tools/go/analysis/cmd/vet
Russ Cox 73554e0f78 go/analysis/passes: fix bugs discovered in std
asmdecl:
- MOVW $x+0(FP) is OK if x is big, because $x is an address
  (happens in internal/cpu, golang.org/x/sys/cpu, runtime)
- ignore TEXT lines in comments
  (happens in runtime/internal/atomic)
- wasm's CallImport instruction writes return results
  (happens in syscall)
- allow write out-of-bounds (SP) references in NOFRAME functions
  (happens in runtime)
- recognize "NOP SP" as an SP "write" to disable SP bounds checking
- 'go test' in passes/asmdecl was not testing all architectures; fix that

stdmethods:
- ignore WriteTo if obviously not io.WriterTo (as in go/types and runtime/pprof)

errorsas:
- don't complain about package errors testing invalid calls

structtag:
- don't complain about encoding/json and encoding/xml testing invalid tags

unmarshal:
- don't complain about encoding/gob, encoding/json, encoding/xml testing invalid calls

For golang/go#31916.
Fixes golang/go#25822.

Change-Id: I322c08b5991ffc4995112b8ea945161a4c5193ce
Reviewed-on: https://go-review.googlesource.com/c/tools/+/176097
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Michael Matloob <matloob@golang.org>
2019-05-09 15:32:22 +00:00
..
README go/analysis/cmd/vet: new name for cmd/analyze 2018-10-19 18:46:07 +00:00
vet.go go/analysis/passes: fix bugs discovered in std 2019-05-09 15:32:22 +00:00

README

Vet is a tool that checks correctness of Go programs. It runs a suite of tests,
each tailored to check for a particular class of errors. Examples include incorrect
Printf format verbs and malformed build tags.

Over time many checks have been added to vet's suite, but many more have been
rejected as not appropriate for the tool. The criteria applied when selecting which
checks to add are:

Correctness:

Vet's checks are about correctness, not style. A vet check must identify real or
potential bugs that could cause incorrect compilation or execution. A check that
only identifies stylistic points or alternative correct approaches to a situation
is not acceptable.

Frequency:

Vet is run every day by many programmers, often as part of every compilation or
submission. The cost in execution time is considerable, especially in aggregate,
so checks must be likely enough to find real problems that they are worth the
overhead of the added check. A new check that finds only a handful of problems
across all existing programs, even if the problem is significant, is not worth
adding to the suite everyone runs daily.

Precision:

Most of vet's checks are heuristic and can generate both false positives (flagging
correct programs) and false negatives (not flagging incorrect ones). The rate of
both these failures must be very small. A check that is too noisy will be ignored
by the programmer overwhelmed by the output; a check that misses too many of the
cases it's looking for will give a false sense of security. Neither is acceptable.
A vet check must be accurate enough that everything it reports is worth examining,
and complete enough to encourage real confidence.