The increasing complexity of modern software poses significant challenges for maintenance. For instance, the Chromium browser, an open-source version of Chrome, consists of 27 million lines of code. Developers of such large codebases increasingly rely on software analysis tools to maintain software quality. There is a need for a fundamentally different approach to software analysis that aims to scale to large applications while remaining accurate.

Code consists of two interacting channels: algorithmic channel (code instructions) aimed at machines and natural language channel (identifiers and comments) targeted at human co-developers. Software analysis tools have long focused on improving the algorithmic channel, ignoring intent hints in the natural language channel. Dual-channel approaches can make the software analysis lightweight and scalable using novel representations of program semantics drawn upon the natural language channel. To address this gap, we propose a novel approach to software analysis that harnesses the information in both channels to enhance precision and scalability.

This thesis explores novel forms of program analysis that leverage the accord or discord between the two channels. The precision of the software analysis can be improved with intent hints. We show that dual-channel information can be used to check if explicit type conversions are used judiciously. The discord between identifiers and the types of variables allows our approach to identifying poor programming and naming practices.

Furthermore, we propose an extension of Call Graphs called Natural Call Graphs, whose edges are weighted based on the callee’s importance to the caller. We show that these weights can be used to identify relevant functions missed by testing. The scalability of these approaches is demonstrated by utilising lightweight techniques in their implementation. Natural Call Graphs present a novel perspective over intermediate representation that can minimise the cost of program analysis by guiding analysis to important parts of the application.