Static Kotlin bug hunting
summary
Sonar replaces the old intermediate tree (Slang) with a native Kotlin engine called Sonar Kotlin 2.0, removing the Slang tech debt and reimplementing ~40 rules plus 180 total rules across 13 releases. Analysis uses IntelliJ PSI (with PSI nullability hell tradeoffs), hits surprising OOM and performance regressions on real projects, temporarily disabled a slow "commented-out code" check, then added a probabilistic heuristic; many false positives for imports and delegates are fixed but unresolved-classpath and Java 16+ resolution remain tricky.
AI-written summary · about
chapters (13)
- 0:00Introduction and motivation
- 3:14History of static analysis
- 8:32Why Kotlin 2.0 was needed
- 11:24Program Structure Interface challenges
- 16:03Nullability and documentation issues
- 17:47Compiler diagnostics reuse
- 19:54SonarKotlin 2.0 release and feedback
- 21:00Performance degradation fixes
- 24:31Commented code rule challenges
- 25:35Unused import rule deep dive
- 33:53Limitations and future work
- 34:14Achievements and takeaways
- 35:58Q&A and closing
related talks
43mStatic Kotlin Bug Hunting
47mHow we completely rewrote our static code analyzer for Kotlin
56mJava 4..21, Kotlin, Code Coverage, bytecode: scandals, intrigues, investigations
46mKotlin, Java 4..18, Code Coverage and their best friend — bytecode: ...
54mKotlin DSLs as a Single Source of Truth for Multiple Tasks
27mKotlin Backstage
49mAn Introduction to Kotlin
39mDekompiling