System and method for static analysis using fault paths

Abstract

A system and method for analyzing a program includes determining possible bug paths in a program based on statistical analysis of test cases. A static analysis is then performed only on the possible bug paths. The bugs are then located in the program.

Description

BACKGROUND [0001] 1. Technical Field [0002] The present invention relates to evaluation of program, and more particularly to systems and methods which determine program soundness. [0003] 2. Description of the Related Art [0004] The soundness of analyses and algorithms has been a cornerstone in programming languages. A static analysis is said to be sound when the data flow information that it produces is guaranteed to be true on all program execution. Foundational theories like Meet-Over-All-Paths (MOAP) and Abstract Interpretation are the basis for sound static analysis. [0005] Unfortunately, scalability becomes an issue when implementing precise and sound static analysis. Soundness of static analysis is extremely important for many applications, including code generation and code transformation. On the other hand, there are applications of static analysis where soundness is not very critical, such as for tracking bugs and defects. One can potentially construct a very simple and fas...

AI Technical Summary

Benefits of technology

[0015] Another method for analyzing a program includes determining a degree of unsoundness that can be tolerated for data flow information in a program and performing a static analysis on less than all possible paths based upon the degree of unsoundness. The data flow information is computed only on those paths that trigger a possible bug or defect, based on statistics, to find the bugs and defects in the program.

[0016] In alternate embodiments, the degree of unsoundness may be checked by measuring a distance between reference data and data of the program being considered. The distance may include a hamming distance. The step of performing a static analysis on less than all possible paths may include performing a meet over possible bug paths (mobp) analysis. The step of performing a meet over possible bug paths (mobp) analysis may include determining possible bug paths based on statistics of type and location of bugs in test case programs. The test case programs may include unit tests and / or regression tests. The method may further comprise determining fault locations in the program using a fault localization algorithm.

Problems solved by technology

Unfortunately, scalability becomes an issue when implementing precise and sound static analysis.

Unfortunately, unsound static analysis can produce misleading data flow information, and in the context of bug finding tools, can potentially generate many false negatives and false positives.

A negative consequence of loosing soundness in such applications is increased reporting of false negatives.

In software diagnosis, as in medical diagnosis, there are two kinds of error that can occur.

One major stumbling block in (sound) static analysis is the tradeoff between scalability and precision of the analysis.

In one such method, random interpretation is used for solving certain data flow problems and the resulting solution is not necessarily sound with respect deterministic MOAP.

Unsound static analysis techniques have also been employed for finding a class of error-handling mistakes that arise from an improper release of resources.

Images