6 ms·

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis chec

by egwor 11y ago

I use IntelliJ for my java development. It has a lot of analysis built in (whilst you're writing code). I'm not sure if there are that many static analysis checks (Findbugs etc) that are missing outside of those real time checks? I can often determine whether someone had used Eclipse or IntelliJ; there tend to be a lot fewer analysis warnings if someone has used IntelliJ (out of the box) => perhaps we need this analysis in real time?

M4v3R 11y ago
Don't know about IntelliJ, but XCode does real-time analysis as well, but it also has a mode for deep static analysis, which for example does code path analysis for finding dead code paths, even across methods. This kind of stuff would be hard to perform in real-time.
- inglor 11y ago
  Why? You'd just keep the code in SSA and diff whenever the user adds code - you need to create the form _once_ but after you've created it diffing it should be reasonably fast - the creation can be done at project creation time and it can be changed on-line and incrementally. I'm not sure if tools actually do it but it definitely sounds possible.
  - danbruc 11y ago
    How would maintaining a SSA representation of the code help detecting dead code paths? Doing so requires reasoning about possible truth values of conditions and is in general equivalent to the halting problem and therefore undecidable. You could only spend the cycles available in real time and that will in a certain number of cases be enough to solve the problem but there will also be instances requiring more cycles and instances being undecidable.
    - inglor 11y ago
      > How would maintaining a SSA representation of the code help detecting dead code paths? Well, if a variable assigned but never appears in a path that might have side effects it's dead. It's only the halting problem if you pretend to catch 100% of cases under all inputs. You can find lots of dead code without it. For more information about the specific technique of DCE under SSA form see http://grothoff.org/christian/teaching/2007/3353/papers/ssa.pdf http://grothoff.org/christian/teaching/2007/3353/papers/ssa....
    - seanmcdirmid 11y ago
      Going incremental is another option: if the analysis was done overnight and you only made a few changes, there shouldn't be much to do to "repair" the analysis according to your changes. But the PL community is not really good with incremental computations, especially ones that must consider arbitrary code changes (which, for example, can cause non-monotonic movements in your lattices).
      - dllthomas 11y ago
        '[I]f the analysis was done overnight and you only made a few changes, there shouldn't be much to do to "repair" the analysis according to your changes.' I would be tremendously surprised if that proved to be true in the general case, but it might well be true enough in common cases to be practical. Very interesting notion...
      - deleted 11y ago
        [deleted]
danbruc 11y ago
Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.
- amelius 11y ago
  Indeed, those real time checks are currently just a convenience, not anything really essential.
  - seanmcdirmid 11y ago
    Real-time feedback is a usability concern, not just a convenience. Of course, it is not always possible, and we have to settle for non-real-time feedback, but there are definitely usability costs!
    - deleted 11y ago
      [deleted]
- inglor 11y ago
  A tool like IntelliJ can do deep analysis off-line and in the background and only tell you about the results. This is a good tradeoff between fast feedback and deep analysis.
  - danbruc 11y ago
    I don't exactly know which kind of analyses IntelliJ performs but assuming that they are comparable to what ReSharper does they are quite different from what for example Coverity looks for.
    - inglor 11y ago
      Oh yes, they do some static analysis but it's not even close to the level of Coverity, sorry if my initial comment was misleading.

by egwor 11y ago

M4v3R 11y ago

Don't know about IntelliJ, but XCode does real-time analysis as well, but it also has a mode for deep static analysis, which for example does code path analysis for finding dead code paths, even across methods. This kind of stuff would be hard to perform in real-time.

inglor 11y ago
Why? You'd just keep the code in SSA and diff whenever the user adds code - you need to create the form _once_ but after you've created it diffing it should be reasonably fast - the creation can be done at project creation time and it can be changed on-line and incrementally. I'm not sure if tools actually do it but it definitely sounds possible.
- danbruc 11y ago
  How would maintaining a SSA representation of the code help detecting dead code paths? Doing so requires reasoning about possible truth values of conditions and is in general equivalent to the halting problem and therefore undecidable. You could only spend the cycles available in real time and that will in a certain number of cases be enough to solve the problem but there will also be instances requiring more cycles and instances being undecidable.
  - inglor 11y ago
    > How would maintaining a SSA representation of the code help detecting dead code paths? Well, if a variable assigned but never appears in a path that might have side effects it's dead. It's only the halting problem if you pretend to catch 100% of cases under all inputs. You can find lots of dead code without it. For more information about the specific technique of DCE under SSA form see http://grothoff.org/christian/teaching/2007/3353/papers/ssa.pdf http://grothoff.org/christian/teaching/2007/3353/papers/ssa....
  - seanmcdirmid 11y ago
    Going incremental is another option: if the analysis was done overnight and you only made a few changes, there shouldn't be much to do to "repair" the analysis according to your changes. But the PL community is not really good with incremental computations, especially ones that must consider arbitrary code changes (which, for example, can cause non-monotonic movements in your lattices).
    - dllthomas 11y ago
      '[I]f the analysis was done overnight and you only made a few changes, there shouldn't be much to do to "repair" the analysis according to your changes.' I would be tremendously surprised if that proved to be true in the general case, but it might well be true enough in common cases to be practical. Very interesting notion...
    - deleted 11y ago
      [deleted]

danbruc 11y ago

Good static checkers perform pretty deep analyses you can not (yet) do in real time. Real time checking is of course useful but it is no replacement for a deeper static analysis.

amelius 11y ago
Indeed, those real time checks are currently just a convenience, not anything really essential.
- seanmcdirmid 11y ago
  Real-time feedback is a usability concern, not just a convenience. Of course, it is not always possible, and we have to settle for non-real-time feedback, but there are definitely usability costs!
  - deleted 11y ago
    [deleted]
inglor 11y ago
A tool like IntelliJ can do deep analysis off-line and in the background and only tell you about the results. This is a good tradeoff between fast feedback and deep analysis.
- danbruc 11y ago
  I don't exactly know which kind of analyses IntelliJ performs but assuming that they are comparable to what ReSharper does they are quite different from what for example Coverity looks for.
  - inglor 11y ago
    Oh yes, they do some static analysis but it's not even close to the level of Coverity, sorry if my initial comment was misleading.