Java Reference
In-Depth Information
tests. Testing is critically important for building confidence that concurrent classes behave
correctly, but should be only one of the QA metholologies you employ.
Different QA methodologies are more effective at finding some types of defects and less ef-
fective at finding others. By employing complementary testing methodologies such as code
review and static analysis, you can achieve greater confidence than you could with any single
approach.
12.4.1. Code Review
As effective and important as unit and stress tests are for finding concurrency bugs, they are
no substitute for rigorous code review by multiple people. (On the other hand, code review
is no substitute for testing either.) You can and should design tests to maximize their chances
of discovering safety errors, and you should run them frequently, but you should not neglect
to have concurrent code reviewed carefully by someone besides its author. Even concurrency
experts make mistakes; taking the time to have someone else review the code is almost al-
ways worthwhile. Expert concurrent programmers are better at finding subtle races than are
most test programs. (Also, platform issues such as JVM implementation details or processor
memory models can prevent bugs from showing up on particular hardware or software con-
figurations.) Code review also has other benefits; not only can it find errors, but it often im-
proves the quality of comments describing the implementation details, thus reducing future
maintenence cost and risk.
12.4.2. Static Analysis Tools
As of this writing,
static analysis tools
are rapidly emerging as an effective complement to
formal testing and code review. Static code analysis is the process of analyzing code without
executing it, and code auditing tools can analyze classes to look for instances of common
detectors
for many common coding errors, many of which can easily be missed by testing or
code review.
Static analysis tools produce a list of warnings that must be examined by hand to determine
whether they represent actual errors. Historically, tools like
lint
produced so many false
warnings as to scare developers away, but tools like FindBugs have been tuned to produce
many fewer false alarms. Static analysis tools are still somewhat primitive (especially in their
integration with development tools and lifecycle), but they are already effective enough to be
a valuable addition to the testing process.
