What is the difference between Static code analysis and code review?

Question

I just wanted to know what the difference is between static code analysis and code review. How are each of these two done? More specifically, what are the tools available today for code review/static analysis of PHP? I would also like to know about good tools for code review for any language.

Answer 1

Code review is something people do, static analysis is something machines do. There are (sometimes good) static analysis tools. Code review is when a colleague/mentor/professor/friend goes over your code and gives you constructive criticism.

Static analysis is, on the other hand, an automated process in which a machine, informed by what it knows about the language it is analyzing (usually from the type system), analyzes a program and tries to pick out things that could be incorrect, inefficient, poor style, or otherwise suboptimal.

Answer 2

Code Review is when A senior or a dedicated authority checks your code, your way of coding, the standards followed in the code and specifically the logic level of the code

As far As static analysis is concerned, it is the analysis of computer software that is performed without actually executing programs built from that software (analysis performed on executing programs is known as dynamic analysis)

The List of tools as per the technology is given in below link

List Of Tools for Static Analysis

Hence code review and static analysis are completely different terms.

Answer 3

static code analysis is performed by automated tool, code review is done with people before the code is committed.

Tools for code review:

1.beyond compare

2.the diff of version control software

These tools are always used to generate the difference between the old version and the new version.

Answer 4

Static analysis is the process of analyzing a software without executing it. This is very good and recommended, but you have to keep in mind that

1. different static analysis tools have different understanding of the code they are studying, hence they can signal (or not signal) different issues. One tool can give a clean report, and the other may complain about a million things.
2. a dynamic tool (to name an example, think of valgrind) can find many other issues, at the price of a serious burden on the resource consumption (time, memory usage). This is so because you are usually running an instrumented version of the software. Notice that, by being instrumented in some way (replace your malloc with a debugging malloc) it is not exactly identical to your software (as you can see from the execution times)

Both of these approaches suffer from the lack of context: they don't know what the sw is supposed to achieve.

Code review is done by another coder, who supposedly knows it and can check

1. if the code is right
2. if the software is semantically correct.

It is much more expensive and it has a varying degree of repeatability but is a great help.

As always, there is not a single silver bullet which will fix all the bugs and avoid all the problems. Applying - as much as possible given the place, the code, the time, the three forms of check (static, dynamic, more eyes (and brains) actually looking at the code) is recommended.

ps: I must note that it is usually much better to apply the tools from scratch. Converting a legacy system is a much less pleasurable experience, due to false positives. If you start from scratch and always aim at keeping the analysis tool clean, you will probably avoid a lot of problems.

pps: as for tools, it depends on the language. In the C and C++ world you can start by looking at Visual Studio itself, which contains a built-in static analysis tool. A relatively complete list can be found on Wikipedia.

ppps: Static analysis is more suited to static languages, like C or C++. For Python it can be really difficult to say if a name which refers to a list at a point will refer to a list for the rest of the program, due to its dynamic properties. This doesn't mean that nothing can be done, as a JIT effort like PyPy shows.

Answer 5

Static analysis is when an artifact is analyzed without being executed. Although it can be applied to any artifact, it is often applied to source code or object code and refers to the use of specific tools to analyze and gain information about these work products. These tools produce reports that are interpreted by an engineer for use in determining the quality of the system under construction, and as a guide to planning development and maintenance. Wikipedia has a list of tools for static analysis, organized by language and with a brief description of their capabilities.

Reviews are a human evaluation of some work product, which could be code. Reviews can also be conducted on designs or other documents as well. The idea is that people familiar with the work product other than the developer are looking at it in order to find mistakes, ranging from security problems to violations of the coding standard.

Technically, a code review can be considered a form of static analysis, since the code is not actually executed during the review. However, in common terminology, "static analysis" typically refers to machine parsing of source or object files while "review" indicates that humans are the one doing the analysis.

Answer 6

Code review is more qualitative assessment, static code analysis is more quantitative assessment.

Hey, boy, this method can be written better

vs, f.e

Decreased performance. It is inefficient to identify an empty string by using 'wcslen(str) > 0' construct. A more efficient way is to check: str[0] != '\0'.

Decreased performance. The expression of strlen(MyStr.c_str()) kind can be rewritten as MyStr.length()

Decreased performance. In case 'Order' is iterator it's more effective to use prefix form of increment. Replace iterator++ with ++iterator.

While real errors can (obviously) exist and be detected by SCA

Incorrect format. Consider checking the N actual argument of the 'Foo' function

The expression was enclosed by parentheses twice: ((expression)). One pair of parentheses is unnecessary or misprint is present

A call of the 'memset' function will lead to underflow of the buffer 'dest.lfFaceName'

Answer 7

Code review is useful technique to smell problems in source code very early stage. As part of this exercise many issues like performance, scalability, and coding standards identified and rectified. This will improve code quality.

Static analysis is used for analyze code quality metrics like cyclometric complexity, maintainability index, depth of inheritance, and class couplings. Various tools available in the market to analyze code qualities. C# developer uses Microsoft visual studio for generating metric reports.