Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Static code analysis for new language. Where to start? [closed]

I just been given a new assignment which looks like its going to be an interesting challenge.

The customer is wanting a code style checking tool to be developed for their internal (soon to be open sourced) programming language which runs on the JVM. The language syntax is very Java like.

The customer basically wants me to produce something like checkstyle.

So my question is this, how would you approach this problem? Given a clean slate what recommendations would you make to the customer?

I think I have 3 options

  1. Write something from scratch. Id prefer not to do this as it seems like this sort of code analysis tool problem has been solved so many times that there must be a more "framework" or "platform" orientated approach.

  2. Fork an existing code style checking tool and modify the parsing to fit with this new language etc etc

  3. Extend or plug into an existing static code analysis tool. (maybe write a plugin for Yasca?)

like image 284
tinny Avatar asked May 19 '10 22:05

tinny


People also ask

At what part of the development stage is static code analysis typically performed?

Static code analysis is performed early in development, before software testing begins. For organizations practicing DevOps, static code analysis takes place during the “Create” phase. Static code analysis also supports DevOps by creating an automated feedback loop.

What is static code analysis in C?

Static analysis, also called static code analysis, is a method of computer program debugging that is done by examining the code without executing the program. The process provides an understanding of the code structure and can help ensure that the code adheres to industry standards.


1 Answers

Such tools basically have to implement a compiler front-end for at least a subset of the language. The easiest starting point is often to adapt an existing compiler front-end, so you should definitely start by looking at your customer's compiler. If you are lucky it will have a clean separation between the front-end and back-end and will be able to use it as-is and use the AST or whatever IR the front-end produces to do your additional analysis.

like image 175
Christopher Barber Avatar answered Oct 21 '22 07:10

Christopher Barber