iOS 静态代码分析

官网： http://clang-analyzer.llvm.org/

【问题类型】

1  retain和release的正确使用
2  未使用的实例变量
3  未初始化的变量
4  无法到达的代码路径
5  引用空指针
6  除0
7  类型不兼容
8  缺少dealloc

9  内存泄漏

【使用方式】

1. 使用xcodebuild ... clean build analyze  或者加上RUN_CLANG_STATIC_ANALYZER=YES

输出报告：各个模块会生成在自己的build目录下/Users/builder/Library/Developer/Xcode/DerivedData/YY2-ekfapvflopyuogfnccpmryrhzpbf/Build/Intermediates/Pods.build/Distribute-iphoneos/Pods-GTM.build/StaticAnalyzer/Pods/Pods-GTM/normal/armv7/Pods-GTM-dummy.plist  。但没找到解析后的html信息。试着带上CLANG_ANALYZER_OUTPUT_DIR，可以改变StaticAnalyzer的输出目录。

2. 在xcodebuild前使用scan-build

输出报告：可通过-o参数指定，然后基于它加上随机数自动生成CLANG_ANALYZER_OUTPUT_DIR = /data/DUOWAN_BUILD/mobile/mobile-ios_analyzer/checkReports/2014-03-05-173031-54544-1

命令格式：

Option	Description
-o	Target directory for HTML report files. Subdirectories will be created as needed to represent separate "runs" of the analyzer. If this option is not specified, a directory is created in /tmp to store the reports.
-h (or no arguments)	Display all scan-build options.
-k --keep-going	Add a "keep on going" option to the specified build command.This option currently supports make and xcodebuild. This is a convenience option; one can specify this behavior directly using build options.
-v	Verbose output from scan-build and the analyzer. A second and third "-v" increases verbosity, and is useful for filing bug reports against the analyzer.
-V	View analysis results in a web browser when the build command completes.
--use-analyzer Xcode or --use-analyzer [path to clang]	scan-build uses the 'clang' executable relative to itself for static analysis. One can override this behavior with this option by using the 'clang' packaged with Xcode (on OS X) or from the PATH.

说明：

1. 建议分析debug配置

2. 在模拟器进行

3. Don't sign code

例子：

$CLANG_HOME/scan-build -k -v -v --use-analyzer $CLANG_HOME/bin/clang -o ./clangScanBuildReports xcodebuild -workspace YY2.xcworkspace -scheme YY2 -configuration Debug -sdk iphonesimulator

3. jenkins集成 clang-scanbuild-plugin,需要设置Target/workspace/scheme/sdk/等信息

输出报告：/data/DUOWAN_BUILD/mobile/mobile-ios_analyzer/clangScanBuildReports/2014-03-05-165238-25536-1

说明：

1. 使用此插件需要配置Target或者scheme或者如果编译要求有workspace也要带上，如果应用多了，这些值信息不一样，要为每个配置不同的信息有点难维护。

【小知识】

1. xcode5默认的clang路径/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang

2.  sudo ./set-xcode-analyzer --use-checker-build=$clang_path 可以重设xcode集成的clang  官方介绍：http://clang-analyzer.llvm.org/xcode.html

3. 使用sudo  ./set-xcode-analyzer 更改clang，如果要用回xcode，则直接使用--use-xcode-clang。如果使用--use-checker-build来指定xcode自带clang的路径，则你在xcodebuild前使用/opt/tools/checker/scan-build,过程数据是显示了CLANG_ANALYZER_EXEC = /opt/tools/checker/bin/clang,但在解析的过程还是直接使用了你指定xcode自带clang的路径。

4. 使用clang新版本解析会比使用xcode自带的clang找到更多的问题。

【FAQ】

问：使用xcodebuild可以添加RUN_CLANG_STATIC_ANALYZER=YES;问题：如何在jenkins显示解析的结果

答： 没找到如果使用xcodebuild来clang其完整的输出报告。想要集成jenkins显示解析结果：

1. 直接使用jenkins插件，然后增加构建步骤：Clang Scan-Build 

2. 如果不想配置Clang Scan-Build步骤，那么可以直接在原来xcodebuild的基础上加上scan-build，且输出报告指向jenkins插件能识别的目录./clangScanBuildReports

codesign fails with !use_frameworks

错误：▸ Building Pods/AFNetworking [(Release)]

⌦ Code Sign error: Provisioning profile does not match bundle identifier: The provisioning profile specified in your build settings (“100edututorhd_inhouse”) has an AppID of “com.100.enterprise.tutorstudenthd” which does not match your bundle identifier “org.cocoapods.AFNetworking”.

问题：Do I need to modify all the info.plist to match my AppID? Or is there a way to skip codesign for the frameworks?

解决：在podfile里加入以下配置关掉签名

post_install do |installer|
  installer.pods_project.targets.each do |target|
    target.build_configurations.each do |config|
      config.build_settings['EXPANDED_CODE_SIGN_IDENTITY'] = ""
      config.build_settings['CODE_SIGNING_REQUIRED'] = "NO"
      config.build_settings['CODE_SIGNING_ALLOWED'] = "NO"
    end
  end
end