Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

viva64.com

Post reply on HN
Print view View original

41–50 of 130 posts

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#41

Post by M4v3R »

egwor wrote: post #27

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analy…

Don't know about IntelliJ, but XCode does real-time analysis as well, but it also has a mode for deep static analysis, which for example does code path analysis for finding dead code paths, even across methods. This kind of stuff would be hard to perform in real-time.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#42

Post by frobozz »

tunesmith wrote: post #10

It's possible to ship working dynamically-typed code that is just absolutely littered with problems that static-analysis tools complain about (even to the point of being "accidentally correct"). So then you can spend a bunch of hours making it compliant, and it's a big refactor that takes a while for other people to review/qa/approve, meanwhile the product folks are grousing about the time it's taking away from the s…

If you had static analysis in from the start, that wouldn't be a problem.

If you add static analysis to a messy project, define success thresholds based on the current violation count, and/or disable violation categories that you can live with. The rule then should be "don't make it worse, try to make it a bit better when you can", rather than "don't commit anything to main until the checker says it's perfect".

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#43

Post by danbruc »

egwor wrote: post #27

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analy…

Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#45

Post by Ono-Sendai »

72deluxe wrote: post #28
maccard wrote: post #12

Earlier quoted context omitted.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

Why is your compile 10 minutes? Mine is about 20 seconds for ~82000 lines of C++ (not comments), with 43000 header lines and 7669 lines of C (according to cloc), and that's on a 2008 quad-core Xeon Mac Pro. Do you not parallel build?

He probably has more source code.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#46

Post by [deleted] »

maccard wrote: post #11
derefr wrote: post #6

I don't know how is why! (And if I learned, then my coworkers wouldn't know how, so until I got everyone else on board, I would be making the bed only to have them jump all over it again.) Don't tell me to hunt down random third-party tools that none of my coworkers has heard of, that I have to convince them to adopt, and which each solve a little (usually overlapping) bit of the problem so I have to run all of them…

Given that this article is written by/for pvs studio, which works mostly inside visual studio (you can get it to work outside but it seems to require some amount of setup), anyone using visual studio's too chain has a static analysis tool at their disposal. Also, clang has built in static analysis, and I can't speak for gcc.

[deleted]

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#47

Post by maccard »

72deluxe wrote: post #28
maccard wrote: post #12

Earlier quoted context omitted.

My compile is already 10 minutes, I don't want to add a static analysis pass to every build thanks.

Why is your compile 10 minutes? Mine is about 20 seconds for ~82000 lines of C++ (not comments), with 43000 header lines and 7669 lines of C (according to cloc), and that's on a 2008 quad-core Xeon Mac Pro. Do you not parallel build?

Parallel build with 40 cores(2x intel xeons), 32GB ram using Visual Studio. According to cloc, we have 11k C++ files. 18k C/c++ header, with 4.5M lines of C++, and 1.5M C/C++ Header, and 700K C. We use a unity build to speed it up (to 10 minutes) without it, it's roughly 40 minutes.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#48

Post by amelius »

danbruc wrote: post #43
egwor wrote: post #27

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analy…

Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.

Indeed, those real time checks are currently just a convenience, not anything really essential.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#49

Post by inglor »

danbruc wrote: post #43
egwor wrote: post #27

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analy…

Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.

A tool like IntelliJ can do deep analysis off-line and in the background and only tell you about the results. This is a good tradeoff between fast feedback and deep analysis.

Re: Why Don't Software Developers Use Static Analysis Tools to Find Bugs?

#50

Post by inglor »

M4v3R wrote: post #41
egwor wrote: post #27

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analy…

Don't know about IntelliJ, but XCode does real-time analysis as well, but it also has a mode for deep static analysis, which for example does code path analysis for finding dead code paths, even across methods. This kind of stuff would be hard to perform in real-time.

Why? You'd just keep the code in SSA and diff whenever the user adds code - you need to create the form _once_ but after you've created it diffing it should be reasonably fast - the creation can be done at project creation time and it can be changed on-line and incrementally. I'm not sure if tools actually do it but it definitely sounds possible.
Post reply on HN