Cache component pointer analysis method based on static analysis
By constructing multimodal pointer analysis rule set and dynamic pointer assignment diagram, the memory security detection problem of AppStorage component in the ArkTS language is solved, efficient and accurate memory leak detection and data synchronization are achieved, and the security and efficiency of ArkTS development are improved.
Patent Information
- Application Number
- CN202510632565.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-16
- Publication Date
- 2025-08-26
AI Technical Summary
In the ArkTS language and AppStorage components, existing pointer analysis technology cannot accurately track dynamic cross-component state synchronization, resulting in a decrease in memory security detection accuracy, low analysis efficiency, and the inability to identify memory leaks or data competition caused by the synchronization mechanism.
By constructing a multimodal pointer analysis rule set, the reverse reflux edge modeling of two-way synchronization and freeze constraint strategies are adopted, and the accessibility propagation algorithm is combined to accurately track the data flow of the cache component, establish a dynamic pointer assignment diagram, reduce redundant paths, and optimize ArkTS code adaptation.
It realizes high-precision memory leak detection, shortening the analysis time by 40-60%, reducing the memory footprint by 50%, supporting real-time analysis of million-level code bases, increasing the memory error detection rate to 95%, and reducing the adaptation cost by 80%.
Smart Images
Figure CN120540700A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of computer software engineering, and in particular to a cache component pointer analysis method based on static analysis. Background Art
[0002] With the rapid development of smart terminal devices and Internet of Things technologies, operating systems, as the core infrastructure of the software ecosystem, have gradually become a key area of technological competition. HarmonyOS has promoted the innovation of application development models with its distributed characteristics and cross-device collaboration capabilities. To optimize Harmony application development, OpenHarmony launched the ArkTS programming language, a statically typed language based on TypeScript extensions, with features such as type safety and efficient compilation. In particular, it implements cross-component state management and responsive data binding through the AppStorage cache component. However, with the increase in application complexity, the importance of pointer analysis technology in ArkTS program optimization, memory safety detection, and other aspects has become increasingly prominent.
[0003] Current status of technology
[0004] Pointer analysis, as a core technology for static program analysis, aims to determine the set of memory objects that a pointer variable may point to. Its mainstream methods include flow-sensitive / insensitive analysis (such as the Andersen algorithm) and context-sensitive / insensitive analysis. Traditional methods have achieved remarkable results in languages such as C / C++ and Java (such as the C language analysis framework proposed in [1] and the review of Java pointer analysis in [2]). Existing frameworks such as SPARK [3] and SVF [4] model program memory behavior by constructing a Pointer Assignment Graph (PAG), supporting alias analysis and data flow tracing.
[0005] Defects of existing technology
[0006] Although the above method works well in traditional languages, it has the following key issues when targeting the ArkTS language and AppStorage components:
[0007] 1. Insufficient language feature adaptation:
[0008] ArkTS's responsive data binding mechanism (such as the @StorageLink and @StorageProp decorators) introduces dynamic cross-component state synchronization. Traditional pointer analysis does not design rules for such features, resulting in the inability to accurately track the reverse dependencies of two-way synchronization (@Link) or the initial value freezing behavior of one-way synchronization (@Prop). For example, when a @Link variable is modified, its changes need to be reversed to the AppStorage source node, but existing methods lack the ability to model reverse data flows (references [3][4] do not address such scenarios).
[0009] 2. Lack of dynamic behavior processing in cache components:
[0010] AppStorage manages global state through key-value pairs, and its APIs (such as setOrCreate, link, and prop) involve dynamic storage unit creation and binding. Traditional analysis frameworks use general memory abstractions (such as the heap object model) and do not specifically model AppStorage's global property nodes, resulting in reduced analysis accuracy. For example, the Java analysis in reference [2] does not consider pointer aliasing relationships in shared storage across components, making it difficult to identify memory leaks or data races caused by synchronization mechanisms.
[0011] 3. Analyze efficiency and scalability bottlenecks:
[0012] Most existing methods are based on general static analysis frameworks and do not optimize the intermediate representation of ArkTS's syntactic sugar (such as decorator syntax). When parsing the AppStorage API, redundant instructions (such as high-order function calls) will cause the pointer assignment graph to expand in size, significantly increasing the analysis time complexity (reference [5] points out that the OpenHarmony ecosystem tool chain has efficiency deficiencies in such scenarios).
[0013] References
[0014] [1]ANDERSEN L O.Program Analysis and Specialization for the C Programming Language[J];
[0015] [2] Tan Tian, Ma Xiaoxing, Xu Chang, et al. A review of Java pointer analysis[J]. Computer Research and Development, 2023, 60(02): 274-293;
[0016] [3] O,HENDREN L.Scaling Java Points-to Analysis Using Spark[M / OL] / / HEDIN G.Compiler Construction:Volume 2622.Berlin,Heidelberg:Springe rBerlin Heidelberg,2003:153-169[2023-12-31].http: / / link.springer.com / 10.1007 / 3-540-36579-6_12.DOI:10.1007 / 3-540-36579-6_12;
[0017] [4]SUI Y,XUE J.SVF:interprocedural static value-flow analysis in LLVM[C / OL] / / Proceedings of the 25th International Conference on Compiler Construction.Barcelona Spain:ACM,2016:265-266[2025-03-17].https: / / dl.acm.org / doi / 10.1145 / 2892208.2892235.DOI:10.1145 / 2892208.2892235;
[0018] [5] LI L, GAO Summary of the Invention
[0019] This paper addresses the shortcomings of the existing technology and provides a cache component pointer analysis method based on static analysis, providing technical support for the efficient development and security optimization of the Hongmeng ecosystem.
[0020] In order to achieve the above object of the invention, the technical solution adopted by the present invention is as follows:
[0021] A cache component pointer analysis method based on static analysis includes the following steps:
[0022] Step S1: statically filter the AppStorage cache component-related APIs in the ArkTS framework based on semantic features and call context, and extract API call statements involving cache read and write operations;
[0023] Step S2: Construct a multimodal pointer analysis rule set to generate reverse dependency tracking rules and initialization freeze constraint strategies based on API operation types and synchronization modes. The synchronization modes include: @StorageLink bidirectional synchronization and @StorageProp unidirectional synchronization.
[0024] Step S3: Establish a dynamic pointer assignment graph model, construct cross-component data flow by injecting reverse backflow edges, and combine the reachability propagation algorithm to update the reference topology of storage units and UI variables in real time to achieve accurate derivation of pointer sets.
[0025] Furthermore, the ArkTS source code is converted into a three-address code intermediate representation, cache operation instructions are filtered based on opcode pattern matching, and semantic verification is performed with the predefined AppStorage API library through method signatures to generate a call instruction sequence with operation semantic annotations.
[0026] Furthermore, the reverse dependency tracing rule in step S2 is implemented in the following manner:
[0027] For the @StorageLink decorator variable, a reverse dependency edge is injected into each AppStorage.key node in the pointer assignment graph to construct a strongly connected component SCC(V,E), so that data changes between components are synchronized in real time through bidirectional backflow edges.
[0028] Furthermore, the initialization of the freezing constraint strategy in step S2 is achieved by:
[0029] For @StorageProp decorator variables, only one-way data flow edges are retained in the pointer assignment graph. When a local modification operation is detected, reverse propagation to the source AppStorage.key node is prevented, forming a pointer set constraint with frozen initial values.
[0030] Furthermore, the dynamic pointer assignment graph modeling in step S3 includes:
[0031] The three-address code variables are abstracted into graph nodes, and the pointer set is iteratively propagated through the Andersen-style pointer analysis algorithm. The write operation on the @StorageLink variable updates the AppStorage.key node pointer set through the reverse backflow edge, while the write operation on the @StorageProp variable only affects the local node pointer set.
[0032] Furthermore, the global attribute node AppStorage.field is introduced as the cache source node in the pointer assignment graph to replace the key-value pair storage structure, so that each AppStorage.key node corresponds to a unique attribute node, and a cache topology shared by multiple components is generated through the cloning mechanism.
[0033] Furthermore, the reachability propagation algorithm is specifically as follows:
[0034] Mark the cross-component data flow edges in the pointer assignment graph. When a component tree update event is detected, traverse all associated nodes along the reachable path, automatically prune redundant reference paths and update pointer alias relationships.
[0035] The present invention also discloses an electronic device, characterized in that it includes a processor and a memory, the memory stores a computer program, and the processor implements the cache component pointer analysis method when executing the computer program.
[0036] The present invention also discloses a computer-readable storage medium, characterized in that a computer program is stored therein, and when the computer program is executed by a processor, the cache component pointer analysis method is implemented.
[0037] Compared with the prior art, the advantages of the present invention are:
[0038] 1. High-precision pointer analysis
[0039] By modeling bidirectional synchronization (@StorageLink) with reverse backflow edges and handling unidirectional synchronization (@StorageProp) with frozen constraints, dynamic data flows can be accurately tracked, reducing the analysis false alarm rate from 20% to 5% and increasing the accuracy of memory leak detection to 98%.
[0040] 2. Efficient analysis framework
[0041] Based on API filtering and incremental graph update technology, it filters out 90% of irrelevant instructions, shortens analysis time by 40%-60%, reduces memory usage by 50%, and supports real-time analysis of millions of code bases.
[0042] 3. ArkTS deep adaptation
[0043] By adopting global attribute node abstraction and multimodal rule engine, the code adaptation cost is reduced by 80%, the rule configuration time is shortened from several hours to minutes, and it is compatible with all ArkTS decorator syntax scenarios.
[0044] 4. Improved system stability
[0045] Accurately identify problems such as circular references and dangling pointers, achieve a memory error detection rate of 95%, shorten the synchronization mechanism defect repair cycle by 50%, and ensure application security and stability.
[0046] 5. Ecological compatibility and expansion
[0047] Seamlessly integrate the OpenHarmony tool chain, support LLVM IR conversion and mainstream analysis frameworks, shorten the new function adaptation cycle from several weeks to 3-5 days, and have strong scalability. BRIEF DESCRIPTION OF THE DRAWINGS
[0048] Figure 1 This is an architecture diagram of a cache component pointer analysis modeling method according to an embodiment of the present invention.
[0049] Figure 2 2 is a diagram of a pattern matching algorithm according to an embodiment of the present invention.
[0050] Figure 3 This is a diagram of a pointer analysis and propagation algorithm according to an embodiment of the present invention.
[0051] Figure 4 2 is an example diagram of the analysis results of an embodiment of the present invention. DETAILED DESCRIPTION
[0052] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and examples.
[0053] The present invention designs and implements a pointer analysis modeling method for the Hongmeng application UI state storage component. Figure 1 The core workflow framework of the invention is shown, which mainly includes three processes:
[0054] (1) Cache component API screening: A static screening mechanism based on semantic features and call context is used to extract API call statements involving AppStorage read and write operations in the ArkTS framework.
[0055] (2) Construction of multimodal pointer analysis rule set: Implement hierarchical classification based on API operation type (read / write / bind) and synchronization mode (unidirectional / bidirectional), apply reverse dependency tracing rules to @StorageLink decorator variables, and adopt initialization freeze constraint strategy for @StorageProp variables.
[0056] (3) Dynamic pointer assignment graph modeling: Construct an incremental pointer assignment graph and establish cross-component data flow edges. Use the reachability propagation algorithm to update the reference topology of storage units and UI variables in real time, achieving accurate derivation of alias relationships and automatic pruning of redundant paths.
[0057] The details of the above steps are described in detail below.
[0058] 1. Cache component API screening
[0059] The method first establishes a conversion and screening mechanism from source code to a set of API call statements. This stage uses the three-address code intermediate representation as the core carrier, and accurately captures AppStorage-related operations in the ArkTS framework through multi-level static analysis. The process starts with the three-address conversion of the source code. This step converts the ArkTS component code in the Hongmeng application into a three-address intermediate representation with explicit memory operation semantics through syntax tree traversal, eliminating the parsing interference caused by high-level syntax sugar. During the three-address code generation process, the front end will annotate the synchronization variables marked in the source code with StorageLink / StorageProp decorator metadata to establish a basic data layer for subsequent screening.
[0060] The main body of the process includes a two-level screening strategy: the first round of screening is based on opcode pattern matching, matching all call statements in the three-address code instruction sequence, preliminarily building a set of candidate call statements, and filtering out instructions that are not related to pointer analysis and cache read and write operations.
[0061] The second round of screening focuses on semantic verification of method signatures, analyzing each call statement in the candidate set. The analyzer extracts the method signature information of the call point and performs a fuzzy match against the AppStore predefined API signature library. This double screening of the API call statement set ultimately forms a three-address call instruction sequence with complete operational semantic annotations, providing structured input for the subsequent construction of the pointer analysis rule set.
[0062] In the construction phase of the multimodal pointer analysis rule set, the system uses the set of API call statements obtained in the first phase as the structured input source. In the pre-processing phase, the system pre-parses the call target method signature of each statement. When the method signature contains AppStorage cache operations, the rule engine passes it to the pattern recognizer, which performs multi-dimensional feature matching based on the operation semantic vector. The specific algorithm is as follows: Figure 2 For API calls that create new cache entities (such as AppStorage.setOrCreate), the rule generator extracts the type parameterization information and parses the parameters to obtain the cache key-value pairs. This information is then fed into the PAG (Pointer Assignment Graph) engine, which creates and clones the corresponding AppStorage.key node to store the obj parameter object.
[0063] For API calls that read the cache (such as AppStorage.get), the system will use the pre-stored key to match and search in all clone nodes, and connect the found target node and the return value node in the pointer assignment graph to achieve correct transfer and association of pointers.
[0064] During the storage process, in order to implement a differentiated synchronization mechanism for props and links, this system innovatively introduces a reverse reflux edge injection strategy. When processing link synchronization, the system not only establishes a forward pointer edge from the parameter variable to AppStorage.key, but also injects a reverse dependency edge, thereby constructing a strongly connected component SCC(V,E) in the pointer assignment graph (where V represents a vertex set and E represents an edge set). This strongly connected structure ensures real-time synchronization between all associated references, and maintains data consistency regardless of forward updates or reverse reflux. As for the prop synchronization mechanism, the traditional basic strategy is continued. Due to the lack of reverse edges in its pointer topology, its pointer set only supports one-way data flow. This design prevents local modifications to prop references from being propagated back to the source attribute node, ensuring that the synchronization behavior of props is directional and local, thereby meeting its needs in one-way data binding scenarios.
[0065] 2. Dynamic pointer assignment graph modeling
[0066] In this stage, this embodiment provides a graph engine for constructing a pointer assignment graph to solve the constraints. The graph engine provides external operation interfaces for nodes and edges. The pointer analysis rules obtained in the previous stage will be visualized as specific nodes and pointer flow edges in this engine. All variables in the three-address code will be represented by nodes, and all pointer flows in the rules will be represented by edges. After the basic graph data structure is constructed, Figure 3 The pointer analysis propagation algorithm in the iterative. This algorithm provides an Andersen-style pointer analysis propagation algorithm. When the cache object is abstracted, it will be passed between variables as a pointer according to the algorithm. The simplified result is as follows Figure 4 As shown, the declarations of the link and prop variables are shared across two programs, but subsequent writes to different synchronization variables yield different analysis results: Writing to the link variable, due to the presence of a reverse backflow edge, also writes the corresponding object to the pointer set of the AppStorage.key node, affecting the pointer set of the prop variable. However, writing to the prop variable has no effect on the AppStorage.key node, nor does it change the contents of the link variable. This approach enables modeling and processing of different synchronization methods for cache components.
[0067] In another embodiment of the present invention, a terminal device is provided, which includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the cache component pointer analysis method.
[0068] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It can be understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and, of course, the extended storage medium supported by the terminal device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space. These instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory.
[0069] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the cache component pointer analysis method in the above embodiment; one or more instructions in a computer-readable storage medium are loaded and executed by a processor.
[0070] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0071] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0072] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0074] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the implementation methods of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.
Claims
1. A cache component pointer analysis method based on static analysis, characterized by: The following steps are involved: Step S1: statically filter the AppStorage cache component-related APIs in the ArkTS framework based on semantic features and call context, and extract API call statements involving cache read and write operations; Step S2: Construct a multimodal pointer analysis rule set to generate reverse dependency tracking rules and initialization freeze constraint strategies based on API operation types and synchronization modes. The synchronization modes include: @StorageLink bidirectional synchronization and @StorageProp unidirectional synchronization. Step S3: Establish a dynamic pointer assignment graph model, construct cross-component data flow by injecting reverse backflow edges, and combine the reachability propagation algorithm to update the reference topology of storage units and UI variables in real time to achieve accurate derivation of pointer sets.
2. The cache component pointer analysis method according to claim 1, characterized in that: The ArkTS source code is converted into a three-address code intermediate representation, cache operation instructions are filtered based on opcode pattern matching, and semantic verification is performed with the predefined AppStorage API library through method signatures to generate a call instruction sequence with operation semantic annotations.
3. The cache component pointer analysis method according to claim 1, characterized in that: The reverse dependency tracking rule in step S2 is implemented in the following way: For the @StorageLink decorator variable, a reverse dependency edge is injected into each AppStorage.key node in the pointer assignment graph to construct a strongly connected component SCC(V,E), so that data changes between components are synchronized in real time through bidirectional backflow edges.
4. The cache component pointer analysis method according to claim 1, characterized in that: Initializing the freezing constraint strategy in step S2 is achieved by: For @StorageProp decorator variables, only one-way data flow edges are retained in the pointer assignment graph. When a local modification operation is detected, reverse propagation to the source AppStorage.key node is prevented, forming a pointer set constraint with frozen initial values.
5. The cache component pointer analysis method according to claim 1, characterized in that: The dynamic pointer assignment graph modeling in step S3 includes: The three-address code variables are abstracted into graph nodes, and the pointer set is iteratively propagated through the Andersen-style pointer analysis algorithm. The write operation on the @StorageLink variable updates the AppStorage.key node pointer set through the reverse backflow edge, while the write operation on the @StorageProp variable only affects the local node pointer set.
6. The cache component pointer analysis method according to claim 1, characterized in that: In the pointer assignment graph, the global attribute node AppStorage.field is introduced as the cache source node to replace the key-value pair storage structure, so that each AppStorage.key node corresponds to a unique attribute node, and a cache topology shared by multiple components is generated through the cloning mechanism.
7. The cache component pointer analysis method according to claim 1, characterized in that: The reachability propagation algorithm is specifically as follows: Mark the cross-component data flow edges in the pointer assignment graph. When a component tree update event is detected, traverse all associated nodes along the reachable path, automatically prune redundant reference paths and update pointer alias relationships.
8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, the cache component pointer analysis method according to any one of claims 1 to 7 is implemented.
9. A computer-readable storage medium, characterized in that A computer program is stored, and when the computer program is executed by a processor, the cache component pointer analysis method according to any one of claims 1 to 7 is implemented.