вторник, 19 июля 2011 г.

Should I fix all the errors found by the static code analyzer?

When analyzing rather large projects, static code analyzers usually generate a lot of error messages. But any static code analyzer always generates many so called "false-positive alarms" besides useful messages.
Various static analyzers treat this problem in different ways. Some analyzers ignore those suspicious fragments in code where the probability of an error is far from 100%. But most analyzers use an opposite approach, i.e. they generate much more "false alarms", however the risk that you might miss real error messages is much lower.
Since analysis results often contain a lot of such "false-positive" messages, there is no sense in correcting all the places in your code marked by the analyzer. However, developers must look through all the warnings anyway and configure the analyzer for each particular project eliminating such low-priority messages and focusing on detecting more serious issues.

References

  1. Evgeniy Ryzhkov. PVS-Studio: using the function "Mark as False Alarm".
  2. Discussion at Stackoverflow.com. When to stop following the advice of static code analysis?

Комментариев нет:

Отправить комментарий