9780321166074

The follow-up volume to the award-winning Code Reading teaches programmers the crucial skill of interpreting someone else's code.

Diomidis Spinellis has been developing the concepts presented in this book since 1985, while also writing groundbreaking software applications and working on multimillion-line code bases. Spinellis holds an M.Eng. degree in software engineering and a Ph.D. in computer science from Imperial College London. Currently he is an associate professor in the Department of Management Science and Technology at the Athens University of Economics and Business.

List of Tables

xv

List of Figures

xvii

Foreword

xxiii

Preface

xxv

Introduction

1

(16)

Software Quality

1

(8)

Quality Through the Eyes of the User, the Builder, and the Manager

2

(2)

Quality Attributes

4

(3)

A World of Tensions

7

(2)

How to Read This Book

9

(8)

Typographical Conventions

10

(1)

Diagrams

11

(2)

Charts

13

(1)

Assembly Code

13

(1)

Exercises

14

(1)

Supplementary Material

14

(1)

Tools

14

(3)

Reliability

17

(84)

Input Problems

17

(4)

Output Problems

21

(5)

Incomplete or Missing Output

21

(2)

Correct Results at the Wrong Time

23

(1)

Wrong Format

24

(2)

Logic Problems

26

(16)

Off-by-One Errors and Loop Iterations

26

(1)

Neglected Extreme Conditions

27

(2)

Forgotten Cases, Condition Tests, or Steps

29

(5)

Missing Methods

34

(3)

Unnecessary Functionality

37

(3)

Misinterpretation

40

(2)

Computation Problems

42

(9)

Incorrect Algorithm or Computation

42

(1)

Incorrect Operand in an Expression

43

(4)

Incorrect Operator in an Expression

47

(1)

Operator Precedence Problems

48

(1)

Overflow, Underflow, and Sign Conversion-Errors

49

(2)

Concurrency and Timing Problems

51

(5)

Interface Problems

56

(13)

Incorrect Routine or Arguments

57

(2)

Failure to Test a Return Value

59

(3)

Missing Error Detection or Recovery

62

(3)

Resource Leaks

65

(3)

Misuse of Object-Oriented Facilities

68

(1)

Data-Handling Problems

69

(16)

Incorrect Data Initialization

69

(2)

Referencing the Wrong Data Variable

71

(4)

Out-of-Bounds References

75

(2)

Incorrect Subscripting

77

(2)

Incorrect Scaling or Data Units

79

(1)

Incorrect Data Packing or Unpacking

80

(2)

Inconsistent Data

82

(3)

Fault Tolerance

85

(16)

Management Strategy

85

(2)

Redundancy in Space

87

(2)

Redundancy in Time

89

(1)

Recoverability

90

(11)

Security

101

(50)

Vulnerable Code

102

(4)

The Buffer Overflow

106

(6)

Race Conditions

112

(3)

Problematic APIs

115

(10)

Functions Susceptible to Buffer Overflows

115

(3)

Format String Vulnerabilities

118

(1)

Path and Shell Metacharacter Vulnerabilities

119

(2)

Temporary Files

121

(1)

Functions Unsuitable for Cryptographic Use

122

(2)

Forgeable Data

124

(1)

Untrusted Input

125

(6)

Result Verification

131

(3)

Data and Privilege Leakage

134

(9)

Data Leakage

135

(3)

Privilege Leakage

138

(2)

The Java Approach

140

(1)

Isolating Privileged Code

141

(2)

Trojan Horse

143

(3)

Tools

146

(5)

Time Performance

151

(56)

Measurement Techniques

156

(17)

Workload Characterization

157

(1)

I/O-Bound Tasks

158

(3)

Kernel-Bound Tasks

161

(2)

CPU-Bound Tasks and Profiling Tools

163

(10)

Algorithm Complexity

173

(6)

Stand-Alone Code

179

(3)

Interacting with the Operating System

182

(8)

Interacting with Peripherals

190

(1)

Involuntary Interactions

191

(3)

Caching

194

(13)

A Simple System Call Cache

195

(2)

Replacement Strategies

197

(2)

Precomputing Results

199

(8)

Space Performance

207

(82)

Data

209

(18)

Basic Data Types

209

(4)

Aggregate Data Types

213

(2)

Alignment

215

(7)

Objects

222

(5)

Memory Organization

227

(4)

Memory Hierarchies

231

(8)

Main Memory and Its Caches

232

(3)

Disk Cache and Banked Memory

235

(3)

Swap Area and File-Based Disk Storage

238

(1)

The Process/Operating System Interface

239

(7)

Memory Allocation

239

(2)

Memory Mapping

241

(1)

Data Mapping

241

(1)

Code Mapping

242

(2)

Accessing Hardware Resources

244

(1)

Interprocess Communication

244

(2)

Heap Memory Management

246

(18)

Heap Fragmentation

247

(7)

Heap Profiling

254

(2)

Memory Leaks

256

(6)

Garbage Collection

262

(2)

Stack Memory Management

264

(10)

The Stack Frame

264

(5)

Stack Space

269

(5)

Code

274

(15)

Design Time

276

(3)

Coding Time

279

(1)

Build Time

280

(9)

Portability

289

(36)

Operating Systems

290

(6)

Hardware and Processor Architectures

296

(6)

Data Type Properties

296

(2)

Data Storage

298

(2)

Machine-Specific Code

300

(2)

Compilers and Language Extensions

302

(5)

Compiler Bugs

302

(5)

Graphical User Interfaces

307

(2)

Internationalization and Localization

309

(16)

Character Sets

309

(4)

Locale

313

(3)

Messages

316

(9)

Maintainability

325

(140)

Measuring Maintainability

326

(25)

The Maintainability Index

327

(6)

Metrics for Object-Oriented Programs

333

(10)

Dependency Metrics on Packages

343

(8)

Analyzability

351

(52)

Consistency

353

(1)

Expression Formatting

354

(2)

Statement Formatting

356

(1)

Naming Conventions

357

(3)

Statement-Level Comments

360

(2)

Versioning Comments

362

(1)

Visual Structure: Blocks and Indentation

363

(1)

Length of Expressions, Functions, and Methods

364

(4)

Control Structures

368

(4)

Boolean Expressions

372

(2)

Recognizability and Cohesion

374

(3)

Dependencies and Coupling

377

(12)

Code Block Comments

389

(4)

Data Declaration Comments

393

(1)

Appropriate Identifier Names

394

(1)

Locality of Dependencies

394

(2)

Ambiguity

396

(1)

Reviewability

397

(6)

Changeability

403

(15)

Identification

403

(5)

Separation

408

(10)

Stability

418

(14)

Encapsulation and Data Hiding

419

(4)

Data Abstraction

423

(2)

Type Checking

425

(3)

Compile-Time Assertions

428

(3)

Runtime Checks and Inspection-Time Assertion

431

(1)

Testability

432

(19)

Unit Testing

433

(4)

Integration Testing

437

(2)

System Testing

439

(2)

Test Coverage Analysis

441

(3)

Incidental Testing

444

(7)

Effects of the Development Environment

451

(14)

Incremental Builds

452

(2)

Tuning Build Performance

454

(11)

Floating-Point Arithmetic

465

(38)

Floating-Point Representation

466

(12)

Measuring Error

469

(1)

Rounding

470

(2)

Memory Format

472

(2)

Normalization and the Implied 1-Bit

474

(1)

Exponent Biasing

474

(1)

Negative Numbers

475

(1)

Denormal Numbers

475

(1)

Special Values

476

(2)

Rounding

478

(3)

Overflow

481

(2)

Underflow

483

(4)

Cancellation

487

(4)

Absorption

491

(4)

Invalid Operations

495

(8)

A Source Code Credits

503

(2)

Bibliography

505

(18)

Index

523

(40)

Author Index

563

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

In programming, as in everything else, to be in error is to be reborn. -- Alan J. Perlis I wish I could start this preface by writing that the book you are holding in your hands is the result of a carefully planned premeditated publishing effort that started with the title Code Reading: The Open Source Perspective and is now being completed with Code Quality. Writing so would, however, be twisting the true facts, adjusting reality to the orderly world we engineers like to see around us. The truth is that Code Quality is mostly the result of a series of fortuitous accidents. When I signed the contract to publish Code Reading, I had in my hands the outline and a couple of completed chapters. I naively calculated the book's length and the completion schedule, based on the length and effort of the chapters I had already written. Now, if you are writing software for a living, you can probably guess that at the time the manuscript was supposed to have been finished, I had covered just slightly more than half the chapters in the outline and had already used up all the allotted pages. Looking for a respectable exit strategy, I suggested to my editor publishing the material I had completed (minus a chapter on portability) as the first volume of Code Reading and continuing the rest of the work in a second volume.We agreed, and Code Reading got published, received a number of favorable reviews, appeared in the list of the 2004 Software Development Magazine Productivity Awards, and got translated into six other languages. In Code Reading, by using real-life examples taken out of working, open source projects, I tried to cover most code-related concepts that are likely to appear before a software developer's eyes, including programming constructs, data types, data structures, control flow, project organization, coding standards, documentation, and architectures. My plan for the second volume was to cover interfacing and applicationoriented code, including the issues of internationalization and portability, the elements of commonly used libraries and operating systems, low-level code, domain-specific and declarative languages, scripting languages, and mixed-language systems. However, with Code Reading in the hands of programmers, I now had the benefit of readership opinions. The feedback I received indicated that many were eagerly waiting for the follow-up volume, but a detailed dissection of a device driver (one of the chapters I had left for a subsequent volume) was not the material they had in mind for it. In July 2003, my then editor, Mike Hendrickson, suggested working on a book titled Secure Code Reading. Although it security is an area that interests me as a scientist, I was loath to jump into the security book bandwagon and wrote a corresponding chapter instead. With one chapter on portability and one on security, I could suddenly see the book's theme and title before my eyes. Code Quality would focus on how to read and write software code, focusing on its quality attributes, those also often described as nonfunctional properties. The nonfunctional properties we can discern from reading a software system's code are associated with the product's nonfunctional requirements: the requirements that are not directly concerned with specific functions delivered by the system but that deal with broader emergent system properties. Some common nonfunctional properties are the various -ilities of a system: reliability, portability, usability, interoperability, adaptability, dependability, and maintainability. Two other significant nonfunctional properties concern the system's efficiency: its performance related to time constraints and its space requirements. The skill of reading code to discern its nonfunctional properties is crucial for two important reasons. First of all, a failure to satisfy a nonfunctional requirement can

Amazon no longer offers textbook rentals. We do!

Code Quality The Open Source Perspective

Code Quality The Open Source Perspective

0321166078

Summary

Author Biography

Table of Contents

Supplemental Materials

Excerpts

Write a Review