CN109144882A

CN109144882A - A kind of software fault positioning method and device based on program invariants

Info

Publication number: CN109144882A
Application number: CN201811096080.XA
Authority: CN
Inventors: 王甜甜; 许家欢; 王克朝; 苏小红
Original assignee: Harbin Institute of Technology
Current assignee: Harbin Institute of Technology
Priority date: 2018-09-19
Filing date: 2018-09-19
Publication date: 2019-01-04
Anticipated expiration: 2038-09-19
Also published as: CN109144882B

Abstract

The invention discloses a kind of software fault positioning method of program invariants and devices.This method comprises: carrying out the pitching pile of sentence, value and logical expression grade for target software source code, the source code after pitching pile is executed using preset test case set obtains execution information；Default failure testing use-case set is clustered, and to each cluster, selection helps to distinguish the successful test case set of defect sentence；The execution information of the preferred success test case set of study, obtains program invariants set, including assembly type, true value phenotype and floating type range invariant；It is violated according to the execution information of failure testing use-case set and program invariants set detection invariant, obtains suspicious sentence set.Invariant caused by being filtered out using dependency analysis because of fault propagation violates erroneous detection, statisticallys analyze the invariant at each sentence and violates, the suspicious degree of computing statement.The present invention improves the accuracy of software fault positioning, overcomes logical expression defect location missing inspection problem.

Description

A kind of software fault positioning method and device based on program invariants

Technical field

The present invention relates to computer software technical field, in particular to a kind of software fault positioning based on program invariants Method and device.

Background technique

Usually include software defect in software systems, reduces the reliability, availability and safety of software systems.It repairs One top priority of positive defect is to identify the position of the relevant program element of defect, and then programmer can be according to suspect program Element position and its program context modify program to corrective pitting.However the process is very time-consuming and laborious.Software debugging Even account for the 80% of entire software overhead.Therefore the software fault positioning method of automation is needed.

Other than directly providing and supporting for software developer, automated software location of mistake technology also be used to automate Correction program in.Suspicious program statement is identified before amendment, to instruct amendment tool to generate patch, reduces patch Search space.Therefore, the accuracy of automatic positioning directly affects the validity of amendment tool.

Therefore the validity for how improving fault location technology becomes current research hotspot.Existing research proposes more Kind Fault Locating Method, these methods respectively have advantage and disadvantage, and there presently does not exist better than other methodical fault location technology of institute.

The basic thought of Fault Locating Method based on program invariants is: using successfully test case training program first Then constant duration set executes failure testing use-case, detects it and violate to program invariants set, be added into candidate collection In, as possible defective locations, the reason of as leading to the failure.The advantages of this method is to utilize successfully test case Acquistion to invariant facilitate analyze software expected behavior and attribute.

However this method difficulties is the program attribute how to need in automatic identification fault location, i.e., how Program invariants are defined, unsuitable invariant will lead to missing inspection or erroneous detection.Another difficulties is that this method uses test The quality requirement of example is higher, and there are the balances between erroneous detection and missing inspection.If the invariant of study is excessively wide in range, may make Really failure producing cause is not incorporated into invariant and violates in candidate collection, leads to defective locations missing inspection；If study Invariant it is narrow (missing out certain invariants), then may cause a large amount of erroneous detections, the production of software failure can not be accurately positioned It takes root source.

Summary of the invention

In view of the above problems, it proposes on the present invention overcomes the above problem or at least be partially solved in order to provide one kind State the software fault positioning method based on program invariants, device, electronic equipment and the computer readable storage medium of problem.

One embodiment of the present of invention provides a kind of software fault positioning method based on program invariants, comprising:

Abstract syntax tree is established for the source code of target software, according to the abstract syntax tree to the target software Source code carries out the other pitching pile of statement level, is worth the pitching pile of rank and the pitching pile of logical expression rank, is successfully surveyed using preset Example set on probation and preset failure testing use-case set execute the source code of the target software after pitching pile, obtain each survey The execution information of example on probation, comprising: sentence coverage information, the value of variable and expression formula and logical expression truth table；

Clustering is carried out to the default failure testing use-case set, standard is preferentially selected according to unsuccessfully covering equivalent partition Then default success test use cases conjunction is screened, obtains preferred success test case set；

The execution information for learning the preferred success test case set, obtains program invariants set, described program is not It include set type A semigroup, floating type range invariant and truth table type A semigroup in variables collection；

Invariant is carried out according to the execution information of the failure testing use-case set and the constant duration set of described program to violate Detection, obtains suspicious sentence set.

Optionally, before the preferred success test case set of the acquisition, the method also includes:

Inevitable coincidence test case is rejected from the success test case.

Optionally, the method also includes:

According to the sentence covering of the sentence coverage information of preset success test case set and failure testing use-case set The sentence that information acquisition is only covered by failure testing use-case, by the sentence only covered by failure testing use-case be added described in can Doubt sentence set；

According to the logical expression truth table and failure testing use-case set of the preset success test case set Logical expression truth table obtains forever true and/or false predicate forever, by described forever true and/or forever institute is added in the sentence where false predicate State suspicious sentence set.

Optionally, after obtaining suspicious sentence set, the method also includes:

The assignment statement and its directly control dependence sentence addition institute that invariant is violated will be generated using definite value analysis is reached State suspicious sentence set；

Invariant violates erroneous detection caused by being filtered out from the suspicious sentence set because of fault propagation using dependency analysis Suspicious sentence.

Optionally, described that the assignment statement and its directly control dependence that invariant is violated will be generated using the analysis of arrival definite value The suspicious sentence set is added in sentence, comprising:

The target software is parsed, the controlling stream graph of the target software is created；

The controlling stream graph is traversed, is solved using iterative algorithm using data-flow equations and reaches fixed value information；

Determine that each invariant of generation in the suspicious sentence set violates sentence according to the arrival fixed value information Assignment statement and its directly control dependence sentence；

The each invariant of generation is violated the assignment statement of sentence and its directly controlled can described in dependence sentence addition Doubt sentence set.

Optionally, the use dependency analysis is constant caused by filtering out from the suspicious sentence set because of fault propagation Amount violates the suspicious sentence of erroneous detection, comprising:

The target software is parsed, the data dependence graph of the target software is obtained；

The invariant of the sentence node of each failure testing use-case is marked to violate information in the data dependence graph；

It is violated according to the invariant constant caused by information is filtered out from the suspicious sentence set because of fault propagation Amount violates the determining suspicious sentence of detection.

Optionally, after obtaining suspicious sentence set, the method also includes:

The invariant that each failure testing use-case generates is statisticallyd analyze to violate, calculate it is each in the suspicious sentence set can The suspicious degree of sentence is doubted, and each suspicious sentence is ranked up according to the suspicious degree of each suspicious sentence.

Optionally, the suspicious degree for calculating each suspicious sentence in the suspicious sentence set, comprising:

The suspicious degree of each suspicious sentence in suspicious sentence set is calculated according to the following formula:

Wherein, Sus_Inv (s_i) it is suspicious sentence s_iSuspicious degree；TS is the preset success test case set, | TF | for the sum of test case in the preset failure testing use-case set；v_iIt is i-th of node in data dependence graph, Tf is failure testing use-case, confidence (v_i, tf, TS) and it is v_iNode executes failure testing use-case tf generation invariant and violates Confidence level；If v_iIt is the failure producing cause determined in dependency analysis, then confidence (v₁, tf, TS)=1, otherwise confidence(v_i, tf, TS) and=0.1,2≤i≤k.

The software fault positioning device based on program invariants that another embodiment of the present invention provides a kind of, comprising:

Source code pitching pile unit establishes abstract syntax tree for the source code for target software, according to the abstract language Method tree carries out inserting for the other pitching pile of statement level, the pitching pile for being worth rank and logical expression rank to the source code of the target software Stake, the target software after pitching pile is executed using preset success test case set and preset failure testing use-case set Source code, obtain the execution information of each test case, comprising: obtain sentence coverage information, variable and expression formula value and Logical expression truth table；

Test case set processing unit, for carrying out clustering to the failure testing use-case set, according to failure The covering preferential selection criterion of equivalent partition screens the success test case set, obtains preferred success test use cases It closes；

Constant duration set acquiring unit obtains program invariants collection for learning the preferred success test case set It closes, includes set type A semigroup, floating type range invariant and truth table type A semigroup in the constant duration set of described program；

Suspicious sentence set acquiring unit, it is constant according to the execution information of the failure testing use-case set and described program Duration set carries out invariant and violates detection, obtains suspicious sentence set.

Another embodiment of the present invention provides a kind of electronic equipment, electronic equipment includes memory and processor, storage By internal bus communication connection between device and processor, memory is stored with the program instruction that can be executed by processor, journey Sequence instruction can be realized above-mentioned method when being executed by processor.

Another embodiment of the present invention provides a kind of computer readable storage medium, computer-readable recording medium storages Computer instruction, computer instruction make to execute the above method on the computer.

The solution have the advantages that the present invention carries out the other pitching pile of statement level, value grade for the source code of target software The pitching pile of other pitching pile and logical expression rank, the source of the target software after pitching pile is executed using preset test case set Code obtains the execution information of each test case, comprising: the value and logical expression of sentence coverage information, variable and expression formula Formula truth table；Clustering is carried out to default failure testing use-case set, obtains preferred success test case set；Study is preferred The execution information of success test case set, acquisition program invariants set, including set type A semigroup, floating type range are constant Amount and truth table type A semigroup；Invariant is carried out according to the execution information of failure testing use-case set and program invariants set to disobey Back detection, obtains suspicious sentence set.It is filtered out from the suspicious sentence set because fault propagation causes using dependency analysis Invariant violate erroneous detection, statistically analyze the invariant at each sentence on this basis and violate, the suspicious degree of computing statement.The present invention The problem of improving the accuracy that software fault positions, overcoming logical expression defect location missing inspection.

Detailed description of the invention

Fig. 1 is the flow diagram of the software fault positioning method based on program invariants of one embodiment of the invention；

Fig. 2 is the schematic diagram of the software fault positioning method based on program invariants of another embodiment of the present invention；

Fig. 3 is the structural schematic diagram of the software fault positioning device based on program invariants of one embodiment of the invention；

Fig. 4 is the structural schematic diagram of the electronic equipment of one embodiment of the invention.

Specific embodiment

To make the object, technical solutions and advantages of the present invention clearer, below in conjunction with attached drawing to embodiment party of the present invention Formula is described in further detail.

Program invariants type, the quality of test case, error propagation can all influence the validity of fault location, need These influence factors are comprehensively considered in position fixing process.Further analysis especially is needed there are still following problems and is solved.

(1) program attribute how to need in automatic identification fault location, making it not only has lower computation complexity, but also It can guarantee the validity of fault location?

(2) test case set how is selected, its one side is reduced by the complexity of invariant, on the other hand improves The validity of positioning?

(3) how to consider that its subsequent sentence is held in error condition propagation, the execution of mistake sentence in position fixing process On the one hand the influence of row state positions suspicious assignment statement, reduce missing inspection, and on the other hand, removal is led because of error condition propagation The erroneous detection of cause?

Fig. 1 is the flow diagram of the software fault positioning method based on program invariants of one embodiment of the invention. As shown in Figure 1, the method for the embodiment of the present invention includes:

S11: establishing abstract syntax tree for the source code of target software, soft to the target according to the abstract syntax tree The source code of part carries out the other pitching pile of statement level, is worth the pitching pile of rank and the pitching pile of logical expression rank, using it is preset at Function test case set and preset failure testing use-case set execute the source code of the target software after pitching pile, obtain each The execution information of a test case, comprising: sentence coverage information, the value of variable and expression formula and logical expression truth table；

It should be noted that the value of variable and expression formula includes the value of variate-value and expression formula.

The abstract syntax tree of program fully illustrates that the syntactic structure of program, the structure of tree are inserted into probe language convenient for executing Sentence, and source code is generated convenient for reversed, therefore inserted based on abstract syntax tree.

Test case will preferably use the execution path information of program, invariant will use variate-value and logical expression Formula truth table information, therefore on the basis of the expression of the abstract syntax tree of program, execute the pitching pile of three kinds of granularities.

(1) the other pitching pile of statement level: being inserted into probe sentence at every sentence, when executing program for collecting test case The sentence line number of covering.

(2) pitching pile of value rank: being inserted into probe sentence to expression formula, executes in program process for collecting test use cases Variable value, and its corresponding invariant type is recorded according to variable and type of expression.

(3) pitching pile of logical expression rank: being inserted into probe sentence to logical expression, executes for collecting test case The truth table of logical expression in program process records its corresponding invariant type.

Specifically, steps are as follows for program pitching pile:

Morphological analysis and syntactic analysis are carried out to source code, establish abstract syntax tree, while recording in source file every Line number where sentence.

The single assignment of static state that equivalent form is first converted into for negative effect expression formula.Such as: return sentence returns to one Expression formula, compound logical expression are converted into for expression formula being assigned to the form of temporary variable.

Ergodic abstract syntax tree, identification need to be inserted into the position of probe sentence, and output phase is inserted into abstract syntax tree Answer the node of line number.

Statement level pitching pile: for all executable statements, the probe sentence of insertion output line number；

If it is assignment statement etc., performance variable value grade pitching pile: variable name is then obtained by syntax tree, by searching for symbol Table obtains types of variables.It is inserted into probe sentence, exports its lvalue.

If it is logical expression, then logical expression grade pitching pile is executed: right according to the depth-first order traversal subtree Each subexpression is inserted into probe sentence, the value of subexpression is exported, until all node visits of the tree finish, in this way rear The logical expression can be obtained by a true value sequence in continuous implementation procedure.

Insertion defines output file flow variables, opens file stream and closes the sentence of file stream, so that execution information is defeated Out into file.Abstract syntax tree is reversely generated to corresponding source code, the program after pitching pile can be obtained.

Then the program after pitching pile is executed with test case, so that it may collect and store execution information when program is run.

S12: carrying out clustering to the default failure testing use-case set, is preferentially selected according to unsuccessfully covering equivalent partition It selects criterion to screen default success test use cases conjunction, obtains preferred success test case set；

S13: the execution information of the study preferred success test case set obtains program invariants set, the journey It include set type A semigroup, floating type range invariant and truth table type A semigroup in the constant duration set of sequence；

Program invariants are the formula or rule of constant satisfaction in program source code.When executing program with different input When, invariant remains unchanged.

Carrot and Savant derives all invariant modes predetermined that can be able to satisfy based on Daikon, calculates multiple Miscellaneous degree is high, and some invariants may be it is unrelated with fault location, in addition, it is difficult to which relevant journey is flowed in abundant representation program control Sequence invariant.

Software defect often will affect the value of variable and expression formula in program, therefore pass through comparison successful execution and failure The difference of the value of variable in execution and expression formula helps to position defect.

Invariant in DIDUCE indicates and the value range invariant of Sahoo et al. proposition is constant relative to Daikon derivation There is lower complexity, but the invariant form provided does not account for control and flows relevant logic invariant for amount, therefore It is difficult to positioning logic expression formula defect, and indicates the range of integer with range format, is easy to cause missing inspection.

Therefore, the embodiment of the present invention improves the invariant representation of Sahoo et al. proposition, situational variables and expression formula The case where implementation procedure intermediate value, and according to variable and type of expression, it is defined as follows the invariant representation of three kinds of forms.

Floating type range invariant: for given successful test case set TS, the expression of the floating type on program point p The program invariants of formula e are denoted as Inv (p, e, TS)=[a, b]

And if only if meeting the following conditions (iff):

Wherein, when value (e, ts) indicates to execute program with test case ts, the value of expression formula e.

That is, the program of the expression formula e of the floating type on program point p is constant for given successful test case set TS Amount is that all success test cases learn to obtain the value interval range of e in its operation TS, and a and b are executed with some test case What e was obtained, a is the lower bound in section, and b is the upper bound in section.

Floating type range invariant captures the value information of floating type program variable and expression formula.Such as double f；With The range invariant for the f that success test case learns is [1.1,5.7].

In order to which effective position divisor is 0 defect, whether special record there is absolute value close to 0 floating point expression formula value. It is defined as follows:

If

Inv (p, e, TS)=[a, b]+[0,0]

Otherwise,

Inv (p, e, TS)=[a, b]

Floating type range invariant is suitable for analyzing array index the defects of crossing the border, can also be with by the surface analysis of value Position the other class defects having an impact to variable and transition formula evaluation indirectly to a certain extent.

Gather type A semigroup: integer, character type, character for given successful test case set TS, on program point p Go here and there (character array or character pointer) type expression formula e program invariants be denoted as Inv (p, e, TS)=value (e, ts) | ts∈TS}.When wherein value (e, ts) indicates to execute program with test case ts, the value of expression formula e.

That is integer, character type, character string, invariant are the discrete value set in its implementation procedure, in this way can be to avoid Invariant range is excessively wide in range, helps to reduce invariant and violates missing inspection in detection process.

Truth table type A semigroup: many condition logical expression for given successful test case set TS, on program point p The program invariants of formula e are denoted as, and Inv (p, e, TS)=(Inv (p, e1, ts), Inv (p, e2, ts), value (e, ts)) | e1, E2 is the subexpression of e }.When wherein value (e, ts) indicates to execute program with test case ts, the value of expression formula e.

That is the invariant form of the logical expression truth table that constitutes of value that is its each subexpression and its expression formula. If e1, e2 also include subexpression, truth table is made of its subexpression true value.

S14: invariant is carried out according to the execution information of the failure testing use-case set and the constant duration set of described program Detection is violated, suspicious sentence set is obtained.

The invariant that specific program point in program is obtained with success test use cases study, then detects failure testing use-case Execution information, determine whether it meets invariant, if conditions are not met, then claiming to produce invariant and violate.

It defines (invariant is violated): for given successful test case set TS, expression formula e on program point p, for Failure testing use-case tf, ifThen claim expression formula e of the tf at program point p, produces Invariant is violated.Then program point p is suspect program point.

Table 1 gives truth table type A semigroup example.Symbol ⊥ representation program calculates truncation in table, i.e., in calculating logic table When up to formula, when the value of front portion expression formula is true, no longer calculating rear portion expression formula result.Assuming that corrected form is Z=x&&y, and its mistake is written as z=x in program | | y.During fault location, by being learnt with success use-case, obtain Logical expression invariant is { 000,1 ⊥ 1 }, and not appear in this constant for the true value sequence 011 that failure use-case (1,0) executes In duration set, therefore invariant has occurred and violates, so as to position the logical expression mistake.

1 truth table type A semigroup example of table

With the formal definition logical expression invariant of truth table, it is contemplated that the composed structure of the expression formula of program avoids Simple value range analysis for logical expression can only obtain fixed 0 or 1 value, it is difficult to positioning logic expression formula phase The problem of closing defect.Floating type range invariant or discrete type then are used according to type expression for the expression formula of single condition Invariant is analyzed.

The embodiment of the present invention does not derive the expression formula that can be able to satisfy between variable, but analyzes it to reduce complexity Variable and the case where transition formula evaluation in implementation procedure.It, will according to variable and type of expression in order to improve the accuracy of positioning Program invariants are defined as floating type range invariant, set type A semigroup and truth table type A semigroup, and pass through value and logic The program pitching pile of expression formula rank obtains each test case and executes corresponding variable and transition formula evaluation when program, so using at The execution information study of function test case generates invariant.The execution state value of first two invariant variable, it is fixed to facilitate Position software defect relevant with data, latter analyze logical expression, facilitate positioning defect relevant with predicate.It solves The problem of existing method is difficult to analyze branch condition expression formula, leads to logical expression defect location missing inspection.

In a kind of optional embodiment of the embodiment of the present invention, the preferred success test case set of the acquisition it Before, the method also includes:

Inevitable coincidence test case is rejected from the success test case.

In order to reduce erroneous detection and the missing inspection that invariant violates detection, the validity of fault location is improved, it is excellent in test case Influence of the failure execution route to fault location is fully considered during choosing, steps are as follows:

(1) failure testing use-case clusters: hierarchical clustering is used, by the failure testing use-case with similar sentence coverage information Gather in same class.It is analyzed every time for a failure testing use-case cluster.

(2) it removes the correct test case of " certainty " coincidence: sentence covering is covered with any failure testing use-case sentence Identical success test case, is labeled as the correct test case of " certainty " coincidence, it is deleted from success test case set It removes.

(3) success test case preferably similar with failure execution route, and filtering out as far as possible in preferred process " can Can " the correct test case of coincidence.Using multiple criteria optimal inspection use-case preferred method [i], according to " unsuccessfully covering vector is similar Spend priority ordering " criterion, it assigns execution route success test case similar with failure execution route to higher priority, makes It is more related to failure testing use-case to obtain the constant duration set that subsequent study generates, reduces invariant and violates detection erroneous detection and leakage Inspection；Then according to " unsuccessfully covering equivalent partition optimum choice " criterion, selection can be distinguished to the full extent and unsuccessfully execute language The minimum success test case set of sentence, avoids the invariant range of study excessively wide in range, and helping, which reduces invariant, violates leakage Inspection.

Further, the method also includes:

If a program statement only occurs in failed path, without being covered by any success test case, the language Sentence is likely to the suspicious sentence to lead to the failure.For example, increasing redundancy in correct program code originally leads to journey The execution logic error of sequence, or generate the calculated result of mistake.

The sentence only covered by failure testing use-case: for given successful test case set TS, failure testing use-case Sentence s on set TF, program point p, ifAndThen s be only by The suspicious sentence of failure testing use-case covering.

In this case, invariant is obtained without calligraphy learning by success test case, it is even more impossible to detect that invariant is violated, because This needs the sentence coverage information according to test case, identifies this suspicious sentence.

Predicate decision condition in program is made different branches different respectively commonly used in distinguishing different situations Processing.If certain predicate decision conditions are forever true or forever false, this, which might mean that in program, contains in all execution of program Certain defects cause predicate to determine failure.In this case, although failure testing use-case does not violate successfully test case study Obtained invariant, but the sentence and its correlative are still suspicious sentence.Therefore need specific identification this forever true and/or False predicate forever.

Forever true and/or false predicate forever: for given successful test case set TS, failure testing use-case set TF, journey Condition criterion predicate expressions e on sequence point p, ifandThen e is true predicate forever.IfandThen e is false predicate forever.

The sentence coverage information collected in each test case implementation procedure is inputted, test case is then respectively created successfully Sentence set covering theory and failure testing use-case sentence set covering theory.The two matrixes are scanned, it is checked for every sentence The sentence of the sentence covering vector sum failure testing use-case of success test case covers vector, by success test case sentence covering Vector element is 0, and failure testing use-case covering vector element is not all 0 sentence as suspicious sentence, and Candidate Set is added It closes.

The true value for statisticalling analyze each condition criterion predicate will execute all success test cases and all failure testings Use-case true value is that the condition criterion predicate recognition of true (or being vacation) is suspicious sentence, is added in candidate collection.

Further, after obtaining suspicious sentence set, the method also includes:

Suspicious sentence usually exist in the execution route of failure testing use-case.In order to reduce the complexity of invariant solution Degree, only the sentence of analysis failure use-case covering, generates program invariants with preferred success test case set study.

The execution information of each success test case is preferably concentrated in parsing, is believed according to the variable and expression formula recorded in advance Breath, statistics generate the invariant of three types.

(1) for gathering type A semigroup, then according to sentence position and corresponding variate-value, with the form of union by variable Discrete value is added in constant duration set.

(2) for floating type range invariant, then according to sentence position and corresponding variate-value, the change of corresponding position is updated Magnitude range.

(3) for truth table type A semigroup, then using the form of union, logical expression is corresponding according to sentence position True value sequence be added in constant duration set.

The execution information file (format is with success test case) for parsing each failure testing use-case, at each position Variable and the corresponding invariant type of expression formula determine to be obtained before whether its value meets with preferred success test use cases study The program invariants obtained.

(1) for assembly type variable, then according to sentence position and variable ID, determine whether its value appears in numeric type set In invariant.

(2) for floating type variable, then according to sentence position and variable ID, determine whether its value meets in numeric type range Within the bound of invariant.

(3) for logical type expression formula, then according to sentence position, determine whether its true value sequence appears in corresponding logic In expression formula truth table.

For determining above, if result be it is no, claim the code line where variable or expression formula to generate invariant and violate, The code line is known as suspect code row.

Further, it is described using reach definite value analysis will generate the assignment statement violated of invariant and its directly control according to Rely sentence that the suspicious sentence set is added, comprising:

Error condition can along failure execution route propagate, the embodiment of the present invention pass through anolytic sentence between data dependence and Dependence, influencing each other between anolytic sentence and the propagation path of failure are controlled, to improve the validity of positioning.One side Face, using variable definite value relationship analysis, positioning is difficult to the variable assignments class defect for being had method and navigating to.On the other hand, wrong Accidentally state propagation, which will lead to, is not unsuccessfully that the sentence of root is identified as suspicious sentence largely, therefore is filtered using dependency analysis Fall such erroneous detection.

For the suspicious degree of quantitative computing statement, is violated for invariant and define confidence level, violated for measuring invariant A possibility that being unsuccessfully root.

Value shaped like constant assignment statement as var=1 in success test case with variable in failure testing use-case It is fixed constant value, therefore can not detect that invariant is violated at the sentence；And it usually successful use-case and unsuccessfully uses Example is performed both by this assignment statement, therefore is also difficult to by the methods of program spectrum effective position.

However if var=1 is to var definite value mistake (for example, correctly value should be 0 to var), subsequent reference var Sentence can all be affected by it, may detect that invariant is violated at the subsequent sentence.

For the generation root of effective position failure, this constant assignment mistake of missing inspection is avoided, is detecting that generation is constant After measuring the suspicious sentence violated, analyzed using arrival-definite value, by definite value sentence (assignment or the return language of variable in the sentence Sentence), it is considered as suspicious sentence, is set as very so that the invariant of the sentence is violated attribute, is that the generation of failure is former by it The confidence level of cause is defined as 1.

It reaches definite value analysis (Reaching Definitions): being directed to each program point, which change in program analyzed Which definite value of amount may reach the program point by a certain Program path.Controlling stream graph is traversed, number is utilized using iterative algorithm It is solved according to flow equation and reaches fixed value information.

Control relies on: being determined if whether node vj executes by the predicate of node vi, claims vj control dependent on vi or vi There are a control dependence edge between vj, it is denoted as

Definite value: vi definite value variable x refers to the execution due to vi so that the internal storage location of x has been rewritten once.It is denoted as

The definite value of variable x is a sentence, its assignment or may be assigned to x.Most common definite value is the assignment or reading to x The sentence being worth in x.

Reference: if having used the variable x of vi definite value as operand in the expression formula of vj, vj is claimed to refer to vi definite value Variable x.

Reach: the definite value vi of variable x reaches vj, and and if only if there are an execution routes from vi to vj, and variable x does not have Have in the path by revaluation.

In order to reduce the complexity of analysis and avoid introducing redundancy, the embodiment of the present invention uses 1 step Reverse Turning Control Rely on and reach definite value analysis.Directly control dependence sentence and its definite value sentence that invariant is violated will only be generated and be added to candidate In set.

The mistake of one sentence may influence whether program state, and continuing to execute with program, the program being affected State may be further propagated.That is, the changed position of the execution route of program, not necessarily really leads The sentence of mistake is caused, and may be the mistake of other sentences, is constantly propagated by program state, the execution road until leading to program Diameter changes.

If a strip defect sentence is the root to lead to the failure, other sentences of the error value of sentence generation are quoted There may be invariants to violate.Based on the heuristic information, propose to analyze mistake based on the fault propagation analysis method being reversely sliced The propagation path of state, invariant violates erroneous detection caused by filtering out because of fault propagation.It is defined on the basis of data dependence graph Data dependence path and error propagation data flow path with invariant label.

In order to reduce complexity, complete dynamic routine dependency graph is not created, and uses the base in static data dependency graph The mode inquired on demand on plinth, analysis invariant violate between data dependence relation.

Data dependence graph: the data dependence graph DDG=(V, E) of program P is a digraph.Wherein, V is node set, Sentence and predicate in representation program；It is line set, indicates the data dependence relation between node.

Data dependence: the path for reaching from node v1 node v2 if there is one, and there are one in v2 definite value and The variable quoted in v1, and the variable is other Anywhere not by revaluation on the path from v1 to v2, then claims v2 number According to depending between v1 or v1 and v2 there are a data stream side, it is denoted as

Data dependence path with invariant label: the given data with invariant label for executing failure testing use-case tf Independent path is that wherein IDDG (tf)=(V, I, E), V are node sets to a digraph, sentence and meaning in representation program Word；I is the attribute set of node, when executing tf for recording, the covering and invariant information of each node；It is side Set indicates the data dependence relation between node.

Wherein the attribute of each node is a triple (COV, INV, VIO), is defined as follows:

Failure executes the sentence node of covering: its COV attribute=T if failure testing use-case performs the sentence, no Then COV attribute=F；

Success use-case has learnt the node of invariant: if having learnt invariant INV attribute=T with success use-case, otherwise INV attribute=F；

Generate the node violated of invariant: if generating invariant violates VIO attribute=T, otherwise VIO attribute=F.

Error propagation data flow path: for failure testing use-case tf, it is assumed thatIt is Data flow path in IDDG, if (1) v_i.COV=T1≤v_i≤ k, i.e., the node v on path_iBy failure testing use-case tf It executes；(2)v₁.INV=T, v_k.INV=T, i.e. v₁And v_kInvariant is generated to violate；(3) k=1 or2 < i < k, v_iAnd v .INV=T_i.VIO=F, i.e., any node for not generating the successful invariant violated is not included in data flow path, thenIt is an error propagation data flow path.

In order to effective evaluation invariant violate whether be failure producing cause, violate for each invariant and be assigned to confidence level The each node of value is that the confidence level of the producing cause of failure is defined as follows:

confidence(v₁, tf, TS)=1

confidence(v_i, tf, TS) and=0.1,2≤i≤k

That is v₁Confidence level with higher is Trouble cause, and the invariant of other positions is disobeyed in the data flow path It may be to be that the confidence level of defect is lower, assigned since error condition is caused by traffic propagation that back, which has biggish, Giving lower confidence level helps to reduce the erroneous detection that invariant violates detection.

It is a fault propagation data flow path, wherein s₁It is unsuccessfully that its confidence level of root is 1, and s₂、s₇It is to cause invariant to be violated because error condition is set along traffic propagation, reliability 0.1.

IfData flow path on,1 < i < k v_i.INV=T and v_i.VIO=F, that is, there is the node for not generating the successful invariant violated, then confidence (v_i+1, tf, TS)=1.This is Based on the principle for trusting successfully invariant, if a sentence includes successful invariant, it assumes that it will not generate the value of mistake, It may be an independent error source if therefore generating invariant dependent on the subsequent sentence of the sentence to violate.

When the invariant for analyzing different failure testing use-case generations is violated, it is not required to repeat to create data dependence graph and mark Remember the invariant information of successfully use-case study, only need to violate information according to the invariant that new failure testing use-case generates, again Execute (3) step.

It is proposed the test case preferred method of consideration failed path, in order to reduce interfering with each other between a variety of failures, first According to execution route similarity cluster failure testing use-case, may the failure testing use-case as caused by same cause gather same In a class, then for each failure use-case cluster difference test case chosen successfully, selection and failure use-case execution route phase As test use cases and avoid the selection correct test case of coincidence, thus constriction invariant range, to reduce missing inspection.Benefit Missing inspection and the erroneous detection of fault location are reduced with program dependency analysis.On the one hand, the definite value for reaching definite value analysis identification variable is utilized Sentence identifies assignment statement defect, reduces missing inspection；On the other hand the Error Propagation Analysis method based on dependence, using dynamic with Track information, analyzes the propagation path of mistake, and then filters out the erroneous detection that the invariant as caused by error propagation is violated.

Preferably, after obtaining suspicious sentence set, the method also includes:

The embodiment of the present invention sorts suspicious sentence, improves detection efficiency.

As shown in Fig. 2, the software fault positioning method key step based on program invariants of the embodiment of the present invention is as follows:

The first step, analysis source code, and collect execution information.

In order to obtain the execution information of program, pitching pile program on the basis of abstract syntax tree.Guaranteeing patrolling for original program Volume and function it is constant on the basis of, point three kinds of granularity pitching pile probe sentences are respectively used to subsequent obtain in program process Sentence covering, variable expression value, logical expression truth table information.

Second step, two classes of identification are difficult to violate the suspicious sentence of positioning with invariant.

Sentence coverage information is parsed, identifies the sentence only unsuccessfully covered；Parsing and logical expression truth table and detection Forever true/false predicate forever.

Third step and the unrelated successful use-case of failure testing use-case can position invariant and violate detection and generate interference.Example Such as, if successfully test case is more, at Defective program sentence, then it is excessively wide to may cause study acquisition invariant range It is general, cause invariant to violate the missing inspection of detection.And at other correct sentences, then it may learn to obtain and currently fail unrelated Invariant causes invariant to violate the erroneous detection of detection.

In addition, success test case is concentrated, there is likely to be the correct test cases of coincidence.The correct test case of coincidence There may be the states of mistake in the implementation procedure of program, but be not transmitted to it is last as a result, so if with Invariant is generated in study, the constant duration set of generation error is may cause, and then influence subsequent position fixing process, both may cause The erroneous detection that invariant violates detection may also lead to missing inspection.

Therefore, the embodiment of the present invention proposes to consider the test case preferred method of failed path.First according to execution sentence Coverage information clusters the failure testing use-case with similar execution route, avoids interfering with each other between a variety of different failures.So It is afterwards each failure use-case cluster, deletes the correct test case of coincidence, preferentially selection success similar with failure execution route Test case.

4th step learns constant duration set using preferred success test case.The embodiment of the present invention is fixed in reduction failure Validity is improved while the complexity of position, according to the type of each program expression, defines the invariant of three types, not only It supports positioning and is worth relevant defect, also support to position defect relevant with programmed logic.

5th step, detection invariant are violated.

For the constant duration set that study obtains, detect whether value of the failure testing use-case at corresponding program point meets Invariant is added in candidate collection if conditions are not met, then violating invariant, which is labeled as suspicious sentence position.

6th step analyzes missing inspection and the erroneous detection for reducing invariant and violating detection using fault propagation.

The defect of assignment statement constant variation class is difficult to navigate to, because of this sentence value when being executed and execution route It is constant for success and failure testing use-case.However, since the program state of mistake can be executed in failure testing use-case Along the control of program and the propagation of data independent path and the assignment statement, there are the subsequent sentences of dependence to execute in journey Invariant, which may be shown, when failure use-case violates behavior, it is further to identify assignment statement defect by reaching definite value analysis, Reduce missing inspection.

The propagation of another aspect error condition will lead to invariant and violate detection generation erroneous detection.If a strip defect sentence is to lead The root for causing failure, the then other sentences for quoting the error value of sentence generation may also generate invariant and violate.It is this subsequent Invariant violate be not failure root, they only because mistake value by subsequent calculatings propagation caused by. Based on the heuristic information, the propagation path of mistake is analyzed, and then filters out the erroneous detection that the invariant as caused by fault propagation is violated.

7th step, statistics, which calculates, occurs the suspicious degree of program point that invariant is violated, and by suspicious degree from high to low suitable Sequence is ranked up, and exports suspicious sentence list and its invariant violates information.

Fig. 3 is the structural schematic diagram of the software fault positioning device based on program invariants of one embodiment of the invention. The device of the embodiment includes:

Source code pitching pile unit 31 establishes abstract syntax tree for the source code for target software, according to described abstract Syntax tree carries out the other pitching pile of statement level, the pitching pile for being worth rank and logical expression rank to the source code of the target software Pitching pile, the target after pitching pile is executed using preset success test case set and preset failure testing use-case set are soft The source code of part obtains the execution information of each test case, comprising: obtains the value of sentence coverage information, variable and expression formula With logical expression truth table；

Test case set processing unit 32, for carrying out clustering to the failure testing use-case set, according to mistake It loses the covering preferential selection criterion of equivalent partition to screen the success test case set, obtains preferred success test case Set；

Constant duration set acquiring unit 33 obtains program invariants for learning the preferred success test case set Gather, includes set type A semigroup, floating type range invariant and truth table type A semigroup in the constant duration set of described program；

Suspicious sentence set acquiring unit 34, not according to the execution information of the failure testing use-case set and described program Variables collection carries out invariant and violates detection, obtains suspicious sentence set.

Optionally, test case set processing unit 32 is also used to:

Inevitable coincidence test case is rejected from the success test case.

Optionally, suspicious sentence set acquiring unit 34 is also used to:

Optionally, further includes:

Fault propagation analytical unit, for the assignment statement violated of invariant and its straight will to be generated using reaching definite value analysis It connects control and relies on the sentence addition suspicious sentence set, filtered out for some reason from the suspicious sentence set using dependency analysis Invariant caused by barrier is propagated violates erroneous detection.

Fault propagation analytical unit is specifically used for:

Optionally, fault propagation analytical unit is also used to:

Optionally, further include the suspicious degree computing unit of sentence, generated not for statisticalling analyze each failure testing use-case Variable is violated, and calculates the suspicious degree of each suspicious sentence in the suspicious sentence set, and according to each suspicious sentence Suspicious degree is ranked up each suspicious sentence.

The suspicious degree computing unit 36 of sentence is specifically used for:

The suspicious degree computing unit is specifically used for:

The device of the embodiment of the present invention can be used for executing above method embodiment, and principle is similar with technical effect, this Place repeats no more.

Fig. 4 is the structural schematic diagram of the electronic equipment of one embodiment of the invention.As shown in figure 4, the electronic equipment includes Memory 41 and processor 42, by 43 communication connection of internal bus between memory 41 and processor 42, memory 41 is stored There is the program instruction that can be executed by processor 42, program instruction can be realized above-mentioned method when being executed by processor 42.

In addition, the logical order in above-mentioned memory 41 can be realized and as only by way of SFU software functional unit Vertical product when selling or using, can store in a computer readable storage medium.Based on this understanding, this hair Substantially the part of the part that contributes to existing technology or the technical solution can be with soft in other words for bright technical solution The form of part product embodies, which is stored in a storage medium, including some instructions are to make It obtains a computer equipment (can be personal computer, server or the network equipment etc.) and executes each embodiment of the application The all or part of the steps of the method.And storage medium above-mentioned include: USB flash disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic or disk etc. it is various It can store the medium of program code.

Another embodiment of the present invention provides a kind of computer readable storage medium, computer-readable recording medium storages Computer instruction, computer instruction make the computer execute above-mentioned method.

For existing method, in the presence of defining to invariant, the not perfect defect kind for leading to positioning is limited, uses because lacking test The analysis and lead to that invariant violates the missing inspection of detection and erroneous detection is studied to the analysis of error propagation that example influences. Firstly, according to variable and type expression, it is constant that invariant is divided into range present invention improves over the definition of program invariants Amount, set invariant, Boolean sequence invariant；And it defines two classes and is difficult to violate the suspicious sentence of detection with invariant；To Enrich the defect kind that can be positioned.Then research reduces the optimisation strategy that invariant is violated detection wrong report and failed to report.It proposes Consider that the test case of failed path is preferred, execution route cluster is pressed to failure testing use-case, to avoid the phase between a variety of failures Mutually interference, and select test use cases similar with failure use-case execution route and avoid the selection correct test case of coincidence, To constriction invariant range, to reduce missing inspection.Execution route cluster is pressed to failure testing use-case, avoids the phase between a variety of failures Mutually interference.It proposes to analyze the method for reducing missing inspection and erroneous detection that invariant violates detection using fault propagation, on the one hand, use Up to the assignment statement defect of definite value analysis detection missing inspection；On the other hand the propagation path of mistake is analyzed, and then is filtered out by mistake The erroneous detection that invariant caused by propagating is violated.On the above Research foundation, the program invariants that parsing error condition is propagated are proposed Fault Locating Method.

Compared with program spectral method, the advantage of present invention method:

(1) since the suspicious sentence list of present invention method only lists the suspicious sentence for generating invariant and violating, And by test case, the operations such as preferred, error propagation further decrease erroneous detection, therefore examine that less code can position To most of defect versions.

(2) for the version that can be navigated to, present invention method has lower code inspection expense.

Program spectral method haves the defects that notable difference, example more suitable for positioning failed path and successful path covering sentence Such as control the relevant defect of stream.And when success and failure use-case are carried out defect sentence, then locating effect is poor.

Present invention method not only considers that sentence covering (such as detects the suspicious language only covered by failure testing use-case Sentence), the state value for also analyzing mistake is flowed along the control of program and the propagation of data flow, therefore significantly improves positioning result Validity.

(3) program spectral method does not consider influencing each other between sentence, can only provide statistic analysis result, can not be effectively auxiliary Developer is helped to understand defect.Invariant considers the context of fault propagation and program, and invariant violate result can To understand the producing cause of software error to auxiliary development personnel, auxiliary is provided for its corrective pitting.

(4) it is compared with program spectral method, present invention method is due to considering specific variate-value and error propagation Path, therefore the sentence of ranking arranged side by side is significantly reduced, improve the validity of positioning.

It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more, The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces The form of product.

The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.

It should be noted that the terms "include", "comprise" or its any other variant are intended to the packet of nonexcludability Contain, so that the process, method, article or equipment for including a series of elements not only includes those elements, but also including Other elements that are not explicitly listed, or further include for elements inherent to such a process, method, article, or device. In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including the element Process, method, article or equipment in there is also other identical elements.

In specification of the invention, numerous specific details are set forth.Although it is understood that the embodiment of the present invention can To practice without these specific details.In some instances, well known method, structure and skill is not been shown in detail Art, so as not to obscure the understanding of this specification.Similarly, it should be understood that disclose in order to simplify the present invention and helps to understand respectively One or more of a inventive aspect, in the above description of the exemplary embodiment of the present invention, each spy of the invention Sign is grouped together into a single embodiment, figure, or description thereof sometimes.However, should not be by the method solution of the disclosure Release is in reflect an intention that i.e. the claimed invention requires more than feature expressly recited in each claim More features.More precisely, as the following claims reflect, inventive aspect is less than single reality disclosed above Apply all features of example.Therefore, it then follows thus claims of specific embodiment are expressly incorporated in the specific embodiment, It is wherein each that the claims themselves are regarded as separate embodiments of the invention.

The above description is merely a specific embodiment, under above-mentioned introduction of the invention, those skilled in the art Other improvement or deformation can be carried out on the basis of the above embodiments.It will be understood by those skilled in the art that above-mentioned tool Body description only preferably explains that the purpose of the present invention, protection scope of the present invention should be subject to the protection scope in claims.

Claims

1. a kind of software fault positioning method based on program invariants characterized by comprising

Abstract syntax tree is established for the source code of target software, according to the abstract syntax tree to the source generation of the target software Code carries out the other pitching pile of statement level, is worth the pitching pile of rank and the pitching pile of logical expression rank, is used using preset successfully test Example set and preset failure testing use-case set execute the source code of the target software after pitching pile, obtain each test and use The execution information of example, comprising: sentence coverage information, the value of variable and expression formula and logical expression truth table；

Clustering is carried out to the default failure testing use-case set, according to the unsuccessfully covering preferential selection criterion pair of equivalent partition It presets successfully test use cases conjunction to be screened, obtains preferred success test case set；

The execution information for learning the preferred success test case set, obtains program invariants set, described program invariant It include set type A semigroup, floating type range invariant and truth table type A semigroup in set；

Invariant, which is carried out, according to the execution information of the failure testing use-case set and the constant duration set of described program violates detection, Obtain suspicious sentence set.

2. the method according to claim 1, wherein the method also includes:

According to the sentence coverage information of the sentence coverage information of preset success test case set and failure testing use-case set The sentence only covered by failure testing use-case is obtained, the suspicious language is added in the sentence only covered by failure testing use-case Sentence set；

According to the logic of the logical expression truth table of the preset success test case set and failure testing use-case set Expression formula truth table obtains forever true and/or false predicate forever, by it is described forever true and/or forever the sentence where false predicate be added described in can Doubt sentence set.

3. the method according to claim 1, wherein the method is also wrapped after obtaining suspicious sentence set It includes:

Using reach definite value analysis will generate the assignment statement violated of invariant and its directly control rely on sentence be added described in can Doubt sentence set；

What invariant caused by being filtered out from the suspicious sentence set because of fault propagation using dependency analysis violated erroneous detection can Doubt sentence.

4. according to the method described in claim 3, it is characterized in that, described violated using arrival definite value analysis by invariant is generated Assignment statement and its directly control and rely on sentence the suspicious sentence set is added, comprising:

Determine that each invariant of generation in the suspicious sentence set violates the assignment of sentence according to the arrival fixed value information Sentence and its directly control dependence sentence；

The each invariant of generation is violated the assignment statement of sentence and its directly controlled and relies on the sentence addition suspicious language Sentence set.

5. according to the method described in claim 3, it is characterized in that, described use dependency analysis from the suspicious sentence set Invariant caused by filtering out because of fault propagation violates the suspicious sentence of erroneous detection, comprising:

Invariant caused by information is filtered out from the suspicious sentence set because of fault propagation is violated according to the invariant to disobey The determining suspicious sentence of back detection.

6. the method according to claim 1, wherein the method is also wrapped after obtaining suspicious sentence set It includes:

It statisticallys analyze the invariant that each failure testing use-case generates to violate, calculates each suspicious language in the suspicious sentence set The suspicious degree of sentence, and each suspicious sentence is ranked up according to the suspicious degree of each suspicious sentence.

7. according to the method described in claim 6, it is characterized in that, described calculate each suspicious language in the suspicious sentence set The suspicious degree of sentence, comprising:

Wherein, Sus_Inv (s_i) it is suspicious sentence s_iSuspicious degree；TS is the preset success test case set, | TF | be The sum of test case in the preset failure testing use-case set；v_iIt is i-th of node in data dependence graph, tf is to lose Lose test case, confidence (v_i, tf, TS) and it is v_iNode executes failure testing use-case tf and generates the confidence that invariant is violated Degree；If v_iIt is the failure producing cause determined in dependency analysis, then confidence (v₁, tf, TS)=1, otherwise confidence(v_i, tf, TS) and=0.1,2≤i≤k.

8. a kind of software fault positioning device based on program invariants characterized by comprising

Source code pitching pile unit establishes abstract syntax tree for the source code for target software, according to the abstract syntax tree The other pitching pile of statement level is carried out to the source code of the target software, is worth the pitching pile of rank and the pitching pile of logical expression rank, Using the target software after preset success test case set and preset failure testing use-case set execution pitching pile Source code obtains the execution information of each test case, comprising: obtains the value of sentence coverage information, variable and expression formula and patrols Collect expression formula truth table；

Test case set processing unit, for carrying out clustering to the failure testing use-case set, according to unsuccessfully covering The preferential selection criterion of equivalent partition screens the success test case set, obtains preferred success test case set；

Constant duration set acquiring unit obtains program invariants set, institute for learning the preferred success test case set State in program invariants set includes set type A semigroup, floating type range invariant and truth table type A semigroup；

Suspicious sentence set acquiring unit, according to the execution information of the failure testing use-case set and the constant quantity set of described program It closes progress invariant and violates detection, obtain suspicious sentence set.

9. a kind of electronic equipment, which is characterized in that the electronic equipment includes memory and processor, the memory and described By internal bus communication connection between processor, the memory, which is stored with, to be referred to by the program that the processor executes It enables, described program instruction can be realized the described in any item methods of claim 1-7 when being executed by the processor.

10. a kind of computer readable storage medium, which is characterized in that the computer-readable recording medium storage computer refers to It enables, the computer instruction makes computer perform claim require the described in any item methods of 1-7.