一句话：提出 Statfier，用保持语义的程序变换生成变体并比对分析结果，自动测试静态分析器。
静态分析器在不执行程序的前提下推断程序行为并报告违反预定义性质的问题，但其分析结果往往不准确、不完整，既产生大量虚假警告，也遗漏重要问题。为提升分析器可靠性，开发者通常人工编写包含输入程序与预期分析结果的测试，而分析器的官方测试套件与文档中已有的示例程序可被复用。作者研究了这两类程序的质量，发现大多数分析规则至少被一个输入程序覆盖。据此提出 Statfier：从测试套件或文档中抽取程序，施加保持语义的变换生成程序变体，通过比较原程序与变体在分析器上报告结果的不一致来暴露分析器的不准确行为。为选出更可能揭示新缺陷的变体，Statfier 采用两个启发式：基于分析报告中程序位置选取变换点，以及以结构多样性驱动变体选择（不同的程序上下文与变换类型）。在五个流行静态分析器上的实验共发现 79 个缺陷，其中 46 个已被确认。
Static analyzers reason about the behaviors of programs without executing them and report issues when they violate pre-defined desirable properties. One of the key limitations of static analyzers is their tendency to produce inaccurate and incomplete analysis results, i.e., they often generate too many spurious warnings and miss important issues. To help enhance the reliability of a static analyzer, developers usually manually write tests involving input programs and the corresponding expected analysis results for the analyzers. Meanwhile, a static analyzer often includes example programs in its documentation to demonstrate the desirable properties and/or their violations. Our key insight is that we can reuse programs extracted either from the official test suite or documentation and apply semantic-preserving transformations to them to generate variants. We studied the quality of input programs from these two sources and found that most rules in static analyzers are covered by at least one input program, implying the potential of using these programs as the basis for test generation. We present Statfier, a heuristic-based automated testing approach for static analyzers that generates program variants via semantic-preserving transformations and detects inconsistencies between the original program and variants (indicate inaccurate analysis results in the static analyzer). To select variants that are more likely to reveal new bugs, Statfier uses two key heuristics: (1) analysis report guided location selection that uses program locations in the reports produced by static analyzers to perform transformations and (2) structure diversity driven variant selection that chooses variants with different program contexts and diverse types of transformations. Our experiments with five popular static analyzers show that Statfier can find 79 bugs in these analyzers, of which 46 have been confirmed.
@inproceedings{ZhangPCT23,
title = {Statfier: Automated Testing of Static Analyzers via Semantic-Preserving Program Transformations},
author = {Huaien Zhang and Yu Pei and Junjie Chen and Shin Hwei Tan},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616272}
}