SoylentNews is people
SoylentNews
I am really astonished by the capabilities of static code analysis. The tool surprised me the other day as it turned out to be smarter and more attentive than I am. I found I must be careful when working with static analysis tools. Code reported by the analyzer often looks fine and I'm tempted to discard the warning as a false positive and move on. I fell into this trap and failed to spot bugs...Even I, one of the PVS-Studio developers.
So, appreciate and use static code analyzers! They will help save your time and nerve cells.
[Ed note: I debated running this story as there was an element of self-promotion (aka Bin Spam), but the submitter has been with the site for a while and has posted informative comments. Besides, I know there have been far too many times when I've seen a compiler complain about some section of my code and I'm thinking there is nothing wrong with it — and then I, finally, see my mistake. Anyone have samples of code where you just knew the compiler or static analyzer was wrong, only to find out otherwise? --martyb]
(Score: 2, Interesting) by Anonymous Coward on Monday October 23 2017, @09:40PM
The only people I have found that have a negative reaction to these sorts of tools are the very ones who need them, desperately. They want to pretend they do not make errors. Once you accept you are not a walking encyclopedia of the different C/C++ specifications and the nuances of each compiler. Then the easy to find abuses of those specifications you realize you need these tools to help you. I have over the years humbled more than one super wizz kid cowboy programer with these sorts of tools. Then showing them in nice easy examples (usually provided by the tools). Of how big a fuckup to the code they are making. I usually bring them in once a project has spent about a week 'finding that crashing/memory leak' bug. Usually finds them in under a day. Plus a STACK of other issues. Usually knocks off the top bugs the code base was having. Usually for little to no effort. These tools are easy to use and well worth paying for. I have saved several multimillion dollar projects by using these sorts of things.
It can actually be kind of fun. You take a crashy, memory hungry program and turn it into something that works. Usually it was some code smashed out at 2AM because the feature just had to be done 'right now'.
The only ones who discount these sorts of tools are ones who do not bother to use them. Or have used them a couple of times and did not understand what the output meant. So they chuck it up to 'false positives' and then continue to pretend they know better.