A Survey of Static Software Analysis Tools.ppt

A Survey of Static Software Analysis Tools Mark Smith Contents Overview Static Analysis Tools FindBugs PMD IntelliJ IDEA Benchmarks Results Conclusion Overview Goals: Derive comparisons and conduct an informative survey of three static analysis tools: FindBugs, PMD, IntelliJ IDEA. To provide some guidance as to how the tools perform differently why they are different what techniques they use. Tool were selected due to ease of implementation well-known in the field of bug-finding tools. Static Analysis Tools FindBugs Based on the concept of bug patterns (code idiom that is often an error).? Bug patterns arise for a variety of reasons: Difficult language features Misunderstood API methods Misunderstood invariants when code is modified during maintenance Typos, use of the wrong boolean operator Uses ad-hoc techniques designed to balance precision, efficiency, and usability. One of its main techniques - syntactically match source code to known suspicious programming practice. Uses static analysis to inspect Java bytecode (compiled class files) Static Analysis Tools PMD Scans Java source code and looks for potential problems such as: Empty try/catch/finally/switch blocks, Unused local variables, parameters and private methods, Empty if/while statements, Overcomplicated expressions Duplicate code Performs syntactic checks on program source code, but does not have a dataflow component. Known to detect clearly erroneous code - many of the “bugs” are stylistic conventions whose violation might be suspicious under some circumstances. Inspects Java code using a rules-based approach. Static Analysis Tools IntelliJ IDEA Commercial, cross-platform Java IDE by JetBrains Focuses on developer productivity and advanced JavaScript code editing support Design is centered around programmer productivity: a number of features that speed up development time and allow programmers to concentrate on functionality while IDEA handles more mundane coding tasks. Associa