Using Static Analysis to Find Bugs
Top Cited Papers
- 19 August 2008
- journal article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Software
- Vol. 25 (5) , 22-29
- https://doi.org/10.1109/ms.2008.130
Abstract
Static analysis examines code in the absence of input data and without running the code. It can detect potential security violations (SQL injection), runtime errors (dereferencing a null pointer) and logical inconsistencies (a conditional test that can't possibly be true). Although a rich body of literature exists on algorithms and analytical frameworks used by such tools, reports describing experiences in industry are much harder to come by. The authors describe FindBugs, an open source static-analysis tool for Java, and experiences using it in production settings. FindBugs evaluates what kinds of defects can be effectively detected with relatively simple techniques and helps developers understand how to incorporate such tools into software development.Keywords
This publication has 8 references indexed in Scilit:
- Status report on JSR-305Published by Association for Computing Machinery (ACM) ,2007
- Finding more null pointer bugs, but not too manyPublished by Association for Computing Machinery (ACM) ,2007
- Evaluating static analysis defect warnings on production softwarePublished by Association for Computing Machinery (ACM) ,2007
- Tracking defect warnings across versionsPublished by Association for Computing Machinery (ACM) ,2006
- Evaluating and tuning a static analysis to find null pointer bugsPublished by Association for Computing Machinery (ACM) ,2005
- Uprooting Software Defects at the SourceQueue, 2003
- How to write system-specific, static checkers in metalPublished by Association for Computing Machinery (ACM) ,2002
- A static analyzer for finding dynamic programming errorsSoftware: Practice and Experience, 2000