Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [static-analysis]

The analysis of source code or object code without executing the program. This may be done by automated tools or by human analysis.

1
vote
3answers
197 views

Automated test “all changes are feature-flagged”, possible?

Let's say in an effort to improve quality, your team agrees on the following policy: all commits to the master branch (direct or via pull request) have to be categorized as either bugfixes or ...
0
votes
1answer
68 views

Effective ways of dealing with static analyser warnings caused by incidental use of reflection

I don't normally use reflection directly while programming in Java. But I do use APIs and frameworks that internally rely on reflection or annotations to provide customization points. A lot of ...
0
votes
0answers
52 views

Program Simulation Techniques

I've noticed that data-flow analysis uses approximations of a programs steps by simulating the value flow in some way (which I don't fully understand yet). They describe it well here. On page 4 they ...
2
votes
1answer
861 views

Difference Between Linter, Sanitizer and Static Analysis Tools

I've recently been looking at C++ static analysis tools. One thing that confuses me is the terminology used with these tools: Some tools are simply called "static analysis tools" (e.g. CppCheck), ...
0
votes
4answers
383 views

How to evaluate efficiency of assembler code?

I was coding some functions in C++ and wondered how different versions of those functions would affect generated assembly code. I put different versions into the Godbolt Compiler Explorer Tool and ...
3
votes
3answers
356 views

Nesting class and enums types

If an enum type is dedicate only to a specific class, does it make sense to declare it inside the class itself? I mean, would it help to understand that this enum type was designed to be used only ...
1
vote
2answers
697 views

Can technical debt be detected by code analysis?

SonarQube is a software product which runs various coding style rules and other metrics similar to FxCop or Re-sharper. It defines breaking the style rules as: "MAINTAINABILITY ISSUE This is ...
7
votes
2answers
302 views

Is practice of using Annotations detrimental to code quality and longer term code maintenance?

With Doctrine annotation processing engine for PHP, and Annotatons being used for Doctrine Entities and for Zend Form, and possibly other things, and use in other languages as well, it looks like ...
28
votes
8answers
5k views

How to argue against lowering quality standards for legacy codebase? [closed]

We have here a large legacy code base with bad code you can't imagine. We defined now some quality standards and want to get those fulfilled in either completely new codebase, but also if you touch ...
8
votes
2answers
536 views

Is it wise to use Clang for personal code analysis in a project that builds with gcc?

I started to work on several C projects that are building using gcc. I believe this choice was made for several reasons: Had to cross-compile for arm very early on (I think). Performance is the first ...
0
votes
1answer
54 views

Static analysis criteria different for various parts of solution

We have quite a large project where and tend to apply risk based approach to stringency of unit tests and code reviews. E.g. components classified as A need to have higher coverage than components ...
2
votes
3answers
181 views

What is the difference between Static code analysis and code quality?

I need to know whether Static code analysis and code Quality are same or not because, I need to find out the tools for code quality and each time I google for it, I'm getting response for the tools ...
17
votes
3answers
795 views

Are there alternatives to types for static analysis?

Static typing in a programming language can be helpful for enforcing certain guarantees at compile time- but are types the only tool for this job? Are there other ways of specifying invariants? For ...
5
votes
2answers
220 views

How much static analysis history should a company keep?

Supposing you work in a very large global company with lot of code at all levels (e.g. from embedded to mobile platform application code), and projects can last anything between 6 months to 5 years... ...
3
votes
2answers
118 views

How to integrate static analysis tools in a running project

I've started in a company that has been developing an app for 4 years. They haven't used any static analysis tool until now so if we include them we will have tons of warnings. Do you know how can we ...
5
votes
2answers
327 views

Should static analysis be integrated with code review? [closed]

I want to integrate various static analysis tools, and then add the results as comments on a file within code review tools, such as Stash or Review board. I am exploring the feasibility of writing ...
1
vote
2answers
5k views

Why am I getting field visibility warnings in Sonar?

Some static analysis tools flag non-private fields with Variable '[nameHere]' must be private and have accessor methods. Sonar consistently presents such warnings and wants to change all protected ...
24
votes
1answer
13k views

What is the purpose of Code analysis and when do I need to use it?

I heard about Visual Studio's Code analysis but never used one. I've read MSDN, but still don't understand the real use of Code analysis. Isn't it the same as StyleCop? Somewhere, FxCop was also ...
0
votes
1answer
46 views

Static analysis for finding capitalisation / case inconsistencies in file names

TLDR; I'm looking for ideas on how to flag code containing file names/paths that have inconsistent capitalisation with the actual file/directory. Situation I am migrating a significant code base ...
0
votes
1answer
555 views

To what extent can impact analysis of a code change be automated?

I'm not sure how possible it even is but as a programmer I have a sense of risk involved when I'm making changes to a code base. I've never seen a tool which basically tells me, as I'm coding, how ...
44
votes
4answers
38k views

Why shouldn't a method throw multiple types of checked exceptions?

We use SonarQube to analyse our Java code and it has this rule (set to critical): Public methods should throw at most one checked exception Using checked exceptions forces method callers to ...
8
votes
3answers
981 views

Is it safe to rely on static analysis to “reproduce” concurrency bugs reliably?

I've inherited some Java code which I suspect harbours some concurrency bugs when synchronizing between a thread that queries data and an IO event that updates the same data. I'm trialling a static ...
2
votes
2answers
339 views

Checking program robustness using static code analysis

(Building on this question) If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
1
vote
2answers
541 views

How to set up something like an integration server that measures the quality of code and reject the code if the score is below a certain number?

Even if I don't like enforcing people to do things (and I believe that it may decline the productivity and cause anger), I really want to enforce good coding style. Is there a way to set up ...
2
votes
2answers
948 views

Query Language for Java Code Analysis

I want to write a refactoring tool for the Java programming language. For this reason I need to do structural queries against the abstract syntax tree. Given this AST how do I get answers to the ...
69
votes
5answers
9k views

Is there a correlation between the scale of the project and the strictness of the language?

Explaining the difference between strictness of languages and paradigms to a colleague of mine, I ended up asserting that: Tolerant languages, such as dynamic and interpreted languages, are used best ...
35
votes
4answers
23k views

Why would anyone invest time in Microsoft “Roslyn”?

I have just been reading through some of the white papers & examples from Microsoft "Roslyn" and the concept seems very interesting. From what I can tell, it opens up the black box that is the ...
8
votes
2answers
2k views

How is it possible to build the whole codebase from source at Google scale?

The first answer to an old, recently active question linked to a video which talks about how Google repository is done. One interesting thing which was mentioned is the fact that everything is build ...
4
votes
2answers
241 views

Strategies for using a code metric evaluation tool

Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
0
votes
2answers
564 views

Static analysis, dynamic analysis and testing

Based on answers I have received here and then confirmed in some authoritative sources (not ISTQB which seems to be too vague), there are 3 activities: Static analysis Dynamic analysis Testing ...
5
votes
3answers
2k views

Inspection, code review - is it really testing?

ISTQB, Wikipedia or other sources classify verification acitivities (reviews etc.) as a static testing, yet other do not. If we can say that peer reviews and inspections are actually a kind of a ...
2
votes
1answer
2k views

Automatic static analysis vs White box testing

Many sources note that automatic static code analysis include data flow and control flow. But these two are included in white box testing as well. Is there a difference in the automation? That in ...
1
vote
3answers
1k views

Why some consider static analysis a testing and some do not?

Preparing myself also to ISTQB certification, I found they call static analysis actually as a static testing, while some engineering book distinct between static analysis and testing, which is the ...
12
votes
5answers
762 views

Programmaticaly finding the Landau notation (Big O or Theta notation) of an algorithm?

I'm used to search for the Landau (Big O, Theta...) notation of my algorithms by hand to make sure they are as optimized as they can be, but when the functions are getting really big and complex, it's ...
16
votes
7answers
2k views

How to avoid the pitfalls of static analysis

I'm working at a company that would score 11 on Joel Test - at least on paper. In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. Now,...
3
votes
2answers
1k views

Why does the code auditing tools like FindBugs require a compile step to work properly?

Basically I ran Intellij Idea 's plug in called FindBugs-Idea to analyze my code . I corrected whatever errror was caught and then ran the tool again but it was still complaining about the same error ...
2
votes
5answers
2k views

Is automatically checking code quality via metrics possible?

For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
3
votes
2answers
255 views

“continue” and “break” for static analysis

I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...
1
vote
1answer
288 views

is there a formal algebra method to analyze programs?

Is there a formal/academic connection between an imperative program and algebra, and if so where would I learn about it? The example I'm thinking of is: if(C1) { A1(); A2(); } if(C2) { A1(); A2(); } ...
5
votes
2answers
2k views

Static Analysis tools to detect architectural patterns

Currently for school we are working on a research project. The central question of this project is: Which architectural patterns can be detected using static code analysis? With architectural pattern ...
4
votes
4answers
3k views

Difference between static testing and code review [duplicate]

Possible Duplicate: What is the difference between Static code analysis and code review? What is the difference between static testing and code review? I found some information on wikipedia that ...
4
votes
1answer
213 views

Rapid code analysis

I have recently moved to a new company where I am tasked (in part) with evaluating the existing code base and coming up with patterns and best practices. Our development team consists of around 20 ...
18
votes
3answers
414 views

Is there a correlation between complexity and reachability?

I've been studying cyclomatic complexity (McCabe) and reachability of software at uni recently. Today my lecturer said that there's no correlation between the two metrics, but is this really the case? ...
5
votes
3answers
2k views

Handling false positives and legacy code warnings in static-analysis of C++ code? [closed]

We have a large "legacy" C++ code base on which no static analysis is run at the moment. Every now and then, we are thinking about at least using cppcheck, maybe via Visual Lint. (I've also briefly ...
19
votes
10answers
3k views

Can the concept of Entropy be used to analyze source code in a useful way?

It seems logical to me that one could define a context for static source code analysis that included rules to produce a relative value of complexity. I know it is not like in the physical sense ...
7
votes
3answers
682 views

Dependency analysis for tests [closed]

Google built a testing system that can infer which tests need to be run after a change. In their own words: ... we built a continuous integration system that uses dependency analysis to ...
18
votes
7answers
12k views

What are the real benefits of static code analysis?

Tools like pc-lint or QAC can be used to perform static code analysis on a code base. In my experience the static analysis often yields a huge amount of noise, i.e. warnings on things that are not ...