CN101847122A - Method and system for testing software by using abnormal control flow set - Google Patents

Abstract

The invention discloses a method and a system for testing software by using an abnormal control flow set. According to the method and the system provided by the invention for treating the software, the method comprises the following steps of: describing a run-time abnormal behavior through an abnormal mode state machine to support expansion of control flow and automatic detection of faults; expanding the traditional abnormal control flow through the run-time abnormal control flow, and adding a throwing run-time abnormal edge into the abnormal control flow to support the detection of a new fault; and generating the run-time abnormal control flow set through an iterative equation by combining the conventional static test technology to realize alternated iterative execution of control flow expansion and new fault detection. The method expands the traditional analysis path and fulfills the purpose of improving the fault report rate.

Description

The method for testing software of using abnormal control flow set and system

Technical field

The present invention relates to software testing technology, relate in particular to a kind of method for testing software and system of using abnormal control flow set.

Background technology

Different with traditional method for testing software, software static test towards the code defective at first will be summed up defective from the code aspect of software, it is abstracted into corresponding defect mode, abstract semanteme to related content in the program carries out approximate treatment then, at last result of calculation is applied to defect mode and detects.Be subjected to the favor of software industry just gradually towards the software static test technology of code defective, become the software testing technology of a kind of main flow of the U.S..Representative code defective static test instrument mainly contains the research project Metal of Stanford university at present, the java applet static test instrument FindBugs of Maryland university research and development, the java applet static test instrument PMD that increases income, the code defect detection tool K8 of U.S. Klocwork company research and development.The result shows by contrast test, and owing to the degree of approximation difference to abstract semanteme, all there is wrong report in various degree in existing testing tool and fails to report situation.

For unforeseen problem in the minimizing program occurs, the software developer can handle abnormal conditions by a large amount of codes of special establishment, even has the code above 2/3rds to be used for abnormality processing in some software systems.Because the introducing of exception handling, it is more complicated that the control rheology of program is got, so work has brought bigger challenge to static test.Though present many experts and scholars have carried out deep research at this point, but to the expansion of control stream, the new run-time exception that causes on the control stream of expansion, and both replace iterative relation the influence of static test are not but all related to for run-time exception.All all do not consider this problem towards the software static test technology and the instrument of code defective at present, and the path analysis that brings thus is insufficient to be a major reason that causes the part defective to be failed to report.

Summary of the invention

The technical problem to be solved in the present invention provides a kind of method for testing software and system that uses run-time exception control adfluxion, can handle the alternately iterative relation between the expansion of run-time exception Detection ﹠ Controling stream, solve thus in static test because the insufficient problem of path analysis that run-time exception causes.

In order to solve the problems of the technologies described above, the invention provides a kind of method for testing software of using abnormal control flow set, comprising:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

Step B, the pairing initial control stream of traversal analytic unit are promptly controlled first element in the adfluxion, and all nodes that call subfunction are wherein handled, and extract the run-time exception information that subfunction may be dished out, first element of expansion fault collection;

Step C, on first element of control adfluxion, use the static test detection failure, and testing result made an addition among first element of fault collection;

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, represents that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

On step F, the subsequent control stream that obtains in described step e, the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the described step e is adjusted into current control stream, the consequent malfunction that obtains in the described step F is adjusted into works as prior fault, returns step D;

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

Further, described steps A specifically comprises:

A1, initialization set member sequence number, it is 0 that its current value is set;

First element of A2, initialization fault collection, its currentElement of set of applications member's sequence number is set to sky;

The currentElement that first element of A3, initialization control adfluxion, set of applications member's sequence number controls adfluxion is set to the initial control of present analysis unit and flows.

Further, described step B specifically comprises:

B1, judge whether the node in the current control stream is its last node, then carries out described step C in this way, otherwise execution in step B2;

B2, judge the statement that whether exists in the present node of current control stream function call, if exist then execution in step B3, otherwise execution in step B5;

B3, according to the function abstracted information discriminant function run-time exception of whether can dishing out that in node, is called, execution in step B4 in this way, otherwise execution in step B5;

B4, the ordered pair that node and Exception Type are formed join and work as prior fault, then execution in step B5;

B5, replace present node, return step B1 with the next node of node in the current control stream.

Further, described step C specifically comprises:

The method of C1, application finite state machine is described fault, node is wherein represented contingent state, possible switch condition between Bian representative state is created and concrete variable correlation behavior machine example for analyzed unit, chooses one as current state machine example from all state machine instance;

C2, on the diverse location of control stream, for the variable in the current state machine example calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine example, in state conversion process if break down state, execution in step C3 then, otherwise execution in step C4;

C3, the run-time exception composition ordered pair that will go out the position of present condition and dish out join ordered pair in prior fault;

C4, judge in the state machine instance set whether have untreated example, and if existed with next example as current example, return step C2, otherwise carry out described step D.

Further, described step e specifically comprises:

E1, choose the current ordered pair in the fault, on control stream, match the respective nodes of ordered pair, judge whether this node is in the exception catching structure, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure corresponding with the exception catching structure can handle the pairing Exception Type of run-time exception in the ordered pair, then on current control stream, add the limit from node to corresponding abnormality processing structure node, an execution in step E5 then in this way; As denying execution in step E3;

Whether E3, judgement also exist other exception catching structure except that current exception catching structure, then outer field in this way exception catching structure is set to current structure, returns step e 2, otherwise execution in step E5;

E4, on current control stream, add one from node to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual;

E5, judge in prior fault whether have the ordered pair of not handling,, return step e 1 if exist then it is labeled as current ordered pair; Otherwise obtain the subsequent control stream of current control stream, then execution in step F.

Further, described step F specifically comprises:

F1, initialization fault are concentrated the consequent malfunction when prior fault, and consequent malfunction is set to sky;

F2, be that analyzed unit is created and concrete variable correlation behavior machine example, from all state machine instance, choose one as current state machine example;

F3, on the diverse location of subsequent control stream, for the variable in the current state machine example calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine example, in state conversion process if break down state, execution in step F4 then, otherwise execution in step F5;

F4, the run-time exception that will occur using wrong position and this mistake to dish out are formed ordered pair, check whether this ordered pair is present in the failure collection, if there is no, then this ordered pair are joined in the described consequent malfunction in back;

F5, judge in the state machine instance set whether have untreated example,, return step F 3 if exist then choose a untreated example as current example, otherwise execution in step G.

Further, described step H specifically comprises:

H1, choose and point to a limit withdrawing from node in the current control stream unusually, with it as working as the pre-treatment limit;

H2, will work as the pairing Exception Type in front and join among the abstracted information of present analysis unit;

H3, judge to point to the limit of withdrawing from node in the current control stream unusually and whether all finish dealing with, execution in step I then in this way, otherwise select to withdraw from unusually in the current control stream limit of node, it as working as the pre-treatment limit, is returned step H2.

The present invention also provides a kind of software testing system of using abnormal control flow set, comprising:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set, be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled, extract the run-time exception information that subfunction may be dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, represents that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module, be used in described judge module output iterative detection unclosed as a result the time, the run-time exception information that in prior fault, is comprised with the fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module, be used to adjust the current information sensing of control adfluxion and fault collection, the subsequent control stream that described subsequent control stream acquisition module is obtained is adjusted into current control stream, the consequent malfunction that described subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to described judge module;

The run-time exception extraction module, be used for described judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

The run-time exception behavior is described by the abnormal patterns state machine by method for testing software provided by the present invention and system, can support the expansion of control stream and the automatic detection of fault; By the traditional abnormal control flow of run-time exception control stream expansion, the limit of the run-time exception of dishing out is added wherein, to support detection to new fault; In conjunction with existing static test technology, abnormal control flow set during by the iterative equation generating run is carried out with the alternately iteration that realizes expansion of control stream and new fault detect.By above method expansion traditional analysis path, reach the purpose that improves the Trouble Report rate.

Description of drawings

Fig. 1 is the schematic flow sheet of the method for testing software of using abnormal control flow set of the present invention;

Fig. 2 is used to describe the state machine that null pointer is quoted abnormal patterns for the present invention;

Fig. 3 is used to describe the state machine of other 3 kinds of abnormal patterns for the present invention;

Fig. 4 is the abnormal control flow set of his-and-hers watches 1 function f l of the present invention;

Fig. 5 is the abnormal control flow set of his-and-hers watches 1 function f of the present invention;

Fig. 6 is the synoptic diagram of experiment porch of the present invention;

Fig. 7 is the formation block scheme of the software testing system of using abnormal control flow set of the present invention.

Embodiment

The invention will be further described below in conjunction with the drawings and specific embodiments, can be implemented so that those skilled in the art can better understand the present invention also, but illustrated embodiment is not as a limitation of the invention.

Static test technology towards the code defective can be described as theoretically to problem D={P, M, and A} finds the solution, and P represents tested program here; M is the code defect mode set corresponding with P; A is the algorithm that obtains the abstract semanteme of related content among the P, is used for determining whether P exists defect mode M.Algorithm A is described as A={S among the D, and ρ (L, X), σ (F) }, wherein S is the path among the program P; ρ is for calculating the value information of correlated variables X approx, and L is the executing location of P, and X is the variable that P carries out the L place; σ is the abstract context of function, represents approx calling the abstract of function F.Because the introducing of run-time exception may expand to S with the control flow path S that influenced by it ₁, and at S ₁On may find new run-time exception again, through so alternately obtaining [S after the iterative process ₁..., S _n], S wherein _iAt S _I-1The basis on produce, and

The problem that algorithm A is found the solution can be converted into A={S ∪ [S like this ₁..., S _n], ρ (L, X), σ (F) }.

In the static test process,, promptly in algorithm A, omitted analysis path [S if ignored processing to run-time exception ₁..., S _n], then have

The situation that defective is failed to report appears thus:

Wherein D (M | x) expression is because the value x of variable X causes fault M, The value x of expression variable X can not cause fault M, and False Negative (X) represents failing to report variable X.This shows that because the existence of run-time exception, it can produce alternately iterative relation in program operation process and between control stream, this specific character can influence static test process and result.

Use run-time exception in order to be implemented in the software static test process, the present invention proposes a kind of static test of using run-time exception, realization fault detect and control stream are expanded alternately iteration execution: fault detect causes controlling stream and goes up the limit that run-time exception is represented in interpolation, extra limit of adding causes detecting more fault again, and this process repeats to control and flows till the no longer expansion.Use the abnormal patterns state machine and describe the characteristic of run-time exception, find run-time exception by its malfunction.Use the running environment of run-time exception control stream, on tradition control stream, increase the limit of handling run-time exception as fault detect.In conjunction with existing static test technology, abnormal control flow set during by the iterative equation generating run is to realize the process that iterates of expansion of control stream and new fault detect.Below respectively the alternately iterative relation between run-time exception description, run-time exception testing environment, the expansion of run-time exception Detection ﹠ Controling stream is elaborated.

1. run-time exception is described

Problem D={P, M, the defect mode M among the A} is the basis of finding the solution D, and how run-time exception being explained among the M is at first to need the problem that solves, and the present invention adopts the abnormal patterns state machine that it is unified to be described below:

The abnormal patterns state machine is defined as a tlv triple EM=＜N, T, C 〉, corresponding one type of each abnormal patterns state machine unusual.N is a state set, comprise in the abnormal patterns the state that might reach.T={＜n _i, n _j| n _i, n _j∈ N} is the state exchange set, and state machine may be from state n _iBe transformed into state n _jC is a state transition condition, T:N * C → N.

N _StartBe the unique inlet of state machine, enter this state after state machine is created automatically; N _EndBe the unique outlet of state machine, enter this state behind the state machine end of run automatically; N _Fault={ Exception, Error} are the unique malfunctions of state machine, unusually then are not labeled as Error as not dishing out when prior fault, otherwise are labeled as Exception.N={N _Start, N _Fault, N _End∪ N _Other, N _OtherExpression other state except that above three state, it is different with the difference of defect type.

When carrying out state exchange on the abnormal patterns state machine, need to finish in conjunction with the abstract semanteme and the state transition condition C of concrete variable X, the abnormal patterns state machine EM of corresponding variable X is called the abnormal patterns state machine instance EM (X) of X.

Virtual condition on the EM (X) is converted to n _i={ n _j* C | { S, ρ (L, X), σ (F) } }, in conjunction with concrete variable X and at the abstract semanteme at position L place { S, ρ (L, X), σ (F) }, can be by state transition condition C with the current state n of EM (X) _jBe converted to state n _i

Suppose program P comprises the run-time exception pattern { EM that the n kind is set ₁, EM ₂..., EM _n, influenced by the correlated variables X among the P, every kind of abnormal patterns EM _iMaximum corresponding m kind abnormal patterns state machine instance { EM _i(X ₁), EM _i(X ₂) ..., EM _i(X _m), then all abnormal patterns state machine instance of program P correspondence constitute the abnormal patterns state machine instance matrix of P, and note is done:

${\left({\mathrm{EM}}_{\mathrm{ij}}\right)}_{n\×m}=\left[\begin{array}{cccc}{\mathrm{EM}}_1\left(X_1\right)& {\mathrm{EM}}_1\left(X_2\right)& ...& {\mathrm{EM}}_1\left(X_m\right)\\ {\mathrm{EM}}_2\left(X_1\right)& {\mathrm{EM}}_2\left(X_2\right)& ...& {\mathrm{EM}}_2\left(X_m\right)\\ ...& ...& & ...\\ {\mathrm{EM}}_n\left(X_1\right)& {\mathrm{EM}}_n\left(X_2\right)& ...& {\mathrm{EM}}_n\left(X_m\right)\end{array}\right].$

The expression variable X _jWith abnormal patterns EM _iIrrelevant, do not need to be X _jCreate such state machine instance.For (EM _Ij) _{N * m}In all non-NULL state machine instance Expression need be the variable X among the program P _jCreate the abnormal patterns state machine instance.In the state machine instance of all non-NULLs, identical part is three state { N _Start, N _Fault, N _End, as for other N state _OtherWith state transition condition C with EM _iDifference and different.Malfunction N _Fault: Error only provides error message, N _Fault: Exception also will be used to control the expansion of stream in the back except that error message is provided.

Among Fig. 2 a state machine description of quoting abnormal patterns about null pointer, the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has the non-NULL N state _NotWith possibility dummy status N _MayState transition condition C comprise in have: C ₁(judging that pointer may be empty), C ₂(judging the pointer non-NULL), C ₃(reference pointer content), C ₄(exceeding the pointer action scope), C ₅(conversion automatically), C ₆(other).State exchange set comprise in have: T ₁: N _Start* C ₆→ N _Start, T ₂: N _Start* C ₁→ N _May, T ₃: N _Start* C ₂→ N _Not, T ₄: N _May* C ₆→ N _May, T ₅: N _May* C ₃→ N _Fault, T ₆: N _May* C ₄→ N _End, T ₇: N _May* C ₂→ N _Not, T ₈: N _Not* C ₆→ N _Not, T ₉: N _Not* C ₄→ N _End, T ₁₀: N _Not* C ₁→ N _May, T ₁₁: N _Error* C ₅→ N _End

Be that a state machine about buffer zone overflow exception pattern is described among Fig. 3 (a), the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has binding state N _BoundState transition condition C comprise in have: C ₁(for buffer zone binding space), C ₂(usage space surpasses the binding space), C ₃(exceeding the buffer zone action scope), C ₄(conversion automatically), C ₅(other).State exchange set comprise in have: T ₁: N _Start* C ₁→ N _Bound, T ₂: N _Start* C ₅→ N _Start, T ₃: N _Bound* C ₅→ N _Bound, T ₄: N _Bound* C ₂→ N _Fault, T ₅: N _Bound* C ₃→ N _End, T ₆: N _{Fault *}C ₄→ N _End

Among Fig. 3 (b) a state machine description of quoting abnormal patterns about wrong indicator, the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has distribution state N _AllocWith release conditions N _FreeState transition condition C comprise in have: C ₁(reference pointer), C ₂(allocation space), C ₃(Free up Memory), C ₄(exceeding the pointer action scope), C ₅(conversion automatically), C ₆(other).State exchange set comprise in have: T ₁: N _Start* C ₆→ N _Start, T ₂: N _Start* C ₁→ N _Fault, T ₃: N _Start* C ₂→ N _Alloc, T ₄: N _Alloc* C ₄→ N _Free, T ₅: N _Alloc* C ₄→ N _End, T ₆: N _Alloc* C ₆→ N _Alloc, T ₇: N _Free* C ₂→ N _Alloc, T ₈: N _Free* C ₁→ N _Fault, T ₉: N _Free* C ₆→ N _Free, T ₁₀: N _Free* C ₄→ N _End, T ₁₁: N _Fault* C ₅→ N _End

Be that a state machine about the memory leak faults pattern is described among Fig. 3 (c), the run-time exception because this type of fault can not dished out, so malfunction is labeled as Error.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has distribution state N _AllocWith release conditions N _FreeState transition condition C comprise in have: C ₁(storage allocation), C ₂(releasing memory), C ₃(exceeding the pointer action scope), C ₄(conversion automatically), C ₅(other).State exchange set comprise in have: T ₁: N _Start* C ₅→ N _Start, T ₂: N _Start* C ₁→ N _Alloc, T ₃: N _Alloc* C ₂→ N _Free, T ₄: N _Alloc* C ₃→ N _Fault, T ₅: N _Alloc* C ₅→ N _Alloc, T ₆: N _Free* C ₁→ N _Alloc, T ₇: N _Free* C ₃→ N _End, T ₈: N _Free* C ₅→ N _Free, T ₉: N _Fault* C ₄→ N _End

Table 1: tested program fragment

1：void?fl(char*p){

2： char*q；

3： if(！p){print(″null″)；}

4： try{

5： *p＝′a′；//NullPointerDereference

6： if(！q＝malloc[p.len+1])throw?E ₁；

7： strcpy(p，q)；//BufferOverflow

8： }

9： catch(NullPointerException?e){

10： }

11： free(q)；//WrongPointerDereference

12： }

13： void?f(int?len){

14： try{

15： char*p＝malloc(len)；

16： fl(p)；

17： free(p)；

18： }

19： catch(Excep?E ₁){free(p)；}

20： catch(Excep?E _wpd){

21： char*q＝malloc(len)；

22： strcpy(q，p)；

23： free(q)；}

24：}

Suppose that the run-time exception state machine that the function f 1 in the his-and-hers watches 1 is set has three types: EM _Npd(null pointer is quoted unusually), EM _Bo(buffer zone overflow exception), EM _Wpd(the mistake reference pointer is unusual), then relevant with types of variables among the f1, need be respectively for the state machine instance that every class defective is created: EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), they constitute the state machine instance matrix of f1 jointly:

After the above method that run-time exception has been described has been arranged, can in the program with specific exceptions pattern EM _iRelevant variable X _jCreate abnormal patterns state machine instance EM _i(X _j), in conjunction with variable X _jAbstract semanteme, use switch condition EM _i.C carry out state exchange.When the N state that breaks down _Fault: behind the Exception, record trouble and to control stream expand accordingly.

2. run-time exception control is flowed

Existing method is when construction procedures control stream, comprised the abnormality processing correlative, as the try statement of determining the exception catching scope, determine the catch statement of catching exception type, and can determine the throw statement of unusual throw point and dish out and can determine unusual process.In addition, in order to describe unusual influence to program control flow fully, the content relevant with run-time exception also should join wherein, as the statement of the run-time exception of can dishing out and the function of run-time exception or the like of can dishing out.The present invention is defined as follows run-time exception control stream:

Run-time exception control stream is to describe the program digraph that comprises that run-time exception is handled, and it has increased the point set and the Bian Ji that describe the run-time exception Processing Structure on the basis of the former control stream of program, be expressed as tuple REC=＜N, E, N _Ex, N _Er, N _Ef, E _Re.Wherein N is a set of node, and each program statement is a node in the corresponding diagram all.N _ExBe the node explicit and that implicit expression is unusual of can dishing out, N _ErBe the node that comprises the run-time exception statement of can dishing out, N _EfIt is the node that comprises the run-time exception function of to dish out.Limit collection E={＜n _i, n _j| n _i, n _j∈ N}, expression node n _iAfter corresponding statement is carried out, XM n immediately _jCorresponding statement.E _ReBe N _ErAnd N _EfThe output limit of node is used to handle the run-time exception of being dished out.

N _ExBefore beginning, static test can determine N _ErAnd N _EfNeed in the static test process, can determine.To the node N that can dish out unusual _Ex, N _ErAnd N _Ef, its output of correspondence of two class limits is arranged, be labeled as E _NoThe limit correspondence be not triggered unusually, be labeled as { E _Re| E _Er={ E _Npd, E _Bo, E _Wpd... } and the corresponding E in limit _ReBeing triggered unusually of type, E _ReIn unusual type and quantity relevant with concrete syntax.Captive run-time exception passes through E _ReBe connected to corresponding catch node, run-time exception at large passes through E _ReWhat be connected to control stream withdraws from node unusually.N _EntryBe the unique inlet of control stream, N _ExitIt is the unique outlet of control stream.N={N _Entry, N _ExitN _Ex, N _Er, N _Ef∪ N _Other, N _OtherExpression other node except that above 5 kinds of nodes, E={E _No, E _Re∪ E _Other, E _OtherExpression other limit except that above 2 kinds of limits.

Based on above description, run-time exception control stream is summarized as follows with the difference of tradition control stream:

Unusual during 1, for the ease of positioning trip, each statement is as a control stream node, rather than a statement block;

2, corresponding each try statement has a N _TryNode, corresponding each catch statement has a N _CatchNode;

3, each unusual function of can dishing out all has a N _{Excp_exit}Node obtains unusual descendant node as at large in all functions.In order to guarantee to control the uniqueness of stream middle outlet, each function increases a N _{Norm_exit}Node, it and N _{Excp_exit}Descendant node be N _Exit

4, the node N of corresponding each run-time exception of can dishing out _ErOr N _Ef, by limit E _ReBe connected to the N corresponding with its type _CatchNode or the N corresponding not with it _{Excp_exit}Node; By limit E _NoLink N _EfOr N _ErThe non-abnormality processing node of first of node back.

3. abnormal control flow set

After being dished out, run-time exception can extender control flow, and new run-time exception may appear on the control stream of expansion, the present invention to controlling the expansion of flowing and flowing these two processes that replace iteration of the new run-time exception of discovery in the control of expansion and represent by abnormal control flow set, specifically describes as follows run-time exception:

Relation between the control of run-time exception behavior of abnormal control flow set representations and the expansion stream comprises run-time exception to the expansion of control stream with find new run-time exception on the control stream of expansion, and process of iteration like this, be expressed as a four-tuple＜RS, ES, G, T 〉.RS is a control stream ordered set { REC ₀, REC ₁..., REC _n, expression is subjected to the influence of run-time exception, and control stream is from REC ₀Beginning progressively expands to REC _nProcess; ES is a set corresponding with RS, constitutes ES={{ES by some order subsets ₀| REC ₀, { ES ₁| REC ₁..., { ES _n| REC _n, be illustrated in corresponding control stream and go up findable new run-time exception set, ordered pair＜N, E ∈ ES _i, N, E ∈ REC _iRepresent newfound run-time exception; G:REC _i* D (P, M, A) → ES _iBe from REC _iLast generation ES _iRule, T:REC _i* ES _i→ REC _I+1Be to pass through ES _iWith REC _iBe converted into REC _I+1Rule.

Under Regulation G,

Comprise two parts content, first control stream REC ₀In all comprise the run-time exception that the node of function call is dished out, comprise the run-time exception of re type in the abstract context of re ∈ σ (F) expression F,＜N, E _ReBe expressed as at control stream REC ₀Go up the ordered pair corresponding with re; It two is not comprise node N _ErAnd N _EfTraditional abnormal control flow REC ₀Upward (that A) asks effectively separates for P, M to problem D.M corresponding states machine example matrix (EM among the D _Ij) _{N * m}, at computation process (EM _Ij) _{N * m}Among * the A,

$\left[\begin{array}{cccc}{\mathrm{EM}}_1\left(X_1\right)& {\mathrm{EM}}_1\left(X_2\right)& ...& {\mathrm{EM}}_1\left(X_m\right)\\ {\mathrm{EM}}_2\left(X_1\right)& {\mathrm{EM}}_2\left(X_2\right)& ...& {\mathrm{EM}}_2\left(X_m\right)\\ ...& ...& & ...\\ {\mathrm{EM}}_n\left(X_1\right)& {\mathrm{EM}}_n\left(X_2\right)& ...& {\mathrm{EM}}_n\left(X_m\right)\end{array}\right]\×\left[\begin{array}{c}A\left(X_1\right)\\ A\left(X_2\right)\\ ...\\ A\left(X_m\right)\end{array}\right]=\underset{i=1}{\overset{n}{\mathrm{\Σ}}}\underset{j=1}{\overset{m}{\mathrm{\Σ}}}\underset{k=1}{\overset{m}{\mathrm{\Σ}}}{\mathrm{EM}}_i\left(X_j\right)A\left(X_k\right)$

Work as variable X _jWith abnormal patterns EM _iWhen irrelevant

In addition, when j ≠ k

Expression is to non-NULL example EM _i(X _j) the application algorithm

Different executing location L on the S of path are to X _jAbstract semanteme calculate, to realize to EM _i(X _j) state exchange.When obtaining EM at the L place _i(X _j) malfunction N _Fault: during Exception, expression is tried to achieve and is separated EM _i(X _j) A (X _jThe L of) →＜, EM _i, wherein L can correspond to REC ₀In the node N that dishes out unusually _Er, EM _iCan correspond to REC ₀In an abnormality processing limit E _Re

Under Regulation G, E _k=D (P, M, A) | REC _kBe at run-time exception control stream REC _kUpward (that A) asks newly effectively separates for P, M to problem D.M is state machine instance matrix (EM _Ij) _{N * m}, to the arbitrary example EM among the M _i(X _j) pairing variable X _j, algorithm In the path On different executing location L to X _jIts abstract semanteme calculate, and try to achieve EM _i(X _j) A (X _jThe L of) →＜, EM _i.By to (EM _Ij) _{N * m}In all example calculation, last controlled stream REC _kLast the new run-time exception that might dish out

Under rule T,

Use ES _iThe information {＜N of middle record _Er, E _Re| N _Er, E _Re∈ REC _i, at control stream REC _iThe dish out node N of run-time exception of last mark _Er, and add corresponding abnormality processing limit E _Re, at last it is expanded to REC _I+1, SUM (ES _i) be ES _iMiddle number of members.

Alternately iteration by to unusual create-rule G and control stream translation rule T can realize the generation of abnormal control flow set RS.Iterative equation is expressed as follows, and supposes REC ₀Known, iterative process is from t=1, up to Finish.

${\mathrm{REC}}_t=\left\{\begin{array}{cc}\mathrm{RE}{C}_0,& t=0,\\ \underset{j=1}{\overset{\mathrm{sum}\left({\mathrm{ES}}_{t-1}\right)}{\∪}}\{{\mathrm{REC}}_{t-1}\×{\mathrm{ES}}_{(t-1)j}\},& t\≥1\end{array}\right.$

In order to analyze the character of abnormal control flow set RS, it can be mapped to function R S={y|y=f (x) }, for any 2 x in f (x) the field of definition x ∈ [0, m] ₁And x ₂, perseverance has

Therefore function f (x) is dull increasing on interval x ∈ [0, m].In addition, because type, statement and the function of the run-time exception of can dishing out among the program P all are limited, therefore total iterations also is limited, and promptly the field of definition of f (x) is a bounded.For the function f (x) of dull bounded, it must have the limit, and promptly the abnormal control flow set RS that f (x) is corresponding has the limit.

Based on above description, the difference between run-time exception control stream and traditional abnormal control flow is as follows:

1, in traditional abnormal control flow node with unusual relevant the node explicit unusual and unusual node N of implicit expression that only dishes out _Ex, and remove N in the run-time exception control stream _ExOutside the node, also comprise the N of the run-time exception of dishing out _ErAnd N _EfNode, and the limit E that handles run-time exception _Re

2, at traditional abnormal control flow REC ₀On when carrying out static test, can only report the run-time exception information E of current discovery ₀, and consequent fault; And the run-time exception of the fault detection method of using iterative control stream is from traditional abnormal control flow REC ₀Beginning expands to { REC by iterative equation with it ₀, REC ₁..., REC _n, can find more run-time exception { E ₁..., E _n, and other failure message that brings thus.

With usability of program fragments fl in the table 1 is example, and the run-time exception control adfluxion of its correspondence as shown in Figure 4.Wherein Fig. 4 (a) is traditional abnormal control flow REC ₀, limit E ₁Be node n ₉In (6 row) condition be true time dish out unusual.If do not consider the influence of run-time exception, analysis node n all sidedly in test process then ₈(9 row) and node n ₁₄It is unusual that (12 row) catches.And the fault detection method of using iterative, Regulation G is at REC ₀Unusual and the buffer zone overflow exception ES of last discovery null pointer ₀={＜n ₇, E _Npd,＜n ₁₁, E _BoAfter, rule T is with REC ₀Be converted to the REC of Fig. 4 (b) ₁, limit E wherein _NpdBe node n ₇In (5 row) because variable p is empty dish out unusual, limit E _BoBe node n ₁₁In (7 row) because buffer zone overflows dish out unusual; When variable p was sky, Regulation G can be at REC ₁The last discovery used unusual ES to the pointer q of no initializtion ₁={＜n ₁₂, E _Wpd, rule T can be with REC ₁Be converted to the REC of Fig. 4 (c) ₂At last

Iteration stops.

From last example as can be seen, owing to used the fault detection method of iteration, make tested object from traditional abnormal control flow REC ₀Expand to REC ₁And REC ₂, comprised node n ₈With node n ₁₄Catch behind the run-time exception the influence of test result, these contents are that other method of testing based on traditional abnormal control flow is not available.

The related content of run-time exception and run-time exception control stream has been introduced in the front, and generates abnormal control flow set by iterative equation, realizes the expansion to the traditional static method of testing.Provide the generating algorithm of abnormal control flow set below, as shown in table 2.The program that the is input as P correspondence of algorithm do not comprise node N _ErAnd N _EfTraditional abnormal control flow CFG (P), and abnormal patterns state machine instance matrix (EM _Ij) _{N * m}, be output as abnormal control flow set RS and corresponding failure message collection ES.

Table 2 abnormal control flow set generating algorithm is described

1：begin

2： I＝0；

3： REC[I]＝CFG(P)；

4： for?each?N?in?REC[I]?do

5： if?F∈N^re∈σ(F)then?ES[I]＝ES[I]∪<N，re>；

6： end?for

7： for?each?EM _i(X _j)in(EM _ij) _n×m?do

8： ES[I]＝ES[I]+{EM _i(X _j)A(X _j)|REC[I]}；

9： end?for

12： for?each<N，E>in?ES[I]?do

13： REC[I+l]＝REC[I]+<N，E>；

14： end?for

15： for?each?EM _i(X _j)in(EM _ij) _n×m?do

$16:\mathrm{ES}[I+1]=\mathrm{ES}[I+1]+$

$\left\{{\mathrm{EM}}_i\left(X_j\right)A\left(X_j\right)\right|\mathrm{REC}[I+1]\}-\underset{i=0}{\overset{I}{\mathrm{\&Sigma;}}}\mathrm{ES}[i];$

17： end?for

18： I++；

19： end while

20： for?each?E _re?in?REC[I].N _{excp_exit}?do

21： add(σ(P)，E _re)；

22： end?for

23：end

Algorithm the 4th～6 row is at first added up the abstract context of the function F that is called among the P, checks its run-time exception of whether dishing out, if exist, then these unusual relevant informations is joined ES[0] in; All state machine instance of 7～9 row traversal program P are at control stream REC[0] on obtain variable X _jAbstract semantic A (X _j) information, to determine state machine instance EM _i(X _j) whether can break down N state _Fault: Exception, if then with unusual relevant information＜L, EM _iJoin ES[0] in, wherein L is the unusual position of dishing out, EM _iBe Exception Type; If ES[0] be not empty, then from the 10th iterative process that is advanced into REC.

The 12nd～14 row at first calculates ES[I] to REC[I] change, with ES[I] in the up-to-date run-time exception information of record add REC[I to], promptly at REC[I] in the mark node of dishing out unusually, and adding abnormality processing limit obtains REC[I+l thus]; Ensuing 15～17 row are traversal (EM once more _Ij) _{N * m}, at REC[I+1] on obtain variable X _jAbstract semantic A (X _j) information, to determine state machine instance EM _i(X _j) whether can break down N state _Fault: Exception, if malfunction also needs to judge its up-to-date property, promptly therefrom remove in the past found identical unusual.By the while circulation of 10～19 row, progressively iteration goes out all members among the REC, up to there not being up-to-date unusual appearance, promptly

Algorithm is last, is used by other function in order to make the run-time exception of dishing out in the current function, the function of the run-time exception of promptly determining to dish out, and 20～22 are about in the current control stream that all are connected to N _{Excp_exit}The limit of node, what be about to not be captured among the program P joins among its abstract context σ (P) unusually, for the caller use of P.

Below in conjunction with accompanying drawing, be example with the tested function f l in the table 1, the application of abnormal control flow set in software test that the present invention is proposed is explained and illustrated, and Fig. 1 is the application flow synoptic diagram of abnormal control flow set of the present invention in software test.As shown in Figure 1, this method may further comprise the steps:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

The present analysis unit is for being the function f 1 in the table 1, and its input information comprises the initial control flow graph CFG (f1) of f1, shown in Fig. 4 (a).Suppose that the run-time exception state machine that f1 is set has four types: EM _Npd(null pointer is quoted unusually), EM _Bo(buffer zone overflow exception), EM _Wpd(the mistake reference pointer is unusual) and EM _Mlf(memory overflow) then needs to be respectively for the state machine instance that every class fault is created: EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), EM _Mlf(q), they constitute the state machine instance matrix of f1 jointly:

This step is to control stream REC[0] and fault ES[0] carry out initialization operation after, initially controlled and flowed REC[0]=CFG (f1) and primary fault

Step B, the pairing initial control stream of traversal analytic unit, the run-time exception information that the extraction subfunction may be dished out is with first element of expansion fault collection, and execution in step is as follows:

B1, judge current control stream REC[0] in node N whether be its last node, execution in step C then in this way, otherwise execution in step B2;

B2, judge current control stream REC[0] present node N in whether have statement to function call, if exist then execution in step B3, otherwise execution in step B5;

B3, suppose that function F is called in node N, then according to its abstracted information σ (F) discriminant function F run-time exception of whether can dishing out, execution in step B4 in this way, otherwise execution in step B5;

B4, suppose that the run-time exception type that function F that node N calls is dished out is E, ordered pair＜N that node and Exception Type are formed then, E〉join as prior fault ES[0], execution in step B5 then;

B5, with current control stream REC[0] in the next node of node N replace present node, execution in step B1 then.

Control stream REC[0 in analytic unit f1 correspondence] in, because f1 is in the bottom of call relation, the subfunction that does not have to call for it generates abstracted information, at control stream REC[0] after traversal finishes, all nodes that comprise function call run-time exception of all not dishing out, therefore step B complete after, work as prior fault

Step C, on current control stream REC[0], use existing static test detection failure, testing result is added to as prior fault ES[0] in, execution in step is as follows:

The method of C1, application finite state machine is described fault, node is wherein represented contingent state, possible switch condition between Bian representative state, for creating and concrete variable correlation behavior machine example analyzed unit, from all state machine instance, choose an EM (X) as current state machine example, execution in step C2 then;

C2, at control stream REC[0] diverse location N on, for the variable X among the current state machine example EM (X) is calculated its possible value, and the bonding state switch condition carries out state exchange to EM (X).In state conversion process if the state that breaks down, execution in step C3 then, otherwise execution in step C4;

C3, step C2 carry out variable X appears in the back at position N place use mistake, as if this mistake run-time exception E that can dish out, then with ordered pair＜N, E〉join as prior fault ES[0] in, execution in step C4 then;

Whether have untreated example in the set of C4, state machine instance, and if existed with next example as current example, execution in step C2 then, otherwise execution in step D.

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each example EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), EM _Mlf(q) as analytic target, at control stream REC[0] each node on the possible value condition of calculated examples correlated variables, and the bonding state switch condition carries out state exchange.Result of calculation is EM _Npd(p) at node n ₇Pass through T ₅: N _May* C ₃→ N _FaultDerive malfunction, EM _Bo(p) at node n ₁₁Pass through T ₄: N _Bound* C ₂→ N _FaultDerive malfunction.Because EM _Npd(p) and EM _Bo(p) run-time exception of can dishing out, thus step C complete after, obtain as prior fault ES[0]={＜n ₇, npd 〉,＜n ₁₁, bo＞}.

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, represents that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Owing to obtain as prior fault ES[0 after step C carries out]={＜n ₇, npd 〉,＜n ₁₁, bo〉}, iterative detection does not finish, then execution in step E.

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, the execution in step of subsequent control stream that obtains current control stream is as follows:

E1, choose fault ES[I] in current ordered pair＜N, E 〉, at control stream REC[I] on match node N, whether decision node N is among the exception catching structure try, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure catch corresponding with exception catching structure try can handle the pairing Exception Type of E, in this way then at REC[I] go up to add a limit, execution in step E5 then, otherwise execution in step E3 from N to corresponding catch node;

Whether E3, current exception catching structure try also exist the try structure outward, and then outer field in this way try structure is set to current structure, execution in step E2 then, otherwise execution in step E5;

E4, at REC[I] go up to add one from node N to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual, execution in step E5 then;

E5, judge as prior fault ES[I] in whether have the ordered pair＜N that did not handle, E 〉, if exist then it be labeled as current ordered pair, execution in step E1 then, otherwise obtain current control stream REC[I] subsequent control stream REC[I+1], execution in step F then.

For working as prior fault ES[0]={＜n ₇, npd 〉,＜n ₁₁, bo〉}, at first therefrom choose ordered pair＜n ₇, npd 〉, node n ₇Be among the exception catching structure try, and abnormality processing structure catch can handle null pointer and quote unusually, therefore at control stream REC[0] the node n that dishes out unusually ₇With abnormality processing node n ₈Between add a limit of handling this run-time exception; Choose ordered pair＜n then ₁₁, bo 〉, node n _LlTherefore be among the exception catching structure try, but abnormality processing structure catch cannot handle the buffer zone overflow exception, at control stream REC[0] the node n that dishes out unusually ₁₁Unusually withdraw from node n ₁₄Between add a limit of handling this run-time exception.Through after the execution of step e, obtain former control stream REC[0] subsequent control stream REC[1], shown in Fig. 4 (b).

Step F: on the subsequent control that the obtains stream, use existing fault detection technique in step e, be not present in fault that fault concentrates and add among the consequent malfunction detected, obtain the next element of fault collection, execution in step is as follows:

F1, initialization fault concentrate fault ES[I] consequent malfunction ES[I+1], it is set to sky

Execution in step F2 then;

F2, be that analyzed unit is created and concrete variable correlation behavior machine example, from all state machine instance, choose an EM (X) as current state machine example, execution in step F3 then;

F3, at control stream REC[I+1] diverse location N on, for the variable X among the current state machine example EM (X) is calculated its possible value, and the bonding state switch condition carries out state exchange to EM (X).In state conversion process if the state that breaks down, execution in step F4 then, otherwise execution in step F5;

F4, step F 3 are carried out the back in the use mistake of position N place appearance to variable X, the run-time exception E if this mistake can be dished out, then check ordered pair＜N, E〉whether be present in set ES[0], ES[1], ..., ES[I] } in, if there is no, then with ordered pair＜N, E〉join fault ES[I+1] in, execution in step F5 then;

Whether there is untreated example in the set of F5, state machine instance, if exist then choose a untreated example as current example EM (X), execution in step F3 then, otherwise execution in step G.

At first initialization

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each example EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), EM _Mlf(q) as analytic target, at control stream REC[1] each node on the possible value condition of calculated examples correlated variables, and the bonding state switch condition carries out state exchange.Result of calculation is EM _Npd(p) at node n ₇Pass through EM _Npd(T ₅: N _May* C ₃→ N _Fault) the derivation malfunction, EM _Bo(p) at node n ₁₁Pass through EM _Bo(T ₄: N _Bound* C ₂→ N _Fault) the derivation malfunction, EM _Wpd(q) at node n ₁₂Pass through EM _Wpd(T ₂: N _Start* C ₁→ N _Fault) the derivation malfunction, EM _Mlf(q) at node n ₁₄Pass through EM _Mlf(T ₄: N _Alloc* C ₃→ N _Fault) the derivation malfunction.EM _Npd(p) and EM _Bo(p) though the run-time exception of can dishing out, they have appeared at ES[0] in, EM _MlfThe run-time exception of can not dishing out, thus step F complete after, obtain as prior fault ES[1]={＜n ₁₂, wpd＞}.

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the step e is adjusted into current control stream, the consequent malfunction that obtains in the step F is adjusted into works as prior fault, then execution in step D;

In step D because ES[1}={＜n ₁₂, wpd〉} be not empty, therefore need once more the process of repeating step D to step G.In this process, obtain REC[2 by step e], shown in Fig. 4 (c).After step F is carried out,, therefore have owing to there is not new fault to produce

When execution in step D once more, withdraw from cyclic process, execution in step H.

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure, be used for calling of other analytic unit step B, implementation step is as follows:

H1, choose and point to control stream REC[I] in withdraw from a limit E of node unusually, with it as working as pre-treatment limit, execution in step H2 then;

H2, will work as among the abstracted information σ (F) that E pairing Exception Type in front joins the present analysis unit F, then execution in step H3;

H3, judge to point to control stream REC[I] in withdraw from node unusually the limit whether all finish dealing with execution in step I then in this way, otherwise execution in step H2.

When carrying out this step, current control stream is REC[2], what be connected to it withdraws from node n unusually ₁₄The limit have three: from node n ₁₂The mistake that spreads out of is used the unusual limit E of pointer _Wpd, from node n ₁₁The buffer zone overflow exception limit E that spreads out of _Bo, from node n ₁₀The self-defined unusual limit E that spreads out of ₁After step H is complete, in the pairing abstracted information σ (f1) that joins function f 1 unusually in these three limits, call for the step B of analytic function f.

Next be the analytic process of function f in the his-and-hers watches 1, its input information comprises the initial control flow graph CFG (f) of f, shown in Fig. 5 (a).The run-time exception state machine of corresponding f also has four types: EM _Npd, EM _Bo, EM _WpdAnd EM _Mlf, need be respectively for the state machine instance that every class fault is created: EM _Npd(p), EM _Npd(q), EM _Bo(q), EM _Wpd(p), EM _Wpd(q), EM _Mlf(p), EM _Mlf(q), they constitute the state machine instance matrix of f jointly:

This step is to control stream REC[0] and fault ES[0] carry out initialization operation after, initially controlled and flowed REC[0]=CFG (f) and primary fault

At the control of analytic unit f correspondence stream REC[0] in, when f1 analyze kept that it can dish out after finishing unusually in σ (f1), so step B complete after, as prior fault ES[0]={＜n ₄, wpd 〉,＜n ₄, bo〉}.

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each example EM _Npd(p), EM _Npd(q), EM _Bo(q), EM _Wpd(p), EM _Wpd(q), EM _Mlf(p), EM _Mlf(q) as analytic target, at control stream REC[0] each node on possible the value condition of calculated examples correlated variables, and the bonding state switch condition carries out state exchange, after step C is complete, obtains working as prior fault ES[0]={＜n ₄, wpd 〉,＜n ₄, bo〉}.

Owing to obtain as prior fault ES[0 after step C carries out]={＜n ₄, wpd 〉,＜n ₄, bo〉}, iterative detection does not finish, then execution in step E.

For working as prior fault ES[0]={＜n ₄, wpd 〉,＜n ₄, bo〉}, at first therefrom choose ordered pair＜n ₄, wpd 〉, node n ₄Be among the exception catching structure try, and abnormality processing structure catch can to handle wrong reference pointer unusual, therefore at control stream REC[0] the node n that dishes out unusually ₄With abnormality processing node n ₈Between add a limit of handling this run-time exception; Choose ordered pair＜n then ₄, bo 〉, node n ₄Therefore be among the exception catching structure try, but abnormality processing structure catch cannot handle the buffer zone overflow exception, at control stream REC[0] the node n that dishes out unusually ₄Unusually withdraw from node n ₁₄Between add a limit of handling this run-time exception.Through after the execution of step e, obtain former control stream REC[0] subsequent control stream REC[1], shown in Fig. 5 (b).

Next initialization

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each example as analytic target, at control stream REC[1] each node on the possible value condition of calculated examples correlated variables, and the bonding state switch condition carries out state exchange.Result of calculation is for obtaining as prior fault ES[1]={＜n ₁₀, npd＞}.Because ES[1]={＜n ₁₀, npd〉} be not empty, therefore need once more the process of repeating step D to step G.In this process, obtain REC[2 by step e], shown in Fig. 5 (c).After step F is carried out,, therefore have owing to there is not new fault to produce

When execution in step D once more, withdraw from cyclic process, execution in step H.

Below in conjunction with concrete experiment the effect of the method for testing software of using abnormal control flow set to fault detect is described.Experiment is based on the software static test system DTS based on the code defective, and contrast using abnormal control flow set front and back are to test process and result's influence.The DTS test structure mainly comprises following content as shown in Figure 6:

Configuration file is used for determining the fault type of needs detection, and it can determine the quantity of abnormal patterns state machine; By analyzing the correlated variables in the source file, determine every kind of abnormal patterns state machine need create the quantity of example; Abstract syntax tree is that create on the basis with the source file, and it is to the abstract semantic basis of calculating of program; Deposit the control stream information of each analytic unit in the control flow graph, it is the basis that fault detects; Deposit information such as action scope, notation declarations and use, type expression derivation in the symbol table, it obtains from the abstract syntax tree construction; Analytic process one side acquisition of information from abstract syntax tree and symbol table is determined to analyze order by the call relation between function between function, and the function of finishing for analysis is preserved its abstract context to be used for other analytic process on the other hand; Interval arithmetic is carried out approximate treatment to the abstract value of correlated variables in the program, and it depends on data structures such as abstract syntax tree, control flow graph and symbol table; After the state machine instance of present analysis unit is created and finished, need this example of operation to carry out state exchange.When carrying out interval arithmetic on each node of control stream, the bonding state switch condition is realized the state conversion process of state machine, and malfunction is used to control the expansion of stream.

On the test structure of existing DTS, this patent is an example with 9 java programs of increasing income, test process and result data before and after the contrast using abnormal control flow set.Set not using abnormal control flow set of DTS (A), DTS (B) using abnormal control flow set.Consider cost of development and operational efficiency, experiment is only studied null pointer and is quoted run-time exception to the test process of resource leakage class fault and result's influence.

Experimental data is as shown in table 3.The instance number of the 4th row only comprises each engineering is quoted abnormal patterns foundation to null pointer state machine instance quantity in the table; Member's sum that total iteration situation of the 5th row is an abnormal control flow set, i.e. while round-robin cycle index in table 2 algorithm.From statistics as can be seen, total iterations of DTS (B) has on average increased by 2.85% than DTS (A), and the detection effect to the resource leakage fault is the average fault detect rate 14.95% that improves thus.

Table 3 test comparison data

In addition, by with the contrast of the similar testing tool with other of above test result, although we find that every kind of instrument all has failing to report in various degree, 29 resource leakage faults that increase newspaper for DTS (B) did not occur in the report of other instrument.

As shown in Figure 7, the software testing system of using abnormal control flow set of the present invention comprises:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set, be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled, extract the run-time exception information that subfunction may be dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, represents that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module, be used in described judge module output iterative detection unclosed as a result the time, the run-time exception information that in prior fault, is comprised with the fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module, be used to adjust the current information sensing of control adfluxion and fault collection, the subsequent control stream that described subsequent control stream acquisition module is obtained is adjusted into current control stream, the consequent malfunction that described subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to described judge module;

The run-time exception extraction module, be used for described judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

The above embodiment is the preferred embodiment that proves absolutely that the present invention lifts, and protection scope of the present invention is not limited thereto.Being equal to that those skilled in the art are done on basis of the present invention substitutes or conversion, all within protection scope of the present invention.Protection scope of the present invention is as the criterion with claims.

Claims (8)

1. the method for testing software of a using abnormal control flow set is characterized in that, comprising:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

Step B, the pairing initial control stream of traversal analytic unit are promptly controlled first element in the adfluxion, and all nodes that call subfunction are wherein handled, and extract the run-time exception information that subfunction may be dished out, first element of expansion fault collection;

Step C, on first element of control adfluxion, use the static test detection failure, and testing result made an addition among first element of fault collection;

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, represents that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

On step F, the subsequent control stream that obtains in described step e, the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the described step e is adjusted into current control stream, the consequent malfunction that obtains in the described step F is adjusted into works as prior fault, returns step D;

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

2. method according to claim 1 is characterized in that, described steps A specifically comprises:

A1, initialization set member sequence number, it is 0 that its current value is set;

First element of A2, initialization fault collection, its currentElement of set of applications member's sequence number is set to sky;

The currentElement that first element of A3, initialization control adfluxion, set of applications member's sequence number controls adfluxion is set to the initial control of present analysis unit and flows.

3. method according to claim 1 is characterized in that, described step B specifically comprises:

B1, judge whether the node in the current control stream is its last node, then carries out described step C in this way, otherwise execution in step B2;

B2, judge the statement that whether exists in the present node of current control stream function call, if exist then execution in step B3, otherwise execution in step B5;

B3, according to the function abstracted information discriminant function run-time exception of whether can dishing out that in node, is called, execution in step B4 in this way, otherwise execution in step B5;

B4, the ordered pair that node and Exception Type are formed join and work as prior fault, then execution in step B5;

B5, replace present node, return step B 1 with the next node of node in the current control stream.

4. method according to claim 1 is characterized in that, described step C specifically comprises:

The method of C1, application finite state machine is described fault, node is wherein represented contingent state, possible switch condition between Bian representative state is created and concrete variable correlation behavior machine example for analyzed unit, chooses one as current state machine example from all state machine instance;

C2, on the diverse location of control stream, for the variable in the current state machine example calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine example, in state conversion process if break down state, execution in step C3 then, otherwise execution in step C4;

C3, the run-time exception composition ordered pair that will go out the position of present condition and dish out join ordered pair in prior fault;

C4, judge in the state machine instance set whether have untreated example, and if existed with next example as current example, return step C2, otherwise carry out described step D.

5. method according to claim 1 is characterized in that, described step e specifically comprises:

E1, choose the current ordered pair in the fault, on control stream, match the respective nodes of ordered pair, judge whether this node is in the exception catching structure, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure corresponding with the exception catching structure can handle the pairing Exception Type of run-time exception in the ordered pair, then on current control stream, add the limit from node to corresponding abnormality processing structure node, an execution in step E5 then in this way; As denying execution in step E3;

Whether E3, judgement also exist other exception catching structure except that current exception catching structure, then outer field in this way exception catching structure is set to current structure, returns step e 2, otherwise execution in step E5;

E4, on current control stream, add one from node to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual;

E5, judge in prior fault whether have the ordered pair of not handling,, return step e 1 if exist then it is labeled as current ordered pair; Otherwise obtain the subsequent control stream of current control stream, then execution in step F.

6. method according to claim 1 is characterized in that, described step F specifically comprises:

F1, initialization fault are concentrated the consequent malfunction when prior fault, and consequent malfunction is set to sky;

F2, be that analyzed unit is created and concrete variable correlation behavior machine example, from all state machine instance, choose one as current state machine example;

F3, on the diverse location of subsequent control stream, for the variable in the current state machine example calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine example, in state conversion process if break down state, execution in step F4 then, otherwise execution in step F5;

F4, the run-time exception that will occur using wrong position and this mistake to dish out are formed ordered pair, check whether this ordered pair is present in the failure collection, if there is no, then this ordered pair are joined in the described consequent malfunction in back;

F5, judge in the state machine instance set whether have untreated example,, return step F 3 if exist then choose a untreated example as current example, otherwise execution in step G.

7. method according to claim 1 is characterized in that, described step H specifically comprises:

H1, choose and point to a limit withdrawing from node in the current control stream unusually, with it as working as the pre-treatment limit;

H2, will work as the pairing Exception Type in front and join among the abstracted information of present analysis unit;

H3, judge to point to the limit of withdrawing from node in the current control stream unusually and whether all finish dealing with, execution in step I then in this way, otherwise select to withdraw from unusually in the current control stream limit of node, it as working as the pre-treatment limit, is returned step H2.

8. the software testing system of a using abnormal control flow set is characterized in that, comprising:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set, be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled, extract the run-time exception information that subfunction may be dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, represents that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module, be used in described judge module output iterative detection unclosed as a result the time, the run-time exception information that in prior fault, is comprised with the fault collection, correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module, be used to adjust the current information sensing of control adfluxion and fault collection, the subsequent control stream that described subsequent control stream acquisition module is obtained is adjusted into current control stream, the consequent malfunction that described subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to described judge module;

The run-time exception extraction module, be used for described judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

Images