Benefits of static code analysis

Question

What are the benefits of doing static code analysis on your source code? I was playing around with FxCop and I was wondering if there any benefits beyond making sure you are following the coding standards.

Answer 1

There are all kinds of benefits:

1. If there are anti-patterns in your code, you can be warned about it.
2. There are certain metrics (such as McCabe's Cyclomatic Complexity) that tell useful things about source code.
3. You can also get great stuff like call-graphs, and class diagrams from static analysis. Those are wonderful if you are attacking a new code base.

Take a look at SourceMonitor

Answer 2

Many classes of memory leaks and common logic errors can be caught statically as well. You can also look at cyclomatic complexity and such, which may be part of the "coding standards" you mentioned, but may be a separate metric you use to evaluate the algorithmic "cleanliness" of your code.

In any case, only a judicious combination of profiling (dynamic or run-time analysis) and static analysis/linting will ensure a consistent, reliable code base. Oh, that, and a little luck ;-)

Answer 3

It's a trade-off. For an individual developer who wants to improve his understanding of the framework and guidelines, I would definitely encourage it. FxCop generates a lot of noise / false positives, but I've also found the following benefits:

• it detects bugs (e.g. a warning about an unused argument may indicate you used the wrong argument in the method body).

• understanding the guidelines FxCop is following helps you to become a better developer.

However with a mixed-ability team, FxCop may well generate too many false positives to be useful. Junior developers will have difficulty appreciating whether some of the more esoteric violations thrown up by FxCop should concern them or are just noise.

Bottom line:

• If you're developing reusable class libraries, such as an in-house framework, make sure you have good developers and use FxCop.

• For everyday application development with mixed-ability teams, it will probably not be practicable.

Answer 4

actually, fxcop doesn't particularly help you follow a coding standard. What it does help you with is designing a well-thought out framework/API. It's true that parts of the coding standard (such as casing of public members) will be caught by FxCop, but coding standards isn't the focus.

coding standards can be checked with stylecop, which checks the source code instead of the MSIL like fxcop does.

Answer 5

It can catch actual bugs, like forgetting to Dispose IDisposables.

Answer 6

Depends on the rules, but many subtle defects can be avoided, code can be cleaned, potential performance problems can be detected etc.

Put it one way...if it's cheap or free (in both time and financial costs) and doesn't break anything, why not use it?

Answer 7

FxCop

There is a list of all warnings in FxCop. You can see that there are warnings from the following areas:

Design Warnings

Warnings that support proper library design as specified by the .NET Framework Design Guidelines.

Globalization Warnings

Warnings that support world-ready libraries and applications.

Interoperability Warnings

Warnings that support interacting with COM clients.

Naming Warnings

Warnings that support adherence to the naming conventions of the .NET Framework Design Guidelines.

Performance Warnings

Warnings that support high performance libraries and applications.

Security Warnings

Warnings that support safer libraries and applications.

Depending on your application some of those areas might not be very interesting, but if you e.g. need COM interoperability, the tests can really help you to avoid the pitfalls.

Other tools

Other static checking tools can help you to detect bugs like not disposing an IDisposable, memory leaks and other subtle bugs. For a extreme case see the not-yet-released NStatic tool.

NStatic is used to track things such as redundant parameters, expressions that evaluate to constants, infinite loops and many other metrics.

Answer 8

The benefits are that you can automatically find and quantify technical debt within your software application.

I find static code analysis tools indispensable on large enterprise application development where many developers and testers come and go over the life of an application but the code quality still needs to be kept high and the technical debt managed properly.

Answer 9

What are the benefits of doing static code analysis on your source code?

The benefits depend on the type of static code analysis that is performed. Static code analysis can range from simple to sophisticated techniques. For example, generating metrics about your source code to identify error prone code is one technique. Other techniques actively attempt to find bugs in your code. Sophisticated techniques use formal methods to prove that your code is free of bugs.

Therefore the benefit depends on the type of static code analysis being used. If the technique produces metrics (such as code complexity etc.), then a benefit is that these metrics could be used during code review to identify error prone code. If the technique detects bugs, then the benefit is that the developer can identify bugs before unit test. If formal methods based techniques are used to prove that the code does not contain bugs, then the benefit is that this information could be used to prove to the QA department (or certification authorities) that the code is free of certain types of bugs.

A more detailed description of the techniques and benefits can also be found on this page: www.mathworks.com/static-analysis

Answer 10

I'll try to describe the main ones:

• Static code analysis identifies detects in the program at early stage, resulting decrease in cost to fix them.
• It can detect flaws in the program's inputs and outputs that cannot be seen through dynamic testing.
• It automatically scans uncompiled codes and identifies vulnerabilities.
• Of what I know from dealing with checkmarx is that static code analysis fixes multiple vulnerabilities at a single point, which saves a lot of time for the developer.