Improving Static Initialization Block Handling in Java Symbolic Execution Engine

摘要

Runtime exceptions usually cause serious problems during execution, so it is important to focus on them during testing. On the other hand, it is very difficult to discover such problems by static analysis, so most tools are not able to find them. Symbolic execution is applied to verify the possible execution paths of the program without really executing it. Although it is able to detect runtime exceptions, usually it is very slow and requires lots of resources, consequently some trade-offs must be made so that it can be used in practice. But due to the different trade-offs, the results become less precise. Our static analyzer tool, called RTEHunter, uses a symbolic execution engine to detect runtime exceptions in Java source code but it has limitations as well. One of them is the proper handling of static initialization which is neglected in the latest version of RTEHunter. We provided a heuristical solution for managing static initializer blocks instead of implementing the proper working of the Java ClassLoader, which can be very complex. The results were tested on more than 200 various sized Java systems. Our solution filtered out more than 200 false positive NullPointerEx-ception warnings, which is about 8% of the total number of reported NullPointerExceptions.