Code Later Using Static Analysis

In 2 002, COVErITY commercialized3 a research static bug-finding tool.6,9 Not surprisingly, as academics, our view of commercial realities was not perfectly accurate. However, the problems we encountered were not the obvious ones. Discussions with tool researchers and system builders suggest we were not alone in our naïveté. Here, we document some of the more important examples of what we learned developing and commercializing an industrialstrength bug-finding tool. We built our tool to find generic errors (such as memory corruption and data races) and systemspecific or interface-specific violations (such as violations of function-ordering constraints). The tool, Doi:10.1145/1646353.1646374