JP6953962B2 - Analysis method, analysis device and analysis program - Google Patents

Description

The present invention relates to an analysis method, an analysis device and an analysis program.

A technique is known that analyzes the source code and lists the setting sources of variables and function arguments and possible value candidates. For example, if there is an error in the source code or if there is a part that does not conform to the source code creation rules, even if there are a wide range of corrections, the source code is converted according to the source code creation rules. The device is known. The device analyzes the structure and calling relationship of all the source code in advance, and extracts the part to be converted based on the analysis result of the source code. Then, the device identifies the rewriting target portion of the source code corresponding to the extracted conversion target portion, and rewrites the source code of the corresponding portion.

Further, a program verification device capable of eliminating the user's determination work and improving the efficiency of program verification is also known. The device converts the program into an abstract syntax tree and makes it a program abstract syntax tree. The device converts the internal specifications into an abstract syntax tree and makes it a specification abstract syntax tree. The device compares the program abstract syntax tree with the specification abstract syntax tree and verifies whether the program to be verified satisfies the internal specifications. If the verification target program cannot satisfy the internal specifications, the device outputs a verification result report showing the verification result as an error position of the program.

Further, there is also known a verification device that enables quick equivalence verification for refactoring performed manually without exploding the amount of calculation when performing symbol execution. When verifying the equivalence of the source code, the device performs two types of verification: verification by structural comparison using a structural graph in which the source code is analyzed, and verification by symbol execution. The apparatus does not execute the symbol when it can be determined that the structures match by the structure comparison using the structure graph. In addition, before verification by structural comparison, the device normalizes the structural graph of each source code before and after refactoring based on the normalization information determined for each refactoring pattern, and when the refactoring is valid, the structure. Adjust so that they match. Further, the apparatus limits the places where the symbols are executed by executing and verifying the abstraction of each structural graph before and after the refactoring.

Japanese Unexamined Patent Publication No. 2014-134962 Japanese Unexamined Patent Publication No. 2011-215998 International Publication No. 2015/029154

However, in the above technique, it is difficult to enumerate the source code variables and function argument setting sources and possible value candidates without erroneous enumeration or omission of enumeration. For example, when the source code is compiled and dynamically analyzed as an executable state, erroneous enumeration does not occur, but the result is returned only for the actually executed contents, so enumeration omission may occur. Also, when parsing the source code statically, if another object of the same class is treated as the same object and the execution order in the function is ignored, enumeration omission does not occur, but erroneous enumeration occurs. There is.

In one aspect, it is an object of the present invention to provide an analysis method, an analysis device, and an analysis program capable of suppressing erroneous enumeration and omission of enumeration when analyzing the source code of a dynamically typed language.

In one embodiment, the analysis method causes a computer to generate a directed graph that represents the flow of data and the flow of processing within a function of a program. In the analysis method, a computer performs dynamic type reference resolution and name resolution using a data flow and a processing flow. In the analysis method, the computer contracts the directed graph for each function of the program. Further, in the analysis method, the computer combines the directed graphs of the caller and called programs related to the function that received the analysis instruction from the reduced directed graphs , and processes the data using the combined new directed graphs. Explore the flow.

According to one aspect, it is possible to suppress erroneous enumeration and omission of enumeration when analyzing the source code of the dynamically typed language.

FIG. 1 is a diagram showing an example of a value difference between a dynamically typed language and a statically typed language. FIG. 2 is a diagram showing an example of a syntax tree. FIG. 3 is a diagram showing an example of a directed graph. FIG. 4 is a diagram showing an example of the analysis device according to the first embodiment. FIG. 5 is a diagram showing an example of the class table in the first embodiment. FIG. 6 is a diagram showing an example of the node relation table in the first embodiment. FIG. 7 is a diagram showing an example of the node table in the first embodiment. FIG. 8 is a diagram showing an example of the edge table in the first embodiment. FIG. 9 is a diagram showing an example of the rewriting rule in the first embodiment. FIG. 10 is a diagram showing an example of graph elements. FIG. 11 is a diagram showing an example of the source code conversion result in the first embodiment. FIG. 12 is a diagram showing another example of the source code conversion result in the first embodiment. FIG. 13 is a diagram showing an example of the resolution process of the source code 1. FIG. 14 is a diagram showing an example of the reduction process of the source code 1. FIG. 15A is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 15B is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 15C is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 15D is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 15E is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 15F is a diagram showing an example of the resolution process and the contraction process of the source code 3. FIG. 16A is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16B is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16C is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16D is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16E is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16F is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 16G is a diagram showing an example of the enumeration process and the combination process of the source code 3. FIG. 17 is a flowchart showing an example of the analysis process in the first embodiment. FIG. 18 is a flowchart showing an example of the conversion process in the first embodiment. FIG. 19 is a flowchart showing an example of the solution process in the first embodiment. FIG. 20 is a flowchart showing an example of the reduction process in the first embodiment. FIG. 21 is a flowchart showing an example of the enumeration process in the first embodiment. FIG. 22 is a flowchart showing an example of the joining process in the first embodiment. FIG. 23 is a diagram showing an example of the source code conversion result in the second embodiment. FIG. 24 is a diagram showing another example of the source code conversion result in the second embodiment. FIG. 25A is a diagram showing an example of the enumeration process and the integrated process of the source code 5. FIG. 25B is a diagram showing an example of the enumeration process and the integration process of the source code 5. FIG. 26 is a diagram showing an example of a computer that executes an analysis program.

Hereinafter, examples of the analysis method, analysis device, and analysis program disclosed in the present application will be described in detail with reference to the drawings. The present invention is not limited to this embodiment. In addition, the examples shown below may be appropriately combined as long as they do not cause a contradiction.

In the present embodiment, the analysis device 100 described later targets the source code of the dynamically typed language as the analysis target. FIG. 1 is a diagram showing an example of a value difference between a dynamically typed language and a statically typed language. The source code 9100 of the dynamically typed language and the source code 9200 of the statically typed language shown in FIG. 1 both include two classes "C" and "D". Also, the two classes "C" and "D" each include a function "f" with the same name.

As shown in FIG. 1, in the source code 9200 of a statically typed language, when an object is created, the "type" of the object is specified in the source code. For example, in the source code 9200 of a statically typed language, the type of the variable and the argument of the object "o" is defined by the class "C", and the type of the variable and the argument of the object "o2" is the class "D". Can be clearly identified as defined in. In this case, only "3" is a candidate for the parameter value of the function "send". Further, as shown in the source code 9201, when the object "o" having the same name is generated, the types of the respective variables and arguments are clearly defined in the source code.

On the other hand, in the source code 9100 of the dynamically typed language, when the object is created, the "type" of the object is not specified in the source code. For example, in the source code 9200 of a statically typed language, it is clearly specified whether the variable and argument types of the object "o" are defined in the class "C" or the class "D". Not. In this case, the parameter value of the function "send" may be a candidate not only "3" but also "8" depending on the order of the execution statements.

As described above, in the dynamically typed language, the parameter value candidates may differ depending on the order of the executable statements. In this case, if another object of the same class is treated as the same object and the program is statically analyzed (so-called "ambiguous static analysis") ignoring the execution order, an erroneous enumeration of candidate values will occur. There is. On the other hand, when enumerating value candidates in an executable state by compiling the source code of a dynamically typed language, erroneous enumeration of candidate values does not occur, but enumeration of candidate values may be omitted.

The analysis device 100 in this embodiment generates a directed graph representing the data flow and the processing flow in the function of the program, and uses the data flow and the processing flow to perform dynamic type reference resolution and name. Perform the resolution. Further, the analysis device 100 reduces the directed graph for each function of the program, and among the reduced results, after matching the solution results related to the function that received the analysis instruction, searches the data processing flow.

The processing of the source code by the analysis device 100 will be described with reference to FIGS. 2 to 3. FIG. 2 is a diagram showing an example of a syntax tree. As shown in FIG. 2, the analyzer 100 starts with the source code 1 described in the dynamically typed language indicated by reference numeral 1000, and performs a processing as described later, for example, in a syntax tree with the particle size of the instruction sequence in the assembler. Generate 1010.

Further, the analysis device 100 further generates a directed graph 1100 as shown in FIG. 3 from the generated syntax tree 1010. FIG. 3 is a diagram showing an example of a directed graph. In FIG. 3, the directed graph 1100 includes first nodes 1111 and 1114 corresponding to processing, second nodes 1112 and 1115 corresponding to data reference, and third node 1116 corresponding to data setting.

The directed graph 1100 in this embodiment is, for example, as shown in FIG. 3, a three-part graph having first to third nodes and an edge. In FIG. 3, the second node is shown in a circular shape, and a positive value such as “1” is shown in the circle. Further, in FIG. 3, the third node is shown in a circular shape, and a negative value such as “-1” is shown in the circle. As shown in FIG. 3, in the following, the notation of the edge 1117 from the first node 1114 to the second node 1115 and the edge 1118 from the third node 1116 to the first node 1114 may be omitted.

The second node and the third node shown in FIG. 3 show the flow of data in the function (reference update of storage area, input / output value of processing) and the flow of processing. In the second node and the third node, a node having an absolute value of "1" indicates an environment, and a node having an absolute value of "2" or more indicates a parameter.

Further, the analysis device 100 performs reference resolution and name resolution on the directed graph as shown in FIG. 3 by using both the data flow and the processing flow. The analysis device 100 contracts and holds the solution result in function units. Further, the analysis device 100 searches the data processing flow after combining the resolution results related to the function that received the analysis instruction among the reduced results.

As described above, the analysis device 100 in the present embodiment shows the data flow and the processing flow in the function as a directed graph, executes reference resolution and name resolution, and executes the reference resolution and the name resolution, and the data flow and the processing flow of the function to be analyzed. Therefore, it is possible to suppress omission of enumeration and erroneous enumeration at the time of dynamically typed language analysis.

[Functional block]
Next, the analysis device 100 in this embodiment will be described with reference to FIG. FIG. 4 is a diagram showing an example of the analysis device according to the first embodiment. As shown in FIG. 4, the analysis device 100 in this embodiment includes a communication unit 110, a storage unit 120, and a control unit 130.

The communication unit 110 controls communication with other computers such as an external server (not shown), a terminal of a user or an administrator of the analysis device 100 (not shown), regardless of whether it is wired or wireless. The communication unit 110 is, for example, a communication interface such as a NIC (Network Interface Card).

The storage unit 120 stores various data such as a program executed by the control unit 130, for example. Further, the storage unit 120 has a source code DB 121, a class definition DB 122, an original flow DB 123, a resolved flow DB 124, a rewriting rule DB 125, a contracted flow DB 126, and a value candidate DB 127. The storage unit 120 corresponds to semiconductor memory elements such as RAM (Random Access Memory), ROM (Read Only Memory), and flash memory, and storage devices such as HDD (Hard Disk Drive). In the following description, the database may be referred to as "DB".

The source code DB 121 stores the source code of the program to be analyzed. The information stored in the source code DB 121 is input by, for example, the acquisition unit 131 described later.

The class definition DB 122 stores information regarding the definition of each class used when generating a directed graph from the source code. The class definition DB 122 stores, for example, a class table 122-1 as shown in FIG. 5 and a node relation table 122-2 as shown in FIG. 6 as information regarding the definition of the class. The information stored in the class definition DB 122 is input in advance by, for example, the administrator of the analysis device 100 (not shown).

FIG. 5 is a diagram showing an example of the class table in the first embodiment. As shown in FIG. 5, the class table 122-1 stores the name of each node in association with the content indicated by the node having the name. For example, the class "λI &" indicates that the node is a node of the class that "defines the processing content of the class member function".

FIG. 6 is a diagram showing an example of the node relation table in the first embodiment. As shown in FIG. 6, the node relation table 122-2 shows the attributes of the second node and the third node corresponding to the nodes of each class listed in the class table. As shown in FIG. 6, the attributes of the second node and the third node are the "environment" indicated by the absolute value "1", the "parameter" indicated by the absolute value "2" and thereafter, and the "memory area". Further includes "plc" indicating "namespace", "def" indicating "namespace", and the like. Further, as shown in the second node of the class "λI &" and the third node of the class "R &", the attribute having the largest absolute value may indicate "continuation".

Returning to FIG. 4, the original flow DB 123 stores information about the directed graph generated from the source code by the conversion unit 132 described later. The original flow DB 123 has, for example, a node table 123-1 that stores information about nodes that make up a directed graph as shown in FIG. 7, and an edge table 123-2 that stores information about edges that make up a directed graph as shown in FIG. And have. The information stored in the original flow DB 123 is input by, for example, the conversion unit 132.

FIG. 7 is a diagram showing an example of the node table in the first embodiment. As shown in FIG. 7, the node table 123-1 stores, for example, a "storage position", a "node type", a "class", and an "attribute" in association with an "ID".

In FIG. 7, “ID” indicates an identifier that uniquely identifies a node. The "storage position" indicates the position where the source code corresponding to the node is stored. The "node type" indicates which of the first node to the third node shown in FIG. 3 corresponds to the node.

In FIG. 7, “class” indicates which class the node corresponds to. The class is stored only for the node whose "node type" is "1". "Attribute" indicates the attribute of the node. For example, the "attribute" of a node whose "node type" is "1" stores a character string such as "'http: //'" or a function name such as "self". Further, for example, the "attribute" of the node whose "node type" is "2" or "3" stores attributes such as "environment" and "parameter" such as "1" and "-1". As will be described later, the "attribute" of the node whose "node type" is "2" or "3" includes attributes such as "plc" indicating a memory area and "def" indicating a namespace. ..

For example, as shown in FIG. 7, the node having the ID "11" is the first node n1, the class is "IV", and the attribute is "'http: //'". The source code corresponding to the node whose ID is "11" is stored in "/src/rev.1/".

FIG. 8 is a diagram showing an example of the edge table in the first embodiment. As shown in FIG. 8, the edge table stores the “start point ID” and the “end point ID” in association with each other. In FIG. 8, the “start point ID” indicates the ID of the node that is the start point of the edge, and the “end point ID” indicates the ID that is the end point of the edge.

Returning to FIG. 4, the resolved flow DB 124 stores information regarding the directed graph which is the result of the resolution process for performing reference resolution and name resolution by the resolution unit 133 which will be described later. The resolved flow DB 124 stores information about the nodes and edges constituting the directed graph, as in the node table 123-1 shown in FIG. 7 and the edge table 123-2 shown in FIG. 8, for example. The information stored in the resolved flow DB 124 is input later, for example, by the resolution unit 133.

The rewriting rule DB 125 stores information about the rewriting rule applied to the resolution process, the contraction process, and the join process, which will be described later, for the directed graph. The information stored in the rewriting rule DB 125 is input in advance by, for example, the administrator of the analysis device 100 (not shown).

FIG. 9 is a diagram showing an example of the rewriting rule in the first embodiment. As shown in FIG. 9, the rewriting rule stores the "content", the "type", and the "priority" in association with the "title". In FIG. 9, the "title" is information that uniquely identifies the rewriting type. "Content" indicates the target and conditions of the directed graph to which the rewriting rule of the title is applied, and the content of the rewriting process.

In FIG. 9, “type” indicates the type of processing for which the rewriting rule is applied. In this embodiment, the type "S" indicates the rewriting rule applied to the resolution process, the type "D" indicates the rewriting rule applied to the contraction process, and the type "M" is applied to the integrated process. Rewrite rules are shown. In addition, "priority" indicates the order in which the rewriting rule is applied. In this embodiment, the rewriting rules are applied in order from the one with the highest priority, that is, the one with the lowest priority value.

Returning to FIG. 4, the contracted flow DB 126 stores information about the directed graph which is the result of the contraction processing performed by the contraction unit 134, which will be described later. The contracted flow DB 126 stores information about the nodes and edges constituting the directed graph, as in the node table 123-1 shown in FIG. 7 and the edge table 123-2 shown in FIG. 8, for example. The information stored in the contracted flow DB 126 is input by, for example, the contracted unit 134.

The value candidate DB 127 stores information about a value that is the result of the enumeration process described later. The value candidate DB 127 stores a value that is a candidate for a setting value of an argument or a variable in the target function. The information stored in the value candidate DB 127 is input by, for example, the enumeration unit 135 described later.

Returning to FIG. 4, the control unit 130 is a processing unit that controls the overall processing of the analysis device 100. The control unit 130 is realized by, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like executing a program stored in an internal storage device using a RAM as a work area. Further, the control unit 130 may be realized by, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The control unit 130 includes an acquisition unit 131, a conversion unit 132, a resolution unit 133, a contraction unit 134, an enumeration unit 135, and an output unit 136. The acquisition unit 131, the conversion unit 132, the resolution unit 133, the contraction unit 134, the enumeration unit 135, and the output unit 136 are examples of electronic circuits included in the processor and examples of processes executed by the processor.

The acquisition unit 131 acquires information about the source code and the function to be analyzed. The acquisition unit 131 acquires the source code from an external server or a user's terminal (not shown) through the communication unit 110, for example, and stores the source code in the source code DB 121.

Further, the acquisition unit 131 receives an instruction regarding the function to be analyzed from, for example, the user's terminal through the communication unit 110. The acquisition unit 131 outputs a directed graph generation instruction regarding the function to be analyzed to the conversion unit 132, and outputs information for specifying the function to be analyzed to the enumeration unit 135.

Next, the conversion unit 132 converts the source code into a directed graph as shown in FIG. The conversion unit 132 is an example of a generation unit.

When the conversion unit 132 receives the output of the directed graph generation instruction from the acquisition unit 131, the conversion unit 132 extracts the source code including the function to be analyzed from the source code DB 121, identifies the graph element as shown in FIG. Generate a syntax tree as shown in 2.

FIG. 10 is a diagram showing an example of graph elements. The conversion unit 132 identifies the elements corresponding to the nodes as shown in FIG. 10 from the source code, and generates a syntax tree as shown in FIG. Further, the conversion unit 132 converts the generated syntax tree into a directed graph as shown in FIG. 3 and stores it in the original flow DB 123.

The directed graph generated by the conversion unit 132 is, for example, a source code decomposed at the particle size of the assembler. That is, the generated directed graph shows the data flow and the processing flow in a form in which the referenced register and memory address can be specified.

The directed graph generated by the conversion unit 132 will be described with reference to FIGS. 11 and 12. FIG. 11 is a diagram showing an example of the source code conversion result in the first embodiment. The source code 2 that is the conversion source shown in reference numeral 2000 is a class having the same name as the source code 1 shown in FIG. 2, but in addition to the function “____init__” 2001, another function “newSpace” 2002 is further defined. ..

In this case, the conversion unit 132 generates a directed graph 2100 including the node "λI &" 2101 corresponding to the function "____init__" 2001 and the node "λI &" 2102 corresponding to another function "newSpace" 2002.

FIG. 12 is a diagram showing another example of the source code conversion result in the first embodiment. The source code 3 shown by reference numeral 3000 includes an instruction 3001 that creates an object “p” of the class “Proxy”.

In this case, the conversion unit 132 generates a directed graph 3100 including a node 3101 indicating the class “Proxy” as the reference destination “RI” of the value. The process of specifying the reference destination of the node 3101 will be described later.

Next, the resolution unit 133 executes a resolution process that performs reference resolution and name resolution for the directed graph. The solution unit 133 reads the information about the directed graph from the original flow DB 123, and applies the rewriting rule of the type "S" stored in the rewriting rule DB 125 to the directed graph. The resolution unit 133 stores the information regarding the directed graph to which the rewriting rule of the type "S" is applied in the resolved flow DB 124.

The solution process in this embodiment will be described with reference to FIG. FIG. 13 is a diagram showing an example of the resolution process of the source code 1. The directed graph 1200 shown in FIG. 13 is a modification of the layout of the directed graph 1100 shown in FIG. 3, and the configurations of the nodes and edges are the same as those of the directed graph 1100. In the drawing showing the following directed graph, the node or edge to be processed next may be indicated by a broken line, and the node or edge changed by the previous processing may be indicated by a thick line.

First, the solution unit 133 refers to the rewriting rule DB 125, and applies the rewriting rule of the type "S" to the main node λI & "____ init __" (constructor method name) included in the directed graph 1200 stored in the original flow DB 123. First, whether or not the solution unit 133 applies "M_I", which has the highest priority, that is, the lowest priority value, to the directed graph 1200 among the rewrite rules of the type "S" stored in the rewrite rule DB 125. To judge.

In this case, since the directed graph 1200 does not include the target graph shape "A & (-2)-> (2) P (-plc)-> (+ plc) Class", the solution unit 133 sets the rewriting rule "M_I" as the directed graph. Not applicable to 1200.

Next, the resolution unit 133 determines whether or not to apply the rewriting rule "RI_E (1)" having the second highest priority among the rewriting rules of the type "S" stored in the rewriting rule DB 125 to the directed graph 1200. judge. In this case, since the directed graph 1200 includes the node “RI” 1201 corresponding to the target graph shape “RI (-1) → (1) ... (-1) → (1) λI &”, the solution unit 133 The rewriting rule "RI_E (1)" is applied to the directed graph 1200.

That is, the solution unit 133 changes the node "RI" 1201 of the directed graph 1200 to the node ID 1301. Further, the solution unit 133 converts the directed graph 1200 into the directed graph 1300 by adding an edge 1323 from the node λI & to the second node of the node ID 1301.

Similarly, the resolution unit 133 also applies the rewriting rule "RI_E (1)" to the directed graph 1300 because the transformed directed graph 1300 includes yet another node "RI" 1311.

That is, the solution unit 133 changes the node "RI" 1311 of the directed graph 1300 to the node ID 1411. Further, the solution unit 133 converts the directed graph 1300 into the directed graph 1400 by adding an edge 1433 from the node "λI &" to the second node of the node ID 1411.

Further, the solution unit 133 determines that the converted directed graph 1400 does not include a node corresponding to the graph shape subject to the rewriting rule “RI_E (1)”. In this case, the resolution unit 133 determines whether or not the rewriting rule of the other type "S" stored in the rewriting rule DB 125 and having a priority of the rewriting rule "RI_E (1)" or lower is applied to the directed graph 1400. judge.

In this case, since the directed graph 1400 does not include the graph shape subject to the rewriting rule of the other type "S", the solution unit 133 does not apply the rewriting rule of the other type "S" to the directed graph 1400. Then, the resolution unit 133 determines whether or not to apply the rewriting rules of all the types "S" to the directed graph 1400, and then stores the converted directed graph 1400 in the resolved flow DB 124.

Next, the contraction unit 134 executes a contraction process for contracting the resolved directed graph in function units of the program. The contraction unit 134 reads information about the directed graph from the resolved flow DB 124, and applies the rewriting rule of type "D" stored in the rewriting rule DB 125 to the directed graph. The contraction unit 134 stores information about the directed graph to which the rewriting rule of the type “D” is applied in the contracted flow DB 126.

The contraction process in this embodiment will be described with reference to FIG. FIG. 14 is a diagram showing an example of the reduction process of the source code 1. First, the contraction unit 134 refers to the rewriting rule DB 125, and applies the rewriting rule of the type “D” to the main node “λI &” “__init__” included in the directed graph 1400 stored in the resolved flow DB 124. .. First, whether or not the contraction unit 134 applies "ID_E", which has the highest priority, that is, the lowest priority value, to the directed graph 1400 among the rewriting rules of the type "D" stored in the rewriting rule DB 125. Is determined. In this case, since the directed graph 1400 includes the target graph shape “ID”, the contraction unit 134 applies the rewriting rule “ID_E” to the directed graph 1400.

That is, the contraction unit 134 deletes the node "ID" 1401 of the directed graph 1400 and deletes the edges 1412, 1413, 1422, and 1423 adjacent to the node "ID" 1401 shown in FIG. In addition, the contraction unit 134 adds edges 1513 and 1523 that connect the connection destinations of the deleted edges to each other. As a result, the contraction unit 134 converts the directed graph 1400 into the directed graph 1500.

Similarly, the contraction unit 134 deletes the node "ID" 1511 and the edges 1512, 1513, 1532 and 1533 by further applying the rewriting rule "ID_E" to the directed graph 1500, and also deletes the edges 1613 and 1633. To add. As a result, the contraction unit 134 converts the directed graph 1500 into the directed graph 1600.

Further, the contraction unit 134 determines whether or not the rewriting rule of the other type “D” whose priority is equal to or lower than the rewriting rule “ID_E” stored in the rewriting rule DB 125 is applied to the directed graph 1600. In this case, since the directed graph 1600 does not include the graph shape subject to the rewriting rule of the other type "D", the contraction unit 134 does not apply the rewriting rule of the other type "D" to the directed graph 1400. Then, the contraction unit 134 determines whether or not to apply the rewriting rules of all the types "D" to the directed graph 1600, and then stores the converted directed graph 1600 in the contracted flow DB 126.

Another example of the processing by the solution unit 133 and the contraction unit 134 according to this embodiment will be described with reference to FIGS. 15A to 15F. 15A to 15F are diagrams showing an example of the resolution process and the contraction process of the source code 3. First, the solution unit 133 applies a rewriting rule of type "S" to the directed graph 3100 generated from the source code 3 shown in FIG. In this case, the solution unit 133 applies the rewriting rule "RI_E (1)" to the node "RI" 3101 corresponding to the target graph shape.

Further, the contraction unit 134 further applies the rewriting rule of the type "D" to the directed graph 3100 to which the rewriting rule "RI_E (1)" is applied by the resolving unit 133. In this case, the contraction unit 134 generates the resolved and contracted directed graph 3200 by applying the rewriting rule "ID_E" to the directed graph 3100.

As shown in FIG. 15A, in the directed graph 3200, the node "RI" 3101 included in the directed graph 3100 and the edges 3112, 3113, and 3132 connected to the second node and the third node of the node are deleted. Further, in the directed graph 3200, an edge 3212 connected to the second node of the node "RI" 3211 and an edge 3233 connected to the second node 3109 of the node "λI &" are added.

As shown in FIG. 12, the source code 3 in this embodiment includes an instruction 3001 that creates an object “p” of the class “Proxy”. Therefore, the enumeration unit 135 in this embodiment adds a node that calls the class "Proxy" when resolving the reference and the name of the source code 3.

Moving on to FIG. 15B, the solution unit 133 further applies the rewriting rule "RI_E (2)" to the directed graph 3200. As a result, the solution unit 133 deletes the node "RI" 3211 related to the class "Proxy" from the directed graph 3200. In addition, the solution unit 133 generates a directed graph 3300 by adding a main node "Class" 3321, a node "P" 3311, and an edge 3313 connecting both nodes.

Further, the solution unit 133 further applies the rewriting rule "M_I" to the directed graph 3300. As a result, the solution unit 133 generates the directed graph 3400 by adding the node "M" 3431 and the node "RM" 3441 to the directed graph 3200.

Moving on to FIG. 15C, the solution unit 133 further applies the rewriting rule "DI_I" to the directed graph 3400. As a result, the solution unit 133 generates the directed graph 3500 by deleting the node "WI" 3451 from the directed graph 3400 and adding the node "DI" 3651, the node "WI" 3551, and the edge connecting both nodes. ..

Further, the solution unit 133 further applies the rewriting rule "DI_E" to the directed graph 3500. As a result, the solution unit 133 generates the directed graph 3600 by deleting the node "DI" 3651 and the node "WI" 3551 of the directed graph 3500 and adding the node "S" 3661 and the node "U" 3651.

Moving on to FIG. 15D, the solution unit 133 further applies the rewriting rules “RI_I (4)” and “PE_E” to the directed graph 3600. As a result, the solution unit 133 deletes the node "RI" 3671 from the directed graph 3400 and adds the node "P" 3771 and the edge connected to the node "P" 3771. Further, the resolution unit 133 connects the node "S" 3661 and the node "P" 3771 via the second node "+ plc" and the third node "-plc". Further, the solution unit 133 generates a directed graph 3700 by adding an edge 3783 connecting the node "M" 3781 and the node "RM" 3789.

Further, the solution unit 133 further applies the rewriting rule "M_E (3)" to the directed graph 3700. As a result, the solution unit 133 adds the node "S" 3891 connected from the main node "Class" 3821 via the second node "+ def" and the third node "-def" to the directed graph 3700. Further, the solution unit 133 replaces the node "M" 3781 of the directed graph 3700 with the node "P" 3881 to generate the directed graph 3800. The node "S" 3891 and the node "M" 3781 are connected to the node "S" 3891 via the second node "+ plc" and the third node "-plc" in addition to the second node "1" and the third node "-1". Even connected.

Moving on to FIG. 15E, the solution unit 133 further applies the rewriting rule "CL_I (4)" to the directed graph 3800. As a result, the solution unit 133 adds the node "CL" 3911 that calls the node "λI &" 3901 corresponding to the "____ init__" method to the directed graph 3800. Further, the solution unit 133 modifies the edge connected to the node “CL” 3911 to generate the directed graph 3900. As a result, the solution unit 133 records the call relationship to the function "Proxy.____init__" by the function "Client.getResource" in the directed graph 3900.

Similarly, the solution unit 133 further applies the rewriting rule "CL_I (4)" to the directed graph 3900 to change the node "CL" 3A11 that calls the node "λI &" 3A01 corresponding to the "newSpace" method to the directed graph 3800. to add. Further, the solution unit 133 modifies the edge connected to the node "CL" 3A11 to generate the directed graph 3A00. As a result, the solution unit 133 records the call relationship to the function "Proxy.newSpace" by the function "Client.getResource" in the directed graph 3A00.

Moving to FIG. 15F, the contraction unit 134 applies the rewriting rule “unref_E, S_U_E” of the type “D” to the directed graph 3A00. As a result, the contraction unit 134 deletes the nodes "RM" 3A21 and 3A22, the nodes "P" 3A31 and 3A32, the node "U" 3A41 and the node "S" 3A51 from the directed graph 3A00, and generates the directed graph 3B00. .. Note that the directed graph 6000 is a modification of the layout of the directed graph 3B00, and the configuration of the nodes and edges is the same as that of the directed graph 3B00.

Returning to FIG. 4, the enumeration unit 135 enumerates the values that are candidates for the setting values of the arguments or variables of the target function by using the reduced directed graph. When the enumeration unit 135 receives the output of the information for specifying the function to be analyzed from the acquisition unit 131, the enumeration unit 135 enumerates the candidate values of the values of the specified function. The enumeration unit 135 is an example of a search unit.

The enumeration unit 135 determines whether or not there is a program to be called for the specified function. When the enumeration unit 135 determines that there is a called program, the enumeration unit 135 combines the directed graph of the called program with the directed graph of the calling program.

The enumeration unit 135 enumerates the directed graph of the caller of the function, refers to the rewriting rule DB 125, and applies the rewriting rule of the type "M" to the directed graph of the callee and the directed graph of the caller. Specifically, the enumeration unit 135 enumerates the callers of the functions including the arguments or variables to be enumerated, and combines the function call portion of the directed graph corresponding to each caller function with the directed graph of the callee.

For example, the enumeration unit 135 adds the directed graph of the callee to the directed graph of the caller as a subgraph. In the directed graph of the callee added as a subgraph, the main node is changed to "λI & $ 2", for example. Then, the enumeration unit 135 applies the rewriting rule of the type "M" to the node "A &" in the graph of the caller. Further, the enumeration unit 135 further applies a rewriting rule of type "M" to the graph in which the directed graph of the caller and the directed graph of the callee are combined.

Further, the enumeration unit 135 includes a resolution process for applying the rewrite rule of the type "S" and a contraction process for applying the rewrite rule of the type "D" to the directed graph to which the rewrite rule of the type "M" is applied. repeat.

Further, the enumeration unit 135 enumerates the nodes for setting the value for the function of the directed graph when the directed graphs of all the called destinations are combined or when it is determined that there is no program of the called destination, and the F node is the data. Search in the opposite direction to the flow and processing flow. The enumeration unit 135 repeats the search until it reaches the IV node, and when it reaches the IV node, it converts the enumerated nodes into a character string.

The output unit 136 outputs the result of the analysis process. The output unit 136 extracts the candidate values of the arguments or variables stored in the value candidate DB 127, and outputs them to a user's terminal (not shown) through, for example, the communication unit 110.

The enumeration process and output contents by the analysis device 100 in this embodiment will be described with reference to FIGS. 16A to 16G. 16A to 16G are diagrams showing an example of the enumeration process and the combination process of the source code 3. In the following, a process of listing the candidate values of the arguments passed to the "send" function included in the object "p" generated by the source code 3 shown in FIG. 12 will be described.

The "send" function is called by the "Client.getResource" function included in the "Client" class of the source code 3. However, the "send" function is included in the "Proxy" class of source code 2 instead of source code 3. Therefore, the enumeration unit 135 in this embodiment performs a combination process of the directed graph of the source code 3 which is the caller and the directed graph of the source code 2 which is the callee.

As shown in FIG. 16A, the enumeration unit 135 applies the rewriting rule “AC_E” of the type “M” to the directed graph 6000 of the source code 3 shown in FIG. 15F. First, the enumeration unit 135 processes the rewriting rule “AC_E” shown in FIG. 9. Duplicates the subgraph starting with the node "λI &" by executing. In this embodiment, the enumeration unit 135 adds a subgraph 2200 starting with the node "λI &" 2201 that defines the "newSpace" function in source code 2. In FIG. 16B and below, the node "λI &" 2201 of the added subgraph 2200 may be represented as "λI & $ 2". As a result, the enumeration unit 135 generates a directed graph 6100 including a directed graph 6000 and a subgraph 2200.

Moving to FIG. 16B, the enumeration unit 135 processes the rewriting rule “AC_E” of the type “M” for the directed graph 6100 2.1. To execute. As a result, the enumeration unit 135 generates a directed graph 6200 to which an edge connecting the node "CL" 6221 of the directed graph 6000 to the node "RI" 6211 of the subgraph 2200 is added.

Further, the enumeration unit 135 processes the rewriting rule “AC_E” for the directed graph 6200 2.2. And processing 2.3.1. To execute. As a result, an edge 6313 connecting the node "P" 6311 to the node "RM" 6312 and an edge 6323 connecting the node "IV" 6321 to the node "F" 6322 are added. Further, the enumeration unit 135 generates a directed graph 6300 to which an edge 6333 connecting from the node “R &” 6331 to the node “R &” 6332 is added. In addition, in the source code 3, the processing of the rewriting rule "AC_E" 2.3.2. And 2.3.3. Does not include nodes or edges that are subject to.

Moving to FIG. 16C, the enumeration unit 135 processes the rewriting rule “AC_E” with respect to the directed graph 6300. To execute. As a result, the enumeration unit 135 generates a directed graph 6400 in which the node “λI &” 6341 shown in FIG. 16B and each connecting edge are deleted.

Further, the enumeration unit 135 processes the rewriting rule “AC_E” with respect to the directed graph 6400. To execute. As a result, the enumeration unit 135 generates a directed graph 6500 in which the node “R &” 6331 shown in FIG. 16B and each connecting edge are deleted. In the directed graph 6500, the enumeration unit 135 adds an edge connecting the node "A &" 6401 connected to the deleted node "R &" 6331 to the node "R &" 6332.

By the way, the class "Proxy" is defined in the source code 1 in addition to the source code 2. Therefore, the enumeration unit 135 performs a process of further combining the directed graph of the source code 1 which is the callee with the directed graph of the source code 3 which is the caller.

Moving to FIG. 16D, the enumeration unit 135 processes the rewriting rule “AC_E” with respect to the directed graph 6400. To execute. As a result, the enumeration unit 135 generates a directed graph 7000 by adding a subgraph 1700 starting from the node "λI & $ 2" 1701 that defines the "____ init__" function of the source code 1 to the directed graph 6500.

Moving to FIG. 16E, the enumeration unit 135 processes the rewriting rule “AC_E” for the directed graph 7000 2.1. 2.2. , And 2.3.1. To execute. As a result, the enumeration unit 135 adds an edge connecting the node "CL" 7111 to the node "IV" 7112 and an edge connecting the node "λI &" 7121 to the node "F" 7122 to the directed graph 7000. Further, the enumeration unit 135 adds an edge connecting the node "R &" 7131 to the node "IV" 7132 and an edge connecting the node "P" 7141 to the node "WM" 7142 to the directed graph 7000, and adds an edge connecting the node "R &" 7131 to the node "WM" 7142. To generate.

Moving to FIG. 16F, the enumeration unit 135 processes the rewriting rule “AC_E” with respect to the directed graph 7100. To execute. As a result, the enumeration unit 135 deletes the node "λI & $ 2" 7151 and the node "A &" 7161 from the directed graph 7000 to generate the directed graph 7200.

Further, the enumeration unit 135 processes the rewriting rule “AC_E” with respect to the directed graph 7200. , And the rewriting rule "unref_E" of type "D" is executed. As a result, the enumeration unit 135 deletes the node “R &” 7131, the nodes “λI &” 7211 and 7212, the nodes “CL” 7211 and 7222, and the node “RM” 7231 from the directed graph 7200. In addition, the enumeration unit 135 organizes the edges connected to each node to be deleted and generates a directed graph 7300.

Moving on to FIG. 16G, the enumeration unit 135 performs an enumeration process on the integrated directed graph 7300. In directed graph 7300, node "RI" 7311 with respect to the "send" function is referenced by node "A &" 7321. Node "A &" 7321 also refers to node "F" 7331. Therefore, the enumeration unit 135 enumerates the nodes having a calling relationship with the node "RI" 7311 related to the "send" function.

The enumeration unit 135 enumerates the node "F" 7341 and the node "IV" 7333 called by the node "F" 7331. In addition, the enumeration unit 135 enumerates the node "F" 7351 and the node "IV" 7343 that are further called by the node "F" 7341. Further, the enumeration unit 135 enumerates the node "λI &" 7353 and the node "IV" 7352 which are further called by the node "F" 7351.

Then, the enumeration unit 135 uses the enumerated nodes to generate candidate values of arguments to be passed to the "send" function included in the object "p". The enumeration unit 135 generates a candidate value including the character string "'Foo'" 7933 corresponding to the node "IV" 7333 and the character string "/ create / space /" 7943 corresponding to the node "IV" 7343. Further, the enumeration unit 135 includes, as candidate values, a character string "'http: //'" 7952 corresponding to the node "IV" 7352 and a variable "λI & Client.getResource.3" 7953 corresponding to the node "λI &" 7353. Include more.

Then, the output unit 136 outputs the output screen 7999 including the generated candidate value to the user's terminal through, for example, the communication unit 110.

[Processing flow]
Next, the processing in this embodiment will be described with reference to FIGS. 17 to 22. FIG. 17 is a flowchart showing an example of the analysis process in the first embodiment. As shown in FIG. 17, the acquisition unit 131 of the analysis device 100 waits until, for example, the communication unit 110 receives an instruction to start the analysis process (S100: No).

When the acquisition unit 131 determines that the start instruction has been accepted (S100: Yes), the acquisition unit 131 outputs a directed graph generation instruction regarding the function to be analyzed to the conversion unit 132, and specifies the function to be analyzed to the enumeration unit 135. Output the information to be done.

Upon receiving the output of the directed graph generation instruction, the conversion unit 132 starts the conversion process (S110). FIG. 18 is a flowchart showing an example of the conversion process in the first embodiment. As shown in FIG. 18, the conversion unit 132 reads the source code including the function to be analyzed from the source code DB 121 and converts it into a syntax tree (S111). Next, the conversion unit 132 initializes funcdic, which is a variable that stores a node, and graph, which is a variable that stores a graph (S112). For example, the conversion unit 132 initializes the fundic and graph.

Next, the conversion unit 132 converts the nodes of the generated syntax tree into graph elements (S113). The conversion unit 132 repeats the process until all the nodes are converted into graph elements (S114: No). When the conversion unit 132 converts all the nodes into graph elements (S114: Yes), the conversion unit 132 stores the directed graph as the conversion result in the original flow DB 123 and shifts to S120.

Returning to FIG. 17, the resolution unit 133 performs a resolution process on the stored directed graph (S120). FIG. 19 is a flowchart showing an example of the solution process in the first embodiment. First, the solution unit 133 enumerates the main nodes "λI &" included in the directed graph (S121), and applies the rewriting rule of the type "S" to each main node (S122). The solution unit 133 repeats the process for all the main nodes "λI &" (S123: No). When all the main nodes "λI &" are dealt with (S123: Yes), the solving unit 133 stores the directed graph which is the conversion result in the solved flow DB 124 and shifts to S130.

Returning to FIG. 17, the contraction unit 134 performs a contraction process on the stored resolved directed graph (S130). FIG. 20 is a flowchart showing an example of the reduction process in the first embodiment. First, the contraction unit 134 enumerates the main nodes "λI &" included in the directed graph (S131), and applies a rewriting rule of type "D" to each main node (S132). The contraction unit 134 repeats the process for all the main nodes “λI &” (S133: No). When all the main nodes "λI &" are dealt with (S133: Yes), the contraction unit 134 stores the directed graph as the conversion result in the contracted flow DB 126 and shifts to S140.

Returning to FIG. 17, the resolution unit 133 determines whether or not the directed graph has been updated by the resolution process and the contraction process (S140). When the solution unit 133 determines that the directed graph has been updated (S140: Yes), it returns to S120 and repeats the process.

When the solution unit 133 determines that the directed graph has not been updated (S140: No), it waits until the input of the candidate value is accepted (S150: No). When the input of the candidate value is accepted (S150: Yes), the enumeration unit 135 performs the enumeration process (S160).

FIG. 21 is a flowchart showing an example of the enumeration process in the first embodiment. The enumeration unit 135 determines whether or not there is a program to be called for the specified function (S161). When the enumeration unit 135 determines that there is no program to be called (S161: No), the enumeration unit 135 shifts to S162. On the other hand, when the enumeration unit 135 determines that there is a program to be called (S161: Yes), the enumeration unit 135 performs a join process (S170).

FIG. 22 is a flowchart showing an example of the joining process in the first embodiment. First, the enumeration unit 135 enumerates the callers of the function including the arguments or variables to be enumerated (S171). Next, the enumeration unit 135 refers to the rewriting rule DB 125 and applies the rewriting rule of the type “M” to the directed graph of the callee (S172).

Next, the enumeration unit 135 applies a rewriting rule of type "M" to the main node "λI &" included in the combined directed graph (S173). The enumeration unit 135 performs a resolution process for applying the rewriting rule of the type "S" to the node "λI &" included in the graph to which the rewriting rule of the type "M" is applied (S174). Further, the enumeration unit 135 performs a resolution process for applying the rewriting rule of the type "D" to the node "λI &" (S175).

Then, the enumeration unit 135 determines whether or not the directed graph combined by the resolution process and the contraction process has been updated (S176). When it is determined that the combined directed graph has been updated (S176: Yes), the solving unit 133 returns to S174 and repeats the process.

When the enumeration unit 135 determines that the combined directed graph has not been updated (S176: No), the enumeration unit 135 returns to S172 and repeats the process until all the enumerated callers are dealt with (S177: No). When it is determined that all the callers have been dealt with (S177: Yes), the enumeration unit 135 returns to S161.

Returning to FIG. 21, the enumeration unit 135 enumerates the nodes for which the value is set for the specified function (S162). Next, the enumeration unit 135 searches for the F node included in the directed graph in the direction opposite to the data flow and the processing flow (S163). Then, the enumeration unit 135 repeats the search until it reaches the IV node (S164: No).

When the enumeration unit 135 reaches the IV node (S164: Yes), the enumeration unit 135 converts the enumerated nodes into a character string (S165), and shifts to S190.

Then, the output unit 136 outputs the candidate values of the arguments or variables stored in the value candidate DB 127 through the communication unit 110 (S190), and ends the process.

[effect]
As described above, in the analysis method in this embodiment, the computer generates a directed graph representing the data flow and the processing flow in the function of the program. In the analysis method, a computer performs dynamic type reference resolution and name resolution using a data flow and a processing flow. In the analysis method, the computer contracts the directed graph for each function of the program. Further, in the analysis method, the computer searches the data processing flow after matching the solution results related to the function for which the analysis instruction has been received among the contracted results. As a result, it is possible to suppress erroneous enumeration and omission of enumeration when analyzing the source code of the dynamically typed language.

Further, in the analysis method, the computer generates a three-part graph showing the connection relationship between the first node corresponding to the processing, the second node corresponding to the data reference, and the third node corresponding to the data setting. .. Further, in the analysis method, the computer generates a three-part graph including a node passing the environment as the second node and the third node. Thereby, the data flow and the processing flow can be easily specified.

In the analysis method, the computer combines the directed graph with a part or all of the directed graph generated from the source code that is the call destination of the function that received the analysis instruction, and uses the combined new directed graph to obtain the data. Search the processing flow. Thereby, the data flow and the processing flow can be specified including other source codes having a calling relationship.

Further, in the analysis method, the computer outputs the searched value candidates to be passed to the function, so that the candidate values can be easily known.

Further, in the analysis method, the computer identifies the class to which the function belongs by enumerating the setting value candidates of the object referred to when the function is called. As a result, candidate values can be enumerated without erroneous enumeration and omission of enumeration.

Furthermore, the analysis method can shorten the analysis time because the computer traces the data flow by limiting the search range to the part of the directed graph related to the function in which the variable / argument to be listed as the set value candidate appears. ..

By the way, although the examples of the present invention have been described so far, the present invention may be implemented in various different forms other than the above-mentioned examples. For example, the analysis device 100 shown in the first embodiment enumerates the values of the arguments of the functions included in the program, and uses the same functional blocks as those in the first embodiment, and follows the same processing flow as in the first embodiment. , You can also list the settings for variables in the function. Therefore, a configuration in which the analysis device 100 enumerates the set values for the variables in the function will be described.

The source code to be analyzed in this embodiment will be described with reference to FIGS. 23 and 24. FIG. 23 is a diagram showing an example of the source code conversion result in the second embodiment. The source code 4 shown by reference numeral 4000 is the source code of the class “Calc” that defines the function “Calc.abs” that returns the return value “n” for the arguments “self” and “n”.

FIG. 24 is a diagram showing another example of the source code conversion result in the second embodiment. The source code 5 shown by reference numeral 5000 is the source code of the class “Calc” that defines the function “Calc.get” that returns “self.n” as a return value for the arguments “self” and “x”. In this embodiment, an example of enumerating the candidate values of the values set in the variable "n" in the function "Calc.get" will be described.

As shown in FIG. 24, the function "Calc.get" calls the function "Calc.abs" included in the source code 4. Therefore, the analysis device 100 generates a directed graph 5100 from the source code 5 and integrates it with the directed graph 4100 generated from the source code 4.

25A and 25B are diagrams showing an example of the enumeration process and the integrated process of the source code 5. As shown in FIG. 25A, the enumeration unit 135 of the analysis device 100 applies the rewriting rule “AC_E” of the type “M” to the directed graph 8100, which integrates the directed graph 4100 and the directed graph 5100, to obtain the directed graph 8200. Generate.

Next, the enumeration unit 135 enumerates the node "ID" 8211 and the node "ID" 8221 as nodes for passing the parameters related to the variable "n" to the node "WM" 8201 related to the variable "n".

Moving on to FIG. 25B, the enumeration unit 135 enumerates the node "λI &" 8231 as a node that passes the parameter related to the variable "n" to the node "ID" 8211. Further, the enumeration unit 135 enumerates the node "F" 8222 as a node that passes the parameter related to the variable "n" to the node "ID" 8221. Further, the enumeration unit 135 enumerates the node "λI &" 8231 as a node that passes the parameter related to the variable "n" to the node "F" 8222.

Then, the enumeration unit 135 generates a candidate value of the value set in the variable "n" by using the enumerated nodes. The enumeration unit 135 enumerates the value “λI & Calc.get.3” 8911 corresponding to the node “ID” 8211 as a candidate value. Further, the enumeration unit 135 enumerates the value "F-λI & Calc. Get.3" 8921 corresponding to the node "ID" 8221 as a candidate value.

Then, the output unit 136 outputs an output screen 8999 including the listed candidate values to the user's terminal through, for example, the communication unit 110.

In this way, the analysis device 100 can also list the setting values for the variables in the function included in the program.

[system]
Further, each component of each of the illustrated parts does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or part of it is functionally or physically distributed / integrated in any unit according to various loads and usage conditions. Can be configured. For example, the solution unit 133 and the contraction unit 134 may be integrated. Further, the illustrated processes are not limited to the above order, and may be performed simultaneously or in a different order as long as the processing contents do not contradict each other.

Further, the various processing functions performed by each device may execute all or any part thereof on the CPU (or a microcomputer such as an MPU or a MCU (Micro Controller Unit)). Further, various processing functions may be executed in whole or in any part on a program analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or on hardware by wired logic. Needless to say, it's good.

By the way, various processes described in each of the above embodiments can be realized by executing a program prepared in advance on a computer. Therefore, in the following, an example of a computer that executes a program having the same functions as those in each of the above embodiments will be described. FIG. 26 is a diagram showing an example of a computer that executes an analysis program.

As shown in FIG. 26, the computer 300 includes a CPU 370 that executes various arithmetic processes, an input device 310 that accepts data input, and an output device 320. Further, the computer 300 has a medium reading device 340 for reading a program or the like from a storage medium, and a communication interface (IF) 330 for exchanging data between various devices. Further, the computer 300 has a RAM 360 for temporarily storing various information and a hard disk device (HDD) 350. Further, each device 310-370 is connected to the bus 380.

The HDD 350 stores an analysis program 351 having the same functions as the processing units of the acquisition unit 131, the conversion unit 132, the resolution unit 133, the contraction unit 134, the enumeration unit 135, and the output unit 136 shown in FIG. .. Further, the HDD 350 stores the source code DB 121, the class definition DB 122, the original flow DB 123, the resolved flow DB 124, the rewriting rule DB 125, the contracted flow DB 126, and the value candidate DB 127. Further, the HDD 350 stores various data for realizing the analysis program 351. The input device 310 receives, for example, input of various information from the administrator of the computer 300. The output device 320 displays various screens to the administrator of the computer 300, for example. The communication IF 330 is connected to a network (not shown) and exchanges various information with various devices.

The CPU 370 performs the analysis process 371 by reading out each program such as the analysis program 351 stored in the HDD 350, expanding the program into the RAM 360, and executing the program. Further, these programs can make the computer 300 function as the acquisition unit 131, the conversion unit 132, the resolution unit 133, the contraction unit 134, the enumeration unit 135, and the output unit 136 shown in FIG.

The analysis program 351 does not necessarily have to be stored in the HDD 350. For example, the computer 300 may read and execute a program stored in a storage medium that can be read by the computer 300. The storage medium that can be read by the computer 300 is, for example, a portable recording medium such as a CD-ROM, a DVD (Digital Versatile Disk), or a USB (Universal Serial Bus) memory, a semiconductor memory such as a flash memory, a hard disk drive, or the like. .. Further, the analysis program may be stored in a device connected to a public line, the Internet, a LAN, or the like, and the computer 300 may read the analysis program from these and execute the analysis program.

100 Analytical device 110 Communication unit 120 Storage unit 121 Source code DB
122 Class definition DB
123 original flow DB
124 Solved flow DB
125 Rewriting Rule DB
126 Contracted flow DB
127 Value Candidate DB
130 Control unit 131 Acquisition unit 132 Conversion unit 133 Resolution unit 134 Reduction unit 135 Enumeration unit 136 Output unit

Claims (8)

In the analysis method that statically analyzes a program of a dynamically typed language
Generate a directed graph that represents the flow of data and the flow of processing in the function of the program.
Using the data flow and the processing flow, perform dynamic type reference resolution and name resolution.
The directed graph is reduced for each function of the program.
Among the reduced directed graphs , the computer performs the process of combining the directed graphs of the caller and called program related to the function that received the analysis instruction and searching the data processing flow using the combined new directed graph. The analysis method to perform. The generated process generates a three-part graph showing the connection relationship between the first node corresponding to the process, the second node corresponding to the reference of the data, and the third node corresponding to the setting of the data. The analysis method according to claim 1, wherein the analysis method is characterized by the above. The analysis method according to claim 2, wherein the generated process generates the three-part graph including the node passing the environment as the second node and the third node. The analysis method according to any one of claims 1 to 3 , further comprising a process of outputting a candidate of a value passed to the function, which is searched by the search process. The search process corresponds to any one of claims 1 to 4 , characterized in that the class to which the function belongs is specified by enumerating the setting value candidates of the object referred to when the function is called. The described analysis method. The analysis method according to claim 5 , wherein the search process limits the search range to a portion of the directed graph related to a function in which the variable / argument to be enumerated of the set value candidate appears. A generator that generates a directed graph that expresses the flow of data and the flow of processing in a program function,
A resolution unit that executes dynamic type reference resolution and name resolution using the data flow and the processing flow.
A contraction part that contracts the directed graph for each function of the program,
Among the reduced directed graphs , a search unit that combines the directed graphs of the caller and called program related to the function that received the analysis instruction and searches the data processing flow using the combined new directed graph. Analytical equipment including. On the computer
Generate a directed graph that represents the flow of data and the flow of processing in the function of the program.
Using the data flow and the processing flow, perform dynamic type reference resolution and name resolution.
The directed graph is reduced for each function of the program.
Among the reduced directed graphs, the directed graphs of the caller and callee programs related to the function that received the analysis instruction are combined, and the combined new directed graph is used to search the data processing flow. Analysis program.

Images