一句话：提出无需错误规约的静态检测工具 EH-Miner，通过挖掘错误处理规则发现错误处理缺陷。
软件系统频繁遇到错误，错误处理代码必须正确执行以助系统恢复，但其编写重复且易错。现有工具依赖错误规约才能检测错误处理缺陷，人工编写规约繁琐易错，自动挖掘规约精度又难令人满意。本文提出 EH-Miner，一种无需错误规约即可自动检测错误处理缺陷的工具：当函数频繁被等价条件检查并以相同动作处理时，挖掘错误处理规则，再据此发现违规。作者在 15 个软件领域的 117 个应用上评估，规则挖掘精度 91.1%、召回 46.9%；报告 142 个缺陷，106 个获确认或修复。进一步应用于 Linux 内核 4.17，报告 68 个缺陷，42 个获确认或修复。
Most software systems frequently encounter errors when interacting with their environments. When errors occur, error-handling code must execute flawlessly to facilitate system recovery. Implementing correct error handling is repetitive but non-trivial, and developers often inadvertently introduce bugs into error-handling code. Existing tools require correct error specifications to detect error-handling bugs. Manually generating error specifications is error-prone and tedious, while automatically mining error specifications is hard to achieve a satisfying accuracy. In this paper, we propose EH-Miner, a novel and practical tool that can automatically detect error-handling bugs without the need for error specifications. Given a function, EH-Miner mines its error-handling rules when the function is frequently checked by an equivalent condition, and handled by the same action. We applied EH-Miner to 117 applications across 15 software domains. EH-Miner mined error-handling rules with the precision of 91.1% and the recall of 46.9%. We reported 142 bugs to developers, and 106 bugs had been confirmed and fixed at the time of writing. We further applied EH-Miner to Linux kernel, and reported 68 bugs for kernel-4.17, of which 42 had been confirmed or fixed.
DOI 原文 ·
@inproceedings{paperbot5324,
title = {Detecting Error-Handling Bugs without Error Specification Input},
author = {Zhouyang Jia and Shanshan Li and Tingting Yu and Xiangke Liao and Ji Wang and Xiaodong Liu and Yunhuai Liu},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00029}
}