A static analyzer for finding dynamic programming errors

TLDR

There are important classes of programming errors that are hard to diagnose, both manually and automatically, because they involve a program's dynamic behavior. This article describes a compile‑time analyzer that detects dynamic errors in large, real‑world programs. The analyzer traces execution paths through source code, models memory, reports inconsistencies, and uses automatically created models of individual functions to efficiently detect inter‑procedural defects. The approach avoids false paths, provides contextual information to aid repair, and has been effectively used on several large commercial programs. © 2000 John Wiley & Sons, Ltd.

Abstract

There are important classes of programming errors that are hard to diagnose, both manually and automatically, because they involve a program's dynamic behavior. This article describes a compile-time analyzer that detects these dynamic errors in large, real-world programs. The analyzer traces execution paths through the source code, modeling memory and reporting inconsistencies. In addition to avoiding false paths through the program, this approach provides valuable contextual information to the programmer who needs to understand and repair the defects. Automatically-created models, abstracting the behavior of individual functions, allow inter-procedural defects to be detected efficiently. A product built on these techniques has been used effectively on several large commercial programs. Copyright © 2000 John Wiley & Sons, Ltd.