一句话：从 API 参考文档抽取细粒度 API 约束知识图谱，据此直接检测缺失调用、缺失条件检查与缺失异常处理三类 API 误用。
现有 API 误用检测方法大多以从代码库中挖掘的高频 API 用法模式为基准，隐含假设“偏离最常见用法即为误用”，但用法模式在完整性、可解释性和最佳实践上与 API 使用注意事项存在明显知识鸿沟。本文提出直接面向 API 注意事项知识进行误用检测的新思路：采用开放信息抽取方法，从 API 参考文档中构建 API 约束知识图谱，显式建模调用顺序与条件检查两类 API 约束关系，并为返回与抛出关系补充返回条件和异常触发条件。该知识图谱支持检测三类常见 API 误用——缺失调用、缺失条件检查和缺失异常处理，而现有检测器大多只关注缺失调用。作者在 Java SDK API 规范上开展概念验证，评估显示抽取的 API 约束关系准确率较高；在 MuBench 基准上，知识驱动的检测器达到 0.60（68/113）精确率与 0.28（68/239）召回率，显著优于基于模式的检测器；12 名开发者参与的初步用户研究也表明该方法在帮助开发者避免 API 误用、调试相关缺陷方面具有前景。
API misuses cause significant problem in software development. Existing methods detect API misuses against frequent API usage patterns mined from codebase. They make a naive assumption that API usage that deviates from the most-frequent API usage is a misuse. However, there is a big knowledge gap between API usage patterns and API usage caveats in terms of comprehensiveness, explainability and best practices. In this work, we propose a novel approach that detects API misuses directly against the API caveat knowledge, rather than API usage patterns. We develop open information extraction methods to construct a novel API-constraint knowledge graph from API reference documentation. This knowledge graph explicitly models two types of API-constraint relations (call-order and condition-checking) and enriches return and throw relations with return conditions and exception triggers. It empowers the detection of three types of frequent API misuses - missing calls, missing condition checking and missing exception handling, while existing detectors mostly focus on only missing calls. As a proof-of-concept, we apply our approach to Java SDK API Specification. Our evaluation confirms the high accuracy of the extracted API-constraint relations. Our knowledge-driven API misuse detector achieves 0.60 (68/113) precision and 0.28 (68/239) recall for detecting Java API misuses in the API misuse benchmark MuBench. This performance is significantly higher than that of existing pattern-based API misused detectors. A pilot user study with 12 developers shows that our knowledge-driven API misuse detection is very promising in helping developers avoid API misuses and debug the bugs caused by API misuses.
DOI 原文 ·
@inproceedings{paperbot6005,
title = {API-misuse detection driven by fine-grained API-constraint knowledge graph},
author = {Xiaoxue Ren and Xinyuan Ye and Zhenchang Xing and Xin Xia and Xiwei Xu and Liming Zhu and Jianling Sun},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3416551}
}