Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

Concerns identified in code review: : A fine-grained, faceted classification

Published: 01 January 2023 Publication History

Abstract

Context:

Code review is a valuable software process that helps software practitioners to identify a variety of defects in code. Even though many code review tools and static analysis tools used to improve the efficiency of the process exist, code review is still costly.

Objective:

Understanding the types of defects that code reviews help to identify could reveal other means of cost improvement. Thus, our goal was to identify defect types detected in real-world code reviews, and the extent to which code review can be benefited from defect detection tools.

Method:

To this end, we classified 417 comments from code reviews of 7 OSS Java projects using thematic analysis.

Results:

We identified 116 defect types that we grouped into 15 groups to create a defect classification. Additionally, 38% of these defects could be automatically detected accurately.

Conclusion:

We learnt that even though many capable defect detection tools are available today, a substantial amount of defects that can be detected automatically, reach code review. Also, we identified several code review cost reduction opportunities.

Highlights

A classification of issues identified during code review is presented.
The highest number of issues in the sample was about documentation.
The least number of issues in the sample was about threads.
A substantial number of issues can be detected automatically.
Another substantial number of issues may be identifiable by non-programmers.

References

[1]
A. Bosu, M. Greiler, C. Bird, Characteristics of useful code reviews: An empirical study at microsoft, in: Proc. IEEE/ACM 12th Working Conference on Mining Software Repositories, 2015, pp. 146–156.
[2]
C. Sadowski, E. Söderberg, L. Church, M. Sipko, A. Bacchelli, Modern code review: a case study at google, in: Proc. 40th International Conference on Software Engineering: Software Engineering in Practice, 2018, pp. 181–190.
[3]
Distefano D., Fähndrich M., Logozzo F., O’Hearn P.W., Scaling static analyses at facebook, Commun. ACM 62 (8) (2019) 62–70.
[4]
S. Nazir, N. Fatima, S. Chuprat, Modern Code Review Benefits-Primary Findings of A Systematic Literature Review, in: Proc. 3rd International Conference on Software Engineering and Information Management, 2020, pp. 210–215.
[5]
Bosu A., Carver J.C., Bird C., Orbeck J., Chockley C., Process aspects and social dynamics of contemporary code review: Insights from open source development and industrial practice at microsoft, IEEE Trans. Softw. Eng. 43 (1) (2017) 56–75.
[6]
T. Baum, O. Liskin, K. Niklas, K. Schneider, Factors Influencing Code Review Processes in Industry, in: Proc.24th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2016, pp. 85–96.
[7]
Wang J., Shih P.C., Carroll J.M., Revisiting linus’s law: Benefits and challenges of open source software peer review, Int. J. Hum.-Comput. Stud. 77 (2015) 52–65.
[8]
A. Bacchelli, C. Bird, Expectations, outcomes, and challenges of modern code review, in: Proc. 35th International Conference on Software Engineering, 2013, pp. 712–721.
[9]
J. Czerwonka, M. Greiler, J. Tilford, Code Reviews Do Not Find Bugs. How the Current Code Review Best Practice Slows Us Down, in: Proc. 37th IEEE International Conference on Software Engineering, vol. 2, 2015, pp. 27–28.
[10]
T. Baum, O. Liskin, K. Niklas, K. Schneider, Factors influencing code review processes in industry, in: Proc. 24th Acm Sigsoft International Symposium on Foundations of Software Engineering, 2016, pp. 85–96.
[11]
Staff C., CodeFlow: Improving the code review process at microsoft, Commun. ACM 62 (2) (2019) 36–44.
[12]
Pascarella L., Spadini D., Palomba F., Bruntink M., Bacchelli A., Information needs in contemporary code review, Proc. ACM Hum.-Comput. Interact. 2 (CSCW) (2018) 1–27.
[17]
V. Balachandran, Reducing human effort and improving quality in peer code reviews using automatic static analysis and reviewer recommendation, in: Proc. 35th International Conference on Software Engineering, 2013, pp. 931–940.
[18]
S. Panichella, V. Arnaoudova, M. Di Penta, G. Antoniol, Would static analysis tools help developers with code reviews?, in: Proc. 22nd International Conference on Software Analysis, Evolution, and Reengineering, 2015, pp. 161–170.
[19]
Fadhel M., Towards automating code reviews, 2020.
[20]
D. Singh, V.R. Sekar, K.T. Stolee, B. Johnson, Evaluating how static analysis tools can reduce code review effort, in: Proc. IEEE Symposium on Visual Languages and Human-Centric Computing, 2017, pp. 101–105.
[21]
B. Johnson, Y. Song, E. Murphy-Hill, R. Bowdidge, Why Don’t Software Developers Use Static Analysis Tools to Find Bugs?, in: Proc. of the International Conference on Software Engineering, 2013, pp. 672–681.
[22]
Vassallo C., Panichella S., Palomba F., Proksch S., Gall H.C., Zaidman A., How developers engage with static analysis tools in different contexts, Empir. Softw. Eng. (2019) 1–39.
[23]
H. Siy, L. Votta, Does the modern code inspection have value?, in: Proc. International Conference on Software Maintenance, 2001, pp. 281–289.
[24]
Mäntylä M.V., Lassenius C., What types of defects are really discovered in code reviews?, IEEE Trans. Softw. Eng. 35 (3) (2009) 430–448.
[25]
Lei Q., He Z., Fuqun H., Bin L., Classification of air on-board software code defects and investigations, Procedia Eng. 15 (2011) 3577–3583.
[26]
Runeson P., Stefik A., Andrews A., Variation factors in the design and analysis of replicated controlled experiments, Empir. Softw. Eng. 19 (6) (2014) 1781–1808.
[27]
Panichella S., Zaugg N., An empirical investigation of relevant changes and automation needs in modern code review, Empir. Softw. Eng. (2020) 1–40.
[28]
M. Paixao, J. Krinke, D. Han, M. Harman, CROP: Linking Code Reviews to Source Code Changes, in: International Conference on Mining Software Repositories, in: MSR, 2018.
[29]
Braun V., Clarke V., Using thematic analysis in psychology, Qual. Res. Psychol. 3 (2) (2006) 77–101.
[36]
N. Cassee, B. Vasilescu, A. Serebrenik, The silent helper: the impact of continuous integration on code reviews, in: Proc. 27th IEEE International Conference on Software Analysis, Evolution and Reengineering, 2020, pp. 423–434.
[39]
J. Lacomis, P. Yin, E. Schwartz, M. Allamanis, C. Le Goues, G. Neubig, B. Vasilescu, Dire: A neural approach to decompiled identifier naming, in: Proc. 34th IEEE/ACM International Conference on Automated Software Engineering, 2019, pp. 628–639.
[40]
B. Lin, S. Scalabrino, A. Mocci, R. Oliveto, G. Bavota, M. Lanza, Investigating the use of code analysis and nlp to promote a consistent usage of identifiers, in: Proc. IEEE 17th International Working Conference on Source Code Analysis and Manipulation, 2017, pp. 81–90.
[41]
M. Allamanis, E.T. Barr, C. Bird, C. Sutton, Learning natural coding conventions, in: Proc. 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2014, pp. 281–293.
[42]
M. Beller, A. Bacchelli, A. Zaidman, E. Juergens, Modern code reviews in open-source projects: Which problems do they fix?, in: Proc. 11th Working Conference on Mining Software Repositories, 2014, pp. 202–211.
[43]
Agnelo J., Laranjeiro N., Bernardino J., Using orthogonal defect classification to characterize NoSQL database defects, J. Syst. Softw. 159 (2020).
[44]
Xia X., Zhou X., Lo D., Zhao X., Wang Y., An empirical study of bugs in software build system, IEICE Trans. Inf. Syst. 97 (7) (2014) 1769–1780.
[45]
Hunny U., Orthogonal security defect classification for secure software development, (Ph.D. thesis) 2012.
[46]
F. Thung, S. Wang, D. Lo, L. Jiang, An empirical study of bugs in machine learning systems, in: Proc. 23rd International Symposium on Software Reliability Engineering, 2012, pp. 271–280.
[47]
N. Li, Z. Li, X. Sun, Classification of software defect detected by black-box testing: An empirical study, in: 2010 Second World Congress on Software Engineering, vol. 2, 2010, pp. 234–240.
[48]
M. Grottke, A.P. Nikora, K.S. Trivedi, An empirical investigation of fault types in space mission system software, in: Proc. International Conference on Dependable Systems & Networks, DSN, 2010, pp. 447–456.
[49]
IEEE standard classification for software anomalies, 2010, pp. 1–23. IEEE Std 1044-2009 (Revision of IEEE Std 1044-1993).
[50]
Pressman R.S., Software Engineering: A Practitioner’s Approach, Palgrave macmillan, 2005.
[51]
Michael Inies R.C., Fault links: identifying module and fault types and their relationship, (Master’s thesis) University of Kentucky, 2004.
[52]
Beizer B., Software Testing Techniques, Dreamtech Press, 2003.
[53]
Huang X., Software reliability, safety and quality assurance, vol. 112, Publishing House of Electronics Industry, Beijing, 2002.
[54]
Kaner C., Falk J., Nguyen H.Q., Testing Computer Software, John Wiley & Sons, 1999.
[55]
Humphrey W.S., A Discipline for Software Engineering, Addison-Wesley Longman Publishing Co., Inc., 1995.
[56]
Grady R.B., Practical Software Metrics for Project Management and Process Improvement, Prentice-Hall, Inc., 1992.
[57]
Putnam L.H., Myers W., Measures for Excellence: Reliable Software on Time, Within Budget, Prentice Hall Professional Technical Reference, 1991.
[58]
Basili V.R., Selby R.W., Comparing the effectiveness of software testing strategies, IEEE Trans. Softw. Eng. (12) (1987) 1278–1296.
[59]
Lopes F., Agnelo J., Teixeira C.A., Laranjeiro N., Bernardino J., Automating orthogonal defect classification using machine learning algorithms, Future Gener. Comput. Syst. 102 (2020) 932–947.
[60]
Mabrey J., Automated Defect Classification Using Machine Learning, (Ph.D. thesis) North Carolina Agricultural and Technical State University, 2020.
[61]
I. Chawla, S.K. Singh, An automated approach for bug categorization using fuzzy logic, in: Proc. of the 8th India Software Engineering Conference, 2015, pp. 90–99.
[62]
N. Pingclasai, H. Hata, K.-i. Matsumoto, Classifying bug reports to bugs and other requests using topic modeling, in: Proc. 20th Asia-Pacific Software Engineering Conference, vol. 2, APSEC, 2013, pp. 13–18.
[63]
C. Liu, Y. Zhao, Y. Yang, H. Lu, Y. Zhou, B. Xu, An ast-based approach to classifying defects, in: Proc.International Conference on Software Quality, Reliability and Security-Companion, 2015, pp. 14–21.
[64]
X. Xia, D. Lo, X. Wang, B. Zhou, Automatic defect categorization based on fault triggering conditions, in: Proc. 19th International Conference on Engineering of Complex Computer Systems, 2014, pp. 39–48.
[65]
L. Yu, C. Kong, L. Xu, J. Zhao, H. Zhang, Mining bug classifier and debug strategy association rules for web-based applications, in: Proc. International Conference on Advanced Data Mining and Applications, 2008, pp. 427–434.
[66]
Code Review Open Platform (CROP) URL https://crop-repo.github.io/#structure.
[67]
M. Paixao, P.H. Maia, Rebasing in code review considered harmful: A large-scale empirical investigation, in: 2019 19th International Working Conference on Source Code Analysis and Manipulation, SCAM, 2019, pp. 45–55.
[68]
Krejcie R.V., Morgan D.W., Determining sample size for research activities, Educ. Psychol. Measur. 30 (3) (1970) 607–610.
[69]
S. Gunawardena, Supporting Documentation - Code Review Cost Reduction Opportunities URL https://github.com/sgun571/Code-Review-Cost-Reduction-Opportunities.
[73]
IntelliJ IDEA - Control flow statement without braces URL https://www.jetbrains.com/help/idea/list-of-java-inspetions.html.
[74]
A.M. Jamil, L.b. Othmane, A. Valani, M. Abdelkhalek, A. Tek, The current practices of changing secure software: an empirical study, in: Proc. 35th Annual ACM Symposium on Applied Computing, 2020, pp. 1566–1575.
[75]
M. Tahaei, K. Vaniea, A Survey on Developer-Centred Security, in: Proc. IEEE European Symposium on Security and Privacy Workshops, 2019, pp. 129–138.
[76]
T. Thomas, Exploring the usability and effectiveness of interactive annotation and code review for the detection of security vulnerabilities, in: Proc. IEEE Symposium on Visual Languages and Human-Centric Computing, 2015, pp. 295–296.
[77]
Chess B., West J., Secure Programming with Static Analysis, 2007.
[78]
V.B. Livshits, M.S. Lam, Finding Security Vulnerabilities in Java Applications with Static Analysis, in: USENIX Security Symposium, vol. 14, 2005, pp. 18–18.
[79]
R.K. McLean, Comparing static security analysis tools using open source software, in: Proc. Sixth International Conference on Software Security and Reliability Companion, 2012, pp. 68–74.
[80]
A. Masood, J. Java, Static analysis for web service security-Tools & techniques for a secure development life cycle, in: 2015 IEEE International Symposium on Technologies for Homeland Security, HST, 2015, pp. 1–6.
[81]
J. Smith, L.N.Q. Do, E. Murphy-Hill, Why Can’t Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for Security, in: Sixteenth Symposium on Usable Privacy and Security ({SOUPS} 2020), 2020, pp. 221–238.
[82]
Do L.N.Q., Wright J., Ali K., Why do software developers use static analysis tools? a user-centered study of developer needs and motivations, IEEE Trans. Softw. Eng. (2020).
[83]
P. Godefroid, N. Nagappan, Concurrency at Microsoft: An exploratory survey, in: CAV Workshop on Exploiting Concurrency Efficiently and Correctly, 2008.
[84]
H. Chen, S. Guo, Y. Xue, Y. Sui, C. Zhang, Y. Li, H. Wang, Y. Liu, {MUZZ}: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs, in: 29th {USENIX} Security Symposium ({USENIX} Security 20), 2020, pp. 2325–2342.
[85]
F. Eichinger, V. Pankratius, P.W. Groß e, K. Böhm, Localizing defects in multithreaded programs by mining dynamic call graphs, in: International Academic and Industrial Conference on Practice and Research Techniques, 2010, pp. 56–71.
[86]
Edelstein O., Farchi E., Goldin E., Nir Y., Ratsaby G., Ur S., Framework for testing multi-threaded java programs, Concurr. Comput.: Pract. Exper. 15 (3–5) (2003) 485–499.
[87]
M.A. Al Mamun, A. Khanam, H. Grahn, R. Feldt, Comparing four static analysis tools for java concurrency bugs, in: Third Swedish Workshop on Multi-Core Computing (MCC-10), 2010, pp. 18–19.
[88]
Liu H., Li G., Lukman J.F., Li J., Lu S., Gunawi H.S., Tian C., DCatch: Automatically detecting distributed concurrency bugs in cloud systems, ACM SIGARCH Comput. Archit. News 45 (1) (2017) 677–691.
[89]
D. Kester, M. Mwebesa, J.S. Bradbury, How good is static analysis at finding concurrency bugs?, in: 2010 10th IEEE Working Conference on Source Code Analysis and Manipulation, 2010, pp. 115–124.
[90]
[91]
Laramee R.S., Bob’s concise coding conventions (c3), Adv. Comput. Sci. Eng. (ACSE) 4 (1) (2010) 23–26.
[96]
B. Johnson, Y. Song, E. Murphy-Hill, R. Bowdidge, Why don’t software developers use static analysis tools to find bugs?, in: Proc. 35th International Conference on Software Engineering, ICSE, 2013, pp. 672–681.
[97]
D. Singh, V.R. Sekar, K.T. Stolee, B. Johnson, Evaluating how static analysis tools can reduce code review effort, in: Proc. IEEE Symposium on Visual Languages and Human-Centric Computing, VL/HCC, 2017, pp. 101–105.
[98]
FindBugs - Return value of method without side effect is ignored URL http://findbugs.sourceforge.net/bugDescriptions.html#RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT.
[99]
Gilb T., Graham D., Software Inspections, Addison-Wesley Reading, Masachusetts, 1993.
[100]
O’Neill D., Issues in software inspection, IEEE Softw 14 (1) (1997) 18–19.
[101]
T. Hall, D. Wilson, N. Baddoo, Towards implementing successful software inspections, in: Proceedings International Conference on Software Methods and Tools. SMT 2000, 2000, pp. 127–136.
[102]
Ciolkowski M., Laitenberger O., Biffl S., Software reviews, the state of the practice, IEEE Softw. 20 (6) (2003) 46–51.
[103]
Y.-K. Wong, An exploratory study of software review in practice, in: PICMET’03: Portland International Conference on Management of Engineering and Technology Technology Management for Reshaping the World, 2003, 2003, pp. 301–308.
[104]
J.-S. Oh, H.-J. Choi, A reflective practice of automated and manual code reviews for a studio project, in: Fourth Annual ACIS International Conference on Computer and Information Science (ICIS’05), 2005, pp. 37–42.
[105]
L. Harjumaa, I. Tervonen, A. Huttunen, Peer reviews in real life-motivators and demotivators, in: Fifth International Conference on Quality Software, QSIC’05, 2005, pp. 29–36.
[106]
Sliz P., Morin A., Optimizing peer review of software code, Science 341 (6143) (2013) 236–237.
[107]
S. Jayatilake, S. De Silva, U. Settinayake, S. Yapa, J. Jayamanne, A. Ruwanthika, C. Manawadu, Role of software inspections in the Sri Lankan software development industry, in: 2013 8th International Conference on Computer Science & Education, 2013, pp. 697–702.
[108]
G. Gousios, A. Zaidman, M.-A. Storey, A. Van Deursen, Work practices and challenges in pull-based development: The integrator’s perspective, in: 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, vol. 1, 2015, pp. 358–368.
[109]
O. Kononenko, O. Baysal, M.W. Godfrey, Code review quality: How developers see it, in: Proceedings of the 38th International Conference on Software Engineering, 2016, pp. 1028–1038.
[110]
MacLeod L., Greiler M., Storey M.-A., Bird C., Czerwonka J., Code reviewing in the trenches: Challenges and best practices, IEEE Softw. 35 (4) (2017) 34–42.
[111]
T. Baum, H. Leßmann, K. Schneider, The choice of code review process: A survey on the state of the practice, in: International Conference on Product-Focused Software Process Improvement, 2017, pp. 111–127.
[112]
Ebert F., Castor F., Novielli N., Serebrenik A., An exploratory study on confusion in code reviews, Empir. Softw. Eng. 26 (1) (2021) 1–48.
[113]
P.M. Johnson, An instrumented approach to improving software quality through formal technical review, in: Proceedings of 16th International Conference on Software Engineering, 1994, pp. 113–122.
[114]
F. Belli, R. Crisan, Towards automation of checklist-based code-reviews, in: Proceedings of ISSRE’96: 7th International Symposium on Software Reliability Engineering, 1996, pp. 24–33.
[115]
Porter A.A., Siy H.P., Toman C.A., Votta L.G., An experiment to assess the cost-benefits of code inspections in large scale software development, IEEE Trans. Softw. Eng. 23 (6) (1997) 329–346.
[116]
F. Belli, R. Crisan, Empirical performance analysis of computer-supported code-reviews, in: Proceedings the Eighth International Symposium on Software Reliability Engineering, 1997, pp. 245–255.
[117]
K. Chan, An agent-based approach to computer assisted code inspections, in: Proceedings 2001 Australian Software Engineering Conference, 2001, pp. 147–152.
[118]
Kelly D., Shepard T., Task-directed software inspection, J. Syst. Softw. 73 (2) (2004) 361–368.
[119]
E. Farchi, S. Ur, Selective Homeworkless Reviews, in: 2008 1st International Conference on Software Testing, Verification, and Validation, 2008, pp. 404–413.
[120]
J. Ratcliffe, Moving software quality upstream: The positive impact of lightweight peer code review, in: Pacific NW Software Quality Conference, 2009, pp. 1–10.
[121]
B. Xu, Cost efficient software review in an e-business software development project, in: 2010 International Conference on E-Business and E-Government, 2010, pp. 2680–2683.
[122]
V. Balachandran, Reducing human effort and improving quality in peer code reviews using automatic static analysis and reviewer recommendation, in: Proc. 35th International Conference on Software Engineering, 2013, pp. 931–940.
[123]
Misra S., Fernández L., Colomo-Palacios R., A simplified model for software inspection, J. Softw. Evol. Process 26 (12) (2014) 1297–1315.
[124]
Staff C., CodeFlow: improving the code review process at microsoft, Commun. ACM 62 (2) (2019) 36–44.
[125]
Rebai S., Amich A., Molaei S., Kessentini M., Kazman R., Multi-objective code reviewer recommendations: balancing expertise, availability and collaborations, Autom. Softw. Eng. (2020) 1–28.
[126]
Z. Xia, H. Sun, J. Jiang, X. Wang, X. Liu, A hybrid approach to code reviewer recommendation with collaborative filtering, in: 2017 6th International Workshop on Software Mining (SoftwareMining), 2017, pp. 24–31.
[127]
McIntosh S., Kamei Y., Adams B., Hassan A.E., An empirical study of the impact of modern code review practices on software quality, Empir. Softw. Eng. 21 (5) (2016) 2146–2189.
[128]
M.M. Rahman, C.K. Roy, J.A. Collins, Correct: code reviewer recommendation in github based on cross-project and technology experience, in: Proceedings of the 38th International Conference on Software Engineering Companion, 2016, pp. 222–231.
[129]
Wang Y., Wang X., Jiang Y., Liang Y., Liu Y., A code reviewer assignment model incorporating the competence differences and participant preferences, Found. Comput. Decis. Sci. 41 (1) (2016) 77–91.
[130]
P. Thongtanunam, C. Tantithamthavorn, R.G. Kula, N. Yoshida, H. Iida, K.-i. Matsumoto, Who should review my code? a file location-based code-reviewer recommendation approach for modern code review, in: 2015 IEEE 22nd International Conference on Software Analysis, Evolution, and Reengineering, SANER, 2015, pp. 141–150.

Cited By

View all
  • (2024)Do Words Have Power? Understanding and Fostering Civility in Code Review DiscussionProceedings of the ACM on Software Engineering10.1145/36607801:FSE(1632-1655)Online publication date: 12-Jul-2024
  • (2024)How do annotations affect Java code readability?Empirical Software Engineering10.1007/s10664-024-10460-w29:3Online publication date: 3-May-2024

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image Information and Software Technology
Information and Software Technology  Volume 153, Issue C
Jan 2023
237 pages

Publisher

Butterworth-Heinemann

United States

Publication History

Published: 01 January 2023

Author Tags

  1. Code review
  2. Code inspection
  3. Concerns
  4. Types
  5. Defects
  6. Decisions
  7. Manual classification
  8. Detection method
  9. Detection expertise
  10. Non-programmers

Qualifiers

  • Research-article

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)0
  • Downloads (Last 6 weeks)0
Reflects downloads up to 19 Nov 2024

Other Metrics

Citations

Cited By

View all
  • (2024)Do Words Have Power? Understanding and Fostering Civility in Code Review DiscussionProceedings of the ACM on Software Engineering10.1145/36607801:FSE(1632-1655)Online publication date: 12-Jul-2024
  • (2024)How do annotations affect Java code readability?Empirical Software Engineering10.1007/s10664-024-10460-w29:3Online publication date: 3-May-2024

View Options

View options

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media