HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
xiw
stack
C++2013–2016
xiw / stack

stack

A static checker for identifying unstable code.

3Distinct people
4Mentions
0Explicit recommenders
366GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A static checker for identifying unstable code.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 6:01:08 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year4 dated mentions

Observed mentions: 2013-11-17 13:48:17 UTC to 2016-08-06 05:32:36 UTC.

01232013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20132014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2016

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC101
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC000
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC000
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC312

What Hacker News says

3 sources
Perhaps an editor could mark this (2016) despite this being the opposite of the usual custom? I've learned not to get excited when someone posts one a Dan Luu article, since it's usually something old that I've already seen. But despite the lack of a date at the top, and despite starting with references to 2010 and 2008 papers, this one is actually new! On further thought, maybe it would better to change the title to claim it's from (2010), wait for enough people to complain, then "something", then use that momentum to convince Dan to finally put dates on his articles. Just need to figure out what that "something" should be... -- I looked into Thread Sanitizer (libtsan) recently, and was happy to see that it's supported on recent GCC as well. Documentation is a little strange, as it's split between a Google Wiki on Github and Clang, w
Read the rest
hile the source is in LLVM: https://github.com/google/sanitizers/wiki/ThreadSanitizerCpp... http://clang.llvm.org/docs/ThreadSanitizer.html https://llvm.org/svn/llvm-project/llvm/trunk/lib/Transforms/... I was spooked by this FAQ on the Google Wiki page, though: Q: My code with C++ exceptions does not work with tsan. A: Tsan does not support C++ exceptions. Does this mean that it does not work at all on code that is written with exceptions, or that it might have false-positives or false-negatives when exceptions actually happen at runtime? -- For other tools, Intel has offers their "Parallel Inspector": https://software.intel.com/en-us/intel-inspector-xe. I haven't tried it, but it sounds like it would be useful for these issues: https://software.intel.com/en-us/get-started-with-inspector. Does anyone know how it compares with TSan? -- An example of an atomicity violation is this bug from MySQL: Thread 1: if (thd->proc_info) fputs(thd->proc_info, ...) Thread 2: thd->proc_info = NULL; While definitely a concurrency bug, I'm surprised that this would happen frequently enough to create numerous bug reports unless there is also an undesired compiler optimization that's removing the "guard" in Thread 1. That is, the window of opportunity seems very small if the code is being executed as written. I didn't look at the details of the linked bug reports, but I suspect the compiler is able to reason based on something earlier that thd->proc_info must be non-null at this point, and thus has omitted the check. If this is the case, it's possible that "Stack" would have caught this bug as well, or at least highlighted it as a place where the generated code was different than the programmer's intent. Stack is painful to install, and seems abandoned, but does catch flag some bugs that other tools miss: https://github.com/xiw/stack/ -- Does anyone know of other tools in this space? I'm still hoping there's a "silver bullet" I haven't found yet.
In Notes on concurrency bugs
It's usually argued that it would be too hard for the compiler to avoid false positives from templates and macro expansion. I don't like this argument, since distinguishing between "generated" code and "explicit" code isn't that hard. Also, the warning mechanism doesn't need to be perfect to be beneficial: it's generally better to catch some of the security flaws than to catch none. The one tool I've found that does catch many of these errors is "stack": https://github.com/xiw/stack It operates by identifying "unstable" code. Essentially, it uses Clang to optimize the code twice, once with optimizations on and once with optimizations off. Then it checks to see if any "basic blocks" have been removed. Its main problem is that it's difficult to set up. You have to locally compile a specific older version of LLVM with a particular set
Read the rest
of compile flags. But once you have it up, it catches a lot of non-obvious errors and doesn't have many false positives. Unfortunately, in the sample code I gave above, "stack" doesn't detect any errors, because Clang doesn't doesn't optimize out the "if (string)" statement like GCC does. And it doesn't catch the switch from printf() to puts() because it's a change of which function is called rather than a change in control flow.
In Memcpy (and friends) with NULL pointers

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.