate-only)
---jobs,-j +
--jobs,-j int
-Run the specified number of +
Run the specified number of analysis jobs simultaneously. Defaults to the minimum value of the max_jobs argument and the number of CPUs.
---keep-going
+--keep-going
-Activates: Keep going when the +
Activates: Keep going when the analysis or capture encounter a failure (Conversely: --no-keep-going)
---lineage
+--lineage
-Activates: lineage +
Activates: lineage checker: Computes a dataflow graph (Conversely: --no-lineage)
---lineage-only
+--lineage-only
-Activates: Enable +
Activates: Enable lineage and disable all other checkers (Conversely: --no-lineage-only)
---litho-required-props
+--litho-required-props
-Activates: +
Activates: litho-required-props checker: Checks that all non-optional ‘@Prop‘s have been specified when constructing Litho components. (Conversely: --no-litho-required-props)
---litho-required-props-only
+--litho-required-props-only
-Activates: Enable +
Activates: Enable litho-required-props and disable all other checkers (Conversely: --no-litho-required-props-only)
---no-liveness
+--no-liveness
-Deactivates: liveness +
Deactivates: liveness checker: Detection of dead stores and unused variables. (Conversely: --liveness)
---liveness-ignored-constant +
--liveness-ignored-constant +string
-List of integer constants to be +
List of integer constants to be ignored by liveness analysis
---liveness-only
+--liveness-only
-Activates: Enable +
Activates: Enable liveness and disable all other checkers (Conversely: --no-liveness-only)
---log-missing-deps
+--log-missing-deps
-Activates: Log analysis +
Activates: Log analysis dependencies that cannot be found. (Conversely: --no-log-missing-deps)
---loop-hoisting
+--loop-hoisting
-Activates: loop-hoisting +
Activates: loop-hoisting checker: Detect opportunities to hoist function calls that are invariant outside of loop bodies for efficiency. (Conversely: --no-loop-hoisting)
+--loop-hoisting-only
---loop-hoisting-only
- -Activates: Enable +
Activates: Enable loop-hoisting and disable all other checkers (Conversely: --no-loop-hoisting-only)
---max-jobs -int
+--max-jobs int
-Maximum number of analysis jobs +
Maximum number of analysis jobs running simultaneously. Experiments show current best value is 40 jobs.
---memtrace-analysis-profiling
+--memtrace-analysis-profiling
-Activates: Generate OCaml +
Activates: Generate OCaml analysis allocation traces in ‘infer-out/memtrace‘. (Conversely: --no-memtrace-analysis-profiling)
- ---memtrace-sampling-rate +
--memtrace-sampling-rate float
-Sampling rate for Memtrace +
Sampling rate for Memtrace allocation profiling. Default is 1e-6.
---modeled-expensive +
--modeled-expensive json
-Matcher or list of matchers for +
Matcher or list of matchers for methods that should be considered expensive by the performance critical checker.
---never-returning-null +
--multicore
+ +Activates: [EXPERIMENTAL] uses +multi-threading for analysis, currently partially or not +implemented. (Conversely: --no-multicore)
+ +--never-returning-null json
-[Java only, all analyses] +
[Java only, all analyses] Matcher or list of matchers for functions that never return null.
---noescaping-function-list +
--noescaping-function-list +string
-Useful for the check +
Useful for the check CXX_REF_CAPTURED_IN_BLOCK. It declares a list of functions that take blocks as arguments that are no escaping but we cannot annotate them accordingly.
---objc-block-execution-macro +
--objc-block-execution-macro string
-Macro for executing Objective-C +
Macro for executing Objective-C blocks safely.
---ondemand-recursion-restart-limit +
--ondemand-recursion-restart-limit int
-In order to make the analysis +
In order to make the analysis of mutual recursion cycles deterministic in their output, the analysis of a cycle of mutually recursive functions may restart the analysis of the entire cycle from a @@ -507,146 +508,143 @@
--no-parameter-not-null-checked
+--no-parameter-not-null-checked
-Deactivates: +
Deactivates: parameter-not-null-checked checker: An Objective-C-specific analysis to detect when a block parameter is used before being checked for null first. (Conversely: --parameter-not-null-checked)
---parameter-not-null-checked-only
+--parameter-not-null-checked-only
-Activates: Enable +
Activates: Enable parameter-not-null-checked and disable all other checkers (Conversely: --no-parameter-not-null-checked-only)
---print-active-checkers
+--print-active-checkers
-Activates: Print the active +
Activates: Print the active checkers before starting the analysis (Conversely: --no-print-active-checkers)
---print-logs
+--print-logs
-Activates: Also log messages to +
Activates: Also log messages to stdout and stderr (Conversely: --no-print-logs)
- ---procs-to-analyze-index +
--procs-to-analyze-index file
-Specify the file containing an +
Specify the file containing an Sexp representing a list of pairs of procedures and specializations to analyze. Only works with the restart scheduler.
---progress-bar-style -{ auto | plain | multiline }
+--progress-bar-style { +auto | plain | multiline }
-Style of the progress bar. +
Style of the progress bar. auto selects multiline if connected to a tty, otherwise plain.
- ---project-root,-C +
--project-root,-C dir
-Specify the root directory of +
Specify the root directory of the project
---no-pulse
+--no-pulse
-Deactivates: pulse +
Deactivates: pulse checker: General-purpose memory and value analysis engine. (Conversely: --pulse)
---pulse-only
+--pulse-only
-Activates: Enable pulse +
Activates: Enable pulse and disable all other checkers (Conversely: --no-pulse-only)
---purity
+--purity
-Activates: purity +
Activates: purity checker: Detects pure (side-effect-free) functions. A different implementation of "impurity". (Conversely: --no-purity)
---purity-only
+--purity-only
-Activates: Enable purity +
Activates: Enable purity and disable all other checkers (Conversely: --no-purity-only)
---qualified-cpp-name-block-list +
--qualified-cpp-name-block-list +string
-Skip analyzing the procedures +
Skip analyzing the procedures under the qualified cpp type name.
---quiet,-q
+--quiet,-q
-Activates: Do not print +
Activates: Do not print anything on standard output. (Conversely: --no-quiet | -Q)
---no-racerd
+--no-racerd
-Deactivates: racerd +
Deactivates: racerd checker: Thread safety analysis. (Conversely: --racerd)
---racerd-only
+--racerd-only
-Activates: Enable racerd +
Activates: Enable racerd and disable all other checkers (Conversely: --no-racerd-only)
+--reactive,-r
---reactive,-r
- -Activates: Reactive mode: the +
Activates: Reactive mode: the analysis starts from the files captured since the infer command started (Conversely: --no-reactive | -R)
---reactive-capture
+--reactive-capture
-Activates: Reactive capture: +
Activates: Reactive capture: capture and analysis are interleaved. Currently this flag will only make the analysis generate a list of type names that were not found in the global tenv. The feature is only available for the Hack frontend for now. (Conversely: --no-reactive-capture)
---no-report
+--no-report
-Deactivates: Run the reporting +
Deactivates: Run the reporting phase once the analysis has completed (Conversely: --report)
---report-force-relative-path
+--report-force-relative-path
-Activates: Force converting an +
Activates: Force converting an absolute path to a relative path to the root directory (Conversely: --no-report-force-relative-path)
---results-dir,-o +
--results-dir,-o dir
-Write results and internal +
Write results and internal files in the specified directory
---scope-leakage
+--scope-leakage
-Activates: scope-leakage +
Activates: scope-leakage checker: The Java/Kotlin checker takes into account a set of "scope" annotations and a must-not-hold relation over the scopes. The checker raises an alarm if there exists @@ -654,161 +652,158 @@
--scope-leakage-only
---scope-leakage-only
- -Activates: Enable +
Activates: Enable scope-leakage and disable all other checkers (Conversely: --no-scope-leakage-only)
---no-self-in-block
+--no-self-in-block
-Deactivates: +
Deactivates: self-in-block checker: An Objective-C-specific analysis to detect when a block captures ‘self‘. (Conversely: --self-in-block)
+--self-in-block-only
---self-in-block-only
- -Activates: Enable +
Activates: Enable self-in-block and disable all other checkers (Conversely: --no-self-in-block-only)
+--shrink-analysis-db
---shrink-analysis-db
- -Activates: After analysis, +
Activates: After analysis, delete analysis summaries (but not report summaries) and vacuum analysis database. (Conversely: --no-shrink-analysis-db)
---sil-validation
+--sil-validation
-Activates: +
Activates: sil-validation checker: This checker validates that all SIL instructions in all procedure bodies conform to a (front-end specific) subset of SIL. (Conversely: --no-sil-validation)
---sil-validation-only
+--sil-validation-only
-Activates: Enable +
Activates: Enable sil-validation and disable all other checkers (Conversely: --no-sil-validation-only)
---no-siof
+--no-siof
-Deactivates: siof +
Deactivates: siof checker: Catches Static Initialization Order Fiascos in C++, that can lead to subtle, compiler-version-dependent errors. (Conversely: --siof)
---siof-only
+--siof-only
-Activates: Enable siof +
Activates: Enable siof and disable all other checkers (Conversely: --no-siof-only)
---sqlite-cache-size +
--sqlite-cache-size int
-SQLite cache size in pages (if +
SQLite cache size in pages (if positive) or kB (if negative), follows formal of corresponding SQLite PRAGMA.
---sqlite-lock-timeout +
--sqlite-lock-timeout int
-Timeout for SQLite results +
Timeout for SQLite results database operations, in milliseconds.
---sqlite-max-blob-size +
--sqlite-max-blob-size int
-Maximum blob/string size for +
Maximum blob/string size for data written in SQLite.
---sqlite-mmap-size +
--sqlite-mmap-size int
-Size of memory map for mmaped +
Size of memory map for mmaped SQLite databases, zero value disables memory mapping.
---sqlite-page-size +
--sqlite-page-size int
-SQLite page size in bytes, must +
SQLite page size in bytes, must be a power of two between 512 and 65536.
---no-starvation
+--no-starvation
-Deactivates: starvation +
Deactivates: starvation checker: Detect various kinds of situations when no progress is being made because of concurrency errors. (Conversely: --starvation)
---starvation-only
+--starvation-only
-Activates: Enable +
Activates: Enable starvation and disable all other checkers (Conversely: --no-starvation-only)
---no-static-constructor-stall-checker
+--no-static-constructor-stall-checker
-Deactivates: +
Deactivates: static-constructor-stall-checker checker: Detect if dispatch_once is called from a static constructor. (Conversely: --static-constructor-stall-checker)
---static-constructor-stall-checker-only
+--static-constructor-stall-checker-only
-Activates: Enable +
Activates: Enable static-constructor-stall-checker and disable all other checkers (Conversely: --no-static-constructor-stall-checker-only)
---timeout +
--timeout float
-Time after which any checker +
Time after which any checker (except biabduction) should give up analysing the current function or method, in seconds
---top-longest-proc-duration-size +
--top-longest-proc-duration-size int
-Number of procedures for which +
Number of procedures for which we track longest analysis duration info.
---topl
+--topl
-Activates: topl checker: +
Activates: topl checker: Detect errors based on user-provided state machines describing temporal properties over multiple objects.
-ACTIVATES: pulse +
ACTIVATES: pulse
(Conversely: --no-topl)
--topl-only
Activates: Enable topl +
Activates: Enable topl and disable all other checkers (Conversely: --no-topl-only)
---write-html
+--write-html
-Activates: Produce html debug +
Activates: Produce html debug output for the analyses in infer-out/captured. This shows the abstract state of all analyses at each program point in the source code. Each captured source file has its own html page. This HTML file contains the source file, and at each line of
-the file there are links to the +
the file there are links to the
nodes of the control flow graph
of Infer's translation of that line of code into its
intermediate
@@ -819,7 +814,7 @@
Specify the suffix of Xcode +
Specify the suffix of Xcode isysroot directory, to avoid absolute paths in tests
--analysis-schedule-file +
--analysis-schedule-file path
-The file where an analysis +
The file where an analysis schedule is stored. The default is infer-out/analysis_dependency_graph
---replay-analysis-schedule
+--replay-analysis-schedule
-Activates: Replay the analysis +
Activates: Replay the analysis schedule stored in --replay-analysis-schedule-file, which should analyze the procedures in the same order as the previous analysis. This should drastically limit @@ -848,9 +843,9 @@
--replay-ondemand-should-error
+--replay-ondemand-should-error
-Activates: [debug] Whether +
Activates: [debug] Whether triggering the analysis of a procedure via ondemand should log an error when replaying an analysis schedule with --replay-analysis-schedule. Enable when replaying the @@ -858,13 +853,13 @@
--scheduler { file | +
--scheduler { file | restart | callgraph }
-Specify the scheduler used for +
Specify the scheduler used for the analysis phase:
-- file: schedules one job per +
- file: schedules one job per
file
- callgraph: schedules one job per procedure, following the
@@ -877,7 +872,7 @@
Activates: Store the analysis +
Activates: Store the analysis schedule for later replay, honoring --replay-analysis-schedule-file if present. This can be useful to store a schedule done with one version of infer @@ -894,58 +889,57 @@
--no-bo-assume-void
+--no-bo-assume-void
-Deactivates: Assume void type +
Deactivates: Assume void type as a type of record fields not in type environment. (Conversely: --bo-assume-void)
---no-bo-bottom-as-default
+--no-bo-bottom-as-default
-Deactivates: Use bottom as a +
Deactivates: Use bottom as a default value instead of unknown. (Conversely: --bo-bottom-as-default)
---bo-context-sensitive-allocsites
+--bo-context-sensitive-allocsites
-Activates: Assume that +
Activates: Assume that different calls to the same function creating an allocsite results in different allocsites imported to the caller. (Conversely: --no-bo-context-sensitive-allocsites)
---bo-debug -int
+--bo-debug int
-Debug level for buffer-overrun +
Debug level for buffer-overrun checker (0-4)
---bo-exit-frontend-gener-vars
+--bo-exit-frontend-gener-vars
-Activates: Put frontend +
Activates: Put frontend generated variables out of scope when they are listed in exit scope instruction. (Conversely: --no-bo-exit-frontend-gener-vars)
---bo-field-depth-limit +
--bo-field-depth-limit int
-Limit of field depth of +
Limit of field depth of abstract location in buffer-overrun checker
---bo-max-cfg-size +
--bo-max-cfg-size int
-Larger CFGs than the max size +
Larger CFGs than the max size are skipped in buffer overrun analysis.
---bo-sound-unknown-sets-join
+--bo-sound-unknown-sets-join
-Activates: Join with an unknown +
Activates: Join with an unknown set always result in an unknown set. When disabled, unknown set behaves as bot. (Conversely: --no-bo-sound-unknown-sets-join)
@@ -956,57 +950,57 @@--biabduction-unsafe-malloc
+--biabduction-unsafe-malloc
-Activates: Assume that +
Activates: Assume that malloc(3) never returns null. (Conversely: --no-biabduction-unsafe-malloc)
---clang-compound-literal-init-limit +
--clang-compound-literal-init-limit int
-Limit after which +
Limit after which initialization of compound types (structs and arrays) is not done element by element but using a builtin function that each analysis has to model.
---cxx-scope-guards +
--cxx-scope-guards json
-Specify scope guard classes +
Specify scope guard classes that can be read only by destructors without being reported as dead stores.
---dynamic-dispatch-json-file-path +
--dynamic-dispatch-json-file-path path
-Dynamic dispatch file path to +
Dynamic dispatch file path to get the JSON used for method name substitution
---inline-func-pointer-for-testing +
--inline-func-pointer-for-testing string
-Enables substituting global +
Enables substituting global function pointers used for testing with the real function calls in the clang frontend. Pass the prefix used to build the global function pointers used for testing.
---liveness-block-list-var-regex +
--liveness-block-list-var-regex string
-Specify a regular expression +
Specify a regular expression for variable names that are ignored when reporting dead stores.
---liveness-dangerous-classes +
--liveness-dangerous-classes json
-Specify classes where the +
Specify classes where the destructor should be ignored when computing liveness. In other words, assignement to variables of these types (or common wrappers around these types such as @@ -1014,26 +1008,26 @@
--lock-model +
--lock-model json
-Specify custom lock models for +
Specify custom lock models for starvation analysis.
-Example for pthreads (already +
Example for pthreads (already
included in infer):
[{"lock":["pthread_mutex_lock"],"unlock":["pthread_mutex_unlock"]}]
--pulse-model-unreachable +string
Methods to be modeled as +
Methods to be modeled as unreachable.
---pulse-unsafe-malloc
+--pulse-unsafe-malloc
-Activates: Assume that +
Activates: Assume that malloc(3) never returns null. (Conversely: --no-pulse-unsafe-malloc)
@@ -1043,16 +1037,16 @@--erlang-list-unfold-depth +
--erlang-list-unfold-depth int
-Unfold Erlang lists up to depth +
Unfold Erlang lists up to depth int
---no-erlang-reliability
+--no-erlang-reliability
-Deactivates: Analyze crashing +
Deactivates: Analyze crashing executions. This flag affects both capture and analysis. At capture time, it encodes Erlang specs; at (Pulse) analysis time, it models Erlang exceptions (builtin or OTP ones). @@ -1064,39 +1058,39 @@
--no-annotation-reachability-apply-superclass-annotations
+--no-annotation-reachability-apply-superclass-annotations
-Deactivates: Applies +
Deactivates: Applies annotations from superclasses and interfaces also on methods that are not overridden from the superclass or interface. (Conversely: --annotation-reachability-apply-superclass-annotations)
---annotation-reachability-check-loops
+--annotation-reachability-check-loops
-Activates: Highlights callsites +
Activates: Highlights callsites in the trace that are nested in some loop. (Conversely: --no-annotation-reachability-check-loops)
---annotation-reachability-custom-models +
--annotation-reachability-custom-models json
-Specify a map from annotations +
Specify a map from annotations to lists of regexps to treat matching methods as if they had the annotation.
-Example format: +
Example format:
{"Annotation":
["com\\.Myclass\\.foo.*"]}
--annotation-reachability-custom-pairs json
Specify custom sources/sinks, +
Specify custom sources/sinks, and optionally sanitizers for the annotation reachability checker
-Example format: for custom +
Example format: for custom
annotations
com.my.annotation.{Source1,Source2,Sink1,Sanitizer1}
{ "sources" : ["Source1",
@@ -1105,16 +1099,16 @@
Activates: check if methods +
Activates: check if methods annotated with @PerformanceCritical can call expensive methods (annotated @Expensive or modeled, with annotation reachability checker) (Conversely: --no-annotation-reachability-expensive)
---no-annotation-reachability-minimize-sinks
+--no-annotation-reachability-minimize-sinks
-Deactivates: do not report +
Deactivates: do not report paths where a prefix is also a source to sink path. For example if there is a source() -> sink1() -> sink2() path then only source() -> sink1() will be reported. @@ -1122,43 +1116,42 @@
--annotation-reachability-minimize-sources
+--annotation-reachability-minimize-sources
-Activates: do not report paths +
Activates: do not report paths where a suffix is also a source to sink path. For example if there is a source1() -> source2() -> sink() path then only source2() -> sink() will be reported. (Conversely: --no-annotation-reachability-minimize-sources)
---annotation-reachability-no-allocation
+--annotation-reachability-no-allocation
-Activates: check if methods +
Activates: check if methods annotated with @NoAllocation can allocate (with annotation reachability checker) (Conversely: --no-annotation-reachability-no-allocation)
---annotation-reachability-report-source-and-sink
+--annotation-reachability-report-source-and-sink
-Activates: Reports methods that +
Activates: Reports methods that are marked as both a source and a sink at the same time. (Conversely: --no-annotation-reachability-report-source-and-sink)
- ---external-java-packages +
--external-java-packages +prefix
-Specify a list of Java package +
Specify a list of Java package prefixes for external Java packages. If set, the analysis will not report non-actionable warnings on those packages.
---java-version +
--java-version int
-The version of Java being used. +
The version of Java being used. Set it to your Java version if mvn is failing.
--no-lineage-dedup
+--no-lineage-dedup
-Deactivates: In JSON output, +
Deactivates: In JSON output, attempt to print each entity at most once. This is the default. The only reason you may want to turn this off is to make hash collisions more visible; that is, cases in which distinct entities get assigned the same ID. (Conversely: --lineage-dedup)
---lineage-field-depth +
--lineage-field-depth int
-[EXPERIMENTAL] Maximal field +
[EXPERIMENTAL] Maximal field depth sensitivity for lineage analysis. 0 will make the analysis field insensitive.
---lineage-field-max-cfg-size +
--lineage-field-max-cfg-size int
-If set, field sensitivity is +
If set, field sensitivity is disabled on larger CFGs.
---lineage-field-width +
--lineage-field-width int
-[EXPERIMENTAL] Maximal width of +
[EXPERIMENTAL] Maximal width of structures for field sensitive lineage analysis. Structure that have a higher number of fields will be smashed into a single element. 0 will make the analysis field insensitive.
---lineage-include-builtins
+--lineage-include-builtins
-Activates: Include call/return +
Activates: Include call/return edges to/from procedures that model primitive Erlang operations, such as constructing a list. (Conversely: --no-lineage-include-builtins)
---lineage-json-report
+--lineage-json-report
-Activates: Enable lineage +
Activates: Enable lineage report in JSON format. (Conversely: --no-lineage-json-report)
---lineage-keep-temporaries
+--lineage-keep-temporaries
-Activates: Normally, lineage +
Activates: Normally, lineage summaries do not mention temporary variables introduced while compiling the high-level code to Infer's IR (intermediate representation). If this option is enabled, then the lineage graph produced corresponds to Infer's IR. (Conversely: --no-lineage-keep-temporaries)
---lineage-max-cfg-size +
--lineage-max-cfg-size int
-If set, larger CFGs are +
If set, larger CFGs are skipped.
---no-lineage-prevent-cycles
+--no-lineage-prevent-cycles
-Deactivates: [EXPERIMENTAL] If +
Deactivates: [EXPERIMENTAL] If given, Lineage will not stop traversing the fields of a variable when it notices recursive types (that is, a sub-field having the same type as one of its "ancestors"). (Conversely: --lineage-prevent-cycles)
---lineage-seed +
--lineage-seed int
-Set the random seed used for +
Set the random seed used for hashing. (Various entities that get reported need unique identifiers. To generate these unique identifiers, in a distributed way without communication, we use hashing. If you are unlucky and get collisions, you can try a different seed.
---lineage-variant-width +
--lineage-variant-width int
-Maximal width of variant types +
Maximal width of variant types for lineage analysis. A variant type is the type of a variable whose value is within a statically known atom set. The width of the type is the cardinal of that atom set.
@@ -1264,40 +1257,40 @@--log-pulse-coverage
+--log-pulse-coverage
-Activates: Log precisely where +
Activates: Log precisely where coverage stops, at the end of file stats/stats.txt. (Conversely: --no-log-pulse-coverage)
---log-pulse-disjunct-increase-after-model-call
+--log-pulse-disjunct-increase-after-model-call
-Activates: Log which model did +
Activates: Log which model did increase the current number of Pulse disjuncts. (Conversely: --no-log-pulse-disjunct-increase-after-model-call)
---pulse-cut-to-one-path-procedures-pattern +
--pulse-cut-to-one-path-procedures-pattern string
-Regex of methods for which +
Regex of methods for which pulse will only explore one path. Can be used on pathologically large procedures to prevent too-big states from being produced.
---pulse-inline-global-init-func-pointer
+--pulse-inline-global-init-func-pointer
-Activates: Inline the +
Activates: Inline the initializer of global variables that are of type function pointer in Pulse. (Conversely: --no-pulse-inline-global-init-func-pointer)
---pulse-log-summary-count
+--pulse-log-summary-count
-Activates: Log the number of +
Activates: Log the number of summaries (grouped by summary kind) for each analyzed procedure in Pulse. Results are put in JSON files under a 'pulse' subdirectory, one corresponding to each analysis @@ -1305,57 +1298,57 @@
--pulse-max-cfg-size +
--pulse-max-cfg-size int
-Larger CFGs than the max size +
Larger CFGs than the max size are skipped in Pulse.
---pulse-max-disjuncts +
--pulse-max-disjuncts int
-Stop exploring new paths after +
Stop exploring new paths after int disjunctions in the domain
---pulse-max-heap +
--pulse-max-heap int
-Give up analysing a procedure +
Give up analysing a procedure if the number of words in the heap exceeds this limit. Intended use: avoid OutOfMemory crashes.
---pulse-model-abort +
--pulse-model-abort +string
-Methods that should be modelled +
Methods that should be modelled as abort in Pulse
---pulse-model-alloc-pattern +
--pulse-model-alloc-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as allocs in Pulse
---pulse-model-cheap-copy-type +
--pulse-model-cheap-copy-type regex
-Regex of methods that should be +
Regex of methods that should be cheap to copy in Pulse
---pulse-model-cheap-copy-type-list +
--pulse-model-cheap-copy-type-list +regex
-Regex of methods that should be +
Regex of methods that should be cheap to copy in Pulse
---pulse-model-free-pattern +
--pulse-model-free-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as wrappers to free(3) in Pulse. The pointer to be freed should be the first argument of the function. This should only be needed if the code of the wrapper is not @@ -1364,105 +1357,105 @@
--pulse-model-malloc-pattern +
--pulse-model-malloc-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as wrappers to malloc(3) in Pulse. The size to allocate should be the first argument of the function. See --pulse-model-free-pattern for more information.
---pulse-model-realloc-pattern +
--pulse-model-realloc-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as wrappers to realloc(3) in Pulse. The pointer to be reallocated should be the first argument of the function and the new size the second argument. See --pulse-model-free-pattern for more information.
---pulse-model-release-pattern +
--pulse-model-release-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as release in Pulse
---pulse-model-return-first-arg +
--pulse-model-return-first-arg string
-Regex of methods that should be +
Regex of methods that should be modelled as returning the first argument in Pulse in terms of the source language semantics. Languages supported: Java, C, Objective-C
---pulse-model-return-nonnull +
--pulse-model-return-nonnull string
-Regex of methods that should be +
Regex of methods that should be modelled as returning non-null in Pulse
---pulse-model-return-nonnull-list +
--pulse-model-return-nonnull-list +string
-Regex of methods that should be +
Regex of methods that should be modelled as returning non-null in Pulse
---pulse-model-return-this +
--pulse-model-return-this string
-Regex of methods that should be +
Regex of methods that should be modelled as returning the ‘this‘ or ‘self‘ argument of an instance method in Pulse. Languages supported: Java, Objective-C
---pulse-model-returns-copy-pattern +
--pulse-model-returns-copy-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as creating copies in Pulse
---pulse-model-skip-pattern +
--pulse-model-skip-pattern string
-Regex of methods that should be +
Regex of methods that should be modelled as "skip" in Pulse
---pulse-model-skip-pattern-list +
--pulse-model-skip-pattern-list +string
-Regex of methods that should be +
Regex of methods that should be modelled as "skip" in Pulse
---pulse-model-transfer-ownership +
--pulse-model-transfer-ownership +string
-Methods that should be modelled +
Methods that should be modelled as transfering memory ownership in Pulse. Accepted formats are method or namespace::method
---pulse-model-unknown-pure +
--pulse-model-unknown-pure +string
-Regex of methods that should be +
Regex of methods that should be modelled as unknown pure in Pulse
---pulse-models-for-erlang +
--pulse-models-for-erlang +path
-Provide custom models for +
Provide custom models for Erlang in JSON files or SQLite3. Files must end with ‘.json‘ or ‘.db‘ respectively. If a path to a directory is given then the subdirectories will be @@ -1470,7 +1463,7 @@
The format for JSON is +
The format for JSON is
[SelectorBehavior, ...] where
SelectorBehavior := {"selector": Selector,
"behavior": Behavior}
@@ -1511,58 +1504,58 @@
Deactivates: Report null +
Deactivates: Report null dereference issues on files marked @Nullsafe. (Conversely: --pulse-nullsafe-report-npe)
---pulse-nullsafe-report-npe-as-separate-issue
+--pulse-nullsafe-report-npe-as-separate-issue
-Activates: Report null +
Activates: Report null dereference issues on files marked @Nullsafe as a separate NULLPTR_DEREFERENCE_IN_NULLSAFE_CLASS issue type. (Conversely: --no-pulse-nullsafe-report-npe-as-separate-issue)
---pulse-over-approximate-reasoning
+--pulse-over-approximate-reasoning
-Activates: [EXPERIMENTAL] add +
Activates: [EXPERIMENTAL] add over-approximate reasoning on top of the under-approximate, disjunctive reasoning of Pulse. (Conversely: --no-pulse-over-approximate-reasoning)
---pulse-recency-limit +
--pulse-recency-limit int
-Maximum number of array +
Maximum number of array elements and structure fields to keep track of for a given address.
---pulse-skip-procedures +
--pulse-skip-procedures regex
-Regex of procedures that should +
Regex of procedures that should not be analyzed by Pulse.
---pulse-specialization-iteration-limit +
--pulse-specialization-iteration-limit int
-Maximum number of iterative +
Maximum number of iterative summary specialization at each call site.
---pulse-specialization-limit +
--pulse-specialization-limit int
-Maximum number of summary +
Maximum number of summary specialization by procedure.
---pulse-taint-config +
--pulse-taint-config +path
-Path to a taint analysis +
Path to a taint analysis configuration file or a directory containing such files. This file can define --pulse-taint-sources, --pulse-taint-sanitizers, @@ -1570,7 +1563,7 @@
If a path to a directory is +
If a path to a directory is
given then the configuration files
must have the ‘.json‘ extension. Any other file
will be ignored.
@@ -1579,38 +1572,37 @@
Specify which taint kinds +
Specify which taint kinds should be used for data flow reporting only. If a source has such a kind, only data flows to sinks which originate at the source will be reported. If a sink has such a kind, only sensitive data flows to the sink will be reported.
---no-pulse-taint-follow-field-accesses
+--no-pulse-taint-follow-field-accesses
-Deactivates: Specify if taint +
Deactivates: Specify if taint analysis should follow field accesses when propagating taints. (Conversely: --pulse-taint-follow-field-accesses)
---pulse-taint-opaque-files +
--pulse-taint-opaque-files +path
-Specify files that should be +
Specify files that should be treated as opaque for taint analysis to make sure that procedure's belonging to these files are always free of any potential taint flows.
---pulse-taint-policies +
--pulse-taint-policies json
-A description of which taint +
A description of which taint flows should be reported, following this JSON format:
-{
-"short_description": "<a short description
-of the issue>",
+
{ "short_description":
+"<a short description of the issue>",
"taint_flows": [{ "source_kinds":
[<kinds>],
"sink_kinds": [<kinds>],
@@ -1636,48 +1628,47 @@
Quick way to specify simple +
Quick way to specify simple propagators as a JSON objects. See --pulse-taint-sources for the fields format documentation.
- ---pulse-taint-sanitizers +
--pulse-taint-sanitizers json
-Quick way to specify simple +
Quick way to specify simple sanitizers as a JSON objects. See --pulse-taint-sources for the fields format documentation.
---pulse-taint-short-traces
+--pulse-taint-short-traces
-Activates: Cut off taint traces +
Activates: Cut off taint traces as soon as a tainted value flows into a sink. This matters when the sink itself calls other sinks of the same kind and as long as the value flows from call to call, without this flag the trace would include the whole chain of calls. (Conversely: --no-pulse-taint-short-traces)
---pulse-taint-sinks +
--pulse-taint-sinks json
-Quick way to specify simple +
Quick way to specify simple sinks as a JSON objects. See --pulse-taint-sources for the fields format documentation.
---pulse-taint-skip-sources
+--pulse-taint-skip-sources
-Activates: Skip the analysis of +
Activates: Skip the analysis of methods declared as sources in the taint. (Conversely: --no-pulse-taint-skip-sources)
---pulse-taint-sources +
--pulse-taint-sources json
-Together with +
Together with --pulse-taint-sanitizers, --pulse-taint-sinks, --pulse-taint-policies, and --pulse-taint-data-flow-kinds, specify taint @@ -1686,8 +1677,8 @@
- "field_regex":
-match a field name using an OCaml regex
+
- "field_regex": match
+a field name using an OCaml regex
- "procedure": match a substring of the procedure
name
- "procedure_regex": as above, but match using an
@@ -1794,50 +1785,37 @@
Stop exploring new paths after +
Stop exploring new paths after int loop iterations
---python-globals { -own-by-closures | own-by-module }
- -Specify the strategy to wire -globals dictionnaire into each function
- -- own-by-closures: each closure
-captured the global
-dictionary
-- own-by-module: each function is given the global
-dictionary as
-argument (not referenced in the heap to avoid aliases)
--racerd-always-report-java
+--racerd-always-report-java
-Activates: Every Java class +
Activates: Every Java class analysed is treated as if it were annotated as @ThreadSafe. (Conversely: --no-racerd-always-report-java)
---racerd-guardedby
+--racerd-guardedby
-Activates: Check @GuardedBy +
Activates: Check @GuardedBy annotations with RacerD (Conversely: --no-racerd-guardedby)
---racerd-ignore-classes +
--racerd-ignore-classes +string
-Any method in a class specified +
Any method in a class specified here will be ignored by RacerD.
---threadsafe-aliases +
--threadsafe-aliases json
-Specify custom annotations that +
Specify custom annotations that should be considered aliases of @ThreadSafe
--siof-check-iostreams
+--siof-check-iostreams
-Activates: Do not assume that +
Activates: Do not assume that iostreams (cout, cerr, ...) are always initialized. The default is to assume they are always initialized to avoid false positives. However, if your program compiles against a recent libstdc++ then it is safe to turn this option on. (Conversely: --no-siof-check-iostreams)
---siof-safe-methods +
--siof-safe-methods +string
-Methods that are SIOF-safe; +
Methods that are SIOF-safe; "foo::bar" will match "foo::bar()", "foo<int>::bar()", etc. (can be specified multiple times)
@@ -1869,10 +1847,10 @@INFER_ARGS, +
INFER_ARGS, INFERCONFIG, INFER_STRICT_MODE
-See the ENVIRONMENT section in +
See the ENVIRONMENT section in the manual of infer(1).
.inferconfig
+.inferconfig
-See the FILES section in the +
See the FILES section in the manual of infer(1).
infer-report(1), +
infer-report(1), infer-run(1)
infer-capture - +
infer-capture - capture source files for later analysis
infer
-capture --buck-java [options] -- buck
-...
+
infer capture
+--buck-java [options] -- buck ...
+
infer capture --buck-clang [options] --
buck ...
infer capture --buck-compilation-database [no-]deps
@@ -80,7 +80,7 @@ DESCRIPTION
-
Capture the +
Capture the build command, compilation database, or cfg/tenv json files specified on the command line: infer intercepts calls to the compiler to read source files, translate them into infer's @@ -93,29 +93,29 @@
--capture-block-list +
--capture-block-list json
-Matcher or list of matchers for +
Matcher or list of matchers for names of files that should not be captured, hence not analyzed either. Clang, Java, and Hack only.
---cfg-json +
--cfg-json file
-Path to CFG json file
+Path to CFG json file
---continue
+--continue
-Activates: Continue the capture +
Activates: Continue the capture for the reactive analysis, increasing the changed files/procedures. (If a procedure was changed beforehand, keep the changed marking.) (Conversely: --no-continue)
---debug,-g
+--debug,-g
-Activates: Debug mode (also +
Activates: Debug mode (also sets --debug-level 2, --developer-mode, --print-buckets, --print-types, --reports-include-ml-loc, @@ -123,47 +123,47 @@
--debug-level +
--debug-level level
-Debug level (sets +
Debug level (sets --bo-debug level, --debug-level-analysis level, --debug-level-capture level):
-- 0: only basic debugging +
- 0: only basic debugging
enabled
- 1: verbose debugging enabled
- 2: very verbose debugging enabled
--debug-level-analysis int
Debug level for the analysis. +
Debug level for the analysis. See --debug-level for accepted values.
---debug-level-capture +
--debug-level-capture int
-Debug level for the capture. +
Debug level for the capture. See --debug-level for accepted values.
---debug-level-report +
--debug-level-report int
-Debug level for the report. See +
Debug level for the report. See --debug-level for accepted values.
---force-delete-results-dir
+--force-delete-results-dir
-Activates: Do not refuse to +
Activates: Do not refuse to delete the results directory if it doesn't look like an infer results directory. (Conversely: --no-force-delete-results-dir)
---force-integration +
--force-integration command
-Proceed as if the first +
Proceed as if the first argument after -- was command. Possible values: ant, buck1, buck, buck2, gradle, gradlew, java, javac, @@ -173,41 +173,40 @@
--help
+--help
-Show this manual
+Show this manual
---help-format { auto -| groff | pager | plain }
+--help-format { auto | +groff | pager | plain }
-Show this help in the specified +
Show this help in the specified format. auto sets the format to plain if the environment variable TERM is "dumb" or undefined, and to pager otherwise.
---help-full
+--help-full
-Show this manual with all +
Show this manual with all internal options in the INTERNAL OPTIONS section
---keep-going
+--keep-going
-Activates: Keep going when the +
Activates: Keep going when the analysis or capture encounter a failure (Conversely: --no-keep-going)
- ---load-average,-l +
--load-average,-l float
-Do not start new parallel jobs +
Do not start new parallel jobs if the load average is greater than that specified (Buck and make only)
---mark-unchanged-procs
+--mark-unchanged-procs
-Activates: Check structural +
Activates: Check structural identity of newly-captured procedures with previously-captured versions, marking the new procedure as unchanged if the two are equivalent. Also prevents removing @@ -215,110 +214,109 @@
--merge-capture +
--merge-capture +string
-Specifies an Infer results +
Specifies an Infer results directory. The files and procedures captured in it will be merged together into the results directory specified with -o. Relative paths are interpreted as relative to project-root/buck-out.
---never-returning-null +
--never-returning-null json
-[Java only, all analyses] +
[Java only, all analyses] Matcher or list of matchers for functions that never return null.
---print-logs
+--print-logs
-Activates: Also log messages to +
Activates: Also log messages to stdout and stderr (Conversely: --no-print-logs)
---progress-bar-style -{ auto | plain | multiline }
+--progress-bar-style { +auto | plain | multiline }
-Style of the progress bar. +
Style of the progress bar. auto selects multiline if connected to a tty, otherwise plain.
- ---project-root,-C +
--project-root,-C dir
-Specify the root directory of +
Specify the root directory of the project
---python-files-index +
--python-files-index path
-A file containing a list of +
A file containing a list of newline-separated Python files to capture. Compatible with infer capture -- python3 file1.py file2.py but not with --pyc-file.
---results-dir,-o +
--results-dir,-o dir
-Write results and internal +
Write results and internal files in the specified directory
---run-python-interpreter
+--run-python-interpreter
-Activates: Capture all .py +
Activates: Capture all .py files, transform them into internal PyIR form and run the PyIR interpreter on them. (Conversely: --no-run-python-interpreter)
---skip-analysis-in-path +
--skip-analysis-in-path +regex
-Ignore files whose path matches +
Ignore files whose path matches a given regex (can be specified multiple times, but you must make sure each regex is properly bracketed)
---sqlite-cache-size +
--sqlite-cache-size int
-SQLite cache size in pages (if +
SQLite cache size in pages (if positive) or kB (if negative), follows formal of corresponding SQLite PRAGMA.
---sqlite-lock-timeout +
--sqlite-lock-timeout int
-Timeout for SQLite results +
Timeout for SQLite results database operations, in milliseconds.
---sqlite-max-blob-size +
--sqlite-max-blob-size int
-Maximum blob/string size for +
Maximum blob/string size for data written in SQLite.
---sqlite-mmap-size +
--sqlite-mmap-size int
-Size of memory map for mmaped +
Size of memory map for mmaped SQLite databases, zero value disables memory mapping.
---sqlite-page-size +
--sqlite-page-size int
-SQLite page size in bytes, must +
SQLite page size in bytes, must be a power of two between 512 and 65536.
---tenv-json +
--tenv-json file
-Path to TEnv json file
+Path to TEnv json file
---workspace +
--workspace path
-Specifies the root of the +
Specifies the root of the workspace, which is a directory containing --project-root. This can be needed if the capture phase is expected to require several different @@ -328,13 +326,13 @@