RuleChecker release 16.10

This release was only available as an integral part of Astrée 16.10.

First provisions for standalone RuleChecker

Most of the supported MISRA rules can now be checked for without running the runtime error analysis (skip-analysis=yes):

• The check for recursion now has two implementations with varying precision that are chosen depending on the value of skip-analysis.
• The new check controlling-invariant-expression, associated with MISRA-C:2004 rule 4.1 and MISRA-C:2012 rule 2.1, provides a partial coverage for those rules without runtime error analysis.
• Likewise, the check uninitialized-variable-use (rule 9.1 of both MISRA-C:2004 and MISRA-C:2012) checks for missing initializers if the runtime error analysis is disabled.
• The following checks have been split in two to gain a partial check that does not rely on the analysis:

  error-information-unused	⤙	error-information-unused error-information-unused-computed
  shift-width	⤙	shift-width shift-width-constant
  essential-shift-width	⤙	essential-shift-width essential-shift-width-constant
  parameter-match	⤙	parameter-match parameter-match-computed
  boolean-invariant	⤙	boolean-invariant boolean-invariant-expression
  controlling-invariant	⤙	controlling-invariant controlling-invariant-expression

MISRA-C:2004

• Added support for rule 18.2.
• The following rule checks have been added to cover the aspect of “implementational limits” (as defined in ISO/IEC 9899:1990 p2.2.4.1) of rule 1.1:
  • max-arguments-macro
  • max-case-labels
  • max-condition-nesting
  • max-declarator-depth
  • max-declarator-nesting
  • max-enums
  • max-expression-nesting
  • max-externals
  • max-include-nesting
  • max-locals
  • max-logical-line-length
  • max-macros-defined
  • max-members
  • max-parameters
  • max-parameters-macro
  • max-statement-nesting
  • max-string-length
  • max-struct-nesting
  • parameters
• New checks for rule 15.0:
  • switch-skipped-code
    warns about statements or declarations preceding the first switch clause
  • switch-clause-empty-compound
    warns about switch clauses consisting of only an empty compound statement, e.g. default: {}
• Type compatibility rules have been modified as follows:
  • arithmetic types of same size and signedness are no longer compatible if they are not equal
  • the plain char type is no longer compatible with signed or unsigned char
  • function types without prototype are now compatible to function types with prototype according to the conditions given in ISO/IEC 9899:1999
  This modification affects incompatible type warnings of the C frontend, as well as checks of MISRA-C:2004 rule 8.4 (type-compatibility) and MISRA-C:2012 Appendix 1 rule 21.15 (memory-function-compatible).
• The check function-return-type has been moved from rule 8.1 to rule 8.2.
• The check evaluation-order for rule 12.2 is now also performed in initializer expressions.
• The check for rule 11.3 has been improved to also cover implicit conversions.
• Fixed checks for rule 8.4.
• The checks for rule 8.1 now also warn about implicit function declarations and function definitions without a preceding declaration of that function.

MISRA-C:2012

• Amendment 1 is now supported, which adds new rules and modifies rule 21.8. The new rules use the prefix M2012A1 followed by the MISRA rule number.
• Added support for rule 19.1.
• New checks for rule 16.1:
  • switch-skipped-code
    warns about statements or declarations preceding the first switch clause
  • switch-clause-empty-compound
    warns about switch clauses consisting of only an empty compound statement, e.g. default: {}
• Read accesses are now only treated as persistent side effects if they are syntactically volatile. This affects rules 13.1, 13.2, 13.5, and 14.2.
• Fixed check for-loop-condition-sideeffect for the case when the third expression of a for-loop is missing. This affects rule 14.2.
• Fixed check side-effect-in-initializer-list for initializer lists with a single element. This affects rule 13.1.
• The check evaluation-order for rule 13.2 is now also performed in initializer expressions.
• The check function-return-type has been moved from rule 8.2 to rule 8.1.
• Fixed false alarm about violation of rule 6.2 when using the _Bool type.
• Fixed false alarms about violation of rule 13.3 when performing the check unary-assign-detachment in combination with volatile variables.
• The checks for rules 11.1 and 11.4 have been improved to also cover implicit conversions.

Both rule sets

The checks for the MISRA-C:2004 rules 11.4 and 11.5 and for the MISRA-C:2012 rules 11.3, 11.6, 11.7, and 11.8 have been extended to cover implicit conversions.

• Added the checks
  • pointer-qualifier-cast-implicit
  • inappropriate-pointer-cast-implicit
  • object-pointer-diff-cast-implicit
  • object-pointer-diff-cast-strict-implicit
• Split the check

  cast-pointer-void-arithmetic

  ⤙

  cast-pointer-void-arithmetic cast-pointer-void-arithmetic-implicit

• Added pointer-qualifier-cast-implicit to rule 1.1.

Customer-specific rules

• Fixed false alarm in rule X.A.4.8 for comment sequences of the form

  /* comment1 *//* comment2
   * comment2 continued */

• Corrected documentation of rule X.A.3.9.
• The rule X.A.4.3 can now be modified by a regular expression parameter.

Other improvements

• Simplified the configuration of rule checks. It is now easier to activate rules within deactivated sections and to enable or disable categories of MISRA rules (Required, Advisory, etc.).
• The XML report may now contain alarm messages without location information. Currently the only alarms of this kind are violations of MISRA-C:2004 rule 21.1 and MISRA-C:2012 rule D.4.1 in cases where the rule check analysis-run fails.
• With the option stop-parse-error-immediate=no, parse errors no longer stop the rule checking on preprocessed files completely. Instead it is performed on all successfully parsed files.