Add /Wall when running code analysis only? - c++

During my regular builds, I have /W4 turned on, with a few additional warnings as well, and some that are simply disabled due to too many false positives with Visual Studio. This mostly works okay, but I'd still like, from time to time, to check on all warnings which /Wall would give.
My preference would be to do this during Code Analysis, which I run about once a week anyway. I already have a custom ruleset file for CA, but I can't figure out how to enable additional non-CA warnings in it. I've also tried looking in the .vcxproj files to see if there's anything in there which is specific to CA, but I couldn't find anything.
Additional info: I use CMake to create the projects, so it would be preferred if it's something I can do in there, but I can probably modify my CMake myself to work with potential solutions. Also, all projects are C++ (not CLI) except one which is C#.

Related

How to run Code analysis on project files only

I have recently upgraded from Visual Studio 2012 to 2017 and I'm experimenting with the Code Analysis features (which seem to be far more capable than they were in 2012).
The problem I have is that I'll get many results for code dependencies, whereas I am really only interested in my own local project files. This is particularly true when I have Enable C++ Core Check (Released) enabled.
For example, as shown above, I receive multitudes of analysis results for the boost libraries. There are tons of results for xerces-c, and other libraries which I'm using as well.
Is there a way to restrict the analysis to only those files which I have written myself (local to the project)?
There isn't a flag or setting that I'm aware of to directly accomplish this, but you can get something close by using #pragma warning to change the warning level (or disable specific warnings) before you include those library headers, then restore the warning level before including your own.
It isn't perfect, and could result in suppressing warnings you'd want to see, but if you only disable them during Code Analysis that wouldn't be an issue.

What options allow me to properly step through code in Visual Studio 2010?

I'm trying to debug a pre-configured and optimized C++ project. I disabled "Optimization" under C++ -> Optimization -> Optimization. However when I step through code sometimes it jumps around randomly and often it doesn't show the proper values for local variables.
As others have said, you need a build with optimisations switched off and debug info being generated. I assume you're already generating a PDB for your release build.
The key here that there is no 'debug mode' - just different project settings. So it's possible (likely even) that while some of the settings in the debug config cause your build to fail, others (possibly including switching off optimisations and enabling debug info) may work fine.
I suggest you experiment with changing the properties one at a time. It's likely that you can take your working config, switch off optimisations, and it'll build fine. If so, you can keep the modified vcproj for yourself or create a new project config containing the changes, to share with your colleagues.
(sorry, not enough rep to post as comment)

Applying compiler options to specific files

I am trying to compile and build a project(s) in visual studio and I started looking into compiling with the /Wall option which gives all warnings.
I am wondering iof there is a way to run this only on those files I am interested in, since currently I get a million warnings on files i have no ability or desire to change.
In the Solution Explorer select the files you want all warnings for, right click and select Properties. From there you can adjust whatever compiler settings you want to for those files, just about like you would for the entire project.
Another approach that can work is to use the #pragma warning( ... ) modifiers.
This lets you controls specific warnings as well as the overall setting. See the documentation at http://msdn.microsoft.com/en-us/library/2c8f766e(v=vs.80).aspx
If a library or subproject causes a problem then you might be able to turn off warnings for it in a single place.
Modifying the project file for subsets of your files can get very messy very quickly, especially if you have multiple architectures and targets (debug, release, ...)
I prefer to modify the project files by hand in a text editor for this type of change so I am sure that everything is happening as expected.
If there is a Makefile (or equivalent) for your part of the project (e.g. a directory), then you may be able to add the the /Wall warning flag only for that part
WARNING_FLAGS += /Wall
(It still is not per file, but this may be more manageable.)
Another option is to put all the warning messages and filter (e.g. grep) for the file names you are interested.

Dead code identification (C++)

I have a large legacy C++ project compiled under Visual Studio 2008. I know there is a reasonably amount of 'dead' code that is not accessed anywhere -- methods that are not called, whole classes that are not used.
I'm looking for a tool that will identify this by static analysis.
This question: Dead code detection in legacy C/C++ project suggests using code coverage tools. This isn't an option as the test coverage just isn't high enough.
It also mentions a -Wunreachable-code. option to gcc. I'd like something similar for Visual Studio. We already use the linker's /OPT:REF option to remove redundant code, but this doesn't report the dead code at a useful level (when used with /VERBOSE there are over 100,000 lines, including a lot from libraries).
Are there any better options that work well with a Visual Studio project?
I know that Gimpel's Lint products (PC-Lint and Flexelint) will identify unreachable code and unused / unreferenced modules.
They both fall in the category of static analysis tools.
I have no affiliation w/ Gimpel, just a satisfied long-term customer.
You'll want something along the lines of QA-C++ (http://www.programmingresearch.com/QACPP_MAIN.html), also see http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis for similar products.
You're looking for a static code analysis tool that detects unreachable code; many coding guidelines (such as MISRA-C++, if I'm not mistaken) require that no unreachable code exists. An analysis tool geared specifically to enforce such a guideline would be your best bet.
And you'll like be able to find other uses for the tool as well.
I dont know Visual C, and had also recommended the -Wunreachable-code specific coverage tools. As solution for your situation I would try the following:
Make with ctags (or similar programm) a list of all your symbols in your source
Enable in your compiler the dead code elimination (I would assume it defaults to on)
Enable your whole-program/link time optimizations (so he knows that not used functions in your moduls are not required by other externals and get discarded)
Take the symbols from your binary and compare them with the symbols from 1.
Another approach could be some call graph generating tool (e.g. doxygen).
I suggest you use a couple approaches:
1. GCC has some useful compilation flags:
-Wunused-function
-Wunused-label
-Wunused-value
-Wunused-variable
-Wunused-parameter
-Wunused-but-set-parameter
2. Cppcheck has some useful features like:
--enable=unusedFunction
3. Use static analyzer as was suggest before.
One approach that works for me - with Delphi - is to enable debugging, and run your program under the debugger.
When a Delphi program is run under the debugger, the IDE shows in the margin which lines of code can be set as breakpoints. Code which is truly dead - i.e., has been stripped out by the linker/compiler is obvious as breakpoints can't be set there.
Some additional notes, as commenters seem to misunderstand this:
a: You don't need to try setting a breakpoint on each line. Just open up the source file in the IDE, and quickly scroll through it. Dead code is easily spotted.
b: This is NOT a 'code coverage' check. You don't need to run the application to see if it reaches the lines.
c: I'm not familiar enough VS2008 so can't say if this suggestion will work.
Either
1) MSVC's under-used in built static analysis tool.
2) The MSVC marketplace has lots of tools including support for most free tools, including CppCheck
You will need the latest version of Visual Studio for market place applications, but the free "Community Edition" has very lenient licencing.
Write a script that randomly deletes a function (from the source code) and recompiles everything from scratch. If it still compiles - that function was dead code.

Using Makefile instead of Solution/Project files under Visual Studio (2005)

Does anyone have experience using makefiles for Visual Studio C++ builds (under VS 2005) as opposed to using the project/solution setup. For us, the way that the project/solutions work is not intuitive and leads to configuruation explosion when you are trying to tweak builds with specific compile time flags.
Under Unix, it's pretty easy to set up a makefile that has its default options overridden by user settings (or other configuration setting). But doing these types of things seems difficult in Visual Studio.
By way of example, we have a project that needs to get build for 3 different platforms. Each platform might have several configurations (for example debug, release, and several others). One of my goals on a newly formed project is to have a solution that can have all platform build living together, which makes building and testing code changes easier since you aren't having to open 3 different solutions just to test your code. But visual studio will require 3 * (number of base configurations) configurations. i.e. PC Debug, X360 Debug, PS3 Debug, etc.
It seems like a makefile solution is much better here. Wrapped with some basic batchfiles or scripts, it would be easy to keep the configuration explotion to a minimum and only maintain a small set of files for all of the different builds that we have to do.
However, I have no experience with makefiles under visual studio and would like to know if others have experiences or issues that they can share.
Thanks.
(post edited to mention that these are C++ builds)
I've found some benefits to makefiles with large projects, mainly related to unifying the location of the project settings. It's somewhat easier to manage the list of source files, include paths, preprocessor defines and so on, if they're all in a makefile or other build config file. With multiple configurations, adding an include path means you need to make sure you update every config manually through Visual Studio's fiddly project properties, which can get pretty tedious as a project grows in size.
Projects which use a lot of custom build tools can be easier to manage too, such as if you need to compile pixel / vertex shaders, or code in other languages without native VS support.
You'll still need to have various different project configurations however, since you'll need to differentiate the invocation of the build tool for each config (e.g. passing in different command line options to make).
Immediate downsides that spring to mind:
Slower builds: VS isn't particularly quick at invoking external tools, or even working out whether it needs to build a project in the first place.
Awkward inter-project dependencies: It's fiddly to set up so that a dependee causes the base project to build, and fiddlier to make sure that they get built in the right order. I've had some success getting SCons to do this, but it's always a challenge to get working well.
Loss of some useful IDE features: Edit & Continue being the main one!
In short, you'll spend less time managing your project configurations, but more time coaxing Visual Studio to work properly with it.
Visual studio is being built on top of the MSBuild configurations files. You can consider *proj and *sln files as makefiles. They allow you to fully customize build process.
While it's technically possible, it's not a very friendly solution within Visual Studio. It will be fighting you the entire time.
I recommend you take a look at NAnt. It's a very robust build system where you can do basically anything you need to.
Our NAnt script does this on every build:
Migrate the database to the latest version
Generate C# entities off of the database
Compile every project in our "master" solution
Run all unit tests
Run all integration tests
Additionally, our build server leverages this and adds 1 more task, which is generating Sandcastle documentation.
If you don't like XML, you might also take a look at Rake (ruby), Bake/BooBuildSystem (Boo), or Psake (PowerShell)
You can use nant to build the projects individually thus replacing the solution and have 1 coding solution and no build solutions.
1 thing to keep in mind, is that the solution and csproj files from vs 2005 and up are msbuild scripts. So if you get acquainted with msbuild you might be able to wield the existing files, to make vs easier, and to make your deployment easier.
We have a similar set up as the one you are describing. We support at least 3 different platforms, so the we found that using CMake to mange the different Visual Studio solutions. Set up can be a bit painful, but it pretty much boils down to reading the docs and a couple of tutorials. You should be able to do virtually everything you can do by going to the properties of the projects and the solution.
Not sure if you can have all three platforms builds living together in the same solution, but you can use CruiseControl to take care of your builds, and running your testing scripts as often as needed.