Evaluating static analysis defect warnings on production software
Top Cited Papers
- 13 June 2007
- proceedings article
- Published by Association for Computing Machinery (ACM)
Abstract
Static analysis tools for software defect detection are becoming widely used in practice. However, there is little public information regarding the experimental evaluation of the accuracy and value of the warnings these tools report. In this paper, we discuss the warnings found by FindBugs, a static analysis tool that finds defects in Java programs. We discuss the kinds of warnings generated and the classification of warnings into false positives, trivial bugs and serious bugs. We also provide some insight into why static analysis tools often detect true but trivial bugs, and some information about defect warnings across the development lifetime of software release. We report data on the defect warnings in Sun's Java 6 JRE, in Sun's Glassfish JEE server, and in portions of Google's Java codebase. Finally, we report on some experiences from incorporating static analysis into the software development process at Google.Keywords
This publication has 8 references indexed in Scilit:
- Static error detection using semantic inconsistency inferencePublished by Association for Computing Machinery (ACM) ,2007
- Have things changed now?Published by Association for Computing Machinery (ACM) ,2006
- Tracking defect warnings across versionsPublished by Association for Computing Machinery (ACM) ,2006
- A Comparison of Bug Finding Tools for JavaPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Comparing Bug Finding Tools with Reviews and TestsPublished by Springer Nature ,2005
- Testing static analysis tools using exploitable buffer overflows from open source codePublished by Association for Computing Machinery (ACM) ,2004
- How to write system-specific, static checkers in metalPublished by Association for Computing Machinery (ACM) ,2002
- Bugs as deviant behaviorPublished by Association for Computing Machinery (ACM) ,2001