What are the differences between PMD and FindBugs?

Question

There was a question comparing PMD and CheckStyle. However, I can't find a nice breakdown on the differences/similarities between PMD and FindBugs. I believe a key difference is that PMD works on source code, while FindBugs works on compiled bytecode files. But in terms of capabilities, should it be an either/or choice or do they complement each other?

Solution 1

I'm using both. I think they complement each other.

As you said, PMD works on source code and therefore finds problems like: violation of naming conventions, lack of curly braces, misplaced null check, long parameter list, unnecessary constructor, missing break in switch, etc. PMD also tells you about the Cyclomatic complexity of your code which I find very helpful (FindBugs doesn't tell you about the Cyclomatic complexity).

FindBugs works on bytecode. Here are some problems FindBugs finds which PMD doesn't: equals() method fails on subtypes, clone method may return null, reference comparison of Boolean values, impossible cast, 32bit int shifted by an amount not in the range of 0-31, a collection which contains itself, equals method always returns true, an infinite loop, etc.

Usually each of them finds a different set of problems. Use both. These tools taught me a lot about how to write good Java code.

Solution 2

The best feature of PMD, is its XPath Rules, bundled with a Rule Designer to let you easily construct new rules from code samples (similar to RegEx and XPath GUI builders). FindBugs is stronger out of the box, but constructing project specific rules and patterns is very important.

For example, I encountered a performance problem involving 2 nested for loops, resulting in a O(n^2) running time, which could easily be avoided. I used PMD to construct an ad-hoc query, to review other instances of nested for loops - //ForStatement/Statement//ForStatement. This pointed out 2 more instances of the problem. This is not a generic rule whatsoever.

Solution 3

PMD is

• famous
• used widely in industry
• you can add your rules in xml
• gives you detailed analysis in Errors levels and warning levels
• you can also scan your code for "copy and paste lines". Duplicate code. This gives good idea about implementing java oops.

Comments

[Geek]

What is the specific error code that you saw when a collection contains itself and why is that marked a probable bug by FindBugs?

[Markus]

well since Sonarqube 6.3 no longer... Sonarqube needs now Java 8 and Findbugs is only supporting Java 7 yet

[Stevers]

Doesn't speak to FindBugs; they're complementary as their problem sets are not identical.