一句话：利用静态分析配置项间的偏序关系作为测试预言，实现可配置静态分析的自动化测试与增量调试。
测试与调试静态分析的实现是一项困难任务，通常依赖领域专家大量繁琐且缺乏系统性的手工工作。本文面向带配置选项的静态分析器提出自动化方法：核心创新是将配置选项之间存在的理论偏序关系（partial order relations）加以改造，用作推理不同配置下分析结果正确性的依据，从而在输入程序上没有 ground truth 的情况下也能获得定义明确的测试预言，并在此基础上进行自动化差分调试（delta debugging），约简出触发缺陷的程序。作者设计并实现了 ECSTATIC——一个易于扩展的开源框架，已集成 SOOT、WALA、DOOP 与 FlowDroid 四款主流静态分析工具。评估中，ECSTATIC 在这四个工具里检测出 74 个偏序缺陷，并生成约简后的问题触发程序辅助调试；作者报告了 42 个缺陷，凡收到回复的均被工具开发者确认为非预期行为，其中 3 个已被修复，更多修复仍在讨论中。
Testing and debugging the implementation of static analysis is a challenging task, often involving significant manual effort from domain experts in a tedious and unprincipled process. In this work, we propose an approach that greatly improves the automation of this process for static analyzers with configuration options. At the core of our approach is the novel adaptation of the theoretical partial order relations that exist between these options to reason about the correctness of actual results from running the static analyzer with different configurations. This allows for automated testing of static analyzers with clearly defined oracles, followed by automated delta debugging, even in cases where ground truths are not defined over the input programs. To apply this approach to many static analysis tools, we design and implement ECSTATIC, an easy-to-extend, open-source framework. We have integrated four popular static analysis tools, SOOT, WALA, DOOP, and FlowDroid, into ECSTATIC. Our evaluation shows running ECSTATIC detects 74 partial order bugs in the four tools and produces reduced bug-inducing programs to assist debugging. We reported 42 bugs; in all cases where we received responses, the tool developers confirmed the reported tool behavior was unintended. So far, three bugs have been fixed and there are ongoing discussions to fix more.
@inproceedings{MordahlZSW23,
title = {ECSTATIC: An Extensible Framework for Testing and Debugging Configurable Static Analysis},
author = {Austin Mordahl and Zenong Zhang and Dakota Soles and Shiyi Wei},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00056}
}