Code Review Checklist

Following is a check list I refer to often which catches many issues often:

1. No errors should occur when building the source code. No warnings should be introduced by changes made to the code. Also, any warnings during the build should be within acceptable boundaries with good reasoning.

2. Each source file should start with an appropriate header and copyright information. All source files should have a comment block describing the functionality provided by the file.

3. Describe each routine, method, and class in one or two sentences at the top of its definition. If you can't describe it in a short sentence or two, you may need to reassess its purpose. It might be a sign that the design needs to be improved and routines may need to be split into smaller more reusable units. Make it clear which parameters are used for input and output.

4. Comments are required for aspects of variables that the name doesn't describe. Each global variable should indicate its purpose and why it needs to be global.

5. Comment the units of numeric data. For example, if a number represents length, indicate if it is in feet or meters.

6. Complex areas, algorithms, and code optimizations should be sufficiently commented, so other developers can understand the code and walk through it.

7. Dead Code: There should be an explanation for any code that is commented out. "Dead Code" should be removed. If it is a temporary hack, it should be identified as such.

8. Pending/TODO: A comment is required for all code not completely implemented. The comment should describe what's left to do or is missing. You should also use a distinctive marker that you can search for later (For example: "TODO:").

9. Are assertions used everywhere data is expected to have a valid value or range? Assertions make it easier to identify potential problems. For example, test if pointers or references are valid.

10. An error should be detected and handled if it affects the execution of the rest of a routine. For example, if a resource allocation fails, this affects the rest of the routine if it uses that resource. This should be detected and proper action taken. In some cases, the "proper action" may simply be to log the error and send an appropriate message to the user.

11. Make sure all resources and memory allocated are released in the error paths. Use try-catch-finally in C++/C# code. Is allocated memory (non-garbage collected) freed? All allocated memory needs to be freed when no longer needed. Make sure memory is released in all code paths, especially in error code paths. Unmanaged objects such as File/Sockets/Graphics/Database objects in C#/Java need to be destructed at the earliest time. File, Sockets, Database connections, etc. (basically all objects where a creation and a deletion method exist) should be freed even when an error occurs. For example, whenever you use "new" in C++, there should be a delete somewhere that disposes of the object. Resources that are opened must be closed. For example, when opening a file in most development environments, you need to call a method to close the file when you're done.

12. If the source code uses a routine that throws an exception, there should be a function in the call stack that catches it and handles it properly. There should not be any abnormal terminations for expected flows and also the user should be informed of any un-recoverable situations.

13. Does the code respect the project coding conventions? Check that the coding conventions have been followed. Variable naming, indentation, and bracket style should be used. Use FXCop and follow C++/C# coding conventions/guidelines within acceptable limits.

14. Consider notifying your caller when an error is detected. If the error might affect your caller, the caller should be notified. For example, the "Open" methods of a file class should return error conditions. Even if the class stays in a valid state and other calls to the class will be handled properly, the caller might be interested in doing some error handling of its own.

15. Don't forget that error handling code that can be defective. It is important to write test cases for error handling cases that exercise it.

16. Make sure there's no code path where the same object is released more than once? Check error code paths.

17. COM Reference Counting: Frequently a reference counter is used to keep the reference count on objects (For example, COM objects). The object uses the reference counter to determine when to destroy itself. In most cases, the developer uses methods to increment or decrement the reference count. Make sure the reference count reflects the number of times an object is referred. Similarly tracing is important in code to validate the flow.

18. Thread Safety: Are all global variables thread-safe? If global variables can be accessed by more than one thread, code altering the global variable should be enclosed using a synchronization mechanism such as a mutex. Code accessing the variable should be enclosed with the same mechanism.

19. If some objects can be accessed by more than one thread, make sure member variables are protected by synchronization mechanisms.

20. It is important to release the locks in the same order they were acquired to avoid deadlock situations. Check error code paths.

21. Database Transactions: Always Commit/Rollback a transaction at the earliest possible time. Keep transactions short.

22. Make sure there's no possibility for acquiring a set of locks (mutex, semaphores, etc.) in different orders. For example, if Thread A acquires Lock #1 and then Lock #2, then Thread B shouldn't acquire Lock #2 and then Lock #1.

23. Are loop ending conditions accurate? Check all loops to make sure they iterate the right number of times. Check the condition that ends the loop; insure it will end out doing the expected number of iterations.

24. Check for code paths that can cause infinite loops? Make sure end loop conditions will be met unless otherwise documented.

25. Do recursive functions run within a reasonable amount of stack space? Recursive functions should run with a reasonable amount of stack space. Generally, it is better to code iterative functions with proper/predictable end conditions.

26. Are whole objects duplicated when only references are needed? This happens when objects are passed by value when only references are required. This also applies to algorithms that copy a lot of memory. Consider using algorithm that minimizes the number of object duplications, reducing the data that needs to be transferred in memory. Avoid entire copying objects onto the stack instead use reference objects (most of the time default in C# for large user defined objects)

27. Does the code have an impact on size, speed, or memory use? Can it be optimized? For instance, if you use data structures with a large number of occurrences, you might want to reduce the size of the structure.

28. Blocking calls: Consider using a different thread for code making a function call that blocks or use a monitor thread with a well-defined timeout

29. Is the code doing busy waits instead of using synchronization mechanisms or timer events? Doing busy waits takes up CPU time. It is a better practice to use synchronization mechanisms since they force the thread to sleep without using valuable cpu time.

30. Optimizations may often make code harder to read and more likely to contain bugs. Such optimizations should be avoided unless a need has been identified. Has the code been profiled? Check if any over optimization has led to functionality disappearing.

31. Are function parameters explicitly verified in the code? This check is encouraged for functions where you don't control the whole range of values that are sent to the function. This isn't the case for helper functions, for instance. Each function should check its parameter for minimum and maximum possible values. Each pointer or reference should be checked to see if it is null. An error or an exception should occur if a parameter is invalid.

32. Make sure an error message is displayed if an index is out-of-bound. This can happen in C# too for dynamically created lists, etc.

33. Make sure the user sees simple error messages, not technical jargon.

34. Don't return references to objects declared on the stack, return references to objects created on the heap. In C# whenever new is called a new heap object is created, but if an object is passed by copy then the stack object would disappear on return resulting in invalid data.

35. Make sure there are no code paths where variables are used prior to being initialized? If an object is used by more than one thread, make sure the object is not in use by another thread when you destroy it. If an object is created by doing a function call, make sure the object was created before using it. The VS.NET C# compiler ensures this so don’t ignore this warning.

36. Does the code re-write functionality that could be achieved by using an existing API/code? Don't reinvent the wheel. New code should use existing functionality as much as possible. Don't rewrite source code that already exists in the project. Code that is replicated in more than one function should be put in a helper function for easier maintenance. The existing code/library routines may be already optimized for this operation.

37. Bug Fix Side Effects: Does a fix made to a function change the behavior of caller functions? Sometimes code expects a function to behave incorrectly. Fixing the function can, in some cases, break the caller. If this happens, either fix the code that depends on the function, or add a comment explaining why the code can't be changed.

38. Does the bug fix correct all the occurrences of the bug? If the code you're reviewing is fixing a bug, make sure it fixes all the occurrences of the bug.

39. Is the code doing signed/unsigned conversions? Check all signed to unsigned conversions: Can sign completion cause problems? Check all unsigned to signed conversions: Can overflow occur? Test with Minimum and Maximum possible values. Sometimes a downcast from ‘long’ to ‘int’ could mean loss of data, use the larger data type preferably.

40. Ensure the developer has unit tested the code before sending it for review. All the limit and main functionality cases should have been tested.

41. As a reviewer, you should understand the code. If you don't, the review may not be complete, or the code may not be well commented.

42. Lastly, when executed, the code should do what it is supposed to.

Thanks to the authors at http://www.macadamian.com/index.php?option=com_content&task=view&id=27&Itemid=31