Finding bugs with FindBugs
But we never write poor code, do we?
A good compiler does more than simply refuse to compile syntactically incorrect code. Most modern compilers can issue warnings about many different types of potential problem, from reporting on the use of deprecated libraries and packages, to sounding alarm bells about uninitialised variables, or ignoring return values from functions or methods.
But, as useful as a compiler can be in flagging potential bugs, it can only go so far. For many developers, what lies beyond the compiler is the unit testing framework and a barrage of tests.
However, there's a class of development tool that can also be used to root out bugs before they happen, and that's a static code analysis tool. In contrast to dynamic analysis, which involves looking at code that's running, static analysis focuses on source or object code (byte code in the Java world).
One such tool is FindBugs, which analyses Java byte code to flag potential errors. Originally developed by Bill Pugh at the University of Maryland, FindBugs is released as open source software (under the Lesser GPL licence), and has been supported by Fortify Software, Google, Sun and others.
It works by looking for common "bug idioms", in other words it searches through byte code looking to do some fancy pattern matching against a database of dodgy code. Some of this unsafe code is down to poorly understood APIs, difficult language features, misunderstood invariants or just down to plain old poor coding (it does happen...).
The software is available in a number of formats - as a standalone jar file, as a Java web start version, and as an Eclipse plug-in. There's even a version available for NetBeans, though it's unofficial and not supported by the FindBugs team.
The Eclipse version is straightforward to install. It's a simple case of using the native Eclipse software updates wizard to point to the correct URL and letting it do the rest.
In contrast to some plug-ins there are few dependencies and the process is incredibly smooth. Once installed the functionality slots in very nicely with the rest of Eclipse, for example, problems discovered by FindBugs are flagged in the normal Problems window rather than creating a separate display.
Because FindBugs uses static analysis of byte code it's not really the sort of tool that is used interactively (unlike Eclipse's incremental compiler), in other words it doesn't flag problems as you type in your source code. However, right-clicking on a package or class in the Package Explorer and selecting "Find Bugs" from the menu triggers the analysis, which dumps the warnings to the Problems display. Clicking on a problem then highlights the offending code in the editor window, and right-clicking offers more details on the type of error.
Each of the error types that the "Find Bugs" process reports is tagged with a code, and this can be used both to find out more about that error and also to enable or disable it. In Eclipse it's a simple case of looking at Project properties, clicking on FindBugs and then selecting/deselecting the list error types. Additional configuration options include a severity setting, so that you can decide just how strict (or how masochistic) you want to be.
The standalone version of the software (either the jar file or the web start version), features a rather plain GUI that hides similar functionality to the Eclipse version. Once a project has been defined - by pointing the tool in the direction of your source and class files - it's a case of hitting the analyse button and letting it do its stuff. A tabbed display is used to show problems listed by class, package, error type or error category. This is useful as it allows the developer to hone in on specific categories of potential bugs, such as malicious code, vulnerabilities, or performance hits. Whichever view is used, clicking on a bug shows details of the type of error and the offending bit of code. And, of course, the types of errors you want found is fully configurable.
In practice both the standalone and the Eclipse versions of FindBugs have different virtues. Being embedded in an IDE has advantages in that it's easy to go in and fix errors once they've been identified (though there's no quick-fix support as there are with the simpler types of errors that the Eclipse compiler finds). On the other hand, the standalone version provides a useful categorised display which can help in deciding which problems you want tackled first. In either case both versions provide real value to a developer.
One problem that is common to static analysis tools is raising too many false alarms. In practice FindBugs errs on the side of caution compared to some tools. This is generally a good thing, a tool that flags too many inconsequential issues or too many false alarms is likely to be ignored or quietly ditched. FindBugs, however, is worth sticking with. ®