Code detection method, device, storage medium and program product

Abstract

The present application discloses a code detection method, device, storage medium and program product, which belongs to the field of program development technology. The method includes: traversing the function call points in the target code to be detected; for each traversed function call point, if the function call point is a first function for performing a first preset operation, and the type of the external class of the instance corresponding to the first function in the target code is the type of the target module, then constructing a time series call chain of the target module according to the target knowledge graph, and constructing one or more cross-method call chains where the first function is located in the target code according to the time series call chain. In this way, all cross-method call chains where the first function is located in the target code can be constructed more accurately, and then it can be determined whether the target code has code defects related to the first preset operation based on all the constructed cross-method call chains, so that the false alarm rate and missed alarm rate of code detection can be reduced, and the code detection effect can be improved.

Description

Technical Field

[0001] The present application relates to the field of program development technology, and in particular to a code detection method, device, storage medium and program product. Background Art

[0002] In a software development environment, ensuring code quality is crucial. Whether it is the start-up of a new project or the maintenance of an existing project, a reliable code checking tool is needed to ensure that the code meets relevant standards. Code checking tools can detect code and find code defects such as errors and vulnerabilities in the code.

[0003] In the related technology, code checking tools can detect whether there is a Wakelock resource leakage problem in the code. The Wakelock resource leakage problem refers to the program performance defect caused by the incorrect use of Wakelock in the program. The reasons for this problem are relatively complicated. The most common reason is that the Wakelock is not released in time at the appropriate program node after applying for Wakelock. However, it is very difficult to detect whether the Wakelock is released in all possible execution paths in the program, so the current code checking tools have a large number of false positives and false negatives for this problem. Summary of the invention

[0004] The present application provides a code detection method, device, storage medium and program product, which can reduce the false positive rate and missed negative rate of code detection. The technical solution is as follows:

[0005] In the first aspect, a code detection method is provided. In this method, the function call points in the target code to be detected are traversed. For each traversed function call point, if the function call point is a first function for performing a first preset operation, the type of the external class of the instance corresponding to the first function is determined in the target code; if the type of the external class is the type of the target module, a time series call chain of the target module is constructed according to the target knowledge graph, and the target module is a module included in the target knowledge graph; according to the time series call chain of the target module, one or more cross-method call chains where the first function is located in the target code are constructed. Afterwards, it is determined whether the target code has code defects related to the first preset operation based on all the constructed cross-method call chains.

[0006] The first preset operation can be set in advance. The first preset operation can be set by a technician according to a code detection requirement, and the first preset operation is an operation related to a code defect that needs to be detected.

[0007] For example, the first preset operation may be a resource application operation, for example, the first preset operation may be an operation of applying for Wakelock, and the corresponding first function may be Wakelock.acquire(). In this case, the code defect to be detected may be a Wakelock not being released problem (i.e., a Wakelock resource leakage problem) or a Wakelock repeated release problem.

[0008] The target code to be detected in this application can be a code under development, or it can be a code that has been developed. The target code can be a code applied to any operating system such as Android, iOS, Windows, etc.

[0009] The present application can pre-build a target knowledge graph based on the API documentation of the operating system to which the target code applies. The target knowledge graph is used to reflect the relationship between various modules and various callback functions.

[0010] For example, if the target code is Android code, a target knowledge graph can be constructed based on the Android API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the Android program. For example, the modules in the Android program can be Android components, such as activities, services, broadcast receivers, content providers and other components. In this case, the target knowledge graph can reflect the life cycle chain of the Android component, and can also reflect the call chain related to various callback functions in the Android program. For example, the callback function in the target knowledge graph can include the life cycle function of the Android component, and can also include one or more of the GUI interaction callback function, system service callback function, custom view callback function, asynchronous task callback function, etc.

[0011] For example, if the target code is iOS code, a target knowledge graph can be constructed based on the iOS API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the iOS program. For example, the modules in the iOS program may include view controllers, background modes, notifications, application extensions, etc. In this case, the target knowledge graph can reflect the time series call chain of the modules in the iOS program, and can also reflect the call chain related to various callback functions in the iOS program.

[0012] For example, if the target code is Windows code, a target knowledge graph can be constructed based on the Windows API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the Windows program. For example, the modules in the Windows program may include application windows, background tasks, notifications, application services, etc. In this case, the target knowledge graph can reflect the time series call chain of the modules in the Windows program, and can also reflect the call chain related to various callback functions in the Windows program.

[0013] The time series call chain of the target module describes a series of function calls that occur in chronological order, and these functions may be callback functions contained in the target module. That is, the time series call chain of the target module includes multiple callback functions that exist in sequence. For example, when the target module is an Android component, the time series call chain of the target module may be a life cycle chain.

[0014] In the present application, the function call points in the target code to be detected are traversed; for each traversed function call point, when the function call point is the first function for performing the first preset operation, the type of the external class of the instance corresponding to the first function is determined in the target code; if the type of the external class is the type of the target module, it means that the instance is related to the callback function of the target module, and thus the time series call chain of the target module can be constructed according to the nodes and edges related to the target module in the target knowledge graph, and then one or more cross-method call chains where the first function is located in the target code are constructed according to the time series call chain. In this way, all cross-method call chains where the first function in the target code is located can be constructed more accurately, and then it can be determined whether the target code has code defects related to the first preset operation based on all the constructed cross-method call chains, which can reduce the false alarm rate and missed alarm rate of code detection and improve the code detection effect.

[0015] In one possible implementation, after determining the type of the external class of the instance corresponding to the first function in the target code, if the type of the external class is not the type of the target module, it means that the target knowledge graph does not contain the time series call chain of the external class, and thus one or more cross-method call chains where the first function is located can be directly constructed according to the target code.

[0016] In a possible implementation, based on the time series call chain of the target module, the operation of constructing one or more cross-method call chains where the first function in the target code is located can be: adding the first function as a node to the target node set; taking the first function as the target call point, and setting i to 1, i to the number of iterations; searching for the pre-order callback function and the post-order callback function of the target call point in the target code and the time series call chain, adding the pre-order callback function as the pre-order node of the target call point to the target node set, and adding the post-order callback function as the post-order node of the target call point to the target node set; if the nodes in the target node set change during this iteration, and i is less than a preset number of times, both the pre-order callback function and the post-order callback function are used as the target call point, setting i=i+1, and re-executing the step of searching for the pre-order callback function and the post-order callback function of the target call point in the target code and the time series call chain and the subsequent steps; if the nodes in the target node set do not change during this iteration, and / or, if i is equal to the preset number of times, constructing one or more cross-method call chains based on all the nodes in the target node set.

[0017] The nodes in the target node set are callback functions in the cross-method call chain where the first function is located. The first function is added to the target node set as a node, that is, each callback function in the cross-method call chain can be determined in sequence using the first function as the starting point.

[0018] The pre-order callback function of the target call point can be a callback function that calls the target call point, or can be a callback function executed before the target call point. The post-order callback function of the target call point can be a callback function called by the target call point, or can be a callback function called after the target call point is executed.

[0019] It should be noted that, in the case where the preorder callback function of the target call point is the callback function that calls the target call point, the callback function called after executing the target call point can be the callback function called after executing the preorder callback function of the target call point. In this case, the postorder callback function of the target call point can also be the callback function called after executing the preorder callback function of the target call point.

[0020] In the present application, the target code and the time series call chain can be combined to more accurately find the pre-order callback function and the post-order callback function of the target call point.

[0021] Optionally, the operations of searching for the pre-order callback function and post-order callback function of the target call point in the target code and the time series call chain, adding the pre-order callback function as the pre-order node of the target call point to the target node set, and adding the post-order callback function as the post-order node of the target call point to the target node set can be: searching for the pre-order callback function and post-order callback function of the target call point in the target code. If the pre-order callback function of the target call point is found in the target code, the found pre-order callback function is added to the target node set as the pre-order node of the target call point; if the pre-order callback function of the target call point is not found in the target code, the pre-order callback function of the target call point is searched from the time series call chain, and the found pre-order callback function is added to the target node set as the pre-order node of the target call point. If the post-order callback function of the target call point is found in the target code, the post-order callback function found is added to the target node set as the post-order node of the target call point; if the post-order callback function of the target call point is not found in the target code, the post-order callback function of the target call point is searched from the time series call chain, and the post-order callback function found is added to the target node set as the post-order node of the target call point.

[0022] In some cases, there may be explicit call logic for the target call point in the target code. Explicit call logic refers to the explicit specification of the called function, its calling time, calling order, etc. in the target code. If there is explicit call logic for the target call point in the target code, the pre-order callback function and / or post-order callback function of the target call point can be found in the target code.

[0023] In other cases, there may not be explicit call logic for the target call point in the target code, but there is implicit call logic for the target call point. Implicit call logic refers to call logic that is automatically executed due to the specific mechanism of the programming language without directly calling a function in the target code. If there is no explicit call logic for the target call point in the target code, the implicit call logic for the target call point can be found from the time series call chain, that is, the pre-order callback function and post-order callback function of the target call point can be found from the time series call chain. In this way, the call logic of the target call point can be improved through the time series call chain, and then the accuracy and completeness of the cross-method call chain determined subsequently can be improved.

[0024] In one possible implementation, after constructing one or more cross-method call chains where the first function is located in the target code, the function registration points in the target code can also be traversed; for each traversed function registration point, the first callback function registered by the function registration point is determined in the target code, and the second callback function containing the function registration point is determined in the target code; the subsequent call chain of the first callback function is searched from the target code; if the subsequent call chain of the first callback function is not found in the target code, the subsequent call chain of the first callback function is searched from the target knowledge graph; a new cross-method call chain is constructed according to the first callback function, the subsequent call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains.

[0025] The post-order call chain of the first callback function is one or more call chains in the target code starting from the post-order callback function of the first callback function. The post-order callback function of the first callback function can be a callback function called by the first callback function, or can be a callback function called after the first callback function is executed.

[0026] In the present application, after constructing a cross-method call chain where the first function in the target code is located through the target knowledge graph according to the function call points in the target code, a new cross-method call chain can be constructed according to the function registration points in the target code through the constructed cross-method call chain and the target knowledge graph. In this way, not only the function call situation but also the function registration situation is taken into consideration, so that the cross-method call chain where the first function in the target code is located can be obtained more accurately.

[0027] Optionally, the operation of constructing a new cross-method call chain based on the first callback function, the post-order call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains can be: using the first callback function as the post-order callback function of the second callback function; for any cross-method call chain where the second callback function is located in the one or more cross-method call chains, constructing a new cross-method call chain based on the pre-order call chain of the second callback function in the cross-method call chain, the second callback function, the first callback function, and the post-order call chain of the first callback function.

[0028] The predecessor call chain of the second callback function in the cross-method call chain is a call chain of the predecessor callback function from the starting point of the cross-method call chain to the second callback function.

[0029] In one possible implementation, before determining whether the target code has a code defect related to the first preset operation based on all constructed cross-method call chains, multiple execution paths in the target code can also be obtained, each of the multiple execution paths having a constraint set; based on the constraint set of each execution path in the multiple execution paths, constraints are added to the call edges in each cross-method call chain in all constructed cross-method call chains to obtain a constraint set for each cross-method call chain; for any cross-method call chain in all constructed cross-method call chains, the reachability of the cross-method call chain is determined based on the constraint set of the cross-method call chain; if the cross-method call chain is reachable, the cross-method call chain is retained; if the cross-method call chain is unreachable, the cross-method call chain is deleted.

[0030] The constraint set of an execution path is the set of constraint conditions for each edge in the execution path.

[0031] The constraint set of a cross-method call chain is the set of constraint conditions of each call edge in the cross-method call chain.

[0032] The reachability of the cross-method call chain refers to whether the end point of the cross-method call chain can be reached from the starting point of the cross-method call chain through a series of call relationships in the cross-method call chain during actual execution. In other words, the cross-method call chain is reachable, which means that the cross-method call chain may be executed in actual application, and the cross-method call chain is unreachable, which means that the cross-method call chain will never be executed in actual application.

[0033] In the present application, the reachability of the cross-method call chain can be determined by analyzing whether there is a solution that satisfies the constraint set of the cross-method call chain. That is, the operation of determining the reachability of the cross-method call chain according to the constraint set of the cross-method call chain can be: if there is a solution that satisfies the constraint set of the cross-method call chain, then the cross-method call chain is determined to be reachable; if there is no solution that satisfies the constraint set of the cross-method call chain, then the cross-method call chain is determined to be unreachable.

[0034] In the present application, by analyzing the reachability of cross-method call chains, deleting unreachable cross-method call chains, and performing subsequent detection on the retained reachable cross-method call chains, the false positive rate of code detection can be reduced.

[0035] In one possible implementation, the operation of determining whether the target code has a code defect related to the first preset operation based on all constructed cross-method call chains may be: for any cross-method call chain among all constructed cross-method call chains, if the predecessor call chain and / or the successor call chain of the first function in the cross-method call chain meets the preset conditions, then it is determined that the cross-method call chain has a defect; if each cross-method call chain among all constructed cross-method call chains has a defect, or if at least one cross-method call chain among all constructed cross-method call chains has a defect, then it is determined that the target code has a code defect.

[0036] For example, the code defect can be determined based on a second function for performing a second preset operation. The second preset operation is an operation associated with the first preset operation. For example, the first preset operation is an operation for applying for Wakelock, and the corresponding first function may be Wakelock.acquire(); the second preset operation is an operation for releasing Wakelock, and the corresponding second function may be Wakelock.release().

[0037] The preset condition is a condition related to the second function. For example, the preset condition may be that the second function does not exist in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that the second function exists in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that there is only one second function in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that there are multiple second functions in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain.

[0038] The pre-order call chain of the first function in the cross-method call chain is a call chain from the starting point of the cross-method call chain to the pre-order callback function of the first function. The post-order call chain of the first function in the cross-method call chain is a call chain from the post-order callback function of the first function to the end point of the cross-method call chain.

[0039] In some cases, when each cross-method call chain in all cross-method call chains has a defect, it can be determined that the target code has a code defect; when at least one cross-method call chain in all cross-method call chains does not have a defect, it can be determined that the target code does not have a code defect.

[0040] In other cases, when at least one of all cross-method call chains has a defect, it can be determined that the target code has a code defect; when each cross-method call chain in all cross-method call chains does not have a defect, it can be determined that the target code does not have a code defect.

[0041] For example, the second function is Wakelock.release(), and the code defect is a Wakelock resource leakage problem. Then the preset condition may be that the second function does not exist in the subsequent call chain of the first function in the cross-method call chain.

[0042] For example, the second function is Wakelock.release(), and the code defect is the problem of repeated release of Wakelock. Then the preset condition may be that there are multiple second functions in the subsequent call chain of the first function in the cross-method call chain.

[0043] In a second aspect, a code detection device is provided, which has the function of implementing the code detection method in the first aspect. The code detection device includes at least one module, and the at least one module is used to implement the code detection method provided in the first aspect.

[0044] In a third aspect, an electronic device is provided, comprising: one or more processors, and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code comprises computer instructions, and the one or more processors call the computer instructions so that the electronic device executes the code detection method provided in the first aspect above.

[0045] In a fourth aspect, a chip system is provided. The chip system is applied to an electronic device. The chip system includes one or more processors. The one or more processors are used to call computer instructions so that the electronic device executes the code detection method provided in the first aspect.

[0046] In a fifth aspect, a computer-readable storage medium is provided, which includes instructions. When the instructions are executed on an electronic device, the electronic device executes the code detection method provided in the first aspect.

[0047] In a sixth aspect, a computer program product is provided. When the computer program product is run on an electronic device, the electronic device executes the code detection method provided in the first aspect.

[0048] The technical effects obtained by the above-mentioned second, third, fourth, fifth and sixth aspects are similar to the technical effects obtained by the corresponding technical means in the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a schematic diagram of a Wakelock resource leakage scenario provided in an embodiment of the present application.

[0050] Figure 2This is a schematic diagram of another scenario of Wakelock resource leakage provided in an embodiment of the present application.

[0051] Figure 3 It is a schematic diagram of the technical architecture of a code detection method provided in an embodiment of the present application.

[0052] Figure 4 It is a schematic diagram of a target knowledge graph provided in an embodiment of the present application.

[0053] Figure 5 It is a schematic diagram of another target knowledge graph provided in an embodiment of the present application.

[0054] Figure 6 It is a flowchart of a code detection method provided in an embodiment of the present application.

[0055] Figure 7 It is a schematic diagram of a problem report provided in an embodiment of the present application.

[0056] Figure 8 It is a schematic diagram of a cross-method call chain provided in an embodiment of the present application.

[0057] Fig. 9 This is a flowchart of another code detection method provided in an embodiment of the present application.

[0058] Fig.10 It is a structural diagram of a code detection device provided in an embodiment of the present application.

[0059] Fig.11 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In the following description, specific details such as specific system structures and technologies are provided for illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details.

[0061] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or their collections. The terms "comprising", "including", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0062] It should be understood that the "one or more" mentioned in this application refers to one, two or more than two, and the "multiple" mentioned in this application refers to two or more. In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B. The "and / or" in this article is just a way to describe the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0063] In order to clearly describe the technical solution of the present application, the words "first", "second" and the like are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the difference.

[0064] The phrases such as "one embodiment" or "some embodiments" described in the present application mean that the specific features, structures or characteristics described in the embodiment are included in one or more embodiments of the present application. Therefore, the phrases such as "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments" etc. that appear in different places in the present application do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways.

[0065] The application scenarios involved in the embodiments of the present application are described below.

[0066] In a software development environment, ensuring code quality is critical. Whether it is the start-up of a new project or the maintenance of an existing project, a reliable code checking tool is needed to ensure that the code meets relevant standards. Code checking tools can detect code and find code defects such as errors and vulnerabilities in the code. For defective code, it is necessary to intercept it to prevent it from being submitted to the code base and entering the product line. In addition, the defective code can be returned to the developer for repair, and the repaired code can be submitted to the code checking tool for inspection again later.

[0067] Next, taking the Wakelock resource leakage problem in the detection code as an example, the code detection method provided in the embodiment of the present application is exemplarily explained.

[0068] Wakelock is a mechanism used to prevent the device from entering sleep mode and keep the device awake to ensure that certain critical tasks can continue to run when needed. If the program holds Wakelock but does not release it in time, the device may be awake for a long time, which will not only cause the battery to drain quickly, but also cause device performance to degrade, which may affect the normal operation of the application.

[0069] Wakelock resource leakage refers to program performance defects caused by incorrect use of Wakelock in Android programs. The reasons for this problem are relatively complex, and the most common reason is that the Wakelock is not released in time at the appropriate program node after applying for it. However, it is very difficult to detect whether the Wakelock is released in all possible execution paths in Android programs, mainly facing the following problems:

[0070] 1. Dynamic testing cannot cover all possible execution paths.

[0071] 2. Android programs are event-driven. Different user interactions and system environments will lead to different execution paths. The execution path is complex and it is difficult to take all situations into consideration during detection.

[0072] 3. Android programs have multiple callback functions, including but not limited to lifecycle functions, graphical user interface (GUI) interaction callback functions, custom view callback functions, system service callback functions, etc. The complex timing logic of callback functions increases the difficulty of detection.

[0073] 4. Traditional static program analysis often cannot handle complex requirements that are cross-method, cross-lifecycle, context-sensitive, and path-sensitive at the same time.

[0074] Therefore, the code checking tools in the related art have a large number of false positives and false negatives.

[0075] Next, combine Figure 1 and Figure 2 Two possible scenarios of Wakelock resource leakage are illustrated below:

[0076] The native life cycle sequence paths of Android components are diverse, and there are many other dynamically registered callback functions. If all possible situations are not considered, it is easy to cause Wakelock resource leakage.

[0077] Taking the Android component Activity as an example, the life cycle sequence path of an Activity may include: onCreate(): Activity is created; onStart(): Activity becomes visible but has not yet gained focus; onResume(): Activity gains focus and the user can interact with it. If the user leaves the current Activity, the following path will continue: onPause(): Activity loses focus but is still visible; onStop(): Activity is no longer visible. When the user returns to the Activity, the following path will continue: onRestart(): Activity restarts; onStart(): Activity becomes visible again; onResume(): Activity regains focus. Finally, when the Activity is destroyed, onDestroy() is called.

[0078] For example, Figure 1 This is a Wakelock resource leak caused by not considering the entire life cycle sequence path. Figure 1 As shown in the figure, after starting the Activity, there may be multiple execution paths. Execution path 1 may include: onCreate()->onStart()->onResume()->onPause()->onStop()->onDestroy(). Execution path 2 may include: onCreate()->onStart()->onResume()->onPause()->onStop()->onRestart()->onStart(). Assuming that onCreate() applies for Wakelock and onRestart() can release Wakelock, then in execution path 1, onCreate() applies for Wakelock but does not release it, resulting in Wakelock resource leakage.

[0079] For example, Figure 2 Wakelock resource leak is caused by not considering the nature of the dynamically registered callback function. Figure 2As shown in the figure, after starting the Activity, there can be multiple execution paths. One of the execution paths includes: onCreate() ->onStart() ->onResume() ->onPause() ->onStop() ->onDestroy(). Assuming that onCreate() applies for Wakelock and onResume() registers onClick(), onClick() can release Wakelock. onClick() is used to handle user click events, that is, the system will call onClick() for processing when a user clicks. In this case, since onClick() is only executed when the user clicks, and will not be executed when the user does not click, Wakelock may not be released, causing Wakelock resource leakage.

[0080] To this end, an embodiment of the present application provides a code detection method, which can more accurately obtain all cross-method call chains where Wakelock.acquire() is located and reachable in the code, and then analyze whether Wakelock resource leakage occurs in each cross-method call chain. This can reduce the false alarm rate and missed alarm rate of code detection and improve the code detection effect.

[0081] The code detection method provided in the embodiment of the present application is explained in detail below.

[0082] Figure 3 Schematic diagram of a technical architecture of a code detection method provided by an embodiment of the present application. The schematic diagram of the technical architecture only shows modules related to the embodiment of the present application. In practical applications, the technical architecture may also include other modules, which are not shown one by one. Figure 3 ,The technical architecture can include four modules, namely: knowledge graph builder, static program analyzer, constraint solver, and rule checker.

[0083] The knowledge graph builder can build a target knowledge graph based on the Android application programming interface (API) document. The target knowledge graph can reflect the relationship between various components and callback functions in the Android program.

[0084] Afterwards, for the target code to be tested, the static program analyzer can construct one or more cross-method call chains where Wakelock.acquire() is located in the target code based on the target knowledge graph, and obtain all execution paths in the target code and record the constraint set of each execution path. Then, based on the constraint set of each execution path in all execution paths in the target code, constraints are added to the call edges in each constructed cross-method call chain to obtain the constraint set of each cross-method call chain.

[0085] Afterwards, the constraint solver can analyze the reachability of each cross-method call chain according to the constraint set of each cross-method call chain, and then delete the unreachable cross-method call chains and retain the reachable cross-method call chains. For example, the constraint solver can solve the constraint set of each cross-method call chain, and then delete the unsolvable cross-method call chains and retain the solvable cross-method call chains. Among them, the unsolvable cross-method call chain is a path that will not be executed when the target code is actually applied, that is, an unreachable path; the solvable cross-method call chain is a path that may be executed when the target code is actually applied, that is, a reachable path.

[0086] Afterwards, for each cross-method call chain, the rule checker can check whether there is Wakelock.release() after Wakelock.acquire() in the cross-method call chain; if not, it is determined that the cross-method call chain has a Wakelock resource leak, and a Wakelock resource leak problem report is generated; if so, it is determined that the cross-method call chain has not had a Wakelock resource leak. It should be noted that if no Wakelock resource leak occurs in each cross-method call chain in all cross-method call chains, it is determined that there is no Wakelock resource leak problem in the target code, and the detection ends.

[0087] It should be understood that the embodiments of the present application are only illustrated by the division of each module in the above-mentioned technical architecture. In practical applications, all or part of the functions described above can be assigned to the same or different modules as needed. In addition, each module in the above-mentioned technical architecture can be integrated into a processing unit, or each module can exist physically alone, or two or more modules can be integrated into a processing unit, and each module can be implemented in the form of hardware or software. In addition, the specific names of each module are only for the convenience of distinguishing each other, and do not constitute a limitation on the embodiments of the present application.

[0088] After describing the technical architecture of the code detection method provided in the embodiment of the present application, the specific process of the code detection method provided in the embodiment of the present application is described in detail.

[0089] It should be noted that the knowledge graph builder can pre-build the target knowledge graph. The target knowledge graph is used to reflect the relationship between various components and various callback functions in the Android program. The target knowledge graph can include nodes and edges, where the edges define the relationship between nodes, and nodes can have attributes, and edges can also have attributes.

[0090] For example, the nodes in the target knowledge graph may include: components, callback functions, etc. The properties of the nodes may include: one or more properties of: identifier (ID), parameter, return value, call line, definition file path, trigger mechanism, related permissions, etc.

[0091] Among them, the ID attribute of a node is used to uniquely identify the node in the target knowledge graph. The parameter attribute of a node is used to describe the input parameters received by the node. The return value attribute of a node is used to indicate the result returned after the node is executed. The call line attribute of a node is used to indicate the specific code line where the node is called. The definition file path of a node is used to indicate the file path where the node definition is located. The trigger mechanism attribute of a node is used to describe the triggering method of the node. The related permission attribute of a node is used to describe the relationship between the node and the permission.

[0092] For example, the edges in the target knowledge graph may include: one or more of the edges between components, the edges between components and callback functions, the edges between callback functions, etc. The attributes of the edges may include: one or more of the attributes of the relationship type, direction, etc. For example, the relationship type may include communication, inclusion, call, etc. Among them, the edge from one component to another component may be a communication edge, used to indicate that this component can communicate with another component; the edge from a component to a callback function may be an inclusion edge, used to indicate that this component includes the callback function; the edge from a callback function to another callback function may be a call edge, used to indicate that this callback function can call another callback function, or indicate that another callback function can be called after executing this callback function.

[0093] For example, the target knowledge graph can be Figure 4 As shown, in Figure 4 The target knowledge graph shown includes multiple nodes, each of which is a component or a callback function. The target knowledge graph includes communication edges between components, inclusion edges between components and callback functions, and call edges between callback functions.

[0094] In some embodiments, the knowledge graph builder can model various knowledge about life cycles and callback functions in the Android API documentation to obtain a target knowledge graph.

[0095] The target knowledge graph can reflect the life cycle stages of various components.

[0096] For example, the life cycle of an Activity: onCreate(): Called when the Activity is created, used to initialize the Activity. onStart(): Called when the Activity becomes visible. onResume(): Called when the Activity is ready to interact with the user. onPause(): Called when the Activity loses focus but is still visible. onStop(): Called when the Activity is completely invisible. onRestart(): Called when the Activity is restarted. onDestroy(): Called when the Activity is destroyed.

[0097] For example, the life cycle of a service: onCreate(): called when the Service is created. onStartCommand(): called when the Service is started. onDestroy(): called when the Service is destroyed.

[0098] For example, the life cycle of a broadcast receiver: onReceive(): called when the BroadcastReceiver receives a broadcast.

[0099] For example, the life cycle of a content provider: onCreate(): called when the Content Provider is created. shutdown(): called when the Content Provider is destroyed.

[0100] The target knowledge graph can also reflect the association between callback functions and life cycles.

[0101] For example, the callback function of an Activity: performs specific operations in each life cycle function of the Activity, such as initializing the interface, saving data, applying for resources, releasing resources, and other operations.

[0102] For example, the callback function of a Service: handles events such as starting and stopping the Service in the Service's life cycle function.

[0103] For example, the callback function of Broadcast Receiver: process the received broadcast data or execute specific logic in the life cycle function of Broadcast Receiver.

[0104] For example, the callback function of the Content Provider: the corresponding database operations are processed in the query(), insert(), update(), delete() and other functions of the Content Provider, where query() is used to query data, insert() is used to insert data, update() is used to update data, and delete() is used to delete data.

[0105] For example, the knowledge modeling in the embodiment of the present application may include the following five callback functions; of course, more or fewer callback functions may also be included, and the embodiment of the present application is not limited to this.

[0106] 1. Lifecycle functions

[0107] A lifecycle function refers to a specific function that is automatically called during the lifecycle of a component. A lifecycle function involves all possible states of a component from creation to destruction. The embodiment of the present application can determine possible pre-order nodes and post-order nodes for each lifecycle function. For example, the pre-order node of onResume() may be onCreate() or onRestart(), and the post-order node is onResume().

[0108] 2. GUI interaction callback function

[0109] GUI interaction callback functions are functions that are called when a user interacts with a graphical interface element (such as a button, text box, list box, etc.). GUI interaction callback functions can be registered in multiple places, but are generally only called when the Activity is in the foreground and there is user interaction.

[0110] 3. System service callback function

[0111] Android provides some system services, such as power management, network status, location services, etc. These system services usually allow applications to register callback functions to monitor their status changes. System service callback functions are functions that are called when the status of system services changes, and are used to respond to and handle specific system events. It can be seen that the execution of system service callback functions depends on the occurrence of system events.

[0112] 4. Custom view callback function

[0113] Custom view callback functions refer to callback functions in custom views. These callback functions will be called by the system in certain circumstances to execute some customized logic. For example, when a custom view needs to be redrawn, the system will call the view's onDraw(). In some cases, the custom view callback function is triggered in an event-driven manner, that is, some operations in the custom view are triggered by user events (such as clicks, slides, etc.). For example, when the user clicks a custom button, the developer may want to redraw the button to show a different state. At this time, invalidate() can be called to request a redraw, but the redraw operation will not be executed immediately. Instead, the system will call onDraw() to perform the redraw operation at the appropriate time.

[0114] 5. Asynchronous task callback function

[0115] Asynchronous tasks are a mechanism used to process background tasks and interact with the main thread. Asynchronous task callback functions are functions used to process asynchronous tasks. Asynchronous task callback functions are related to the status and progress of asynchronous tasks, and some are executed in separate threads. For example, asynchronous task callback functions may include onPreExecute(), doInBackground(), onProgressUpdate(), onPostExecute(), etc. Among them, onPreExecute() is called before the task is executed, and is usually used to perform some initialization operations. onPreExecute() can be executed in the main thread. doInBackground() is the core method of asynchronous tasks. Time-consuming operations are processed within this method. doInBackground() can be executed in the background thread. onProgressUpdate() is used to update the progress of the task and can be executed in the main thread. onPostExecute() is called after the background task is executed and doInBackground() is called. It is used to process the results after the task is executed. onPostExecute() can be executed in the main thread.

[0116] In the embodiment of the present application, the knowledge graph builder can perform knowledge modeling on the various callback logics of the above five callback functions according to the Android API documentation, and save it in the form of a knowledge graph, so as to guide the subsequent code detection work, increase the detection coverage, and improve the stability and capabilities of development and maintenance.

[0117] In some embodiments, the operation of the knowledge graph builder to construct the target knowledge graph according to the Android API document can be: using natural language processing technology and text mining technology to analyze the Android API document to perform entity recognition and relationship extraction; wherein entity recognition refers to identifying key entities, such as component names, such as Activity, Service, etc., and callback function names, such as onCreate, onStart, etc.; wherein relationship extraction refers to determining the relationship between different entities, such as which callback functions will be called in the life cycle of Activity, the communication method between Service and Broadcast Receiver, etc., for example, these relationships can be extracted by analyzing the description, sample code or specific keywords in the Android API document. Afterwards, for each entity (i.e., component or callback function), its attributes are extracted from the Android API document. For example, component attributes can include the life cycle function of Activity, the startup method of Service, etc., and callback function attributes can include the parameter list, return value, calling time, execution order, etc. of the callback function. Finally, the extracted entities, relationships and attributes are organized into a structured knowledge graph, i.e., the target knowledge graph. The nodes in the target knowledge graph are used to represent entities, such as Activity, Service, Broadcast Receiver, Content Provider and the callback functions they contain, such as onCreate(), onStart(), etc.; the edges in the target knowledge graph are used to represent the relationship between entities, such as the calling relationship between different callback functions in the life cycle of Activity, the communication relationship between Service and Broadcast Receiver, etc.

[0118] Of course, the knowledge graph builder can also build the target knowledge graph in other ways according to the Android API documentation, and this embodiment of the present application is not limited to this.

[0119] It should be noted that as the Android API documentation is updated, the knowledge graph builder can regularly update the target knowledge graph to reflect the latest Android practices and specifications.

[0120] For example, the part related to Activity in the target knowledge graph can be as follows Figure 5 As shown, from Figure 5 The content shown can show the life cycle sequence path of the Activity, that is, the order of a series of life cycle functions experienced in the life cycle of the Activity.

[0121] In an embodiment of the present application, after the target knowledge graph is pre-built, code detection can be performed according to the target knowledge graph. The device for building the target knowledge graph and the device for performing code detection can be the same device or different devices, which is not limited in the embodiment of the present application. For example, the code being developed can be detected by a device for performing code detection in a code development pipeline according to the target knowledge graph.

[0122] Figure 6 : is a flow chart of a code detection method provided by an embodiment of the present application. The method is applied to an electronic device, which may be a terminal or a server, and the target knowledge graph may be pre-stored in the electronic device. The electronic device may include a static program analyzer, a constraint solver, and a rule checker. Figure 6 , the method may include the following steps:

[0123] Step 601: The static program analyzer traverses the function call points in the target code to be detected.

[0124] The target code can be the code under development. Testing the code under development can help developers find and fix potential problems in the code in a timely manner to ensure the quality and reliability of the code. Alternatively, the target code can be the code that has been developed. Testing the code that has been developed can help developers maintain and optimize the code and improve the stability and security of the code.

[0125] Function call sites are used to perform function calls. Function call sites are usually represented by call expressions (UCallExpression). Call expressions are grammatical structures used to perform function calls in programming languages. Call expressions can include information such as function name, parameter list, and grammatical identifier. Among them, the function name is the name of the function to be called, the parameter list is the actual parameters passed to the function, and the grammatical identifier is used to identify that this is a grammatical structure for a function call.

[0126] For example, in step 601, the function call points in the form of Caller.callee() in the target code can be traversed, where Caller refers to the caller and callee refers to the callee. In the embodiment of the present application, Caller is an instance of calling the callee() method.

[0127] Step 602: For each traversed function call point, the static program analyzer determines whether the function call point is Wakelock.acquire().

[0128] Wakelock.acquire() is a function used to apply for (also known as acquire) Wakelock.

[0129] If the function call point is Wakelock.acquire(), it means that the function called by the function call point is used to apply for Wakelock. Generally, you can first create a Wakelock instance, and then call the acquire() method of the Wakelock instance, that is, call Wakelock.acquire() to apply for Wakelock.

[0130] Step 603: If the function call point is Wakelock.acquire(), the static program analyzer determines the Wakelock instance corresponding to the Wakelock.acquire() in the target code, and determines the type of the external class of the Wakelock instance.

[0131] The Wakelock instance corresponding to Wakelock.acquire() is the Wakelock instance that calls the acquire() method.

[0132] The external class of the Wakelock instance can also be called the declaring class of the Wakelock instance. The external class of the Wakelock instance is the class of the object to which the Wakelock instance belongs, that is, the class that declares the Wakelock instance.

[0133] If the type of the external class of the Wakelock instance is the type of the target component, execute step 604; if the type of the external class of the Wakelock instance is not the type of the target component, execute step 605.

[0134] The target component is a component included in the target knowledge graph. For example, the target component can be the four major components of Android, namely Activity, Service, Broadcast Receiver, and Content Provider.

[0135] Step 604: If the type of the external class of the Wakelock instance is the type of the target component, the static program analyzer builds the lifecycle chain of the target component based on the target knowledge graph, and builds one or more cross-method call chains where the Wakelock.acquire() is located in the target code based on the lifecycle chain, and then executes step 606.

[0136] If the external class type of the Wakelock instance is the type of the target component, it means that the Wakelock instance is related to the life cycle of the target component. Therefore, the life cycle chain of the target component can be constructed based on the nodes and edges related to the target component in the target knowledge graph.

[0137] The life cycle chain of the target component includes a series of life cycle functions that are sequentially experienced during the life cycle of the target component, which describes the entire process of the target component from creation to destruction. In other words, the life cycle chain of the target component includes multiple life cycle functions that exist in sequence. In this case, each life cycle function in the life cycle chain can be called a node, and the calling relationship between one life cycle function and the next life cycle function can be called a calling edge, indicating that this life cycle function can call the next life cycle function, or that the next life cycle function can be called after executing this life cycle function. The preceding callback function of a life cycle function is the previous life cycle function of this life cycle function, and the post-order callback function of a life cycle function is the next life cycle function of this life cycle function.

[0138] For example, if the target component is Activity, then according to Figure 5 From the target knowledge graph shown, we can determine that one life cycle chain of the target component is: onCreate() ->onStart() ->onResume() ->onPause() ->onStop() ->onDestroy(), and the other life cycle chain is: onCreate() ->onStart() ->onResume() ->onPause() ->onStop() ->onRestart() ->onStart() ->…… ->onDestroy().

[0139] In some embodiments, the operation of the static program analyzer constructing one or more cross-method call chains where the Wakelock.acquire() is located in the target code according to the lifecycle chain may include the following steps (1) to (5):

[0140] (1) Add the Wakelock.acquire() as a node to the target node set.

[0141] The nodes in the target node set are callback functions in the cross-method call chain where the Wakelock.acquire() is located. The Wakelock.acquire() is added as a node to the target node set, and each callback function in the cross-method call chain can be determined in sequence with the Wakelock.acquire() as the starting point.

[0142] (2) Set Wakelock.acquire() as the target call point and set i to 1.

[0143] i is the number of iterations. Each time the target call point is determined, the pre-order callback function and / or post-order callback function of the target call point can be found according to the target call point determined this time. This process is called an iteration process.

[0144] In the embodiment of the present application, a limit value of the number of iterations can be preset, which can also be referred to as a preset number. Optionally, the preset number can be preset by a technician based on experience or needs, for example, it can be set according to the number of callback functions usually included in a call chain in the code.

[0145] (3) Search for the pre-order callback function and post-order callback function of the target call point in the target code. If the pre-order callback function of the target call point is found in the target code, the pre-order callback function is added to the target node set as the pre-order node of the target call point; if the pre-order callback function of the target call point is not found in the target code, the pre-order callback function of the target call point is searched from the life cycle chain, and the found pre-order callback function is added to the target node set as the pre-order node of the target call point. If the post-order callback function of the target call point is found in the target code, the post-order callback function is added to the target node set as the post-order node of the target call point; if the post-order callback function of the target call point is not found in the target code, the post-order callback function of the target call point is searched from the life cycle chain, and the found post-order callback function is added to the target node set as the post-order node of the target call point.

[0146] The pre-order callback function of the target call point can be a callback function that calls the target call point, or can be a callback function executed before the target call point. The post-order callback function of the target call point can be a callback function called by the target call point, or can be a callback function called after the target call point is executed.

[0147] It should be noted that, in the case where the preorder callback function of the target call point is the callback function that calls the target call point, the callback function called after executing the target call point can be the callback function called after executing the preorder callback function of the target call point. In this case, the postorder callback function of the target call point can also be the callback function called after executing the preorder callback function of the target call point. For example, if the preorder callback function of Wakelock.acquire() is found in the target code to be the callback function onCreate() that calls Wakelock.acquire(), then when searching for the postorder callback function of Wakelock.acquire() from the lifecycle chain, not only can we search for the callback function called by Wakelock.acquire(), and the callback function called after executing Wakelock.acquire(), but we can also search for the callback function called after executing onCreate().

[0148] In some cases, there may be explicit call logic for the target call point in the target code. Explicit call logic refers to the explicit specification of the called function, its calling time, calling order, etc. in the target code. If there is explicit call logic for the target call point in the target code, the pre-order callback function and / or post-order callback function of the target call point can be found in the target code.

[0149] In other cases, there may be no explicit calling logic for the target call point in the target code, but there is implicit calling logic for the target call point. Implicit calling logic refers to calling logic that is automatically executed due to the specific mechanism of the programming language without directly calling the function in the target code. If there is no explicit calling logic for the target call point in the target code, the implicit calling logic for the target call point can be found from the lifecycle chain, that is, the pre-order callback function and post-order callback function of the target call point can be found from the lifecycle chain. In this way, the calling logic of the target call point can be improved through the lifecycle chain, and then the accuracy and completeness of the cross-method call chain determined subsequently can be improved.

[0150] It should be noted that after the target call point is determined this time, before step (3), it can be determined whether the target call point has a pre-order node and a post-order node in the target node set; if the target call point has a pre-order node in the target node set, then in step (3), there is no need to search for the pre-order callback function of the target call point in the target code and the life cycle chain; if the target call point has a post-order node in the target node set, then in step (3), there is no need to search for the post-order callback function of the target call point in the target code and the life cycle chain.

[0151] In some cases, if each target call point determined this time has a predecessor node and a successor node in the target node set, then this iteration process only determines the target call point, but step (3) is not executed. In this case, the nodes in the target node set do not change during this iteration process.

[0152] In other cases, if each target call point determined this time meets the following conditions: the target call point has a preceding node and a succeeding node in the target node set, or the target call point has a preceding node in the target node set and the succeeding node callback function of the target call point is not found in the target code and the lifecycle chain in step (3), or the target call point has a succeeding node in the target node set and the preceding node callback function of the target call point is not found in the target code and the lifecycle chain in step (3), then the nodes in the target node set will not change during this iteration.

[0153] (4) If the nodes in the target node set change during this iteration, and i is less than the preset number, the previous order callback function found is used as the target call point, and the subsequent order callback function found is used as the target call point, and i=i+1 is set, and the above step (3) is executed again.

[0154] Re-execute the above step (3) to start a new iteration process.

[0155] (5) If the nodes in the target node set have not changed during this iteration, and / or if i is equal to a preset number of times, one or more cross-method call chains are constructed based on all the nodes in the target node set.

[0156] Each of all nodes in the target node set has one or more preceding nodes and / or one or more succeeding nodes, so one or more cross-method call chains can be constructed based on all nodes in the target node set. A callback function in a cross-method call chain has a call edge with the next callback function, indicating that this callback function can call the next callback function, or that the next callback function can be called after executing this callback function.

[0157] For example, a cross-method call chain can be: onCreate() ->Wakelock.acquire() ->onStart() ->onResume() ->onPause() ->onStop() ->onDestroy(), and another cross-method call chain can be: onCreate() ->Wakelock.acquire() ->onStart() ->onResume() ->onPause() ->onStop() ->onRestart()->Wakelock.release() ->onStart() ->……->onDestroy().

[0158] Step 605: If the type of the external class of the Wakelock instance is not the type of the target component, the static program analyzer constructs one or more cross-method call chains where the Wakelock.acquire() is located in the target code, and then executes step 606.

[0159] If the type of the external class of the Wakelock instance is not the type of the target component, the target knowledge graph does not include the life cycle of the external class, so the cross-method call chain where Wakelock.acquire() is located can be directly constructed according to the target code.

[0160] In some embodiments, the operation of the static program analyzer constructing one or more cross-method call chains where the Wakelock.acquire() is located in the target code may include the following steps a to e:

[0161] Step a: Add the Wakelock.acquire() as a node to the target node set.

[0162] Step b: Set Wakelock.acquire() as the target call site and set i to 1.

[0163] Step c: Search the target call point's pre-order callback function and post-order callback function in the target code. If the target call point's pre-order callback function is found in the target code, the pre-order callback function is added to the target node set as the target call point's pre-order node. If the target call point's post-order callback function is found in the target code, the post-order callback function is added to the target node set as the target call point's post-order node.

[0164] Step d: If the nodes in the target node set change during this iteration and i is less than the preset number, the previous callback function found is used as the target call point, and the subsequent callback function found is used as the target call point, let i=i+1, and re-execute the above step c.

[0165] Step e: If the nodes in the target node set have not changed during this iteration, and / or if i is equal to a preset number, one or more cross-method call chains are constructed based on all the nodes in the target node set.

[0166] The operations of the above steps a to e are similar to the corresponding operations of steps (1) to (5) in the above step 604, and will not be described in detail in this embodiment of the present application.

[0167] Step 606: The static program analyzer traverses the function registration points in the target code; for each function registration point traversed, the first callback function registered by the function registration point is determined in the target code, and the second callback function containing the function registration point is determined in the target code, and the post-order call chain of the first callback function is searched from the target code. If the post-order call chain of the first callback function is not found in the target code, the post-order call chain of the first callback function is searched from the target knowledge graph, and a new cross-method call chain is constructed according to the first callback function, the post-order call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains.

[0168] The function registration point is used to perform function registration. The second callback function including the function registration point is the callback function that registers the function registration point.

[0169] The post-order call chain of the first callback function is one or more call chains in the target code starting from the post-order callback function of the first callback function. The post-order callback function of the first callback function can be a callback function called by the first callback function, or can be a callback function called after the first callback function is executed.

[0170] In an embodiment of the present application, after constructing a cross-method call chain where the first function in the target code is located through the target knowledge graph according to the function call points in the target code, a new cross-method call chain can be constructed according to the function registration points in the target code through the constructed cross-method call chain and the target knowledge graph. In this way, not only the function call situation but also the function registration situation is taken into consideration, so that the cross-method call chain where the first function in the target code is located can be obtained more accurately.

[0171] In some embodiments, the static program analyzer may construct a new cross-method call chain based on the first callback function, the post-order call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains. The operation may be: using the first callback function as the post-order callback function of the second callback function; for any cross-method call chain where the second callback function is located in the one or more cross-method call chains, constructing a new cross-method call chain based on the pre-order call chain of the second callback function in the cross-method call chain, the second callback function, the first callback function, and the post-order call chain of the first callback function.

[0172] The predecessor call chain of the second callback function in the cross-method call chain is a call chain of the predecessor callback function from the starting point of the cross-method call chain to the second callback function.

[0173] Since the post-order call chain of the first callback function may be one or more, the new cross-method call chain constructed based on the pre-order call chain of the second callback function, the second callback function, the first callback function and the post-order call chain of the first callback function in the cross-method call chain can also be one or more.

[0174] Step 607: The static program analyzer obtains multiple execution paths in the target code, each of the multiple execution paths having a constraint set.

[0175] The constraint set of an execution path is the set of constraint conditions for each edge in the execution path.

[0176] In some embodiments, the operation of step 607 may be: the static program analyzer generates an abstract syntax tree (AST) of the target code, constructs a control flow graph (CFG) according to the AST, traverses the CFG, and obtains multiple execution paths.

[0177] AST is an abstract representation of the target code, which captures the grammatical structure and hierarchical relationship of the target code. Each node in AST represents a grammatical unit in the target code, such as an expression, statement, declaration, etc. The connections and relationships between nodes in AST reflect the grammatical and semantic structure of the target code.

[0178] CFG is a graphical representation of the target code, which is used to describe the control flow transfer relationship when the target code is executed. CFG reflects the execution path of the target code, including sequential execution, conditional branches, loops and other structures. The edges between nodes in CFG can have constraints.

[0179] As an example, the operation of a static program analyzer to build a CFG based on an AST may be: identifying basic blocks in the AST, which are usually a group of statements executed sequentially; identifying control flow statements in the AST, which may include conditional statements (such as if, else, switch, etc.), loop statements (such as for, while, etc.), jump statements (such as break, continue, etc.), exception handling statements (such as try, catch, etc.), etc.; taking each basic block in the AST as a node in the CFG, and establishing edges between nodes in the CFG according to the control flow statements in the AST, for example, a conditional statement will result in two different paths, so there will be corresponding branch edges in the CFG.

[0180] As an example, the static program analyzer traverses the CFG to obtain multiple execution paths by: traversing the CFG using a depth-first search (DFS) algorithm, recording the multiple execution paths obtained through the traversal and recording the constraints of each edge in each execution path.

[0181] Step 608: The static program analyzer adds constraints to the call edges in each cross-method call chain in all constructed cross-method call chains according to the constraint set of each execution path in the multiple execution paths, to obtain the constraint set of each cross-method call chain.

[0182] The constraint set of a cross-method call chain is the set of constraint conditions of each call edge in the cross-method call chain.

[0183] In some embodiments, the operation of step 608 may be: for any cross-method call chain, search the target execution path that includes the cross-method call chain from the multiple execution paths, add the constraints of each edge in the target execution path to the corresponding call edge of the cross-method call chain, and use the set of constraints of each call edge in the cross-method call chain as the constraint set of the cross-method call chain.

[0184] Step 609: For any cross-method call chain among all constructed cross-method call chains, the constraint solver determines the reachability of the cross-method call chain according to the constraint set of the cross-method call chain; if the cross-method call chain is unreachable, the cross-method call chain is deleted; if the cross-method call chain is reachable, the cross-method call chain is retained.

[0185] The reachability of the cross-method call chain refers to whether the end point of the cross-method call chain can be reached from the starting point of the cross-method call chain through a series of call relationships in the cross-method call chain during actual execution. In other words, the cross-method call chain is reachable, which means that the cross-method call chain may be executed in actual application, and the cross-method call chain is unreachable, which means that the cross-method call chain will never be executed in actual application.

[0186] In the embodiment of the present application, the reachability of the cross-method call chain can be determined by analyzing whether there is a solution that satisfies the constraint set of the cross-method call chain.

[0187] In some embodiments, the operation of the constraint solver determining the reachability of the cross-method call chain based on the constraint set of the cross-method call chain can be: if there is a solution that satisfies the constraint set, then the cross-method call chain is determined to be reachable; if there is no solution that satisfies the constraint set, then the cross-method call chain is determined to be unreachable.

[0188] As an example, the constraint set can be solved by a Satisfiability Modulo Theories Solver (SMT) solver (such as Z3, etc.).

[0189] For example, after starting Z3, you can call Solver() to create a solver, then call add() with the constraint set as a parameter to add the constraint set to the solver, then call check() to check whether the constraint set has a solution, and finally call model() to obtain a solution that satisfies the constraint set.

[0190] For example, for a constraint set of a cross-method call chain “x>2, y<0, x + y = 0”, if the solver outputs a solution: [y = -3, x = 3], it can be determined that the cross-method call chain is reachable and the cross-method call chain is retained.

[0191] It should be noted that the embodiment of the present application analyzes the reachability of cross-method call chains, deletes unreachable cross-method call chains, and performs subsequent detection on the retained reachable cross-method call chains, thereby reducing the false alarm rate of code detection.

[0192] Step 610: For any cross-method call chain among all retained cross-method call chains, the rule checker determines whether there is Wakelock.release() after Wakelock.acquire() in the cross-method call chain; if so, it is determined that no Wakelock resource leakage occurs in the cross-method call chain; if not, it is determined that a Wakelock resource leakage occurs in the cross-method call chain.

[0193] In some embodiments, if a Wakelock resource leak occurs across the method call chain, a problem report may be generated, where the problem report is used to indicate the existence of a Wakelock resource leak problem.

[0194] For example, Figure 7 As shown, the problem report may include the location of Wakelock.acquire() in the cross-method call chain in the target code, and prompt that Wakelock is applied for at this location, but Wakelock release is not found in the current module.

[0195] For example, Figure 8 As shown, the problem report may also include a schematic diagram of the cross-method call chain. The schematic diagram may include the attributes of the callback function that calls Wakelock in the cross-method call chain, such as one or more attributes of ID, parameters, return value, call line, definition file path, trigger mechanism, related permissions, etc. The schematic diagram may also include relevant information of the Wakelock called in the cross-method call chain, such as the attributes of Wakelock (such as variable name, position, etc.), the instance methods called by Wakelock (such as acquire(), release(), etc.), and the corresponding permissions registered or unregistered by these instance methods (such as Full, Screen, Partial, etc.). Among them, Full is a full wake-up lock, which means keeping the device's screen and central processing unit (CPU) in a wake-up state. Screen is a wake-up lock with screen brightness control, which means keeping the device screen dimmed but not turned off so that certain operations can continue to run. Partial is a partial wake-up lock, which means allowing the device to enter the CPU sleep state, but still keeping some parts in a wake-up state.

[0196] If no Wakelock resource leak occurs in any cross-method call chain among all cross-method call chains, it can be determined that there is no Wakelock resource leak problem in the target code and the target code detection has passed. If at least one cross-method call chain among all cross-method call chains has a Wakelock resource leak, it can be determined that there is a Wakelock resource leak problem in the target code and the target code detection has failed.

[0197] It should be noted that, in some embodiments, if it is determined in step 603 that the type of the external class of the Wakelock instance is the type of the Activity component, the static program analyzer can directly search for onDestroy() in the target code and determine whether the onDestroy() calls Wakelock.release(); if the onDestroy() calls Wakelock.release(), it can be directly determined that there is no Wakelock resource leakage problem in the target code, that is, it is determined that the target code detection has passed, in which case there is no need to execute subsequent steps 604 to 610; if the onDestroy() does not call Wakelock.release(), the subsequent steps 604 to 610 can continue to be executed to determine whether there is a Wakelock resource leakage problem in the target code.

[0198] Next, the above code detection process is illustrated with examples in conjunction with exemplary target codes:

[0199] Assume the target code is as follows:

[0200] public class MainActivity extends Activity{

[0201] Wakelock mWakelock;

[0202] @Override

[0203] public void onCreate(Bundle savedInstanceState){

[0204] super.onCreate(savedInstanceState);

[0205] PowerManager pm = (PowerManager)getSystemService(Context.POWER_SERVICE);

[0206] mWakelock = pm.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "MyWakelock");

[0207] mWakelock.acquire();

[0208] Log.d(msg, "The onCreate() event");

[0209] }

[0210] @Override

[0211] protected void onStart(){

[0212] super.onStart();

[0213] Log.d(msg, "The onStart() event");

[0214] }

[0215] @Override

[0216] protected void onRestart(){

[0217] super.onRestart();

[0218] mWakelock.release();

[0219] Log.d(msg, "The onRestart() event");

[0220] }

[0221] @Override

[0222] protected void onDestroy(){

[0223] super.onDestroy();

[0224] Log.d(msg, "The onDestroy() event");

[0225] }

[0226] }

[0227] For the above target code, it is necessary to detect whether the Wakelock applied by calling mWakelock.acquire() in onCreate() has been released in all execution paths. Specifically, perform the following operations:

[0228] 1. Query the target knowledge graph and build the life cycle chain of the current Activity component.

[0229] Life cycle chain 1 is: onCreate() ->onStart() ->onResume() ->onPause() ->onStop() ->onDestroy(). Life cycle chain 2 is: onCreate() ->onStart() ->onResume() ->onPause() ->onStop() ->onRestart() ->…… ->onDestroy().

[0230] 2. Construct a constrained cross-method call chain in the target code based on the lifecycle chain.

[0231] Cross-method call chain 1 is: onCreate() ->mWakelock.acquire() ->onStart() ->onResume() ->onPause() ->onStop() ->onDestroy(). Cross-method call chain 2 is: onCreate()->mWakelock.acquire() ->onStart() ->onResume() ->onPause() ->onStop() ->onRestart() ->mWakelock.release() ->…… ->onDestroy().

[0232] 3. Solve constraints across method call chains.

[0233] Since the constraint set of cross-method call chain 1 and the constraint set of cross-method call chain 2 are both empty, cross-method call chain 1 and cross-method call chain 2 are retained.

[0234] 4. Check each cross-method call chain to determine if Wakelock resource leakage occurs in cross-method call chain 1.

[0235] It should be noted that the embodiments of the present application have strengthened the static code detection process in multiple dimensions, including enhancing the analysis accuracy in multiple aspects such as cross-method, context-sensitive, path-sensitive, and constraint-sensitive, thereby greatly reducing the false positive rate and missed negative rate of code detection, improving the detection effect of Wakelock resource leakage, and thus improving the code quality.

[0236] In an embodiment of the present application, the electronic device traverses the function call points in the target code to be detected; for each function call point traversed, when the function call point is Wakelock.acquire(), the type of the external class of the Wakelock instance corresponding to Wakelock.acquire() is determined; if the type of the external class is the type of the target component, the life cycle chain of the target component is constructed according to the target knowledge graph, and one or more cross-method call chains where the Wakelock.acquire() is located in the target code are constructed according to the life cycle chain. Afterwards, the function registration points in the target code are traversed; for each function registration point traversed, the first callback function registered by the function registration point is determined in the target code, and the second callback function containing the function registration point is determined in the target code, and the post-order call chain of the first callback function is searched from the target code and the target knowledge graph, and a new cross-method call chain is constructed according to the first callback function, the post-order call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains. Afterwards, based on the constraint set of each execution path in the multiple execution paths in the target code, a constraint set for each cross-method call chain is generated; based on the constraint set of each cross-method call chain, unreachable cross-method call chains are deleted. Finally, check whether Wakelock resource leakage occurs in each cross-method call chain. The embodiment of the present application can more accurately obtain all cross-method call chains where Wakelock.acquire() is located and reachable in the target code, and then analyze whether Wakelock resource leakage occurs in each cross-method call chain, which can reduce the false alarm rate and missed alarm rate of code detection and improve the code detection effect.

[0237] It should be noted that the code detection method provided in the embodiment of the present application can be used not only to detect the Wakelock resource leakage problem in the code, but also to detect other code defects, which is described in detail below:

[0238] The target code to be detected in the embodiment of the present application may be a code under development, or may be a code that has been developed. The target code may be a code applied to any operating system such as Android, iOS, Windows, etc.

[0239] The embodiment of the present application can construct a target knowledge graph in advance according to the API documentation of the operating system used by the target code. The target knowledge graph is used to reflect the relationship between various modules and various callback functions. The target code can be detected subsequently according to the constructed target knowledge graph.

[0240] For example, if the target code is Android code, a target knowledge graph can be constructed based on the Android API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the Android program. For example, the modules in the Android program can be Android components, such as Activity, Service, Broadcast Receiver, ContentProvider and other components. In this case, the target knowledge graph can reflect the life cycle chain of the Android component, and can also reflect the call chain related to various callback functions in the Android program.

[0241] For example, if the target code is iOS code, a target knowledge graph can be constructed based on the iOS API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the iOS program. For example, the modules in the iOS program may include view controllers, background modes, notifications, app extensions, etc. In this case, the target knowledge graph can reflect the time series call chain of the modules in the iOS program, and can also reflect the call chain related to various callback functions in the iOS program.

[0242] For example, if the target code is Windows code, a target knowledge graph can be constructed based on the Windows API document, and the target knowledge graph is used to reflect the relationship between various modules and various callback functions in the Windows program. For example, the modules in the Windows program may include application windows (App Windows), background tasks (BackgroundTasks), notifications (Notifications), application services (App Services), etc. In this case, the target knowledge graph can reflect the time series call chain of the modules in the Windows program, and can also reflect the call chain related to various callback functions in the Windows program.

[0243] It should be noted that the operation of constructing the target knowledge graph based on the API documentation of the operating system applied by the target code is similar to the operation of constructing the target knowledge graph based on the Android API documentation described in the above embodiment, and the embodiments of this application will not go into details about this.

[0244] In the embodiment of the present application, after the target knowledge graph is pre-built, code detection can be performed according to the target knowledge graph. The device for building the target knowledge graph and the device for performing code detection can be the same device or different devices, which is not limited in the embodiment of the present application.

[0245] Fig. 9is a schematic diagram of a code detection method provided in an embodiment of the present application. Fig. 9 , the method may include the following steps:

[0246] Step 901: The electronic device traverses the function call points in the target code to be detected.

[0247] The operation of step 901 is the same as above. Figure 6 The operation of step 601 in the embodiment is similar and will not be described in detail in the embodiment of the present application.

[0248] Step 902: For each traversed function call point, the electronic device determines whether the function call point is a first function for executing a first preset operation.

[0249] The first preset operation can be set in advance. The first preset operation can be set by a technician according to a code detection requirement, and the first preset operation is an operation related to a code defect that needs to be detected.

[0250] For example, the first preset operation may be a resource application operation, for example, the first preset operation may be an operation of applying for Wakelock, and the corresponding first function may be Wakelock.acquire(). In this case, the code defect to be detected may be a Wakelock not being released problem (i.e., a Wakelock resource leakage problem) or a Wakelock repeated release problem.

[0251] Of course, the first preset operation may also be other operations. For example, the first preset operation may be an operation of obtaining a database connection, an operation of obtaining a thread lock, etc. This embodiment of the present application does not limit this.

[0252] Step 903: If the function call point is the first function, the electronic device determines the type of the external class of the instance corresponding to the first function in the target code.

[0253] The external class of the instance is the class that declares the instance. The external class of the instance is the class of the object to which the instance belongs, that is, the class that declares the instance.

[0254] If the type of the external class of the instance is the type of the target module, execute step 904; if the type of the external class of the instance is not the type of the target module, execute step 905.

[0255] The target module is a module included in the target knowledge graph. For example, when the target code is Android code, the target module can be Figure 6 The target component described in the embodiments.

[0256] Step 904: If the type of the external class of the instance is the type of the target module, the electronic device constructs a time series call chain of the target module according to the target knowledge graph, and constructs one or more cross-method call chains where the first function in the target code is located according to the time series call chain, and then executes step 906.

[0257] If the type of the external class of the instance is the type of the target module, it means that the instance is related to the callback function of the target module. Therefore, the time series call chain of the target module can be constructed according to the nodes and edges related to the target module in the target knowledge graph.

[0258] The time series call chain of the target module describes a series of function calls that occur in chronological order, and these functions can be callback functions contained in the target module. In other words, the time series call chain of the target module includes multiple callback functions that exist in sequence. In this case, each callback function in the time series call chain can be called a node, and the calling relationship between a callback function and the next callback function can be called a call edge, which means that this callback function can call the next callback function, or that the next callback function can be called after executing this callback function. The predecessor callback function of a callback function is the previous callback function of this callback function, and the successor callback function of a callback function is the next callback function of this callback function.

[0259] For example, when the target module is a target component, the time series call chain of the target module may be a life cycle chain of the target component.

[0260] In some embodiments, the operation of the electronic device constructing one or more cross-method call chains where the first function in the target code is located according to the time series call chain may include the following steps (1) to (5):

[0261] (1) Add the first function as a node to the target node set.

[0262] (2) Take the first function as the target call point and let i be 1, where i is the number of iterations.

[0263] (3) Search for the pre-order callback function and post-order callback function of the target call point in the target code and the time series call chain, add the found pre-order callback function as the pre-order node of the target call point to the target node set, and add the found post-order callback function as the post-order node of the target call point to the target node set.

[0264] (4) If the nodes in the target node set change during this iteration and i is less than the preset number, the found pre-order callback function and post-order callback function are both used as the target call points, i=i+1, and the above step (3) is executed again.

[0265] (5) If the nodes in the target node set have not changed during this iteration, and / or if i is equal to a preset number of times, one or more cross-method call chains are constructed based on all the nodes in the target node set.

[0266] The operations of steps (1) to (5) above are the same as those in the previous Figure 6 The operations of steps (1) to (5) in step 604 in the embodiment are similar. For specific implementation, please refer to the above Figure 6 Embodiment, the embodiment of this application will not be described in detail.

[0267] Step 905: If the type of the external class of the instance is not the type of the target module, the electronic device constructs one or more cross-method call chains where the first function is located in the target code, and then executes step 906.

[0268] If the type of the external class of the instance is not the type of the target module, the target knowledge graph does not contain the time series call chain of the external class, so the cross-method call chain where the first function is located can be directly constructed according to the target code.

[0269] The operation of step 905 is the same as above. Figure 6 The operation of step 605 in the embodiment is similar, and the specific implementation can refer to the above Figure 6 Embodiment, the embodiment of this application will not be described in detail.

[0270] It should be noted that, in the embodiment of the present application, after executing the above step 904 or step 905, step 906 may be executed directly, or step A may be executed first and then step 906, or step B may be executed first and then step 906, or step A may be executed first and then step B and then step 906.

[0271] Step A: The electronic device traverses the function registration points in the target code; for each traversed function registration point, determines in the target code the first callback function registered by the function registration point, and determines in the target code the second callback function containing the function registration point; searches for the post-order call chain of the first callback function from the target code; if the post-order call chain of the first callback function is not found from the target code, searches for the post-order call chain of the first callback function from the target knowledge graph; constructs a new cross-method call chain based on the first callback function, the post-order call chain of the first callback function, and the cross-method call chain where the second callback function is located in one or more constructed cross-method call chains.

[0272] The operation of step A is the same as above Figure 6 The operation of step 606 in the embodiment is similar, and the specific implementation can refer to the above Figure 6Embodiment, the embodiment of this application will not be described in detail.

[0273] Step B: The electronic device obtains multiple execution paths in the target code, each of the multiple execution paths having a constraint set; according to the constraint set of each execution path in the multiple execution paths, constraints are added to the call edges in each cross-method call chain in all constructed cross-method call chains to obtain the constraint set of each cross-method call chain; for any cross-method call chain in all constructed cross-method call chains, the reachability of the cross-method call chain is determined according to the constraint set of the cross-method call chain; if the cross-method call chain is reachable, the cross-method call chain is retained; if the cross-method call chain is unreachable, the cross-method call chain is deleted.

[0274] The operation of step B is the same as above Figure 6 The operations of step 607 to step 609 in the embodiment are similar, and the specific implementation can refer to the above Figure 6 Embodiment, the embodiment of this application will not be described in detail.

[0275] Step 906: The electronic device determines whether the target code has a code defect related to the first preset operation based on all constructed cross-method call chains.

[0276] For example, the code defect can be determined based on a second function for performing a second preset operation. The second preset operation is an operation associated with the first preset operation. For example, the first preset operation is an operation for applying for Wakelock, and the corresponding first function may be Wakelock.acquire(); the second preset operation is an operation for releasing Wakelock, and the corresponding second function may be Wakelock.release().

[0277] In some embodiments, the operation of step 906 may be: for any cross-method call chain among all the constructed cross-method call chains, if the predecessor call chain and / or the successor call chain of the first function in the cross-method call chain meets the preset conditions, it is determined that the cross-method call chain has a defect; if each cross-method call chain among all the constructed cross-method call chains has a defect, or if at least one cross-method call chain among all the constructed cross-method call chains has a defect, it is determined that the target code has a code defect.

[0278] The pre-order call chain of the first function in the cross-method call chain is a call chain from the starting point of the cross-method call chain to the pre-order callback function of the first function. The post-order call chain of the first function in the cross-method call chain is a call chain from the post-order callback function of the first function to the end point of the cross-method call chain.

[0279] The preset condition can be set in advance, and the preset condition is a condition related to the second function. For example, the preset condition may be that the second function does not exist in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that the second function exists in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that there is only one second function in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain, or the preset condition may be that there are multiple second functions in the pre-order call chain and / or post-order call chain of the first function in the cross-method call chain.

[0280] In some cases, when each cross-method call chain in all cross-method call chains has a defect, it can be determined that the target code has a code defect; when at least one cross-method call chain in all cross-method call chains does not have a defect, it can be determined that the target code does not have a code defect.

[0281] In other cases, when at least one of all cross-method call chains has a defect, it can be determined that the target code has a code defect; when each cross-method call chain in all cross-method call chains does not have a defect, it can be determined that the target code does not have a code defect.

[0282] For example, the second function is Wakelock.release(), and the code defect is a Wakelock resource leakage problem. Then the preset condition may be that the second function does not exist in the subsequent call chain of the first function in the cross-method call chain.

[0283] In this case, the operation of step 906 is the same as above. Figure 6 The operation of step 610 in the embodiment is similar, and the specific implementation can refer to the above Figure 6 Embodiment, the embodiment of this application will not be described in detail.

[0284] For example, the second function is Wakelock.release(), and the code defect is the problem of repeated release of Wakelock. Then the preset condition may be that there are multiple second functions in the subsequent call chain of the first function in the cross-method call chain.

[0285] In this case, the operation of step 906 can be: for any cross-method call chain, determine whether there are multiple Wakelock.release() after Wakelock.acquire() in the cross-method call chain; if so, determine that the cross-method call chain has a Wakelock repeated release problem; if not, determine that the cross-method call chain does not have a Wakelock repeated release problem. If each cross-method call chain in all cross-method call chains does not have a Wakelock repeated release problem, it can be determined that the target code does not have a Wakelock repeated release problem, and the target code detection is determined to have passed; if at least one cross-method call chain in all cross-method call chains has a Wakelock repeated release problem, it can be determined that the target code has a Wakelock repeated release problem, and the target code detection is determined to have failed.

[0286] In an embodiment of the present application, the electronic device traverses the function call points in the target code to be detected; for each function call point traversed, if the function call point is a first function for performing a first preset operation, the type of the external class of the instance corresponding to the first function is determined in the target code; if the type of the external class is the type of the target module, a time series call chain of the target module is constructed according to the target knowledge graph, and one or more cross-method call chains where the first function is located in the target code are constructed according to the time series call chain. In this way, all cross-method call chains where the first function is located in the target code can be constructed more accurately, and then it can be determined whether the target code has code defects related to the first preset operation based on all the constructed cross-method call chains, which can reduce the false alarm rate and missed alarm rate of code detection and improve the code detection effect.

[0287] Fig.10 is a schematic diagram of the structure of a code detection device provided in an embodiment of the present application. The device can be implemented by software, hardware or a combination of both to form part or all of an electronic device. The electronic device can be as follows Fig.11 The electronic device described in the embodiment. Fig.10 The device includes: a traversal module 1001, a first determination module 1002, a first construction module 1003, a second construction module 1004 and a second determination module 1005.

[0288] A traversal module 1001 is used to traverse the function call points in the target code to be detected;

[0289] A first determination module 1002 is used to determine, for each traversed function call point, if the function call point is a first function for performing a first preset operation, a type of an external class of an instance corresponding to the first function in the target code;

[0290] The first construction module 1003 is used to construct a time series call chain of the target module according to the target knowledge graph if the type of the external class is the type of the target module. The target knowledge graph is used to reflect the relationship between various modules and various callback functions. The target module is a module included in the target knowledge graph;

[0291] A second construction module 1004 is used to construct one or more cross-method call chains where the first function is located in the target code according to the time series call chain of the target module;

[0292] The second determination module 1005 is used to determine whether the target code has a code defect related to the first preset operation according to all constructed cross-method call chains.

[0293] In an embodiment of the present application, the code detection device traverses the function call points in the target code to be detected; for each traversed function call point, if the function call point is a first function for performing a first preset operation, the type of the external class of the instance corresponding to the first function is determined in the target code; if the type of the external class is the type of the target module, a time series call chain of the target module is constructed according to the target knowledge graph, and one or more cross-method call chains where the first function is located in the target code are constructed according to the time series call chain. In this way, all cross-method call chains where the first function is located in the target code can be constructed more accurately, and then it can be determined whether the target code has code defects related to the first preset operation based on all the constructed cross-method call chains, which can reduce the false alarm rate and missed alarm rate of code detection and improve the code detection effect.

[0294] It should be noted that: the code detection device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example for code detection. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0295] The functional units and modules in the above embodiments may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit, and the above integrated units may be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the embodiments of the present application.

[0296] The code detection device and the code detection method provided in the above embodiments belong to the same concept. The specific working process of the units and modules in the above embodiments and the technical effects brought about can be found in the method embodiment part, which will not be repeated here.

[0297] Fig.11 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.11 The electronic device includes at least one processor 1101, a communication bus 1102, a memory 1103 and at least one communication interface 1104.

[0298] The processor 1101 may be a microprocessor (including a CPU, etc.), an application-specific integrated circuit (ASIC), or may be one or more integrated circuits for controlling the execution of the program of the present application.

[0299] The communication bus 1102 may include a pathway for transmitting information between the above-mentioned components.

[0300] The memory 1103 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disk (including a compact disc read-only memory (CD-ROM), a compressed optical disk, a laser disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1103 may exist independently and be connected to the processor 1101 via the communication bus 1102. The memory 1103 may also be integrated with the processor 1101.

[0301] The communication interface 1104 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0302] In a specific implementation, as an embodiment, the processor 1101 may include one or more CPUs, such as Fig.11 CPU0 and CPU1 are shown in the figure.

[0303] In a specific implementation, as an embodiment, the electronic device may include multiple processors, such as Fig.111 and 1105. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0304] In a specific implementation, as an embodiment, the electronic device may further include an output device 1106 and an input device 1107. The output device 1106 communicates with the processor 1101 and may display information in a variety of ways. For example, the output device 1106 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 1107 communicates with the processor 1101 and may receive user input in a variety of ways. For example, the input device 1107 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0305] The electronic device may be a general electronic device or a dedicated electronic device. In a specific implementation, the electronic device may be a desktop computer, a portable computer, a network server, a palmtop computer, a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device, etc. The embodiment of the present application does not limit the type of the electronic device.

[0306] The memory 1103 is used to store the program code 1110 for executing the solution of the present application, and the processor 1101 is used to execute the program code 1110 stored in the memory 1103. The electronic device can implement the code detection method described in the above embodiment through the processor 1101 and the program code 1110 in the memory 1103.

[0307] The embodiments of the present application do not particularly limit the specific structure of the execution subject of the code detection method, as long as the code that records the code detection method provided by the embodiments of the present application can be processed according to the code detection method provided by the embodiments of the present application. For example, the execution subject of the code detection method provided by the embodiments of the present application can be a functional module in an electronic device that can call and execute a program, or can be a processing device applied to an electronic device, such as a chip.

[0308] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0309] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0310] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0311] The embodiments of the present application also provide a computer program product. When the computer program product is run on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments.

[0312] The embodiment of the present application also provides a chip system, which includes a processor, the processor is coupled to a memory, and the processor executes a computer program stored in the memory to implement the steps of any method embodiment of the present application. The chip system can be a single chip or a chip module composed of multiple chips.

[0313] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instruction is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instruction may be transmitted from a website site, computer, server or data center by wired (such as: coaxial cable, optical fiber, data subscriber line (Digital Subscriber Line, DSL), etc.) or wireless (such as: infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape, etc.), an optical medium (such as a digital versatile disc (DVD), etc.), or a semiconductor medium (such as a solid state disk (SSD), etc.).

[0314] The above are optional embodiments provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the technical scope disclosed in the present application shall be included in the protection scope of the present application.

Claims

1. A code detection method, characterized in that: The method comprises: Traverse the function call points in the target code to be detected; For each traversed function call point, if the function call point is a first function for executing a first preset operation, determining in the target code the type of the external class of the instance corresponding to the first function; If the type of the external class is the type of the target module, a time series call chain of the target module is constructed according to the target knowledge graph, the target knowledge graph is constructed according to the application programming interface API document of the operating system applied by the target code, the target knowledge graph is used to reflect the relationship between various modules and various callback functions, and the target module is a module included in the target knowledge graph; Constructing one or more cross-method call chains where the first function in the target code is located according to the time series call chain of the target module; For any cross-method call chain among all constructed cross-method call chains, if the preceding call chain and / or the following call chain of the first function in the cross-method call chain meets a preset condition, it is determined that the cross-method call chain has a defect, where the preset condition is a condition related to a second function for performing a second preset operation, and the second preset operation is an operation associated with the first preset operation; If each of all the constructed cross-method call chains has a defect, or if at least one of all the constructed cross-method call chains has a defect, it is determined that the target code has a code defect.

2. The method according to claim 1, characterized in that The target knowledge graph is constructed based on the Android API document; the callback functions in the target knowledge graph include the life cycle functions of Android components, and also include one or more of the graphical user interface GUI interaction callback functions, system service callback functions, custom view callback functions, and asynchronous task callback functions.

3. The method according to claim 1, characterized in that The step of constructing one or more cross-method call chains where the first function in the target code is located according to the time series call chain of the target module includes: Adding the first function as a node to the target node set; The first function is used as the target call point, and i is set to 1, where i is the number of iterations; Searching for a pre-order callback function and a post-order callback function of the target call point in the target code and the time series call chain, adding the pre-order callback function as a pre-order node of the target call point to the target node set, and adding the post-order callback function as a post-order node of the target call point to the target node set; If the nodes in the target node set change during this iteration, and i is less than a preset number, both the pre-order callback function and the post-order callback function are used as target call points, i=i+1 is set, and the steps of searching the pre-order callback function and the post-order callback function of the target call point in the target code and the time series call chain and subsequent steps are re-executed; If the nodes in the target node set have not changed during this iteration, and / or if i is equal to a preset number, one or more cross-method call chains are constructed based on all the nodes in the target node set.

4. The method according to claim 3, characterized in that The step of searching the target call point's pre-order callback function and post-order callback function in the target code and the time series call chain, adding the pre-order callback function as the pre-order node of the target call point to the target node set, and adding the post-order callback function as the post-order node of the target call point to the target node set includes: Searching for a pre-order callback function and a post-order callback function of the target call point in the target code; If the preorder callback function of the target call point is found in the target code, the preorder callback function found is added to the target node set as the preorder node of the target call point; if the preorder callback function of the target call point is not found in the target code, the preorder callback function of the target call point is searched from the time series call chain, and the preorder callback function found is added to the target node set as the preorder node of the target call point; If the post-order callback function of the target call point is found in the target code, the post-order callback function found is added to the target node set as the post-order node of the target call point; if the post-order callback function of the target call point is not found in the target code, the post-order callback function of the target call point is searched from the time series call chain, and the post-order callback function found is added to the target node set as the post-order node of the target call point.

5. The method according to claim 1, characterized in that After determining the type of the external class of the instance corresponding to the first function in the target code, the method further includes: If the type of the external class is not the type of the target module, one or more cross-method call chains where the first function in the target code is located are constructed.

6. The method according to claim 1, characterized in that After constructing one or more cross-method call chains where the first function in the target code is located, the method further includes: Traversing function registration points in the target code; For each traversed function registration point, determining in the target code a first callback function registered at the function registration point, and determining in the target code a second callback function including the function registration point; Searching for a subsequent call chain of the first callback function from the target code; if the subsequent call chain of the first callback function is not found from the target code, searching for the subsequent call chain of the first callback function from the target knowledge graph; A new cross-method call chain is constructed according to the first callback function, the subsequent call chain of the first callback function, and the cross-method call chain where the second callback function is located in the one or more cross-method call chains.

7. The method according to claim 1, characterized in that Before determining whether the target code has a code defect related to the first preset operation according to all constructed cross-method call chains, the method further includes: Acquire multiple execution paths in the target code, each of the multiple execution paths having a constraint set; According to the constraint set of each execution path in the multiple execution paths, adding constraint conditions to the call edges in each cross-method call chain in all constructed cross-method call chains to obtain the constraint set of each cross-method call chain; For any cross-method call chain among all constructed cross-method call chains, determine the reachability of the cross-method call chain according to the constraint set of the cross-method call chain; If the cross-method call chain is reachable, retaining the cross-method call chain; If the cross-method call chain is unreachable, the cross-method call chain is deleted.

8. The method according to claim 7, characterized in that The determining the reachability of the cross-method call chain according to the constraint set of the cross-method call chain includes: If there is a solution that satisfies the constraint set of the cross-method call chain, it is determined that the cross-method call chain is reachable; If there is no solution that satisfies the constraint set of the cross-method call chain, it is determined that the cross-method call chain is unreachable.

9. The method according to any one of claims 1 to 8, characterized in that: The first preset operation is an operation of applying for a wake-up lock, and the second preset operation is an operation of releasing the wake-up lock; The code defect is a problem of wake-up lock not being released, and the preset condition is that the second function does not exist in the subsequent call chain of the first function in the cross-method call chain; or, the code defect is a problem of repeated release of the wake-up lock, and the preset condition is that there are multiple second functions in the subsequent call chain of the first function in the cross-method call chain.

10. An electronic device, characterized in that: The electronic device includes: one or more processors, and a memory; The memory is coupled to the one or more processors, and the memory is used to store computer program codes, wherein the computer program codes include computer instructions, and the one or more processors call the computer instructions to enable the electronic device to perform the method as claimed in any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, which, when executed on an electronic device, enable the electronic device to perform the method as claimed in any one of claims 1 to 9.

12. A computer program product, characterized in that When the computer program product is executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 9.

Images