arXiv ScienceSearch

arXiv · 2002.06191

Did JHotDraw Respect the Law of Good Style?: A deep dive into the nature of false positives of bad code smells

Abstract

Developers need to make a constant effort to improve the quality of their code if they want to stay productive. Tools that highlight code locations that could benefit from refactoring are thus highly desirable. The most common name for such locations is "bad code smell". A number of tools offer such quality feedback and there is a substantial body of related research. However, all these tools, including those based on Machine Learning, still produce false positives. Every single false positive shown to the developer places a cognitive burden on her and should thus be avoided. The literature discusses the choice of metric thresholds, the general subjectivity of such a judgment and the relation to conscious design choices, "design ideas". To examine false positives and the relation between bad smells and design ideas, we designed and conducted an exploratory case study. While previous research presented a broad overview, we have chosen a narrow setting to reach for even deeper insights: The framework JHotDraw had been designed so thoughtfully that most smell warnings are expected to be false positives. Nevertheless, the "Law of Good Style", better known as the "Law of Demeter", is a rather restrictive design rule so that we still expected to find some potential bad smells, i.e. violations of this "Law". This combination led to 1215 potential smells of which at most 42 are true positives. We found generic as well as specific design ideas that were traded for the smell. Our confidence in that decision ranged from high enough to very high. We were surprised to realize that the smell definition itself required the formulation of constructive design ideas. Finally we found some smells to be the result of the limitation of the language and one could introduce auxiliary constructive design ideas to compensate for them. The decision whether a potential smell occurrence is actually a true positive was made very meticulously. For that purpose we took three qualities that the smell could affect negatively into account and we discussed the result of the recommended refactorings. If we were convinced that we had found a false positive, we described the relationships with design ideas. The realization that not only general design ideas but also specific design ideas have an influence on whether a potential smell is a true positive turns the problem of false positives from a scientific problem ("What is the true definition of the smell?") to a engineering problem ("How can we incorporate design ideas into smell definitions?"). We recommend to add adaptation points to the smell definitions. Higher layers may then adapt the smell for specific contexts. After adaptation the tool may continuously provide distinct and precise quality feedback, reducing the cognitive load for the developer and preventing habituation. Furthermore, the schema for the discussion of potential smells may be used to elaborate more sets of true and false smell occurrences. Finally, it follows that smell detection based on machine learning should also take signs of design ideas into account.

Explore related subjects

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Daniel Speicher. 2020-06-04. Did JHotDraw Respect the Law of Good Style?: A deep dive into the nature of false positives of bad code smells. https://doi.org/10.22152/programming-journal.org%2F2020%2F4%2F14

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

Search-based Trace Diagnostic for Cyber-Physical Systems

Cyber-physical systems (CPS) development requires verifying whether system behaviors violate their requirements. This analysis often considers system behaviors expressed by execution traces and requirements expressed by signal-based temporal properties. When an execution trace violates a requirement, engineers must solve the trace diagnostic problem---they need to understand the cause of the breach. Automated trace diagnostic techniques aim to support engineers in the trace diagnostic activity. This paper proposes search-based trace diagnostic (SBTD), a novel trace diagnostic technique for CPS requirements. Unlike existing techniques, SBTD relies on evolutionary search. SBTD starts from a set of candidate diagnoses, applies an evolutionary algorithm to generate new candidate diagnoses (via mutation, recombination, and selection), and uses a fitness function to determine the qualities of these solutions. Then, a diagnostic generator step is performed to explain the cause of the trace violation. We implemented Diagnosis, an SBTD tool for signal-based temporal logic requirements expressed using the Hybrid Logic of Signals (HLS). We evaluated Diagnosis by performing 34 experiments for 17 trace-requirement combinations for property violations. We assessed the effectiveness of SBTD in producing informative diagnoses and its efficiency. Diagnosis achieved expert-aligned diagnoses for 29/34 experiments and scaled to the full HLS benchmark, whereas state-of-the-art literature remained restricted to a subset due to performance and language limitations. SBTD treats trace-checking as a black box, which makes the checker replaceable. Substituting our HLS checker for an STL monitor, e.g., RTAMT, reproduces on two requirements the diagnoses at two to three orders of magnitude lower per-check cost.

cs.SE

Toward Secure Code Generation: Bridging Correctness and Security via Task-Adaptive Vulnerability Modeling and Execution-Based Benchmarking

Large language models (LLMs) are increasingly used for program synthesis, yet they often generate code that is functionally plausible but insecure. Progress in secure code generation has been hindered by benchmarks that are small, non-executable, leak mitigation details, or rely on noisy analyzers and subjective judgments, making it difficult to measure whether security improves without sacrificing correctness. We address these gaps with CodeSecEval, an execution-based benchmark for secure code generation, comprising 255 Python tasks spanning 77 CWE categories. Each task provides paired insecure and secure implementations together with executable functional and vulnerability-targeted security tests, enabling precise and reproducible evaluation of secure code generation and insecure-code repair. Building on CodeSecEval, we propose SecAwareCoder, an agent-based framework that shifts code generation toward secure-by-construction synthesis. SecAwareCoder performs task-adaptive threat modeling to identify security-sensitive regions and derive task-grounded vulnerability hypotheses, uses these hypotheses to guide both constraint-aware code generation and security-aware test synthesis, and leverages execution feedback for targeted refinement. Experiments across multiple LLM backbones show that SecAwareCoder consistently improves Pass@1 and security robustness over prompting and analyzer-driven baselines, narrowing the security--correctness gap in LLM code generation.

cs.SE

Enabling Communication via APIs for Mainframe Applications

Mainframe systems continue to support critical applications across industries such as banking, retail, and healthcare. Exposing their functionality through Application Programming Interfaces (APIs) enables reuse and development of new applications, but identifying and implementing APIs for legacy code remains challenging. It requires understanding complex programs, separating dependent components, introducing new artifacts, and preserving functionality and Service Level Agreements (SLAs) such as Turnaround Time (TAT). We propose a framework for APIfication of legacy mainframe applications. Candidate APIs are identified from artifacts such as transactions, screens, control-flow blocks, inter-microservice calls, business rules, and data accesses. Static analyses, including liveness and reaching definitions, are then used to traverse the code and automatically compute API signatures consisting of request and response fields. We evaluated the framework through a qualitative survey of nine mainframe developers with an average of 15 years of experience, using the public GENAPP application and two industrial mainframe applications. The results show that the framework identifies additional candidate APIs and reduces implementation effort for APIfication. The API-signature computation has been incorporated into IBM watsonx Code Assistant for Z Refactoring Assistant. We further validated the identified APIs by executing them on an IBM Z mainframe system, demonstrating the practical viability of the approach.

cs.SE