CN101847122B - Method and system for testing software by using abnormal control flow set - Google Patents

Abstract

The invention discloses a method and a system for testing software by using an abnormal control flow set. According to the method and the system provided by the invention for treating the software, the method comprises the following steps of: describing a run-time abnormal behavior through an abnormal mode state machine to support expansion of control flow and automatic detection of faults; expanding the traditional abnormal control flow through the run-time abnormal control flow, and adding a throwing run-time abnormal edge into the abnormal control flow to support the detection of a new fault; and generating the run-time abnormal control flow set through an iterative equation by combining the conventional static test technology to realize alternated iterative execution of control flow expansion and new fault detection. The method expands the traditional analysis path and fulfills the purpose of improving the fault report rate.

Description

The method for testing software of using abnormal control flow set and system

Technical field

The present invention relates to software testing technology, relate in particular to a kind of method for testing software and system of using abnormal control flow set.

Background technology

Different with traditional method for testing software; Software static test towards the code defective at first will be summed up defective from the code aspect of software; It is abstracted into the corresponding defects pattern; Abstract semanteme to related content in the program carries out approximate treatment then, at last result of calculation is applied to defect mode and detects.Receive the favor of software industry just gradually towards the software static test technology of code defective, become the software testing technology of a kind of main flow of the U.S..Representative code defective static test instrument mainly contains the research project Metal of Stanford university at present; The java applet static test instrument FindBugs of Maryland university research and development; The java applet static test instrument PMD that increases income, the code defect detection tool K8 of U.S. Klocwork company research and development.The result shows through contrast test, because different to the degree of approximation of abstract semanteme, all there is wrong report in various degree in existing testing tool and fails to report situation.

For unforeseen problem in the minimizing program occurs, the software developer can handle abnormal conditions by a large amount of codes of special establishment, even in some software systems, has the code above 2/3rds to be used for abnormality processing.Because the introducing of exception handling, it is more complicated that the control rheology of program is got, so work has brought bigger challenge to static test.Though present many experts and scholars have carried out deep research at this point; But to the expansion of control stream, the new run-time exception that on the control stream of expansion, causes, and both replace iterative relation the influence of static test are not but all related to for run-time exception.All all do not consider this problem towards the software static test technology and the instrument of code defective at present, and the path analysis that brings thus is insufficient to be a major reason that causes the part defective to be failed to report.

Summary of the invention

The technical matters that the present invention will solve provides a kind of method for testing software and system that uses run-time exception control adfluxion; Can handle the alternately iterative relation between the expansion of run-time exception Detection & Controling stream, solve thus in static test because the insufficient problem of path analysis that run-time exception causes.

In order to solve the problems of the technologies described above, the invention provides a kind of method for testing software of using abnormal control flow set, comprising:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

Step B, the pairing initial control stream of traversal analytic unit are promptly controlled first element in the adfluxion, and all nodes that call subfunction are wherein handled, and extract the run-time exception information that subfunction possibly dished out, first element of expansion fault collection;

Step C, on first element of control adfluxion, use the static test detection failure, and testing result made an addition among first element of fault collection;

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, representes that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, on the node that corresponds to current control stream according to dish out position and Exception Type and the limit, obtain the subsequent control that current control flows and flow;

On step F, the subsequent control stream that in said step e, obtains, the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the said step e is adjusted into current control stream, the consequent malfunction that obtains in the said step F is adjusted into works as prior fault, returns step D;

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

Further, said steps A specifically comprises:

A1, initialization set member sequence number, it is 0 that its current value is set;

First element of A2, initialization fault collection, its currentElement of set of applications member's sequence number is set to sky;

The currentElement that first element of A3, initialization control adfluxion, set of applications member's sequence number controls adfluxion is set to the initial control of present analysis unit and flows.

Further, said step B specifically comprises:

B1, judge whether the node in the current control stream is its last node, then carries out said step C in this way, otherwise execution in step B2;

B2, judge in the present node of current control stream whether have statement to function call, if exist then execution in step B3, otherwise execution in step B5;

B3, according to the function abstracted information discriminant function run-time exception of whether can dishing out that in node, is called, execution in step B4 in this way, otherwise execution in step B5;

B4, the ordered pair that node and Exception Type are formed join and work as prior fault, then execution in step B5;

B5, with the next node replacement present node of node in the current control stream, return step B1.

Further, said step C specifically comprises:

The method of C1, application finite state machine is described fault; Node is wherein represented contingent state; Possible switch condition between Bian representative state for being created by analytic unit and concrete variable correlation behavior machine instance, is chosen one as current state machine instance from all state machine instance;

C2, on the diverse location of control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step C3 then, otherwise execution in step C4;

C3, the run-time exception composition ordered pair that will go out the position of present condition and dish out join ordered pair in prior fault;

C4, judge in the state machine instance set whether have untreated instance, and if existed with next instance as current instance, return step C2, otherwise carry out said step D.

Further, said step e specifically comprises:

E1, choose the current ordered pair in the fault, on control stream, match the respective nodes of ordered pair, judge whether this node is in the exception catching structure, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure corresponding with the exception catching structure can handle the pairing Exception Type of run-time exception in the ordered pair; Then on current control stream, add the limit from node to corresponding abnormality processing structure node, an execution in step E5 then in this way; As denying execution in step E3;

Whether E3, judgement also exist other exception catching structure except that current exception catching structure, then outer field in this way exception catching structure is set to current structure, returns step e 2, otherwise execution in step E5;

E4, on current control stream, add one from node to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual;

E5, judge in prior fault whether have the ordered pair of not handling,, return step e 1 if exist then it is labeled as current ordered pair; Otherwise obtain the subsequent control stream of current control stream, then execution in step F.

Further, said step F specifically comprises:

F1, initialization fault are concentrated the consequent malfunction when prior fault, and consequent malfunction is set to sky;

F2, be to be created and concrete variable correlation behavior machine instance, from all state machine instance, choose one as current state machine instance by analytic unit;

F3, on the diverse location of subsequent control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step F4 then, otherwise execution in step F5;

F4, the run-time exception that will occur using wrong position and this mistake to dish out are formed ordered pair, check whether this ordered pair is present in the failure collection, if do not exist, then this ordered pair are joined in the said consequent malfunction in back;

F5, judge in the state machine instance set whether have untreated instance,, return step F 3 if exist then choose a untreated instance as current instance, otherwise execution in step G.

Further, said step H specifically comprises:

H1, choose and point to a limit withdrawing from node in the current control stream unusually, with it as working as the pre-treatment limit;

H2, will work as the pairing Exception Type in front and join among the abstracted information of present analysis unit;

H3, judge to point to the limit of withdrawing from node in the current control stream unusually and whether all finish dealing with, execution in step I then in this way, otherwise select to withdraw from unusually in the current control stream limit of node, it as working as the pre-treatment limit, is returned step H2.

The present invention also provides a kind of software testing system of using abnormal control flow set, comprising:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set; Be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled; Extract the run-time exception information that subfunction possibly dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, representes that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module; Be used in said judge module output iterative detection unclosed as a result the time; The run-time exception information that in prior fault, is comprised with the fault collection; Correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module; Be used to adjust the current information sensing of control adfluxion and fault collection; The subsequent control stream that said subsequent control stream acquisition module is obtained is adjusted into current control stream; The consequent malfunction that said subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to said judge module;

The run-time exception extraction module, be used for said judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

The run-time exception behavior is described through the abnormal patterns state machine by method for testing software provided by the present invention and system, can support the expansion of control stream and the automatic detection of fault; Through the traditional abnormal control flow of run-time exception control stream expansion, the limit of the run-time exception of dishing out is added wherein, to support detection to new fault; In conjunction with existing static test technology, abnormal control flow set during through the iterative equation generating run is carried out with the alternately iteration that realizes expansion of control stream and new fault detect.Through above method expansion traditional analysis path, reach the purpose that improves the Trouble Report rate.

Description of drawings

Fig. 1 is the schematic flow sheet of the method for testing software of using abnormal control flow set of the present invention;

Fig. 2 is used to describe the state machine that null pointer is quoted abnormal patterns for the present invention;

Fig. 3 is used to describe the state machine of other 3 kinds of abnormal patterns for the present invention;

Fig. 4 is the abnormal control flow set of his-and-hers watches 1 function f l of the present invention;

Fig. 5 is the abnormal control flow set of his-and-hers watches 1 function f of the present invention;

Fig. 6 is the synoptic diagram of experiment porch of the present invention;

Fig. 7 is the formation block scheme of the software testing system of using abnormal control flow set of the present invention.

Embodiment

Below in conjunction with accompanying drawing and specific embodiment the present invention is described further so that those skilled in the art can better understand the present invention and implementing, but the embodiment that lifts not conduct to qualification of the present invention.

Static test technology towards the code defective can be described as problem D={P theoretically, M, and A} finds the solution, and P represents tested program here; M is the code defect mode set corresponding with P; A is the algorithm that obtains the abstract semanteme of related content among the P, is used for confirming whether P exists defect mode M.Algorithm A is described as A={S among the D, and ρ (L, X), σ (F) }, wherein S is the path among the program P; ρ is for calculate the value information of correlated variables X approx, and L is the executing location of P, and X is the variable that P implements the L place; σ is the abstract context of function, representes approx calling the abstract of function F.Because the introducing of run-time exception possibly expand to S with the control flow path S that influenced by it ₁, and at S ₁On possibly find new run-time exception again, through so alternately obtaining [S after the iterative process ₁..., S _n], S wherein _iAt S _I-1The basis on produce, and

The problem of like this algorithm A being found the solution can be converted into A={S ∪ [S ₁..., S _n], ρ (L, X), σ (F) }.

In the static test process,, promptly in algorithm A, omitted analysis path [S if ignored processing to run-time exception ₁..., S _n], then have

The situation that defective is failed to report appears thus:

Wherein D (M | x) expression is because the value x of variable X causes fault M; The value x of

expression variable X can not cause fault M, and False Negative (X) representes failing to report variable X.This shows that because the existence of run-time exception, it can produce alternately iterative relation in program operation process and between control stream, this specific character can influence static test process and result.

Use run-time exception in order to be implemented in the software static test process; The present invention proposes a kind of static test of using run-time exception; Realization fault detect and control stream are expanded alternately iteration execution: fault detect causes controlling stream and goes up the limit that run-time exception is represented in interpolation; The limit of extra interpolation causes detecting more fault again, and this process repeats to control and flows till the no longer expansion.Use the abnormal patterns state machine and describe the characteristic of run-time exception, find run-time exception through its malfunction.Use the running environment of run-time exception control stream, on tradition control stream, increase the limit of handling run-time exception as fault detect.In conjunction with existing static test technology, abnormal control flow set during through the iterative equation generating run is to realize the process that iterates of expansion of control stream and new fault detect.Below respectively the alternately iterative relation between run-time exception description, run-time exception testing environment, the expansion of run-time exception Detection & Controling stream is elaborated.

1. run-time exception is described

Problem D={P, M, the defect mode M among the A} is the basis of finding the solution D, is the problem that at first need solve among how run-time exception being explained M, the present invention adopts the abnormal patterns state machine that it is unified to be described below:

The abnormal patterns state machine is defined as a tlv triple EM=< N, T, C >, corresponding one type of each abnormal patterns state machine unusual.N is a state set, comprise in the abnormal patterns the state that might reach.T={＜n _i, n _j>| n _i, n _j∈ N} is the state exchange set, and state machine maybe be from state n _iBe transformed into state n _jC is a state transition condition, T:N * C → N.

N _StartBe the unique inlet of state machine, get into this state after state machine is created automatically; N _EndBe the unique outlet of state machine, get into this state behind the state machine end of run automatically; N _Fault={ Exception, Error} are the unique malfunctions of state machine, then are not labeled as Error unusually as not dishing out when prior fault, otherwise are labeled as Exception.N={N _Start, N _Fault, N _End∪ N _Other, N _OtherExpression other state except that above three state, it is different with the difference of defect type.

When on the abnormal patterns state machine, carrying out state exchange, need to combine the abstract semanteme and the state transition condition C of concrete variable X to accomplish, the abnormal patterns state machine EM of corresponding variable X is called the abnormal patterns state machine instance EM (X) of X.

Virtual condition on the EM (X) converts n into _i={ n _j* C | { S, ρ (L, X), σ (F) }, in conjunction with concrete variable X and in the position the abstract semanteme { S, ρ (L, X), σ (F) } at L place, can be through state transition condition C with the current state n of EM (X) _jConvert state n into _i

Suppose program P comprises the run-time exception pattern { EM that the n kind is set ₁, EM ₂..., EM _n, influenced by the correlated variables X among the P, every kind of abnormal patterns EM _iMaximum corresponding m kind abnormal patterns state machine instance { EM _i(X ₁), EM _i(X ₂) ..., EM _i(X _m), all abnormal patterns state machine instance that then program P is corresponding constitute the abnormal patterns state machine instance matrix of P, and note is done:

${\left({\mathrm{EM}}_{\mathrm{ij}}\right)}_{n\&times;m}=\left[\begin{array}{cccc}{\mathrm{EM}}_1\left(X_1\right)& {\mathrm{EM}}_1\left(X_2\right)& ...& {\mathrm{EM}}_1\left(X_m\right)\\ {\mathrm{EM}}_2\left(X_1\right)& {\mathrm{EM}}_2\left(X_2\right)& ...& {\mathrm{EM}}_2\left(X_m\right)\\ ...& ...& & ...\\ {\mathrm{EM}}_n\left(X_1\right)& {\mathrm{EM}}_n\left(X_2\right)& ...& {\mathrm{EM}}_n\left(X_m\right)\end{array}\right].$

The expression variable X _jWith abnormal patterns EM _iIrrelevant, need not be X _jCreate such state machine instance.For (EM _Ij) _{N * m}In all non-NULL state machine instance

Expression need be the variable X among the program P _jCreate the abnormal patterns state machine instance.In the state machine instance of all non-NULLs, identical part is three state { N _Start, N _Fault, N _End, as for other N state _OtherWith state transition condition C with EM _iDifference and different.Malfunction N _Fault: Error only provides error message, N _Fault: Exception also will be used to control the expansion of stream in the back except that error message is provided.

Among Fig. 2 a state machine description of quoting abnormal patterns about null pointer, the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has the non-NULL N state _NotWith possibility dummy status N _MayState transition condition C comprise in have: C ₁(judging that pointer maybe be empty), C ₂(judging the pointer non-NULL), C ₃(reference pointer content), C ₄(exceeding the pointer action scope), C ₅(conversion automatically), C ₆(other).State exchange set comprise in have: T ₁: N _Start* C ₆→ N _Start, T ₂: N _Start* C ₁→ N _May, T ₃: N _Start* C ₂→ N _Not, T ₄: N _May* C ₆→ N _May, T ₅: N _May* C ₃→ N _Fault, T ₆: N _May* C ₄→ N _End, T ₇: N _May* C ₂→ N _Not, T ₈: N _Not* C ₆→ N _Not, T ₉: N _Not* C ₄→ N _End, T ₁₀: N _Not* C ₁→ N _May, T ₁₁: N _Error* C ₅→ N _End

Be that a state machine about buffer zone overflow exception pattern is described among Fig. 3 (a), the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has binding state N _BoundState transition condition C comprise in have: C ₁(for buffer zone is bound the space), C ₂(usage space surpasses the binding space), C ₃(exceeding the buffer zone action scope), C ₄(conversion automatically), C ₅(other).State exchange set comprise in have: T ₁: N _Start* C ₁→ N _Bound, T ₂: N _Start* C ₅→ N _Start, T ₃: N _Bound* C ₅→ N _Bound, T ₄: N _Bound* C ₂→ N _Fault, T ₅: N _Bound* C ₃→ N _End, T ₆: N _{Fault *}C ₄→ N _End

Among Fig. 3 (b) a state machine description of quoting abnormal patterns about wrong indicator, the run-time exception because this type of fault can be dished out, so malfunction is labeled as Exception.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has distribution state N _AllocWith release conditions N _FreeState transition condition C comprise in have: C ₁(reference pointer), C ₂(allocation space), C ₃(Free up Memory), C ₄(exceeding the pointer action scope), C ₅(conversion automatically), C ₆(other).State exchange set comprise in have: T ₁: N _Start* C ₆→ N _Start, T ₂: N _Start* C ₁→ N _Fault, T ₃: N _Start* C ₂→ N _Alloc, T ₄: N _Alloc* C ₄→ N _Free, T ₅: N _Alloc* C ₄→ N _End, T ₆: N _Alloc* C ₆→ N _Alloc, T ₇: N _Free* C ₂→ N _Alloc, T ₈: N _Free* C ₁→ N _Fault, T ₉: N _Free* C ₆→ N _Free, T ₁₀: N _Free* C ₄→ N _End, T ₁₁: N _Fault* C ₅→ N _End

Be that a state machine about the memory leak faults pattern is described among Fig. 3 (c), the run-time exception because this type of fault can not dished out, so malfunction is labeled as Error.Except the total N state of each abnormal patterns state machine _Start, N _EndAnd N _FaultOutward, this state machine has distribution state N _AllocWith release conditions N _FreeState transition condition C comprise in have: C ₁(storage allocation), C ₂(releasing memory), C ₃(exceeding the pointer action scope), C ₄(conversion automatically), C ₅(other).State exchange set comprise in have: T ₁: N _Start* C ₅→ N _Start, T ₂: N _Start* C ₁→ N _Alloc, T ₃: N _Alloc* C ₂→ N _Free, T ₄: N _Alloc* C ₃→ N _Fault, T ₅: N _Alloc* C ₅→ N _Alloc, T ₆: N _Free* C ₁→ N _Alloc, T ₇: N _Free* C ₃→ N _End, T ₈: N _Free* C ₅→ N _Free, T ₉: N _Fault* C ₄→ N _End

Table 1: tested program fragment

1：void?fl(char*p){

2： char*q；

3： if(！p){print(″null″)；}

4： try{

5： *p＝′a′；//NullPointerDereference

6： if(！q＝malloc[p.len+1])throw?E ₁；

7： strcpy(p，q)；//BufferOverflow

8： }

9： catch(NullPointerException?e){

10： }

11： free(q)；//WrongPointerDereference

12： }

13： void?f(int?len){

14： try{

15： char*p＝malloc(len)；

16： fl(p)；

17： free(p)；

18： }

19： catch(Excep?E ₁){free(p)；}

20： catch(Excep?E _wpd){

21： char*q＝malloc(len)；

22： strcpy(q，p)；

23： free(q)；}

24：}

Suppose that the run-time exception state machine that the function f 1 in the his-and-hers watches 1 is set has three types: EM _Npd(null pointer is quoted unusually), EM _Bo(buffer zone overflow exception), EM _Wpd(the mistake reference pointer is unusual), then with f1 in types of variables relevant, need be respectively for the state machine instance that every type of defective is created: EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), they constitute the state machine instance matrix of f1 jointly:

After the above method that run-time exception has been described has been arranged, can in the program with specific exceptions pattern EM _iRelevant variable X _jCreate abnormal patterns state machine instance EM _i(X _j), in conjunction with variable X _jAbstract semanteme, applied transformation condition EM _i.C carry out state exchange.When the N state that breaks down _Fault: behind the Exception, record trouble is also expanded control stream accordingly.

2. run-time exception control is flowed

Existing method is when construction procedures control stream; Comprised the abnormality processing correlative; Like the try statement of confirming the exception catching scope, confirm the catch statement of catching exception type, and can confirm that the throw statement of unusual throw point can confirm unusual process with dishing out.In addition, in order to describe unusual influence to program control flow fully, the content relevant with run-time exception also should join wherein, like the statement of the run-time exception of can dishing out and the function of run-time exception or the like of can dishing out.The present invention is following to the definition of run-time exception control stream:

Run-time exception control stream is to describe the program digraph that comprises that run-time exception is handled, and it has increased the point set and the Bian Ji that describe the run-time exception Processing Structure on the basis of the former control stream of program, be expressed as tuple REC=<n, E, N _Ex, N _Er, N _Ef, E _Re>Wherein N is a set of node, and each program statement is a node in the corresponding diagram all.N _ExBe the node explicit and that implicit expression is unusual of can dishing out, N _ErBe the node that comprises the run-time exception statement of can dishing out, N _EfIt is the node that comprises the run-time exception function of to dish out.Limit collection E={<n _i, n _j>| n _i, n _j∈ N}, expression node n _iAfter corresponding statement is carried out, XM n immediately _jCorresponding statement.E _ReBe N _ErAnd N _EfThe output limit of node is used to handle the run-time exception of being dished out.

N _Ex, static test can confirm N before beginning _ErAnd N _EfNeed in the static test process, can confirm.To the node N that can dish out unusual _Ex, N _ErAnd N _Ef, two types of limits its outputs of correspondence are arranged, be labeled as E _NoThe limit correspondence be not triggered unusually, be labeled as { E _Re| E _Er={ E _Npd, E _Bo, E _Wpd... } and the corresponding E in limit _ReBeing triggered unusually of type, E _ReIn unusual type and quantity relevant with concrete syntax.Captive run-time exception passes through E _ReBe connected to corresponding catch node, run-time exception at large passes through E _ReWhat be connected to control stream withdraws from node unusually.N _EntryBe the unique inlet of control stream, N _ExitIt is the unique outlet of control stream.N={N _Entry, N _ExitN _Ex, N _Er, N _Ef∪ N _Other, N _OtherExpression other node except that above 5 kinds of nodes, E={E _No, E _Re∪ E _Other, E _OtherExpression other limit except that above 2 kinds of limits.

Based on above description, run-time exception control stream is summed up as follows with the difference of tradition control stream:

Unusual during 1, for the ease of positioning trip, each statement is as a control stream node, rather than a statement block;

2, corresponding each try statement has a N _TryNode, corresponding each catch statement has a N _CatchNode;

3, each unusual function of can dishing out all has a N _{Excp_exit}Node obtains unusual descendant node as at large in all functions.In order to guarantee to control the uniqueness of stream middle outlet, each function increases a N _{Norm_exit}Node, it and N _{Excp_exit}Descendant node be N _Exit

4, the node N of corresponding each run-time exception of can dishing out _ErOr N _Ef, through limit E _ReBe connected to the N corresponding with its type _CatchNode or the N corresponding not with it _{Excp_exit}Node; Through limit E _NoLink N _EfOr N _ErThe non-abnormality processing node of first of node back.

3. abnormal control flow set

After being dished out, run-time exception can extender control flow; And new run-time exception possibly appear on the control stream of expansion; The present invention with run-time exception to the expansion of control stream and on the control stream of expansion, find these two of new run-time exceptions alternately the processes of iteration represent through abnormal control flow set, specifically describe as follows:

Relation between the control of run-time exception behavior of abnormal control flow set representations and the expansion stream comprises run-time exception to the expansion of control stream with on the control stream of expansion, find new run-time exception, and process of iteration like this; Be expressed as a four-tuple < RS; ES, G, T >.RS is a control stream ordered set { REC ₀, REC ₁..., REC _n, expression receives the influence of run-time exception, and control stream is from REC ₀Beginning progressively expands to REC _nProcess; ES is a set corresponding with RS, constitutes ES={{ES by some order subsets ₀| REC ₀, { ES ₁| REC ₁..., { ES _n| REC _n, be illustrated in corresponding control stream and go up findable new run-time exception set, ordered pair<n, E>∈ ES _i, N, E ∈ REC _iRepresent newfound run-time exception; G:REC _i* D (P, M, A) → ES _iBe from REC _iLast generation ES _iRule, T:REC _i* ES _i→ REC _I+1Be through ES _iWith REC _iBe converted into REC _I+1Rule.

Under Regulation G,

<img file="BSA00000143094600121.GIF" he="57" img-content="drawing" img-format="GIF" inline="yes" orientation="portrait" wi="700" />Comprise two parts content, first control stream REC<sub >0</sub>In all comprise the run-time exception that the node of function call is dished out, comprise the run-time exception of re type in the abstract context of re ∈ σ (F) expression F,<n, E<sub >Re</sub>>Be expressed as at control stream REC<sub >0</sub>Go up the ordered pair corresponding with re; It two is not comprise node N<sub >Er</sub>And N<sub >Ef</sub>Traditional abnormal control flow REC<sub >0</sub>Upward (that A) asks effectively separates for P, M to problem D.M corresponding states machine instance matrix (EM among the D<sub >Ij</sub>)<sub >N * m</sub>, at computation process (EM<sub >Ij</sub>)<sub >N * m</sub>Among * the A,

$\left[\begin{array}{cccc}{\mathrm{EM}}_1\left(X_1\right)& {\mathrm{EM}}_1\left(X_2\right)& ...& {\mathrm{EM}}_1\left(X_m\right)\\ {\mathrm{EM}}_2\left(X_1\right)& {\mathrm{EM}}_2\left(X_2\right)& ...& {\mathrm{EM}}_2\left(X_m\right)\\ ...& ...& & ...\\ {\mathrm{EM}}_n\left(X_1\right)& {\mathrm{EM}}_n\left(X_2\right)& ...& {\mathrm{EM}}_n\left(X_m\right)\end{array}\right]\&times;\left[\begin{array}{c}A\left(X_1\right)\\ A\left(X_2\right)\\ ...\\ A\left(X_m\right)\end{array}\right]=\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}\underset{j=1}{\overset{m}{\mathrm{\&Sigma;}}}\underset{k=1}{\overset{m}{\mathrm{\&Sigma;}}}{\mathrm{EM}}_i\left(X_j\right)A\left(X_k\right)$

Work as variable X _jWith abnormal patterns EM _iWhen irrelevant

In addition, when j ≠ k

Expression is to non-NULL instance EM _i(X _j) the application algorithm

Different executing location L on the S of path are to X _jAbstract semanteme calculate, to realize to EM _i(X _j) state exchange.When obtaining EM at the L place _i(X _j) malfunction N _Fault: during Exception, expression is tried to achieve and is separated EM _i(X _j) A (X _j) →<l, EM _i>, wherein L can correspond to REC ₀In the node N that dishes out unusually _Er, EM _iCan correspond to REC ₀In an abnormality processing limit E _Re

Under Regulation G, E _k=D (P, M, A) | REC _kBe at run-time exception control stream REC _kUpward (that A) asks newly effectively separates for P, M to problem D.M is state machine instance matrix (EM _Ij) _{N * m}, to the arbitrary instance EM among the M _i(X _j) pairing variable X _j, algorithm

In the path On different executing location L to X _jIts abstract semanteme calculate, and try to achieve EM _i(X _j) A (X _j) →<l, EM _i>Through to (EM _Ij) _{N * m}In all example calculation, last controlled stream REC _kLast the new run-time exception that might dish out

Under rule T,<img file="BSA00000143094600139.GIF" he="153" img-content="drawing" img-format="GIF" inline="yes" orientation="portrait" wi="700" />Use ES<sub >i</sub>Middle information recorded<n<sub >Er</sub>, E<sub >Re</sub>>| N<sub >Er</sub>, E<sub >Re</sub>∈ REC<sub >i</sub>, at control stream REC<sub >i</sub>The dish out node N of run-time exception of marked<sub >Er</sub>, and add corresponding abnormality processing limit E<sub >Re</sub>, at last it is expanded to REC<sub >I+1</sub>, SUM (ES<sub >i</sub>) be ES<sub >i</sub>Middle number of members.

Through to the alternately iteration of unusual create-rule G, can realize the generation of abnormal control flow set RS with control stream translation rule T.Iterative equation is represented to suppose REC as follows ₀Known, iterative process begins from t=1, up to

Finish.

${\mathrm{REC}}_t=\left\{\begin{array}{cc}\mathrm{RE}{C}_0,& t=0,\\ \underset{j=1}{\overset{\mathrm{sum}\left({\mathrm{ES}}_{t-1}\right)}{\&cup;}}\{{\mathrm{REC}}_{t-1}\&times;{\mathrm{ES}}_{(t-1)j}\},& t\&GreaterEqual;1\end{array}\right.$

In order to analyze the character of abnormal control flow set RS, can it be mapped to function R S={y|y=f (x) }, for any 2 x in f (x) the field of definition x ∈ [0, m] ₁And x ₂, perseverance has

Therefore function f (x) is dull increasing on interval x ∈ [0, m].In addition, because type, statement and the function of the run-time exception of can dishing out among the program P all are limited, therefore total iterations also is limited, and promptly the field of definition of f (x) is a bounded.For the function f (x) of dull bounded, it must have the limit, and the abnormal control flow set RS that promptly f (x) is corresponding has the limit.

Based on above description, the difference between run-time exception control stream and traditional abnormal control flow is following:

1, in traditional abnormal control flow node with unusual relevant the node explicit unusual and unusual node N of implicit expression that only dishes out _Ex, and remove N in the run-time exception control stream _ExOutside the node, also comprise the N of the run-time exception of dishing out _ErAnd N _EfNode, and the limit E that handles run-time exception _Re

2, at traditional abnormal control flow REC ₀On when carrying out static test, can only report the run-time exception information E of current discovery ₀, and consequent fault; And the run-time exception of the fault detection method of using iterative control stream is from traditional abnormal control flow REC ₀Beginning expands to { REC through iterative equation with it ₀, REC ₁..., REC _n, can find more run-time exception { E ₁..., E _n, and other failure message that brings thus.

With usability of program fragments fl in the table 1 is example, and its corresponding run-time exception control adfluxion is as shown in Figure 4.Wherein Fig. 4 (a) is traditional abnormal control flow REC ₀, limit E ₁Be node n ₉In (6 row) condition be true time dish out unusual.If do not consider the influence of run-time exception, analysis node n all sidedly in test process then ₈(9 row) and node n ₁₄It is unusual that (12 row) catches.And the fault detection method of using iterative, Regulation G is at REC ₀Unusual and the buffer zone overflow exception ES of last discovery null pointer ₀=<n ₇, E _Npd>,<n ₁₁, E _Bo>After, rule T is with REC ₀Convert the REC of Fig. 4 (b) into ₁, limit E wherein _NpdBe node n ₇In (5 row) because variable p is empty dish out unusual, limit E _BoBe node n ₁₁In (7 row) because buffer zone overflows dish out unusual; When variable p was sky, Regulation G can be at REC ₁The last discovery used unusual ES to the pointer q of no initializtion ₁=<n ₁₂, E _Wpd>, rule T can be with REC ₁Convert the REC of Fig. 4 (c) into ₂

iteration stops at last.

Can find out from last example,, make tested object from traditional abnormal control flow REC owing to used the fault detection method of iteration ₀Expand to REC ₁And REC ₂, comprised node n ₈With node n ₁₄Catch behind the run-time exception the influence of test result, these contents are that other method of testing based on traditional abnormal control flow is not available.

The related content of run-time exception and run-time exception control stream has been introduced in the front, and generates abnormal control flow set through iterative equation, realizes the expansion to the traditional static method of testing.Provide the generating algorithm of abnormal control flow set below, as shown in table 2.The program that the is input as P of algorithm is corresponding does not comprise node N _ErAnd N _EfTraditional abnormal control flow CFG (P), and abnormal patterns state machine instance matrix (EM _Ij) _{N * m}, be output as abnormal control flow set RS and corresponding failure message collection ES.

Table 2 abnormal control flow set generating algorithm is described

1：begin

2： I＝0；

3： REC[I]＝CFG(P)；

4： for?each?N?in?REC[I]?do

5： if?F∈N^re∈σ(F)then?ES[I]＝ES[I]∪<N，re>；

6： end?for

7： for?each?EM _i(X _j)in(EM _ij) _n×m?do

8： ES[I]＝ES[I]+{EM _i(X _j)A(X _j)|REC[I]}；

9： end?for

12： for?each<N，E>in?ES[I]?do

13： REC[I+l]＝REC[I]+<N，E>；

14： end?for

15： for?each?EM _i(X _j)in(EM _ij) _n×m?do

$16:\mathrm{ES}[I+1]=\mathrm{ES}[I+1]+$

$\left\{{\mathrm{EM}}_i\left(X_j\right)A\left(X_j\right)\right|\mathrm{REC}[I+1]\}-\underset{i=0}{\overset{I}{\mathrm{\&Sigma;}}}\mathrm{ES}[i];$

17： end?for

18： I++；

19： end while

20： for?each?E _re?in?REC[I].N _{excp_exit}?do

21： add(σ(P)，E _re)；

22： end?for

23：end

Algorithm the 4th～6 row is at first added up the abstract context of the function F that is called among the P, checks its run-time exception of whether dishing out, if exist, then these unusual relevant informations is joined among the ES [0]; All state machine instance of 7～9 row traversal program P are obtained variable X on control stream REC [0] _jAbstract semantic A (X _j) information, to confirm state machine instance EM _i(X _j) whether can break down N state _Fault: Exception, if then with unusual relevant information<l, EM _i>Join among the ES [0], wherein L is the unusual position of dishing out, EM _iBe Exception Type; If ES [0] is not empty, then from the 10th iterative process that is advanced into REC.

The 12nd～14 row at first calculates the change of ES [I] to REC [I], adds the up-to-date run-time exception information of record among the ES [I] to REC [I], i.e. the mark node of dishing out unusually among REC [I], and adding abnormality processing limit obtains REC [I+l] thus; Ensuing 15～17 row are traversal (EM once more _Ij) _{N * m}, on REC [I+1], obtain variable X _jAbstract semantic A (X _j) information, to confirm state machine instance EM _i(X _j) whether can break down N state _Fault: Exception, if malfunction also need be judged its up-to-date property, promptly therefrom remove in the past found identical unusual.While circulation through 10～19 row; Progressively iteration goes out all members among the REC; Up to there not being up-to-date unusual appearance, i.e.

Algorithm is last, is used by other function in order to make the run-time exception of dishing out in the current function, the function of the run-time exception of promptly confirming to dish out, and 20～22 are about in the current control stream that all are connected to N _{Excp_exit}The limit of node, what be about to not be captured among the program P joins among its abstract context σ (P) unusually, for the caller use of P.

Below in conjunction with accompanying drawing, be example with the tested function f l in the table 1, the application of abnormal control flow set in software test that the present invention is proposed makes an explanation and explains that Fig. 1 is the application flow synoptic diagram of abnormal control flow set of the present invention in software test.As shown in Figure 1, this method may further comprise the steps:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

The present analysis unit is for being the function f 1 in the table 1, and its input information comprises the initial control flow graph CFG (f1) of f1, shown in Fig. 4 (a).Suppose that the run-time exception state machine that f1 is set has four types: EM _Npd(null pointer is quoted unusually), EM _Bo(buffer zone overflow exception), EM _Wpd(the mistake reference pointer is unusual) and EM _Mlf(memory overflow) then need be respectively for the state machine instance that every type of fault is created: EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), EM _Mlf(q), they constitute the state machine instance matrix of f1 jointly:

This step is initially controlled and is flowed REC [0]=CFG (f1) and primary fault

after control stream REC [0] and fault ES [0] are carried out initialization operation

Step B, the pairing initial control stream of traversal analytic unit, the run-time exception information that the extraction subfunction possibly dished out is with first element of expansion fault collection, and execution in step is following:

B1, judge whether the node N among the current control stream REC [0] is its last node, execution in step C then in this way, otherwise execution in step B2;

B2, judge among the present node N of current control stream REC [0] whether have statement to function call, if exist then execution in step B3, otherwise execution in step B5;

B3, suppose that function F is called in node N, then according to its abstracted information σ (F) discriminant function F run-time exception of whether can dishing out, execution in step B4 in this way, otherwise execution in step B5;

B4, suppose that the run-time exception type that function F that node N calls is dished out is E, the ordered pair of then node and Exception Type being formed < N, E>joins as prior fault ES [0], execution in step B5 then;

B5, with next node replacement present node, the execution in step B1 then of node N among the current control stream REC [0].

In the corresponding control stream REC [0] of analytic unit f1; Because f1 is in the bottom of call relation; The subfunction that does not have to call for it generates abstracted information; After control stream REC [0] traversal is accomplished; All nodes that comprise function call run-time exception of all not dishing out, thus step B complete after, as prior fault

Step C, on current control stream REC [0], use existing static test detection failure, testing result is added in prior fault ES [0], execution in step is following:

The method of C1, application finite state machine is described fault; Node is wherein represented contingent state; Possible switch condition between Bian representative state; For being created by analytic unit and concrete variable correlation behavior machine instance, from all state machine instance, choose an EM (X) as current state machine instance, execution in step C2 then;

C2, on the diverse location N of control stream REC [0], be that the variable X among the current state machine instance EM (X) is calculated its possible value, and the bonding state switch condition carries out state exchange to EM (X).In state conversion process if the state that breaks down, execution in step C3 then, otherwise execution in step C4;

C3, step C2 carry out the back use mistake of variable X appear in N place in the position, as if this mistake run-time exception E that can dish out, then ordered pair < N, E>are joined in prior fault ES [0], then execution in step C4;

Whether have untreated instance in the set of C4, state machine instance, and if existed with next instance as current instance, execution in step C2 then, otherwise execution in step D.

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each instance EM _Npd(p), EM _Npd(q), EM _Bo(p), EM _Wpd(p), EM _Wpd(q), EM _Mlf(q) as analytic target, the possible value condition of calculated examples correlated variables on each node of control stream REC [0], and the bonding state switch condition carries out state exchange.Result of calculation is EM _Npd(p) at node n ₇Pass through T ₅: N _May* C ₃→ N _FaultDerive malfunction, EM _Bo(p) at node n ₁₁Pass through T ₄: N _Bound* C ₂→ N _FaultDerive malfunction.Because EM _Npd(p) and EM _Bo(p) run-time exception of can dishing out, thus step C complete after, obtain when prior fault ES [0]=<n ₇, npd>,<n ₁₁, bo＞}.

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, representes that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Since obtain after step C carries out when prior fault ES [0]=<n ₇, npd>,<n ₁₁, bo>, iterative detection does not finish, then execution in step E.

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, on the node that corresponds to current control stream according to dish out position and Exception Type and the limit, it is following to obtain the execution in step that subsequent control that current control flows flows:

E1, choose the current ordered pair < N, E>among the fault ES [I], on control stream REC [I], match node N, whether decision node N is among the exception catching structure try, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure catch corresponding with exception catching structure try can handle the pairing Exception Type of E, then go up to add the limit from N to corresponding catch node at REC [I] in this way, execution in step E5 then, otherwise execution in step E3;

Whether E3, current exception catching structure try also exist the try structure outward, and then outer field in this way try structure is set to current structure, execution in step E2 then, otherwise execution in step E5;

E4, REC [I] go up to add one from node N to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual, execution in step E5 then;

Whether E5, judgement exist the ordered pair < N that did not handle in prior fault ES [I]; E >, if exist then it be labeled as current ordered pair, execution in step E1 then; Otherwise obtain subsequent control stream REC [I+1], the execution in step F then of current control stream REC [I].

For when prior fault ES [0]=<n ₇, npd>,<n ₁₁, bo>, at first therefrom choose ordered pair<n ₇, npd>, node n ₇Be among the exception catching structure try, and abnormality processing structure catch can handle null pointer and quote unusually, therefore at the node n that dishes out unusually at control stream REC [0] ₇With abnormality processing node n ₈Between add a limit of handling this run-time exception; Choose ordered pair then<n ₁₁, bo>, node n _LlBe among the exception catching structure try, but abnormality processing structure catch cannot handle the buffer zone overflow exception, therefore at the node n that dishes out unusually at control stream REC [0] ₁₁Unusually withdraw from node n ₁₄Between add a limit of handling this run-time exception.Through after the execution of step e, obtain the subsequent control stream REC [1] of former control stream REC [0], shown in Fig. 4 (b).

Step F: on the subsequent control that in step e, the obtains stream, use existing fault detection technique, be not present in fault that fault concentrates and add among the consequent malfunction detected, obtain the next element of fault collection, execution in step is following:

F1, initialization fault are concentrated the consequent malfunction ES [I+1] of fault ES [I], and it is set to sky execution in step F2 then;

F2, be to be created and concrete variable correlation behavior machine instance, from all state machine instance, choose an EM (X) as current state machine instance, execution in step F3 then by analytic unit;

F3, on the diverse location N of control stream REC [I+1], be that the variable X among the current state machine instance EM (X) is calculated its possible value, and the bonding state switch condition carries out state exchange to EM (X).In state conversion process if the state that breaks down, execution in step F4 then, otherwise execution in step F5;

The use mistake to variable X appearred in the N place in the position after F4, step F 3 were carried out, and the run-time exception E if this mistake can be dished out then checks ordered pair < N; E>whether be present in set ES [0], and ES [1] ...; ES [I] } in, if do not exist, then with ordered pair < N; E>join among the fault ES [I+1] execution in step F5 then;

Whether there is untreated instance in the set of F5, state machine instance, if exist then choose a untreated instance as current instance EM (X), execution in step F3 then, otherwise execution in step G.

At first initialization<img file="BSA00000143094600201.GIF" he="73" img-content="drawing" img-format="GIF" inline="yes" orientation="portrait" wi="272" />One by one with state machine instance matrix (EM<sub >Ij</sub>)<sub >4 * 2</sub>In each instance EM<sub >Npd</sub>(p), EM<sub >Npd</sub>(q), EM<sub >Bo</sub>(p), EM<sub >Wpd</sub>(p), EM<sub >Wpd</sub>(q), EM<sub >Mlf</sub>(q) as analytic target, the possible value condition of calculated examples correlated variables on each node of control stream REC [1], and the bonding state switch condition carries out state exchange.Result of calculation is EM<sub >Npd</sub>(p) at node n<sub >7</sub>Pass through EM<sub >Npd</sub>(T<sub >5</sub>: N<sub >May</sub>* C<sub >3</sub>→ N<sub >Fault</sub>) the derivation malfunction, EM<sub >Bo</sub>(p) at node n<sub >11</sub>Pass through EM<sub >Bo</sub>(T<sub >4</sub>: N<sub >Bound</sub>* C<sub >2</sub>→ N<sub >Fault</sub>) the derivation malfunction, EM<sub >Wpd</sub>(q) at node n<sub >12</sub>Pass through EM<sub >Wpd</sub>(T<sub >2</sub>: N<sub >Start</sub>* C<sub >1</sub>→ N<sub >Fault</sub>) the derivation malfunction, EM<sub >Mlf</sub>(q) at node n<sub >14</sub>Pass through EM<sub >Mlf</sub>(T<sub >4</sub>: N<sub >Alloc</sub>* C<sub >3</sub>→ N<sub >Fault</sub>) the derivation malfunction.EM<sub >Npd</sub>(p) and EM<sub >Bo</sub>(p) though the run-time exception of can dishing out, they have appeared among the ES [0], EM<sub >Mlf</sub>The run-time exception of can not dishing out, thus step F complete after, obtain when prior fault ES [1]=<n<sub >12</sub>, wpd＞}.

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the step e is adjusted into current control stream, the consequent malfunction that obtains in the step F is adjusted into works as prior fault, then execution in step D;

In step D because ES [1}={<n ₁₂, wpd>Be not empty, therefore need once more the process of repeating step D to step G.In this process, obtain REC [2] through step e, shown in Fig. 4 (c).After step F is carried out; Owing to there is not new fault generating; Therefore

arranged and when execution in step D once more, withdraw from cyclic process, execution in step H.

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure, be used for calling of other analytic unit step B, implementation step is following:

H1, choose and point to a limit E who withdraws from node among the control stream REC [I] unusually, with it as working as pre-treatment limit, execution in step H2 then;

H2, will work as among the abstracted information σ (F) that E pairing Exception Type in front joins the present analysis unit F, then execution in step H3;

H3, judge to point to the limit of withdrawing from node among the control stream REC [I] unusually and whether all finish dealing with, execution in step I then in this way, otherwise execution in step H2.

When carrying out this step, current control stream is REC [2], and what be connected to it withdraws from node n unusually ₁₄The limit have three: from node n ₁₂The mistake that spreads out of is used the unusual limit E of pointer _Wpd, from node n ₁₁The buffer zone overflow exception limit E that spreads out of _Bo, from node n ₁₀The self-defined unusual limit E that spreads out of ₁After step H is complete, in the pairing abstracted information σ (f1) that joins function f 1 unusually in these three limits, call for the step B of analytic function f.

Next be the analytic process of function f in the his-and-hers watches 1, its input information comprises the initial control flow graph CFG (f) of f, shown in Fig. 5 (a).The run-time exception state machine of corresponding f also has four types: EM _Npd, EM _Bo, EM _WpdAnd EM _Mlf, need be respectively for the state machine instance that every type of fault is created: EM _Npd(p), EM _Npd(q), EM _Bo(q), EM _Wpd(p), EM _Wpd(q), EM _Mlf(p), EM _Mlf(q), they constitute the state machine instance matrix of f jointly:

This step is initially controlled and is flowed REC [0]=CFG (f) and primary fault

after control stream REC [0] and fault ES [0] are carried out initialization operation

In the corresponding control stream REC [0] of analytic unit f, when f1 analyze kept that it can dish out after accomplishing unusually in σ (f1), so step B complete after, when prior fault ES [0]=<n ₄, wpd>,<n ₄, bo>.

One by one with state machine instance matrix (EM _Ij) _{4 * 2}In each instance EM _Npd(p), EM _Npd(q), EM _Bo(q), EM _Wpd(p), EM _Wpd(q), EM _Mlf(p), EM _Mlf(q) as analytic target, possible the value condition of calculated examples correlated variables on each node of control stream REC [0], and the bonding state switch condition carries out state exchange, after step C is complete, obtain working as prior fault ES [0]=<n ₄, wpd>,<n ₄, bo>.

Since obtain after step C carries out when prior fault ES [0]=<n ₄, wpd>,<n ₄, bo>, iterative detection does not finish, then execution in step E.

For when prior fault ES [0]=<n ₄, wpd>,<n ₄, bo>, at first therefrom choose ordered pair<n ₄, wpd>, node n ₄Be among the exception catching structure try, and abnormality processing structure catch can to handle wrong reference pointer unusual, therefore at the node n that dishes out unusually at control stream REC [0] ₄With abnormality processing node n ₈Between add a limit of handling this run-time exception; Choose ordered pair then<n ₄, bo>, node n ₄Be among the exception catching structure try, but abnormality processing structure catch cannot handle the buffer zone overflow exception, therefore at the node n that dishes out unusually at control stream REC [0] ₄Unusually withdraw from node n ₁₄Between add a limit of handling this run-time exception.Through after the execution of step e, obtain the subsequent control stream REC [1] of former control stream REC [0], shown in Fig. 5 (b).

Next initialization<img file="BSA00000143094600221.GIF" he="73" img-content="drawing" img-format="GIF" inline="yes" orientation="portrait" wi="265" />One by one with state machine instance matrix (EM<sub >Ij</sub>)<sub >4 * 2</sub>In each instance as analytic target, the possible value condition of calculated examples correlated variables on each node of control stream REC [1], and the bonding state switch condition carries out state exchange.Result of calculation for obtain when prior fault ES [1]=<n<sub >10</sub>, npd＞}.Because ES [1]=<n<sub >10</sub>, npd>Be not empty, therefore need once more the process of repeating step D to step G.In this process, obtain REC [2] through step e, shown in Fig. 5 (c).After step F is carried out; Owing to there is not new fault generating; Therefore <img file=" BSA00000143094600222.GIF " he=" 73 " img-content=" drawing " img-format=" tif " inline=" yes " orientation=" portrait " wi=" 265 " /> arranged and when execution in step D once more, withdraw from cyclic process, execution in step H.

Below in conjunction with concrete experiment the effect of the method for testing software of using abnormal control flow set to fault detect is described.Experiment is the basis with the software static test system DTS based on the code defective, and contrast Application abnormal control flow set front and back are to test process and result's influence.The DTS test structure is as shown in Figure 6, mainly comprises following content:

Configuration file is used for confirming the fault type of needs detection, and it can determine the quantity of abnormal patterns state machine; Through analyzing the correlated variables in the source file, determine every kind of abnormal patterns state machine need create the quantity of instance; Abstract syntax tree is that create on the basis with the source file, and it is to the abstract semantic basis of calculating of program; Deposit the control stream information of each analytic unit in the control flow graph, it is the basis that fault detects; Deposit information such as action scope, notation declarations and use, type expression derivation in the symbol table, it obtains from the abstract syntax tree construction; Analytic process one side acquisition of information from abstract syntax tree and symbol table confirms to analyze order through the call relation between function between function, for analyzing the function of accomplishing, preserves its abstract context to be used for other analytic process on the other hand; Interval arithmetic is carried out approximate treatment to the abstract value of correlated variables in the program, and it depends on data structures such as abstract syntax tree, control flow graph and symbol table; After the state machine instance of present analysis unit is created and accomplished, need this instance of operation to carry out state exchange.When on each node of control stream, carrying out interval arithmetic, the bonding state switch condition is realized the state conversion process of state machine, and malfunction is used to control the expansion of stream.

On the test structure of existing DTS, this patent is an example with 9 java programs of increasing income, test process and result data before and after the contrast Application abnormal control flow set.Set not using abnormal control flow set of DTS (A), DTS (B) using abnormal control flow set.Consider cost of development and operational efficiency, experiment is only studied null pointer and is quoted run-time exception to the test process of resource leakage class fault and result's influence.

Experimental data is as shown in table 3.The instance number of the 4th row only comprises each engineering is quoted abnormal patterns foundation to null pointer state machine instance quantity in the table; Member's sum that total iteration situation of the 5th row is an abnormal control flow set, i.e. while round-robin cycle index in table 2 algorithm.Can find out that from statistics total iterations of DTS (B) has on average increased by 2.85% than DTS (A), the detection effect to the resource leakage fault is the average fault detect rate 14.95% that improves thus.

Table 3 test comparison data

In addition, through with the contrast of the similar testing tool with other of above test result, although we find that every kind of instrument all has failing to report in various degree, 29 resource leakage faults that increase newspaper for DTS (B) did not occur in the report of other instrument.

As shown in Figure 7, the software testing system of using abnormal control flow set of the present invention comprises:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set; Be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled; Extract the run-time exception information that subfunction possibly dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, representes that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module; Be used in said judge module output iterative detection unclosed as a result the time; The run-time exception information that in prior fault, is comprised with the fault collection; Correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module; Be used to adjust the current information sensing of control adfluxion and fault collection; The subsequent control stream that said subsequent control stream acquisition module is obtained is adjusted into current control stream; The consequent malfunction that said subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to said judge module;

The run-time exception extraction module, be used for said judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure.

The above embodiment is the preferred embodiment that proves absolutely that the present invention lifts, and protection scope of the present invention is not limited thereto.Being equal to that the technician in present technique field is done on basis of the present invention substitutes or conversion, all within protection scope of the present invention.Protection scope of the present invention is as the criterion with claims.

Claims (2)

1. the method for testing software of a using abnormal control flow set is characterized in that, comprising:

The input information of steps A, application present analysis unit, initialization control adfluxion and fault collection;

Step B, the pairing initial control stream of traversal analytic unit are promptly controlled first element in the adfluxion, and all nodes that call subfunction are wherein handled, and extract the run-time exception information that subfunction possibly dished out, first element of expansion fault collection;

Step C, on first element of control adfluxion, use the static test detection failure, and testing result made an addition among first element of fault collection;

Whether comprise detected failure collection in the currentElement of step D, failure judgement collection, if this set, representes that iterative detection finishes execution in step H for empty; If not, execution in step E then;

Step e, with the run-time exception information that is comprised in the prior fault of fault collection, on the node that corresponds to current control stream according to dish out position and Exception Type and the limit, obtain the subsequent control that current control flows and flow;

On step F, the subsequent control stream that in said step e, obtains, the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The current information of step G, adjustment control adfluxion and fault collection points to, and the subsequent control stream that obtains in the said step e is adjusted into current control stream, the consequent malfunction that obtains in the said step F is adjusted into works as prior fault, returns step D;

Step H, after the iteration processing finishes, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure;

Wherein, said steps A specifically comprises:

A1, initialization set member sequence number, it is 0 that its current value is set;

First element of A2, initialization fault collection, its currentElement of set of applications member's sequence number is set to sky;

The currentElement that first element of A3, initialization control adfluxion, set of applications member's sequence number controls adfluxion is set to the initial control of present analysis unit and flows;

Wherein, said step B specifically comprises:

B1, judge whether the node in the current control stream is its last node, then carries out said step C in this way, otherwise execution in step B2;

B2, judge in the present node of current control stream whether have statement to function call, if exist then execution in step B3, otherwise execution in step B5;

B3, according to the function abstracted information discriminant function run-time exception of whether can dishing out that in node, is called, execution in step B4 in this way, otherwise execution in step B5;

B4, the ordered pair that node and Exception Type are formed join and work as prior fault, then execution in step B5;

B5, with the next node replacement present node of node in the current control stream, return step B1;

Wherein, said step C specifically comprises:

The method of C1, application finite state machine is described fault; Node is wherein represented contingent state; Possible switch condition between Bian representative state for being created by analytic unit and concrete variable correlation behavior machine instance, is chosen one as current state machine instance from all state machine instance;

C2, on the diverse location of control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step C3 then, otherwise execution in step C4;

C3, the run-time exception composition ordered pair that will go out the position of present condition and dish out join ordered pair in prior fault;

C4, judge in the state machine instance set whether have untreated instance, and if existed with next instance as current instance, return step C2, otherwise carry out said step D;

Wherein, said step e specifically comprises:

E1, choose the current ordered pair in the fault, on control stream, match the respective nodes of ordered pair, judge whether this node is in the exception catching structure, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure corresponding with the exception catching structure can handle the pairing Exception Type of run-time exception in the ordered pair; Then on current control stream, add the limit from node to corresponding abnormality processing structure node, an execution in step E5 then in this way; As denying execution in step E3;

Whether E3, judgement also exist other exception catching structure except that current exception catching structure, then outer field in this way exception catching structure is set to current structure, returns step e 2, otherwise execution in step E5;

E4, on current control stream, add one from node to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual;

E5, judge in prior fault whether have the ordered pair of not handling,, return step e 1 if exist then it is labeled as current ordered pair; Otherwise obtain the subsequent control stream of current control stream, then execution in step F;

Wherein, said step F specifically comprises:

F1, initialization fault are concentrated the consequent malfunction when prior fault, and consequent malfunction is set to sky;

F2, be to be created and concrete variable correlation behavior machine instance, from all state machine instance, choose one as current state machine instance by analytic unit;

F3, on the diverse location of subsequent control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step F4 then, otherwise execution in step F5;

F4, the run-time exception that will occur using wrong position and this mistake to dish out are formed ordered pair, check whether this ordered pair is present in the failure collection, if do not exist, then this ordered pair are joined in the said consequent malfunction in back;

F5, judge in the state machine instance set whether have untreated instance,, return step F 3 if exist then choose a untreated instance as current instance, otherwise execution in step G;

Wherein, said step H specifically comprises:

H1, choose and point to a limit withdrawing from node in the current control stream unusually, with it as working as the pre-treatment limit;

H2, will work as the pairing Exception Type in front and join among the abstracted information of present analysis unit;

H3, judge to point to the limit of withdrawing from node in the current control stream unusually and whether all finish dealing with, execution in step I then in this way, otherwise select to withdraw from unusually in the current control stream limit of node, it as working as the pre-treatment limit, is returned step H2.

2. the software testing system of a using abnormal control flow set is characterized in that, comprising:

Initialization module is used to use the input information of present analysis unit, initialization control adfluxion and fault collection;

The plain expansion module of fault element of set; Be used to travel through the pairing initial control stream of analytic unit, promptly control first element in the adfluxion, all nodes that call subfunction are wherein handled; Extract the run-time exception information that subfunction possibly dished out, first element of expansion fault collection;

Fault detection module is used for first element in the control adfluxion, uses the static test detection failure, and testing result is made an addition among first element of fault collection;

Judge module, whether the currentElement that is used for the failure judgement collection comprises detected failure collection, if this set, representes that iterative detection finishes for empty, the result that the output iterative detection finishes; If not, the unclosed result of output iterative detection;

Subsequent control stream acquisition module; Be used in said judge module output iterative detection unclosed as a result the time; The run-time exception information that in prior fault, is comprised with the fault collection; Correspond to according to dish out position and Exception Type on the node and limit of current control stream, obtain the subsequent control stream of current control stream;

Subsequent control stream fault detection module is used at subsequent control stream, and the application and trouble detection technique is not present in fault that fault concentrates and adds among the consequent malfunction detected, obtains the next element of fault collection;

The circulation module; Be used to adjust the current information sensing of control adfluxion and fault collection; The subsequent control stream that said subsequent control stream acquisition module is obtained is adjusted into current control stream; The consequent malfunction that said subsequent control stream fault detection module is obtained is adjusted into works as prior fault, and exports to said judge module;

The run-time exception extraction module, be used for said judge module output iterative detection finish as a result the time, analyze current control stream, extract the run-time exception that it can be dished out, and be retained in the designated data structure;

Wherein, the performed operation of said initialization module specifically comprises:

A1, initialization set member sequence number, it is 0 that its current value is set;

First element of A2, initialization fault collection, its currentElement of set of applications member's sequence number is set to sky;

The currentElement that first element of A3, initialization control adfluxion, set of applications member's sequence number controls adfluxion is set to the initial control of present analysis unit and flows;

Wherein, the performed operation of the plain expansion module of said fault element of set specifically comprises:

B1, judge whether the node in the current control stream is its last node, is then further operated by said fault detection module in this way, otherwise execution in step B2;

B2, judge in the present node of current control stream whether have statement to function call, if exist then execution in step B3, otherwise execution in step B5;

B3, according to the function abstracted information discriminant function run-time exception of whether can dishing out that in node, is called, execution in step B4 in this way, otherwise execution in step B5;

B4, the ordered pair that node and Exception Type are formed join and work as prior fault, then execution in step B5;

B5, with the next node replacement present node of node in the current control stream, return step B1;

Wherein, the performed operation of said fault detection module specifically comprises:

The method of C1, application finite state machine is described fault; Node is wherein represented contingent state; Possible switch condition between Bian representative state for being created by analytic unit and concrete variable correlation behavior machine instance, is chosen one as current state machine instance from all state machine instance;

C2, on the diverse location of control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step C3 then, otherwise execution in step C4;

C3, the run-time exception composition ordered pair that will go out the position of present condition and dish out join ordered pair in prior fault;

C4, judge in the state machine instance set whether have untreated instance, and if existed with next instance as current instance, return step C2, otherwise carry out corresponding operating by said judge module;

Wherein, the performed operation of said subsequent control stream acquisition module specifically comprises:

E1, choose the current ordered pair in the fault, on control stream, match the respective nodes of ordered pair, judge whether this node is in the exception catching structure, execution in step E2 in this way, otherwise execution in step E4;

Whether E2, the judgement abnormality processing structure corresponding with the exception catching structure can handle the pairing Exception Type of run-time exception in the ordered pair; Then on current control stream, add the limit from node to corresponding abnormality processing structure node, an execution in step E5 then in this way; As denying execution in step E3;

Whether E3, judgement also exist other exception catching structure except that current exception catching structure, then outer field in this way exception catching structure is set to current structure, returns step e 2, otherwise execution in step E5;

E4, on current control stream, add one from node to the limit of withdrawing from node unusually, as the present analysis unit dished out unusual;

E5, judge in prior fault whether have the ordered pair of not handling,, return step e 1 if exist then it is labeled as current ordered pair; Otherwise obtain the subsequent control stream of current control stream, carry out corresponding operating by said subsequent control stream fault detection module then;

Wherein, the performed operation of said subsequent control stream fault detection module specifically comprises:

F1, initialization fault are concentrated the consequent malfunction when prior fault, and consequent malfunction is set to sky;

F2, be to be created and concrete variable correlation behavior machine instance, from all state machine instance, choose one as current state machine instance by analytic unit;

F3, on the diverse location of subsequent control stream; Be that the variable in the current state machine instance calculates its possible value, and the bonding state switch condition carries out state exchange to current state machine instance, in state conversion process if break down state; Execution in step F4 then, otherwise execution in step F5;

F4, the run-time exception that will occur using wrong position and this mistake to dish out are formed ordered pair, check whether this ordered pair is present in the failure collection, if do not exist, then this ordered pair are joined in the said consequent malfunction in back;

F5, judge in the state machine instance set whether have untreated instance,, return step F 3, otherwise carry out corresponding operating by said circulation module if exist then choose a untreated instance as current instance;

Wherein, the performed operation of said run-time exception extraction module specifically comprises:

H1, choose and point to a limit withdrawing from node in the current control stream unusually, with it as working as the pre-treatment limit;

H2, will work as the pairing Exception Type in front and join among the abstracted information of present analysis unit;

H3, judge to point to the limit of withdrawing from node in the current control stream unusually and whether all finish dealing with, execution in step I then in this way, otherwise select to withdraw from unusually in the current control stream limit of node, it as working as the pre-treatment limit, is returned step H2.

Images