1. Improving software quality using Visual Studio 11 C++ Code Analysis
11/18/2018 7:59 PM
TOOL-100T
Improving software quality using Visual Studio 11 C++ Code Analysis
Vince Smith
Senior Program Manager
Jason Yang
Principal Development Lead
Microsoft Corporation
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Key takeaways Code analysis finds bugs early in development
Code analysis can find bugs often missed by traditional testing
Code analysis in Visual Studio 11 is simple to use
“If you're not using ‘Analyze’ you're making a mistake. It is enlightening to see what's happening when you turn this on.”
John Carmack – Cofounder ID software

3. Great customer experiences start with quality
11/18/2018 7:59 PM
Great customer experiences start with quality
Reliability and security bugs
Crashes and hangs
Poor performance
Security vulnerabilities
Lead to poor customer experience
Can be difficult to catch
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. What code analysis is Finds bugs at compile time
11/18/2018 7:59 PM
What code analysis is
Finds bugs at compile time
Systematically looks for bug patterns in source code
Complements traditional testing techniques
“A defect that costs $1 to fix on the programmer’s desktop costs $100 to fix once it is incorporated into a complete program and many thousands of dollars if it is identified only after the software has been deployed in the field.”
“Building a Better Bug Trap” — The Economist
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Introduction to code analysis
11/18/2018 7:59 PM
demo
Introduction to code analysis
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. What we heard from you “Make the analyzer more understandable”
“Help me manage the number of results”
“Improve the accuracy and breadth of coverage”

7. Improvements in Visual Studio 11

8. Walking through code analysis
11/18/2018 7:59 PM
demo
Walking through code analysis
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Results of your feedback
Intuitive analysis results with key events and code step through
Effective prioritization using keyword filtering and rule sets
Broader coverage and more accurate results

10. Getting the most out of code analysis

11. Source code Annotation Language (SAL)
Consistent syntax describing critical properties
Automatically enforced by tools
Allows you to get analysis results quickly

12. _In_: input parameter; cannot be NULL
What SAL looks like
_In_: input parameter; cannot be NULL
void Print(_In_ int* p) {
std::cout << *p; }
void Bad()
int* q = NULL;
...
Print(q);
void Print(_In_ int* p) {
std::cout << *p; }
void Good()
int* q = NULL;
...
if (q != NULL)
Print(q);

13. Examples of parameter annotations
Required Parameters
Optional Parameters
Input to called function
_In_
_In_opt_
Output to caller
_Out_
_Out_opt_
Input to called function and output to caller
_Inout_
_Inout_opt_
Output of pointer to caller
_Outptr_
_Outptr_opt_

14. Analyzer improvement in Visual Studio 11
Broad coverage
Accurate results
Fast speed
Null pointer dereference
Uninitialized variable
Buffer overflow
Memory leak
Concurrency issue

15. Incremental and lasting benefit
Initial benefit without annotations
Incremental benefit with some annotations
Full benefit when thoroughly annotated

16. Adding annotations to find more bugs
11/18/2018 7:59 PM
demo
Adding annotations to find more bugs
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Review

18. Code analysis finds bugs early in development

19. Code analysis can find bugs often missed by traditional testing

20. Code analysis in Visual Studio 11 is simple to use

21. For more information Related sessions Documentation & articles
[HW-889P] Advanced driver code analysis techniques
[HW-239T] Moving driver quality upstream with WDK driver verification and test tools
Developer’s Reference Guide to SAL
Developer’s Reference Guide to Concurrency SAL Annotations
Visual Studio Code Analysis Defect Warnings Reference
SAL Illustrated: A Visual Guide for New Users
Code Analysis Team Blog

22. thank you Feedback and questions http://forums.dev.windows.com
Session feedback

23. 11/18/2018 7:59 PM
© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.