[ANN] lglob - a static Lua global checker

[steve donovan <steve.j.donovan@...>]

Hi all,

lglob [1] is a little program which analyses the output of luac and
tracks all global references.  Since undeclared variables are
considered to be unknown globals, it makes a pretty good spellchecker,
for both Lua 5.1 and 5.2.  Output is in the same form as luac so it
can be integrated into your editor workflow as a pre-run build check;
it is a single Lua file with no dependencies.

It catches errors in field names of known tables as well, so both
'tabel' and 'math.sine' are considered errors.  By default it will
also require() any other modules and track them. It can be used to
analyze programs that use a lot of globals using the '-t' (for
'tolerant') flag, where using new globals is allowed if they were
defined in the module (although not across modules)  For instance,
analyzing Lake gives nearly 900 'errors' but when run with -t we get
about a dozen issues, all understood.

It is a beefed-up version of David Manura's globalsplus.lua[2], which
extended the globals.lua script that used to be part of etc/ in the
Lua distribution. This version eliminates a number of irritating
false-negatives and allows all Lua files in a tree to be analyzed with
a single '.'.  There is also a -dx flag which dumps out all unknown
symbols, which can be made into a whitelist once you've decided they
are harmless; if directed to a file 'global.whitelist' then subsequent
runs will not mention these symbols again.

Since monkey-patching occupied lua-l's finest minds recently, here is
Penlight analyzed for both 5.1 and 5.2:

~/lua/Penlight/lua$ lglob .
lglob: pl\compat.lua:86: undefined get debug.upvaluejoin
lglob: pl\compat.lua:114: redefining global table.pack
lglob: pl\compat.lua:127: redefining global package.searchpath
lglob: pl\comprehension.lua:37: warning: could not require "luabalanced"
lglob: pl\dir.lua:9: warning: require "pl.path" added these globals: lfs
lglob: pl\lapp.lua:25: warning: could not require "sip"
lglob: pl\lapp.lua:217: undefined get lapp.slack
lglob: pl\test.lua:15: undefined get utils.pack
lglob: pl\xml.lua:682: undefined get _M.debug
lglob: pl\xml.lua:689: undefined get _M.debug

~/lua/Penlight/lua$ lglob52 .
lglob: pl\compat.lua:62: undefined get setfenv
lglob: pl\compat.lua:68: undefined get setfenv
lglob: pl\compat.lua:68: undefined get getfenv
lglob: pl\compat.lua:114: redefining global table.pack
lglob: pl\compat.lua:127: redefining global package.searchpath
lglob: pl\comprehension.lua:37: warning: could not require "luabalanced"
lglob: pl\lapp.lua:25: warning: could not require "sip"
lglob: pl\lapp.lua:217: undefined get lapp.slack
lglob: pl\test.lua:15: undefined get utils.pack
lglob: pl\utils.lua:15: undefined get compat.lua51
lglob: pl\xml.lua:682: undefined get _M.debug
lglob: pl\xml.lua:689: undefined get _M.debug

These are mostly evidence of PL's attempts to generate a compatible
5.1/5.2 environment - i.e. its monkey-patching ;)

The _M abomination will be duly corrected!

I've tested against large publically available code bases like
LuaRocks (there the lesson is that static analysis cannot track
dynamic creation of module contents) and would appreciate any feedback
or criticisms.

100% accuracy is probably not possible, due to the many ingenious ways
of modifying modules in Lua, but it should be very sensitive to new
errors.

[1] https://github.com/stevedonovan/lglob
[2] http://lua-users.org/wiki/DetectingUndefinedVariables