static analysis in lua [was Re: Lua Digest, Vol 174, Issue 1]

[David Manura <dm.lua@...>]

On Mon, Sep 28, 2009 at 10:59 AM, Mike Zraly wrote:
> >   http://user.it.uu.se/~kostis/Papers/contracts.pdf
> Actually, it might be an interesting idea to provide an interface to set
> (some) and get (all)
> information about a function object within the lua language itself.  One
> might use this to
> expose annotations like type assertions, comment strings, and perhaps even
> more low-level
> information like the function's name and source location and whether or not
> the function calls
> yield directly.

I've experimented with some things like that in luaanalyze [1].  The
basic concept and implementation is rather simple (< 300 lines in
luaanalyze/tools.lua:process_comments and luaanalyze/walk.lua).  Lua
code embedded inside specially formatted Lua comments (i.e. prefixed
by "!") can be executed prior to run-time by an external static
checker tool.  The embedded code has access to the AST and the lexical
location in which its containing comment exists within the AST.  The
embedded code can query and decorate the AST.  Users can write their
own functions for doing this, or they can use predefined functions,
the latter of which includes things like decorating objects with type
and contract information and performing rudimentary inferences and
checking on that information.  Unfortunately, I haven't spent the time
to make this production grade, and I haven't gotten into the practice
of using this much (rather, my static analysis practices in Lua have
largely remained limited to "luac -p -l file.lua | grep ETGLOBAL" or
"checkglobals()").  As said, after removing the optional stuff, the
basic code is rather simple though and could be reused as a basis for
work by others.  Most of the heavy-lifting of generating the AST is
provided for us by the Metalua libraries (currently bundled with the
distribution).

[1] http://lua-users.org/lists/lua-l/2009-08/msg00260.html