The process of examining source code for problems without executing it.

learn more… | top users | synonyms

-4
votes
0answers
23 views

IntelliJ asymptotic complexity plugin? [on hold]

Is there any IntelliJ or Eclipse plugin that shows line/method asymptotic complexity on the fly like intellij shows for instance debug informations, but of course in compile time?
0
votes
0answers
52 views

Use of SAL annotations for C++ [on hold]

Code analysis tool for visual studio is able to detect some kinds of errors statically if you annotate functions with SAL We used it at first in windows driver when code was mostly C code, and where ...
1
vote
2answers
74 views

Why am I getting field visibility warnings in Sonar?

Some static analysis tools flag non-private fields with Variable '[nameHere]' must be private and have accessor methods. Sonar consistently presents such warnings and wants to change all ...
6
votes
1answer
393 views

What is the purpose of Code analysis and when do I need to use it?

I heard about Visual Studio's Code analysis but never used one. I've read MSDN, but still don't understand the real use of Code analysis. Isn't it the same as StyleCop? Somewhere, FxCop was also ...
1
vote
1answer
137 views

Hypothetical : What restrictions will I need to add to Java so that I can remove its GC? [closed]

This is a hypothetical, yet very technically precise question I'm trying to ask all the compiler/static analysis programmers. I'm trying to understand the extent of prohibitive features I would need ...
0
votes
1answer
23 views

Static analysis for finding capitalisation / case inconsistencies in file names

TLDR; I'm looking for ideas on how to flag code containing file names/paths that have inconsistent capitalisation with the actual file/directory. Situation I am migrating a significant code base ...
0
votes
1answer
101 views

To what extent can impact analysis of a code change be automated?

I'm not sure how possible it even is but as a programmer I have a sense of risk involved when I'm making changes to a code base. I've never seen a tool which basically tells me, as I'm coding, how ...
11
votes
4answers
2k views

Why shouldn't a method throw multiple types of checked exceptions?

We use SonarQube to analyse our Java code and it has this rule (set to critical): Public methods should throw at most one checked exception Using checked exceptions forces method callers to ...
-1
votes
1answer
96 views

Buffer-overflow vulnerabilities that a static code analyser won't pick up [closed]

I'll use FlawFinder in this example. FlawFinder is a static code "analyser" tool that examines C/C++ source files and outputs warnings/hits if a vulnerability was identified. The way it does this is ...
-1
votes
1answer
88 views

What is the recommended way to go about porting large code bases? [closed]

I am currently porting a large library (150+ files, 15k+ LOC) from Javascript to Java. Fortunately, the original library is already very object-oriented, so this has largely been a matter of ...
6
votes
3answers
301 views

Is it safe to rely on static analysis to “reproduce” concurrency bugs reliably?

I've inherited some Java code which I suspect harbours some concurrency bugs when synchronizing between a thread that queries data and an IO event that updates the same data. I'm trialling a static ...
2
votes
2answers
162 views

Checking program robustness using static code analysis

(Building on this question) If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
1
vote
2answers
430 views

How to set up something like an integration server that measures the quality of code and reject the code if the score is below a certain number?

Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style. Is there a way to set up ...
3
votes
1answer
427 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
2
votes
1answer
161 views

Avoiding Packages with High Efferent Coupling

I use java language to develop android application, after static analysis, the tool warns about high efferent coupling. What is the reason of this warning? Is it about AComModel which is extended by ...
8
votes
3answers
222 views

How does BASIC locate an out-of-order NEXT statement when the loop body is skipped

Set the WABAC machine, Sherman. This question is about BASIC in general, and Microsoft's BASIC-80 in particular. Old school basic. With line numbers. How do (or, rather, did) old-school BASIC ...
2
votes
1answer
205 views

Is it worth the time to run static analysis tools (e.g. Findbugs) on test classes? [closed]

How likely is it for a bug that can be discovered by a static analysis tool (namely Findbugs) in test classes mask a real bug in the actual code? Is this a realistic scenario? Is it really worth the ...
2
votes
3answers
487 views

Static code analysis application: Where to start? [closed]

I am trying to create a poc for a static code analysis tool supporting an Object Oriented and a procedural language (C and Java, for example). Even after quite a bit of internet search I am still not ...
46
votes
5answers
6k views

Is there a correlation between the scale of the project and the strictness of the language?

Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that: Tolerant languages, such as dynamic and interpreted languages, are used ...
4
votes
3answers
225 views

Codebase Analysis of Trends over Time

I've looked around for a solution (preferably not hosted, something I can run locally) to do static analysis of a codebase over time for things like SLOC, Complexity, authors, commits, etc. It has to ...
3
votes
1answer
2k views

Static code analysis for bash scripts

I program CLI utilities in bash to automate much of my work as a DBA. I would like improve my code and make it more robus,t maybe with the help of some static code analysis tool like the one I used ...
3
votes
2answers
652 views

How is it possible to build the whole codebase from source at Google scale?

The first answer to an old, recently active question linked to a video which talks about how Google repository is done. One interesting thing which was mentioned is the fact that everything is build ...
3
votes
2answers
186 views

Strategies for using a code metric evaluation tool

Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
0
votes
2answers
342 views

Static analysis, dynamic analysis and testing

Based on answers I have received here and then confirmed in some authoritative sources (not ISTQB which seems to be too vague), there are 3 activities: Static analysis Dynamic analysis Testing ...
5
votes
3answers
798 views

Inspection, code review - is it really testing?

ISTQB, Wikipedia or other sources classify verification acitivities (reviews etc.) as a static testing, yet other do not. If we can say that peer reviews and inspections are actually a kind of a ...
2
votes
1answer
771 views

Automatic static analysis vs White box testing

Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in ...
1
vote
3answers
488 views

Why some consider static analysis a testing and some do not?

Preparing myself also to ISTQB certification, I found they call static analysis actually as a static testing, while some engineering book distinct between static analysis and testing, which is the ...
7
votes
4answers
1k views

Semi-intelligent “diff” utility

Part of the QA steps required for a project I am tangentially involved with require the person who is responsible to integrate new version of source file to first calculate how many lines have been ...
9
votes
5answers
767 views

How to avoid the pitfalls of static analysis

I'm working at a company that would score 11 on Joel Test - at least on paper. In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. ...
2
votes
2answers
515 views

Why does the code auditing tools like FindBugs require a compile step to work properly?

Basically I ran Intellij Idea 's plug in called FindBugs-Idea to analyze my code . I corrected whatever errror was caught and then ran the tool again but it was still complaining about the same error ...
7
votes
1answer
744 views

Are there tools that do automated validation of database standards?

I'm looking for something akin to FxCop, but for databases. Basically, I want to have a tool where I configure my database standards (naming conventions, field types, or more complex custom rules). ...
2
votes
5answers
1k views

Is automatically checking code quality via metrics possible?

For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
3
votes
2answers
214 views

“continue” and “break” for static analysis

I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...
6
votes
2answers
718 views

Static Analysis tools to detect architectural patterns

Currently for school we are working on a research project. The central question of this project is: Which architectural patterns can be detected using static code analysis? With architectural pattern ...
4
votes
4answers
1k views

Difference between static testing and code review [duplicate]

Possible Duplicate: What is the difference between Static code analysis and code review? What is the difference between static testing and code review? I found some information on ...
28
votes
8answers
1k views

Why is there such limited support for Design by Contract in most modern programming languages?

I recently discovered Design by Contract (DbC) and I find it an extremely interesting way to write code. Among other things, it would seem to offer: Better documentation. Since the contract is the ...
5
votes
3answers
779 views

Handling false positives and legacy code warnings in static-analysis of C++ code? [closed]

We have a large "legacy" C++ code base on which no static analysis is run at the moment. Every now and then, we are thinking about at least using cppcheck, maybe via Visual Lint. (I've also briefly ...
2
votes
3answers
244 views

Is it worth evaluating compiler optimization on trivial cases?

I'm currently testing Visual C++ 10 on some trivial pieces of code. For example, like this one (taken from here): int main() { int i; clrscr(); ...
17
votes
6answers
1k views

Any success stories continuously using commercial static analysis tools for C++? [closed]

I can't decide whether an offer of a commercial static analysis tool is worth spending the resources. We tried the tool on several million lines of our C++ code and it found something like 50 real ...
17
votes
8answers
1k views

Can the concept of Entropy be used to analyze source code in a useful way?

It seems logical to me that one could define a context for static source code analysis that included rules to produce a relative value of complexity. I know it is not like in the physical sense ...
9
votes
4answers
348 views

Dependency analysis for tests

Google built a testing system that can infer which tests need to be run after a change. In their own words: ... we built a continuous integration system that uses dependency analysis to ...
3
votes
2answers
149 views

Why would a code analysis tool be priced based on lines of code count? [closed]

I heard some static analysis tools are priced depending on how much code they are licensed for. I can think that it's usual segmentation - the more code the customer has the more care he needs and ...
14
votes
7answers
6k views

What are the real benefits of static code analysis?

Tools like pc-lint or QAC can be used to perform static code analysis on a code base. In my experience the static analysis often yields a huge amount of noise, i.e. warnings on things that are not ...