一句话：提出两阶段路径敏感静态分析，兼顾大规模可扩展性与内存泄漏检测精度。
工业级内存泄漏检测长期受困于精度与可扩展性矛盾：精确分析难扩展，不精确分析伤精度或召回。SMOKE 用两阶段化解：第一阶段以可扩展但不精确的分析生成简洁的候选泄漏路径，基于新稀疏程序表示 use-flow graph (UFG) 将问题转为多项式时间状态分析；第二阶段用更精确分析验证候选可行性，候选少且配有专用约束求解器。实验对高达 8MLoC 的工业项目可在 40 分钟内完成检查，平均误报率 24.4%，较现有研究与工业工具快 5.2–22.8 倍；在 29 个成熟基准中发现 30 个此前未知内存泄漏，均获开发者确认，其中一个获 CVE 编号。
Detecting memory leak at industrial scale is still not well addressed, in spite of the tremendous effort from both industry and academia in the past decades. Existing work suffers from an unresolved paradox - a highly precise analysis limits its scalability and an imprecise one seriously hurts its precision or recall. In this work, we present SMOKE, a staged approach to resolve this paradox. In the ?rst stage, instead of using a uniform precise analysis for all paths, we use a scalable but imprecise analysis to compute a succinct set of candidate memory leak paths. In the second stage, we leverage a more precise analysis to verify the feasibility of those candidates. The ?rst stage is scalable, due to the design of a new sparse program representation, the use-?ow graph (UFG), that models the problem as a polynomial-time state analysis. The second stage analysis is both precise and ef?cient, due to the smaller number of candidates and the design of a dedicated constraint solver. Experimental results show that SMOKE can ?nish checking industrial-sized projects, up to 8MLoC, in forty minutes with an average false positive rate of 24.4%. Besides, SMOKE is signi?cantly faster than the state-of-the-art research techniques as well as the industrial tools, with the speedup ranging from 5.2X to 22.8X. In the twenty-nine mature and extensively checked benchmark projects, SMOKE has discovered thirty previously unknown memory leaks which were con?rmed by developers, and one even assigned a CVE ID.
@inproceedings{FanWS0ZZ19,
title = {SMOKE: Scalable Path-Sensitive Memory Leak Detection for Millions of Lines of Code},
author = {Gang Fan and Rongxin Wu and Qingkai Shi and Xiao Xiao and Jinguo Zhou and Charles Zhang},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00025}
}