Hi everyone,
I'm currently trying to perform static analysis on MIR, but I'm having trouble finding practical guidance. My focus isn’t on MIR’s design itself, but rather on how to deeply work with it—for example, using crates like rustc_middle or related ones.
If anyone has experience working with MIR or has gone through a learning process in this area, I’d really appreciate it if you could share your insights, resources, or a possible roadmap for getting started.
Thanks in advance!
I just shared such a talk about this topic in the last few days! (It's from the Chinese Rust compiler bootcamp, so it's in Chinese.)
I find it's quite easy for learners to start with rustc_public (formerly stable_mir) to explore MIR before they dive into the internal rustc APIs.
You can check out the slides or video (the microphone got muffled intermittent audio during recording).
I've also implemented a tiny checker os-checker/redpen to find potential call paths to a panic spot, using MirVisitor to collect direct calls and traverse through instances to construct the whole call graph, which is similar to what kani or usual static analysis tool does.
The idea is based on estebank/redpen, which is also a great example for you to learn how a classic static analyzer is written with rustc_driver and rustc_middle.
You should absolutely try to use rustc_public if you can. That's designed to be consumed in a less-breaks-all-the-time way by external tools.
If you need help, check out #project-stable-mir on Zulip.