paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Bugs in the wild: examining the effectiveness of static analyzers at finding real-world bugs

野外的缺陷：检验静态分析器发现真实世界缺陷的有效性
FSE Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering2018匹配度 3/10 · 论文主题是传统静态分析器（ErrorProne/SpotBugs）在真实 Java 缺陷上的实证检出效果，属于静态分析范畴，但既未与 LLM/Agent 结合（AI→PL），也未涉及 ML/Agentic 程序（PL→AI）、浮点程序分析或贝叶斯程序分析，与用户画像的核心交叉方向没有交集。引用 21 inbox
David A. Tomassi
程序分析与抽象解释
crossref: 2026-09-12

AI 速览

一句话：实证评估 ErrorProne 与 SpotBugs 对 320 个真实 Java 缺陷的潜在与实际检出效果。

静态分析是发现软件缺陷的重要技术，但缺乏其在真实软件中有效性的证据。本文对流行的静态分析器 ErrorProne 与 SpotBugs 进行初步实证研究：从 BugSwarm 数据集选取 320 个真实 Java 缺陷，判断哪些缺陷可能被分析器发现，并统计实际检出数量。结果显示，ErrorProne 和 SpotBugs 分别可覆盖 30.3% 与 40.3% 的缺陷候选；两者较容易集成到使用 Maven 构建系统的多样项目中，但实际检出效果不佳，SpotBugs 仅成功发现一个缺陷。该研究揭示了静态分析工具在真实缺陷发现能力上的差距。

问题
现有静态分析工具在真实软件中究竟能发现多少缺陷缺乏证据；本文关注 ErrorProne 与 SpotBugs 对真实 Java 缺陷的实际有效性。
方法
从 BugSwarm 数据集选取 320 个真实 Java 缺陷，判定哪些缺陷可能被分析器发现，并将分析器集成到使用 Maven 的项目中进行检测。
评估
统计候选缺陷比例和实际检出数量，并评估工具链集成难度；ErrorProne 与 SpotBugs 的候选率分别为 30.3% 和 40.3%，但实际仅 SpotBugs 检出一个缺陷。
原文摘要（Abstract）

Static analysis is a powerful technique to find software bugs. In past years, a few static analysis tools have become available for developers to find certain kinds of bugs in their programs. However, there is no evidence on how effective the tools are in finding bugs in real-world software. In this paper, we present a preliminary study on the popular static analyzers ErrorProne and SpotBugs. Specifically, we consider 320 real Java bugs from the BugSwarm dataset, and determine which of these bugs can potentially be found by the analyzers, and how many are indeed detected. We find that 30.3% and 40.3% of the bugs are candidates for detection by ErrorProne and SpotBugs, respectively. Our evaluation shows that the analyzers are relatively easy to incorporate into the tool chain of diverse projects that use the Maven build system. However, the analyzers are not as effective detecting the bugs under study, with only one bug successfully detected by SpotBugs.

链接与引用

DOI 原文 · PDF（开放获取） ·

BibTeX 
@inproceedings{paperbot4688,
  title = {Bugs in the wild: examining the effectiveness of static analyzers at finding real-world bugs},
  author = {David A. Tomassi},
  booktitle = {FSE},
  year = {2018},
  doi = {10.1145/3236024.3275439}
}