Static Kotlin Bug Hunting
summary
Sonar replaces the old generalized-tree pipeline with a Kotlin-native analyzer (extracted to a separate repo) and ships SonarKotlin 2.0, using the Kotlin compiler semantic model to reduce false positives and add advanced checks. Initial release spikes analysis time and triggers OOMs (commented‑out‑code rule compiled every comment), so a probabilistic filter and lazy invoke-checks are added. Edge cases include IntelliJ-style nullable AST nodes, KTNamedFunction surprises, delegates, overloaded operators, unresolved classpath imports and a Java version mismatch. Result: improved precision, about 133 rules and ~18–19 releases, with ongoing performance tuning.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:32Agenda
- 2:13History
- 11:04Why Kotlin?
- 12:29sonar-kotlin 2.0
- 23:12Feedback
- 40:04Achievements
- 41:27Takeaways
- 42:37Outro
related talks
38mStatic Kotlin bug hunting
47mHow we completely rewrote our static code analyzer for Kotlin
46mKotlin, Java 4..18, Code Coverage and their best friend — bytecode: ...
56mJava 4..21, Kotlin, Code Coverage, bytecode: scandals, intrigues, investigations
49mAn Introduction to Kotlin
49mBeyond the basics of SonarQube: improve your Java(Script) code even further
39mDekompiling
54mKotlin DSLs as a Single Source of Truth for Multiple Tasks