一句话：提出根据静态警告自动生成测试用例的方法，通过测试代码片段验证真/假阳性。
静态分析是发现软件缺陷与漏洞的重要手段，但人工检查与确认静态警告既困难又耗时。本文提出一种基于静态警告自动生成测试用例的新方法，以验证真阳性与假阳性。作者设计了语法修补算法，能够从静态警告生成语法合法、语义保持的可执行代码片段，并构建了自动化构建与测试系统，利用模糊测试器、KLEE和Valgrind对片段进行测试。在12个真实C项目、来自两个商用静态分析工具的1955条警告上进行评估：成功构建68.5%的代码片段，生成1003个测试用例，识别出48个真阳性、27个假阳性和205个疑似假阳性；匹配到4个CVE及真实缺陷，且这些缺陷仅由本工具触发，其他基线工具未能触发。实验表明，测试代码片段方法可扩展且有效，能够触发全程序测试或过程级测试未能触发的缺陷。
Static analysis is an important approach for finding bugs and vulnerabilities in software. However, inspecting and confirming static warnings are challenging and time-consuming. In this paper, we present a novel solution that automatically generates test cases based on static warnings to validate true and false positives. We designed a syntactic patching algorithm that can generate syntactically valid, semantic preserving executable code fragments from static warnings. We developed a build and testing system to automatically test code fragments using fuzzers, KLEE and Valgrind. We evaluated our techniques using 12 real-world C projects and 1955 warnings from two commercial static analysis tools. We successfully built 68.5% code fragments and generated 1003 test cases. Through automatic testing, we identified 48 true positives and 27 false positives, and 205 likely false positives. We matched 4 CVE and real-world bugs using Helium, and they are only triggered by our tool but not other baseline tools. We found that testing code fragments is scalable and useful; it can trigger bugs that testing entire programs or testing procedures failed to trigger.