Benefits of static code analysis.

Question

What are the benefits of doing static code analysis on your source code? I was playing around with FxCop and I was wondering if there any benefits beyond making sure you are following the coding standards.

Answer 1

actually, fxcop doesn't particularly help you follow a coding standard. What it does help you with is designing a well-thought out framework/API. It's true that parts of the coding standard (such as casing of public members) will be caught by FxCop, but coding standards isn't the focus.

coding standards can be checked with stylecop, which checks the source code instead of the MSIL like fxcop does.

Answer 2

It can catch actual bugs, like forgetting to Dispose IDisposables.

Answer 3

Many classes of memory leaks and common logic errors can be caught statically as well. You can also look at cyclomatic complexity and such, which may be part of the "coding standards" you mentioned, but may be a separate metric you use to evaluate the algorithmic "cleanliness" of your code.

In any case, only a judicious combination of profiling (dynamic or run-time analysis) and static analysis/linting will ensure a consistent, reliable code base. Oh, that, and a little luck ;-)

Answer 4

Depends on the rules, but many subtle defects can be avoided, code can be cleaned, potential performance problems can be detected etc.

Put it one way...if it's cheap or free (in both time and financial costs) and doesn't break anything, why not use it?

Answer 5

There are all kinds of benefits: 1) If there are anti-patterns in your code, you can be warned about it. 2) There are certain metrics (such as McCabe's Cyclomatic Complexity) that tell useful things about source code.
3) You can also get great stuff like call-graphs, and class diagrams from static analysis. Those are wonderful if you are attacking a new code base.

Take a look at SourceMonitor: http://www.campwoodsw.com/sourcemonitor.html

Answer 6

It's a trade-off. For an individual developer who wants to improve his understanding of the framework and guidelines, I would definitely encourage it. FxCop generates a lot of noise / false positives, but I've also found the following benefits:

• it detects bugs (e.g. a warning about an unused argument may indicate you used the wrong argument in the method body).

• understanding the guidelines FxCop is following helps you to become a better developer.

However with a mixed-ability team, FxCop may well generate too many false positives to be useful. Junior developers will have difficulty appreciating whether some of the more esoteric violations thrown up by FxCop should concern them or are just noise.

Bottom line:

• If you're developing reusable class libraries, such as an in-house framework, make sure you have good developers and use FxCop.

• For everyday application development with mixed-ability teams, it will probably not be practicable.

Answer 7

FxCop

There is a list of all warnings in FxCop. You can see that there are warnings from the following areas:

Design Warnings

Warnings that support proper library design as specified by the .NET Framework Design Guidelines.

Globalization Warnings

Warnings that support world-ready libraries and applications.

Interoperability Warnings

Warnings that support interacting with COM clients.

Naming Warnings

Warnings that support adherence to the naming conventions of the .NET Framework Design Guidelines.

Performance Warnings

Warnings that support high performance libraries and applications.

Security Warnings

Warnings that support safer libraries and applications.

Depending on your application some of those areas might not be very interesting, but if you e.g. need COM interoperability, the tests can really help you to avoid the pitfalls.

Other tools

Other static checking tools can help you to detect bugs like not disposing an IDisposable, memory leaks and other subtle bugs. For a extreme case see the not-yet-released NStatic tool.

NStatic is used to track things such as redundant parameters, expressions that evaluate to constants, infinite loops and many other metrics.