Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Findbugs and comparing

I recently started using the findbugs static analysis tool in a java build I was doing. The first report came back with loads of High Priority warnings. Being the obsessive type of person, I was ready to go knock them all out. However, I must be missing something. I get most of the warnings when comparing things. Such as the following code:

   public void setSpacesPerLevel(int value)
   {
      if( value >= 0)
      {
         spacesPerLevel = value;
      }
      else
      {
         spacesPerLevel = 0;
      }
   }

produces a high priority warning at the if statement that reads.

File: Indenter.java, Line: 60, Type: BIT_AND_ZZ, Priority: High, Category: CORRECTNESS Check to see if ((...) & 0) == 0 in sample.Indenter.setSpacesPerLevel(int)

I am comparing an int to an int, seems like a common thing. I get quite a few of that type of error with similar simple comparisons.

I have alot of other high priority warnings on what appears to be simple code blocks. Am I missing something here? I realize that static analysis can produce false positives, but the errors I am seeing seem too trivial of a case to be a false positive.

This one has me scratching my head as well.

    for(int spaces = 0;spaces < spacesPerLevel;spaces++)
    {
       result = result.concat(" ");
    }

Which gives the following findbugs warning:

File: Indenter.java, Line: 160, Type: IL_INFINITE_LOOP, Priority: High, Category: CORRECTNESS

There is an apparent infinite loop in sample.Indenter.indent()

This loop doesn't seem to have a way to terminate (other than by perhaps throwing an exception).

Any ideas?

So basically I have a handful of files and 50-60 high priority warnings similar to the ones above. I am using findbugs 1.3.9 and calling it from the findbugs ant task

UPDATE: I have this build being executed by a hudson server and had the code being instrumented by Clover for code coverage. When I turned that off, all of my high priority warnings disappeared. That makes sense now. Thanks for the feedback.

like image 412
Rob Goodwin Avatar asked Jun 01 '10 15:06

Rob Goodwin


People also ask

What is the difference between FindBugs and SpotBugs?

Find bugs in Java Programs It is free software, distributed under the terms of the GNU Lesser General Public License. SpotBugs is a fork of FindBugs (which is now an abandoned project), carrying on from the point where it left off with support of its community. Please check the official manual for details.

What are FindBugs for?

FindBugs is an open-source static code analyser created by Bill Pugh and David Hovemeyer which detects possible bugs in Java programs. Potential errors are classified in four ranks: (i) scariest, (ii) scary, (iii) troubling and (iv) of concern. This is a hint to the developer about their possible impact or severity.

Is FindBugs a code Analyser tool?

Findbugs is an open source tool for static code analysis of Java programs.

What is PMD and FindBugs?

PMD, FindBugs and Checkstyle, are the most popular open-source code analyzers, they are extensively used in Java development to improve the codebase and identify potential vulnerabilities along with design flaws; every tool has its feature, purpose and strength, targeting a specific type of coding rules.


1 Answers

UPDATE: I have this build being executed by a hudson server and had the code being instrumented by Clover for code coverage. When I turned that off, all of my high priority warnings disappeared. That makes sense now. Thanks for the feedback.

like image 73
Rob Goodwin Avatar answered Sep 29 '22 12:09

Rob Goodwin