FindBugs is an open-source tool that analyzes code for patterns that might indicate bugs, detecting entire classes of potential coding errors. While FindBugs comes with a large number of ready-to-use error patterns, it also allows users to define new bug patterns.

In a recent IBM developerWorks article, Testing with leverage, Part 2, Brian Goetz explains the value in automatically detecting Java bug patterns, and shows how to define new patterns with FindBugs:

All that is needed for a bug pattern detector to be effective is that it turn up a high enough percentage of questionable code to make it worth the effort of using it. Creating bug pattern detectors can have very high leverage; once you've created a detector, you can run it on any code you want, now or in the future, and you might be surprised what turns up.

Goetz's example detects a non-trivial bug that inadvertently swallows RuntimeException by catching all Exceptions, called RuntimeException capture, that looks as follows:

public void addInstance(String className) {
    try {
        Class clazz = Class.forName(className);
        objectSet.add(clazz.newInstance());
    }
    catch (Exception e) {
        logger.log("Exception in newInstance", e);
    }
}

By contrast, the correct code would like this:

public void addInstance(String className) {
    try {
        Class clazz = Class.forName(className);
        objectSet.add(clazz.newInstance());
    }
    catch (RuntimeException e) {
        throw e;
    }
    catch (Exception e) {
        logger.log("Exception in newInstance", e);
    }
}

Observing the incorrect pattern, Goetz notes that,

The bug pattern is a catch block that catches Exception when there is no corresponding catch block for RuntimeException, and where no method call or throw statement in the try block throws Exception. To detect this bug pattern, you'll need to know where the try-catch blocks are, what might be thrown out of the try block, and what is caught in the catch blocks.

To detect the above pattern, FindBugs inspects the Java bytecode, and provides an API that allows you to detect patterns in the bytecode corresponding to the buggy code. For instance, in the article's example, the bug detector must first identify what exceptions are caught where in the code, allowing you to further refine the pattern by looking for a caught Exception without previously catching RuntimeException.

Goetz comments that,

To write bug detectors, you need some understanding of the structure of JVM bytecode and of class files. The BCEL and FindBugs libraries handle some of this task for you, extracting information from the bytecode and presenting it at a slightly higher level. Unfortunately, the documentation on both the BCEL and FindBugs support for taking apart a class is weaker than you might like.

Detecting a pattern that appears to indicate buggy code does not mean that the identified code is, indeed, a bug. In the conclusion of his article, Goetz discusses tuning a bug detector to make it more useful:

The process of tuning a detector involves looking at the false alarms and refining the bug pattern so as to eliminate some false alarms without excluding too many actual bugs... Tuning a detector often involves the use of "scoring" algorithms to determine whether a match should be reported as a bug...

As the article demonstrates, writing a useful bug pattern recognizer is an involved process, but the payoff can be handsome and long-lasting. What's your experience using code analysis tools such as FindBugs in eliminating coding errors?