Slow JS analysis for large project

SonarQube Server / Community Build
,
1

Hello Christophe,

I’m having the same problem as Chanon : large JS codebase which either fails during taint analysis, or succeeds after a very long time (4.5 hours) :

00:48:13.876 INFO 4019 / 9348 UCFGs simulated, memory usage: 3663 MB
00:48:13.877 INFO Taint analysis for js: Time spent was 04:27:40.579

And when verbose mode is activated, I get an endless loop of
“DEBUG Large history size (201) while concatenating flows. Truncating.”.

Any insight gained in the ticket you’ve created in august ?

Thank you!

2

Hello Alexandre,

I’ve moved your post from where you originally posted it (here for reference), as having the same symptoms does not necessarily means it has the same root cause.

To be sure we can understand the problem, could you please share the 2 following information with us:

  • Which SonarQube edition / version are you using?
  • Is your project using Angular JS?

And to answer your original question:

Any insight gained in the ticket you’ve created in august ?

Regarding the problem mentioned in the other post, yes, we have some team members working on it at the moment, and we’re hoping to have a fix ready soon.
Note that if your project extensively uses Angular JS, the fix we are implementing is likely to improve the performance issues you are facing.

Best,
-Christophe

3

Hello Christophe!

Sonar Version :

INFO  SonarScanner CLI 6.2.1.4610
INFO  Java 17.0.12 Amazon.com Inc. (64-bit)
INFO  Communicating with SonarQube Server 10.6.0.92116
DEBUG Enterprise 10.6.0.92116

No Angular, just JS on Node with Express.

Thanks a lot!

Alex.

4

Thanks for the additional information.
Then, it seems it’s an unrelated performance issue to the one we were previously investigating. And version 10.6.0 of SonarQube Server is recent and should benefit from some of the performance improvements we did over the last months.

Do you know how much memory is available for the analysis?
And whether the max memory used during analysis is close to the amount of available memory? (In some rare cases, when when the amount of memory is barely enough, the Java Garbage Collector needs to constantly free memory along the analysis, which can significantly increase the time). In such cases, increasing the available memory usually fixes the issue.

Otherwise, would you be willing to share privately with us the content of the .scannerwork/ucfg2/js folder? It contains an intermediate representation of the JS files, on which the security analysis is run, which would allows us to reproduce the issue on our side.

Best,
-Christophe

5

Hello Christophe,

A colleague of ours opened two support tickets, if you want to have more detailed info :
SUPPORT-51086 and SUPPORT-51340.

Thank you!
Alexandre.