一句话：扩展控制流图与符号执行框架，在 Clang Static Analyzer 上实现 C++ 异常处理缺陷静态检测工具，精度达 84%。
异常处理是现代编程语言的重要机制，但异常处理代码容易出错，针对 C++ 程序的异常处理缺陷检测研究仍然有限。本文旨在精确刻画 C++ 程序的异常控制流并据此检测缺陷。作者首先扩展控制流图，引入五类不同的基本块来表示异常控制流；随后改造经典符号执行框架，将程序状态扩展为四元组，并专门处理 try、throw 与 catch 语句。基于上述技术，在 Clang Static Analyzer 之上实现了静态分析工具。作者在 GitHub 高星项目上运行该工具，在 8 个项目中发现了 36 个异常处理缺陷，精确率为 84%。与 Cppcheck、Clang Static Analyzer、Facebook Infer 和 IKOS 四个先进静态分析工具在 GitHub 项目及手工基准上的对比表明，其他工具未能发现本文工具所发现的任何异常处理缺陷，而在手工基准上本文工具的召回率显著更高。
Exception handling is a mechanism in modern programming languages. Studies have shown that the exception handling code is error-prone. However, there is still limited research on detecting exception handling bugs, especially for C++ programs. To tackle the issue, we try to precisely represent the exception control flow in C++ programs and propose an analysis method that makes use of the control flow to detect such bugs. More specifically, we first extend control flow graph by introducing the concepts of five different kinds of basic blocks, and then modify the classic symbolic execution framework by extending the program state to a quadruple and properly processing try, throw and catch statements. Based on the above techniques, we develop a static analysis tool on the top of Clang Static Analyzer to detect exception handling bugs. We run our tool on projects with high stars from GitHub and find 36 exception handling bugs in 8 projects, with a precision of 84%. We compare our tool with four state-of-the-art static analysis tools (Cppcheck, Clang Static Analyzer, Facebook Infer and IKOS) on projects from GitHub and handmade benchmarks. On the GitHub projects, other tools are not able to detect any exception handling bugs found by our tool. On the handmade benchmarks, our tool has a significant higher recall.