Automatic Memory Deallocation Error Repair via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automatic program repair techniques are inadequate for fixing memory deallocation errors, as they are difficult to represent as input/output examples and may introduce additional errors during manual repair, and existing solutions do not guarantee the absence of memory deallocation errors.
Innovation Solution
A device and method that includes a static analysis unit to generate status information for objects in the source code, a decision unit to choose patch candidates capable of deallocating objects only once, and a repair unit to repair the source code, using point-to analysis and exact cover problem solving to ensure safe deallocation without memory leaks or double-free errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual repair of memory deallocation errors is performed, then the errors can be identified and fixed, but the repair process requires considerable time and may introduce additional errors
Solution Approach 1:
The system performs automatic program repair by having the computer itself analyze and fix memory deallocation errors without human intervention. The processor executes instructions to automatically identify erroneous deallocation statements and generate corrected code, eliminating the need for manual repair while ensuring accuracy through systematic analysis of allocation and deallocation patterns throughout the program.
2Extent of automation
If existing automatic program repair techniques based on input/output examples are used, then general automation is achieved, but memory deallocation errors cannot be properly fixed as they are difficult to represent as input/output examples
Solution Approach 1:
The system replaces the mechanical approach of input/output example matching with a semantic analysis mechanism that understands the meaning of memory operations. Instead of relying on external test cases, the system uses static analysis to track object lifecycles, pointer assignments, and deallocation statements, automatically identifying errors based on program semantics rather than external examples.
3Reliability
If existing memory leak fixing techniques that insert deallocation statements are applied, then some memory leaks can be fixed, but the repaired program may still contain memory leaks and other deallocation errors cannot be fixed
Solution Approach 1:
The system segments the program analysis into distinct components: tracking object allocations, monitoring pointer assignments, identifying deallocation statements, and analyzing control flow paths. By dividing the complex analysis into manageable segments, the system can comprehensively examine all aspects of memory management and identify various types of deallocation errors including memory leaks, double-free errors, and use-after-free errors that single-approach methods miss.
4Measurement precision
If comprehensive static analysis is performed to generate status information for each object, then accurate identification of deallocation errors is achieved, but the analysis complexity increases
Solution Approach 1:
The system performs preliminary static analysis to generate status information for each object before executing the program. This includes pre-computing allocation sites, tracking pointer assignments, and identifying potential deallocation points. By performing this analysis beforehand, the system establishes a comprehensive view of memory operations that enables accurate error detection during execution without adding complexity to the runtime system.
Data Source
AI summary
A device for automatically repairing memory deallocation errors is disclosed. The device includes: a static analysis unit configured to generate status information for each one of the objects included in the source code of a program by way of a static analysis of the source code, where the status information includes position information, pointer information, and patch information, the position information associated with allocation sites of the objects, the pointer information associated with pointers pointing to the objects, the patch information associated with deallocation statements capable of deallocating the objects; a decision unit configured to choose patch candidates from the patch information and decide on a combination of the patch candidates capable of deallocating each of the objects only once; and a repair unit configured to repair the source code according to the combination of patch candidates.