System and method for static analysis using fault paths

Abstract

A system and method for analyzing a program includes determining possible bug paths in a program based on statistical analysis of test cases. A static analysis is then performed only on the possible bug paths. The bugs are then located in the program.

1 . A method for analyzing a program, comprising the steps of: 
 determining possible bug paths in a program based on statistical analysis of test cases;    performing a static analysis only on the possible bug paths; and    locating the bugs in the program.    
     
     
         2 . The method as recited in  claim 1 , wherein the step of determining includes performing a meet over possible bug paths (mobp) analysis which includes determining possible bug paths based on statistics of type and location of bugs in test cases.  
     
     
         3 . The method as recited in  claim 2 , wherein the test case programs include unit tests and/or regression tests.  
     
     
         4 . The method as recited in  claim 1 , further comprising determining fault locations in the program using a fault localization algorithm.  
     
     
         5 . A computer program product comprising a computer useable medium including a computer readable program for analyzing a software program, wherein the computer readable program when executed on a computer causes the computer to perform the steps of: 
 determining possible bug paths in a program based on statistical analysis of test cases;    performing a static analysis only on the possible bug paths; and    locating the bugs in the program.    
     
     
         6 . The computer program product as recited in  claim 5 , wherein the step of determining includes performing a meet over possible bug paths (mobp) analysis which includes determining possible bug paths based on statistics of type and location of bugs in test cases.  
     
     
         7 . The computer program product as recited in  claim 5 , wherein the test case programs include unit tests and/or regression tests.  
     
     
         8 . The computer program product as recited in  claim 5 , further comprising determining fault locations in the program using a fault localization algorithm.  
     
     
         9 . A method for analyzing a program, comprising the steps of: 
 determining a degree of unsoundness that can be tolerated for data flow information in a program;    performing a static analysis on less than all possible paths based upon the degree of unsoundness;    computing the data flow information only on those paths that trigger a possible bug or defect, based on statistics, to find the bugs and defects in the program.    
     
     
         10 . The method as recited in  claim 9 , wherein the degree of unsoundness is checked by measuring a distance between reference data and data of the program being considered.  
     
     
         11 . The method as recited in  claim 9 , wherein the distance includes a hamming distance.  
     
     
         12 . The method as recited in  claim 9 , wherein the step of performing a static analysis on less than all possible paths includes performing a meet over possible bug paths (mobp) analysis.  
     
     
         13 . The method as recited in  claim 12 , wherein the step of performing a meet over possible bug paths (mobp) analysis includes determining possible bug paths based on statistics of type and location of bugs in test case programs.  
     
     
         14 . The method as recited in  claim 13 , wherein the test case programs includes unit tests and/or regression tests.  
     
     
         15 . The method as recited in  claim 9 , further comprising determining fault locations in the program using a fault localization algorithm.  
     
     
         16 . A computer program product comprising a computer useable medium including a computer readable program for analyzing a software program, wherein the computer readable program when executed on a computer causes the computer to perform the steps of: 
 determining a degree of unsoundness for data flow information in a software program;    performing a static analysis on less than all possible paths based upon the degree of unsoundness;    computing the data flow information only on those paths that trigger a bug or defect to find the bugs in defects in the software program.    
     
     
         17 . The computer program product as recited in  claim 16 , wherein the degree of soundness is checked by measuring a distance between reference data and data of the software program being considered.  
     
     
         18 . The computer program product as recited in  claim 16 , wherein the distance includes a hamming distance.  
     
     
         19 . The computer program product as recited in  claim 16 , wherein the step of performing a static analysis on less than all possible paths includes performing a meet over possible bug paths (mobp) analysis.  
     
     
         20 . The computer program product as recited in  claim 19 , wherein the step of performing a meet over possible bug paths (mobp) analysis includes determining possible bug paths based on statistics of type and location of bugs in test case programs.  
     
     
         21 . The computer program product as recited in  claim 20 , wherein the test case programs includes unit tests and/or regression tests.  
     
     
         22 . The computer program product as recited in  claim 16 , further comprising determining fault locations in the software program using a fault localization algorithm.  
     
     
         23 . A system for determining faults in a program, comprising: 
 a determination module which identifies possible bug paths in a program based on statistical analysis of test cases;    a static analysis module which performs a static analysis only on the possible bug paths identified by the determination module; and    a fault localization module which locates the bugs in the program.    
     
     
         24 . The system as recited in  claim 23 , wherein the determination module includes a meet over possible bug paths (mobp) analysis program which determines possible bug paths based on statistics of type and location of bugs in failed test cases.  
     
     
         25 . The system as recited in  claim 23 , wherein the test case programs include unit tests and/or regression tests.  
     
     
         26 . The system as recited in  claim 23 , wherein the fault localization module performs a BEAM analysis.