<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>On 12/10/2018 09:26, Óvári wrote:<br>
</p>
<blockquote type="cite"
cite="mid:1611f648-b76c-affb-884d-cad2742cd959@zoho.com">"Since
Coverity is C/C++ only, this obviously wouldn't be necessary" [1];
however, "Projects on Coverity Scan" [2] languages: Java, C/C++,
C#, JavaScript, PHP/Python/Ruby.
<br>
<br>
Isn't JavaScript [3] used in Thunderbird add-ons?
<br>
</blockquote>
Yes it is, but it wasn't clear from the site that it covers
Javascript.<br>
<blockquote type="cite"
cite="mid:1611f648-b76c-affb-884d-cad2742cd959@zoho.com">Does this
mean that "Coverity Scan" could help with Thunderbird add-ons?
<br>
</blockquote>
<p>That's very unclear. There's no detailed list that I can see of
what Javascript specific defects are caught. There is a list of
general defects but they are mainly things I'd associate with c++
or similar compiled languages.</p>
<p>Without more information on the specifics, I'd suggest that
promoting <a moz-do-not-send="true" href="https://eslint.org/">ESLint</a>
to add-on authors is more likely to be useful - there's <a
moz-do-not-send="true" href="https://eslint.org/docs/rules/">lots
of rules</a> highlighting various issues that can be selectively
enabled. For legacy/hybrid add-ons, there's <a
moz-do-not-send="true"
href="https://www.npmjs.com/package/eslint-plugin-mozilla">eslint-plugin-mozilla</a>
which has the mozilla-central configuration, and useful rules
specific to gecko.</p>
<p>There's various editor integrations and easy ways (e.g. Travis
CI) to incorporate into PRs etc.<br>
</p>
<p>Mark<br>
</p>
</body>
</html>