4 ms·
Certain languages lend themselves better to static analysis than others. Some qualities (there are others) that simplify static analysis include: * static (no
by colanderman 11y ago
Certain languages lend themselves better to static analysis than others. Some qualities (there are others) that simplify static analysis include:
* static (not necessarily explicit) typing
* no dynamic metaprogramming (static OK)
* no "eval"
* no first-class functions (second-class OK)
* no prototype-based OOP (class-based OK)
* no mutable variables (lexical shadowing OK)
* no mutable values, or very strict aliasing rules
* no unbounded recursion
* no dynamically defined structures
Of course you can perform useful static analysis with only some of these guidelines met. e.g. Erlang's Dialyzer does pretty well with dynamic typing, first-class functions, and unbounded recursion, because these features generally aren't abused in Erlang. (Though this took a hit recently due to the recent introduction of the `maps` feature, which was designed in such a way as to encourage violating that last guideline, despite proposals for a similar feature which would not have violated it.)
Surprisingly, C also meets all but two of these guidelines, and, although it is an egregious violator of those both, it is somewhat amenable to static analysis (see Coverity).
JavaScript, on the other hand, is notoriously difficult to statically analyze, since it not only permits code to violate all the above guidelines, but it's common for code to violate all of them.
- coderdude 11y agoThanks for that response. I didnt expect to get that much useful information.
- apaprocki 11y agoEven though static analysis of C/C++ works reasonably well in Coverity (at least enough to buy and use the product), there are enough false positives and corner cases that make the thought of "automatic" fixes unrealistic. It finds serious bugs but it also gets tripped up on certain patterns without modeling or embedding pseudo-pragmas for it to process.
- colanderman 11y agoYes I know. But parent was asking about detection, not correction (which the OP is about). On that topic though, it is notable that Erlang's Dialyzer, unlike most static analysis tools and type systems, guarantees no false positives; it only reports errors via code paths it can prove are taken. This makes it very easy to integrate into existing development workflows.
- Splines 11y agoPardon if this is a naive question, but are there languages designed with static analysis in mind?
- tormeh 11y agoKotlin, designed by the Intellij-people. Maybe Ceylon? Don't remember.
- tormeh 11y agoKotlin, designed by the Intellij-people. Maybe Ceylon? Don't remember.
- colanderman 11y agoThere are, but they're not too widely used. Cyclone [1] and SPARK [2] are two examples. Of course many others may have been designed in such a way that they are easily analyzable, without that explicitly being a goal. [1] https://en.wikipedia.org/wiki/Cyclone_(programming_language) https://en.wikipedia.org/wiki/Cyclone_(programming_language) [2] https://en.wikipedia.org/wiki/SPARK_(programming_language) https://en.wikipedia.org/wiki/SPARK_(programming_language)
- riyadparvez 11y agoWhat is wrong with first-class functions other than function-pointer indirect jumps? If that is the problem, then polymorphism (virtual functions) should also be in the list.