Question

I have experimented with several different static analyzers for Java, notably Findbugs and PMD.

I am looking for examples of other static analyzers that may be worth running on Java code.

Answer 1

Next to FindBugs and PMD, there are also Bandera, ESC/Java and JLint. You can find a comparision of them here (PDF). Here’s an extract of relevance:

Bug Category - Example                            | ESC | FindBugs | JLint | PMD
--------------------------------------------------+-----+----------+-------+-----
General - Null dereference                        |  V  |    V     |   V   |  V
Concurrency - Possible deadlock                   |  V  |    V     |   V   |  V
Exceptions - Possible unexpexted exception        |  V  |          |       |
Array - Length may be less than zero              |  V  |          |   V   |   
Mathematics - Division by zero                    |  V  |          |   V   |  
Conditional, loop - Unreachable code              |     |    V     |       |  V 
String - Checking equality using == or !=         |     |    V     |   V   |  V
Object overriding - Equal objects/equal hashcodes |     |    V     |   V   |  V
I/O stream - Stream not closed on all paths       |     |    V     |       |  
Unused or duplicate statement - Unused local      |     |    V     |       |  V
Design - Should be a static inner class           |     |    V     |       |  
Unnecessary statement - Unnecessary return        |     |          |       |  V

_{Note: The article is from 2004. The tools may have been improved in the meanwhile.}

As you see, FindBugs and PMD finds pretty much and are also the most popular static analyser tools. However, some points are also covered by a smart IDE nowadays, like null deference, unused locals and unreachable code. Eclipse for example can warn on them.