WO2015003555A1

WO2015003555A1 - Error detection method and device for program

Info

Publication number: WO2015003555A1
Application number: PCT/CN2014/080696
Authority: WO
Inventors: 衷璐洁; 霍玮; 李丰; 陈聪明; 冯晓兵; 张兆庆
Original assignee: 华为技术有限公司
Priority date: 2013-07-08
Filing date: 2014-06-25
Publication date: 2015-01-15
Also published as: CN104281519A

Abstract

The present invention is applicable to the field of computer technologies. Disclosed are an error detection method and device for a program. The error detection device for a program analyzes a to-be-analyzed program to obtain program analysis information, acquires an error attribute scale value of each constant value point in the to-be-analyzed program according to the program analysis information, and performs error prompt on an invocation point corresponding to a constant value point having an error attribute scale value being the dangerous attribute in the to-be-analyzed program. Error detection for a program is changed into calculation of an error attribute scale value, which simplifies an error detection process, and can improve error detection efficiency of the program. When the program analysis information is obtained, the error detection device for the program can consider multiple sensibilities of the to-be-analyzed program, to obtain entire information of each program point, so that the obtained error attribute scale value is more accurate, and error detection accuracy for the to-be-analyzed program is improved.

Description

Method and device for error detection of a program The application is submitted to the Chinese Patent Office on July 8, 2013, and the application number is

201310284541.7, the entire disclosure of which is hereby incorporated by reference in its entirety in its entirety in the the the the the the the the the the Technical field

The present invention relates to the field of computer technology, and in particular, to a method and device for detecting errors in a program. Background technique

Program error detection methods can be divided into dynamic and static categories. Dynamic methods need to run programs, rely on test cases, and only find errors on the executed path, and the construction of test cases is still an open problem. The static method directly acts on the program source code, can detect all the paths in the program, and does not need test cases, which has better completeness.

In methods and tools for detecting static analysis, methods such as flow analysis, theorem proving, and model detection are often used. The limitations of the theorem proving and the method of model detection lead to the poor performance of such methods or tools. For example, the length of the verification condition will increase exponentially with the size of the program, and the space-time overhead of traversing the program state space exhaustively Very large, etc., and formal methods often require user involvement, requiring users to use a predefined specification language to label or describe the source program. These annotations or property descriptions are often difficult to write. The stream analysis method based on compiler technology is an effective method to improve the correctness of the software. The compiler can not only translate and optimize the program, but also perform the most basic program correctness check. However, the traditional flow analysis technology is mainly for compiler optimization, and it is necessary to ensure the correctness of the compiled results, and the results are conservative. However, for the wrong detection, the analysis result obtained by the flow analysis cannot meet the accuracy requirement of the detection, and brings a large number of false positives and potential false negatives, thereby affecting the detection accuracy.

Summary of the invention

The embodiment of the invention provides a method and a device for detecting errors of a program, which can improve the efficiency of error detection of the program.

A first aspect of the embodiments of the present invention provides a method for detecting an error of a program, including:

Analyze the analysis program to obtain a program analysis letter for each program point in the program to be analyzed Interest rate

Determining an error attribute type of an error type for detecting the program to be analyzed;

Acquiring, according to the program analysis information, an error attribute value of each fixed value point in the program to be analyzed, where the error attribute value corresponds to the determined error attribute;

The reference point corresponding to the fixed value point with the dangerous attribute value of the error attribute value is incorrectly prompted.

In a first possible implementation manner of the first aspect of the embodiment, the program analysis information includes information for reading side effects and/or writing side effects, and the analyzing the program is analyzed to obtain each of the to-be-analyzed programs. Program analysis information of the program point, including:

Characterizing the program to be analyzed as a static single assignment SSA;

Determining, by the SSA form, information about read side effects and/or writing side effects of the dereferenced program points in the program to be analyzed, the information of the read side effects being the to-be-analyzed at the dereferenced program point Element information in the program, the information of the write side effect is element information in the program to be analyzed that needs to be written at the dereferenced program point.

With reference to the first aspect of the embodiment of the present invention or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect of the embodiment, the program to be analyzed includes the first fixed value Point, the first fixed value point does not call a function, and the error attribute value of each fixed value point in the to-be-analyzed program in the determined error attribute is obtained according to the program analysis information, and specifically includes:

Obtaining a set of elements affecting the first fixed point in the program analysis information of the respective program points;

Determining an error attribute lattice value of the first fixed value point according to the set of elements corresponding to the first fixed value point.

With reference to the first aspect of the embodiment of the present invention or the first possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect of the embodiment of the present invention, if the to-be-analyzed program includes the second predetermined a value point, the second fixed value point calling function, the obtaining, according to the program analysis information, an error attribute value of each fixed value point in the to-be-analyzed program under the determined error attribute, specifically:

The first error attribute value of the reference input of the called function at the second fixed point is determined as: The error attribute value of the actual parameter variable or the global quantity in the main adjustment function at the second fixed value point; calculating the second error of the fixed value output point corresponding to the called function according to the first error attribute value Attribute value

The second error attribute value is used as the error attribute value of the second fixed point.

With reference to the third possible implementation manner of the first aspect of the embodiments of the present invention, in a fourth possible implementation manner of the first aspect of the embodiments, The second error attribute value of the fixed value output point corresponding to the called function, specifically includes:

Determining a summary of the called function, the summary including a relationship between the first error attribute value of the reference input and the called function, and the second error attribute value being adjusted by the Information affected by the function;

If the second error attribute value is not affected by the first error attribute value of the reference input, directly calculating the second error attribute according to the information that the second error attribute value is affected by the called function Value

If the second error attribute value is affected by the first error attribute value of the reference input, the second error is calculated according to the relationship between the first error attribute value of the reference input and the called function Attribute value.

A second aspect of the embodiments of the present invention provides a program error detecting apparatus, including:

a program analysis unit, configured to analyze the program to be analyzed to obtain program analysis information of each program point in the program to be analyzed;

a attribute determining unit, configured to determine an error attribute of an error type that detects the program to be analyzed;

a lattice value calculation and propagation unit, configured to acquire, according to the program analysis information obtained by the program analysis unit, an error attribute value of each fixed value point in the to-be-analyzed program, the error attribute lattice value and the attribute lattice determining unit The determined error attribute corresponds to;

The error prompting unit is configured to calculate, according to the lattice value, an error attribute value obtained by the propagation unit, and perform an error prompt on the reference point corresponding to the fixed value point of the fault attribute value having a dangerous attribute.

In a first possible implementation manner of the second aspect of the embodiment of the present invention, the program analysis information includes information for reading a side effect and/or a write side effect, and the program analyzing unit specifically includes:

a characterization unit, configured to describe the program to be analyzed as a static single assignment SSA; a side effect information determining unit, configured to determine information of a read side effect and/or a write side effect of the program point dereferenced in the program to be analyzed in the SSA form depicted by the characterization unit, the information of the read side effect being the dereferenced The element information in the program to be analyzed that needs to be read at the program point, and the information of the write side effect is element information in the program to be analyzed that needs to be written at the dereferenced program point.

With reference to the second aspect of the embodiment of the present invention or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect of the embodiment, the program to be analyzed includes the first fixed value. Point, the first fixed value point does not call a function, and the lattice value calculation and propagation unit specifically includes: an element set obtaining unit, configured to acquire, in the program analysis information of the program point, the first fixed value point Collection of elements;

a first trellis value determining unit, configured to determine an error attribute lattice value of the first fixed value point according to the element set of the first fixed value point.

With reference to the second aspect of the embodiment of the present invention or the first possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect of the embodiment of the present invention, if the program to be analyzed includes the second a value point, the second fixed value point calling function, the lattice value calculation and propagation unit specifically includes: a reference lattice value determining unit, configured to input a reference of the called function at the second fixed value point The error attribute value is determined as: an error attribute value of an actual parameter or a global quantity in the main adjustment function at the second fixed value point;

a second value calculation unit, configured to calculate a second error attribute value of the fixed value output point corresponding to the called function according to the first error attribute value;

And outputting a value determining unit, configured to use the second error attribute value as an error attribute value of the second fixed point corresponding to the main function.

With reference to the third possible implementation manner of the second aspect of the embodiment of the present invention, in a fourth possible implementation manner of the second aspect of the embodiment, the second value calculation unit specifically includes:

a summary determining unit, configured to determine a summary of the called function, where the summary includes a relationship between a first error attribute value of the reference input and the called function, and the second error attribute Information whose value is affected by the called function;

a first calculating unit, configured to: if the second error attribute value is not affected by the first error attribute value of the reference input, directly receive the called function according to the second error attribute value The information of the ringing is calculated to obtain the second error attribute value;

a second calculating unit, configured to: if the second error attribute value is affected by the first error attribute value of the reference input, between the first error attribute value input according to the reference and the called function The relationship is calculated to get the second error attribute value.

In the method of the embodiment, the error detecting device of the program analyzes the program analysis information obtained by analyzing the analysis program, and obtains the error attribute value of each fixed value point in the program to be analyzed according to the program analysis information, and treats the error in the analysis program. The attribute value has a reference point corresponding to the fixed value point of the dangerous attribute for error prompting. Mainly to convert the detection of program error into the calculation of the error attribute value, simplify the process of error detection, improve the error detection efficiency of the program; and calculate the information according to the program analysis information of the program point when calculating the error attribute value. When the program analysis information is obtained, the error detection device of the program can take into account the various sensitivities of the program to be analyzed, obtain complete information of each program point, and make the obtained error attribute value more accurate, and improve the program to be analyzed. Error detection accuracy.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flowchart of a method for detecting errors of a program according to an embodiment of the present invention;

2 is a schematic diagram of a program to be analyzed in an embodiment of the present invention;

3 is a flowchart of another method for detecting errors in a program according to an embodiment of the present invention;

4 is a flow chart of a method for determining an error attribute value in an embodiment of the present invention;

FIG. 5 is a flowchart of another method for determining an error attribute value in an embodiment of the present invention; FIG.

6 is a schematic structural diagram of determining an error attribute lattice value of a second fixed value point in the embodiment of the present invention; FIG. 7 is a schematic diagram of a program to be analyzed in an application embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an error detecting apparatus of a program according to an embodiment of the present invention; FIG. 9 is a schematic structural diagram of an error detecting apparatus of a program according to an embodiment of the present invention; A partial structural diagram of an error detecting device of a program provided; FIG. 11 is a schematic structural diagram of an error detecting apparatus of a program according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the invention provides a method for detecting errors of a program, which mainly performs error detection on the analysis program by a static method. The method in this embodiment is a method performed by the error detection device of the program, and the flowchart is as shown in FIG. 1 . Show, including:

Step 101: Perform analysis on the analysis program to obtain program analysis information of each program point in the program to be analyzed, where one program is called a program point between two lines, and program analysis information of the program point is obtained after analysis. The information related to the program point in the program may include element information of the program to be analyzed, such as an actual variable, a global quantity, a function, or a statement.

Here, when analyzing the analysis program, sensitive analysis can be performed, which can include at least one of the following analysis methods: flow-sensitive program analysis, context-sensitive program analysis, domain-sensitive program analysis, and path-sensitive program analysis. Etc., in the flow-sensitive program analysis, will consider the order of the statements in the program, generally calculate the information at each program point; in the domain-sensitive program analysis, will distinguish different domain members in a structure; When performing context-sensitive program analysis, it distinguishes the information of the same function at different call points; when performing path-sensitive program analysis, it distinguishes the information of predicate of different branch conditions.

In the embodiment of the present invention, in order to improve the accuracy of the program analysis, the error detecting device of the program can consider a plurality of sensitive program analysis, so as to obtain complete information related to each program point, such as program side reading side effects and/or Or write side-effect information, other element information in the program that affects the program point, and so on. The information for reading side effects refers to other element information in the program that needs to be read at the program point, and can be recorded as μ ( a ) {xl , x2 ... ... xn} , where a is the point of the program The setting parameter, xi (i is a natural number from 1 to n), an element that can be read; the information for writing side effects refers to other element information in the program that needs to be written at the program point, which can be written as X ( a ) { Yl , y2 ... ... ym} , where yi is a natural number from 1 to 111) is an element that may be written.

For example, in the program shown in Figure 2, the information on the read side effects at program point 7 (ie, line 7) is: μ ( q ) {x, y} , used to indicate that the fixed value parameter q is the value of the read x or y.

Step 102: Determine an error attribute of the error type to be detected by the analysis program. The error attribute is a description of the attribute type of the error type of the program. The user can define the error type of the program according to actual needs, such as null pointer reference, unassigned value, memory leak, etc. Each error attribute can include multiple values. The error attribute value, such as the error attribute value of the error type referenced by the null pointer, can include: null (NULL), non-null (U ULL ), possibly empty ( MAYNULL ), and so on. In this embodiment, the error detecting device of the program may provide an interface for the user to select an error attribute type of the error type, and receive an error attribute of the error type selected by the user.

Step 103: Acquire an error attribute value of each fixed value point in the to-be-analyzed program according to the program analysis information obtained in step 101, where the error attribute lattice value corresponds to the error attribute type determined in step 102, where the fixed value point is A type of program point used to set an manipulated variable.

Since the complete information related to each program point has been obtained in step 101, the determined error attribute value can comprehensively take into account various factors in the program to be analyzed. Specifically, the error detecting device of the program can be first according to step 101. The program analysis information obtained is used to determine the value of the actual parameter variable or the global value of the error attribute associated with the fixed point, and then combine the relationship between the actual variable (or global quantity) and the fixed point, and according to the The relationship is calculated between the error attribute values to get the error attribute value of the fixed point.

For example, when the type of the error attribute is a null pointer reference, in the program shown in Figure 2, the information on the read side effect of the fixed point 7 (ie, at program point 7) is: μ ( q ) {x, y } , the actual parameter variables associated with the fixed parameter q are x and y. Then, according to the statements in lines 3 to 6, the value of the fixed point q is X or y, where the error attribute values of X and y can be For NULL, UNNULL, or MAYNULL, the error attribute value of the fixed point q is NULL, UNNULL, or MAYNULL.

Step 104: Perform an error prompt on the reference point corresponding to the fixed value point of the fault attribute value in the analysis program with the dangerous attribute. In step 103, the error attribute values of the plurality of fixed value points are obtained. The attributes of the error attribute values are different. For example, the attribute of NULL is mandatory, the attribute of UNNULL is safe, and the attribute of MAYNULL is dangerous. In the example, the error detection device of the program can make an error indication for the other dangerous points corresponding to the fixed value points, such as the reference points, for the dangerous and potentially dangerous error attribute values, and can correspond to the two fixed points of the necessary danger and the possible danger. The error point of the reference point is different, so that the user can re-analyze the analysis program according to the error prompt. Correct the operation. The reference point is the point of the actual parameter or the global quantity referenced by the fixed value operation variable at the specified value point, that is, the use point of the operation variable, which can be used to check whether the fixed value of the operation variable is dangerous.

It should be noted that there is no absolute order relationship between the above steps 102 and 101, and they may be executed simultaneously or sequentially. The specific implementation method shown in FIG. 1 is only one of the specific implementation methods.

It can be seen that, in the method of the embodiment, the error detecting device of the program analyzes the analysis program to obtain the program analysis information, and obtains the error attribute value of each fixed value point in the program to be analyzed according to the program analysis information, and treats the analysis program in the analysis program. The error attribute value has a reference point corresponding to the fixed value point of the dangerous attribute for error indication. It mainly converts the detection of program errors into the calculation of the error attribute value, which simplifies the process of error detection, thereby improving the error detection efficiency of the program; and because the calculation error attribute value is based on the program analysis information of the program point. Calculated, and when the program analysis information is obtained, the error detection device of the program can take into account the various sensitivities of the program to be analyzed, obtain complete information of each program point, and make the obtained error attribute value more accurate, and improve the treatment. Analyze the error detection accuracy of the program.

In a specific embodiment, in order to further improve the error detection accuracy and speed of the program, the error detecting device of the program may be implemented by performing the following steps in the analysis in the above step 101. The flowchart is as shown in FIG. , including:

A1 : Characterize the program to be analyzed as a Static Single Assignment (SSA).

In the form of SSA, different values of the same manipulated variable are treated as different variables, which can ensure that each operating variable reference in the program to be analyzed has only a unique variable value, that is, the SSA can represent the basis of the fixed value reference relationship. By introducing different variable names to distinguish the fixed values of the same operating variable at different program points, it is possible to distinguish the fixed value of the same operating variable in the source program at different program points, so as to achieve the flow-sensitive program analysis effect. For example, when the manipulated variable q is first fixed, it is treated as ql, the second fixed value is treated as q2, and so on.

B 1: Determine the read side effect and/or write side effect information of the dereferenced program point in the SSA form to be analyzed, wherein the dereference can be represented by *p, which is used to take the pointer to the content of the address, and read The side effect information refers to the element information in the program to be analyzed that needs to be read at the dereferenced program point, and the information written by the side point is the element in the program to be analyzed that needs to be written at the program point of the reference program. Information. In general, program points with information about writing side effects are call points in the program, and need to be set by calling other called functions as fixed value parameters. Program points with read side effect information are directly referenced in the program. The parameter or global quantity is set as a fixed value parameter. Thus, in determining the side effects of read/write, a context sensitive analysis of a program point is required to analyze other information that affects the context of the program point.

It should be noted that, in the process of analyzing the program to be analyzed, the error detecting device of the program may also describe the program to be analyzed in the form of static single assignment as a set of multiple elements, and the set of elements refers to the elements constituting the program to be analyzed. A collection, which may include an operation variable set, a function set, an expression set, and a statement set, wherein the expression set includes a direct variable operation, an operation expression, and a function expression, and the statement set includes a branch statement, a jump statement, and an assignment statement. Wait.

For example, in the program shown in FIG. 2, after the program is depicted as the SSA form, the fixed operations of the 4th line and the 6th line are ql and q2; the program variable is obtained by the program variable {ql, q2, *q}, The set of statements is {if ( *x>*y ), else} , and the set of functions is {ql=x, q2=y}; where the information about the read side of the program point dereferencing *q is: μ ( q ) {x , y}.

In another specific embodiment, the error detection device of the program may obtain the value of the error attribute in the step 103, and may be obtained according to the actual situation of the program to be analyzed, and may specifically include the following situations:

(1) The program to be analyzed includes a first fixed value point, and the first fixed value point does not call the function. Referring to FIG. 4, the error detecting device of the program can implement the calculation of the error attribute value according to the following steps:

A2: Obtaining a set of elements affecting the first fixed point in the program analysis information of each program point obtained in step 102. Specifically, since the program analysis information of each program point has been obtained in step 101, error detection of the program is performed. The device can find a set of elements in the program analysis information that can affect the first fixed point. In this embodiment, the function F _relat can be defined to establish an association between the error attribute and the set of elements in the program to be analyzed, that is, Find out which elements in the program to be analyzed are associated with the calculation of the incorrect attribute value of the first fixed point.

B2: Determine the error attribute value of the first fixed point according to the set of elements of the first fixed point in the program to be analyzed.

Specifically, the error detecting device of the program may first determine an actual attribute variable or a global quantity of the incorrect attribute value associated with the first fixed point; and then combine the actual variable (or global quantity) with the fixed point The relationship, and thus the error attribute value of the first fixed point is obtained by calculation between the incorrect attribute values. In this embodiment, when performing this step, the functions F _meet and F _n (the parallel operation) may be defined to perform calculation between the error attribute values; and the lattice value mapping function F _ato is defined to determine the program to be analyzed. The error attribute value of the various variables in the variable.

(2) The program to be analyzed includes a first fixed value point, and a second fixed value point, wherein the second fixed value point calls a function, and the second fixed value point includes a main adjustment function and a adjusted function. Referring to FIG. 5, the error detecting device of the program can obtain the error attribute value of the first fixed point according to the above steps A2 to B2, and obtain the error attribute value of the second fixed point according to the following steps:

A3: The first error attribute value of the reference input of the called function at the second fixed value (denoted as Use_In) is determined as: The error of the actual parameter or the global quantity in the main adjustment function at the second fixed point Attribute value. It can be written as Map (Actually—In(cs), Use— In ), where Map represents the mapping of the wrong attribute value, cs represents the call point, and Actual—In(cs) represents the function f _es called at the call point cs — The actual or global amount of _eallee . Specifically, the error detecting device of the program may obtain an actual parameter variable or a global quantity in the calling function according to the information of the writing side effect at the second fixed value point, thereby obtaining the first error attribute value.

B3: Calculate the second error attribute value of the fixed value output point (denoted as Def Out) corresponding to the called function according to the first error attribute value. It can be recorded as intra-compute ( f _{cs ca} n _ee , ActualIn_V _AL (cs)) , where intra-compute represents the calculation of the error attribute value in the process, Actualln_V _AI Xcs) is called at the call point cs The layer function f _es — the error attribute value of _eallee .

When the error detection device of the program calculates the second error attribute value, it can be implemented according to the following steps B31 to B33:

B31: determining a summary of the called function, and including, in the summary, a relationship between the first error attribute value of the reference input and the called function, specifically, the first error attribute value and each operation variable in the called function The relationship information between the error attribute values; the summary further includes information that the second error attribute value is affected by the called function, and specifically may be the second error attribute value and the error attribute of each operation variable in the called function Relationship information between values. When determining the digest, the error detecting device of the program can be found in the program analysis information obtained in the above step 101.

B32: If the second error attribute value is not affected by the first error attribute value of the reference input, the second error attribute value may be directly calculated according to the information that the second error attribute value is affected by the adjusted function. , that is, the value of the error attribute value of each operation variable in the called function Calculate the second error attribute value.

B33: If the second error attribute value is affected by the first error attribute value of the reference input, the second error attribute may be calculated according to the relationship between the input first error attribute value and the called function. The lattice value, that is, the second error attribute value obtained by referring to the first error attribute value of the output and the error attribute value of each of the other operation variables in the called function.

C3: The second error attribute value is used as the error attribute value of the second fixed point corresponding to the main function. Recorded as Map (ActualOut - V _AL (cs), Actual - Out (cs)), where ActualOut - V _AL (cs) represents the value of the error attribute passed by the calling function at the call point cs, Actual_Out(cs ) indicates that the fixed value output value of the function f _es — _eallee is called at the call point cs.

For example, as shown in FIG. 6, the error attribute value of the argument variable in the main function is passed to the reference input of the called function called by the main function, and according to the summary point of the digest function of the called function. Partially calculate the error attribute value of the fixed value output point in the called function, or directly calculate the error attribute value of the fixed value output point in the called function according to each relevant operation variable and statement in the called function, and calculate The obtained error attribute value is the error attribute value of the second fixed point corresponding to the main function.

(3) When the second set point is included in the program to be analyzed, the error detecting device of the program may obtain the error attribute value of the second fixed point according to the above steps A3 to C3, and details are not described herein. The error detection method of the program described in the embodiment of the present invention is described below with reference to a specific embodiment. The error type determined in this embodiment is a null pointer reference, and the error attribute value under the error attribute of the error type includes NULL. , U ULL, and MAYNULL, the program to be analyzed is shown in Figure 7, the error detection device of the program can analyze the program to be analyzed as shown in Figure 7 as follows:

(1) Program analysis of the analysis program

According to the above steps A1 to C1, the program to be analyzed can be described as SSA, wherein the operation variables are ql, q2 and pi to p5, and the information of the read side effect at the program point 7 is analyzed as follows: μ ( q ) {x , y} ; Assume that the memory space allocated by the malloc function at program point 16 is mem, then the information of the write side effect at program point 18 is: X ( p4 ) {a, b} ; the information of the write side effect at program point 20 is : x ( p5 ) {NULL, b} ; The information for the read side effect at program point 21 is: μ ( *p ) {NULL, a, *mem, b}, the information for the read side effect at program point 23 is: μ ( *p ) {NULL, a, *mem, b}. It can be seen that, in general, the program point with the information for writing side effects is the calling point of the program, and the program point with the information for reading the side effect does not call the program point of the function.

(2) Calculate the error attribute value corresponding to the determined error attribute (ie, the null pointer reference) First, since the program points 18, 20, and 25 are the call points of the program, determine the summary associated with the call points, and obtain the program. Point 18 and 20, that is, the reference input at the boo function is X and y, and the fixed value output parameter is q. The error attribute value of the reference input affects the error attribute value of the fixed value output parameter; and the program point 25 is the foo function. There are no reference output and fixed value output parameters, and the summary is empty.

Then, the error attribute value of the second fixed value included in the program is calculated, as shown in Table 1 below, and the error attribute value of the actual parameter variable of the calling function at the calling point is used as the reference input of the called function boo. The error attribute value, and then the error attribute value of the second fixed point is obtained according to the digest of the input function boo reference. Where 9 ₁₃₁₁₁ is the value of *9, which is obtained by the intersection or parallel operation of the error attribute values of the operation variables ql and q2, and can be used according to the corresponding program when determining the error attribute value of the actual parameter variable of the main function. Information on the side effects of writing is obtained.

Table 1 Error attribute value of the second fixed point

Calculate the error attribute value of each fixed value point (including the first fixed value point and the second fixed value point) included in the program, as shown in Table 2 below, and the error of the actual parameter variable of the calling key function at the calling point The attribute value is used as the error attribute value of the reference input in the boo of the called function, and then the error attribute value of the second fixed point is obtained according to the digest of the input function boo.

Error attribute value of each fixed point in the program

i 10 NULL Danger

2 14 U ULL not dangerous

3 16 MAYNULL Potential danger p4 18 UNNULL Not dangerous

5 20 MAYNULL May be dangerous

Pphi 21 MAYNULL May be dangerous

Pphi 23 UNNULL Not dangerous. It should be noted that for the 21st and 23rd lines of *p, according to the information of the write side effects at the two program points, the fixed value of the 21st line may have a null pointer reference error. ; and the statement associated with the program point of the 23rd line, that is, the statement of the 22nd line, there is no null pointer reference error at the fixed point of the 23rd line, mainly because the program point of the 22nd line is Belongs to the special control flow (that is, the return value when not p), it will update the error attribute value of p to be safe, because when p has an unsafe error attribute value, it will return directly, so the value of the 23rd line A null pointer reference error will not occur at the point.

(3) Error message

According to the above Table 2, the error attribute value of the program point 10 in the program to be analyzed is dangerous, and the dangerous point can be indicated at the program point 10, and the error attribute value at the program points 16, 20 and 21 may be dangerous, The program point 16 and the reference point 11 corresponding to the program point 20 and the reference point 11 corresponding to the program point 21 can be prompted for danger.

The error detection method of the above program is to detect the error type of the null pointer reference, and there are other error types in the actual application, such as the error detection method of the corresponding program such as unassigned or memory leak and the reference of the above null pointer. The error detection method is similar and will not be described here. A memory leak is a memory allocated at a program point, but it is not reclaimed at the end of the program. The embodiment of the present invention further provides a program error detecting device, wherein each unit can perform error detection according to the method in the above embodiment, and the structure of the device is shown in FIG.

The program analyzing unit 10 is configured to analyze the program to be analyzed to obtain program analysis information of each program point in the program to be analyzed; the program analysis information refers to the program in the program to be analyzed. Describe the information related to the program point.

The attribute determining unit 11 is configured to determine an error attribute of the error type for detecting the program to be analyzed.

The value calculation and propagation unit 12 is configured to acquire, according to the program analysis information obtained by the program analysis unit 10, an error attribute value of each fixed value point in the to-be-analyzed program, and the error attribute value and the attribute lattice are determined. The error attribute determined by unit 11 corresponds. The lattice value calculation and propagation unit 12 may first determine the error attribute value of the actual parameter variable or the global quantity associated with the fixed value point according to the program analysis information obtained by the program analysis unit 10, and then combine the actual parameter variable (or the global quantity). ) and the relationship between the fixed point, and the calculation between the error attribute values according to the relationship to obtain the error attribute value of the fixed point.

The error prompting unit 13 is configured to calculate, according to the lattice value, an error attribute value obtained by the propagation unit 12, and a reference point corresponding to a fixed value point having a dangerous attribute in the error attribute value in the to-be-analyzed program, for example, a reference Click the error message.

In the device of this embodiment, the lattice value calculation and propagation unit 12 obtains the error analysis grid value of each fixed value point in the program to be analyzed according to the program analysis information analyzed by the program analysis unit 10 to be analyzed by the program analysis unit, and is provided by the error prompting unit 13 An error message is given at the reference point corresponding to the fixed value point of the error attribute value in the analysis program that has a dangerous attribute. It mainly converts the detection of program errors into the calculation of the error attribute value, which simplifies the process of error detection, can improve the error detection efficiency of the program; and is calculated according to the program analysis information of the program point when calculating the error attribute value. When the program analysis information is obtained, the program analysis unit 10 can take into account various sensitivities of the program to be analyzed, obtain complete information of each program point, and make the obtained error attribute value more accurate, and improve the program to be analyzed. Error detection accuracy.

Referring to FIG. 9, in a specific embodiment, the error detecting device of the program may include the structure shown in FIG. 8, wherein the program analyzing unit 10 may specifically be configured by the characterization unit 110 and the side effect information determining unit 120. Part of the program analysis information to obtain the program point is information on side effects and/or side effects of reading, wherein:

a characterization unit 110, configured to describe the program to be analyzed as a static single-assignment SSA; the side-effect information determining unit 120 is configured to determine a program point dereferenced in the SSA-formed program to be analyzed by the characterization unit 110 Reading side effects and/or writing side effects, the read side effects The information refers to the element information in the program to be analyzed that needs to be read at the dereferenced program point, and the information of the write side effect is the program to be analyzed that needs to be written at the dereferenced program point. Elemental information in . Thus, the trellis calculation and propagation unit 12 determines the error attribute value of each of the fixed points based on the information of the read/write side effects determined by the side effect information determining unit 120.

Further, the characterization unit 110 included in the program analysis unit 10 may further describe the program to be analyzed in a static single assignment form as a set of multiple elements, where the set of elements includes an operation variable set, a function set, an expression set, and a statement. Collections, etc.

Referring to FIG. 10, in a specific embodiment, the error detecting device of the program may include a structure as shown in FIG. 8, wherein the first setting value is included if the program to be analyzed includes only the first fixed value. If the function is not called, the trellis calculation and propagation unit 12 can be implemented by the element set obtaining unit 120 and the first trellis determining unit 121; if the program to be analyzed further includes a second fixed point, the second fixed point Calling the function, the lattice value calculation and propagation unit 12 may further include a reference lattice value determining unit 122, a second lattice value calculating unit 123, and an output lattice value determining unit 124, where:

The element set obtaining unit 120 is configured to obtain, in the program analysis information of the program point analyzed by the program analyzing unit 10, a set of elements that affect the first fixed point.

The first trellis value determining unit 121 is configured to determine an error attribute cell value of the first fixed value point according to the element set of the first fixed value point in the to-be-analyzed program acquired by the element set obtaining unit 120. Thus, the error unit 13 can perform an error indication of the program according to the error attribute value of the first fixed point determined by the first value determining unit 121.

Specifically, the first trellis value determining unit 121 may first determine an actual attribute variable or a global quantity error attribute value associated with the first fixed value point; and then combine the actual parameter variable (or global quantity) with the first fixed value point. The relationship between the error attribute values is calculated according to the relationship, and the error attribute value of the first fixed point is obtained by calculation between the incorrect attribute values.

a reference lattice value determining unit 122, configured to determine a first error attribute value of the reference input of the called function at the second fixed value point as: an actual parameter variable in the main adjustment function at the second fixed value point or The global attribute's error attribute value. The reference lattice value determining unit 122 may analyze the obtained information of the write side effect at the second fixed value point corresponding to the main key function according to the program analyzing unit 10, and obtain an actual parameter variable or a global quantity in the main tuning function, thereby obtaining the first error. Attribute value.

a second trellis value calculation unit 123, configured to use the reference determined by the reference trellis value determining unit 122 Entering a first error attribute value, and calculating a second error attribute value of the fixed value output point corresponding to the called function.

The second trellis value calculation unit 123, when calculating the second error attribute value, may be implemented by the digest determination unit 1230, the first calculation unit 1231, and the second calculation unit 1232, where:

The summary determining unit 1230 is configured to determine a summary of the called function, and the summary includes a relationship between the first error attribute value of the reference input determined by the reference lattice value determining unit 122 and the called function, specifically And may be the relationship information between the first error attribute value and the error attribute value of each operation variable in the called function; and the second error attribute value is affected by the called function, specifically The relationship between the second error attribute value and the error attribute value of each operation variable in the called function. If the digest determined by the digest determining unit 1230 indicates that the second error attribute value is not affected by the first error attribute value of the reference input, the first calculating unit 1231 may directly receive the value according to the second error attribute value. The information affected by the adjusted function calculates a second error attribute value; if the digest determined by the digest determining unit 1230 indicates that the second error attribute value is affected by the first error attribute value of the reference input, Then, the second calculating unit 1232 calculates and calculates the second error attribute value according to the relationship between the first error attribute value input by the reference and the called function.

The above-mentioned digest determining unit 1230 can be obtained in the program analyzing information analyzed by the program analyzing unit 10, and the first calculating unit 1231 can obtain the second by calculating the error attribute value of each operation variable in the called function according to the instruction in the digest. The second attribute unit 1232 may obtain the second error attribute by calculating the first error attribute value of the output and the error attribute value of each of the other operation variables in the called function according to the indication in the digest. value.

The output trellis value determining unit 124 is configured to use the second error attribute value calculated by the first calculating unit 1231 or the second calculating unit 1232 in the second trellis calculating unit 123 as the second corresponding to the main function The value of the error attribute of the fixed point. Thus, the error unit 13 can perform an error indication of the program according to the second error attribute value determined by the output trellis value determining unit 124. The embodiment of the present invention further provides a program error detecting device, wherein each unit can perform error detection according to the method in the above embodiment, and the structure diagram is as shown in FIG. 11 , including respectively connected to the bus. The memory 20, the processor 21, the input device 23 and the output device 24, wherein: The memory 20 is used to store data input from the input device 23, and may also store information such as necessary files for processing the data by the processor 21; the input device 23 and the output device 24 are ports for communication of the error detecting device of the program with other devices, It can include devices that are external to the error detection device of the program such as monitors, keyboards, mice, and printers.

The processor 21 is configured to analyze the program to be analyzed to obtain program analysis information of each program point in the program to be analyzed; the program analysis information refers to information related to the program point in the program to be analyzed; Determining an error attribute type of the error type detected by the program to be analyzed; and acquiring an error attribute value of each fixed point in the to-be-analyzed program according to the program analysis information; and finally, according to the acquired error attribute value, The error attribute value has a reference point corresponding to the fixed value point of the dangerous attribute for error prompting.

When the processor 21 determines the error attribute value, first determines the error attribute value of the actual parameter variable or the global quantity related to the fixed value point according to the program analysis information, and then combines the actual parameter variable (or global quantity) with The relationship between the value points, and the calculation between the error attribute values according to the relationship to obtain the error attribute value of the fixed point.

Further, when the processor 21 analyzes the program to be analyzed, the analysis may be performed with sensitivity. Specifically, the information of the partial program analysis information, that is, the side effect of reading and/or the side effect of writing may be obtained according to the following steps, that is, the processor 21 firstly The program to be analyzed is depicted in the form of a static single assignment SSA; then information on the read side effects and/or write side effects of the dereferenced program points in the SSA form is determined, and the information of the read side effects refers to the solution The element information in the program to be analyzed that needs to be read at the referenced program point, and the information of the write side effect is element information in the program to be analyzed that needs to be written at the dereferenced program point. Thus, the processor 21 determines the error attribute value of each fixed point based on the determined read/write side effect information. Further, in the process of performing program analysis, the processor 21 may further describe the to-be-analyzed program in a static single-assignment form as a set of multiple elements, where the set of elements includes an operation variable set, a function set, an expression set, and a statement. Collections, etc.

Further, when determining the error attribute value, the processor 21 mainly has the following situations: (1) The first program point is included in the to-be-analyzed program, and the function is not called when the first value point is not: the processor 21, Specifically, the method is configured to obtain, in the program analysis information of each program point obtained by the analysis, a set of elements that affect the first fixed point, and according to the obtained first fixed point in the to-be-analyzed program. The set of the determinants determines the value of the error attribute of the first fixed point; specifically, the processor 21 may first determine the value of the actual parameter or the global value of the error attribute associated with the first fixed point; The relationship between the variable (or global quantity) and the fixed point, and the calculation between the error attribute values is performed according to the relationship, so that the error attribute value of the first fixed point is obtained by calculation between the incorrect attribute values.

(2) The program to be analyzed includes a first fixed point, and a second fixed point, the second fixed point calling function:

The processor 21 is further configured to determine, by using the reference input value of the called function at the second fixed value, a first error attribute value: an actual parameter variable or a global quantity in the main adjustment function at the second fixed value point The error attribute value; calculating a second error attribute value of the fixed value output point corresponding to the called function according to the first error attribute value input by the determined reference; and using the second error attribute value as The error attribute value of the second fixed value point corresponding to the main key function. Thus, the processor 21 can perform an error indication of the program according to the second error attribute value.

The processor 21 may obtain an actual parameter variable or a global quantity in the main adjustment function according to the information of the write side effect at the second fixed value obtained by the analysis, thereby obtaining the first error attribute value.

When the processor 21 calculates the second error attribute lattice value, it first determines a summary of the called function, where the summary includes a relationship between the first error attribute value of the reference input and the called function, specifically Is the relationship information between the first error attribute value and the error attribute value of each operation variable in the called function; and the second error attribute value is affected by the called function, specifically The relationship between the second error attribute value and the error attribute value of each operation variable in the called function. If the digest indicates that the second error attribute value is not affected by the first error attribute value of the reference input, the processor 21 may directly receive the information affected by the called function according to the second error attribute value. Calculating a second error attribute value; if the second summary indicates that the second error attribute value is affected by the first error attribute value of the reference input, the processor 21 inputs the first according to the reference The relationship between the error attribute value and the called function is calculated to obtain a second error attribute value.

The processor 21 may obtain a digest in the analyzed program analysis information; and may use an error attribute value of each operation variable in the called function according to an indication related to the fixed value output point of the called function in the digest. Calculating the second error attribute value; or according to the indication of the summary, the first error attribute value output by reference and the error attribute of each of the other operation variables in the called function The calculation of the personality value yields the second error attribute value.

A person skilled in the art can understand that all or part of the steps of the foregoing embodiments can be completed by a program to instruct related hardware. The program can be stored in a computer readable storage medium. The storage medium can include: Read only memory (ROM), random access memory (RAM), disk or optical disk, etc.

The foregoing detailed description of the error detection method and apparatus of the program provided by the embodiment of the present invention is only for helping to understand the method of the present invention and its core idea; and, for a person of ordinary skill in the art, according to the present invention The present invention is not limited by the scope of the present invention.

Claims

Rights request

1. A program error detection method, characterized by including:

Analyze the program to be analyzed to obtain program analysis information for each program point in the program to be analyzed;

Determine the error attribute lattice of the error type detected for the program to be analyzed;

Obtain the error attribute grid value of each fixed value point in the program to be analyzed according to the program analysis information, and the error attribute grid value corresponds to the determined error attribute grid;

An error message is provided for the reference point corresponding to the fixed value point whose wrong attribute cell value has dangerous attributes.

2. The method of claim 1, wherein the program analysis information includes information on read side effects and/or write side effects, and the program to be analyzed is analyzed to obtain each program point in the program to be analyzed. Program analysis information, specifically including:

Characterize the program to be analyzed as a static single assignment SSA;

Determine information on the read side effects and/or write side effects of the dereferenced program point in the SSA form of the program to be analyzed, where the information on the read side effects refers to the information to be read at the dereferenced program point that needs to be analyzed The element information in the program, the information about writing side effects is the element information in the program to be analyzed that needs to be written at the dereferenced program point.

3. The method according to claim 1 or 2, the program to be analyzed includes a first fixed value point, the first fixed value point does not call a function, and the program to be analyzed is obtained according to the program analysis information. The error attribute grid values of each fixed value point in the program under the determined error attribute grid include:

Obtain the set of elements that affect the first fixed value point from the program analysis information of each program point;

The error attribute grid value of the first fixed value point is determined according to the element set corresponding to the first fixed value point.

4. The method according to claim 1 or 2, characterized in that, if the program to be analyzed includes a second fixed value point, the second fixed value point calls a function, and the analysis information is obtained according to the program The error attribute grid values of each fixed value point in the program to be analyzed under the determined error attribute grid specifically include:

The first error attribute grid value of the reference input of the called function at the second fixed value point is determined as: The error attribute grid value of the actual parameter variable or global variable in the calling function at the second fixed value point; according to the first error attribute grid value, calculate the second error of the fixed value output point corresponding to the called function Attribute value;

The second error attribute grid value is used as the error attribute grid value of the second fixed value point.

5. The method of claim 4, wherein calculating the second error attribute lattice value of the fixed value output point corresponding to the adjusted function according to the first error attribute lattice value specifically includes: Determine the summary of the called function, the summary includes the relationship between the first error attribute lattice value of the reference input and the called function, and the second error attribute lattice value is affected by the called function. Information about function effects;

If the second error attribute lattice value is not affected by the first error attribute lattice value referenced by the input, the second error attribute lattice value is calculated directly based on the information that the second error attribute lattice value is affected by the called function. value;

If the second error attribute grid value is affected by the first error attribute grid value of the reference input, the second error is calculated based on the relationship between the first error attribute grid value of the reference input and the called function. Attribute value.

6. A program error detection device, characterized by including:

A program analysis unit, used to analyze the program to be analyzed to obtain program analysis information for each program point in the program to be analyzed;

The attribute cell determination unit is used to determine the error attribute cell of the error type detected in the program to be analyzed;

The grid value calculation and propagation unit is used to obtain the error attribute grid value of each fixed value point in the program to be analyzed based on the program analysis information obtained by the program analysis unit, the error attribute grid value and the attribute grid determination unit Correspondence of determined wrong attributes;

An error prompting unit is configured to provide an error prompt for a reference point corresponding to a fixed value point whose erroneous attribute lattice value has a dangerous attribute based on the erroneous attribute lattice value obtained by the lattice value calculation and propagation unit.

7. The device according to claim 6, wherein the program analysis information includes information on read side effects and/or write side effects, and the program analysis unit specifically includes:

The characterization unit is used to characterize the program to be analyzed into the form of static single assignment SSA; the side effect information determination unit is used to determine the program to be analyzed in the SSA form described by the characterization unit. Information about the read side effects and/or write side effects of the dereferenced program point in the sequence, the information about the read side effects refers to the element information in the program to be analyzed that needs to be read at the dereferenced program point, the The information about writing side effects is the element information in the program to be analyzed that needs to be written at the dereferenced program point.

8. The device according to claim 6 or 7, characterized in that the program to be analyzed includes a first fixed value point, the first fixed value point does not call a function, and the grid value calculation and propagation unit specifically It includes: an element set acquisition unit, configured to acquire the element set that affects the first fixed value point from the program analysis information of the program point;

The first grid value determination unit is used to determine the error attribute grid value of the first fixed value point according to the element set of the first fixed value point.

9. The device according to claim 6 or 7, characterized in that, if the program to be analyzed includes a second fixed value point, the second fixed value point calls a function, and the grid value calculation and propagation unit specifically It includes: a reference grid value determination unit, used to determine the first error attribute grid value of the reference input of the called function at the second fixed value point as: the actual parameter variable in the calling function at the second fixed value point Or the wrong attribute value of the global variable;

The second grid value calculation unit is used to calculate the second error attribute grid value of the fixed value output point corresponding to the adjusted function according to the first error attribute grid value;

The output grid value determination unit is used to use the second error attribute grid value as the error attribute grid value of the second fixed value point corresponding to the main calling function.

10. The device according to claim 9, wherein the second grid value calculation unit specifically includes:

A summary determination unit, configured to determine a summary of the called function, where the summary includes the relationship between the first error attribute lattice value of the reference input and the called function, and the second error attribute lattice. Information that the value is affected by the called function;

The first calculation unit is used to directly calculate the second error attribute value according to the information that the second error attribute value is affected by the called function if the second error attribute value is not affected by the reference input first error attribute value. Calculate the second error attribute value;

A second calculation unit, configured to calculate the first error attribute cell value based on the reference input and the adjusted function if the second error attribute cell value is affected by the first error attribute cell value input by the reference. The relationship between the numbers is calculated to obtain the second error attribute grid value,