Evolutionary development of a semantic patch using Coccinelle

Posted Mar 30, 2010 21:51 UTC (Tue) by neilbrown (subscriber, #359)
Parent article: Evolutionary development of a semantic patch using Coccinelle

This reminds me of something I would really like to have - a semantic 'grep'.

e.g. 'find all times the field 'next' of structure 'struct foo' is used'

You cannot do this with a regexp as lots of structures have a 'next' and
lots of variables are of type 'struct foo'.

I usually rename 'next' to 'nextX' and recompile, but there must be a faster way.

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 30, 2010 22:29 UTC (Tue) by hppnq (guest, #14462) [Link] (4 responses)

You could look at Elsa, written by Scott McPeak. It is a C/C++ parser, one of its sample applications is a semantic grep.

Have fun. ;-)

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 30, 2010 22:44 UTC (Tue) by nix (subscriber, #2304) [Link] (3 responses)

Ooooh, thanks for that. Not only does Elsa look nice, but Elkhound looks
like a seriously nice-looking parser generator.

Evolutionary development of a semantic patch using Coccinelle

Posted Apr 1, 2010 0:21 UTC (Thu) by vonbrand (subscriber, #4458) [Link] (2 responses)

Looks dead to me. No updates for 5 years, the site "it moved to" doesn't have the announced SVN repos, ...

Evolutionary development of a semantic patch using Coccinelle

Posted Apr 1, 2010 7:25 UTC (Thu) by ajb (subscriber, #9694) [Link]

Mozilla are maintaining a fork of it: https://wiki.mozilla.org/Pork

Evolutionary development of a semantic patch using Coccinelle

Posted Apr 1, 2010 7:42 UTC (Thu) by hppnq (guest, #14462) [Link]

The original Elsa page shows quite nicely and concisely how to implement a semantic grep. It is now used (and lives on) as a frontend for Oink, which has a Git repository here. It is also used by Pork, an Oink fork used by the Mozilla project. Both of these toolchains do static source code analysis and code rewriting.

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 31, 2010 4:06 UTC (Wed) by wsa (guest, #52415) [Link] (4 responses)

Grepping is possible, too. You can use '*' in the first column to just display a match. So, a general approach would be:

@@
// This metavariable has a defined type
struct foo *var;
@@
*   var->next

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 31, 2010 5:18 UTC (Wed) by neilbrown (subscriber, #359) [Link] (3 responses)

Thanks... that is quite close to what I wanted.

I really wanted to know if "(struct device_driver *)->groups" was ever set and the following pattern doesn't find any. It wouldn't find a static initialisation though..


struct device_driver *var;
@@
* var->groups

A similar search for struct device->groups does find a few hits.

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 31, 2010 7:50 UTC (Wed) by wsa (guest, #52415) [Link] (2 responses)

Unleashing another feature (regexp), you could do this for static ones:

@@
// Match identifiers starting with "device" for "device_type", "device_driver"...
identifier S ~= "device.*";
identifier name;
expression E;
@@
        static struct S name = {
*               .groups = E,
        };

which matched just a few device_types here.

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 31, 2010 12:34 UTC (Wed) by lawall (guest, #56234) [Link] (1 responses)

The following semantic patch:

@r@
struct device_driver var;
expression E;
@@
* var.groups = E;

Expands into essentially the following, via a user-configurable notion of "isomorphisms", which describe code patterns that are considered to be the same:

@@
struct device_driver var;
struct device_driver *_E1_1;
identifier _I_0;
@@

(
*var.groups = E;
|
*_E1_1->groups = E;
|
*struct device_driver _I_0 = {.groups = E,
};
)

This, however, doesn't match cases where the assignment is a subexpression of another expression. For that you could have to do:

@r@
struct device_driver var;
expression E;
@@
* var.groups = E

which would match both the . and the -> case, again via an isomorphism.

julia

Evolutionary development of a semantic patch using Coccinelle

Posted Apr 2, 2010 16:53 UTC (Fri) by giraffedata (guest, #1954) [Link]

Coccinelle doesn't seem to be all that semantic. It works on C syntax. A semantic matching rule would be something like "a statement that references the 'next' field of a 'device_driver' struct," as opposed to a rule that matches particular C syntax that happens to do that.

Finding all uses of a structure member

Posted Mar 31, 2010 9:12 UTC (Wed) by epa (subscriber, #39769) [Link]

e.g. 'find all times the field 'next' of structure 'struct foo' is used'

In fact, any decent IDE will do this. (The C preprocessor makes it almost impossible for any automated system to be 100% correct for C and C++, but for languages like Java and C# it's straightforward. An IDE might allow a simple right-click and 'find references' from the menu).

Evolutionary development of a semantic patch using Coccinelle

Posted Mar 31, 2010 14:16 UTC (Wed) by idle (guest, #5017) [Link]

sparse can do this. In fact it can do more, say,
find all times the field 'next' of structure 'struct foo'
is dereferenced (but not read/modified).

test-dissect is example.