Finding bugs is easy

Abstract

Many techniques have been developed over the years to automatically find bugs in software. Often, these techniques rely on formal methods and sophisticated program analysis. While these techniques are valuable, they can be difficult to apply, and they aren't always effective in finding real bugs.Bug patterns are code idioms that are often errors. We have implemented automatic detectors for a variety of bug patterns found in Java programs. In this extended abstract 1 , we describe how we have used bug pattern detectors to find serious bugs in several widely used Java applications and libraries. We have found that the effort required to implement a bug pattern detector tends to be low, and that even extremely simple detectors find bugs in real applications.From our experience applying bug pattern detectors to real programs, we have drawn several interesting conclusions. First, we have found that even well tested code written by experts contains a surprising number of obvious bugs. Second, Java (and similar languages) have many language features and APIs which are prone to misuse. Finally, that simple automatic techniques can be effective at countering the impact of both ordinary mistakes and misunderstood language features.

On guiding the augmentation of an automated test suite via mutation analysis

“…Stubborn mutants are those which cannot be killed due to logical equivalence or due to language constructs (Hierons, et al, 1999). We can relate stubborn mutants in mutation testing to false positives in static analysis (Hovemeyer and Pugh, 2004) because both cause excess system processing and the software engineer to expend energy when no problems exist (e.g. no additional test case is needed and no fault exists, respectively).…”

Survey on static program analysis results refinement approaches

“…Тем не менее данные инструменты не гарантируют нахождение всех дефектов определенного типа. Ховемейер и Пуг [38] разработали автоматические обнаружители различных шаблонов ошибок в Java-программах. Получившийся инструмент FindBugs получил одобрение как академическим сообществом, так и индустрией, несмотря на то, что проводит неглубокий внутрипроцедурный анализ.…”

A Theory for Control-Flow Graph Exploration

“…1 Related Work. Different approaches have been presented to identify code that does not occur on feasible executions within a given program, such as [6,8,14,3]. In this paper we focus on static verification based approaches to detect infeasible code and on their strategies to explore all paths in a program.…”