Keeping a C analyser current with the C23 standard

Outcome

TrustInSoft Analyzer now supports the C23 features its customers had already started using: improved typing for enumerations, enumerations with a fixed underlying type, bit-precise integers, constexpr, and true and false as predefined constants.

Those features were chosen by customer demand rather than by working through the standard in order. The remaining C23 features were left for a later phase, because no customer had needed them yet.

Two defects in Clang's own handling of C23 were found while checking the analyser's behaviour against the standard, and both were reported upstream (#146351 and #147736). Several pre-existing issues in the analyser were found and reported in the same way.

TrustInSoft commissioned a second project immediately afterwards, extending the analyser's constant evaluator as part of its Rust analysis work.

Approach

Tarides worked inside TrustInSoft's own codebase and review process, with changes reviewed by their engineers alongside their internal work.

Adding enumerations with a fixed underlying type created a grammar conflict in the parser, which had accumulated ad-hoc rules over years of extensions. The parser was restructured first, replacing duplicated rules with parameterised ones and bringing rule names into line with the standard. That refactoring was submitted and reviewed on its own and carried no functional change, so it could be checked before the C23 features were built on top of it.

Smaller improvements came out of the same work. Empty initializers were already supported as a compiler extension rather than as a standard feature, so they were reimplemented to match the specification and their tests were changed to stop depending on GCC.

The second project covered compile-time expression evaluation: mutability, loops, and operators such as sizeof and alignment queries in constant expressions.

Challenge

TrustInSoft Analyzer checks C, C++ and Rust code in settings where a defect is expensive, and its users adopt new language standards before the tools around them do. A static analyser cannot skip syntax it does not recognise.

C23 touched the type system, literals, constant expressions and keywords at once, and most of it had to be handled by the front end before any analysis could run.

That front end descends from a lineage of OCaml C parsers, and the parts that needed changing were the parts that had been extended most often. Existing behaviour had to be preserved exactly, because the tool's value depends on its results not changing unexpectedly.