Finding bugs is easy

Abstract

Many techniques have been developed over the years to automatically find bugs in software. Often, these techniques rely on formal methods and sophisticated program analysis. While these techniques are valuable, they can be difficult to apply, and they aren't always effective in finding real bugs. Bug patterns are code idioms that are often errors. We have implemented automatic detectors for a variety of bug patterns found in Java programs. In this paper, we describe how we have used bug pattern detectors to find serious bugs in several widely used Java applications and libraries. We have found that the effort required to implement a bug pattern detector tends to be low, and that even extremely simple detectors find bugs in real applications.From our experience applying bug pattern detectors to real programs, we have drawn several interesting conclusions. First, we have found that even well tested code written by experts contains a surprising number of obvious bugs. Second, Java (and similar languages) have many language features and APIs which are prone to misuse. Finally, that simple automatic techniques can be effective at countering the impact of both ordinary mistakes and misunderstood language features.

Alternating GUI Test Generation and Execution

“…Due to their popularity, these applications have undergone quality assurance before release. To further eliminate "obvious" bugs, a static analysis tool called FindBugs [7] was executed on all the applications; after the study, we verified that none of our reported bugs were detected by FindBugs.…”

Software Defect Detection-oriented Static Analysis Techniques

“…f) FindBug [9,10] uses the defect model checker to collect defects in Java programs, such as abnormal null pointer, deadlocks and thread error, etc. g) PREfix [11] makes analysis over the program call graph to track variables and memory status by analyzing plenty of paths in program.…”

Practically Applicable Formal Methods

“…It allows to create and run your checks to enforce specific architecture rules and coding standards. FindBugs [17] detects code instances that are likely to be errors. Our CodeStatistics is designed to find any user defined patterns and is able to insert annotations into the code.…”