Dialyzer – a DIscrepancy AnaLYZer of ERlang programs Tobias Lindahl and Kostis Sagonas Dept of Information Technology Uppsala University

What is the Dialyzer? The short answer: It is a user-friendly tool that can help you find bugs with little more effort than pressing a button. The somewhat longer answer:... will take something like half an hour

What does Dialyzer report? Dialyzer reports discrepancies in Erlang code Discrepancies come in different flavours: Calls to primitive operations or built-in functions that will always fail Pattern matching clauses that cannot match Guards that always will silently fail...

Properties of Dialyzer v1.0 1.No false warnings 2.Automatic: Dialyzer requests the user to press a button 1. No user annotations required 2. No changes to existing code or the characteristics of Erlang 3.Analysis works starting from bytecode 4.Analysis is quite fast

What kind of analysis is used? Intra-procedural, forward dataflow analysis using type inference. The Dialyzer: – Builds a static callgraph for intra-modular function calls. – Analyses its strongly connected components in a bottom-up fashion (using the information from already analysed functions) until fixpoint. – Builds a similar callgraph for inter-modular calls. – With the help of this callgraph, analyses all modules until fixpoint.

The core of the analysis: Local analysis Performed on the internal language Icode, an idealised assembly language. Icode is represented as a Control Flow Graph (CFG) and is converted to Static Single Assignment (SSA) form. Type information is available: – Explicitly in guards and pattern matching – Implicitly in calls to primops and bifs (e.g., '+'/2)

if is_binary(v0) truefalse v2 := mktuple(list, v1) return(v2) v3 := mktuple(tuple, v1) return(v3) v4 := mktuple(binary, v1) return(v4) if is_tuple(v0) v5 := gazonk return(v5) v1 := erlang:size(v0) if is_list(v0) falsetrue falsetrue Example test(X) -> case size(X) of N when is_list(X) -> {list, N}; N when is_tuple(X) -> {tuple, N}; N when is_binary(X) -> {binary, N}; _ -> gazonk end. size(tuple() | binary()) -> integer() v0 ::= tuple() | binary() v0 ::= any() v0 ::= tuple() | binary() v0 ::= binary() v0 ::= tuple()v0 ::= binary()

Dialyzer in action

Example of discrepancies (1) In snmp: snmp_user_based_sm_mib.erl case is_crypto_supported(sha_mac_96) of true -> ok; fasle ->...

remote_dirty_select(Tab, [{HeadPat,_,_}] = Spec, [Pos|Tail]) when tuple(HeadPat), size(HeadPat) > 2, Pos =... Example of discrepancies (2) In mnesia: mnesia.erl

case snmp_pdus:enc_scoped_pdu(ScopedPDU) of {'EXIT', Reason} ->... Example of discrepancies (3) In snmp: snmp_mpd.erl

case Options of {wrap, T, WrapSize, WrapCnt, WrapTime} ->... nowrap -> … end,... case Options of {wrap, _, _, _} ->... _Other ->... Example of discrepancies (4) In snmp: snmp_mpd.erl

merge_data(Queue, Header) -> Data = list_to_binary(Queue),... {B1, B2} = split_binary(Header, Data),... Example of discrepancies (5) In kernel: sock5_udp.erl

read_trailer_end(Info,Timeout,MaxHdrSz,Trailers) ->... Fields0 = regexp:split(Trailers,”\r\n"), [_Last | Fields] = lists:reverse(Fields0),... Example of discrepancies (6) In inets: httpd_request_handler.erl

handle_connection(Manager, ConfigDb, SocketType, Socket) -> case httpd_request_handler:start_link(Manager, ConfigDb) of {ok, Pid} ->... {error, Reason} ->... Example of discrepancies (7) In inets: httpd_acceptor.erl and httpd_request_handler.erl start_link(Manager, ConfigDB) ->... {ok, Pid}.

Future work Analyse starting from source code. Make a command line version for automated use. Provide annotations in edoc format based on the result from the analysis. Let the user provide more information by annotations. Allow the user to relax the 'no false warnings' guideline to find more discrepancies. Extend the analysis to check for other properties (e.g., the concurrent part of Erlang).

Conclusions Dialyzer really works: It has been applied to literally millions of lines of code in well tested, commercial projects. What others say: “Goddamn bloody excellent tool”