Hacker News Reader

Comment by saagarjha | Hacker News Reader

The kinds of analyses mentioned here are typically grouped under "linting"–more advanced static analysis tools will typically do things like dataflow analysis.

View on HN

I too would be interested in interesting static code analyses (that are beyond linting).

Terms which you might find useful to search for are "dataflow analysis", "abstract interpretation", and "taint checking". A basic background in compiler optimization would generally be helpful.

Any beginner friendly articles on more advanced analysis that you'd recommend?

Maybe a bit tangential, but still interestin:

https://cacm.acm.org/magazines/2010/2/69354-a-few-billion-li...

https://en.wikipedia.org/wiki/Static_single_assignment_form

While computing phis for SSA does require dataflow analysis, SSA itself is not tremendously useful. The natural follow up to this would be "so what?" Something like live variable analysis is probably a much better first introduction to dataflow analysis since its application is much more obvious.

SSA is also not even universal among IRs for static analysis at this point. Heap-SSA is growing in popularity for complex dataflow problems involving fields.

Don't have any materials to point to, sadly. Most of the knowledge in this field is locked up in papers and tools; I was lucky to learn most of what I know from a graduate class taught by a professor working on static analysis in V8 and working with/on software security tooling. To begin with, I'd suggest first brushing up on compiler optimizations (which is largely separate from parsing) and that should lead you to dataflow analysis techniques.

I think Matt Might's intro is relatively beginner-friendly depending on your familiarity with Scheme: http://matt.might.net/articles/intro-static-analysis/

Reply on news.ycombinator.com