CN102662825B - Method for detecting memory leakage of heap operational program - Google Patents
Method for detecting memory leakage of heap operational program Download PDFInfo
- Publication number
- CN102662825B CN102662825B CN201210041025.7A CN201210041025A CN102662825B CN 102662825 B CN102662825 B CN 102662825B CN 201210041025 A CN201210041025 A CN 201210041025A CN 102662825 B CN102662825 B CN 102662825B
- Authority
- CN
- China
- Prior art keywords
- pointer
- state
- statement
- heap
- another name
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The present invention discloses a method for detecting the memory leakage of a heap operational program, is directed to solving a technical problem of the memory error detection of the heap operational program in terms of precision and efficiency, and provides a novel memory leakage detection method with improved precision and efficiency of the detection. The technical scheme comprises analyzing a source code of the program in terms of statement and morphology at first and generating an intermediate file; carrying out a pretreatment which includes slicing and transformation; obtaining an abstract state of a heap memory based on the definition of an extension type of a pointer variable in the program; employing a forward data flow iteration method to implement an in-process detection and an inter-process detection; and finally inspecting and counting results of the memory leakage detection. The method finds a good equilibrium point between precision and efficiency of a static analysis, accelerates the termination of an iterative algorithm, improves the precision and the efficiency of the detection, and has a strong scalability and a low storage overhead.
Description
Technical field
The present invention relates to the static detection method that heap operation program internal memory that a class in computer program has dynamic, variable shared drive operating characteristic leaks.
Background technology
Heap operation program comprises the program that uses dynamic data structure (as: chained list, tree etc.) Storage and Processing data, very common at system software and application software, such as: operating system (as: Linux, FreeRTOS) is usually used the task of priority query or Hash table management system; Device drives supervisory routine is used shares unidirectional or doubly linked list management various device; Server software (as: Apache) uses container (Collection) to accept and store various user's requests; All kinds of containers of information system management software application represent view and the storage data that inquiry obtains from database.This class method all has dynamic assignment in operational process, polymerization, separation or discharges the feature of internal storage location in heap; On the other hand, known while analyzing this class method source code, programmer uses pointer variable (or pointer field) direct (or indirectly) to handle these internal storage locations, make to exist complicated points relationship between these Dram unit, such as: certain internal storage location may be pointed by multiple pointer variables or other internal storage location.Therefore, judge whether the internal storage location of having applied in heap operation program is finally released than the program difficulty of other types and much complicated.RAM leakage refers to that the internal memory of dynamic assignment is not released immediately, and it is the important software error of a class, and it can cause the system of continuous service to be collapsed because memory source exhausts, or important information leakage.
Current, Memory leakage detection has several different methods and instrument thereof, is mainly divided into dynamic and static method.The instrument of exemplary dynamic method has Purify, JPF etc., though these class methods can be located mistake exactly, automaticity is high, is limited to input use-case, can not check all memory overflow mistakes; Static method is under operating software prerequisite, not check whether there is memory overflow, and exemplary operation has: LCLint, SATURN etc., can find all possible memory overflow mistake, but have higher rate of false alarm.Therefore, how under the prerequisite that ensures precision, to make static detecting tool can detect focus and the difficult point that extensive program is current Static Detection research.Method for Memory leakage detection in the heap operation program of dynamic, variable storage allocation mainly can be divided into:
(1) the insensitive detection method in territory
The insensitive detection method in territory is whether the internal memory node based on each distribution in Pointer Alias Analysis trace routine is finally released, and can be divided into again that stream is responsive and stream is insensitive, path-sensitive and path is insensitive, context-sensitive and the insensitive 6 kinds of detection methods of context.For example: the people such as Zongxing Xu have proposed the interprocedual RAM leakage algorithm based on constraint solver CVC3 path-sensitive in 2008 on software quality international conference (QSIC'08); The static analysis tools SPARROW that has proposed a kind of robotization in the international memory management forum meeting of Yungbum Jung and Kwangkeun Yi (ISMM ' 08), has designed the parameterized procedure function method of abstracting based on escape model; In addition, Xie Yichen and Alex Aiken have proposed memory leak detecting instrument Saturn in the 10th European soft project meeting, be the satisfiability problem of boolean's formula by Memory Leaks stipulations, then use SAT solver to judge whether to exist RAM leakage; The people such as David L.Heine have proposed memory leak detecting instrument Clouseau on the 28th International Conference on Software Engineering, it is to describe based on pointer entitlement the pointer variable that discharges heap memory node, then constructs entitlement constrained system and detects RAM leakage mistake.All these instruments can not directly apply to and detect RAM leakage mistake in heap operation program.
(2) the responsive detection method in territory
The responsive detection method in territory relates to the accessibility relation between heap memory unit.The people such as Mooly Sagiv have proposed three-valued logic TVLA (Three-Value Logic) in ACM program language in 2002 and system transactions (TOPLAS ' 02), the program with chained list type is divided into limited equivalence class by definition core (core) and auxiliary (instrumental) predicate collection by internal memory node, prove that by the form of routine analyzer various chained list running programs do not have RAM leakage mistake, but there is higher wrong report while being applied to the heap operation program internal memory leak detection of other types in TVLA; The people such as Hackett have proposed a kind of regional morphology analytical algorithm based on reference count of novelty in ACM program language principle in 2005 international conference (POPL ' 05), and can in 2 minutes, detect and find 97 mistakes to 3 popular large-scale c programs of several ten thousand row, wherein only have 37 to be true mistake, although efficiency is higher, but, exist higher rate of false alarm; The people such as Ji Wang have designed the memory leak detecting algorithm driving based on the abstract sensing figure of internal memory demand on Chinese journal of computers English edition (JCST ' 09) in 2009, and in precision and efficiency, obtain the better balance that compares, but storage overhead and computation complexity are still higher.Recently, in succession occurred heap operation program to use the morphological analysis method of reasoning from logic to detect EMS memory error, exemplary operation has: SpaceInvader and Xisa.SpaceInvader was upper separation logic (Separation Logic) the formula recursive definition linked list data structure invariant that uses of area of computer aided checking international conference (CAV ' 08) in 2008, then designed various inference rule based on recursive definition heap operation program has been carried out to reasoning, successful analysis and the internal memory correctness of having verified some device drives supervisory routines under Windows and Linux; Xisa is at the upper User Defined data structure invariant analysis of abstract interpretation framework support parameter and the internal memory security property of checking heap operation program of using of ACM program language principle in 2008 international conference (POPL ' 08).But these methods are subject to the constraint of User Defined data structure invariant, automaticity is not high, and the EMS memory error that is difficult to be practically applicable to extensive practical programs detects automatically.
In sum, although academic circles at present and industry member have multiple different memory leakage detecting method, every kind of method has feature and the scope of application separately, and they all have weak point in detection heap operation program.Though the insensitive detection method in territory can detect extensive program, but accuracy of detection is lower, especially face while having the heap operation program of heap memory polymerization, stalling characteristic, whether all internal memory nodes that can not detect in same pointer variable sensing region of memory are all released; Though the detection method of territory sensitivity can detect all RAM leakage mistakes in heap operation program, but because automated procedures are not high or system resource (mainly comprising internal memory, time) consumption cost is too large, so efficiency is not high, the program scale that can analyze is smaller.
Summary of the invention
The technical problem to be solved in the present invention is: have for current method for detecting memory leakage the problem that has precision and efficiency aspect the heap operation program internal memory error-detecting of the operating characteristics such as dynamic shared drive application, merging, separation, deletion, a kind of method for detecting memory leakage based on the local abstract forward data flow iteration of heap memory is provided, improves the precision and the efficiency that detect.
Concrete technical scheme is:
The 1st step, utilize compiler platform to carry out lexical analysis, grammatical analysis to detected program, generate detected program abstract syntax tree, control flow graph (describe front and back between program basic statement continue relation), the such intermediate information of invocation of procedure figure (call graph in program between function).
The 2nd step, pre-service.Before being detected, a real heap operation program internal memory needs to carry out two-step method.
2.1 sections, are not used the assignment statement of any pointer type variable to delete from program by those, obtain the program after section.
2.2 convert according to transformation rule the pointer assignment statement that does not meet canonical form in the program after section to canonical form.The pointer assignment statement of canonical form comprises 7 kinds: 1, pointer variable p is set to sky, and shape is as p=null; 2, by the pointer field p->f of pointer variable p
mbe set to sky, shape is as p->f
m=null; 3, between pointer variable, copy statement, shape is as p=q; 4, copy statement between the pointer field of pointer p and pointer q, shape is as p=q->f
m; 5, copy statement between the pointer field of pointer p and pointer q, shape is as p->f
m=q; 6, internal memory application statement, shape is as p=malloc; 7, internal memory free statement, shape is as free (p).Transformation rule has 5 kinds, respectively:: 1, introduce auxiliary pointer variable pt
0by shape as p->f
m=q->f
npointer assignment statement be converted to: pt
0=q->f
n; P->f
m=pt
0; 2, introduce auxiliary pointer variable pt
1by shape as p=p->f
mpointer assignment statement be converted to: pt
1=p->f
m; P=pt
1; 3, introduce auxiliary pointer variable pt
2by shape as p->f
mthe pointer assignment statement of=malloc is converted to: pt
2=malloc; P->f
m=pt
2; 4, introduce auxiliary pointer variable pt
3by shape as p=q->f
m->f
npointer assignment statement be converted to: pt
3=q->f
m; P=pt
3->f
n; 5, introduce auxiliary pointer variable pt
4by shape as free (p->f
m) internal memory free statement be converted to: pt
4=p->f
m; Free (pt
4).
The 3rd step, according to the expansion type of the another name information definition pointer of each pointer variable in function, obtains the heap memory Abstract State of program.In heap operation program, the expansion type of pointer variable p
be defined as: <f
1: <dist; 2
pVar>; f
2: <dist, 2
pVar>; ... f
i: <dist; 2
pVar>...; f
n: <dist; 2
pVar>>, wherein: f
1, f
2... f
i..., f
nrepresent that respectively p points to the name in internal storage location pointer territory, 1≤i≤n, that is: p points to the internal storage location of being assembled by n pointer field, and internal storage location is called again internal memory node; Variable dist represents the distance value between internal memory node and pointer p in heap; 2
pVarrepresent to point to p internal memory node distance pointed the set that all pointer variables that are the internal memory node of dist form, be called pointer another name collection, comprising: the formal parameter in global pointer variable, local pointers variable, function with pointer type.Analyze 7 kinds of basic pointer assignment statements of standard of heap operation program known: the internal memory node that in a pointer assignment statement, p directly or indirectly quotes is 1 apart from the maximal value of p, for example: statement p->f
i=q, by internal memory node pointer territory f pointed pointer p
ithe value address of being revised as pointer q internal memory node pointed, in this statement, p is by pointer field f
ithe internal memory node that route can reach is 1 apart from the value of p.Therefore, the scope of variable dist value is: 0,1 and 2, wherein: element 0 and 1 represents in heap memory the distance exact value of the internal memory node pointed with p, and value 2 is arbitrary values, represents to pass through certain pointer field f
imore than twice or twice routing times (claiming again the operation of pointer dereference, dereferencing), the internal memory node obtaining like this in the heap memory node (summary node) that claims again to make a summary.Pointer set 2
pVarin have two special elements: empty set
represent that in heap memory, pointing to p distance without any pointer variable is the internal storage location of dist, and this internal storage location is assigned with in heap memory; ⊥ represents that the value of certain pointer variable p is null or certain pointer field f
ivalue be null (special marking value represents that this pointer variable value is invalid memory address), p or pointer field f
iinternal storage location pointed is not also assigned with in heap.The active pointer variable of heap operation program HP is the pointer variable that in usability of program fragments, a class is used or revises, and by predicate, LivePVar represents.So, the local Abstract State of heap memory
the set with the expansion type formation of active pointer variable, that is:
in formula, p
irepresent the activated pointer variable of any one tool,
represent p
iexpansion type.Hence one can see that: in heap operation program, the number of the local Abstract State of heap memory is limited.Suppose that heap operation program pointer variable number is pn, the number in aggregate type pointer territory is fn, so the local Abstract State of heap memory
maximum number be: [fn × 3 × (2
pn+ 1)]
pn, in formula, 3 represent the kind of distance value, 2
pnnumber of subsets in the power set of expression pointer another name collection, 1 represents to add the concentrated special elements value ⊥ of pointer another name.
The 4th step, memory leak detecting in process.According to the definition of above-mentioned pointer expansion type, obtain in heap operation program basic statement about the transition relationship of heap memory Abstract State, particularly, certain function f of top-down selection from the invocation of procedure figure of detected program, and by the Abstract State of function f porch
be set to sky, carry out memory leak detecting in process according to forward data flow alternative manner, forward data flow alternative manner is:
The heap memory Abstract State of each program point i in 4.1 initialization function f
be set to sky, and queue W is set to sky, W is the queue of a fifo fifo, and fundamental element is
right, s is statement.
4.2 by the entry statement s of function f
0and Abstract State
join queue W.
4.3 judge whether queue W is empty, and sky turns the 6th step if, if not for sky, carry out 4.4.
4.4 from queue W pop-up item
according to the type conversion Abstract State of statement s
obtain new Abstract State
concrete grammar is as follows:
4.4.1 if statement s is basic pointer assignment statement, by the type conversion state of 7 kinds of pointer assignment statements
obtain new Abstract State
and from Succ (s), selecting certain element s ', Succ (s) represents to control the follow-up statement collection of statement s in flow graph.Then carry out 4.5.By the type conversion of 7 kinds of pointer assignment statements
method be:
(1) pointer assignment statement p=null.Transformation rule is: at state
in, first from passing through certain pointer field f
iroute can reach the pointer another name of p sensing internal memory node and concentrate deletion p, then will
be set to null, that is: will
in all f that pass through
iroute distance value is that 0,1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
pointer p internal memory node pointed exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by this statement s and Abstract State
join in RAM leakage queue heapleakListF, heapleakListF preserves the statement of all generation RAM leakages and the queue of state, and fundamental element is: statement and Abstract State pair
(2) statement p->f
m=null.Transformation rule is: at state
in, pointer variable x representative can be passed through certain pointer field f
iroute can reach the pointer variable of p sensing internal memory node.First, the expansion type of amendment x: if x and p call, that is: x is 0 to the distance of p, from
in will pass through f
iroute distance value is that 1 and 2 pointer another name collection is set to sky; If x is 1 or 2 to the distance value of p, from
in pass through f
iroute distance is 2 concentrated deletion of pointer another name
in pass through f
iroute distance value is 1 and 2 pointer another name collection.Then, will
in pass through f
mroute distance value is that 1 and 2 pointer another name collection is set to sky, obtains new Abstract State
if state
middle p points to the f in internal memory node
mthe internal memory node pointing to exists and is not passed through f by other pointer variables or other internal memory nodes
iroute can reach, and RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
(3) pointer copy statement p=q.Transformation rule is: first, and at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, will
assignment is given
be revised as by the sensing of p the node that q points to, obtain new Abstract State
if state
the internal memory node that middle p points to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
(4) statement p=q->f
m.Transformation rule is: first, and at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, will
in pass through f
mroute distance value be 1 pointer another name collection assignment to
in by certain pointer field f
iroute distance value is 0 pointer another name collection, and p is joined
in pass through f
iroute distance value is that 1 pointer another name is concentrated, and obtains new Abstract State
if state
the internal memory node that middle p points to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
(5) statement p->f
m=q.Transformation rule is: first, and at state
under according to rule (1) perform statement p->f
mabstract State in the middle of=null obtains
then at middle Abstract State
under, set Q represents
in by certain pointer field f
iroute distance is 0 pointer another name collection, and pointer variable t represents Abstract State
in can pass through f
ione or many route arrives the pointer of the internal memory node of p sensing.According to Abstract State in the middle of following rules modification
first, the expansion type of each pointer variable y in amendment set Q
will
in pass through f
iroute distance is that 0 pointer another name collection joins
in pass through f
iroute distance is that 1 pointer another name is concentrated, will
in pass through f
iroute distance is that 1 and 2 pointer another name collection adds to
in pass through f
iroute distance is that 2 pointer another name is concentrated; Then, will pass through f
iroute distance q value is 0,1 to add to together with q with 2 pointer another name collection
in pass through f
iroute distance is that 2 pointer another name is concentrated, and obtains new Abstract State
if state
f in the internal memory node that middle p points to
mthe internal memory node pointing to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
(6) Memory Allocation statement p=malloc ().Transformation rule is: first, and at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, newly apply for an internal memory node and by the address assignment of this internal memory node to pointer p, that is: will
in by certain pointer field f
iroute distance is that 0 pointer another name collection is set to empty set
pass through f
iroute distance is that 1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
the internal memory node that middle p points to exists and is not passed through certain pointer field f by other internal memory nodes in other pointer variables or heap memory
jroute can reach, and RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
(7) internal memory free statement free (p).Transformation rule is: at state
in, pointer variable w represents to remove the every other pointer variable of p in pointer variable collection LivePVar alive (HP), first, from
in by certain pointer field f
iroute distance value is 0,1 and 2 concentrated deletion of pointer another name
in pass through f
iroute distance is 0 pointer another name collection, then will
in pass through f
iroute distance value is that 0,1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
middle p points to certain pointer field internal memory node existence pointed in internal memory node and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF.
4.4.2 if statement s is switch condition case statement: first at current heap memory Abstract State
under solve the true value of switch statement condition, then from Succ (s), select next perform statement s ' according to condition true value, and follow-up statement using s ' as statement s, state
as new Abstract State
carry out 4.5.
4.4.3 if statement s is unconditional jump statement: and follow-up statement using object statement s ' as statement s, state
as new Abstract State
carry out 4.5.
4.4.4 if statement s is function call statement, carries out the 5th step, obtains new Abstract State
from Succ (s), select certain element s ', as the follow-up statement of s.
4.4.5 if statement s is function return statement return e, at Abstract State
under, the expansion type using the expansion type of pointer variable e as function return value, the expansion type of global pointer variable is constant, and the expansion type assignment of other local pointers variablees is put sky, obtains new Abstract State
and as the discharge state of function f
exit statement s ', as the follow-up statement of return statement s, then carries out 4.5.
4.5 by new Abstract State
original state with follow-up statement s '
obtain this program by union operation Join and put new Abstract State
carry out 4.6 steps.The mistake of leaking in order to detect as much as possible heap operation program internal memory, union operation is: and if only if any two Abstract States
with
existence comprises while relation and could merge, otherwise two Abstract States are respectively as the element of union operation.Two heap memory Abstract States
with
there is relation of inclusion
and if only if: state
middle arbitrary element is at state
in.Union operation can be expressed as by formula:
4.6 by the heap Abstract State after merging
adopt the operated in saturation state that reaches capacity
operated in saturation concrete steps are as follows:
4.6.1 token variable modified is initialized as to vacation.
4.6.2 irreflexive operation.Traversal Abstract State
in each pointer variable x
1, from
in by certain pointer field f
iroute distance is 0 the concentrated pointer x that deletes of pointer another name
1.If certain pointer another name collection has been modified, modified is set to very.
4.6.3 symmetry operation.Traversal Abstract State
in each pointer variable x2, from
in by certain pointer field f
iroute distance is concentrated certain pointer variable y that takes out arbitrarily of pointer another name of 0
2if,
in all f that pass through
iroute distance is that 0 pointer another name collection does not comprise x
2, by x
2join and pass through f
iroute distance is 0 pointer another name collection.If certain pointer another name collection has been modified, modified is set to very.
4.6.4 transmit operation.Traversal Abstract State
in each pointer variable x
3, from
in by certain pointer field f
iroute distance is certain value d
1pointer another name concentrate and take out arbitrarily certain pointer variable y,
in by certain pointer field route distance for certain be worth d
2obtain pointer another name collection Q
2if, pointer another name collection Q
2in certain pointer variable z do not exist
in pass through f
iroute distance is d
1+ d
2pointer another name concentrate, z is joined
in pass through f
iroute distance is d
1+ d
2pointer another name concentrate.If certain pointer another name collection has been modified, modified is set to very.
4.6.5 judge the value of modified, false if, state
state reaches capacity
turn 4.7 steps; Otherwise turn 4.6.1 step.
If 4.7 state of saturation
with virgin state
difference, by state of saturation
as new virgin state
and by state of saturation
join in W with follow-up statement s ', turn 4.3.
The 5th step, carries out the memory leak detecting of interprocedual to heap operation program, method is:
5.1 acquisition process call statement e=f (e
1, e
2..., e
k) initialization information.Invoked procedure is by name: f, formal parameter is: p
1, p
2..., p
k, actual parameter is: e
1, e
2..., e
k, wherein: p
hrepresent formal parameter, e
hfor p
hcorresponding actual parameter, the scope of subscript h is 1≤h≤k, rreturn value is: ret
f, local pointers variables set is: LVar
f, global pointer variables set is: GVar
f, the heap memory Abstract State of carrying out before function call statement is
5.2 at heap memory Abstract State
the state transition of lower execution call statement, obtains the heap memory original state of called function
process is as follows:
5.2.1 by state
middle global pointer variables set GVar
fin arbitrarily the expansion type of global pointer variable g pass to invoked procedure, that is: state
middle g's
equal state
middle g's
5.2.2 by state
middle actual parameter e
h's
pass to formal parameter p
h, as called porch p
h's
that is: state
in
value be state
in
value.
5.2.3 state
middle local pointers variables set LVar
fin the expansion type of any local pointers variable l
be initialized as sky.
5.3 by function f and original state
as parameter, adopt the 4th step forward data flow alternative manner to carry out memory leak detecting in process to function f, obtain the new Abstract State of function exit heap memory
5.4 by heap memory state
pass to invoked procedure, obtain new Abstract State
in accordance with the following steps:
5.4.1 by state
pointer type rreturn value ret
fexpansion type pass to invoked procedure, as state
the expansion type of lower pointer e.
5.4.2 state
the expansion type of middle global pointer variable g
constant while passing to invoked procedure, as state
lower g's
5.4.3 the expansion type of other local pointers variablees is constant before and after the invocation of procedure, that is: state
in the value of expansion type of other local pointers variablees be state
in the value of corresponding topical pointer variable expansion type.
The 6th step, statistics heap operation program internal memory leak detection result data.
6.1 according to the information about heap memory Abstract State in each program point on control flow graph, exports the heap memory Abstract State of entry statement and the heap memory Abstract State in exit of each program point.
6.2 according to the content of RAM leakage queue heapleakListF, and program statement s and the state of RAM leakage likely occurs in output
and add up the number of RAM leakage.
The possible RAM leakage mistake of 6.3 screening, counts the wrong report number of detection, and obtains rate of false alarm.Because a RAM leakage mistake represents the pointer assignment under current pointer expansion type, in forward direction iterative detection process, report these mistakes with Abstract State and the right form of pointer assignment statement, can assist and confirm true mistake.
6.4 information during according to the operation of compiling platform and system, obtain the situation of method for detecting memory leakage consume system resources, such as: elapsed time of memory consumption, each detection-phase etc.
Compared with prior art, adopt the present invention can reach following technique effect:
(1) the present invention is on the basis of the 2nd step pointer expansion type definition, a kind of method for detecting memory leakage towards heap operation has been proposed, then use internal memory Rankine-Hugoniot relations local between expansion pointer type record pointer variable to support the local reasoning of heap memory, detect the RAM leakage mistake in heap operation program, take into account efficiency and precision, between the precision of static analysis and efficiency, found a good equilibrium point.
(2) the present invention proposes to describe based on pointer expansion type the another name relation of pointer, compared with the method for detecting memory leakage that points to alias analysis with traditional (unification-based) based on unification, not only represent the another name information of pointer, and represent the another name information of all pointer fields in pointer node pointed, it is the RAM leakage static detection method of a kind of territory sensitivity, compared with other method for detecting memory leakages, improve accuracy of detection.
(3) the present invention's the 3rd step has provided the local abstract representation of heap memory based on pointer expansion type, compared with classical sensing figure, the local Abstract State of heap memory based on pointer expansion type represents simply, efficiently, the direct operational semantics towards pointer assignment statement, without the lvalue and the r value that calculate pointer expression formula, just can obtain another name information and the occurrence of pointer, improve the efficiency detecting.
(4) the present invention's the 4th step memory leak detecting adopts forward data flow iterative algorithm, try to achieve the set of each program point about the local Abstract State of heap memory by fixed point iterative process, can consider various possible pointer another name situations, on the other hand, in program, the number of the local Abstract State of heap memory is limited, can ensure the termination of iterative algorithm, union operation can reduce the storage overhead of state, accelerates the termination of iterative algorithm.
(5) there is good extendability.Because program termination is undecidable in theory, the number of the interprocedual transfer environment of context-sensitive is infinite, therefore, accomplish that context-sensitive is impossible completely.The present invention's the 5th step is in the time that the interprocedual of processing context-sensitive detects, use a kind of detection method of log history information increment type: if when the original state of invoked procedure does not comprise current Abstract State, testing process is called, and the result of detection is joined in invoked procedure; Otherwise do not enter detection invoked procedure.The method can improve the efficiency of detection, and while especially repeatedly repeatedly being called with some identical process along with the increase of detection of code scale, this advantage embodies extremely obviously.
Brief description of the drawings
Fig. 1 is overview flow chart of the present invention.
Fig. 2 is the process flow diagram detecting in the present invention's the 4th step process.
Fig. 3 is the process flow diagram that the present invention's the 5th step interprocedual detects.
Specific embodiments
Fig. 1 overview flow chart of the present invention.Input is the source code of program, may cause the statement of RAM leakage and Abstract State, various statistic when output in program source code.
The present invention includes following step:
1. first utilize compiler platform to carry out Sentence analysis and lexical analysis to program source code, generate intermediate file, comprising: abstract syntax tree, control flow graph and invocation of procedure figure.
2. pre-service, comprising: section and conversion.
3. obtain heap memory Abstract State according to the definition of the expansion type of program pointer variable.
4. in process, detect.
5. interprocedual detects.
6. check and add up the result that RAM leakage inspection detects.
Fig. 2 is the process flow diagram detecting in the present invention's the 4th step process, comprises the following steps:
The heap memory Abstract State of each program point i and queue W in 4.1 initialization functions.
4.2 join population statement and the Abstract State of function in queue.
4.3 judge whether queue W is empty, and sky turns the 6th step if, if not for sky, carry out 4.4.
4.4 eject a certainly from queue, obtain new Abstract State according to the type conversion Abstract State of statement.
4.5 are merged into new Abstract State by the original state of new Abstract State and follow-up statement by union operation.
The heap Abstract State after merging is adopted the operated in saturation state that reaches capacity by 4.6.
If 4.7 state of saturation are different from virgin state, using state of saturation as new virgin state, and state of saturation and follow-up statement are joined in W, then jump to the 4.3rd step.
Fig. 3 is the process flow diagram that the present invention's the 5th step interprocedual detects, and comprises the following steps:
The initialization information of 5.1 acquisition process call statements.
5.2 carry out the state transition of call statement under heap memory Abstract State, obtain the heap memory original state of called function.
5.3 adopt the 4th step forward data flow iterative algorithm to carry out memory leak detecting in process to function, obtain the new Abstract State of function exit heap memory.
5.4 by heap memory state transfer to invoked procedure, obtain new Abstract State.
Claims (4)
1. towards a memory leakage detecting method for heap operation program, it is characterized in that comprising the following steps:
The 1st step, utilizes compiler platform to carry out lexical analysis, grammatical analysis to detected program, generates abstract syntax tree, control flow graph, the invocation of procedure figure of detected program;
The 2nd step, pre-service:
2.1 sections, are not used the assignment statement of any pointer type variable to delete from program by those, obtain the program after section;
2.2 convert according to transformation rule the pointer assignment statement that does not meet canonical form in the program after section to canonical form;
The 3rd step, according to the expansion type of the another name information definition pointer of each pointer variable in function, obtains the heap memory Abstract State of program; In heap operation program, the expansion type definition of pointer variable p
for: <f
1: <dist; 2
pVar>; f
2: <dist, 2
pVar>; ... f
i: <dist; 2
pVar>...; f
u: <dist; 2
pVar>> is wherein: f
1, f
2... f
i..., f
nrepresent that respectively p points to the name in internal storage location pointer territory, 1≤i≤n, that is: p points to the internal storage location of being assembled by n pointer field, and internal storage location is called again internal memory node; Variable dist represents the distance value between internal memory node and pointer p in heap; 2
pVarrepresent to point to p internal memory node distance pointed the set that all pointer variables that are the internal memory node of dist form, be called pointer another name collection; The scope of variable dist value is: 0,1 and 2, wherein: element 0 and 1 represents in heap memory the distance exact value of the internal memory node pointed with p, and value 2 is arbitrary values, represents to pass through certain pointer field f
imore than twice or twice routing times, the internal memory node obtaining like this in heap memory claims again the node of making a summary; Pointer set 2
pVarin have two special elements: empty set
represent that in heap memory, pointing to p distance without any pointer variable is this internal storage location of dist, and this internal storage location is assigned with in heap memory; ⊥ represents that the value of certain pointer variable p is null or certain pointer field f
ivalue be null, represent that this pointer variable value is invalid memory address, p or pointer field f
iinternal storage location pointed is not also assigned with in heap; The active pointer variable of heap operation program HP is the pointer variable that in usability of program fragments, a class is used or revises, and by predicate, LivePVar represents; The local Abstract State of heap memory
the set with the expansion type formation of active pointer variable, that is:
pi represents the activated pointer variable of any one tool,
represent the expansion type of pi;
The 4th step, certain function f of top-down selection from the invocation of procedure figure of detected program, and by the Abstract State of function f porch
be set to sky, carry out memory leak detecting in process according to forward data flow alternative manner, obtain that in heap operation program, basic statement is about the transition relationship of heap memory Abstract State, forward data flow alternative manner is:
The heap memory Abstract State of each program point i in 4.1 initialization function f
be set to sky, and queue W is set to sky, W is the queue of a fifo fifo, and fundamental element is
right, s is statement,
for the local Abstract State of heap memory;
4.2 by the entry statement s of function f
0and Abstract State
join queue W;
4.3 judge whether queue W is empty, and sky turns the 6th step if, if not for sky, carry out 4.4;
4.4 from queue W pop-up item
according to the type conversion Abstract State of statement s
obtain new Abstract State
concrete grammar is as follows:
4.4.1 if statement s is basic pointer assignment statement, by the type conversion state of 7 kinds of pointer assignment statements
obtain new Abstract State
and select certain element s ' from control the follow-up statement collection Succ (s) of statement s flow graph, then carry out 4.5; By the type conversion of 7 kinds of pointer assignment statements
method be:
(1) pointer assignment statement p=null, transformation rule is: at state
in, first from passing through certain pointer field f
iroute can reach the pointer another name of p sensing internal memory node and concentrate deletion p, then will
be set to null, that is: will
in all f that pass through
iroute distance value is that 0,1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
pointer p internal memory node pointed exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by this statement s and Abstract State
join in RAM leakage queue heapleakListF, heapleakListF preserves the statement of all generation RAM leakages and the queue of state, and fundamental element is: statement and Abstract State pair
(2) statement p->f
m=null, transformation rule is: at state
in, pointer variable x representative can be passed through certain pointer field f
iroute can reach the pointer variable of p sensing internal memory node; First, the expansion type of amendment x: if x and p call, that is: x is 0 to the distance of p, from
in will pass through f
iroute distance value is that 1 and 2 pointer another name collection is set to sky; If x is 1 or 2 to the distance value of p, from
in pass through f
iroute distance is 2 concentrated deletion of pointer another name
in pass through f
iroute distance value is 1 and 2 pointer another name collection; Then, will
in pass through f
mroute distance value is that 1 and 2 pointer another name collection is set to sky, obtains new Abstract State
if state
middle p points to the f in internal memory node
mthe internal memory node pointing to exists and is not passed through f by other pointer variables or other internal memory nodes
iroute can reach, and RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
(3) pointer copy statement p=q, transformation rule is: first, at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, will
assignment is given
be revised as by the sensing of p the node that q points to, obtain new Abstract State
if state
the internal memory node that middle p points to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
(4) statement p=q->f
m, transformation rule is: first, and at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, will
in pass through f
mroute distance value be 1 pointer another name collection assignment to
in by certain pointer field f
iroute distance value is 0 pointer another name collection, and p is joined
in pass through f
iroute distance value is that 1 pointer another name is concentrated, and obtains new Abstract State
if state
the internal memory node that middle p points to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
(5) statement p->f
m=q, transformation rule is: first, at state
under according to rule (1) perform statement p->f
mabstract State in the middle of=null obtains
then at middle Abstract State
under, set Q represents
in by certain pointer field f
iroute distance is 0 pointer another name collection, and pointer variable x represents Abstract State
in can pass through f
ione or many route arrives the pointer of the internal memory node of p sensing; According to Abstract State in the middle of following rules modification
first, the expansion type of amendment set Q pointer variable y
will
in pass through f
iroute distance is that 0 pointer another name collection joins
in pass through f
iroute distance is that 1 pointer another name is concentrated, will
in pass through f
iroute distance is that 1 and 2 pointer another name collection adds to
in pass through f
iroute distance is that 2 pointer another name is concentrated; Then, will pass through f
iroute distance q value is 0,1 to add to together with q with 2 pointer another name collection
in pass through f
iroute distance is that 2 pointer another name is concentrated, and obtains new Abstract State
if state
f in the internal memory node that middle p points to
mthe internal memory node pointing to exists and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
(6) Memory Allocation statement p=malloc (), transformation rule is: first, at state
under according to rule (1) perform statement p=null obtain in the middle of Abstract State
then at middle Abstract State
under, newly apply for an internal memory node and by the address assignment of this internal memory node to pointer p, that is: will
in by certain pointer field f
iroute distance is that 0 pointer another name collection is set to empty set
pass through f
iroute distance is that 1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
the internal memory node that middle p points to exists and is not passed through certain pointer field f by other internal memory nodes in other pointer variables or heap memory
jroute can reach, and RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
(7) internal memory free statement free (p), transformation rule is: at state
in, pointer variable w represents to remove the every other pointer variable of p in pointer variable collection LivePVar alive (HP), first, from
in by certain pointer field f
iroute distance value is 0,1 and 2 concentrated deletion of pointer another name
in pass through f
iroute distance is 0 pointer another name collection, then will
in pass through f
iroute distance value is that 0,1 and 2 pointer another name collection is set to ⊥, obtains new Abstract State
if state
middle p points to certain pointer field internal memory node existence pointed in internal memory node and can not reached by certain pointer field route by other internal memory nodes in other pointer variables or heap memory, RAM leakage occurs, by statement s and state
join in RAM leakage queue heapleakListF;
4.4.2 if statement s is switch condition case statement: first at current heap memory Abstract State
under solve the true value of switch statement condition, then from Succ (s), select next perform statement s ' according to condition true value, and follow-up statement using s ' as statement s, state
as new Abstract State
carry out 4.5;
4.4.3 if statement s is unconditional jump statement: the follow-up statement using object statement s ' as statement s, state
as new Abstract State
carry out 4.5;
4.4.4 if statement s is function call statement, carries out the 5th step, obtains new Abstract State
from Succ (s), select certain element s ', as the follow-up statement of s;
4.4.5 if statement s is function return statement return e, at Abstract State
under, the expansion type using the expansion type of pointer variable e as function return value, the expansion type of global pointer variable is constant, and the expansion type assignment of other local pointers variablees is put sky, obtains new Abstract State
and as the discharge state of function f
exit statement s ', as the follow-up statement of return statement s, then carries out 4.5;
4.5 by new Abstract State
original state with follow-up statement s '
obtain this program by union operation Join and put new Abstract State
carry out 4.6 steps; Union operation is: and if only if any two Abstract States
with
existence comprises while relation and could merge, otherwise two Abstract States are respectively as the element of union operation; Two heap memory Abstract States
with
there is relation of inclusion
and if only if: state
middle arbitrary element is at state
in; Union operation is shown by formula table:
4.6 by the heap Abstract State after merging
adopt the operated in saturation state that reaches capacity
operated in saturation concrete steps are as follows:
4.6.1 token variable modified is initialized as to vacation;
4.6.2 irreflexive operation: traversal Abstract State
in each pointer variable x
1, from
in by certain pointer field f
iroute distance is 0 the concentrated pointer x that deletes of pointer another name
1if certain pointer another name collection has been modified, and modified is set to very;
4.6.3 symmetry operation: traversal Abstract State
in each pointer variable x
2, from
in by certain pointer field f
iroute distance is concentrated certain pointer variable y that takes out arbitrarily of pointer another name of 0
2if,
in all f that pass through
iroute distance is that 0 pointer another name collection does not comprise x
2, by x
2join and pass through f
iroute distance is 0 pointer another name collection, if certain pointer another name collection has been modified, modified is set to very;
4.6.4 transmit operation: traversal Abstract State
in each pointer variable x
3, from
in by certain pointer field f
iroute distance is certain value d
1pointer another name concentrate and take out arbitrarily certain pointer variable y,
in by certain pointer field route distance for certain be worth d
2obtain pointer another name collection Q
2if, pointer another name collection Q
2in certain pointer variable z do not exist
in pass through f
iroute distance is d
1+ d
2pointer another name concentrate, z is joined
in pass through f
iroute distance is d
1+ d
2pointer another name concentrate, if certain pointer another name collection has been modified, modified is set to very;
4.6.5 judge the value of modified, false if, state
state reaches capacity
turn 4.7 steps; Otherwise turn 4.6.1 step;
If 4.7 state of saturation
with virgin state
difference, by state of saturation
as new virgin state
and by state of saturation
join in W with follow-up statement s ', turn 4.3;
The 5th step, carries out the memory leak detecting of interprocedual to heap operation program, method is:
5.1 acquisition process call statement e=f (e
1, e
2..., e
k) initialization information, invoked procedure is by name: f, formal parameter is: p
1, p
2..., p
k, actual parameter is: e
1, e
2..., e
k, wherein: p
hrepresent formal parameter, e
hfor p
hcorresponding actual parameter, 1≤h≤k, rreturn value is: ret
f, local pointers variables set is: LVar
f, global pointer variables set is: GVar
f, the heap memory Abstract State of carrying out before function call statement is
5.2 at heap memory Abstract State
the state transition of lower execution call statement, obtains the heap memory original state of called function
process is as follows:
5.2.1 by state
middle global pointer variables set GVar
fin arbitrarily the expansion type of global pointer variable g pass to invoked procedure, that is: state
middle g's
equal state
middle g's
5.2.2 by state
middle actual parameter e
h's
pass to formal parameter p
h, as called porch p
h's
that is: state
in
value be state
in
value;
5.2.3 state
middle local pointers variables set LVar
fin the expansion type of any local pointers variable l
be initialized as sky;
5.3 by function f and original state
as parameter, adopt the 4th step forward data flow alternative manner to carry out memory leak detecting in process to function f, obtain the new Abstract State of function exit heap memory
5.4 by heap memory state
pass to invoked procedure, obtain new Abstract State
in accordance with the following steps:
5.4.1 by state
the expansion type of pointer type rreturn value retf passes to invoked procedure, as state
the expansion type of lower pointer e;
5.4.2 state
the expansion type of middle global pointer variable g
constant while passing to invoked procedure, as state
lower g's
5.4.3 the expansion type of other local pointers variablees is constant before and after the invocation of procedure, that is: state
in the value of expansion type of other local pointers variablees be state
in the value of corresponding topical pointer variable expansion type;
The 6th step, statistics heap operation program internal memory leak detection result data:
6.1 according to the information about heap memory Abstract State in each program point on control flow graph, exports the heap memory Abstract State of entry statement and the heap memory Abstract State in exit of each program point;
6.2 according to the content of RAM leakage queue heapleakListF, and program statement s and the state of RAM leakage likely occurs in output
and add up the number of RAM leakage;
The possible RAM leakage mistake of 6.3 screening, counts the wrong report number of detection, and obtains rate of false alarm;
6.4 information during according to the operation of compiling platform and system, obtain the situation of method for detecting memory leakage consume system resources.
2. a kind of memory leakage detecting method towards heap operation program as claimed in claim 1, is characterized in that the pointer assignment statement of pre-service Plays form comprises 7 kinds: 1), pointer variable p is set to empty statement p=null; 2), by the pointer field p->f of pointer variable p
mbe set to empty statement p->f
m=null; 3), between pointer variable, copy statement p=q; 4), the copy statement p=q->f between the pointer field of pointer p and pointer q
m; 5), the copy statement p->f between the pointer field of pointer p and pointer q
m=q; 6), internal memory application statement p=malloc; 7), internal memory free statement free (p).
3. a kind of memory leakage detecting method towards heap operation program as claimed in claim 1, is characterized in that the transformation rule in described pre-service has 5 kinds, respectively: 1), introduce auxiliary pointer variable pt
0by shape as p->f
m=q->f
npointer assignment statement be converted to: pt
0=q->f
n; P->f
m=pt
0; 2), introduce auxiliary pointer variable pt
1by shape as p=p->f
mpointer assignment statement be converted to: pt
1=p->f
m; P=pt
1; 3), introduce auxiliary pointer variable pt
2by shape as p->f
mthe pointer assignment statement of=malloc is converted to: pt
2=malloc; P->f
m=pt
2; 4), introduce auxiliary pointer variable pt
3by shape as p=q->f
m->f
npointer assignment statement be converted to: pt
3=q->f
m; P=pt
3->f
n; 5), introduce auxiliary pointer variable pt
4by shape as free (p->f
m) internal memory free statement be converted to: pt
4=p->f
m; Free (pt
4).
4. a kind of memory leakage detecting method towards heap operation program as claimed in claim 1, is characterized in that described pointer another name collection comprises: the formal parameter in global pointer variable, local pointers variable, function with pointer type.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210041025.7A CN102662825B (en) | 2012-02-22 | 2012-02-22 | Method for detecting memory leakage of heap operational program |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210041025.7A CN102662825B (en) | 2012-02-22 | 2012-02-22 | Method for detecting memory leakage of heap operational program |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102662825A CN102662825A (en) | 2012-09-12 |
| CN102662825B true CN102662825B (en) | 2014-07-16 |
Family
ID=46772322
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210041025.7A Active CN102662825B (en) | 2012-02-22 | 2012-02-22 | Method for detecting memory leakage of heap operational program |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102662825B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3078154B1 (en) * | 2013-12-05 | 2018-09-19 | Koninklijke Philips N.V. | A computing device for iterative application of table networks |
| CN104750563B (en) * | 2013-12-26 | 2017-11-07 | 北京大学 | A kind of memory overflow self-repairing method based on controlling stream graph |
| CN103942077B (en) * | 2014-04-15 | 2018-06-15 | 清华大学 | A kind of driving resource reclaim analysis method |
| CN105302712A (en) * | 2014-07-17 | 2016-02-03 | 南京普爱射线影像设备有限公司 | Method for detecting C++ memory leakage |
| CN104636256B (en) * | 2015-02-17 | 2017-10-24 | 中国农业银行股份有限公司 | A kind of abnormal detection method and device of internal storage access |
| CN107992307B (en) * | 2017-12-11 | 2021-04-13 | 北京奇虎科技有限公司 | Function compiling method and device |
| CN109711167B (en) * | 2018-12-21 | 2020-08-18 | 华中科技大学 | UAF vulnerability defense method based on multi-level pointers |
| CN111694747B (en) * | 2020-06-17 | 2023-03-28 | 抖音视界有限公司 | Thread detection method, device, equipment and computer readable medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6658652B1 (en) * | 2000-06-08 | 2003-12-02 | International Business Machines Corporation | Method and system for shadow heap memory leak detection and other heap analysis in an object-oriented environment during real-time trace processing |
| CN101339533A (en) * | 2007-07-04 | 2009-01-07 | 国际商业机器公司 | Method and device for diagnosing Java system EMS memory leakage based on partition |
| CN101763305A (en) * | 2009-12-29 | 2010-06-30 | 青岛海信宽带多媒体技术有限公司 | Method for detecting memory leak of embedded system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7519867B2 (en) * | 2004-12-21 | 2009-04-14 | National Instruments Corporation | Test executive which provides heap validity checking and memory leak detection for user code modules |
-
2012
- 2012-02-22 CN CN201210041025.7A patent/CN102662825B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6658652B1 (en) * | 2000-06-08 | 2003-12-02 | International Business Machines Corporation | Method and system for shadow heap memory leak detection and other heap analysis in an object-oriented environment during real-time trace processing |
| CN101339533A (en) * | 2007-07-04 | 2009-01-07 | 国际商业机器公司 | Method and device for diagnosing Java system EMS memory leakage based on partition |
| CN101763305A (en) * | 2009-12-29 | 2010-06-30 | 青岛海信宽带多媒体技术有限公司 | Method for detecting memory leak of embedded system |
Non-Patent Citations (4)
| Title |
|---|
| Demand-Driven Memory Leak Detection Based on Flow- and Context-Sensitive Pointer Analysis;Ji Wang et al.;《JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY》;20090331;第24卷(第2期);全文 * |
| Ji Wang et al..Demand-Driven Memory Leak Detection Based on Flow- and Context-Sensitive Pointer Analysis.《JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY》.2009,第24卷(第2期),全文. |
| 基于指针映射集的动态内存故障测试方法研究;张威等;《计算机学报》;20091115;第32卷(第11期);全文 * |
| 张威等.基于指针映射集的动态内存故障测试方法研究.《计算机学报》.2009,第32卷(第11期),全文. |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102662825A (en) | 2012-09-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102662825B (en) | Method for detecting memory leakage of heap operational program | |
| US11036614B1 (en) | Data control-oriented smart contract static analysis method and system | |
| US10162610B2 (en) | Method and apparatus for migration of application source code | |
| Gosain et al. | Static analysis: A survey of techniques and tools | |
| Mei et al. | Data flow testing of service-oriented workflow applications | |
| CN102567200A (en) | Parallelization security hole detecting method based on function call graph | |
| CN103577168A (en) | Test case creation system and method | |
| He et al. | Pyart: Python api recommendation in real-time | |
| Nguyen et al. | Cross-language program slicing for dynamic web applications | |
| CN110059006B (en) | Code auditing method and device | |
| Heo et al. | Continuously reasoning about programs using differential bayesian inference | |
| Rohatgi et al. | An approach for mapping features to code based on static and dynamic analysis | |
| Shepperd | An evaluation of software product metrics | |
| Giachino et al. | Deadlock detection in linear recursive programs | |
| Ortin et al. | Cnerator: A Python application for the controlled stochastic generation of standard C source code | |
| US11662998B2 (en) | Detecting duplicated code patterns in visual programming language code instances | |
| Romanov et al. | Representing programs with dependency and function call graphs for learning hierarchical embeddings | |
| CN114691197A (en) | Code analysis method and device, electronic equipment and storage medium | |
| Wang et al. | Anchor: Fast and Precise Value-Flow Analysis for Containers via Memory Orientation | |
| CN114880673A (en) | Method and system for detecting private data leakage aiming at applet source code | |
| Srinivasan | Improving constraint-based test input generation using Korat | |
| CN117555811B (en) | Embedded software analysis method, device and storage medium based on static symbol execution | |
| Zheng et al. | FQL: An extensible feature query language and toolkit on searching software characteristics for HPC applications | |
| Singh et al. | Design and implementation of testing tool for code smell rectification using c-mean algorithm | |
| Zhang et al. | Propositional projection temporal logic specification mining |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |