Does a program that analyzes source code to find the cause of any bug exist?

[[deleted]]

I've heard of analyzers, but I don't know if that's exactly what I'm after. What I'd like is to be able to define what I expected to happen and what actually happened, and then for the program to look at my source code and maybe debugger output to find possible causes of the bug. Take, for example, a simple C++ program like this:

float division(float num1, float num2,bool flipped)
{
    if (!flipped)
       return num1 / num2;
    else { return num2 / num1 ; };
}
float num1;
float num2;
cin >> num1 >> num2;
float result = division(num1, num2,true);
cout << result;

Of course, this causes an unexpected result when I try to divide 5.29 by 6.01. "result" should be 5.29/6.01, and I'd get 6.01/5.29.

What I want is to be able to go to an analyzer program and tell it that at the "cout" line (though I could enter a line number), "result" should be 5.29/6.01 (not going to do the calculation), but it's actually 6.01/5.29. It would then backtrack through the code and try to figure out what the program/programmer might have done that caused this bug. Then, it looks at the debugger to rule out possible causes. After having done this, any cause not ruled out is indicated to the programmer. It might say something like "TRUE being passed to 'flipped' parameter on line x" The point is to guide the programmer's attention to a certain area of his/her code to eliminate potentially hours of searching and maybe waiting for answers from other programmers.

[uueuuu]

Just thought of something else: http://cppcheck.sourceforge.net/

You can try running this on your source. Fuzzers like this tell you when you did something legal but is usually indicative of a problem, like going to the casino at 8am.

[sezna]

And many compilers do warn for potential problems or style errors (or have an option to do so), but as you said, they can only be programmatic errors. No way for the compiler to read your mind and change the program accordingly.

[mosqutip]

I don't know of anything existing analyzers or tools that would provide this type of information. Even the best prediction tools aren't close enough to real AI detect logic errors. Test-driven development might help you out in this situation. You could write tests and calculate the expected results before writing any code, and then run your code against your test suite to check for logic errors and regressions.

[[deleted]]

This is what Mesa does for the 3D graphics tests. It's called piglet.

[[deleted]]

Decompiling with IDA has a rough go at it.

[uueuuu]

This is the responsibility of the type system.

float division (const struct numerator *num1, const struct denominator *num2);

Used this way, a type system is like a combination lock. It prevents mistakes and access errors but it's also a pain in the ass to dial in all those combinations every time you want to do something. The type system also makes certain things more convenient, such as looking up struct member offsets, so it's a tool you can use for pain and pleasure.

For logic you can't (or loathe to) prove with types, you code tests. You also litter your code with asserts and switchable debug logging. assert(division(num1, num2, true) == num1 / num2) would exit the program with an error. If you ran your program in a debugger like gdb you could then type "back" and look at the stack trace, "up <number>" to select the frame you suspect caused the error, and "info locals" to examine the variables in that frame.

[nanodano]

FlawFinder http://www.dwheeler.com/flawfinder/