dev@glassfish.java.net

Re: How many folks are using static analysis tools...

From: vince kraemer <Vince.Kraemer_at_Sun.COM>
Date: Fri, 15 Sep 2006 13:32:31 -0700

Aditya Dada wrote:
> I'm sure everyone must have seen the daily FindBugs reports that
> Terena produces on the nightly glassfish builds.

I am sure that I have... and forgotten about their existence since then.
>
> While working with Jerome, Tony and Geoff, we too came to the
> conclusion that there were way too many warnings for people to go
> through.
> So while I had personally filed laundry-list bugs in the last release
> for each component that were reported to have bugs by the tool, I'm am
> currently working with Terena to implement the 'delta' feature i.e.
> the daily email will contain a small list of bugs that were introduced
> last night (as found by FindBugs of course).

That would be very useful.

>
> the list would be much more readable, and hence, the bugs much easier
> to identify and fix.
>
> till then, if you're interested in knowing the bugs in your area,
> click on any HTML file at:
> http://javaweb.sfbay/java/re/glassfish/9.1/nightly/findbugs/snapshot/
> ...and grep for the package that you work on.

Can I make two quick suggestions....

1. change the file names so they sort by date correctly... Right now,
the report for 2006-09-10 is after the report for 2006-09-01 and before
the report for 2006-09-02 when I follow the link you have provided.

2. Could you publish the findbugs configuration file that was used to
create these reports...

The findbugs gui seems very powerful (folks will be able to get to info
that is useful "to them") fast, once they configure FB. And that is the
"hard part" (though it isn't terrible). Since someone has "paid their
dues" (Thanks Terena) and gotten this to work, sharing it will help all
of us.

One other thing... could these reports get moved to an external site.

People already have access to a report about glassfish from the findbugs
team. I would hate it if we did clean-up that no one ever saw, because
we didn't publish it....
>
> Also, like Bill just mentioned, FindBugs has the ability to use
> filters i.e. you can choose to filter out some warnings that are false
> positives. If there are any such warnings that you'd like filtered
> out, please let me know and I can work with Terena to incorporate that
> in the daily FindBugs run.

I understand why folks want to filter stuff out of the report...

The code is written this way because of X or Y or Z....

But if Z changes, we may be able to clean up "questionable" things that
FB has been flagging....

If we know that FB was flagging a questionable bit of code.

Which is harder to do if the report is filtered.....
>
> -Aditya
>
>