Static Code Analysis - A Behind-the-scenes Look
summary
Uses Java examples to show concrete engineering trade-offs: parsing an AST or bytecode vs source (ASM/invokeDynamic) for full type info, then tracking taint flows across assignments, propagators and conditionals. Path explosion produces more than a thousand paths in a small example; naive merging cuts that to ~11 but loses precision. Recursion, loops and aliasing force call graph limitations and k‑limits; full precision is undecidable, so tools must choose approximations and framework-specific heuristics.
AI-written summary · about
chapters (30)
- 0:00Intro
- 1:03File & text utilities
- 1:48Challenge: Cross referencing
- 2:33Abstract syntax tree
- 3:47Which identifier refers to what?
- 5:33Explicit support for all language features
- 6:26Byte code
- 7:15Which is the better choice?
- 8:35Tracking flows
- 10:15Assignment
- 11:00Propagators
- 12:18Conditional flows
- 14:24Combinatorial explosion
- 16:08Merging
- 16:53Combinatorial explosion - Revisited
- 17:34Merging - Limitations
- 18:37Loops
- 20:15Impossible to be precise
- 20:44Function calls
- 21:40Recursion
- 22:26Virtual method calls
- 24:05Call graph
- 26:33Flow sensitivity
- 27:48Aliasing
- 29:57Framework / Library knowledge
- 31:58Identifying unique findings
- 33:38Quality of results
- 34:49Levels of sophistication
- 35:58Summary
- 37:10Outro
related talks
36mThe art of static code analysis
44mUsing Static Analysis Tools to Become A Superhero Programmer
28mTypes, Deeper Static Analysis, and you
55mCode Analysis with Zero False Positives in Java
42mContemporary Automatic Program Analysis
40mStatic Analysis in Go
47mStatic Code Analysis: Judging a Forest by Its Trees
34mKeep your code safe during the development path using OS tools