Evaluating and tuning a static analysis to find null pointer bugs

Abstract

Using static analysis to detect memory access errors, such as null pointer dereferences, is not a new problem. However, much of the previous work has used rather sophisticated analysis techniques in order to detect such errors.In this paper we show that simple analysis techniques can be used to identify many such software defects, both in production code and in student code. In order to make our analysis both simple and effective, we use a non-standard analysis which is neither complete nor sound. However, we find that it is effective at finding an interesting class of software defects.We describe the basic analysis we perform, as well as the additional errors we can detect using techniques such as annotations and inter-procedural analysis.In studies of both production software and student projects, we find false positive rates of around 20% or less. In the student code base, we find that our static analysis techniques are able to pinpoint 50% to 80% of the defects leading to a null pointer exception at runtime.

Changing Java's Semantics for Handling Null Pointer Exceptions

“…Null pointer dereferences are frequent [31], and have been reported as "a very serious threat to the safety of programs" and are the most common error in Java programs [7]. Many classes of null pointer exceptions can be found automatically by static analyses [15]. Addressing such risks with fault-tolerance techniques is a promising avenue.…”

Java Bytecode Verification for @NonNull Types

“…However, no mechanism for actually checking non-null types was presented. The FindBugs tool checks @NonNull annotations using a dataflow analysis that accounts for comparisons against null [16,15]. Their approach does not employ type aliasing and provides no guarantee that all potential errors will be reported.…”

“…[25,10,16,3,8]), none has directly addressed the problem of bytecode verification. While these existing techniques could be used for this purpose, they operate on higher-level program representations and must first translate bytecode into their representation.…”

Leveraging Light-Weight Analyses to Aid Software Maintenance

“…In response, many tools have been developed to reduce the overwhelming cost of finding and fixing bugs (e.g. [4,15,20,23,30,31,45,47,53,71]) and to ensure long-term system understandability and evolvability (e.g. [11,12,13,41,55,58,59]).…”

“…[11,12,13,41,55,58,59]). Despite these advancements, developers still struggle to handle the volume of maintenance tasks that arise in practice [31].…”