The Compiler Knows Your Code Better Than You Do (opens in new tab)

The Bug You Were Sure You Didn’t Write In 2011, the Chromium security team ran their codebase through Clang’s static analyzer. The analyzer was not new technology. It had been in development since 2007, built on top of the LLVM compiler infrastructure that Chris Lattner had started at the University of Illinois. But by 2011, it had grown sharp enough to find things that human reviewers missed routinely. What it found in Chromium was not obscure corner-case nonsense. It found use-after-free er...