FindBugs™ - Find Bugs in Java Programs

This is the web page for FindBugs, a program which uses static analysis to look for bugs in Java code.  It is free software, distributed under the terms of the Lesser GNU Public License. The name FindBugs™ and the FindBugs logo are trademarked by The University of Maryland. As of July, 2008, FindBugs has been downloaded more than 700,000 times.

FindBugs requires JRE (or JDK) 1.5.0 or later to run.  However, it can analyze programs compiled for any version of Java. The current version of FindBugs is 1.3.7, released on 16:40:29 EST, 30 December, 2008. We are very interested in getting feedback on how to improve FindBugs.

More | Output | Try | Changes | Talks | Papers | Sponsors | Support

New

We created LinkedIn and Facebook groups for the FindBugs community. Join these to help meet up with other users and contributors to FindBugs.

Additional open source projects

The following software is being made available by the University of Maryland and the FindBugs project. The software is still preliminary, and needs volunteers to help mature it.

• Multithreaded test case, a framework designed to make it easy to create test cases for concurrent software in which multiple threads must coordindate their activity to perform a test (e.g., testing a concurrent blocking queue, with one thread that blocks when it trys to add to a full queue, and another thread that unblocks the first by removing an element).
• Checked uncontended lock, an implementation of the Java 5 Lock and ReadWriteLock interfaces that throw exceptions if they detect lock contention. These locks are designed to be used for debugging, and can be used in places where you don't believe you need to use a lock but want to verify that at runtime.

Sample output

As an example of the kind of issues FindBugs can identify, we provide our results on the Sun's JDK 7, Eclipse, Netbeans, Glassfish and JBoss. We present these results as a table showing the number of warnings we generate, an html report generated by FindBugs, and using a Java Webstart demo of FindBugs that loads the results of our analysis and the relevant source, so that you can view the source corresponding to each of our warnings and judge for yourself the accuracy of Findbugs.

Briefly, this table gives the number of warnings we found in various applications we use as benchmarks:

KNCSS - Thousands of lines of non-commenting source statements

Try FindBugs now on your project!

Using Java Web Start you can try the GUI version of FindBugs now on your project. As long as you have a 1.5 or better JRE installed, you can run FindBugs now. If you are using Java 1.5 or later, you will see the new GUI that we wrote over the summer.

Change history

The current version of FindBugs is s 1.3.7.

Changes since version 1.3.6

• Overall, a small bugfix release.
• New detection of accidental vacuous/useless calls to EasyMock methods, and of generic signatures that proclaim the use of unhashable classes in ways that require that they be hashed.
• Eliminate some false positives where we were warning about a useless call (e.g., comparing two incompatible types for equality), but the only thing the code was doing with the result was passing it to assertFalse.
• Japanese localization and manual by K.Hashimoto. (Thanks!)
• Added -exclude and -outputDir command line options to rejarForAnalysis
• Extended -adjustPriorities option to FindBugs analysis textui so that you can modify the priorities of individual bug patterns as well as visitors, and also completely suppress individual bug patterns or visitors.
  • e.g., -adjustPriority MS_SHOULD_BE_FINAL=suppress,MS_PKGPROTECT=suppress,EI_EXPOSE_REP=suppress,EI_EXPOSE_REP2=suppress,PZLA_PREFER_ZERO_LENGTH_ARRAYS=raise

Older versions...

Talks about FindBugs

• Quicktime movie showing of demo of our new GUI to view some of the null pointer bugs in Eclipse (Big file warning: 23 Megabytes)
• JavaOne 2007 talk on Improving Software Quality Using Static Analysis
• Talk Bill Pugh gave at SD Best Practices, Sept 14th (more of a handle on tutorial about using FindBugs)
• Talk Bill Pugh gave at ITA Software and MIT, Sept 12th and 13th (more of a research focus)
• Video of talk Bill Pugh gave at Google, July 6th, 2006
• Java Posse podcast interview with Bill Pugh and Brian Goetz

Papers about FindBugs

• Finding More Null Pointer Bugs, But Not Too Many, by David Hovemeyer, York College of Pennsylvania and William Pugh, Univ. of Maryland, 7th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, June, 2007
• Evaluating Static Analysis Defect Warnings On Production Software, Nathaniel Ayewah and William Pugh, Univ. of Maryland, and J. David Morgenthaler, John Penix and YuQian Zhou, Google, Inc., 7th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, June, 2007

Sponsors

Support for the FindBugs project is provided by SureLogic, which provides Sierra, an advanced interface and collaborative auditing and report system for static analysis tools, including FindBugs.

Additional Support

YourKit is kindly supporting open source projects with its full-featured Java Profiler. YourKit, LLC is creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit's leading software products: YourKit Java Profiler and YourKit .NET Profiler.

The FindBugs project also uses FishEye and Clover, which are generously provided by Cenqua/Atlassian.

Additional financial support for the FindBugs project has been provided by Google, Sun Microsystems, National Science Foundation grants ASC9720199 and CCR-0098162, and by a 2004 IBM Eclipse Innovation award.

Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation (NSF).

Send comments to findbugs@cs.umd.edu