After watching a FindBugs session on JavaOne Online (2004), I am totally hooked. I’ve played with PMD and
CheckStyle before (and they are both very cool), but the neat thing about FindBugs is that it runs on your bytecode rather than your source - so it picks up a bunch of things the other tools don’t.
I have seen Findbugs before, and even downloaded it, but it didn’t seem as “slick” as the other options, so I didn’t really give it the time it deserved. After giving it a workout of our source tree, I’m totally impressed. This thing is definitely the goods - and the false positives are really very low.
One thing that it did flag wildly about were a few of my pojos that returned arrays. For example, stuff like:
public Foo[] getFoos() {
return foos;
}
which looks pretty innocuous to me… but then you realise that foos (the array itself) is mutable, so your clients can do stuff like:
foo[0] = new Foo("Do Evil", -1);
Eeek. Not so good. So I did some reading. So one simple fix might be to clone it:
`
public Foo[] getFoos() {
return (Foo[]) foos.clone();
}
`
The gotcha is that clone() is only shallow. So the Foo instances themselves are still subject to tampering… which was fine for me, since each Foo instance in my array was actually immutable (only getters which return primitives).
But what to do if the objects themselves are mutable? Trickier problem. Maybe write a copy constructor for Foo, then roll your own “iterate, copy, and append to a fresh array” type code? Could be nasty on the performance front.
Anyways, big props for the FindBugs guys. Very cool tool and definitely part of my toolkit from now on.