Software checkers revealed 14 hidden mistakes in new tests
A study of three Java code-checking tools found 12 missed problems and two incorrect warnings.
Editorial illustration — not from the study.
Static code analyzers inspect programs for possible flaws, but they can miss real problems or flag code that is not actually wrong. Researchers studied 350 previously confirmed and fixed issues from PMD, SpotBugs and SonarQube to examine why these errors occur.
They then used patterns from that analysis to create new test programs by changing existing ones in ways that should preserve or predict the tools’ results. The approach found 14 additional issues: 12 missed problems and two incorrect warnings. Eleven were confirmed by developers and nine had been fixed when the researchers reported their results.
Hidden errors in code checkers
The historical review found that some analyzer errors were linked to unhandled Java language features, missing cases in a rule’s implementation, and weaknesses in the underlying analysis. Issues were also associated with annotations, method calls and field accesses, Java libraries, nested classes, and code using the same identifiers in different contexts.
The researchers tested PMD version 7.0.0-rc3, SpotBugs 4.7.4 and SonarQube 10.0.0.68432 using test programs released by the tools. The testing strategy generated new Java programs and compared the tools’ warnings with those for the original programs. It found 14 new issues across 12 rules from PMD and SpotBugs: 12 false negatives, in which a tool missed a problem, and two false positives, in which it reported a problem that was not present. Three issues were still awaiting developer feedback. A further manual review identified one rule-specification issue and four additional false negatives or false positives caused by weaknesses in the implemented analysis.
Why these errors matter
Static code analyzers are used to help identify flaws, so missed problems and incorrect warnings can affect both their usefulness and the effort required to review their results. The study shows that testing rules with varied versions of otherwise related code can uncover issues without relying on another analyzer as a reference.
The researchers say that supporting new Java language features, testing more input patterns, and improving how tools handle annotations, libraries, types, scopes and program behavior could reduce these errors. The study also notes that developers may balance accuracy against performance, development effort and the risk of creating more incorrect warnings.
Evidence and caveats
This was a systematic analysis of 350 historical issues from three Java static code analyzers, followed by a proof-of-concept testing strategy. The new tests used 3,754 PMD programs, 1,227 SpotBugs programs and 572 SonarQube programs, transformed with JavaParser and run on the versions available during the study. Researchers manually inspected suspected issues and reported them to the developers.
The findings cover three tools and Java programs, so the results do not by themselves establish how often similar issues occur in other analyzers, programming languages or software projects. Confirmation and fixes were also incomplete when the results were reported: 11 of the 14 newly found issues had been confirmed, nine had been fixed, and three were still awaiting feedback. The datasets and testing tools were made publicly available.
// Source
ACM Transactions on Software Engineering and Methodology · 2026 · DOI: 10.1145/3849701
Researchers tested a programmable hardware design that imitates selected quantum-computing ideas to run matrix calculations in parallel. In representative benchmarks, the design reached up to 6.3 times the speed and 4.1 times the energy efficiency of conventional matrix co-processors and embedded graphics processors.
Researchers evaluated three AI systems on hundreds of molecules bound to a SARS-CoV-2 protein and in three prospective drug screens. The results suggest that combining AI-based predictions with traditional docking may help prioritize candidates, although no single approach worked best in every test.
Researchers developed a hardware-assisted system intended to detect message injection, spoofing, flooding and impersonation attacks on automotive networks. In tests using simulated traffic and a prototype automotive processor system, it reported an average detection time of 14 microseconds and less than 2 percent CPU overhead.
