SQM 23/24: Static Analysis [software quality crash course] [eng sub]

A lecture for BSc students at HSE University.
The slides are here: github.com/yegor256/sqm (in LaTeX and PDF)
Blog: www.yegor256.com
Books: www.yegor256.com/books.html
GitHub: github.com/yegor256 (don't hesitate to follow in order to stay informed)
Telegram channel with recent news and updates: t.me/yegor256news (subscribe to not miss a thing)
Twitter with daily and weekly updates: / yegor256 (follow me!)
iTunes: podcasts.apple.com/us/podcast...
SoundCloud: / yegor256
00:00 Introduction
00:49 Static analysis
01:58 Lint program
02:35 First generation of static analysis programs
03:25 Second generation of static analysis programs
04:03 Third generation of static analysis programs
06:12 Errors that static analyzers help you see
06:22 Uncreachable Code
09:09 Division by Zero
10:46 Endless Loop
15:44 Uninitialized Variable
18:56 Integer Overflow
00:25 Buffer Overflow
27:25 Errors in interprocedural analysis
27:54 Unused Global Var
28:55 Endless Recursion
29:38 Pointer Dereferencing
30:36 Three categories of errors in code
30:50 Style Violation
31:54 Code Smell
34:23 Bug
35:40 2004. Static Analysis for Security
38:36 Four options for analyzer responses (True Positive, False Positive, True Negative, False Positive)
45:12 2007. Which Warnings Should I Fix First?
45:57 How to filter what the analyzer produces. Queries of the future
49:31 2007. Static Analysis Tools As Early Indicators Of Pre-release Defect Denity
52:15 Examples of Static Analyzers
54:13 What does static analysis include?
55:21 Relevance and necessity of static analysis
58:07 Commercial static analysis programs (Coverity by Synopsys, Klockwork by Perforce, PVS-Studio...)
59:59 2017. Why and How JavaScript Developers Use Linters
01:03:17 Training function of static analyzers
01:06:29 2018. The Adoption of JavaScript Linters In Practice
01:09:05 SARIF
01:10 Code Perfumes
01:13:50 Conclusions

[@user-ff3lc1et3u]

Отличный канал. Спасибо за познавательные уроки.

[@TheGrand1987]

не планируете пригласить на интервью ребят из PSV-Studio ?

[@yegor256]

уже пригласили: czcams.com/video/hp_hFI1rl9A/video.html

[@TheGrand1987]

у Toyota есть интерестный набор тестов для статических анализаторов (он стал де-факто стандартом для проверки годности СА). Насчет СА для открытого кода, есть Coverity и тот-же PVS-Studio

[@ilya2184]

Есть подход когда да - есть 300К замечаний от стат анализа, да мы имеем ввиду эти замечания и применяем два принципа: 1.Положи лучше чем взял - вместе с доработкой сделай комит для исправления нескольких замечаний, а потом приступай к реализации изменений; 2.Мерж реквест не должен добавлять новых замечаний.