Correlation of problem reports with static analysis results

[mmilata]

I wanted to work on this some time ago but it looks like it will never happen - I'm writing this down in case anyone finds this interesting and wants to pick up the work.

The basic idea is to take set of problem reports, set of static analysis results (aka traces aka defects), and find pairs such that they both refer to a single code location. Finding such pair might mean that there is underlying bug that caused the problem report to be sent and the same bug was found by the static analyzer. It can be valuable because this means that the static analysis result is not a false positive (and therefore should have higher priority to be fixed) and that we have additional information about the bug from the static analyzer (which might help in fixing the bug).

More detailed description and some preliminary experiments can be found here and here. The original experiments were done using the firehose framework for static analysis results. It seems to be no longer maintained so I'd suggest taking advantage of the csmock project which is used and actively maintained.

More information about csmock:

• https://kdudka.fedorapeople.org/devconf15.pdf
• https://kdudka.fedorapeople.org/static-analysis-flock2014.pdf