Features

Contents

• Features
  • Parsing
  • Basic analysis
  • Global analysis
  • Static analysis
  • Dynamic analysis
  • Bug finder
  • API finder
  • Sgrep
  • Spatch
  • Visualization
    • Google maps on source code
    • Layers
    • Code search and navigation
      • Visual grep
    • Editor integration
    • Advanced source code highlighting
      • Visual feedback on bad smell
    • Visual debugger
  • Misc

Features

For now only PHP has support for the following features. The other programming languages have partial support (see Matrix).

Parsing

• lexer/parser generating a concrete syntax tree (CST) with comments, spaces, and preprocessor directives information easily accessible. It makes the CST source-to-source transformation friendly. It also helps when displaying code in codemap.
• visitor, usually autogenerated using ocamltarzan
• concrete syntax tree pretty printer, also autogenerated, useful to debug and learn which OCaml constructor corresponds to which construction.
• unparser
• basic source-to-source transformation (parse, annotate tokens and their 'transfo' field, unparse)

Basic analysis

• simplified AST a la CIL
• control flow graph (intra-procedural)
• generic data flow (intra-procedural)

Global analysis

• persistent storage (using berkeley DB or just single marshalled file) to scale to thousands of files and million lines of code
• function callgraph
• def/use of entities (functions, classes, methods, fields)
• method callgraph (handling self/parent, and ambiguities because of imprecise analysis)
• include analysis (can require to define an environment containing global settings to a project)
• builtins analysis
• TODO class analysis (requires dataflow in general)
• TODO type inference (requires simplified IL and dataflow)
• TODO interprocedural bottom-up analysis
• TODO summary-based interprocedural analysis
• TODO context sensitive interprocedural analysis (k-CFA)
• emacs TAGS file generator

Static analysis

• dead functions reaper
• code_rank (useful to understand the core functions of a project, but not better than the simple number_of_callers when want to undetstand the important functions in a API; so complementary)
• cyclomatic complexity
• reaching definitions (using data flow analysis)
• liveness (using data flow analysis)
• TODO tainted analysis (hard, requires interprocedural analysis)
• static test coverage (can be complentary to dynamic test coverage by showing which functions are not directly tested)
• test_rank

Dynamic analysis

• tracing/profling
• test coverage (requires tracing)
• underministic bug finder (using trace and diff)

Bug finder

• unused function (deadcode, sometimes the sign of a bug)
• unused variable (often because of a typo)
• dead statements (using control flow graph)
• TODO dead assignements (using data flow liveness)
• use of undefined variable
• undefined entity (function, class, constant)
• TODO undefined field/method (requires class analysis)
• TODO typing error (requires type inference, obviously)

API finder

• builtins integration
• PLEAC
• code<->test navigation

Sgrep

• expression matcher
• metavariables
• '...' in function calls
• linear patterns
• metavariables printing
• basic isomorphisms (e.g don't care abour order of fields in struct definitions, xhp attributes, etc)
• TODO typed metavariables
• TODO statement matcher
• TODO full language matcher
• TODO '...' between statements or entities

Spatch

• syntactical sed for expressions
• +/- on any PHP constructions (a la coccinelle) in any expression context
• TODO support not just PHP expressions but also statements function header, class header, etc
• TODO typed metavariables

Visualization

Google maps on source code

Code overview using treemap + thumbnails. "A Google Maps on source code". Can see both the macro and micro organization of a project.

• architecture/category of a file using color scheme
• labels with different size and alpha value
• thumbnail source view
• summary of important entities of a file in the thumbnail source view
• TODO anamorphic representation using importance of a file instead of size of file where importance can be number of callers/users or code_rank like metric

Layers

Layers a la google earth with flexible color scheme:

• deadcode layer (using static information)
• liveness layer (using dynamic information from profilers)
• TODO code coverage layer (when have unit tests to run and trace)
• bugs/bad smell layer (using scheck)
• TODO cycomatic complexity layer
• TODO code_rank layer
• TODO test_rank layer
• TODO distance_to_bottom layer
• TODO activity layer (using git)
• TODO age layer (using git)

Code search and navigation

• entity search, with completion (with integration for builtins too)
• file/dir search
• code navigation, directory/file navigation
• multi-dir navigation, to allow for instance to multi-navigate on a project with the same directory name spreaded in many places (e.g. include/project, test/project, ui/core/project, etc)
• code<->covering_test integration
• code<->PLEAC integration
• TOREPUT minimap
• TODO smooth zoom (a la google maps)
• TODO callers/callees navigation

Visual grep

• micro-level visual grep
• TODO macro-level visual grep
• TODO sgrep integration
• TODO flexible color scheme with sgrep poweful patterns

Editor integration

Editor integration with line-precision file opening.

• emacs
• TODO: other

Advanced source code highlighting

• token-based source highlighting
• identifier highlighting; usually requires parsing to disambiguate the multiple uses of identifiers in a program (for classes, functions, parameters, locals, types, etc)
• varying font size depending on class of the token
• local/global/parameter highlighting
• semantic highlighting, visual feedback on importance of entities (anamorphic entities)

Visual feedback on bad smell

• dangerous functions
• dangerous patterns
• use of globals
• function calls with variable passed by ref
• TODO dead code
• TODO test coverage
• TODO test_rank

Visual debugger

• TODO dynamic trace highlighting (use layer)
• TODO trace browsing
• TODO aspect layer + trace

Misc

• integration with version control system
• SEMI integration with documentation (e.g. document builtins)
• TODO integration with mailing list
• preprocessor
• closure by source-to-source transformation