Can Valgrind output HTML?

No. Memcheck writes text or XML (`--xml=yes`); Callgrind writes a profile file meant for KCachegrind. Both convert — XML through an XSLT or `junit`-style renderer, Callgrind through `gprof2dot` into an SVG call graph.

How do I turn a callgrind file into a picture?

`gprof2dot -f callgrind callgrind.out.1234 | dot -Tsvg -o callgraph.svg`. The SVG keeps node labels and edge costs and scales without becoming unreadable.

`ms_print massif.out.1234` produces an ASCII graph; for something shareable, parse the snapshots into a chart and publish that — the heap-over-time curve is the thing people need to see.

Should I run Valgrind in CI?

Memcheck under CI is common and slow — often on a nightly job rather than per commit. A routine that re-runs it and PATCHes the same report id fits that cadence.

Can teammates comment on a specific leak?

Yes. Threads anchor to the rendered content, so a note on one leak record stays attached to it across later runs.

Share a Valgrind report

Valgrind's findings are precise and its output is hostile. Memcheck emits a wall of stack traces prefixed with process ids; Callgrind writes a file whose intended reader is KCachegrind, a GUI that the person who needs to see the result has never installed and is not going to.

Both convert into something a browser can open.

Callgrind → SVG call graph

valgrind --tool=callgrind --callgrind-out-file=callgrind.out ./app
pip install gprof2dot     # plus graphviz for `dot`

gprof2dot -f callgrind callgrind.out | dot -Tsvg -o callgraph.svg

gprof2dot prunes by cost, so the graph stays readable — -n 0.5 -e 0.1 tightens it further on a large binary. The SVG is self-contained and scales, which is exactly what a screenshot of KCachegrind does not.

Memcheck → a page

valgrind --tool=memcheck --leak-check=full \
  --xml=yes --xml-file=memcheck.xml ./app

# Render the XML with whatever your stack already has, e.g.
xsltproc valgrind-to-html.xsl memcheck.xml > memcheck.html

If your CI already converts the XML for a test summary, reuse that — the goal is a page, not a particular converter.

Publish it

Drag the file into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html memcheck.html \
        --arg title "Memcheck — $GITHUB_SHA" '{title: $title, html: $html}')"

The nightly cadence

Memcheck runs slow enough that most projects put it on a nightly job rather than a per-commit gate. That cadence is what makes a stable URL valuable: one report id, PATCHed each night, with a revision history where a new leak record appears as a diff rather than as a line in a log nobody opened.

A routine handles the re-run and the publish.
Anchored threads on a specific leak — "this one is the static logger, it is freed at exit" — so the known-benign records stop being re-reported. See commenting on HTML.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total. A full call graph on a large binary is the one that gets close — prune with gprof2dot -n/-e.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a profile →