Erik,
I too have been bothered by the lack of sophistication in static analyzers, my most recent was
something like this:
int foo ()
{
if (…) {
return x;
} else switch (…) {
case 1: return y;
default: return z;
}
}
and the compiler complained that the function could run-off-the-end without returning a value.!.
(the problem was with gcc, I have not tried clang on my code yet, since that would require clang/llvm
self-hosting, which I am not sure works yet ?)
as this email-thread has evolved into a discussion of what is necessarily missed by not doing
inter-procedural (whole-program) analysis, I am still confounded by what is not being done that
could be done with intra-procedural analysis which is very much more doable (and again, maybe
clang is already doing better in that department than gcc, but I have not yet done the experiment
to find out…)
so, what I am really trying to say is this: static analysis (and also dynamic analysis) should be
implemented by folks that are very familiar with optimization theory, since avoiding false-positives
is very often necessarily going to rely on some form of iterative-data-flow analysis, which while
fairly simple conceptually, isn’t typically understood well enough by pure “front-end” only folks
that are traditionally given the task of implementing these analyses. — well, perhaps I am over-
analyzing the situation a bit, but I do think things could stand some improvement anyway.
just my $0.02, your milage may vary…
-Peter Lawrence.