Lackwit
•Semantic
•Scalable
•Real language (C)
•Static
•Can work on incomplete
programs
–Make assumptions about missing code,
or supply stubs
•Sample queries
–Which integer variables contain file handles?
–Can pointer foo in function bar be passed
to free()? If so, what
paths in the call graph are
involved?
–Field f of variable v has an incorrect value; where in the source might it have changed?
–Which functions modify the cur_veh field
of map_manager_global?