Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in automatic static analysis all is done by the tools while in white box testing, a person creates the data to exercise the possible paths?

1 Answer 1


Static analysis and testing are different things, and pick up different classes of problems.

With black or white box testing, you execute parts of the code with inputs, etc that the developer or tester thinks are important. The only real quality control you have over the developer / tester's design of test cases is code coverage ... and that doesn't tell you anything about whether the logic has been properly tested.

By contrast, static analysis is looking for problems in a different way; i.e. by analysing what the code does independently of the test cases / data. Typically they find different kinds of problem, and typically they find them with less effort on the part of the developer / tester. For example, a static analyser might identify dead code, or a storage or resource leak that would be impossible to find by unit testing, or an unsafe practice like (in Java) using == to test strings.

In short the two approaches are complementary.

  • +1, but with white box testing and code coverage analysis you will identify dead code eventually.
    – scarfridge
    Nov 11, 2012 at 8:55
  • @Stephen C Yet both are considered to be a testing activity, looking for defects.
    – John V
    Nov 11, 2012 at 9:54
  • @user970696 - I disagree with that. Testing is not synonymous with "looking for defects", Testing is just one way of looking for defects. Other ways include use of static analysis tools, manual code review and (in an ideal world) formal methods.
    – Stephen C
    Nov 13, 2012 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.