An object code segment acquisition method and apparatus

Abstract

The application discloses a target code segment acquisition method and device, relates to the technical field of computers, and can reduce the time cost and false positive rate of running sequence analysis. In the application, intermediate code of an application program and dynamic data including a running track function acquired when the application program is running are acquired, functions different from the running track function in the intermediate code are removed, and a target function of the intermediate code is obtained; running sequence analysis is performed on the target function, and a first target code segment in which the running sequence of the code in the target function is different from a preset sequence is obtained. Based on the target code segment acquisition method provided in the application, the analysis range of application program running sequence analysis can be reduced, and the time cost and false positive rate can be reduced.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for obtaining target code segments. Background Technology

[0002] When an application runs in a weak memory ordering architecture, out-of-order instruction execution between multiple threads may occur, causing the execution results to deviate from the developer's expectations. Therefore, it is necessary to perform runtime order analysis on the application to identify and fix the out-of-order code segments. One approach is to obtain the application's intermediate representation (IR) and perform static runtime order analysis to identify out-of-order code segments. However, this method is too time-consuming, especially in cases of complex events and / or large codebases, where it is not only time-consuming but also has a high false positive rate. Summary of the Invention

[0003] This application provides a method and apparatus for obtaining target code segments, which can reduce the time cost and false alarm rate of application execution sequence analysis.

[0004] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0005] Firstly, a method for obtaining a target code segment is provided. The method includes: obtaining intermediate code of an application and dynamic data including execution trajectory functions obtained when the application is running; removing functions in the intermediate code that are different from the execution trajectory functions to obtain the target function of the intermediate code; and performing execution order analysis on the target function to obtain a first target code segment whose execution order of the code in the target function is different from the preset order.

[0006] The solution provided in the first aspect above allows the target code segment acquisition device to remove functions that will not be called during the application's runtime from the intermediate code after obtaining the application's intermediate code and dynamic data containing the running trajectory function, thereby obtaining the target function. Further, the execution order analysis of the target function is performed to obtain the first target code segment, thus avoiding the need to perform execution order analysis on the entire intermediate code, narrowing the scope of application execution order analysis, and thereby reducing time costs and false alarm rates.

[0007] In some examples, the default order can refer to the execution order of the application as set by the developer.

[0008] In one possible implementation, the dynamic data also includes function jump data acquired during application runtime. The aforementioned analysis of the execution order of the target functions to obtain the first target code segment includes: correcting the call relationships between target functions based on the function jump data; and performing execution order analysis on the corrected call relationships to obtain the first target code segment. Thus, by correcting the call relationships between target functions using function jump data, the actual call relationships used by the target functions during runtime can be obtained, thereby improving the accuracy of the target function call relationships and the accuracy of the first target code segment.

[0009] In one possible implementation, the above-mentioned modification of the call relationships between target functions based on function jump data includes: obtaining a reference function call graph of the target functions, the reference function call graph representing the call relationships between target functions; and modifying the reference function call graph based on the function jump data to obtain a tree-structured function call graph. Thus, by transforming the reference function call graph into a tree-structured function call graph using function jump data, the complexity of function call graph analysis can be reduced, and the efficiency of application execution sequence analysis can be improved.

[0010] In one possible implementation, the above-mentioned modification of the reference function call graph based on function jump data to obtain the function call graph includes: deleting call relationships not represented by the function jump data in the reference function call graph; and / or adjusting non-tree-structured call relationships in the reference function call graph to tree-structured call relationships, where the non-tree structure includes circular structures. In this way, call relationships not used by the target function at runtime can be removed through function jump data, improving the accuracy of call relationships; by adjusting circular call relationships to tree-structured call relationships, the complexity of function call graph analysis can be reduced, and the efficiency of application execution sequence analysis can be improved.

[0011] In one possible implementation, adjusting the non-tree-structured call relationships in the reference function call graph to a tree-structured call relationship includes: determining the callback functions and callback call relationships in the circular structure based on function jump data; deleting the callback call relationships; and copying the remaining call relationships in the circular structure after deleting the callback call relationships, using the callback functions as the starting point, to obtain the function call graph. This allows the circular call relationships to be adjusted to a tree-structured call relationship, reducing the complexity of function call graph analysis and improving the efficiency of application execution sequence analysis.

[0012] In one possible implementation, the method further includes: obtaining the first alias analysis result corresponding to the intermediate code and the second alias analysis result corresponding to the dynamic data; correcting the first alias analysis result based on the dynamic data and the second alias analysis result to obtain a third alias analysis result including variables with alias relationships; and performing execution order analysis on the intermediate code based on the third alias analysis result to obtain the second target code segment. Thus, since the second alias analysis result corresponding to the dynamic data can represent the alias analysis result during application runtime, correcting the first alias analysis result using dynamic data and the second alias analysis result can make the obtained third alias analysis result more accurate (for example, variables with alias relationships in the first alias analysis result may be corrected to non-alias relationships), thereby reducing the number of variables with alias relationships, narrowing the scope of subsequent execution order analysis of the intermediate code, improving the efficiency of application execution order analysis, and reducing the false positive rate.

[0013] As an example, dynamic data also includes the virtual addresses of variables, and the second aliasing analysis result is obtained based on the virtual addresses of the variables. For instance, an object code segment acquisition device can determine which variables might point to the same memory space based on the virtual addresses of the variables, thereby obtaining the second aliasing analysis result.

[0014] In one possible implementation, the intermediate code includes multiple first data memory access instructions, and the dynamic data includes multiple second data memory access instructions. The above-mentioned modification of the first alias analysis result based on the dynamic data and the second alias analysis result to obtain the third alias analysis result includes: obtaining the mapping relationship between the multiple first data memory access instructions and the multiple second data memory access instructions; and modifying the first alias analysis result based on the mapping relationship and the second alias analysis result to obtain the third alias analysis result. In this way, the multiple first data memory access instructions and the multiple second data memory access instructions can be associated to form a mapping relationship. Therefore, based on the mapping relationship, the first alias analysis result can be modified using the second alias analysis result to obtain the third alias analysis result, thus improving the accuracy of the third alias analysis result.

[0015] As an example, the statement corresponding to the first data memory access instruction with a mapping relationship is the same as or corresponds to the statement corresponding to the second data memory access instruction.

[0016] In some examples, the statement corresponding to the first data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the first data memory access instruction, and the statement corresponding to the second data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the second data memory access instruction.

[0017] In some examples, since the first memory access instruction is generated during the compilation of the application, the statements in the source code file that are compiled into the first memory access instruction correspond to the first memory access instruction. The second memory access instruction is generated during the execution of the application; therefore, the statements in the source code file that generate the second memory access instruction correspond to the second memory access instruction.

[0018] For example, suppose statement 1 in the source code file is compiled into instruction A in the first data memory access instruction, then the statement corresponding to instruction A is statement 1 in the source code file. Suppose that during application runtime, instruction B in the second data memory access instruction is generated through statement 2 in the source code file, then the statement corresponding to instruction B is statement 2 in the source code file.

[0019] In some examples, the statement corresponding to the first data memory access instruction is the same as the statement corresponding to the second data memory access instruction, indicating that the first data memory access instruction and the second data memory access instruction correspond to the same statement in the source code file.

[0020] For example, suppose the first data memory access instruction is instruction A and the second data memory access instruction is instruction B. If the statement corresponding to instruction A is statement 1 in the source code file and the statement corresponding to instruction B is statement 1 in the source code file, then the statement corresponding to the first data memory access instruction is the same as the statement corresponding to the second data memory access instruction, and it can be determined that there is a mapping relationship between instruction A and instruction B.

[0021] In some examples, the correspondence between the statement corresponding to the first memory access instruction and the statement corresponding to the second memory access instruction indicates that the first and second memory access instructions correspond to statements with the same meaning in the source code file. For instance, suppose the first memory access instruction is instruction A and the second memory access instruction is instruction B. If the statement corresponding to instruction A is statement 1 in the source code file, and the statement corresponding to instruction B is statement 2 in the source code file, and statements 1 and 2 have the same meaning, then the correspondence between the statement corresponding to the first memory access instruction and the statement corresponding to the second memory access instruction confirms a mapping relationship between instruction A and instruction B.

[0022] As an example, the dynamic data also includes address information corresponding to each of the multiple second data memory access instructions. The statements corresponding to these instructions are derived from this address information. Thus, the statements corresponding to the multiple second data memory access instructions can be obtained from their respective address information, thereby determining the mapping relationship between the multiple first and second data memory access instructions, which facilitates the correction of subsequent alias analysis results.

[0023] In one possible implementation, the process of obtaining the third alias analysis result based on the mapping relationship, the first alias analysis result, and the second alias analysis result includes: obtaining multiple sets of related variables based on the mapping relationship, each set including variables included in the first and second data memory access instructions with a mapping relationship; obtaining the first alias relationship corresponding to each of the multiple sets of related variables based on the first alias analysis result; obtaining the second alias relationship corresponding to each of the multiple sets of related variables based on the second alias analysis result; determining the third alias relationship corresponding to each of the multiple sets of related variables based on the first and second alias relationships; and obtaining the third alias analysis result based on the third alias relationships corresponding to each of the multiple sets of related variables. In this way, the third alias relationship corresponding to each of the multiple sets of related variables can be obtained based on the first and second alias relationships, thereby improving the accuracy of the third alias analysis result.

[0024] In one possible implementation, determining the third alias relationship for each of the multiple sets of associated variables based on their respective first and second alias relationships includes: if the first alias relationship indicates that the associated variable set is an alias relationship and the second alias relationship indicates that the associated variable set is not an alias relationship, then the probability that the third alias relationship indicates that the associated variable set is an alias relationship is high; if the probability that the first alias relationship indicates that the associated variable set is an alias relationship is high and the second alias relationship indicates that the associated variable set is an alias relationship, then the probability that the third alias relationship indicates that the associated variable set is an alias relationship is high; if the first... If a first alias relationship indicates a high probability that a group of related variables is an alias relationship, and a second alias relationship indicates that a group of related variables is not an alias relationship, then a third alias relationship is determined to indicate that the group of related variables is not an alias relationship. Similarly, if a first alias relationship indicates that a group of related variables is not an alias relationship, and a second alias relationship indicates that a group of related variables is an alias relationship, then a third alias relationship is determined to indicate a high probability that the group of related variables is an alias relationship. Likewise, if a first alias relationship indicates that a group of related variables is not an alias relationship, and a second alias relationship indicates a high probability that a group of related variables is an alias relationship, then a third alias relationship is determined to indicate a high probability that the group of related variables is an alias relationship. Thus, by combining various first and second alias relationships, different third alias relationships can be obtained, thereby allowing for more accurate correction of the first alias relationships and improving the accuracy of subsequent application execution sequence analysis.

[0025] Secondly, a method for obtaining a target code segment is provided. The method includes: obtaining intermediate code and dynamic data of an application; obtaining a first alias analysis result corresponding to the intermediate code and a second alias analysis result corresponding to the dynamic data; correcting the first alias analysis result based on the dynamic data and the second alias analysis result to obtain a third alias analysis result, the third alias analysis result including variables with alias relationships; and performing execution sequence analysis on the intermediate code according to the third alias analysis result to obtain a second target code segment.

[0026] As an example, dynamic data includes the virtual addresses of variables, and the second alias analysis result is obtained based on the virtual addresses of the variables.

[0027] In one possible implementation, the intermediate code includes multiple first data memory access instructions, and the dynamic data also includes multiple second data memory access instructions. The first alias analysis result is modified based on the dynamic data and the second alias analysis result to obtain the third alias analysis result, which includes: obtaining the mapping relationship between the multiple first data memory access instructions and the multiple second data memory access instructions; and modifying the first alias analysis result based on the mapping relationship and the second alias analysis result to obtain the third alias analysis result.

[0028] As an example, the statement corresponding to the first data memory access instruction with a mapping relationship is the same as or corresponds to the statement corresponding to the second data memory access instruction.

[0029] In some examples, the statement corresponding to the first data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the first data memory access instruction, and the statement corresponding to the second data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the second data memory access instruction.

[0030] In some examples, since the first memory access instruction is generated during the compilation of the application, the statements in the source code file that are compiled into the first memory access instruction correspond to the first memory access instruction. The second memory access instruction is generated during the execution of the application; therefore, the statements in the source code file that generate the second memory access instruction correspond to the second memory access instruction.

[0031] For example, suppose statement 1 in the source code file is compiled into instruction A in the first data memory access instruction, then the statement corresponding to instruction A is statement 1 in the source code file. Suppose that during application runtime, instruction B in the second data memory access instruction is generated through statement 2 in the source code file, then the statement corresponding to instruction B is statement 2 in the source code file.

[0032] In some examples, the statement corresponding to the first memory access instruction being the same as the statement corresponding to the second memory access instruction means that the first and second memory access instructions correspond to the same statement in the source code file. The statement corresponding to the first memory access instruction being identical to the statement corresponding to the second memory access instruction means that the first and second memory access instructions correspond to statements with the same meaning in the source code file.

[0033] For example, suppose the first data memory access instruction is instruction A and the second data memory access instruction is instruction B. If the statement corresponding to instruction A is statement 1 in the source code file and the statement corresponding to instruction B is statement 1 in the source code file, then it can be determined that the statement corresponding to the first data memory access instruction is the same as the statement corresponding to the second data memory access instruction. If the statement corresponding to instruction A is statement 1 in the source code file and the statement corresponding to instruction B is statement 2 in the source code file, and statement 1 and statement 2 have the same meaning, then it can be determined that the statement corresponding to the first data memory access instruction corresponds to the statement corresponding to the second data memory access instruction.

[0034] As an example, dynamic data also includes address information corresponding to each of the multiple second data memory access instructions, and the statements corresponding to the multiple second data memory access instructions are obtained based on the address information corresponding to each of the multiple second data memory access instructions.

[0035] In one possible implementation, obtaining the third alias analysis result based on the mapping relationship, the first alias analysis result, and the second alias analysis result includes: obtaining multiple sets of related variables based on the mapping relationship, each set of related variables including the variables included in the first data memory access instruction and the second data memory access instruction with the mapping relationship; obtaining the first alias relationship corresponding to each of the multiple sets of related variables based on the first alias analysis result; obtaining the second alias relationship corresponding to each of the multiple sets of related variables based on the second alias analysis result; determining the third alias relationship corresponding to each of the multiple sets of related variables based on the first alias relationship and the second alias relationship corresponding to each of the multiple sets of related variables; and obtaining the third alias analysis result based on the third alias relationship corresponding to each of the multiple sets of related variables.

[0036] In one possible implementation, determining the third alias relationship for each of the multiple sets of associated variables based on their respective first and second alias relationships includes: if the first alias relationship indicates that the associated variable set is an alias relationship and the second alias relationship indicates that the associated variable set is not an alias relationship, then the probability that the third alias relationship indicates that the associated variable set is an alias relationship is high; if the probability that the first alias relationship indicates that the associated variable set is an alias relationship is high and the second alias relationship indicates that the associated variable set is an alias relationship, then the probability that the third alias relationship indicates that the associated variable set is an alias relationship is high; if the first... If the first alias relationship indicates a high probability that the associated variable group is an alias relationship, and the second alias relationship indicates that the associated variable group is not an alias relationship, then the third alias relationship indicates that the associated variable group is not an alias relationship. If the first alias relationship indicates that the associated variable group is not an alias relationship, and the second alias relationship indicates that the associated variable group is an alias relationship, then the third alias relationship indicates a high probability that the associated variable group is an alias relationship.

[0037] In one possible implementation, the dynamic data also includes the execution trajectory function obtained when the application is running. The method further includes: removing functions in the intermediate code that are different from the execution trajectory function to obtain the target function of the intermediate code; performing execution order analysis on the target function to obtain a first target code segment whose execution order is different from the preset order.

[0038] In one possible implementation, the dynamic data also includes function jump data obtained when the application is running. The above-mentioned analysis of the execution order of the target functions to obtain the first target code segment includes: correcting the call relationship between the target functions based on the function jump data; and performing execution order analysis on the corrected call relationship between the target functions to obtain the first target code segment.

[0039] In one possible implementation, the above-mentioned correction of the call relationship between target functions based on function jump data includes: obtaining a reference function call graph of the target functions, the reference function call graph representing the call relationship between target functions; and correcting the reference function call graph based on the function jump data to obtain a function call graph, the function call graph being a tree structure.

[0040] In one possible implementation, the above-mentioned modification of the reference function call graph based on function jump data to obtain the function call graph includes: deleting call relationships not represented by the function jump data in the reference function call graph; and / or adjusting the non-tree structure call relationships in the reference function call graph to tree structure call relationships, wherein the non-tree structure includes a ring structure.

[0041] In one possible implementation, adjusting the non-tree-structured call relationship in the reference function call graph to a tree-structured call relationship includes: determining the callback function and callback call relationship in the ring structure based on function jump data; deleting the callback call relationship; and copying the other call relationships in the ring structure call relationship after deleting the callback call relationship, using the callback function as the call starting point, to obtain the function call graph.

[0042] The beneficial effects of the methods in the second aspect above can be found in the descriptions of the beneficial effects of the methods in the first aspect, and will not be repeated here.

[0043] Thirdly, a target code segment acquisition apparatus is provided, the target code segment acquisition apparatus comprising: a memory for storing computer program instructions; and a processor for executing the computer program instructions to support the target code segment acquisition apparatus in implementing the method as described in any possible implementation of the first or second aspect.

[0044] Fourthly, a computer-readable storage medium is provided that stores computer program instructions that, when executed by a processor, implement the method as described in any possible implementation of the first or second aspect.

[0045] Fifthly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to implement the method as described in any possible implementation of the first or second aspect.

[0046] Sixthly, a chip system is provided, comprising processing circuitry and a storage medium storing computer program instructions; when executed by a processor, the computer program instructions implement the method as described in any possible implementation of the first or second aspect. The chip system may be composed of chips or may include chips and other discrete devices. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of a static execution sequence analysis;

[0048] Figure 2 A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0049] Figure 3 A flowchart illustrating a method for obtaining a target code segment provided in an embodiment of this application;

[0050] Figure 4 A schematic diagram of dynamic data provided in an embodiment of this application;

[0051] Figure 5A schematic diagram illustrating dynamic data acquisition provided in an embodiment of this application;

[0052] Figure 6 A schematic diagram of an initial function call graph and a reference function call graph provided for embodiments of this application;

[0053] Figure 7 A reference function call graph and a schematic diagram of the function call graph are provided for embodiments of this application;

[0054] Figure 8 Another reference function call diagram and a schematic diagram of the function call diagram provided for embodiments of this application;

[0055] Figure 9 A schematic diagram illustrating an application execution sequence analysis provided in an embodiment of this application;

[0056] Figure 10 A flowchart illustrating another method for obtaining target code segments provided in this application embodiment;

[0057] Figure 11 A schematic diagram illustrating the determination of a third alias relationship provided in an embodiment of this application;

[0058] Figure 12 A schematic diagram illustrating another method for determining a third alias relationship, provided as an embodiment of this application;

[0059] Figure 13 A schematic diagram illustrating another method for determining a third alias relationship, provided as an embodiment of this application;

[0060] Figure 14 A schematic diagram illustrating another application execution sequence analysis provided in this application embodiment;

[0061] Figure 15 A flowchart of another method for obtaining target code segments provided in an embodiment of this application. Detailed Implementation

[0062] The technical solutions of the embodiments of this application will be described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0063] In the following text, the terms "first," "second," etc., are used only to distinguish different descriptive objects and do not limit the position, order, priority, quantity, or content of the described objects. For example, if the described object is a "target code segment," then the ordinal numbers preceding "target code segment" in "first target code segment" and "second target code segment" do not limit the position or order of the "target code segments," and "first" and "second" do not restrict the order of "first target code segment" and "second target code segment." Similarly, if the described object is an "alias analysis result," then the ordinal numbers preceding "alias analysis result" in "first alias analysis result," "second alias analysis result," and "third alias analysis result" do not limit the priority of the "alias analysis result." Furthermore, the number of described objects is not limited by ordinal numbers and can be one or more; for example, "first target code segment" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the described object is a "target code segment," then "first target code segment" and "second target code segment" can be target code segments with the same content or target code segments with different content. In summary, the use of ordinal numbers and other prefixes used to distinguish the described objects in the embodiments of this application does not constitute a limitation on the described objects. The description of the described objects is given in the claims or the context of the embodiments, and should not constitute an unnecessary limitation due to the use of such prefixes.

[0064] Furthermore, in the embodiments of this application, "connection" can be a direct connection or an indirect connection; in addition, it can refer to an electrical connection or a communication connection; for example, the connection of two electrical components A and B can refer to A and B being directly connected, or it can refer to A and B being indirectly connected through other electrical components or connection media, or it can refer to A and B being indirectly connected through other communication devices or communication media, as long as it enables communication between A and B.

[0065] Weak memory ordering refers to a model of memory access order. In some examples, a weak memory ordering architecture can refer to a computer architecture where the order of memory accesses does not strictly conform to the order of instructions in the program code. In this architecture, the order of memory operations can be reordered by the hardware and compiler according to optimization needs. Therefore, a weak memory ordering architecture allows the processor to perform memory operations without strictly adhering to the order of instructions in the program, thus allowing for more parallel operations and improving computational efficiency and performance. However, when an application runs in a weak memory ordering architecture, out-of-order instruction execution between multiple threads in the application may occur, leading to results that do not match the developer's expectations and affecting the user experience.

[0066] To avoid out-of-order instruction execution issues between multiple threads in an application, execution order analysis can be performed to identify code segments with out-of-order execution and corresponding repair suggestions. For example, such as... Figure 1 As shown, performing execution order analysis on an application can include: performing static analysis on the intermediate code corresponding to the application to obtain code segments in the application that are executed out of order and modification suggestions. Static analysis may include, but is not limited to, alias analysis, thread analysis, shared variable analysis, lock variable analysis, constructing a vector clock for shared variables using a static vector clock algorithm, obtaining code segments that are executed out of order by querying conditions through memory read and write patterns, and providing feedback on modification suggestions.

[0067] In some examples, intermediate code can refer to a programming language used in an abstract machine. During the process of compiling source code into target code, the compiler first converts the source code into one or more intermediate code snippets to facilitate optimization and generate the machine language for the target machine.

[0068] In some examples, an alias can refer to a data location in memory that can be accessed by multiple variables in a program. When the value of one variable is modified, the values ​​of other variables that are aliased to that variable will also change. Alias ​​analysis can be used to analyze alias relationships between variables in a program. An alias relationship between two variables can be a must-alias relationship, a no-alias relationship, or a possible alias relationship. A possible alias relationship indicates a high probability that the two variables are aliased. In some examples, the results of alias analysis can be used for shared variable analysis.

[0069] In some examples, shared variables can be accessed and modified simultaneously by multiple threads or applications. Shared variable analysis can be used to identify shared variables, as well as the thread call context and function call context corresponding to them. For example, one can first look for global variables in the application, then look for memory access instructions involving global variables, and based on the variables involved in the memory access instructions and the global variables, obtain the shared variables.

[0070] In some examples, thread analysis can be used to construct a thread data structure based on thread call context and function call context to distinguish the context of different thread operations.

[0071] However, when the application's codebase is large, based on Figure 1 The static execution order analysis shown takes a long time. Furthermore, the larger the codebase, the higher the false positive rate. The main reason for false positives is that incorrect alias analysis causes code segments whose execution order matches the developer's expectations to be marked as out-of-order execution segments.

[0072] To address the issues of long execution time and high false positive rate in application execution sequence analysis, this application provides a method for obtaining target code segments. This method acquires the intermediate code of an application and dynamic data including execution trajectory functions obtained during application execution. It removes functions from the intermediate code that differ from the execution trajectory functions to obtain the target functions of the intermediate code. Execution sequence analysis is then performed on the target functions to obtain a first target code segment whose execution order differs from a preset order. This method, after obtaining the application's intermediate code and dynamic data containing execution trajectory functions, allows for the removal of functions not called during application execution based on the execution trajectory functions, resulting in the target functions. Further execution sequence analysis of these target functions yields the first target code segment, thus avoiding the need for execution sequence analysis of the entire intermediate code, narrowing the scope of application execution sequence analysis, and consequently reducing time costs and false positive rates.

[0073] In some examples, the default order can refer to the execution order of the application as set by the developer.

[0074] The method provided in this application can be applied to devices or apparatuses capable of acquiring target code segments, hereinafter referred to as "target code segment acquisition apparatus". The target code segment acquisition apparatus can acquire target code segments by means of hardware, software, or a combination of hardware and software.

[0075] In some embodiments, the target code segment acquisition device may also have one or more of the following capabilities: acquiring dynamic data of the application, correcting the call relationships of target functions, performing execution order analysis on the corrected call relationships between target functions, analyzing the alias analysis results of the acquired intermediate code and dynamic data, correcting the alias analysis results of the intermediate code, and performing execution order analysis on the intermediate code based on the corrected alias analysis results.

[0076] For example, the target code segment acquisition device may include, but is not limited to, electronic devices such as smartphones, netbooks, tablets, personal computers (PCs), PDAs, and smart screen devices. This application does not limit the specific functions and structure of the target code segment acquisition device.

[0077] The application scenarios of this application embodiment can be as follows: Figure 2 As shown. In Figure 2The device may include a computer device 100 and an object code segment acquisition device 200. The application program can execute within the strong memory ordering (SMO) architecture of the computer device 100. Strong memory ordering refers to a model of memory access order; in some examples, strong memory ordering architecture can refer to a computer architecture where the memory access order is consistent with the instruction order in the program code.

[0078] When an application in computer device 100 is migrated to a target machine with a weak memory ordering architecture (such as a target code segment acquisition device 200 with a weak memory ordering architecture), the execution order of the application on the target machine may differ from the preset order (such as the execution order of the application set by the developer). To ensure that the execution order of the application on the target machine matches the preset order, the target code segment acquisition device 200 can analyze the execution order of the application, obtain the out-of-order code segments in the application, and repair the out-of-order code segments. In some examples, the target code segment acquisition device 200 may include a processor 210 and a memory 220.

[0079] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the target code segment acquisition device 200. In other embodiments of this application, the target code segment acquisition device 200 may include more or fewer components than illustrated, or combine certain components, or split certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0080] The processor 210 may include one or more processing units, such as an application processor (AP), a microcontroller unit (MCU), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). These different processing units may be independent devices or integrated into one or more processors. For example, the application processor may include a graphics processor and a digital signal processor, and the microcontroller unit may include a graphics processor.

[0081] In some embodiments of this application, the processor 210 can be used to obtain intermediate code of the application and dynamic data including the running trajectory function obtained when running the application, remove functions in the intermediate code that are different from the running trajectory function, obtain the target function of the intermediate code, and perform running order analysis on the target function to obtain a first target code segment in which the running order of the code in the target function is different from the preset order.

[0082] In some embodiments of this application, the processor 210 can be used to obtain a first alias analysis result corresponding to intermediate code and a second alias analysis result corresponding to dynamic data; based on the dynamic data and the second alias analysis result, the first alias analysis result is corrected to obtain a third alias analysis result including variables with alias relationships, thereby performing execution order analysis on the intermediate code according to the third alias analysis result to obtain a second target code segment.

[0083] Memory 220 may include one or more random access memory (RAM) and one or more non-volatile memory (NVM). The RAM can be directly read and written by the processor 210 and can be used to store executable programs (e.g., machine instructions) of the operating system or other running programs, as well as user and application data. The NVM can also store executable programs and user and application data, and can be pre-loaded into the RAM for direct read and write operations by the processor 210.

[0084] As an example, the program code stored in memory 220 includes, but is not limited to, one or more of the following: one or more pieces of code in an application, intermediate code obtained after compiling the application, and execution order analysis code. The processor 210 can perform execution order analysis on the intermediate code using the execution order analysis code to obtain a first target code segment and / or a second target code segment. The intermediate code can be obtained by the processor 210 after compiling the application, or it can be obtained by the target code segment acquisition device 200 from other computer devices.

[0085] In some examples, when the target machine for application migration is the target code segment acquisition device 200, the target code segment acquisition device 200 can execute the repaired application after repairing the out-of-order code segments.

[0086] In some examples, when the target machine for application migration is a computer device with a weak memory ordering architecture other than the target code segment acquisition device 200, the target code segment acquisition device 200 can send the repaired application to the other computer device with a weak memory ordering architecture after repairing the out-of-order code segments, so that the repaired application can be executed on the other computer device with a weak memory ordering architecture.

[0087] The following will describe in detail, with reference to the accompanying drawings, a method for obtaining target code segments provided in the embodiments of this application.

[0088] Please refer to Figure 3 , Figure 3 A flowchart illustrating a target code segment acquisition method provided in an embodiment of this application is shown. This method can be applied to a target code segment acquisition device with target code segment acquisition capability. Figure 3 As shown, the methods for obtaining the target code segment may include S301-S303:

[0089] S301: The target code segment acquisition device acquires the intermediate code and dynamic data of the application, including the running trajectory function acquired when the application is running.

[0090] As one possible implementation, the target code segment acquisition device can compile the application to obtain intermediate code; the target code segment acquisition device can also run the application and collect dynamic data while running the application.

[0091] As an example, the target code segment acquisition device can compile the application using a compiler (such as low-level virtual machine, LLVM) to obtain intermediate code.

[0092] In some examples, intermediate code may include, but is not limited to, multiple first data memory access instructions, which can be used to access variables in the memory corresponding to the intermediate code or to store variables in the corresponding memory.

[0093] In some examples, dynamic data includes, but is not limited to, runtime trajectory functions and function jump data, memory access information, and multiple second data memory access instructions obtained when the application is running. The runtime trajectory functions may include, but are not limited to, functions used when the application is running; the function jump data may include, but are not limited to, the call relationships between runtime trajectory functions; the memory access information includes, but is not limited to, the virtual addresses of variables and the address information corresponding to each of the multiple second data memory access instructions. The second data memory access instructions can be used to access variables in the memory corresponding to the running application or to store variables in the corresponding memory.

[0094] For example, dynamic data can be as follows Figure 4 As shown, in Figure 4 In the code, the application's execution trajectory functions may include, but are not limited to, Main, Func1, Func2, and Func3; memory access information may include, but is not limited to: the virtual address of variable Var1 (e.g., 0x12314), the address information (addr, e.g., 0xfff324) of the second data memory access instruction corresponding to variable Var1; the virtual address of variable Var2 (e.g., 0x32423), the address information (addr, e.g., 0xfff345) of the second data memory access instruction corresponding to variable Var2; function jump data may include, but is not limited to: the call relationship between Func1 and Func2, and the call relationship between Func2 and Func3; the second data memory access instructions may include, but are not limited to: load Var1 and store Var2, where load Var1 is used to read variable Var1 from memory, and store Var2 is used to write variable Var2 into memory.

[0095] As an example, such as Figure 5 As shown, the target code segment acquisition device can run an application in a pre-built runtime environment. Then, based on dynamic binary instrumentation (DBI), it collects and records the virtual addresses of functions used and memory-accessed variables during application execution, such as the virtual addresses of loaded and stored variables. Based on static instrumentation, it collects and records the function call traces and the addresses of parameters contained in each function. Based on the perf tool, it collects and records the call stack and the address information corresponding to multiple second data memory access instructions. After collecting the above data, the target code segment acquisition device further analyzes and extracts the data to obtain dynamic data. For example, the target code segment acquisition device can analyze and extract the execution trace functions and function jump data based on the functions used during application execution, the function call traces, and the call stack. As another example, the target code segment acquisition device can analyze and extract the virtual addresses of loaded and stored variables, the addresses of parameters contained in each function, and the virtual addresses of related variables to obtain memory access information.

[0096] In some examples, DBI refers to the method of analyzing the runtime behavior of binary programs by injecting instrumented code. DBI can insert specific analysis code into the program execution process according to the user's analysis needs without affecting the dynamic execution result of the program, thereby achieving monitoring and analysis of the dynamic execution process of the program.

[0097] In some examples, the target code segment acquisition device can statically instrument the entry point of each function to obtain the function call path and the addresses of the parameters contained in each function.

[0098] In some examples, `perf` can refer to a performance analysis tool in a Linux system, supporting hardware performance counting, software performance counting, and dynamic monitoring. The address information corresponding to multiple second data memory access instructions can be collected using the `spe` (statistical profiling extension) within the `perf` tool. `spe` can sample instructions in the application at preset sampling intervals to obtain the address information corresponding to each of the multiple second data memory access instructions.

[0099] As another implementation, other electronic devices can compile the application and send the corresponding intermediate code to the target code segment acquisition device. Other electronic devices can also run the application and collect dynamic data, then send the collected dynamic data to the target code segment acquisition device.

[0100] S302: The target code segment acquisition device removes functions in the intermediate code that are different from the running trajectory function to obtain the target function of the intermediate code.

[0101] For example, assuming the intermediate code includes functions Main, Func1, Func2, and Func3, and the execution trajectory function includes Main and Func1, the target code segment acquisition device can remove the functions Func2 and Func3 from the intermediate code that are different from the execution trajectory function, and obtain the target functions of the intermediate code as Main and Func1.

[0102] In some examples, the objective function may come from the same thread or from different threads.

[0103] S303: The target code segment acquisition device performs an execution order analysis on the target function to obtain the first target code segment. The first target code segment is the code segment in the target function whose execution order is different from the preset order.

[0104] As one possible approach, the target code segment acquisition device can correct the call relationships between target functions based on function jump data; then, it can perform execution sequence analysis on the corrected call relationships to obtain the first target code segment. In this way, by correcting the call relationships between target functions using function jump data, the actual call relationships used by the target functions during runtime can be obtained, thereby improving the accuracy of the target function call relationships and the accuracy of the first target code segment.

[0105] As an example, the target code segment acquisition device can acquire a reference function call graph (CG) of the target function, which represents the call relationships between target functions. Based on function jump data, the reference function call graph is corrected to obtain a tree-structured function call graph. The execution order analysis of the call relationships in the function call graph is then performed to obtain the first target code segment. Thus, by transforming the reference function call graph into a tree-structured function call graph using function jump data, the complexity of function call graph analysis can be reduced, and the efficiency of application execution order analysis can be improved.

[0106] As an example, the target code segment acquisition device can obtain an initial function call graph based on the functions in the intermediate code. The initial function call graph can represent the call relationships between functions in the intermediate code. Then, based on the target function of the intermediate code, the device can delete the functions other than the target function in the initial function call graph, as well as the call relationships other than the call relationships between the target functions, to obtain a reference function call graph.

[0107] For example, the initial function call graph can be as follows: Figure 6 As shown in the left figure, assuming the target function of the intermediate code includes the call relationships between Main, Func1, Func6, and Func7, then by removing functions other than the target function from the initial function call graph, and removing all call relationships except those between the target functions, the resulting reference function call graph can be as follows: Figure 6 As shown in the figure on the right.

[0108] As an example, after obtaining the reference function call graph, the target code segment acquisition device modifies the reference function call graph based on function jump data to obtain a tree-structured function call graph. This includes: the target code segment acquisition device deleting call relationships not represented by the function jump data in the reference function call graph; and / or, the target code segment acquisition device adjusting non-tree-structured call relationships in the reference function call graph to tree-structured call relationships, where non-tree-structured structures include, but are not limited to, circular structures. In this way, call relationships not used by the target function during runtime can be removed through function jump data, improving the accuracy of call relationships; adjusting circular call relationships to tree-structured call relationships can reduce the complexity of function call graph analysis and improve the efficiency of application execution sequence analysis.

[0109] For example, the call relationships between target functions in the reference function call diagram are as follows: Figure 7Taking the left diagram as an example, assuming the call relationships represented by the function jump data include: Main calls Func1, Func1 calls Func2, Func2 calls Func3, Func3 calls Func4, and Func4 calls Func5, but does not involve Func4 calling Func2, the reference function call graph can be corrected by adjusting the function jump data, such as by deleting... Figure 7 The left diagram shows the call relationship between Func4 and Func2, from which we can obtain... Figure 7 The function call diagram shown on the right.

[0110] As an example, the target code segment acquisition device can adjust the non-tree-structured call relationships in the reference function call graph into a tree-structured call relationship. This can include: the target code segment acquisition device determining the callback functions and callback call relationships in the circular structure based on function jump data, deleting the callback call relationships, and then copying the call relationships in the circular structure, deleting all call relationships except for the callback call relationships, starting from the callback function. In this way, the circular call relationship can be adjusted into a tree-structured call relationship, reducing the complexity of function call graph analysis and improving the efficiency of application execution sequence analysis.

[0111] In some examples, a circular structure can represent a cyclic call relationship between multiple functions. The callback function can refer to the last function in the circular structure before the loop occurs, and the callback call relationship can represent the callback function calling the first function in the circular structure before the loop occurs. The appearance of a callback call relationship indicates the start of a cyclic call relationship. For example, when the circular structure is: Func2 calls Func3, Func3 calls Func4, and Func4 calls Func2, the callback function can be Func4, and the callback call relationship can be Func4 calling Func2.

[0112] For example, the call relationships between target functions in the reference function call diagram are as follows: Figure 8 Taking the left diagram as an example, assuming the call relationships represented by the function jump data include: Main calls Func1, Func1 calls Func2, Func2 calls Func3, Func3 calls Func4, Func4 calls Func2, and Func4 calls Func5, then the callback function is Func4, and the callback call relationship is Func4 calling Func2. By deleting the callback call relationship, such as deleting... Figure 8 The left diagram shows the call relationship between Func4 and Func2. Then, using the callback function as the starting point (e.g., Func4), the circular call relationship is copied, and other call relationships after the callback call relationship are removed, resulting in... Figure 8 The function call diagram shown on the right.

[0113] As an example, the target code segment acquisition device can perform execution order analysis on the call relationships between the modified target functions to obtain the first target code segment. For example, the target code segment acquisition device can refer to... Figure 1 This section introduces related topics such as shared variable analysis, lock variable analysis, constructing a vector clock for shared variables using a static vector clock algorithm, and obtaining out-of-order code segments by querying conditions through memory read / write patterns. It also analyzes the execution order of the call relationships between the corrected target functions to obtain out-of-order code segments, such as the first target code segment.

[0114] For example, such as Figure 9 As shown, taking an application whose intermediate code contains functions Main, Func1, Func2, and Func3, and whose execution trajectory function includes Main and Func1 as an example, the target code segment acquisition device can analyze the static intermediate code by combining it with dynamic data. For example, by deleting Func2 and Func3, a function call graph containing Main and Func1 can be obtained. Then, the execution order can be analyzed based on the function call graph to obtain the first target code segment. For example, the first target code segment includes code segments in Main and Func1 whose execution order is different from the preset order.

[0115] In this embodiment, the target code segment acquisition device can, after obtaining the intermediate code and dynamic data of the application, remove functions that will not be called during the application's runtime from the intermediate code based on the running trajectory function to obtain the target function. Further, it performs a running order analysis on the target function to obtain the first target code segment. Thus, it can perform running order analysis by combining static data (intermediate code) and dynamic data, avoiding the need to perform running order analysis on the entire intermediate code, narrowing the scope of running order analysis, and thereby reducing time costs and false alarm rates.

[0116] The target code segment acquisition method in the foregoing embodiments reduces the time cost and false positive rate during application execution order analysis by correcting the function call graph. This application also provides another target code segment acquisition method, which can further reduce the time cost and false positive rate during application execution order analysis by correcting alias analysis results. The following will describe in detail the other target code segment acquisition method provided by this application embodiment with reference to the accompanying drawings.

[0117] like Figure 10 As shown, an embodiment of this application provides a method for obtaining a target code segment, which may include S1001-S1004:

[0118] S1001: The target code segment acquisition device acquires the intermediate code and dynamic data of the application.

[0119] For information on obtaining intermediate code and dynamic data, please refer to the above text. Figure 3 The introduction of S301 will not be repeated here.

[0120] S1002: The target code segment acquisition device acquires the first alias analysis result corresponding to the intermediate code and the second alias analysis result corresponding to the dynamic data.

[0121] In some examples, the first alias analysis result may include alias relationships corresponding to variables in intermediate code; the second alias analysis result may include alias relationships corresponding to variables in dynamic data.

[0122] As one possible approach, the target code segment acquisition device can analyze intermediate code using a static alias analysis tool to obtain the first alias analysis result. For example, the static alias analysis tool can include, but is not limited to, SVF (static value flow), etc. SVF can use static analysis techniques to determine the alias relationship between variables in the intermediate code, that is, to determine which variables may point to the same storage path.

[0123] As one possible approach, the target code segment acquisition device can obtain the second alias analysis result based on the virtual addresses of variables in dynamic data. For example, the target code segment acquisition device can determine which variables might point to the same storage path based on the virtual addresses of variables in dynamic data, thereby obtaining the second alias analysis result.

[0124] S1003: The target code segment acquisition device corrects the first alias analysis result based on dynamic data and the second alias analysis result to obtain the third alias analysis result, which includes variables that have alias relationships.

[0125] As an example, the intermediate code includes multiple first data memory access instructions, and the dynamic data acquired by the target code segment acquisition device also includes multiple second data memory access instructions. As a possible implementation, the target code segment acquisition device can acquire the mapping relationship between the multiple first data memory access instructions and the multiple second data memory access instructions; based on the mapping relationship and the second alias analysis result, the first alias analysis result is corrected to obtain the third alias analysis result.

[0126] In some examples, the first data memory access instruction with a mapping relationship is the same as or corresponds to the statement of the second data memory access instruction.

[0127] In some examples, the statement corresponding to the first data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the first data memory access instruction, and the statement corresponding to the second data memory access instruction can refer to a statement in the application's source code file that has the same meaning as the second data memory access instruction.

[0128] In some examples, since the first data memory access instruction is generated during the compilation of the application, the statement in the source code file that is compiled into the first data memory access instruction can be used as the statement corresponding to the first data memory access instruction. The second data memory access instruction is generated during the execution of the application; therefore, the statement in the source code file that generates the second data memory access instruction corresponds to the second data memory access instruction.

[0129] For example, suppose statement 1 in the source code file is compiled into instruction A in the first data memory access instruction, then the statement corresponding to instruction A is statement 1 in the source code file. Suppose that during application runtime, instruction B in the second data memory access instruction is generated through statement 2 in the source code file, then the statement corresponding to instruction B is statement 2 in the source code file.

[0130] As an example, if the statement corresponding to the first data memory access instruction is the same as the statement corresponding to the second data memory access instruction, it can be said that the first data memory access instruction and the second data memory access instruction correspond to the same statement in the source code file. For example, assuming the first data memory access instruction is instruction A and the second data memory access instruction is instruction B, if the statement corresponding to instruction A is statement 1 and the statement corresponding to instruction B is statement 1, it can be determined that there is a mapping relationship between instruction A and instruction B.

[0131] As an example, the statement corresponding to the first data memory access instruction corresponds to the statement corresponding to the second data memory access instruction, which means that the first data memory access instruction and the second data memory access instruction correspond to statements with the same meaning in the source code file. For example, suppose the first data memory access instruction is instruction A and the second data memory access instruction is instruction B. If the statement corresponding to instruction A is statement 1 and the statement corresponding to instruction B is statement 2, and statement 1 and statement 2 have the same meaning, it can be determined that there is a mapping relationship between instruction A and instruction B.

[0132] In some examples, the target code segment acquisition device can obtain the statements corresponding to multiple second data memory access instructions based on the address information corresponding to each of the multiple second data memory access instructions.

[0133] In this embodiment of the application, the target code segment acquisition device can obtain the statements corresponding to the multiple second data memory access instructions based on the address information corresponding to each of the multiple second data memory access instructions, thereby determining the mapping relationship between the multiple first data memory access instructions and the multiple second data memory access instructions, so as to facilitate the correction of subsequent alias analysis results.

[0134] In some examples, the target code segment acquisition device can obtain the association between the first data memory access instruction and the statements in the code source file, and based on the association, it can obtain the statements corresponding to multiple first data memory access instructions.

[0135] In some examples, the association can be directly output by the compiler.

[0136] For example, assuming the target code segment acquisition device has a compiler, when the target code segment acquisition device compiles the application through the compiler, the compiler can not only output the intermediate code corresponding to the application, but also output the association relationship between the intermediate code and the source code file in the application. For example, each instruction in the intermediate code is compiled from which statement in the source code file. Thus, the target code segment acquisition device can obtain the statements corresponding to multiple first data memory access instructions based on the output association relationship.

[0137] In this embodiment, the language type of the first data memory access instruction is different from that of the second data memory access instruction. For example, the first data memory access instruction can be a three-address instruction between the source code file and binary instructions, while the second data memory access instruction can be a binary instruction. The target code segment acquisition device can associate multiple first data memory access instructions and multiple second data memory access instructions with different language types to form a mapping relationship. Based on the mapping relationship, the first alias analysis result can be corrected using the second alias analysis result to obtain the third alias analysis result, thereby improving the accuracy of the third alias analysis result.

[0138] As an example, the target code segment acquisition device can obtain multiple sets of associated variables based on mapping relationships, each set of associated variables including variables included in the first and second data memory access instructions with mapping relationships; based on the first alias analysis results, obtain the first alias relationship corresponding to each of the multiple sets of associated variables; based on the second alias analysis results, obtain the second alias relationship corresponding to each of the multiple sets of associated variables; based on the first and second alias relationships corresponding to each of the multiple sets of associated variables, determine the third alias relationship corresponding to each of the multiple sets of associated variables; and based on the third alias relationships corresponding to each of the multiple sets of associated variables, obtain the third alias analysis results.

[0139] As an example, the target code segment acquisition device can obtain the first alias relationship of the corresponding associated variable group based on the variables included in the first data memory access instruction and the analysis result of the first alias; and obtain the second alias relationship of the corresponding associated variable group based on the variables included in the second data memory access instruction and the analysis result of the second alias.

[0140] As an example, such as Figure 11As shown, if the first alias relation represents a group of associated variables as an alias relation (must alias) and the second alias relation represents a group of associated variables as a non-alias relation (no alias), the target code segment acquisition device determines that the third alias relation represents a group of associated variables as a highly probable alias relation, for example, the third alias relation is a possible alias; if the first alias relation represents a group of associated variables as an alias relation (must alias) and the second alias relation represents a group of associated variables as a highly probable alias relation, for example, the second alias relation is a possible alias, the target code segment acquisition device determines that the third alias relation represents a group of associated variables as an alias relation (must alias); if the first alias relation represents a group of associated variables as an alias relation and the second alias relation represents a group of associated variables as an alias relation, the target code segment acquisition device determines that the third alias relation represents a group of associated variables as an alias relation (must alias).

[0141] As an example, such as Figure 12 As shown, if the first alias relation indicates a high probability that the associated variable group is an alias relation, for example, the first alias relation is a possible alias, and the second alias relation indicates that the associated variable group is a non-alias relation, the target code segment acquisition device determines that the third alias relation indicates that the associated variable group is a non-alias relation; if the first alias relation indicates a high probability that the associated variable group is an alias relation, for example, the first alias relation is a possible alias, and the second alias relation indicates that the associated variable group is a must alias, the target code segment acquisition device determines that the third alias relation indicates that the associated variable group is a must alias; if the first alias relation indicates a high probability that the associated variable group is an alias relation and the second alias relation indicates a high probability that the associated variable group is an alias relation, for example, the first alias relation is a possible alias, the target code segment acquisition device determines that the third alias relation indicates that the associated variable group is an alias relation; if the first alias relation indicates a high probability that the associated variable group is an alias relation and the second alias relation indicates a high probability that the associated variable group is an alias relation, for example, the first alias relation is a possible alias, the target code segment acquisition device determines that the target code segment acquisition device determines that the third alias relation indicates that the associated variable group is an alias relation. The third alias relation is determined by the target code segment acquisition device to represent the associated variable group as an alias relation (mustalias), and the second alias relation is a possible alias relation (mayalias).

[0142] As an example, such as Figure 13As shown, if the first alias relation represents a non-alias relation (no alias) and the second alias relation represents a must alias relation (must alias), it is highly likely that the third alias relation represents a alias relation, for example, the third alias relation is a possible alias. If the first alias relation represents a non-alias relation (no alias) and the second alias relation represents a non-alias relation (no alias), it is highly likely that the third alias relation represents a non-alias relation (no alias). If the first alias relation represents a non-alias relation (no alias) and the second alias relation represents a must alias relation (no alias), it is highly likely that the third alias relation represents a alias relation, for example, the second alias relation is a possible alias, and the third alias relation is a possible alias.

[0143] In the embodiments of this application, the target code segment acquisition device can obtain different third alias relationships by combining various first alias relationships and second alias relationships, thereby more accurately correcting the first alias relationship and improving the accuracy of subsequent application execution order analysis.

[0144] In some examples, where there is no corresponding second data access instruction for a portion of the first data access instruction in the intermediate code, the target code segment acquisition device may retain the first alias relationship involved in the first data access instruction in the intermediate code that does not have a mapping relationship. That is, the first alias relationship involved in the first data access instruction in the intermediate code that does not have a mapping relationship is the same as the third alias relationship.

[0145] In this embodiment, since the first alias relationship is obtained based on a static alias analysis tool, and the second alias relationship is obtained based on the variable memory access operations actually performed during application runtime, the accuracy of the first alias relationship may not be high enough due to the limitations of the static alias analysis tool itself. Therefore, the target code segment acquisition device can use the second alias relationship corresponding to the running application to correct the first alias relationship obtained by static analysis. That is, the target code segment acquisition device obtains the third alias relationship corresponding to each of the multiple associated variable groups based on the first and second alias relationships corresponding to each of the multiple associated variable groups, so as to improve the accuracy of the third alias analysis results.

[0146] S1004: The target code segment acquisition device performs execution sequence analysis on the intermediate code based on the third alias analysis results to obtain the second target code segment.

[0147] In some examples, the second target code segment can refer to a code segment in the intermediate code where the execution order of the code does not conform to the preset order and contains variables with alias relationships.

[0148] As one possible approach, the target code segment acquisition device can perform execution sequence analysis on the intermediate code based on the third alias analysis results to obtain the second target code segment. For example, the target code segment acquisition device can refer to... Figure 1 This section introduces related topics such as shared variable analysis, lock variable analysis, constructing a vector clock for shared variables using a static vector clock algorithm, and obtaining out-of-order code segments by querying conditions through memory read / write patterns. Based on the results of the third alias analysis, the execution order of the intermediate code is analyzed to obtain out-of-order code segments, such as the second target code segment.

[0149] As an example, the target code segment acquisition device can obtain variables with alias relationships in the intermediate code based on the third alias analysis results, obtain shared variables based on the variables with alias relationships, perform execution order analysis on the code blocks with shared variables, and obtain the second target code segment.

[0150] In some examples, applications may include multiple threads, and shared variables refer to variables that can be accessed by multiple threads. When processing multithreaded code, target code segment acquisition devices need to handle shared variables specially to avoid issues such as race conditions and deadlocks. Alias ​​analysis plays a crucial role in this process, helping the target code segment acquisition device determine which variables might be accessed and modified simultaneously by multiple threads, thereby guiding the device to perform appropriate optimizations and error detection. Therefore, correcting the first alias analysis result using the second alias analysis result can remove erroneous alias relationships from the first result, thus reducing the number of variables with alias relationships (for example, shared variables obtained from the first alias analysis result may include Shared var1, Shared var2, and Shared var3, while shared variables obtained from the third alias analysis result may only include Shared var1). This reduces the scope of shared variable analysis, lowering the time cost and false positive rate of application execution order analysis.

[0151] For example, such as Figure 14As shown, taking an application's intermediate code containing functions Main and Func1, the statements corresponding to the first data memory access instructions including Load x, Load y, Load z, Store x, Store y, and Store z, the execution trajectory functions including Main and Func1, and the statements corresponding to the second data memory access instructions including Load x, Load y, Load z, Store x, Store y, and Store z as an example, the target code segment acquisition device can analyze by combining static intermediate code with dynamic data. For example, it can perform dynamic and static combined analysis on the alias relationships corresponding to variables x, y, and z contained in the intermediate code to obtain a function call graph containing Main and Func1, and confirm that there is an alias relationship between variables x and y. Then, based on the function call graph and the alias relationship between variables x and y, it can perform execution order analysis to obtain the second target code segment. For example, the second target code segment includes code segments containing variables x and / or y whose execution order is different from the preset order.

[0152] In this embodiment, since the first alias analysis result corresponding to the intermediate code is obtained based on the static alias analysis tool, and the second alias analysis result corresponding to the dynamic data is obtained based on the variable memory access operations actually performed during application runtime, the accuracy of the first alias relationship may not be high enough due to the limitations of the static alias analysis tool itself. Therefore, the target code segment acquisition device corrects the first alias analysis result using dynamic data and the second alias analysis result, which can make the obtained third alias analysis result more accurate (for example, variables with alias relationships in the first alias analysis result may be corrected to non-alias relationships), thereby reducing the number of variables with alias relationships, narrowing the scope of subsequent execution order analysis of the intermediate code, improving the efficiency of application execution order analysis and reducing the false alarm rate.

[0153] In the target code segment acquisition method of the foregoing embodiments, the analysis and discussion are based on the function call graph and the alias analysis results respectively. In practical applications, the target code segment acquisition method based on the function call graph can be implemented independently, the target code segment acquisition method based on the alias analysis results can be implemented independently, or the target code segment can be acquired by combining the function call graph and the alias analysis results. This application embodiment does not limit this.

[0154] The following example illustrates how to obtain a third target code segment by combining function call graphs and alias analysis results. This method, along with the previously described embodiments, demonstrates how to obtain a third target code segment based on function call graphs and alias analysis results. The third target code segment may include, but is not limited to, the first and second target code segments.

[0155] As one possible implementation, after the target code segment acquisition device obtains the intermediate code and dynamic data of the application according to the description in step S301, the target code segment acquisition device can obtain the function call graph according to the description in step S302 and part of the description in step S303, and can also obtain the third alias analysis result according to the description in steps S1002 and S1003; based on the third alias analysis result and the function call graph corresponding to the target function, the intermediate code is analyzed to obtain the third target code segment. The process of obtaining the function call graph and the process of obtaining the third alias analysis result are independent of each other. The target code segment acquisition device can obtain the function call graph and the third alias analysis result simultaneously, or it can obtain the function call graph / third alias analysis result first, and then obtain the third alias analysis result / function call graph.

[0156] For example, such as Figure 15 As shown, after obtaining intermediate code and dynamic data according to step S1501, the target code segment acquisition device can perform two types of dynamic and static combined analysis through steps S1502 to S1507 to obtain the function call graph and the third alias analysis result; then, the target code segment acquisition device can analyze the intermediate code according to the third alias analysis result and the function call graph corresponding to the target function through step S1508 to obtain the third target code segment.

[0157] In some examples, the first dynamic-static combined analysis modifies the initial function call graph corresponding to the intermediate code, including: the target code segment acquisition device removes functions in the intermediate code that are different from the running trajectory function according to step S1502 to obtain the target function of the intermediate code; obtains the reference function call graph of the target function according to step S1503; deletes call relationships not represented by function jump data in the reference function call graph according to step S1504; and / or adjusts the non-tree-structured call relationships in the reference function call graph to a tree-structured call relationship to obtain the function call graph. For a description of steps S1502 to S1504, please refer to the relevant content in the aforementioned embodiments S302 to S303, which will not be repeated here.

[0158] In some examples, the second dynamic-static combined analysis modifies the first alias analysis result corresponding to the intermediate code, including: the target code segment acquisition device acquires the first alias analysis result corresponding to the intermediate code and the second alias analysis result corresponding to the dynamic data according to step S1505; acquires the mapping relationship between multiple first data memory access instructions and multiple second data memory access instructions according to step S1506; and executes step S1507: based on the mapping relationship and the second alias analysis result, the first alias analysis result is modified to obtain the third alias analysis result. A description of steps S1505 to S1507 can be found in the relevant content of the aforementioned embodiments S1002 to S1003, and will not be repeated here.

[0159] In some examples, after obtaining the function call graph and the third alias analysis results, the target code segment acquisition device can call the relevant interfaces to perform execution sequence analysis.

[0160] In some examples, during execution sequence analysis, the target code segment acquisition device can perform shared variable analysis based on the function call graph and the third alias analysis results to obtain one or more shared variables, the thread call context corresponding to each shared variable, and the function call context; it can also perform lock variable analysis based on the function call graph and the third alias analysis results to obtain one or more mutex lock variables, the thread call context corresponding to each mutex lock variable, and the function call context; and, according to the static vector time algorithm, construct vector clocks for the thread call context and function call context of the code block containing shared variables; and, according to the preset memory read / write mode query conditions, find the code segment in the function call graph that meets the conditions, i.e., the third target code segment; after obtaining the third target code segment, the target code segment acquisition device can mark the third target code segment and display it on the display screen of the target code segment acquisition device; and, the target code segment acquisition device can also display modification suggestions on the display screen.

[0161] In some examples, the preset memory read / write mode query conditions may include, but are not limited to, the execution time difference between multiple instructions that perform read / write operations on the same shared variable being less than or equal to a preset difference. For example, the target code segment acquisition device determines, through a vector clock, that code block A performs a write operation on shared variable 1 at time 1, and code block B performs a read operation on shared variable 1 at time 2, where time 1 is earlier than time 2. When the execution time difference between time 1 and time 2 is less than or equal to the preset difference, the target code segment acquisition device can mark code block A and code block B as the third target code segment. This is because, in a weak memory ordering architecture, to improve execution efficiency (such as reducing CPU execution time), there may be a situation where code block B is executed before code block A.

[0162] In some examples, suggested modifications may include, but are not limited to, adding memory barrier instructions to a third target code segment. Memory barrier instructions are instructions used to control the order of memory accesses, ensuring that certain operations are executed in the expected order and preventing optimizations to memory accesses from affecting the correctness of the program.

[0163] It should be understood that the various solutions in the embodiments of this application can be used in a reasonable combination, and the explanations or descriptions of the various terms appearing in the embodiments can be referenced or explained to each other in the various embodiments, without limitation.

[0164] It should also be understood that, in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0165] In the embodiments provided above, the method provided by the present application is described from the perspective of the target code segment acquisition device as the execution subject. To implement the functions of the method provided in the embodiments of the present application, the target code segment acquisition device may include hardware structures and / or software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. Whether a particular function is executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules depends on the specific application and design constraints of the technical solution.

[0166] This application embodiment can divide the target code segment acquisition device into functional modules. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0167] It should be understood that the various modules in the target code segment acquisition device can be implemented in software and / or hardware, without specific limitations. In other words, the target code segment acquisition device is presented in the form of functional modules. Here, "module" can refer to application-specific integrated circuits (ASICs), circuits, processors and memories that execute one or more software or firmware programs, integrated logic circuits, and / or other devices that can provide the above functions.

[0168] In the above embodiments, depending on the context, the terms "when / at..." or "after..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrases "when determining...", "if (the stated condition or event)" or "if..." can be interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event)" or "in response to detecting (the stated condition or event)". Furthermore, in the above embodiments, relational terms such as "first" and "second" are used to distinguish one entity from another, without limiting any actual relationship or order between these entities.

[0169] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0170] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in this embodiment are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)). Where there is no conflict, the solutions in the above embodiments can be combined.

[0171] The steps of the methods or algorithms described in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, portable hard disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a target code segment acquisition device. Of course, the processor and storage medium can also exist as discrete components in the target code segment acquisition device.

[0172] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

Claims

1. A method for obtaining a target code segment, characterized in that, The method includes: Obtain intermediate code and dynamic data of the application, wherein the dynamic data includes the running trajectory function obtained when the application is run; Remove functions from the intermediate code that are different from the execution trajectory function to obtain the target function of the intermediate code; The execution order of the target function is analyzed to obtain the first target code segment, which is the code segment in the target function whose execution order is different from the preset order.

2. The method according to claim 1, characterized in that, The dynamic data also includes function jump data obtained when the application is run. The step of analyzing the execution sequence of the target function to obtain the first target code segment includes: The calling relationships between the target functions are corrected based on the function jump data. The execution order of the call relationships between the modified target functions is analyzed to obtain the first target code segment.

3. The method according to claim 2, characterized in that, The step of correcting the call relationship between the target functions based on the function jump data includes: Obtain a reference function call graph of the target function, wherein the reference function call graph represents the call relationship between the target functions; The reference function call graph is corrected based on the function jump data to obtain a function call graph, which is a tree structure.

4. The method according to claim 3, characterized in that, The process of correcting the reference function call graph based on the function jump data to obtain the function call graph includes: Remove any call relationships not represented by the function jump data in the reference function call diagram; And / or, Adjust the non-tree-structured call relationships in the reference function call graph to a tree-structured call relationship, wherein the non-tree-structured call relationships include a ring structure.

5. The method according to claim 4, characterized in that, The step of adjusting the non-tree-structured call relationship in the reference function call graph to a tree-structured call relationship includes: Based on the function jump data, determine the callback functions and callback call relationships in the ring structure; Delete the aforementioned callback relationship; Using the callback function as the starting point, copy the call relationship of the circular structure, delete the callback call relationship, and obtain the function call graph.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: Obtain the first alias analysis result corresponding to the intermediate code and the second alias analysis result corresponding to the dynamic data; The first alias analysis result is corrected based on the dynamic data and the second alias analysis result to obtain a third alias analysis result, which includes variables that have alias relationships. Based on the analysis results of the third alias, the execution order of the intermediate code is analyzed to obtain the second target code segment.

7. The method according to claim 6, characterized in that, The dynamic data also includes the virtual address of the variable, and the second alias analysis result is obtained based on the virtual address of the variable.

8. The method according to claim 6 or 7, characterized in that, The intermediate code includes multiple first data memory access instructions, and the dynamic data also includes multiple second data memory access instructions. The step of correcting the first alias analysis result based on the dynamic data and the second alias analysis result to obtain a third alias analysis result includes: Obtain the mapping relationship between the plurality of first data memory access instructions and the plurality of second data memory access instructions; Based on the mapping relationship and the second alias analysis result, the first alias analysis result is corrected to obtain the third alias analysis result.

9. The method according to claim 8, characterized in that, The first data access instruction with a mapping relationship is the same as or corresponds to the second data access instruction.

10. The method according to claim 8 or 9, characterized in that, The dynamic data also includes address information corresponding to each of the plurality of second data memory access instructions, and the statements corresponding to the plurality of second data memory access instructions are obtained based on the address information corresponding to each of the plurality of second data memory access instructions.

11. The method according to any one of claims 8-10, characterized in that, The process of obtaining the third alias analysis result based on the mapping relationship, the first alias analysis result, and the second alias analysis result includes: Based on the mapping relationship, multiple sets of associated variables are obtained, each set of associated variables including the variables included in the first data memory access instruction and the second data memory access instruction which have a mapping relationship; Based on the results of the first alias analysis, the first alias relationships corresponding to each of the multiple groups of related variables are obtained; Based on the results of the second alias analysis, the second alias relationships corresponding to each of the multiple groups of related variables are obtained; Based on the first alias relationship and the second alias relationship corresponding to each of the multiple sets of associated variables, determine the third alias relationship corresponding to each of the multiple sets of associated variables; The third alias analysis results are obtained based on the third alias relationships corresponding to each of the multiple groups of associated variables.

12. The method according to claim 11, characterized in that, The step of determining the third alias relationship corresponding to each of the plurality of association variable groups based on the first alias relationship and the second alias relationship corresponding to each of the plurality of association variable groups includes: If the first alias relationship represents an alias relationship for the associated variable group and the second alias relationship represents a non-alias relationship for the associated variable group, then it is highly likely that the third alias relationship represents an alias relationship for the associated variable group. If the first alias relationship indicates a high probability that the associated variable group is an alias relationship and the second alias relationship indicates that the associated variable group is an alias relationship, then the third alias relationship indicates that the associated variable group is an alias relationship. If the first alias relationship indicates a high probability that the associated variable group is an alias relationship and the second alias relationship indicates that the associated variable group is a non-alias relationship, then the third alias relationship indicates that the associated variable group is a non-alias relationship. If the first alias relationship represents a non-alias relationship for the associated variable group and the second alias relationship represents an alias relationship for the associated variable group, then it is highly likely that the third alias relationship represents an alias relationship for the associated variable group. If the first alias relationship indicates that the associated variable group is not an alias relationship and the second alias relationship indicates that the associated variable group is likely to be an alias relationship, then the third alias relationship is likely to indicate that the associated variable group is likely to be an alias relationship.

13. A target code segment acquisition device, characterized in that, The target code segment acquisition device includes: Memory is used to store computer program instructions; A processor for executing the computer program instructions to support the target code segment acquisition device in implementing the method as described in any one of claims 1-12.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processing circuit, implement the method as described in any one of claims 1-12.

15. A computer program product containing instructions, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1-12.

Images