NAME infer-analyze - analyze the files captured by infer SYNOPSIS infer analyze [options] infer [options] DESCRIPTION Analyze the files captured in the project results directory and report. OPTIONS --annotation-reachability Activates: checker annotation-reachability: Given a pair of source and sink annotation, e.g. `@PerformanceCritical` and `@Expensive`, this checker will warn whenever some method annotated with `@PerformanceCritical` calls, directly or indirectly, another method annotated with `@Expensive` (Conversely: --no-annotation-reachability) --annotation-reachability-only Activates: Enable annotation-reachability and disable all other checkers (Conversely: --no-annotation-reachability-only) --no-biabduction Deactivates: checker biabduction: This analysis deals with a range of issues, many linked to memory safety. (Conversely: --biabduction) --biabduction-only Activates: Enable biabduction and disable all other checkers (Conversely: --no-biabduction-only) --biabduction-write-dotty Activates: Produce dotty files for specs and retain cycles reports in infer-out/captured. (Conversely: --no-biabduction-write-dotty) --bufferoverrun Activates: checker bufferoverrun: InferBO is a detector for out-of-bounds array accesses. (Conversely: --no-bufferoverrun) --bufferoverrun-only Activates: Enable bufferoverrun and disable all other checkers (Conversely: --no-bufferoverrun-only) --changed-files-index file Specify the file containing the list of source files from which reactive analysis should start. Source files should be specified relative to project root or be absolute --config-checks-between-markers Activates: checker config-checks-between-markers: [EXPERIMENTAL] Collects config checks between marker start and end. (Conversely: --no-config-checks-between-markers) --config-checks-between-markers-only Activates: Enable config-checks-between-markers and disable all other checkers (Conversely: --no-config-checks-between-markers-only) --config-impact-analysis Activates: checker config-impact-analysis: [EXPERIMENTAL] Collects function that are called without config checks. (Conversely: --no-config-impact-analysis) --config-impact-analysis-only Activates: Enable config-impact-analysis and disable all other checkers (Conversely: --no-config-impact-analysis-only) --continue-analysis Activates: Continue the analysis after more targets are captured by --continue. The other analysis options should be given the same before. Not compatible with --reanalyze and --incremental-analysis. (Conversely: --no-continue-analysis) --cost Activates: checker cost: Computes the time complexity of functions and methods. Can be used to detect changes in runtime complexity with `infer reportdiff`. (Conversely: --no-cost) --cost-only Activates: Enable cost and disable all other checkers (Conversely: --no-cost-only) --no-cost-suppress-func-ptr Deactivates: Suppress printing function pointers in cost reports (Conversely: --cost-suppress-func-ptr) --custom-symbols json Specify named lists of symbols available to rules --debug,-g Activates: Debug mode (also sets --debug-level 2, --developer-mode, --print-buckets, --print-types, --reports-include-ml-loc, --no-only-cheap-debug, --trace-error, --write-html) (Conversely: --no-debug | -G) --debug-level level Debug level (sets --bo-debug level, --debug-level-analysis level, --debug-level-capture level, --debug-level-linters level): - 0: only basic debugging enabled - 1: verbose debugging enabled - 2: very verbose debugging enabled --debug-level-analysis int Debug level for the analysis. See --debug-level for accepted values. --debug-level-capture int Debug level for the capture. See --debug-level for accepted values. --debug-level-linters int Debug level for the linters. See --debug-level for accepted values. --no-deduplicate Deactivates: Apply issue-specific deduplication during analysis and/or reporting. (Conversely: --deduplicate) --no-default-checkers Deactivates: Default checkers: --biabduction, --fragment-retains-view, --inefficient-keyset-iterator, --linters, --liveness, --racerd, --dotnet-resource-leak, --siof, --self-in-block, --starvation (Conversely: --default-checkers) --eradicate Activates: checker eradicate: The eradicate `@Nullable` checker for Java annotations. (Conversely: --no-eradicate) --eradicate-only Activates: Enable eradicate and disable all other checkers (Conversely: --no-eradicate-only) --no-fragment-retains-view Deactivates: checker fragment-retains-view: Detects when Android fragments are not explicitly nullified before becoming unreachable. (Conversely: --fragment-retains-view) --fragment-retains-view-only Activates: Enable fragment-retains-view and disable all other checkers (Conversely: --no-fragment-retains-view-only) --help Show this manual --help-format { auto | groff | pager | plain } Show this help in the specified format. auto sets the format to plain if the environment variable TERM is "dumb" or undefined, and to pager otherwise. --help-full Show this manual with all internal options in the INTERNAL OPTIONS section --immutable-cast Activates: checker immutable-cast: Detection of object cast from immutable types to mutable types. For instance, it will detect casts from `ImmutableList` to `List`, `ImmutableMap` to `Map`, and `ImmutableSet` to `Set`. (Conversely: --no-immutable-cast) --immutable-cast-only Activates: Enable immutable-cast and disable all other checkers (Conversely: --no-immutable-cast-only) --impurity Activates: checker impurity: Detects functions with potential side-effects. Same as "purity", but implemented on top of Pulse. (Conversely: --no-impurity) --impurity-only Activates: Enable impurity and disable all other checkers (Conversely: --no-impurity-only) --impurity-report-immutable-modifications Activates: Report modifications to immutable fields in the Impurity checker (Conversely: --no-impurity-report-immutable-modifications) --no-inefficient-keyset-iterator Deactivates: checker inefficient-keyset-iterator: Check for inefficient uses of iterators that iterate on keys then lookup their values, instead of iterating on key-value pairs directly. (Conversely: --inefficient-keyset-iterator) --inefficient-keyset-iterator-only Activates: Enable inefficient-keyset-iterator and disable all other checkers (Conversely: --no-inefficient-keyset-iterator-only) --jobs,-j int Run the specified number of analysis jobs simultaneously --keep-going Activates: Keep going when the analysis encounters a failure (Conversely: --no-keep-going) --no-linters Deactivates: checker linters: Declarative linting framework over the Clang AST. (Conversely: --linters) --linters-only Activates: Enable linters and disable all other checkers (Conversely: --no-linters-only) --litho-required-props Activates: checker litho-required-props: Checks that all non-optional `@Prop`s have been specified when constructing Litho components. (Conversely: --no-litho-required-props) --litho-required-props-only Activates: Enable litho-required-props and disable all other checkers (Conversely: --no-litho-required-props-only) --no-liveness Deactivates: checker liveness: Detection of dead stores and unused variables. (Conversely: --liveness) --liveness-ignored-constant +string List of integer constants to be ignored by liveness analysis --liveness-only Activates: Enable liveness and disable all other checkers (Conversely: --no-liveness-only) --loop-hoisting Activates: checker loop-hoisting: Detect opportunities to hoist function calls that are invariant outside of loop bodies for efficiency. (Conversely: --no-loop-hoisting) --loop-hoisting-only Activates: Enable loop-hoisting and disable all other checkers (Conversely: --no-loop-hoisting-only) --max-jobs int Maximum number of analysis jobs running simultaneously --memtrace-analysis-profiling Activates: Generate OCaml analysis allocation traces in `infer-out/memtrace`. (Conversely: --no-memtrace-analysis-profiling) --memtrace-sampling-rate float Sampling rate for Memtrace allocation profiling. Default is 1e-6. --print-active-checkers Activates: Print the active checkers before starting the analysis (Conversely: --no-print-active-checkers) --print-logs Activates: Also log messages to stdout and stderr (Conversely: --no-print-logs) --printf-args Activates: checker printf-args: Detect mismatches between the Java `printf` format strings and the argument types For example, this checker will warn about the type error in `printf("Hello %d", "world")` (Conversely: --no-printf-args) --printf-args-only Activates: Enable printf-args and disable all other checkers (Conversely: --no-printf-args-only) --progress-bar-style { auto | plain | multiline } Style of the progress bar. auto selects multiline if connected to a tty, otherwise plain. --project-root,-C dir Specify the root directory of the project --pulse Activates: checker pulse: Memory and lifetime analysis. (Conversely: --no-pulse) --pulse-cut-to-one-path-procedures-pattern string Regex of methods for which pulse will only explore one path. Can be used on pathologically large procedures to prevent too-big states from being produced. --pulse-model-abort +string Methods that should be modelled as abort in Pulse --pulse-model-alloc-pattern string Regex of methods that should be modelled as allocs in Pulse --pulse-model-free-pattern string Regex of methods that should be modelled as wrappers to free(3) in Pulse. The pointer to be freed should be the first argument of the function. This should only be needed if the code of the wrapper is not visible to infer or if Pulse somehow doesn't understand it (e.g. the call is dispatched to global function pointers). --pulse-model-malloc-pattern string Regex of methods that should be modelled as wrappers to malloc(3) in Pulse. The size to allocate should be the first argument of the function. See --pulse-model-free-pattern for more information. --pulse-model-realloc-pattern string Regex of methods that should be modelled as wrappers to realloc(3) in Pulse. The pointer to be reallocated should be the first argument of the function and the new size the second argument. See --pulse-model-free-pattern for more information. --pulse-model-release-pattern string Regex of methods that should be modelled as release in Pulse --pulse-model-return-first-arg string Regex of methods that should be modelled as returning the first argument in Pulse --pulse-model-return-nonnull string Regex of methods that should be modelled as returning non-null in Pulse --pulse-model-skip-pattern string Regex of methods that should be modelled as "skip" in Pulse --pulse-model-transfer-ownership +string Methods that should be modelled as transfering memory ownership in Pulse. Accepted formats are method or namespace::method --pulse-only Activates: Enable pulse and disable all other checkers (Conversely: --no-pulse-only) --pulse-prune-unsupported-arithmetic Activates: The arithmetic engine in Pulse sometimes does not detect that the collection of conditions on the path makes it infeasible, especially outside the well-supported linear arithmetic fragment. To avoid false positives, Pulse tries to detect when there is a possibility of imprecise arithmetic treatment and if so pessimistically assumes the path is infeasible. (Conversely: --no-pulse-prune-unsupported-arithmetic) --pulse-report-ignore-unknown-java-methods-patterns +string On Java, issues that are found on program paths that contain calls to unknown methods (those without implementation) are not reported unless all the unknown method names match this pattern. If the empty list is provided with --pulse-report-ignore-unknown-java-methods-patterns-reset, all issues will be reported regardless the presence of unknown code --purity Activates: checker purity: Detects pure (side-effect-free) functions. A different implementation of "impurity". (Conversely: --no-purity) --purity-only Activates: Enable purity and disable all other checkers (Conversely: --no-purity-only) --quandary Activates: checker quandary: The Quandary taint analysis detects flows of values between sources and sinks, except if the value went through a "sanitizer". In addition to some defaults, users can specify their own sources, sinks, and sanitizers functions. (Conversely: --no-quandary) --quandary-only Activates: Enable quandary and disable all other checkers (Conversely: --no-quandary-only) --quiet,-q Activates: Do not print anything on standard output. (Conversely: --no-quiet | -Q) --no-racerd Deactivates: checker racerd: Thread safety analysis. (Conversely: --racerd) --racerd-only Activates: Enable racerd and disable all other checkers (Conversely: --no-racerd-only) --reactive,-r Activates: Reactive mode: the analysis starts from the files captured since the infer command started (Conversely: --no-reactive | -R) --no-report Deactivates: Run the reporting phase once the analysis has completed (Conversely: --report) --report-force-relative-path Activates: Force converting an absolute path to a relative path to the root directory (Conversely: --no-report-force-relative-path) --results-dir,-o dir Write results and internal files in the specified directory --scheduler { file | restart | callgraph } Specify the scheduler used for the analysis phase: - file: schedule one job per file - callgraph: schedule one job per procedure, following the syntactic call graph. Usually faster than "file". - restart: same as callgraph but uses locking to try and avoid duplicate work between different analysis processes and thus performs better in some circumstances --no-self-in-block Deactivates: checker self-in-block: An Objective-C-specific analysis to detect when a block captures `self`. (Conversely: --self-in-block) --self-in-block-only Activates: Enable self-in-block and disable all other checkers (Conversely: --no-self-in-block-only) --no-siof Deactivates: checker siof: Catches Static Initialization Order Fiascos in C++, that can lead to subtle, compiler-version-dependent errors. (Conversely: --siof) --siof-only Activates: Enable siof and disable all other checkers (Conversely: --no-siof-only) --sqlite-cache-size int SQLite cache size in pages (if positive) or kB (if negative), follows formal of corresponding SQLite PRAGMA. --sqlite-lock-timeout int Timeout for SQLite results database operations, in milliseconds. --sqlite-page-size int SQLite page size in bytes, must be a power of two between 512 and 65536. --no-starvation Deactivates: checker starvation: Detect various kinds of situations when no progress is being made because of concurrency errors. (Conversely: --starvation) --starvation-only Activates: Enable starvation and disable all other checkers (Conversely: --no-starvation-only) --topl Activates: checker topl: Detect errors based on user-provided state machines describing temporal properties over multiple objects. (Conversely: --no-topl) --topl-only Activates: Enable topl and disable all other checkers (Conversely: --no-topl-only) --uninit Activates: checker uninit: Warns when values are used before having been initialized. (Conversely: --no-uninit) --uninit-only Activates: Enable uninit and disable all other checkers (Conversely: --no-uninit-only) --write-html Activates: Produce html debug output for the analyses in infer-out/captured. This shows the abstract state of all analyses at each program point in the source code. Each captured source file has its own html page. This HTML file contains the source file, and at each line of the file there are links to the nodes of the control flow graph of Infer's translation of that line of code into its intermediate representation (SIL). This way it's possible to see what the translation is, and the details of the symbolic execution on each node. (Conversely: --no-write-html) --xcode-isysroot-suffix string Specify the suffix of Xcode isysroot directory, to avoid absolute paths in tests BUCK OPTIONS --merge Activates: Merge the captured results directories specified in the dependency file. (Conversely: --no-merge) BUFFER OVERRUN OPTIONS --bo-debug int Debug level for buffer-overrun checker (0-4) --bo-field-depth-limit int Limit of field depth of abstract location in buffer-overrun checker CLANG OPTIONS --annotation-reachability-cxx json Specify annotation reachability analyses to be performed on C/C++/ObjC code. Each entry is a JSON object whose key is the issue name. "sources" and "sinks" can be specified either by symbol (including regexps) or path prefix. "sinks" optionally can specify "overrides" (by symbol or path prefix) that block the reachability analysis when hit. Example: { "ISOLATED_REACHING_CONNECT": { "doc_url": "http:://example.com/issue/doc/optional_link.html", "sources": { "desc": "Code that should not call connect [optional]", "paths": [ "isolated/" ] }, "sinks": { "symbols": [ "connect" ], "overrides": { "symbol_regexps": [ ".*::Trusted::.*" ] } } } } This will cause us to create a new ISOLATED_REACHING_CONNECT issue for every function whose source path starts with "isolated/" that may reach the function named "connect", ignoring paths that go through a symbol matching the OCaml regexp ".*::Trusted::.*". --annotation-reachability-cxx-sources json Override sources in all cxx annotation reachability specs with the given sources spec --biabduction-unsafe-malloc Activates: Assume that malloc(3) never returns null. (Conversely: --no-biabduction-unsafe-malloc) --clang-compound-literal-init-limit int Limit after which initialization of compound types (structs and arrays) is not done element by element but using a builtin function that each analysis has to model. --cxx-scope-guards json Specify scope guard classes that can be read only by destructors without being reported as dead stores. --liveness-dangerous-classes json Specify classes where the destructor should be ignored when computing liveness. In other words, assignement to variables of these types (or common wrappers around these types such as unique_ptr) will count as dead stores when the variables are not read explicitly by the program. JAVA OPTIONS --annotation-reachability-custom-pairs json Specify custom sources/sink for the annotation reachability checker Example format: for custom annotations com.my.annotation.{Source1,Source2,Sink1} { "sources" : ["Source1", "Source2"], "sink" : "Sink1" } --external-java-packages +prefix Specify a list of Java package prefixes for external Java packages. If set, the analysis will not report non-actionable warnings on those packages. --java-version int The version of Java being used. Set it to your Java version if mvn is failing. QUANDARY CHECKER OPTIONS --quandary-endpoints json Specify endpoint classes for Quandary --quandary-sanitizers json Specify custom sanitizers for Quandary --quandary-sinks json Specify custom sinks for Quandary --quandary-sources json Specify custom sources for Quandary RACERD CHECKER OPTIONS --racerd-guardedby Activates: Check @GuardedBy annotations with RacerD (Conversely: --no-racerd-guardedby) --no-racerd-unknown-returns-owned Deactivates: DEPRECATED, does nothing. (Conversely: --racerd-unknown-returns-owned) --threadsafe-aliases json Specify custom annotations that should be considered aliases of @ThreadSafe SIOF CHECKER OPTIONS --siof-check-iostreams Activates: Do not assume that iostreams (cout, cerr, ...) are always initialized. The default is to assume they are always initialized to avoid false positives. However, if your program compiles against a recent libstdc++ then it is safe to turn this option on. (Conversely: --no-siof-check-iostreams) --siof-safe-methods +string Methods that are SIOF-safe; "foo::bar" will match "foo::bar()", "foo::bar()", etc. (can be specified multiple times) ENVIRONMENT INFER_ARGS, INFERCONFIG, INFER_STRICT_MODE See the ENVIRONMENT section in the manual of infer(1). FILES .inferconfig See the FILES section in the manual of infer(1). SEE ALSO infer-report(1), infer-run(1)