The process of examining source code for problems without executing it.

learn more… | top users | synonyms

-1
votes
1answer
69 views

What is the recommended way to go about porting large code bases? [closed]

I am currently porting a large library (150+ files, 15k+ LOC) from Javascript to Java. Fortunately, the original library is already very object-oriented, so this has largely been a matter of ...
5
votes
3answers
208 views

Is it safe to rely on static analysis to “reproduce” concurrency bugs reliably?

I've inherited some Java code which I suspect harbours some concurrency bugs when synchronizing between a thread that queries data and an IO event that updates the same data. I'm trialling a static ...
3
votes
2answers
129 views

Checking program robustness using static code analysis

(Building on this question) If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
0
votes
2answers
266 views

How to enforce good coding style in team? [duplicate]

Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style. Is there a way to set up ...
3
votes
1answer
368 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
2
votes
1answer
115 views

Avoiding Packages with High Efferent Coupling

I use java language to develop android application, after static analysis, the tool warns about high efferent coupling. What is the reason of this warning? Is it about AComModel which is extended by ...
8
votes
3answers
186 views

How does BASIC locate an out-of-order NEXT statement when the loop body is skipped

Set the WABAC machine, Sherman. This question is about BASIC in general, and Microsoft's BASIC-80 in particular. Old school basic. With line numbers. How do (or, rather, did) old-school BASIC ...
2
votes
1answer
187 views

Is it worth the time to run static analysis tools (e.g. Findbugs) on test classes? [closed]

How likely is it for a bug that can be discovered by a static analysis tool (namely Findbugs) in test classes mask a real bug in the actual code? Is this a realistic scenario? Is it really worth the ...
3
votes
3answers
276 views

Static code analysis application: Where to start? [closed]

I am trying to create a poc for a static code analysis tool supporting an Object Oriented and a procedural language (C and Java, for example). Even after quite a bit of internet search I am still not ...
33
votes
4answers
4k views

Is there a correlation between the scale of the project and the strictness of the language?

Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that: Tolerant languages, such as dynamic and interpreted languages, are used ...
4
votes
3answers
168 views

Codebase Analysis of Trends over Time

I've looked around for a solution (preferably not hosted, something I can run locally) to do static analysis of a codebase over time for things like SLOC, Complexity, authors, commits, etc. It has to ...
2
votes
1answer
846 views

Static code analysis for bash scripts

I program CLI utilities in bash to automate much of my work as a DBA. I would like improve my code and make it more robus,t maybe with the help of some static code analysis tool like the one I used ...
3
votes
2answers
479 views

How is it possible to build the whole codebase from source at Google scale?

The first answer to an old, recently active question linked to a video which talks about how Google repository is done. One interesting thing which was mentioned is the fact that everything is build ...
3
votes
2answers
169 views

Strategies for using a code metric evaluation tool

Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
0
votes
2answers
296 views

Static analysis, dynamic analysis and testing

Based on answers I have received here and then confirmed in some authoritative sources (not ISTQB which seems to be too vague), there are 3 activities: Static analysis Dynamic analysis Testing ...
5
votes
3answers
643 views

Inspection, code review - is it really testing?

ISTQB, Wikipedia or other sources classify verification acitivities (reviews etc.) as a static testing, yet other do not. If we can say that peer reviews and inspections are actually a kind of a ...
2
votes
1answer
561 views

Automatic static analysis vs White box testing

Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in ...
1
vote
3answers
400 views

Why some consider static analysis a testing and some do not?

Preparing myself also to ISTQB certification, I found they call static analysis actually as a static testing, while some engineering book distinct between static analysis and testing, which is the ...
7
votes
4answers
888 views

Semi-intelligent “diff” utility

Part of the QA steps required for a project I am tangentially involved with require the person who is responsible to integrate new version of source file to first calculate how many lines have been ...
9
votes
5answers
590 views

How to avoid the pitfalls of static analysis

I'm working at a company that would score 11 on Joel Test - at least on paper. In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. ...
2
votes
2answers
420 views

Why does the code auditing tools like FindBugs require a compile step to work properly?

Basically I ran Intellij Idea 's plug in called FindBugs-Idea to analyze my code . I corrected whatever errror was caught and then ran the tool again but it was still complaining about the same error ...
7
votes
1answer
568 views

Are there tools that do automated validation of database standards?

I'm looking for something akin to FxCop, but for databases. Basically, I want to have a tool where I configure my database standards (naming conventions, field types, or more complex custom rules). ...
2
votes
5answers
1k views

Is automatically checking code quality via metrics possible?

For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
3
votes
2answers
201 views

“continue” and “break” for static analysis

I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...
6
votes
2answers
573 views

Static Analysis tools to detect architectural patterns

Currently for school we are working on a research project. The central question of this project is: Which architectural patterns can be detected using static code analysis? With architectural pattern ...
4
votes
4answers
1k views

Difference between static testing and code review [duplicate]

Possible Duplicate: What is the difference between Static code analysis and code review? What is the difference between static testing and code review? I found some information on ...
24
votes
8answers
1k views

Why is there such limited support for Design by Contract in most modern programming languages?

I recently discovered Design by Contract (DbC) and I find it an extremely interesting way to write code. Among other things, it would seem to offer: Better documentation. Since the contract is the ...
5
votes
3answers
621 views

Handling false positives and legacy code warnings in static-analysis of C++ code? [closed]

We have a large "legacy" C++ code base on which no static analysis is run at the moment. Every now and then, we are thinking about at least using cppcheck, maybe via Visual Lint. (I've also briefly ...
2
votes
3answers
230 views

Is it worth evaluating compiler optimization on trivial cases?

I'm currently testing Visual C++ 10 on some trivial pieces of code. For example, like this one (taken from here): int main() { int i; clrscr(); ...
17
votes
6answers
974 views

Any success stories continuously using commercial static analysis tools for C++? [closed]

I can't decide whether an offer of a commercial static analysis tool is worth spending the resources. We tried the tool on several million lines of our C++ code and it found something like 50 real ...
17
votes
8answers
1k views

Can the concept of Entropy be used to analyze source code in a useful way?

It seems logical to me that one could define a context for static source code analysis that included rules to produce a relative value of complexity. I know it is not like in the physical sense ...
9
votes
4answers
326 views

Dependency analysis for tests

Google built a testing system that can infer which tests need to be run after a change. In their own words: ... we built a continuous integration system that uses dependency analysis to ...
5
votes
2answers
144 views

Why would a code analysis tool be priced based on lines of code count?

I heard some static analysis tools are priced depending on how much code they are licensed for. I can think that it's usual segmentation - the more code the customer has the more care he needs and ...
14
votes
7answers
5k views

What are the real benefits of static code analysis?

Tools like pc-lint or QAC can be used to perform static code analysis on a code base. In my experience the static analysis often yields a huge amount of noise, i.e. warnings on things that are not ...
10
votes
8answers
430 views

How can current IDEs improve the development experience? What secondary tools should be primary?

A modern IDE wouldn't be taken seriously if it didn't have a good editor with syntax highlighting, comprehensive warnings, and a source-level debugger. And there are many more tools/IDE features that ...