Fix #15110: Support extra comments for suppression files

[ludviggunne]

No description provided.

[dmcppcheck]

AI review

I found no problems in this PR. parseLine() now saves the text after the first # or // in extraComment. This also covers --suppress= on the command line and the strings that the process executor passes from its child processes. In the process executor, parts[4] overwrites the parsed comment afterwards, so the round trip is unchanged. Comments that contain the other marker are split at the first marker, so abc // see #123 gives see #123. The new comment is written XML-escaped in the <suppressions> section of the --xml output.

Two notes, neither of which I see as a blocker:

• Inline comments go through getExtraComment(), which removes bytes ≥ 0x80. This path keeps them, and ErrorLogger::toxml then writes them as x characters (ä → xx). Nothing breaks, but the two paths behave differently.
• The tests only cover parseFile(). No test in test/cli checks that a comment from a suppressions file reaches the XML output.

Testing

• Built cppcheck and testrunner in pr/ without errors.
• ./testrunner TestSuppressions: all 70 tests passed.
• Manual test with printf 'int f(){int x; return x;}\n' > a.c and this suppressions file:

  uninitvar:a.c # why: ä & <x> "q"
  nullPointer // other
  

  cppcheck --xml --suppressions-list=s.txt a.c printed:

  <suppression errorId="uninitvar" fileName="a.c" inline="false" comment="why: xx &amp; &lt;x&gt; &quot;q&quot;" />
  <suppression errorId="nullPointer" inline="false" comment="other" />
  

  The comments are parsed and escaped correctly; the non-ASCII ä comes out as xx.
• Two cases printed no <suppressions> section at all: two files with -j1/-j2 and --executor=process, and --suppress='uninitvar // cmd'. So I could not check the comment in those paths. I did not build base/ to see whether it behaves the same there. The most likely cause is that the section is only printed under conditions unrelated to this change.

---

Automated review of 5da7b3e by Claude. The pull request was built and tested locally.

[dmcppcheck]

Test results for commit 5da7b3e (tools/test-my-pr.py, main compared to this PR):

Test: http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8942/
packages: 100
Differing warnings: 0 (+0 -0)
Timing: -0.1% (http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8942/2026-10-15_08-53-48-5da7b3e38cc3_timing.html)

_{Posted automatically by the cppcheck PR test runner. +N: warnings only with this PR, -N: warnings only with main. The AI review is written by Claude and can be wrong.}