Interesting article on static analysis tools to help find concurrency issues. These so called “Parallel Lint” tools are specific to finding these types of issues. Overall there are some great discussions on certain tools, and it is always nice when Klocwork gets mentioned. But my problem is with the categorization of these tools. It always makes me feel sick every time someone puts Klocwork in the same category of “powerful static analysis” with JLint, C++Test, FXCop and my favorite PC-Lint.
This article goes deeper into PC-Lint and what they are doing with deadlocks. The author highlights a very important point here:
“Like compilers, static analyzers operate each .cpp file separately. And that’s why if f() function is called in parallel mode in file A from file B, we cannot know this when analyzing file B. Of course there are static analyzers which analyze the whole set of files at once but it is a very difficult task. At least, PC-Lint operates each file separately.”
This is a point I feel keeps getting lost with modern static analysis tools today. Forget the Lint of the past or these other tools, their focus is on file by file analysis. These old tools are doing simple grep type analysis. Sometimes where you’re lucky you get a little bit of control flow with a dash of data flow analysis. But plainly they are missing the deep inter-procedural analysis and techniques that are used with modern static analysis tools today. I’m hoping the message is getting out there that static source code analysis is far far beyond Lint and is providing the context you never had before.
