https://www.meetup.com/St-Petersburg-CPP-User- Group/ ● C++ Russia: https://cppconf.ru/en/Why Code Analysis?Software QualityReadability Maintainability tools fuzzer battery life Repeatable tests Undefined Behavior – Fun with NULL pointers, part 1: https://lwn.net/Articles/342330/Why code analysis – ● Improve software quality ● Lower developer frustration ● Avoid UBLanguageLanguage helps Built-in compiler check ○ Current LLVM implementation gives 5% overhead ○ Annotations to help analysis: gsl::SharedOwner, gsl::Owner, gsl::Pointer void sample1() { int* p = nullptr; {

Finding Bugs using Path-Sensitive Static Analysis Gábor Horváth Gabor.Horvath@microsoft.com @XazaxHunWelcome to CppCon 2021! Join #visual_studio channel on CppCon Discord https://aka.ms/cppcon/discord latest announcements Take our survey https://aka.ms/cppconAgenda • Intro to path-sensitive static analysis • Path-sensitive checks in MSVC • A look under the hood • Upcoming features • Lessons learned2012 -> Unknown p -> Null p -> MaybeNull p -> MaybeNull Warning Unknown Null NotNull MaybeNull Analysis state Transition semi-lattice• Some paths are infeasible: • Not taking branch 1, but taking branch

modules unannotated. The more you annotate, the more useful mypy will be, but even a little annotation coverage is useful. 1.3.6 Write annotations as you go Consider adding something like these in your code annotation coverage in your codebase without much effort. 1.3.7 Automate annotation of legacy code There are tools for automatically adding draft annotations based on simple static analysis or on type PyAnnotate. A simple approach is to collect types from test runs. This may work well if your test coverage is good (and if your tests aren’t very slow). Another approach is to enable type collection for

modules unannotated. The more you annotate, the more useful mypy will be, but even a little annotation coverage is useful. Write annotations as you go Consider adding something like these in your code style increase annotation coverage in your codebase without much effort. Automate annotation of legacy code There are tools for automatically adding draft annotations based on simple static analysis or on type profiles com/dropbox/pyannotate]. A simple approach is to collect types from test runs. This may work well if your test coverage is good (and if your tests aren’t very slow). Another approach is to enable type collection for

modules unannotated. The more you annotate, the more useful mypy will be, but even a little annotation coverage is useful. Write annotations as you go Consider adding something like these in your code style increase annotation coverage in your codebase without much effort. Automate annotation of legacy code There are tools for automatically adding draft annotations based on simple static analysis or on type profiles com/dropbox/pyannotate]. A simple approach is to collect types from test runs. This may work well if your test coverage is good (and if your tests aren’t very slow). Another approach is to enable type collection for

modules unannotated. The more you annotate, the more useful mypy will be, but even a little annotation coverage is useful. 1.3.6 Write annotations as you go Consider adding something like these in your code annotation coverage in your codebase without much effort. 1.3.7 Automate annotation of legacy code There are tools for automatically adding draft annotations based on simple static analysis or on type PyAnnotate. A simple approach is to collect types from test runs. This may work well if your test coverage is good (and if your tests aren’t very slow). Another approach is to enable type collection for

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.6 Coverage Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . empty vector, since there is no possible index of type Fin 0. For more details, see the section on coverage checking. 18 Chapter 2. Getting Started Agda User Manual, Release 2.6.3 2.4.3 Agda as a Proof (continued from previous page) pred zero = zero pred (suc x) = x With copatterns, we can do the case analysis directly by pattern matching: open Enumeration enum-Nat : Bool → Enumeration Nat start (enum-Nat

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.6 Coverage Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . empty vector, since there is no possible index of type Fin 0. For more details, see the section on coverage checking. 18 Chapter 2. Getting Started Agda User Manual, Release 2.6.4.1 2.4.3 Agda as a Proof where pred : Nat → Nat pred zero = zero pred (suc x) = x With copatterns, we can do the case analysis directly by pattern matching: open Enumeration enum-Nat : Bool → Enumeration Nat start (enum-Nat

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.6 Coverage Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . empty vector, since there is no possible index of type Fin 0. For more details, see the section on coverage checking. 18 Chapter 2. Getting Started Agda User Manual, Release 2.6.4 2.4.3 Agda as a Proof where pred : Nat → Nat pred zero = zero pred (suc x) = x With copatterns, we can do the case analysis directly by pattern matching: open Enumeration enum-Nat : Bool → Enumeration Nat start (enum-Nat

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.6 Coverage Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . empty vector, since there is no possible index of type Fin 0. For more details, see the section on coverage checking. 2.4.3 Agda as a Proof Assistant: Proving Associativity of Addition In this section we } where pred : Nat → Nat pred zero = zero pred (suc x) = x With copatterns, we can do the case analysis directly by pattern matching: open Enumeration enum-Nat : Bool → Enumeration Nat start (enum-Nat