• [x] Need updated ASM (6.0 snapshot works fine)
  • [x] We should temporarily host and build against a snapshot build, I can upload one
• [x] Need updated BCEL ?(current snapshot seem to work but probably lacks some new constructs). See #106 for BCEL update evaluation.
• [x] Need JRT FS support (I have a patch, missing: multi-module packages)
  • [x] Need update of runtime requirements and build to Java 8 (I have a patch)
• [x] Need Eclipse plugin support (I have a patch)
• [x] Need proper update of JavaVersion parser (see #75 , must be adopted)
• [x] Requires minor version number increase (3.0 -> 3.1) at least.

The maven artifact containing the JSR 305 annotations on Maven Central [1] declares the Apache License 2 as the license to use for the JSR305 annotations. However, the FindBugs project states that all source code is licensed under the LGPL [2].

Which one is true?

[1] http://search.maven.org/#artifactdetails|com.google.code.findbugs|jsr305|3.0.1|jar [2] http://findbugs.sourceforge.net/

BCEL 6 broke every single API by moving all types in different package structure, see https://issues.apache.org/jira/browse/BCEL-222. No comments about that move.

However, to get up to date with latest Java 9 fixes in BCEL we have either to break every FB plugin/user (because we exposed BCEL in FB API all over the place, see for example use of org.apache.bcel.classfile.JavaClass) and ship totally incompatible FB 4.0, or we need to backport BCEL 6 changes to the "old" package structure.

I'm investigating the later one.

OK, I've managed to rename the packages back (see https://github.com/iloveeclipse/commons-bcel/tree/old_structure) and with few (not committed) FB changes I was able to run FB with that BCEL version. Problem: it simply doesn't work in few cases anymore, neither on Java 8 nor on Java 9. I had few different exceptions, which I'm not sure where the root cause is - new BCEL code or missing adoption on FB side: bcel_test_result.txt

Now I'm going to break FB API and use BCEL as is, just to test if BCEL 6 "unchanged" will work with FB.

Using findbugs-3.0.1, we run into the following situation during analysis: [findbugs] Executing findbugs FindBugsTask from ant task [findbugs] Running FindBugs... [findbugs] The following errors occurred during analysis: [findbugs] Error processing2 < I, 1 >iadd< Ljava/lang/String;, "", r4 > @ 706 in workflow.fileupload.swift.mt101.Mt101MultibankingWorkflowTest.testMultibankingOkWithMultipleASeqs : ()V [findbugs] java.lang.IllegalArgumentException: [findbugs] At edu.umd.cs.findbugs.OpcodeStack.constantToInt(OpcodeStack.java:2179) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.pushByIntMath(OpcodeStack.java:3198) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.sawOpcode(OpcodeStack.java:1644) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory$JumpStackComputation.sawOpcode(OpcodeStack.java:2846) [findbugs] At edu.umd.cs.findbugs.visitclass.DismantleBytecode.visit(DismantleBytecode.java:883) [findbugs] At edu.umd.cs.findbugs.visitclass.BetterVisitor.visitCode(BetterVisitor.java:218) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitCode(PreorderVisitor.java:235) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory$JumpStackComputation.visitCode(OpcodeStack.java:2832) [findbugs] At org.apache.bcel.classfile.Code.accept(Code.java:135) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:307) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.computeJumpInfo(OpcodeStack.java:2876) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.analyze(OpcodeStack.java:2806) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.analyze(OpcodeStack.java:2789) [findbugs] At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.analyzeMethod(AnalysisCache.java:369) [findbugs] At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getMethodAnalysis(AnalysisCache.java:322) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.getJumpInfo(OpcodeStack.java:3007) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.resetForMethodEntry(OpcodeStack.java:2978) [findbugs] At edu.umd.cs.findbugs.bcel.OpcodeStackDetector.visitCode(OpcodeStackDetector.java:62) [findbugs] At org.apache.bcel.classfile.Code.accept(Code.java:135) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:307) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395) [findbugs] At org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215) [findbugs] At edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38) [findbugs] At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76) [findbugs] At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089) [findbugs] At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283) [findbugs] At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402) [findbugs] At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200) [findbugs] Error processing2 < I, 1 >iadd< Ljava/lang/String;, "", r4 > @ 706 in workflow.fileupload.swift.mt101.Mt101MultibankingWorkflowTest.testMultibankingOkWithMultipleASeqs : ()V [findbugs] java.lang.IllegalArgumentException: [findbugs] At edu.umd.cs.findbugs.OpcodeStack.constantToInt(OpcodeStack.java:2179) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.pushByIntMath(OpcodeStack.java:3198) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.sawOpcode(OpcodeStack.java:1644) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory$JumpStackComputation.sawOpcode(OpcodeStack.java:2846) [findbugs] At edu.umd.cs.findbugs.visitclass.DismantleBytecode.visit(DismantleBytecode.java:883) [findbugs] At edu.umd.cs.findbugs.visitclass.BetterVisitor.visitCode(BetterVisitor.java:218) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitCode(PreorderVisitor.java:235) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory$JumpStackComputation.visitCode(OpcodeStack.java:2832) [findbugs] At org.apache.bcel.classfile.Code.accept(Code.java:135) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:307) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.computeJumpInfo(OpcodeStack.java:2876) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.analyze(OpcodeStack.java:2806) [findbugs] At edu.umd.cs.findbugs.OpcodeStack$JumpInfoFactory.analyze(OpcodeStack.java:2789) [findbugs] At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.analyzeMethod(AnalysisCache.java:369) [findbugs] At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getMethodAnalysis(AnalysisCache.java:322) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.getJumpInfo(OpcodeStack.java:3007) [findbugs] At edu.umd.cs.findbugs.OpcodeStack.resetForMethodEntry(OpcodeStack.java:2978) [findbugs] At edu.umd.cs.findbugs.bcel.OpcodeStackDetector.visitCode(OpcodeStackDetector.java:62) [findbugs] At org.apache.bcel.classfile.Code.accept(Code.java:135) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitMethod(PreorderVisitor.java:307) [findbugs] At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:395) [findbugs] At org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:215) [findbugs] At edu.umd.cs.findbugs.BytecodeScanningDetector.visitClassContext(BytecodeScanningDetector.java:38) [findbugs] At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76) [findbugs] At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089) [findbugs] At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283) [findbugs] At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402) [findbugs] At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200) [findbugs] [findbugs] Calculating exit code... [findbugs] Exit code set to: 0

:bangbang: THIS PULL REQUEST IS NOT COMPLETE YET

This is my shot at implementing Feature Request #313: Warn about identity-sensitive operations on value based classes.

For brevity's sake I'll use vbi for value-based instance(s), i.e. an instance of a value-based class.

Current State

The annotation @ValueBased can be used to mark own value-based classes. These classes and those from the JDK are processed uniformly when it comes to the following checks:

• :white_check_mark: no reference comparison
• :white_check_mark: serialization of vbi
  • :white_check_mark: no non-transient field in serializable class (works out of the box)
  • :white_check_mark: no direct serialization via ObjectOutputStream.writeObject (works out of the box)
• :red_circle: identity hash code
  • :white_check_mark: no argument to System.identityHashCode
  • :red_circle: no key in an IdentityHashMap
• :white_check_mark: no locking on a vbi
  • :white_check_mark: no use in synchronized block
  • :white_check_mark: no calls to Object.wait
  • :white_check_mark: no calls to Object.notify
  • :white_check_mark: no calls to Object.notifyAll

Notes

Ensuring that a class annotated with @ValueBased has all properties described in the official documentation is not in the scope of #313 and hence also not of this pull request.

This is a followup to https://sourceforge.net/p/findbugs/bugs/1415/ I tried if the error still occurs with findbugs 3.1.0_preview2 that contains a newer bcel - it still occurs, but now with a different error message.

Steps to reproduce: 1.) compile the following code using Eclipse 4.6

public interface HasUniqueKey<Key> {
  Key getInternId();
}

public class Util {
  public static List<Integer> toIntegerList(List<? extends HasUniqueKey<Integer>> entities) {
    return entities.stream().map(m -> m.getInternId()).collect(Collectors.toList());
  }
}

Note that compiling the code with javac will NOT show the problem, as javac produces quite different byte code when compiling the lambda.

2.) let findbugs analyse the resulting class files (e.g. through the gui). This results in the following stacktrace:

The following errors occurred during analysis:
  Error parsing signature !+LHasUniqueKey<Ljava/lang/Integer;>;
    java.lang.IllegalStateException: Invalid method signature: '(!+LHasUniqueKey<Ljava/lang/Integer;>;)V' : !+LHasUniqueKey<Ljava/lang/Integer;>;)V 
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser$ParameterSignatureIterator.next(GenericSignatureParser.java:120)
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser$ParameterSignatureIterator.next(GenericSignatureParser.java:45)
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser.getNumParameters(GenericSignatureParser.java:184)
      At edu.umd.cs.findbugs.ba.generic.GenericUtilities.getType(GenericUtilities.java:263)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.getLocalVariable(TypeFrameModelingVisitor.java:827)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.handleLoadInstruction(TypeFrameModelingVisitor.java:889)
      At edu.umd.cs.findbugs.ba.AbstractFrameModelingVisitor.visitALOAD(AbstractFrameModelingVisitor.java:452)
      At org.apache.bcel.generic.ALOAD.accept(ALOAD.java:56)
      At edu.umd.cs.findbugs.ba.AbstractFrameModelingVisitor.analyzeInstruction(AbstractFrameModelingVisitor.java:84)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.analyzeInstruction(TypeFrameModelingVisitor.java:197)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transferInstruction(TypeAnalysis.java:406)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transferInstruction(TypeAnalysis.java:86)
      At edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis.transfer(AbstractDataflowAnalysis.java:135)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transfer(TypeAnalysis.java:414)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transfer(TypeAnalysis.java:86)
      At edu.umd.cs.findbugs.ba.Dataflow.execute(Dataflow.java:376)
      At edu.umd.cs.findbugs.classfile.engine.bcel.TypeDataflowFactory.analyze(TypeDataflowFactory.java:83)
      At edu.umd.cs.findbugs.classfile.engine.bcel.TypeDataflowFactory.analyze(TypeDataflowFactory.java:43)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.analyzeMethod(AnalysisCache.java:369)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getMethodAnalysis(AnalysisCache.java:322)
      At edu.umd.cs.findbugs.classfile.engine.bcel.CFGFactory.analyze(CFGFactory.java:160)
      At edu.umd.cs.findbugs.classfile.engine.bcel.CFGFactory.analyze(CFGFactory.java:65)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.analyzeMethod(AnalysisCache.java:369)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getMethodAnalysis(AnalysisCache.java:322)
      At edu.umd.cs.findbugs.ba.ClassContext.getMethodAnalysis(ClassContext.java:1005)
      At edu.umd.cs.findbugs.ba.ClassContext.getMethodAnalysisNoDataflowAnalysisException(ClassContext.java:990)
      At edu.umd.cs.findbugs.ba.ClassContext.getCFG(ClassContext.java:303)
      At edu.umd.cs.findbugs.detect.BuildNonnullReturnDatabase.analyzeMethod(BuildNonnullReturnDatabase.java:87)
      At edu.umd.cs.findbugs.detect.BuildNonnullReturnDatabase.considerMethod(BuildNonnullReturnDatabase.java:76)
      At edu.umd.cs.findbugs.detect.BuildNonnullReturnDatabase.visitClassContext(BuildNonnullReturnDatabase.java:67)
      At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
      At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)
      At edu.umd.cs.findbugs.gui2.BugLoader.doAnalysis(BugLoader.java:101)
      At edu.umd.cs.findbugs.gui2.AnalyzingDialog$AnalysisThread.run(AnalyzingDialog.java:275)
  Error parsing signature !+LHasUniqueKey<Ljava/lang/Integer;>;
    java.lang.IllegalStateException: Invalid method signature: '(!+LHasUniqueKey<Ljava/lang/Integer;>;)V' : !+LHasUniqueKey<Ljava/lang/Integer;>;)V 
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser$ParameterSignatureIterator.next(GenericSignatureParser.java:120)
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser$ParameterSignatureIterator.next(GenericSignatureParser.java:45)
      At edu.umd.cs.findbugs.ba.generic.GenericSignatureParser.getNumParameters(GenericSignatureParser.java:184)
      At edu.umd.cs.findbugs.ba.generic.GenericUtilities.getType(GenericUtilities.java:263)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.getLocalVariable(TypeFrameModelingVisitor.java:827)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.handleLoadInstruction(TypeFrameModelingVisitor.java:889)
      At edu.umd.cs.findbugs.ba.AbstractFrameModelingVisitor.visitALOAD(AbstractFrameModelingVisitor.java:452)
      At org.apache.bcel.generic.ALOAD.accept(ALOAD.java:56)
      At edu.umd.cs.findbugs.ba.AbstractFrameModelingVisitor.analyzeInstruction(AbstractFrameModelingVisitor.java:84)
      At edu.umd.cs.findbugs.ba.type.TypeFrameModelingVisitor.analyzeInstruction(TypeFrameModelingVisitor.java:197)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transferInstruction(TypeAnalysis.java:406)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transferInstruction(TypeAnalysis.java:86)
      At edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis.transfer(AbstractDataflowAnalysis.java:135)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transfer(TypeAnalysis.java:414)
      At edu.umd.cs.findbugs.ba.type.TypeAnalysis.transfer(TypeAnalysis.java:86)
      At edu.umd.cs.findbugs.ba.Dataflow.execute(Dataflow.java:376)
      At edu.umd.cs.findbugs.detect.FindRefComparison.analyzeMethod(FindRefComparison.java:769)
      At edu.umd.cs.findbugs.detect.FindRefComparison.visitClassContext(FindRefComparison.java:696)
      At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
      At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283)
      At edu.umd.cs.findbugs.gui2.BugLoader.doAnalysis(BugLoader.java:101)
      At edu.umd.cs.findbugs.gui2.AnalyzingDialog$AnalysisThread.run(AnalyzingDialog.java:275)

Hi, this introduces support for FindBugs to recognize android.support.annotation.Nullable as CHECK_FOR_NULL and android.support.annotation.NonNull as NONNULL. While it is annoying that there are so many nullability annotations out in the wild and these are just another set of them, these are the only nullability annotations supported by Android Studio, so even if you develop on another IDE, but share code with Android Studio developers, these are the only way to go. Hopefully soon there will be a Java standard for null annotations ...

When running FB 3.1.0 Preview from the command line with: "C:\Program Files\Java\jdk1.8.0_92\jre\bin\java.exe" -Xmx512m -Dfile.encoding=UTF8 -classpath C:\Users\njt\Downloads\findbugs-noUpdateChecks-3.1.0-dev-20160609-91ad577\findbugs-3.1.0-dev-20160609-91ad577\lib\findbugs.jar;C:\Users\njt\.m2\repository\net\jcip\jcip-annotations\1.0\jcip-annotations-1.0.jar;C:\Users\njt\Downloads\findbugs-noUpdateChecks-3.1.0-dev-20160609-91ad577\findbugs-3.1.0-dev-20160609-91ad577\lib\jsr305.jar;C:\Users\njt\Downloads\findbugs-noUpdateChecks-3.1.0-dev-20160609-91ad577\findbugs-3.1.0-dev-20160609-91ad577\lib\bcel-6.0-SNAPSHOT.jar;C:\Users\njt\Downloads\findbugs-noUpdateChecks-3.1.0-dev-20160609-91ad577\findbugs-3.1.0-dev-20160609-91ad577\lib\jFormatString.jar;C:\Users\njt\Downloads\findbugs-noUpdateChecks-3.1.0-dev-20160609-91ad577\findbugs-3.1.0-dev-20160609-91ad577\lib\dom4j-1.6.1.jar;C:\Users\njt\.m2\repository\xml-apis\xml-apis\1.0.b2\xml-apis-1.0.b2.jar;C:\Users\njt\.m2\repository\org\ow2\asm\asm-debug-all\5.0.2\asm-debug-all-5.0.2.jar;C:\Users\njt\.m2\repository\org\ow2\asm\asm-commons\5.0.2\asm-commons-5.0.2.jar;C:\Users\njt\.m2\repository\org\ow2\asm\asm-tree\5.0.2\asm-tree-5.0.2.jar;C:\Users\njt\.m2\repository\org\ow2\asm\asm\5.0.2\asm-5.0.2.jar;C:\Users\njt\.m2\repository\commons-lang\commons-lang\2.6\commons-lang-2.6.jar;C:\Users\njt\.m2\repository\com\apple\AppleJavaExtensions\1.4\AppleJavaExtensions-1.4.jar;C:\Users\njt\.m2\repository\jaxen\jaxen\1.1.6\jaxen-1.1.6.jar;C:\Users\njt\.m2\repository\org\apache\ant\ant\1.9.4\ant-1.9.4.jar;C:\Users\njt\.m2\repository\org\apache\ant\ant-launcher\1.9.4\ant-launcher-1.9.4.jar;C:\Users\njt\.m2\repository\org\codehaus\groovy\groovy-all\2.4.3\groovy-all-2.4.3.jar;C:\Users\njt\.m2\repository\org\apache\maven\reporting\maven-reporting-impl\2.1\maven-reporting-impl-2.1.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-project\2.0.10\maven-project-2.0.10.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-settings\2.0.10\maven-settings-2.0.10.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-profile\2.0.10\maven-profile-2.0.10.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-plugin-registry\2.0.10\maven-plugin-registry-2.0.10.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-interpolation\1.1\plexus-interpolation-1.1.jar;C:\Users\njt\.m2\repository\commons-validator\commons-validator\1.2.0\commons-validator-1.2.0.jar;C:\Users\njt\.m2\repository\commons-beanutils\commons-beanutils\1.7.0\commons-beanutils-1.7.0.jar;C:\Users\njt\.m2\repository\commons-digester\commons-digester\1.6\commons-digester-1.6.jar;C:\Users\njt\.m2\repository\commons-logging\commons-logging\1.0.4\commons-logging-1.0.4.jar;C:\Users\njt\.m2\repository\oro\oro\2.0.8\oro-2.0.8.jar;C:\Users\njt\.m2\repository\org\apache\maven\reporting\maven-reporting-api\3.0\maven-reporting-api-3.0.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-plugin-api\2.0\maven-plugin-api-2.0.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-plugin-descriptor\2.2.1\maven-plugin-descriptor-2.2.1.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-artifact\2.2.1\maven-artifact-2.2.1.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-core\1.4\doxia-core-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-logging-api\1.4\doxia-logging-api-1.4.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-component-annotations\1.5.5\plexus-component-annotations-1.5.5.jar;C:\Users\njt\.m2\repository\xerces\xercesImpl\2.9.1\xercesImpl-2.9.1.jar;C:\Users\njt\.m2\repository\org\apache\httpcomponents\httpclient\4.0.2\httpclient-4.0.2.jar;C:\Users\njt\.m2\repository\commons-codec\commons-codec\1.3\commons-codec-1.3.jar;C:\Users\njt\.m2\repository\org\apache\httpcomponents\httpcore\4.0.1\httpcore-4.0.1.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-sink-api\1.4\doxia-sink-api-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-decoration-model\1.4\doxia-decoration-model-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-site-renderer\1.4\doxia-site-renderer-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-module-xhtml\1.4\doxia-module-xhtml-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\doxia\doxia-module-fml\1.4\doxia-module-fml-1.4.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-i18n\1.0-beta-7\plexus-i18n-1.0-beta-7.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-velocity\1.1.7\plexus-velocity-1.1.7.jar;C:\Users\njt\.m2\repository\org\apache\velocity\velocity\1.5\velocity-1.5.jar;C:\Users\njt\.m2\repository\org\apache\velocity\velocity-tools\2.0\velocity-tools-2.0.jar;C:\Users\njt\.m2\repository\commons-chain\commons-chain\1.1\commons-chain-1.1.jar;C:\Users\njt\.m2\repository\sslext\sslext\1.2-0\sslext-1.2-0.jar;C:\Users\njt\.m2\repository\org\apache\struts\struts-core\1.3.8\struts-core-1.3.8.jar;C:\Users\njt\.m2\repository\antlr\antlr\2.7.2\antlr-2.7.2.jar;C:\Users\njt\.m2\repository\org\apache\struts\struts-taglib\1.3.8\struts-taglib-1.3.8.jar;C:\Users\njt\.m2\repository\org\apache\struts\struts-tiles\1.3.8\struts-tiles-1.3.8.jar;C:\Users\njt\.m2\repository\commons-collections\commons-collections\3.2.1\commons-collections-3.2.1.jar;C:\Users\njt\.m2\repository\org\apache\maven\shared\maven-doxia-tools\1.2.1\maven-doxia-tools-1.2.1.jar;C:\Users\njt\.m2\repository\commons-io\commons-io\1.4\commons-io-1.4.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-artifact-manager\2.0.6\maven-artifact-manager-2.0.6.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-repository-metadata\2.0.6\maven-repository-metadata-2.0.6.jar;C:\Users\njt\.m2\repository\org\apache\maven\maven-model\2.0.6\maven-model-2.0.6.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-container-default\1.0-alpha-9\plexus-container-default-1.0-alpha-9.jar;C:\Users\njt\.m2\repository\classworlds\classworlds\1.1-alpha-2\classworlds-1.1-alpha-2.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-resources\1.0-alpha-7\plexus-resources-1.0-alpha-7.jar;C:\Users\njt\.m2\repository\org\codehaus\plexus\plexus-utils\1.5.6\plexus-utils-1.5.6.jar;C:\Users\njt\.m2\repository\org\sonatype\plexus\plexus-build-api\0.0.7\plexus-build-api-0.0.7.jar edu.umd.cs.findbugs.FindBugs2 -xml:withMessages -auxclasspathFromInput -projectName "Content Router Core" -effort:max -low -nested:false -onlyAnalyze com.groupgti.shared.router.- -output D:\Work\shared_content_router\content_router_core\target\findbugsTemp.xml D:\Work\shared_content_router\content_router_core\target\classes

I get this error: Exception analyzing com.groupgti.shared.router.dao.PostDaoImpl using detector edu.umd.cs.findbugs.detect.FindUnsatisfiedObligation org.apache.bcel.classfile.ClassFormatException: Expected class 'CONSTANT_Class' at index 2 and got CONSTANT_Fieldref[9](class_index = 242, name_and_type_index = 468) At org.apache.bcel.classfile.ConstantPool.getConstant(ConstantPool.java:261) At org.apache.bcel.classfile.ConstantPool.getConstantString(ConstantPool.java:293) At org.apache.bcel.generic.FieldOrMethod.getReferenceType(FieldOrMethod.java:116) At edu.umd.cs.findbugs.ba.obl.InstructionActionCache.getActions(InstructionActionCache.java:107) At edu.umd.cs.findbugs.ba.obl.ObligationAnalysis.transferInstruction(ObligationAnalysis.java:139) At edu.umd.cs.findbugs.ba.obl.ObligationAnalysis.transferInstruction(ObligationAnalysis.java:68) At edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis.transfer(AbstractDataflowAnalysis.java:135) At edu.umd.cs.findbugs.ba.obl.ObligationAnalysis.transfer(ObligationAnalysis.java:160) At edu.umd.cs.findbugs.ba.obl.ObligationAnalysis.transfer(ObligationAnalysis.java:68) At edu.umd.cs.findbugs.ba.Dataflow.execute(Dataflow.java:376) At edu.umd.cs.findbugs.classfile.engine.bcel.ObligationDataflowFactory.analyze(ObligationDataflowFactory.java:75) At edu.umd.cs.findbugs.classfile.engine.bcel.ObligationDataflowFactory.analyze(ObligationDataflowFactory.java:45) At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.analyzeMethod(AnalysisCache.java:369) At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getMethodAnalysis(AnalysisCache.java:322) At edu.umd.cs.findbugs.detect.FindUnsatisfiedObligation$MethodChecker.analyzeMethod(FindUnsatisfiedObligation.java:240) At edu.umd.cs.findbugs.detect.FindUnsatisfiedObligation.visitMethodCFG(FindUnsatisfiedObligation.java:158) At edu.umd.cs.findbugs.bcel.CFGDetector.visitClass(CFGDetector.java:93) At edu.umd.cs.findbugs.detect.FindUnsatisfiedObligation.visitClass(FindUnsatisfiedObligation.java:144) At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1089) At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:283) At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:402) At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1200) At edu.umd.cs.findbugs.LaunchAppropriateUI.launch(LaunchAppropriateUI.java:106)

I'm not sure where the custom bcel code is for findbugs anymore, but you may want to check your version of Constants.java for these changes... i think they are not included

Index: dev/bcel/src/main/java/org/apache/commons/bcel6/Constants.java

--- dev/bcel/src/main/java/org/apache/commons/bcel6/Constants.java (revision 1745834) +++ dev/bcel/src/main/java/org/apache/commons/bcel6/Constants.java (revision 1741710) @@ -1037,10 +1037,6 @@ /** Java VM opcode. * @see * Opcode definitions in The Java Virtual Machine Specification */

• public static final short INVOKEDYNAMIC = 186;
• /** Java VM opcode.
• * @see
• * Opcode definitions in The Java Virtual Machine Specification / public static final short NEW = 187; /* Java VM opcode.
• @see @@ -1391,7 +1387,7 @@ 0/dreturn/, 0/areturn/, 0/return/, 2/getstatic/, 2/putstatic/, 2/getfield/, 2/putfield/, 2/invokevirtual/, 2/invokespecial/, 2/invokestatic/,
• 4/invokeinterface/, 4/invokedynamic/, 2/new/,
• 4/invokeinterface/, UNDEFINED, 2/new/, 1/newarray/, 2/anewarray/, 0/arraylength/, 0/athrow/, 2/checkcast/, 2/instanceof/, 0/monitorenter/, @@ -1464,7 +1460,7 @@ {T_SHORT}/putstatic/, {T_SHORT}/getfield/, {T_SHORT}/putfield/, {T_SHORT}/invokevirtual/, {T_SHORT}/invokespecial/, {T_SHORT}/invokestatic/,
• {T_SHORT, T_BYTE, T_BYTE}/invokeinterface/, {T_SHORT, T_BYTE, T_BYTE}/invokedynamic/,
• {T_SHORT, T_BYTE, T_BYTE}/invokeinterface/, {}, {T_SHORT}/new/, {T_BYTE}/newarray/, {T_SHORT}/anewarray/, {}/arraylength/, {}/athrow/, {T_SHORT}/checkcast/, {T_SHORT}/instanceof/, @@ -1511,7 +1507,7 @@ "tableswitch", "lookupswitch", "ireturn", "lreturn", "freturn", "dreturn", "areturn", "return", "getstatic", "putstatic", "getfield", "putfield", "invokevirtual", "invokespecial", "invokestatic",
• "invokeinterface", "invokedynamic", "new", "newarray", "anewarray",
• "invokeinterface", ILLEGAL_OPCODE, "new", "newarray", "anewarray", "arraylength", "athrow", "checkcast", "instanceof", "monitorenter", "monitorexit", "wide", "multianewarray", "ifnull", "ifnonnull", "goto_w", "jsr_w", "breakpoint", ILLEGAL_OPCODE, ILLEGAL_OPCODE, @@ -1567,7 +1563,7 @@ UNPREDICTABLE/putstatic/, 1/getfield/, UNPREDICTABLE/putfield/, UNPREDICTABLE/invokevirtual/, UNPREDICTABLE/invokespecial/, UNPREDICTABLE/invokestatic/,
• UNPREDICTABLE/invokeinterface/, UNPREDICTABLE/invokedynamic/, 0/new/, 1/newarray/, 1/anewarray/,
• UNPREDICTABLE/invokeinterface/, UNDEFINED, 0/new/, 1/newarray/, 1/anewarray/, 1/arraylength/, 1/athrow/, 1/checkcast/, 1/instanceof/, 1/monitorenter/, 1/monitorexit/, 0/wide/, UNPREDICTABLE/multianewarray/, 1/ifnull/, 1/ifnonnull/, 0/goto_w/, 0/jsr_w/, 0/breakpoint/, UNDEFINED, UNDEFINED, @@ -1623,7 +1619,7 @@ 0/dreturn/, 0/areturn/, 0/return/, UNPREDICTABLE/getstatic/, 0/putstatic/, UNPREDICTABLE/getfield/, 0/putfield/, UNPREDICTABLE/invokevirtual/, UNPREDICTABLE/invokespecial/, UNPREDICTABLE/invokestatic/,
• UNPREDICTABLE/invokeinterface/, UNPREDICTABLE/invokedynamic/, 1/new/, 1/newarray/, 1/anewarray/,
• UNPREDICTABLE/invokeinterface/, UNDEFINED, 1/new/, 1/newarray/, 1/anewarray/, 1/arraylength/, 1/athrow/, 1/checkcast/, 1/instanceof/, 0/monitorenter/, 0/monitorexit/, 0/wide/, 1/multianewarray/, 0/ifnull/, 0/ifnonnull/, 0/goto_w/, 1/jsr_w/, 0/breakpoint/, UNDEFINED, UNDEFINED,

JEP 223 introduces a new version scheme for Java versions >= 9:

http://openjdk.java.net/jeps/223

This fixes https://sourceforge.net/p/findbugs/bugs/1432

I'm using Gradle plugin for FindBugs and I'm seeing:

java.io.IOException: Wrong magic bytes of cafebabe for zip file /tmp/.gradle/caches/modules-2/files-2.1/com.almworks.sqlite4java/libsqlite4java-osx/1.0.392/de9528513a20ceae197ce9e14690973d617233bb/libsqlite4java-osx-1.0.392.dylib of 1620880 bytes
      At edu.umd.cs.findbugs.classfile.impl.ZipFileCodeBase.<init>(ZipFileCodeBase.java:87)
      At edu.umd.cs.findbugs.classfile.impl.ZipCodeBaseFactory.makeZipCodeBase(ZipCodeBaseFactory.java:39)
      At edu.umd.cs.findbugs.classfile.impl.ClassFactory.createFilesystemCodeBase(ClassFactory.java:121)
      At edu.umd.cs.findbugs.classfile.impl.FilesystemCodeBaseLocator.openCodeBase(FilesystemCodeBaseLocator.java:77)
      At edu.umd.cs.findbugs.classfile.impl.ClassPathBuilder.processWorkList(ClassPathBuilder.java:607)
      At edu.umd.cs.findbugs.classfile.impl.ClassPathBuilder.build(ClassPathBuilder.java:226)
      At edu.umd.cs.findbugs.FindBugs2.buildClassPath(FindBugs2.java:677)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:218)
      At org.gradle.api.plugins.quality.internal.findbugs.FindBugsExecuter.runFindbugs(FindBugsExecuter.java:39)

The problem here is that because of libsqlite4java there are some binary files on the classpath. I tracked the problem down to https://github.com/findbugsproject/findbugs/blob/master/findbugs/src/java/edu/umd/cs/findbugs/classfile/impl/ClassFactory.java#L118-L124 but not sure what to do from here.

It's impossible to remove binaries from the classpath. I don't see a way to filter classpath and not sources for FindBugs. Ideally FindBugs should ignore non *.zip/*.jar files on the classpath. Or at least have a better error message. What do you think will be the right solution? For now I'm going to disable FindBugs for tests but this problem can occur again on production classes.

Bumps protobuf-java from 2.3.0 to 3.16.3.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Bumps spring-core from 3.1.2.RELEASE to 5.2.22.RELEASE.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Bumps gson from 2.2.4 to 2.8.9.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Bumps ant from 1.7.1 to 1.10.9.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Hello,

We ran findbugs with our tool and detected the object-level redundancy issues (object-level redundancies that happen across objects sharing the same calling context). Our tool reports an object, BasicBlock block, which is accessed at line 183 in method lookupOrCreateFact of class BasicAbstractDataflowAnalysis. The optimized code is in this pull request.

Bumps junit from 4.11 to 4.13.1.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.