Static analyzers can reason about the properties and behaviors of programs and detect various issues without executing them. Hence, they should extract the necessary information to understand the analyzed program well. Annotation has been a widely used feature for different purposes in Java since the introduction of Java 5. Annotations can change program structures and convey semantics information without awareness of static analyzers, consequently leading to imprecise analysis results. This paper presents the first comprehensive study of annotation-induced faults (AIF) by analyzing 246 issues in six open-source and popular static analyzers (i.e., PMD, SpotBugs, CheckStyle, Infer, SonarQube, and Soot). We analyzed the issues' root causes, symptoms, and fix strategies and derived ten findings and some practical guidelines for detecting and repairing annotation-induced faults. Moreover, we developed an automated testing framework called AnnaTester based on three metamorphic relations originating from the findings. AnnaTester generated new tests based on the official test suites of static analyzers and unveiled 43 new faults, 20 of which have been fixed. The results confirm the value of our study and its findings.
翻译:静态分析器能够在无需执行程序的情况下,推理程序的属性和行为并检测各类问题。因此,它们需要提取必要信息以充分理解待分析程序。自Java 5引入以来,注解作为一种广泛使用的特性,在Java中服务于不同目的。注解能够在不被静态分析器察觉的情况下改变程序结构并传递语义信息,从而导致分析结果不精确。本文通过分析六个开源且流行的静态分析器(即PMD、SpotBugs、CheckStyle、Infer、SonarQube和Soot)中的246个问题,首次对注解诱发缺陷进行了全面研究。我们分析了这些问题的根本原因、症状及修复策略,得出了十项发现及一些用于检测和修复注解诱发缺陷的实用指南。此外,基于这些发现中的三条蜕变关系,我们开发了一个名为AnnaTester的自动化测试框架。AnnaTester利用静态分析器的官方测试套件生成新测试,并揭示了43个新缺陷,其中20个已被修复。这些结果证实了本研究及其发现的价值。