A Comparison of Bug Finding Tools for Java
Top Cited Papers
- 6 April 2005
- proceedings article
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 245-256
- https://doi.org/10.1109/issre.2004.1
Abstract
Bugs in software are costly and difficult to find and fix. In recent years, many tools and techniques have been developed for automatically finding bugs by analyzing source code or intermediate code statically (at compile time). Different tools and techniques have different tradeoffs, but the practical impact of these tradeoffs is not well understood. In this paper, we apply five bug finding tools, specifically Bandera, ESC/Java 2, FindBugs, JLint, and PMD, to a variety of Java programs. By using a variety of tools, we are able to cross-check their bug reports and warnings. Our experimental results show that none of the tools strictly subsumes another, and indeed the tools often find non-overlapping bugs. We discuss the techniques each of the tools is based on, and we suggest how particular techniques affect the output of the tools. Finally, we propose a meta-tool that combines the output of the tools together, looking for particular lines of code, methods, and classes that many tools warn about.Keywords
This publication has 9 references indexed in Scilit:
- Finding bugs is easyPublished by Association for Computing Machinery (ACM) ,2004
- Z-Ranking: Using Statistical Analysis to Counter the Impact of Static Analysis ApproximationsPublished by Springer Nature ,2003
- Quickly detecting relevant program invariantsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Bandera: extracting finite-state models from Java source codePublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Extended static checking for JavaPublished by Association for Computing Machinery (ACM) ,2002
- Houdini, an Annotation Assistant for ESC/JavaPublished by Springer Nature ,2001
- Model checking JAVA programs using JAVA PathFinderInternational Journal on Software Tools for Technology Transfer, 2000
- The model checker SPINIEEE Transactions on Software Engineering, 1997
- Orthogonal defect classification-a concept for in-process measurementsIEEE Transactions on Software Engineering, 1992