The process of examining source code for problems without executing it.

learn more… | top users | synonyms

56
votes
5answers
7k views

Is there a correlation between the scale of the project and the strictness of the language?

Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that: Tolerant languages, such as dynamic and interpreted languages, are used ...
26
votes
4answers
14k views

Why shouldn't a method throw multiple types of checked exceptions?

We use SonarQube to analyse our Java code and it has this rule (set to critical): Public methods should throw at most one checked exception Using checked exceptions forces method callers to ...
1
vote
2answers
474 views

How to set up something like an integration server that measures the quality of code and reject the code if the score is below a certain number?

Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style. Is there a way to set up ...
25
votes
8answers
4k views

Is it possible to statically predict when to deallocate memory---from source code only?

Memory (and resource locks) are returned to the OS at deterministic points during a program's execution. The control flow of a program by itself is enough to know where, for sure, a given resource can ...
18
votes
6answers
2k views

Any success stories continuously using commercial static analysis tools for C++? [closed]

I can't decide whether an offer of a commercial static analysis tool is worth spending the resources. We tried the tool on several million lines of our C++ code and it found something like 50 real ...
4
votes
2answers
1k views

How is it possible to build the whole codebase from source at Google scale?

The first answer to an old, recently active question linked to a video which talks about how Google repository is done. One interesting thing which was mentioned is the fact that everything is build ...
9
votes
1answer
3k views

What is the purpose of Code analysis and when do I need to use it?

I heard about Visual Studio's Code analysis but never used one. I've read MSDN, but still don't understand the real use of Code analysis. Isn't it the same as StyleCop? Somewhere, FxCop was also ...
4
votes
4answers
2k views

Difference between static testing and code review [duplicate]

Possible Duplicate: What is the difference between Static code analysis and code review? What is the difference between static testing and code review? I found some information on wikipedia ...
5
votes
2answers
156 views

How much static analysis history should a company keep?

Supposing you work in a very large global company with lot of code at all levels (e.g. from embedded to mobile platform application code), and projects can last anything between 6 months to 5 years... ...
5
votes
3answers
1k views

Handling false positives and legacy code warnings in static-analysis of C++ code? [closed]

We have a large "legacy" C++ code base on which no static analysis is run at the moment. Every now and then, we are thinking about at least using cppcheck, maybe via Visual Lint. (I've also briefly ...