>
>
C#, PVS-Studio, ReSharper

Andrey Karpov
Articles: 674

C#, PVS-Studio, ReSharper

There is one question that we constantly get asked: "Does it make sense to use PVS-Studio static code analyzer, if we already have ReSharper?". Programmers probably expect to see an article with the comparison of these tools, according to their ability to find bugs in programs. But we reckon that such an article won't clarify the situation; and we'll explain why. However, the question is raised so often that it should be answered. The answer is yes, it makes sense. I should warn you that you won't find a comparison of these tools here. However, if you take just 10 minutes to read this article to its end, you will understand the way we see the situation.

PVS-Studio is a static code analyzer that detects errors in the source code written in C/C++. Recently, the analyzer obtained a new ability - to detect bugs in programs written in C#. Historically, ReSharper is known as the main tool for C# programmers. But it belongs to the category of 'productivity tools', and can not be called a static code analyzer in its classical meaning. However, ReSharper performs a wide variety of checks, and highlights suspicious code fragments. That's why the programmers ask a reasonable question, "Is there a point in PVS-Studio, if we already have ReSharper?"

The answer: Yes! We are certain of this. To prove it, a simple table showing the comparison of the abilities won't be enough. It's not a problem to make one, but we have sworn off making such detailed comparisons again. Our experience has shown us that such comparisons do more harm than good.

For example, we carried out a thorough comparison of PVS-Studio with Cppcheck, and Visual Studio SCA, in which we invested a lot of time and effort. This resulted in two articles - a short and long variant. We were accused by many of being biased, and told it was unfair to choose these projects for comparison.

We don't see the point in spending time on such comparisons. No matter how thorough we try to do it, there will always be someone who will say that it is biased.

Nevertheless, we need to come up with an answer about the comparison of PVS-Studio with ReSharper. We can offer a different variant:

You are already using ReSharper? Great! Install PVS-Studio and see if it finds new bugs in your code.

This is the best way to decide whether PVS-Studio is needed or not. And there is no competition here: these tools can complement each other quite well.

"Ok", a reader might say. "A new tool is no harm to anybody. But will you be able to get to the market of C# tools? Every spot is already taken here. Does anybody need PVS-Studio for C#?"

For a start, the answer is:

Figure. "Certainty of death, small chance of success. What are we waiting for?"

Of course, we have already thought about this philosophical question "Does this world need PVS-Studio?" This question arose when the analyzer was newly created, and it was only at the beginning of its path to popularity among C++ programmers. It seemed pointless to make another tool, since there were already:

  • Compilers that had the functionality of static analyzers. For example, Clang and some Visual Studio editions containing a C++ code static analyzer. s
  • Free code analyzers, such as Cppcheck.
  • Powerful paid tools such as Coverity, Klocwork, and so on.

So why was PVS-Studio for C++ needed? To be honest, we didn't have an answer. We were making it because we could, and we loved what we were doing. Now cadit quaestio, as we can easily demonstrate the benefits that the PVS-Studio analyzer brings.

We have found thousands of bugs in programs, and here is the documented proof of it. These bugs were detected regardless of other tools. We could have a long conversation about competitive advantages, but right now, that's of no interest to us.

Here are 9355 bugs that we found in projects such as Chromium, Qt, LibreOffice, TortoiseSVN, Unreal Engine 4, and so on.

We can also provide some links to the articles where you can see some comparisons with other tools.

  • For example, someone wants to see why we are better than Clang. Great! Everything is very simple. We have found bugs in Clang: link 1, link 2.
  • For those who are curious, if there is a point in using PVS-Studio analyzer when there is already an analyzer implemented in Visual Studio. Of course there is a point. You may just have a look at the bugs we found in Visual Studio libraries: 2012, 2013.
  • Another question - should programmers buy PVS-Studio if there is free Cppcheck. There is an article on this topic - comparison of PVS-Studio and Cppcheck that wasn't accepted by the public. Here is a different proof - Link.
  • Some may think that Coverity/Klocwork will be enough for all occasions. Undoubtedly, these are powerful and extremely useful tools. But PVS-Studio was also able to detect errors that weren't noticed by these tools: link 1, link 2.

Our way with C# analyzer has just started. But we can already say:

  • We have found bugs in Roslyn.
  • Our analyzer detected bugs in Microsoft projects that are known for the high quality of their code. To find at least something in their projects is already a great achievement. Examples: CoreFX, Microsoft Code Contracts

We are quite sure, that in time there won't be any necessity to compare the tools. You don't have to wait, and can start using the analyzer now. Although it is relatively new, and we have implemented only part of the planned diagnostics, your code can benefit greatly from it. Try automatic check mode after the compilation. We hope you'll enjoy it. We'll be glad to help if something goes wrong - just write to us.

Overall results. We suggest you download and try PVS-Studio, no matter what tool you are already using. If it finds bugs in your project, it will be the best proof of its usefulness. But don't forget that random checks don't make sense. Code analyzers are useful only when they are regularly used. It's also very inefficient to search for typos and errors, and debugging your code yourself, if the analyzer can do it for you. Of course, it won't be able to detect 100% of bugs, but it can really help to save time, which can be used for something that is more effective than searching for bugs in conditions.