Publication

Back to overview

Context is king: The developer perspective on the usage of static analysis tools

Type of publication Peer-reviewed
Publikationsform Proceedings (peer-reviewed)
Author Vassallo Carmine, Panichella Sebastiano, Palomba Fabio, Proksch Sebastian, Zaidman Andy, Gall Harald C.,
Project SURF-MobileAppsData
Show all

Proceedings (peer-reviewed)

Editor , Oliveto Rocco; , Shepherd David C.; , Penta Massimiliano Di
Page(s) 38 - 49
Title of proceedings 25th Int Conf on Software Analysis, Evolution and Reengineering, SANER 2018
DOI 10.1109/saner.2018.8330195

Open Access

URL https://www.zora.uzh.ch/id/eprint/198337/
Type of Open Access Repository (Green Open Access)

Abstract

Automatic static analysis tools (ASATs) are tools that support automatic code quality evaluation of software systems with the aim of (i) avoiding and/or removing bugs and (ii) spotting design issues. Hindering their wide-spread acceptance are their (i) high false positive rates and (ii) low comprehensibility of the generated warnings. Researchers and ASATs vendors have proposed solutions to prioritize such warnings with the aim of guiding developers toward the most severe ones. However, none of the proposed solutions considers the development context in which an ASAT is being used to further improve the selection of relevant warnings. To shed light on the impact of such contexts on the warnings configuration, usage and adopted prioritization strategies, we surveyed 42 developers (69% in industry and 31% in open source projects) and interviewed 11 industrial experts that integrate ASATs in their workflow. While we can confirm previous findings on the reluctance of developers to configure ASATs, our study highlights that (i) 71% of developers do pay attention to different warning categories depending on the development context, and (ii) 63% of our respondents rely on specific factors (e.g., team policies and composition) when prioritizing warnings to fix during their programming. Our results clearly indicate ways to better assist developers by improving existing warning selection and prioritization strategies.
-