[cfe-dev] Static analysis tool development

[Ted Kremenek]

On Jan 17, 2009, at 6:53 AM, Monty Zukowski wrote:

> I'm glad to hear all the details of your analyzer.  I'll have more
> questions later, I'm sure, but for now this is what interests me most:
>
>> Another high-level goal of the analyzer is to support the relaying  
>> of rich
>> diagnostics to end-users about how a bug manifests in their  
>> program.  The
>> diagnostic reporting mechanism in the analyzer also uses a set of  
>> abstract
>> interfaces so that bug reports can be rendered in a variety of ways  
>> (e.g.,
>> to the console, to an HTML page, within an IDE, etc.).  Providing  
>> rich
>> diagnostics is an important goal because without them the results  
>> of a
>> static analysis algorithm is only useful to graduate students  
>> studying
>> program analysis techniques rather than programmers who want to fix  
>> bugs.
>
> As you mentioned later, issue tracking is very important and the
> analyzer can be designed to help with that.  It seems to me that that
> could be the best use of Google's money to get this tool into its most
> useful state.

I think having good issue tracking and improving the general  
infrastructure for the analyzer would expand its usefulness to more  
users.  Improving the UI and workflow would greatly improve its  
usability to more developers.

Among other issues that I didn't mention was a better way of  
"intercepting the build" so that the analyzer scans every file that  
the compiler does (and with the same flags, include paths, etc.).   
Currently 'scan-build' just overrides CC to be a "fake compiler" that  
forwards its arguments onto gcc and clang.  This solution doesn't work  
in many cases and could be greatly improved.

>  I can see you've put a lot of thought into the other
> analysis which can be added to the tool later.  I'm not an expert in
> that area so I'll probably leave that area untouched.
>
> In any event, you've described a tool which seems to have been
> designed to be both extensible and useful and for that I'm very
> excited.  It seems like such an obvious need, doesn't it?

I certainly think so.  ;-)