3 ms·

I wonder how their checks compare to Coverity's and QAC++'s. I have a passing acquaintance with both, and I'm almost certain both would have caught the three b

I wonder how their checks compare to Coverity's and QAC++'s. I have a passing acquaintance with both, and I'm almost certain both would have caught the three bugs listed on that page.

chandlerc 15y ago
I would expect many of these tools to catch these types of bugs. The challenging thing for us has been to catch only bugs, and to catch them very fast during normal compilation. A lot of the static analyses we've looked into (and I'm hoping for more detailed blog posts about that in the future) find plenty of bugs, but also find lots of non-bugs. Combine that with being too slow to run during the normal build, and you can't break the build when such a bug is found. I think one of the most interesting aspects of this is how we catch the bugs early, and force developers to fix them immediately by breaking the build.
- mcbain 15y ago
  Static analysis is a great tool - Clang's isn't too bad - but it isn't the right one to drop into a normal workflow. We still develop using GCC - for our use case Clang performance isn't there yet - but have our continuous integration system perform Clang builds (as well as other platform/compiler variants, with unit+regression tests, etc.) so we miss out on the immediate build breakage that you mention, but do find out within ~30 mins if someone slipped up.
- spitfire 15y ago
  These sort of articles (and the attendant comments about false positives) always scream out for Ada to me. It's a language designed by a calm, careful thinker back in the 80's for life critical programs. It has everything Java and C++ have except the vast number of undefined states and it's designed for static analysis. By designed I mean, there are formal verifiers and the NSA has used it in a test security system. Plus the compiled code is pretty fast. So if you're feeling the need to reduce your workload take a look at it, you might be surprised.
  - cageface 15y ago
    What kinds of libraries are available for Ada? Half the reason I use C++ is that half the code I need to write is already available in mature libraries.
    - spitfire 15y ago
      Library support is aimed squarely at realtime life critical systems. You're more likely to find a library with some sort of safety certification than not. If you're expecting to use the latest web libraries or hadoop you'll be disappointed. However, there is a small collection of oss Ada libraries out there.
      - axman6 15y ago
        I seem to remember there was a pretty interesting web framework written in Ada, Adaweb I think? Anyway, Ada has some other amazingly cool features. The concurrency primitives it offers are very cool, lets you make some much stronger guarantees about the interactions between threads than any other language I've seen. For example, you can define rendezvous sections, which if memory serves, are pieces of code that are guaranteed to only be run once both threads participating in the rendezvous and neither thread can leave the section until both are ready.
        spitfire 15y ago
        There's ada web server (aws) which is neat. Similar idea to the java web kits like jetty. You can even hotplug code during runtime. You're right about the concurrency. Ada has a bunch of stuff like that built into the language since 1983. The particularly cool toys I like are SPARK (a formal verifier tool) and stackcheck - tells you exactly how deep in the stack your code can possibly go. (Yes you have to annotate cycles.)
  - iskander 15y ago
    Admittedly I only programmed in Ada for a few months, but I found it to be an unbearably tedious language. The verbosity is monstrous--- the type system is inexpressive; it feels primitive. Nothing is inferred, everything is repeated. Ugh, I would rather code exclusively in C++ templates than touch Ada again.

I wonder how their checks compare to Coverity's and QAC++'s. I have a passing acquaintance with both, and I'm almost certain both would have caught the three bugs listed on that page.

chandlerc 15y ago

I would expect many of these tools to catch these types of bugs. The challenging thing for us has been to catch only bugs, and to catch them very fast during normal compilation. A lot of the static analyses we've looked into (and I'm hoping for more detailed blog posts about that in the future) find plenty of bugs, but also find lots of non-bugs. Combine that with being too slow to run during the normal build, and you can't break the build when such a bug is found. I think one of the most interesting aspects of this is how we catch the bugs early, and force developers to fix them immediately by breaking the build.

mcbain 15y ago
Static analysis is a great tool - Clang's isn't too bad - but it isn't the right one to drop into a normal workflow. We still develop using GCC - for our use case Clang performance isn't there yet - but have our continuous integration system perform Clang builds (as well as other platform/compiler variants, with unit+regression tests, etc.) so we miss out on the immediate build breakage that you mention, but do find out within ~30 mins if someone slipped up.
spitfire 15y ago
These sort of articles (and the attendant comments about false positives) always scream out for Ada to me. It's a language designed by a calm, careful thinker back in the 80's for life critical programs. It has everything Java and C++ have except the vast number of undefined states and it's designed for static analysis. By designed I mean, there are formal verifiers and the NSA has used it in a test security system. Plus the compiled code is pretty fast. So if you're feeling the need to reduce your workload take a look at it, you might be surprised.
- cageface 15y ago
  What kinds of libraries are available for Ada? Half the reason I use C++ is that half the code I need to write is already available in mature libraries.
  - spitfire 15y ago
    Library support is aimed squarely at realtime life critical systems. You're more likely to find a library with some sort of safety certification than not. If you're expecting to use the latest web libraries or hadoop you'll be disappointed. However, there is a small collection of oss Ada libraries out there.
    - axman6 15y ago
      I seem to remember there was a pretty interesting web framework written in Ada, Adaweb I think? Anyway, Ada has some other amazingly cool features. The concurrency primitives it offers are very cool, lets you make some much stronger guarantees about the interactions between threads than any other language I've seen. For example, you can define rendezvous sections, which if memory serves, are pieces of code that are guaranteed to only be run once both threads participating in the rendezvous and neither thread can leave the section until both are ready.
      - spitfire 15y ago
        There's ada web server (aws) which is neat. Similar idea to the java web kits like jetty. You can even hotplug code during runtime. You're right about the concurrency. Ada has a bunch of stuff like that built into the language since 1983. The particularly cool toys I like are SPARK (a formal verifier tool) and stackcheck - tells you exactly how deep in the stack your code can possibly go. (Yes you have to annotate cycles.)
- iskander 15y ago
  Admittedly I only programmed in Ada for a few months, but I found it to be an unbearably tedious language. The verbosity is monstrous--- the type system is inexpressive; it feels primitive. Nothing is inferred, everything is repeated. Ugh, I would rather code exclusively in C++ templates than touch Ada again.