Someone may want to see which Infer shows us, check http://blog.hoangnm.com/2015/06/12/infer-facebook-demo-and-t... . I just did a test job for Infer and going to apply it into some of my iOS projects.
Open-sourcing Facebook Infer: Identify bugs before you ship
111–120 of 121 posts
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#112The types of issues discovered (they mention null pointer access and resource and memory leaks) is much smaller than what a tool like Coverity will find (I use it). And they analyze C and Java, two languages supported by Coverity, a very mature tool... I am not certain of the proposed value, except it's free to other than Facebook - but not to Facebook, who pays engineers to develop this... Is this some kind of NIH s…
Findbugs is also very good for Java apps, and is free. (Developed by the University of Maryland)[1] [1] http://findbugs.sourceforge.net/
These sorts of tools can get very annoying with their excessive warnings, but when they work, they save tons of time. We faced one bug at work where when multiple users were making a search at the same time, you would get bogus results back. With one user it would work consistently. We spent weeks tracking this downs and the problem:
== instead of .equals() in Java
The thing is, we were used to ignoring find bugs, but lo and behold it had pointed this problem out.
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#113The types of issues discovered (they mention null pointer access and resource and memory leaks) is much smaller than what a tool like Coverity will find (I use it). And they analyze C and Java, two languages supported by Coverity, a very mature tool... I am not certain of the proposed value, except it's free to other than Facebook - but not to Facebook, who pays engineers to develop this... Is this some kind of NIH s…
Coverity is great, but for example on the mid-size service (10s but not 100s of kloc) that my team works on the analysis still takes hours. Therefore we only do it for prod releases, not on every commit or CI deployment. If you want to make static analysis part of the everyday development process, it has to be 1) very quick, ideally seconds; minutes at most 2) preferably something the developer can just run locally b…
You might want to check the desktop analysis in Coverity. It runs a complete analysis at the first time. But afterwards, it can run analysis on the changes - but against a version present on your build server. I had set this up for a code base in C (>100Kloc) and desktop analysis was fast enough.
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#114Can someone explain-it-like-I'm-a-90s-programmer (ELi90s?) why so much symbolic evaluation stuff gets done in OCaml? What does OCaml do that makes it so well suited for this problem domain? (I know a very little bit about symbolic evaluation and have done a very very little bit of it).
This article was written to answer this exact request:
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#115I'm going to completely ignore the tool itself and focus on the fact that it is written in OCaml. IMHO it's a great language that's much underused and as such there's a need for greater library ecosystem (what's out there is generally very good, but there isn't much). Hopefully adoption of OCaml at Facebook will grow and we'll see some interesting general purpose open-source libraries!
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#116Earlier quoted context omitted.
Right, and for Facebook internally, whatever the number is, it's a speed bump. But some reasons not to use Coverity then: * Doing it in-house gives Facebook near total control over what the system is going to focus on; they can tailor it exactly to their problem set. * It's a worthwhile open source project, since most values of "expensive" mean "other projects won't ever use it". * If it gets any traction as an open…
I'd add * Facebook has recently hired a number of expert language theorists and practitioners. Doing it in-house 1) Gives them something to do 2) Serves to cement Facebook's language-expertise-brand recognition and dominance. The very fact that hiring is focusing on this group signals to me that this is an area which Facebook takes seriously and wants to be taken seriously in.
If Facebook ever goes down as a social network, they will without doubt still be a powerful technology company.
FB has achieved a vertical integration in the IT world rivaled only by Google, Apple and maybe MS.
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#117Sounds like Rubocop for Ruby:
https://github.com/bbatsov/rubocop
Fast enough to integrate into a continuous integration build process and catches a lot of dumb mistakes/typos before deploying to production.
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#118The types of issues discovered (they mention null pointer access and resource and memory leaks) is much smaller than what a tool like Coverity will find (I use it). And they analyze C and Java, two languages supported by Coverity, a very mature tool... I am not certain of the proposed value, except it's free to other than Facebook - but not to Facebook, who pays engineers to develop this... Is this some kind of NIH s…
how does the post positive break compare?
Sorry.. should have read "false positive rate"
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#119Unfortunately, infer finds no issues in this simple variant of their Hello.java demo.
class Hello { private String s; int test() { return s.length(); } }
Re: Open-sourcing Facebook Infer: Identify bugs before you ship
#120I assume it can also be used for java server side code?
Yes, it can be used with most Java code you can build on the command line. Just run "infer -- ". Currently, this works with javac, Ant, Maven, and Gradle. See http://fbinfer.com/docs/hello-world.html#hello-world-android for a Gradle example.
I thought I'd try it with a fairly large project (353K lines of Java) at https://git.eclipse.org/c/hudson/org.eclipse.hudson.core.git...
This is a multi-level project. At both the top level and the individual module level, the command below seems to do exactly nothing. Actual output:
org.eclipse.hudson.core$ infer -- mvn build
org.eclipse.hudson.core$ cd hudson-core/
hudson-core$ infer -- mvn build
hudson-core$