Dialyzer a DIscrepancy Ana LYZer of ERlang programs

Dialyzer – a DIscrepancy Ana. LYZer of ERlang programs Tobias Lindahl and Kostis Sagonas Dept of Information Technology Uppsala University

What is the Dialyzer? The short answer: It is a user-friendly tool that can help you find bugs with little more effort than pressing a button. The somewhat longer answer: . . . will take something like half an hour

What does Dialyzer report? Dialyzer reports discrepancies in Erlang code Discrepancies come in different flavours: • Calls to primitive operations or built-in functions that will always fail • Pattern matching clauses that cannot match • Guards that always will silently fail • . . .

Properties of Dialyzer v 1. 0 1. No false warnings 2. Automatic: Dialyzer requests the user to press a button 1. No user annotations required 2. No changes to existing code or the characteristics of Erlang 3. Analysis works starting from bytecode 4. Analysis is quite fast

What kind of analysis is used? Intra-procedural, forward dataflow analysis using type inference. The Dialyzer: – Builds a static callgraph for intra-modular function calls. – Analyses its strongly connected components in a bottom-up fashion (using the information from already analysed functions) until fixpoint. – Builds a similar callgraph for inter-modular calls. – With the help of this callgraph, analyses all modules until fixpoint.

The core of the analysis: Local analysis • Performed on the internal language Icode, an idealised assembly language. • Icode is represented as a Control Flow Graph (CFG) and is converted to Static Single Assignment (SSA) form. • Type information is available: – Explicitly in guards and pattern matching – Implicitly in calls to primops and bifs (e. g. , '+'/2)

Example v 0 : : = any()

Dialyzer in action

Example of discrepancies (1) In snmp: snmp_user_based_sm_mib. erl

Example of discrepancies (2) In mnesia: mnesia. erl

Example of discrepancies (3) In snmp: snmp_mpd. erl

Example of discrepancies (4) In snmp: snmp_mpd. erl

Example of discrepancies (5) In kernel: sock 5_udp. erl

Example of discrepancies (6) In inets: httpd_request_handler. erl

Example of discrepancies (7) In inets: httpd_acceptor. erl and httpd_request_handler. erl

Future work • Analyse starting from source code. • Make a command line version for automated use. • Provide annotations in edoc format based on the result from the analysis. • Let the user provide more information by annotations. • Allow the user to relax the 'no false warnings' guideline to find more discrepancies. • Extend the analysis to check for other properties (e. g. , the concurrent part of Erlang).

Conclusions Dialyzer really works: It has been applied to literally millions of lines of code in well tested, commercial projects. What others say: “Goddamn bloody excellent tool”