A type-sensitive pointer analysis method and device for generic programming

Abstract

The application relates to a type-sensitive pointer analysis method and device for generic programming, and particularly relates to the technical field of software testing. The method comprises the following steps: obtaining target program code to be analyzed; mapping a type variable in a generic programming statement in the target program code to an actual type of the type variable, and putting the mapping between the type variable and the actual type into a context of the generic programming statement; and performing context-sensitive pointer analysis on the target program code based on the context of the generic programming statement, so as to obtain a pointing relationship between various pointers in the target program code. The mapping relationship between a specific type of generic instantiation and a type variable is put into a context for context-sensitive pointer analysis, so that the pointing relationship between various pointers is obtained, and the accuracy of the context-sensitive pointer analysis for the generic programming is improved.

Description

Technical Field

[0001] This application relates to the field of software testing technology, specifically to a method and apparatus for type-sensitive pointer analysis in generic programming. Background Technology

[0002] Program static analysis is a code analysis technique that scans program code without running the code, using techniques such as lexical analysis, syntax analysis, control flow analysis, and data flow analysis, to verify whether the code meets the criteria for standardization, security, reliability, and maintainability.

[0003] Pointer analysis, a type of static analysis, answers the question of which memory a pointer in a program points to. On one hand, taking Java as an example, pointer analysis in Java refers to determining which object a pointer points to in the program. Typically, pointer analysis is a probability analysis, and the result is usually which objects a pointer could possibly point to. On the other hand, generic programming is widely adopted in modern programming. Using generics, class and method definitions can be made using type variables as parameters, and then these classes or methods can be instantiated by assigning them specific actual types.

[0004] However, there is no pointer analysis method for generic programming in the existing technology, which makes the conventional pointer analysis method less effective in analyzing code obtained from generic programming. Summary of the Invention

[0005] This application provides a method and apparatus for analyzing type-sensitive pointers in generic programming, which improves the accuracy of context-sensitive pointer analysis in generic programming. The technical solution is as follows.

[0006] On the one hand, a type-sensitive pointer analysis method for generic programming is provided, the method comprising:

[0007] Obtain the target program code to be analyzed;

[0008] Map the type variables in the generic programming statements in the target program code to the actual types of the type variables, and place the mapping between the type variables and the actual types into the context of the generic programming statements;

[0009] Based on the context of the generic programming statement, context-sensitive pointer analysis is performed on the target program code to obtain the pointing relationships between various pointers in the target program code.

[0010] On another front, a type-sensitive pointer analysis apparatus for generic programming is provided, the apparatus comprising:

[0011] The program code acquisition module is used to acquire the target program code to be analyzed.

[0012] The type mapping module is used to map type variables in generic programming statements in the target program code to the actual types of the type variables, and to place the mapping between the type variables and the actual types into the context of the generic programming statements;

[0013] The pointer analysis module is used to perform context-sensitive pointer analysis on the target program code based on the context of the generic programming statement, so as to obtain the pointing relationship between the pointers in the target program code.

[0014] In one possible implementation, the type mapping module is used to map the type variable in the generic programming statement in the target program code to the actual type of the type variable according to the type of the generic programming statement.

[0015] In one possible implementation, the type mapping module includes:

[0016] The first type mapping unit is used to process the type variable in the generic programming statement in the target program code according to the type update function when the generic programming statement type is NEW statement, so as to map the type variable to the actual type.

[0017] The type update function is used to map the type variable according to the instantiation type in the NEW statement in order to determine the actual type of the type variable.

[0018] In one possible implementation, the type mapping unit is further configured to, when it is detected that an object is instantiated with a type variable in a NEW statement, find the initialization point of the mapping of the type variable, and determine the type parameter at the initialization point as the actual type.

[0019] In one possible implementation, the type mapping module further includes:

[0020] The second type mapping unit is used to process the type variable in the generic programming statement in the target program code according to the type append function when the generic programming statement type is a CALL statement, so as to map the type variable to the actual type;

[0021] The type append function is used to map the type variable according to the call type in the CALL statement, so as to determine the actual type of the type variable.

[0022] In one possible implementation, the second type mapping module is further configured to, when the call type in the CALL statement is a generic call of a specific type, determine the mapping relationship between the type variable and the actual type parameter in the CALL statement as the mapping relationship between the type variable and the actual type.

[0023] In one possible implementation, the second type mapping unit is further configured to, when the call type in the CALL statement is a generic call of a type variable, determine the mapping relationship between the type variable and the specific type of the actual instantiated site as the mapping relationship between the type variable and the actual type;

[0024] The actual instantiation type includes the type of the receiving object of the target method in the CALL statement, and the type of the method caller of the target method.

[0025] In another aspect, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, the at least one instruction being loaded and executed by the processor to implement the above-described type-sensitive pointer analysis method for generic programming.

[0026] In another aspect, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the at least one instruction being loaded and executed by a processor to implement the above-described type-sensitive pointer analysis method for generic programming.

[0027] Furthermore, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned type-sensitive pointer analysis method for generic programming.

[0028] The technical solution provided in this application may include the following beneficial effects:

[0029] When performing pointer analysis on target program code obtained from generic programming, we can first obtain the type variables in the generic programming statements to determine the corresponding instantiation types. Then, we place the mapping relationship between type variables and instantiation types into the context corresponding to the generic programming statements and perform context-sensitive pointer analysis to obtain the pointing relationships between various pointers in the target program code. This approach, in the target program code obtained from generic programming, first analyzes the type variables in the generic programming statements to obtain the generic instantiation types, and then uses concrete types for instantiation. The generic type is a key context element; therefore, placing the mapping relationship between the concrete types of generic instantiation and type variables into the context for context-sensitive pointer analysis improves the accuracy of context-sensitive pointer analysis for generic programming. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram illustrating the structure of a software analysis system according to an exemplary embodiment.

[0032] Figure 2 A schematic diagram of a software program code is shown.

[0033] Figure 3 A schematic diagram of generic programming code is shown.

[0034] Figure 4 This is a flowchart illustrating a type-sensitive pointer analysis method for generic programming according to an exemplary embodiment.

[0035] Figure 5 This is a flowchart illustrating a type-sensitive pointer analysis method for generic programming according to an exemplary embodiment.

[0036] Figure 6 This diagram illustrates the instantiation of explicit and missing types.

[0037] Figure 7 A diagram illustrating five types of tag statements is shown.

[0038] Figure 8 This is a structural block diagram illustrating a type-sensitive pointer analysis device for generic programming according to an exemplary embodiment.

[0039] Figure 9 A structural block diagram of a computer device illustrated in an exemplary embodiment of this application is shown. Detailed Implementation

[0040] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] It should be understood that the term "instruction" mentioned in the embodiments of this application can be a direct instruction, an indirect instruction, or an indication of a relationship. For example, A instructing B can mean that A directly instructs B, such as B being able to obtain information through A; it can also mean that A indirectly instructs B, such as A instructing C, so B can obtain information through C; or it can mean that there is a relationship between A and B.

[0042] In the description of the embodiments of this application, the term "correspondence" may indicate that there is a direct or indirect correspondence between two things, or that there is an association between two things, or that there is a relationship of instruction and being instructed, configuration and being configured, etc.

[0043] In the embodiments of this application, "predefined" can be achieved by pre-storing corresponding codes, tables or other means that can be used to indicate relevant information in the device (e.g., including terminal devices and network devices). This application does not limit the specific implementation method.

[0044] To facilitate understanding of this application, several concepts involved in this application will be introduced before describing the various embodiments shown in this application.

[0045] 1) Program Static Analysis

[0046] Static code analysis refers to a code analysis technique that scans program code without running the code, using techniques such as lexical analysis, syntax analysis, control flow analysis, and data flow analysis to verify whether the code meets indicators such as compliance, security, reliability, and maintainability. Static analysis techniques are evolving towards simulated execution to uncover more defects that traditionally could only be found through dynamic testing, such as symbolic execution, abstract interpretation, and value dependency analysis. Furthermore, mathematical constraint solving tools are used for path reduction or reachability analysis to reduce false positives and increase efficiency.

[0047] 2) Pointer Analysis

[0048] Pointer analysis is a challenging aspect of static analysis. For any given pointer / reference, can we know at compile time which memory location it points to (not a specific location like 0xFFFF, but rather which local / object on the stack / heap it points to)? The pointer problem is undeterministic; that is, we cannot accurately analyze where any pointer will point. However, this doesn't prevent us from finding approximate solutions, thus enabling optimization in certain situations. Therefore, pointer analysis statically calculates the possible runtime values ​​(abstract memory addresses) that pointer variables in a program might point to.

[0049] Context-sensitive pointer analysis determines the value of a pointer variable in different calling contexts, effectively reducing false alarms introduced by infeasible inter-procedural control flow paths and significantly improving accuracy. Generally, a context is represented by a sequence of k context elements, where each element can be a call site (k-call-site-sensitive), an object initialization point (k-object-sensitive), or an object type (k-type-sensitive). For object-oriented programs, object-sensitive pointers are considered superior to call site-sensitive pointers in terms of accuracy and efficiency in practice, and type-sensitive pointers are considered a more efficient but less accurate alternative to object-sensitive pointers.

[0050] 3) Generic Programming

[0051] Generic programming refers to operations that can be performed on multiple data types. Unlike object-oriented programming, it does not require an additional layer of indirection to call functions. Instead, it uses fully generalized and reusable algorithms with the same efficiency as algorithms designed for a specific data type. Generic programming has been widely adopted and applied in modern programming languages, including C++, Java, and C#.

[0052] Figure 1 This is a schematic diagram illustrating the structure of a software analysis system according to an exemplary embodiment. For example... Figure 1 As shown, the software analysis system includes a computer device 110 and a server 120, which can communicate with each other via wired or wireless networks.

[0053] Optionally, the computer device 110 can be a terminal device, that is, the developer can input the corresponding software program code into the computer device 110, and the computer device 110 can send the software program code to the server 120 so that the server 120 can perform context-sensitive pointer analysis on the software program code.

[0054] Optionally, the above software program code is generic programming software program code.

[0055] Alternatively, the computer device 110 may pre-store various software programs for generic programming. When the developer needs to perform pointer analysis on any of the software programs, the computer device can send the software program to the server 120 so that the server 120 can perform context-sensitive pointer analysis on any of the software programs based on generic programming.

[0056] Optionally, the aforementioned server can be a server cluster or a distributed system consisting of multiple physical servers, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0057] Optionally, the system may also include a management device for managing the system (such as managing the connection status between each module and the server), and the management device is connected to the server via a communication network. Optionally, the communication network may be a wired network or a wireless network.

[0058] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any other network, including but not limited to any combination of local area networks (LANs), metropolitan area networks (MANs), wide area networks (WANs), mobile, wired or wireless networks, private networks, or virtual private networks (VPNs). In some embodiments, technologies and / or formats including Hypertext Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), VPNs, and Internet Protocol (IP) security can be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0059] Pointer analysis calculates the set of pointers that a program variable points to, that is, the set of abstract addresses that a variable v can point to (denoted as pts(v)). Typically, abstract addresses represent initialization points (instructions that initialize objects, e.g., `new` in Java), representing all dynamic object instances initialized by instructions at runtime. In context-sensitive analysis, both variable v and abstract address o are context-bound, effectively distinguishing their different dynamic instances. Therefore, unlike context-insensitive analysis which calculates whether o ∈ pts(v), context-sensitive analysis calculates the relation (co, o) ∈ pts(cv, v), where co and cv are the contexts of abstract address o and variable v, respectively.

[0060] Call-site sensitivity, object sensitivity, and type sensitivity are the three main variants of context sensitivity, where the call site, the initialization point of the receiving object, and the type of the receiving object are regarded as context elements respectively. To ensure termination, k-limiting is applied to limit the number of context elements to k. In practice, for scalability, k is usually set to be less than 2.

[0061] Among the above three variants, object sensitivity and type sensitivity (as a less costly alternative) are considered more suitable for analyzing object-oriented programs. In k-type sensitivity, the object o0 is cloned multiple times, and each object has a different context of length k - 1, called the heap context. The heap context is in the form of [T k-1 ,...,T1], where T i (1 < i < k - 1) is the type of the object at the initialization point of o i-1 , that is, o i-1 is initialized in the method with o i as the receiving object. Therefore, the method o0.m (where o0 is the receiving object) will be analyzed multiple times: for each different heap context c0, the method is analyzed once under the method context [T0, c0].

[0062] Please refer to Figure 2 , which shows a schematic diagram of software program code. As Figure 2 shown, the example uses the generic class java.util.HashMap. Hereafter, we only discuss the two mainstream context-sensitive variants of object-oriented programs: object sensitivity and type sensitivity, and in this application, we focus on discussing the type-sensitive machine under generic programming.

[0063] In the main method, there are two HashMap objects: O1 (line 2) and O2 (line 7). An object O A is created in line 3 and put into O1, and then retrieved in line 4 through the get method. Similarly, an object O B is created in line 8 and put into O2, and then retrieved in line 9. As a result, the two cast operations (lines 5 and 10) will never fail.

[0064] Lines 13-38 provide a simplified code snippet of HashMap. HashMap stores data in a table, which is an array of Node objects (line 15). The `put` method creates a Node object and stores it in the table (lines 16-19). The `get` method retrieves the corresponding Node object from the table and returns its value via the `getValue` interface (lines 20-23). ​​Note that the Node class (lines 24-38) is implemented as an inner generic class and is instantiated using the type variables (i.e., K and V) of its outer class, HashMap, when creating a Node object.

[0065] k-type-sensitive. In 1-type-sensitive analysis (abbreviated as 1-type), the type of the receiving object for the put / get methods called in lines 3 / 4 and 8 / 9 is HashMap. Therefore, using the context [HashMap] cannot distinguish between different call points to the put / get methods. This leads to false cast-may-fail reports in lines 5 and 10.

[0066] Please refer to Figure 3 It illustrates a schematic diagram of generic programming code. For example... Figure 3 As shown, for generics, the key to ensuring precision is preserving the instantiation location as part of the context—that is, the location where the generic type parameter is instantiated using the concrete type. Therefore, it is possible to effectively identify different pointer values ​​flowing into / out of generic methods and generic objects. Figure 2 In the example, lines 2 and 7 instantiate the generic class HashMap with actual types. These actual types are passed as type variables of HashMap to instantiate Node in line 17. Therefore, the corresponding actual types (A and B) should be considered as the context when analyzing the Node class methods. Thus, for 1-type, we are able to compute more accurate results: pts(A,key) = {"A"}, pts(B,key) = {"B"}, pts(A,value) = {OA}, and pts(B,value) = {O}. B In the scheme shown in this application, the propagation of type variables is accurately tracked by using the actual types at the generic instantiation locations to argumentize the context. The actual types at these instantiation locations are then updated efficiently in a context-sensitive manner during analysis. Figure 4 This is a flowchart illustrating a type-sensitive pointer analysis method for generic programming according to an exemplary embodiment. The method is executed by a computer device, which may be, for example... Figure 1 The server in the software analysis system shown. For example... Figure 4As shown, this type-sensitive pointer analysis method for generic programming may include the following steps:

[0067] Step 401: Obtain the target program code to be analyzed.

[0068] When pointer analysis of a computer program is required, the computer device can obtain the target program code corresponding to the computer program. In this embodiment of the application, the computer program is obtained through generic programming, that is, the target program code is program code obtained through generic programming.

[0069] Step 402: Map the type variable in the generic programming statement in the target program code to the actual type of the type variable, and put the mapping between the type variable and the actual type into the context of the generic programming statement.

[0070] Since the target program code is obtained through generic programming, it contains various types of generic programming statements. Furthermore, because generic programming directly uses type variables as parameters to define classes and methods, the concrete type that instantiates the generic should also be a key context element when performing context-sensitive pointer analysis on the generic programming statements. In this case, placing the mapping relationship between type variables and concrete types into the context element of the corresponding generic programming statement enhances the context information and improves its completeness.

[0071] Step 403: Based on the context of the generic programming statement, perform context-sensitive pointer analysis on the target program code to obtain the pointing relationships between the pointers in the target program code.

[0072] When a mapping relationship between type variables and actual types is added in the context of a generic programming statement, the pointing relationship between various pointers in the target program code can be obtained through context-sensitive pointer analysis, thereby obtaining the runtime values ​​that pointer variables in the program may point to statically.

[0073] In summary, when performing pointer analysis on target program code obtained from generic programming, we can first obtain the type variables in the generic programming statements to determine the instantiation location of the type variables. Then, we place the mapping relationship between the type variables and the actual types into the context corresponding to the generic programming statements, and perform context-sensitive pointer analysis to obtain the pointing relationships between various pointers in the target program code. This approach, in the target program code obtained from generic programming, first analyzes the type variables in the generic programming statements to obtain the actual types. Since the concrete type used to instantiate the generics is a key context element, placing the mapping relationship between the concrete type instantiated by the generics and the type variables into the context for context-sensitive pointer analysis improves the accuracy of context-sensitive pointer analysis for generic programming.

[0074] Figure 5 This is a flowchart illustrating a type-sensitive pointer analysis method for generic programming according to an exemplary embodiment. The method is executed by a computer device, which may be, for example... Figure 1 The server in the software analysis system shown. For example... Figure 5 As shown, this type-sensitive pointer analysis method for generic programming may include the following steps:

[0075] Step 501: Obtain the target program code to be analyzed.

[0076] In traditional context-sensitive pointer parsing, the context c is expanded into a tuple.<c,G> G records the instantiation points of all available type variables. For non-generic methods, G is θ. The size of G is limited by the number of available type variables.

[0077] In Java, developers can use explicit typing (...) Figure 6 (a) or not providing any actual type parameter to instantiate the generic class. In the latter case, the missing parameter is used to instantiate the generic class using the type Object. For example, in Figure 6 In (b), s is in the 3rd line with type HashSet <object>Created. In line 5, an object of type A is first created and implicitly cast to Object, and then placed into s.

[0078] Step 502: Based on the type of the generic programming statement, map the type variable in the generic programming statement in the target program code to the actual type of the type variable, and put the mapping between the type variable and the actual type into the context of the generic programming statement.

[0079] In this application embodiment, it is necessary to infer the type parameter (i.e. the type variable). In the target program code of this application embodiment, if the generic object O of the generic class instantiated with the type formal parameter T has not left its scope, and all its use of T can be resolved to type C, C can be safely regarded as the actual type parameter of instantiating T.

[0080] As in Figure 6 In (b), if s is not returned (i.e., it does not go out of scope of its declaration foo), then we can infer that s instantiates a HashSet of type A, that is, s has type HashSet. .

[0081] Finally, if we cannot resolve the actual type parameter that instantiates the generic class, we use the instantiation location as a pseudo-type. (See example...) Figure 6 In (b), a pseudo-type T3 is introduced to instantiate s; that is, in our analysis, the statement in line 3 is treated as a Set. <t3>s = new HashSet(). Therefore, when analyzing generics, we treat each instantiation location as a different type.

[0082] Without loss of generality, we consider a simplified subset of Java, in Figure 7 There are five types of marker statements. We write "x = new C <t:a>"Used for object allocation. If C is a generic class, then T is its type formal parameter, and A is the type actual parameter that instantiates T. Otherwise, both T and A are Nil. Similarly, generic method calls "x = v0.m' " <t:a>(v1) instantiates its type formal parameter T with the actual type parameter A. For non-generic method calls, both T and A are Nil. For simplicity, our formalization only considers NEW and CALL statements with only one type parameter. The general form of NEW and CALL statements with multiple parameters can be analyzed in the same way.

[0083] In Java, the statement "x = new C(...)" is modeled as "x = new C; x;". <init>(...)",in <init>() represents the corresponding constructor call. Control flow statements are not important for context-sensitive flow-insensitive analysis and are therefore skipped. Access to array elements is modeled by folding all elements into a special field of the array. Furthermore, it is assumed that each method returns via the variable ret. Since we formalize method calls with only one argument, each method also has only one formal parameter p.

[0084] In one possible implementation, when the generic programming statement type is NEW statement, the type variable in the generic programming statement in the target program code is processed according to the type update function to map the type variable to the actual type;

[0085] This type update function is used to map the type variable based on the instantiation type in the NEW statement to determine the actual type of the type variable.

[0086] Furthermore, when the computer device detects that an object is instantiated with a type variable in a NEW statement, it looks up the initialization point of the mapping of that type variable and determines the type parameter at that initialization point as the actual type.

[0087] Suppose a program has M, F, H, V, L, and T as its sets of methods, domains, initialization points, local variables, statement labels, and types, respectively. We use the symbol C to represent the context.

[0088] The following helper functions were used in our rules:

[0089] ·methodOf:

[0090] ·methodCtx:

[0091] • dispatch:

[0092] ·pts:

[0093] ·typeOf:

[0094] The `methodOf` parameter specifies the inclusion method of the statement, `methodCtx` maintains the context used to analyze the method, `dispatch` resolves the call to the target method, `pts` records context-sensitive pointer information for variables or fields, and `typeOf` returns the variable of the declared type.

[0095] Given a list of context elements c = [e1, ..., en] and a context element e, we use the notation e++c to represent [e, e1, ..., en] and ck to represent [e1, ..., ek], where k < n.

[0096] In the type-sensitive scheme shown in the embodiments of this application, let This means mapping type variable T∈T to actual type T∈T (identified by label l). Extended context C = H* × G. Our defined type update function is as follows:

[0097]

[0098] The function G(A) finds the initialization point of the mapping of type variable A.

[0099] When the generic programming statement is of type NEW, the following rules can be used to perform type sensitivity analysis on the generic programming statement:

[0100] l: x = newC<T:A> m = methodOf(l)

[0101] ctx =<c,G> ∈methodCtx(m)

[0102]

[0103] In the NEW statement, given the method context ctx =<c,G> The heap context ctx is constructed as <[c]k-1, G′>, [c] k-1 The first k-1 context elements are selected by c and G′ is updated by the Update function, as shown below.

[0104] If the type formal parameter T is Nil, then set G′ to Nil. Therefore, the analysis of method calls that use non-generic object types as their receiving object types is the same as in standard type sensitivity analysis.

[0105] If by specific type, i.e. Instantiate the object, then set G′ to Therefore, when analyzing the corresponding method call, the actual instantiated type A at the instantiation location is considered as part of the context.

[0106] Finally, if the object is instantiated with a type variable, i.e., T≠Nil∧A∈G, then we determine the actual instantiation location of A by looking at the context in which l contains the method. G′ is updated to This forces the actual instantiation type at the actual generic instantiation location to be part of the context.

[0107] In one possible implementation, when the generic programming statement type is a CALL statement, the type variable in the generic programming statement in the target program code is processed according to the type append function to map the type variable to the actual type;

[0108] This type of append function is used to map the variable of this type according to the call type in the CALL statement, so as to determine the actual type of the variable.

[0109] In this embodiment of the application, the object append function can be as follows:

[0110]

[0111] In the Append function, if f is a non-generic call, i.e. T≡Nil, then G remains unchanged.

[0112] If f is of a specific type, that is, Instantiated generic calls then use the new mapping Add to G to update G′.

[0113] If f is a variable of type [type], that is The instantiated generic call updates G′ by introducing the following mapping to G: from T to its actual instantiation site. The actual instantiation type at that location. Note that the available type variables can be propagated from the receiving object (in this case, A∈G) or from the caller method (in this case, A∈Gm).

[0114] In one possible implementation, when the call type in the CALL statement is a generic call of a specific type, the mapping relationship between the type variable and the actual type parameter in the CALL statement is determined as the mapping relationship between the type variable and the actual type.

[0115] In one possible implementation, when the call type in the CALL statement is a generic call of a type variable, the mapping relationship between the type variable and the specific type of the actual instantiated site is determined as the mapping relationship between the type variable and the actual type.

[0116] The actual instantiation type includes the type of the receiving object of the target method in the CALL statement, and the type of the method caller of the target method.

[0117] Therefore, when the generic programming statement is of type CALL, the following rules can be used to perform type sensitivity analysis on the generic programming statement:

[0118] l: x = a0.f<T:A> (a1)m=mehtodOf(l)

[0119] ctx = <c m :G m >∈mehtodCtx(m)

[0120] (O o ,hctx)∈pts(a o ,ctx)

[0121] hctx =<c:G> G′=Append(G,G m (T, A)

[0122]

[0123]

[0124]

[0125] In [CALL], the instance method x = a0.f<T:A> We will analyze the call. Let m′ be the target method, and we will write tis for the "this" variable parameter. m′ p m′ ret m And these are the formal parameters and return value of m′, respectively. Let O0 be the receiving object of the method call and the heap context ctx =<c,G> And let ctx =<cm,Gm> This is the context of m. Similar to [NEW], the context ctx′ is constructed when analyzing m′.<typeof(O0)++c,G′> In this case, typeof(O0)++c appends the heap context of the receiving object O0 in the standard way (at which point the heap context of O0 contains the specific type that called the receiving object), and in the conclusion of the rule, ctx′∈methodCtx(m′) shows how the context of the method is introduced.

[0126] Further study Figure 3 The example in [the example]. In line 2, the generic object O1 is instantiated using the actual type A. Therefore, we have (That is, the NEW statement). On line 4, g.foo is called for the generic method.<E:B> (b), where O1 is the receiving object. Since O1 has a declared type G, the updated context is used. (That is, the CALL statement) is used to analyze the target method foo. In foo, the object created on line 8 (O3) is instantiated using the type variable T. Therefore, it has an updated heap context. Similarly, O4 in line 10 has a heap context. Finally, in two contexts and Next, we analyze the method bar. It's worth noting that in our extended type analysis, the generic type and the actual instantiated type of the record form the complete instantiated type signature of the generic.

[0127] Step 503: Based on the context of the generic programming statement, perform context-sensitive pointer analysis on the target program code to obtain the pointing relationships between the pointers in the target program code.

[0128] After mapping the type variables in NEW and CALL statements using the context-sensitive pointer analysis rules corresponding to the NEW and CALL statements, the resulting mapping relationships can be added to the context of the generic programming statements (i.e., the NEW and CALL statements). Furthermore, based on the updated context, the pointer relationships can also be analyzed using the context-sensitive pointer analysis rules corresponding to the NEW and CALL statements.

[0129] And such Figure 6 As shown, in Java generic programming, in addition to the NEW and CALL statements, the ASSIGN, LOAD, and STORE statements can also be analyzed using the following rules:

[0130]

[0131]

[0132]

[0133] Since the context-sensitive pointer analysis of the above statements is similar to the existing type-sensitive pointer analysis method, it will not be described in detail here.

[0134] In other words, in the scheme shown in the embodiments of this application, by setting specific rules for context-sensitive pointer analysis of generic programming statements (i.e., CALL and NEW statements) involving type variables, the correspondence between type variables and instantiated types in CALL and NEW statements is established, and the context of CALL and NEW statements is broadened, thereby improving the accuracy of generic programming analysis.

[0135] In summary, when performing pointer analysis on target program code obtained from generic programming, we can first obtain the type variables in the generic programming statements to determine the instantiation location of the type variables. Then, we place the mapping relationship between the type variables and the actual types into the context corresponding to the generic programming statements, and perform context-sensitive pointer analysis to obtain the pointing relationships between various pointers in the target program code. This approach, in the target program code obtained from generic programming, first analyzes the type variables in the generic programming statements to obtain the actual types. Since the concrete type used to instantiate the generics is a key context element, placing the mapping relationship between the concrete type instantiated by the generics and the type variables into the context for context-sensitive pointer analysis improves the accuracy of context-sensitive pointer analysis for generic programming.

[0136] Figure 8 This is a structural block diagram illustrating a type-sensitive pointer analysis device for generic programming according to an exemplary embodiment. The device includes:

[0137] The program code acquisition module 801 is used to acquire the target program code to be analyzed.

[0138] The type mapping module 802 is used to map the type variable in the generic programming statement in the target program code to the actual type of the type variable, and put the mapping between the type variable and the actual type into the context of the generic programming statement;

[0139] The pointer analysis module 803 is used to perform context-sensitive pointer analysis on the target program code based on the context of the generic programming statement, so as to obtain the pointing relationship between the pointers in the target program code.

[0140] In one possible implementation, the type mapping module is used to map the type variable in the generic programming statement in the target program code to the actual type of the type variable according to the type of the generic programming statement.

[0141] In one possible implementation, the type mapping module includes:

[0142] The first type mapping unit is used to process the type variable in the generic programming statement in the target program code according to the type update function when the generic programming statement type is NEW statement, so as to map the type variable to the actual type.

[0143] The type update function is used to map the type variable according to the instantiation type in the NEW statement in order to determine the actual type of the type variable.

[0144] In one possible implementation, the type mapping unit is further configured to, when it is detected that an object is instantiated with a type variable in a NEW statement, find the initialization point of the mapping of the type variable, and determine the type parameter at the initialization point as the actual type.

[0145] In one possible implementation, the type mapping module further includes:

[0146] The second type mapping unit is used to process the type variable in the generic programming statement in the target program code according to the type append function when the generic programming statement type is a CALL statement, so as to map the type variable to the actual type;

[0147] The type append function is used to map the type variable according to the call type in the CALL statement, so as to determine the actual type of the type variable.

[0148] In one possible implementation, the second type mapping module is further configured to, when the call type in the CALL statement is a generic call of a specific type, determine the mapping relationship between the type variable and the actual type parameter in the CALL statement as the mapping relationship between the type variable and the actual type.

[0149] In one possible implementation, the second type mapping unit is further configured to, when the call type in the CALL statement is a generic call of a type variable, determine the mapping relationship between the type variable and the specific type of the actual instantiated site as the mapping relationship between the type variable and the actual type;

[0150] The actual instantiation type includes the type of the receiving object of the target method in the CALL statement, and the type of the method caller of the target method.

[0151] In summary, when performing pointer analysis on target program code obtained from generic programming, we can first obtain the type variables in the generic programming statements to determine the corresponding instantiation types. Then, we place the mapping relationship between type variables and instantiation types into the context corresponding to the generic programming statements and perform context-sensitive pointer analysis to obtain the pointing relationships between various pointers in the target program code. This approach, by first analyzing the type variables in the generic programming statements to obtain the generic instantiation types and then using concrete types for instantiation, improves the accuracy of context-sensitive pointer analysis for generic programming by placing the mapping relationship between the concrete types of generic instantiations and type variables into the context for context-sensitive pointer analysis.

[0152] Figure 9 A structural block diagram of a computer device 900 illustrated in an exemplary embodiment of this application is shown. This computer device can be implemented as a server as described above in this application. The computer device 900 includes a Central Processing Unit (CPU) 901, a system memory 904 including Random Access Memory (RAM) 902 and Read-Only Memory (ROM) 903, and a system bus 905 connecting the system memory 904 and the CPU 901. The computer device 900 also includes a mass storage device 906 for storing an operating system 909, application programs 910, and other program modules 911.

[0153] The mass storage device 906 is connected to the central processing unit 901 via a mass storage controller (not shown) connected to the system bus 905. The mass storage device 906 and its associated computer-readable media provide non-volatile storage for the computer device 900. That is, the mass storage device 906 may include computer-readable media (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0154] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state storage technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer storage media are not limited to the above-mentioned types. The system memory 904 and mass storage device 906 described above can be collectively referred to as memory.

[0155] According to various embodiments of this disclosure, the computer device 900 can also be connected to a remote computer on a network, such as the Internet. That is, the computer device 900 can be connected to a network 908 via a network interface unit 907 connected to the system bus 905, or it can use the network interface unit 907 to connect to other types of networks or remote computer systems (not shown).

[0156] The memory also includes at least one computer program stored in the memory, and the central processing unit 901 executes the at least one computer program to implement all or part of the steps in the methods shown in the above embodiments.

[0157] In one exemplary embodiment, a computer-readable storage medium is also provided for storing at least one computer program, which is loaded and executed by a processor to implement all or part of the steps in the above-described method. For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, or optical data storage device, etc.

[0158] In one exemplary embodiment, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned actions. Figure 2 or Figure 3 All or part of the steps of the method shown in any embodiment.

[0159] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0160] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.< / init> < / init> < / t:a> < / t:a> < / object>

Claims

1. A type-sensitive pointer analysis method for generic programming, characterized in that, The method includes: Obtain the target program code to be analyzed; Map the type variables in the generic programming statements in the target program code to the actual types of the type variables, and place the mapping between the type variables and the actual types into the context of the generic programming statements; Based on the context of the generic programming statement, context-sensitive pointer analysis is performed on the target program code to obtain the pointing relationships between the pointers in the target program code; The step of mapping the type variable in the generic programming statement in the target program code to the actual type of the type variable includes: Based on the type of the generic programming statement, the type variable in the generic programming statement in the target program code is mapped to the actual type of the type variable; The step of mapping the type variable in the generic programming statement in the target program code to the actual type of the type variable according to the type of the generic programming statement includes: When the type of the generic programming statement is a NEW statement, the type variable in the generic programming statement in the target program code is processed according to the type update function to map the type variable to the actual type; The type update function is used to map the type variable according to the instantiation type in the NEW statement, so as to determine the actual type of the type variable; When the type of the generic programming statement is a CALL statement, the type variable in the generic programming statement in the target program code is processed according to the type append function to map the type variable to the actual type; The type append function is used to map the type variable according to the call type in the CALL statement, so as to determine the actual type of the type variable.

2. The method according to claim 1, characterized in that, The step of processing type variables in generic programming statements in the target program code according to the type update function to map the type variables to the actual type includes: When it is detected that an object is instantiated with a type variable in a NEW statement, the initialization point of the mapping of the type variable is found, and the type parameter at the initialization point is determined as the actual type.

3. The method according to claim 1, characterized in that, The step of processing type variables in generic programming statements in the target program code according to the type append function to map the type variables to the actual type includes: When the call type in the CALL statement is a generic call of a specific type, the mapping relationship between the type variable and the actual type parameter in the CALL statement is determined as the mapping relationship between the type variable and the actual type.

4. The method according to claim 1, characterized in that, The step of processing type variables in generic programming statements in the target program code according to the type append function to map the type variables to the actual type includes: When the call type in the CALL statement is a generic call of a type variable, the mapping relationship between the type variable and the specific type of the actual instantiated site is determined as the mapping relationship between the type variable and the actual type; The actual type includes the type of the receiving object of the target method in the CALL statement, and the type of the method caller of the target method.

5. A type-sensitive pointer analysis device for generic programming, characterized in that, The device includes: The program code acquisition module is used to acquire the target program code to be analyzed. The type mapping module is used to map type variables in generic programming statements in the target program code to the actual types of the type variables, and to place the mapping between the type variables and the actual types into the context of the generic programming statements; The pointer analysis module is used to perform context-sensitive pointer analysis on the target program code based on the context of the generic programming statement, so as to obtain the pointing relationship between the pointers in the target program code; Specifically, the type mapping module is used for: Based on the type of the generic programming statement, the type variable in the generic programming statement in the target program code is mapped to the actual type of the type variable; When the type of the generic programming statement is a NEW statement, the type variable in the generic programming statement in the target program code is processed according to the type update function to map the type variable to the actual type; The type update function is used to map the type variable according to the instantiation type in the NEW statement, so as to determine the actual type of the type variable; When the type of the generic programming statement is a CALL statement, the type variable in the generic programming statement in the target program code is processed according to the type append function to map the type variable to the actual type; The type append function is used to map the type variable according to the call type in the CALL statement, so as to determine the actual type of the type variable.

6. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one instruction, which is loaded and executed by the processor to implement the type-sensitive pointer analysis method for generic programming as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, which is loaded and executed by a processor to implement the type-sensitive pointer analysis method for generic programming as described in any one of claims 1 to 4.

Images