Why Code Reviews Are Good, But Not Enough
Therefore, static analysis perfectly complements reviews and helps to detect a variety of inconspicuous errors and typos.
Join the DZone community and get the full member experience.Join For Free
Code reviews are definitely necessary and useful. It's a way to impart knowledge, educate, control a task, improve code quality and formatting, fix bugs. Moreover, you can notice high-level errors related to the architecture and algorithms used. So it's a must-have practice, except that people get tired quickly. Therefore, static analysis perfectly complements reviews and helps to detect a variety of inconspicuous errors and typos. Let's look at a decent example on this topic.
Try to find an error in the code of a function taken from the structopt library:
To avoid accidentally reading the answer right away, I'll add a picture.
I don't know if you found the error or not. Even if you found it, I'm sure you'll agree that it's not easy to find such a typo. Moreover, you knew that there was an error in the function. If you hadn't known, it would have been hard to make you read and check all this code carefully.
In such cases, a static code analyzer will perfectly complement the classic code review. The analyzer doesn't get tired and will thoroughly check all the code. As a result, the PVS-Studio analyzer notices an anomaly in this function and issues a warning:
V560 A part of conditional expression is always false: input[i] <= '9'. structopt.hpp 1870
For those who didn't notice the error, I will give an explanation. Here's the main part:
The above condition checks that the i-th element is the letter 'e'. Accordingly, the following check input[i] <= '9' doesn't make sense. The result of the second check is always false, which is what the static analysis tool warns you about. The reason for the error is simple: the person was hasty and made a typo, forgetting to write +1.
In fact, it turns out that the function doesn't check the correctness of the entered numbers as expected. Correct version:
Here's an interesting fact. This error can be considered as a kind of the "last line effect" one. An error was made in the last condition of the function. By the end of this snippet, the programmer's attention weakened, and they made this barely noticeable mistake.
Bye everyone. Kudos to those who found the bug themselves.
Published at DZone with permission of Andrey Karpov. See the original article here.
Opinions expressed by DZone contributors are their own.