Static analysis tools help to detect common programming errors but generate a large number of false positives. Moreover, when applied to evolving software systems, around 95% of alarms generated on a version are repeated, i.e., they have also been generated on the previous version. Version-aware static analysis techniques (VSATs) have been proposed to suppress the repeated alarms that are not impacted by the code changes between the two versions. The alarms reported by VSATs after the suppression, called delta alarms, still constitute 63% of the tool-generated alarms. We observe that delta alarms can be further postprocessed using their corresponding code changes: the code changes due to which VSATs identify them as delta alarms. However, none of the existing VSATs or alarms postprocessing techniques postprocesses delta alarms using the corresponding code changes. Based on this observation, we use the code changes to classify delta alarms into six classes that have different priorities assigned to them. The assignment of priorities is based on the type of code changes and their likelihood of actually impacting the delta alarms. The ranking of alarms, obtained by prioritizing the classes, can help suppress alarms that are ranked lower, when resources to inspect all the tool-generated alarms are limited. We performed an empirical evaluation using 9789 alarms generated on 59 versions of seven open source C applications. The evaluation results indicate that the proposed classification and ranking of delta alarms help to identify, on average, 53% of delta alarms as more likely to be false positives than the others.

1. CLASSIFICATIONANDRANKINGOF
DELTASTATICANALYSISALARMS
TUKARAM MUSKE, TATA CONSULTANCY SERVICES, INDIA
ALEXANDER SEREBRENIK, EINDHOVEN UNIVERSITY OF TECHNOLOGY, THE NETHERLANDS

2. v1 v2
New
Repeated

3. v1 v2
New
Repeated
x = lib1();
y = 1/x;
x = lib2();
y = 1/x;

4. v1 v2
New
Impacted
Suppressed
F. Logozzo, S. K. Lahiri, M. Fahndrich, and S. Blackshear, “Veri
f
ication modulo versions: Towards usable veri
f
ication,” in PLDI 2014, pp. 294–304.
B. Chimdyalwar and S. Kumar, “E
ff
ective false positive
f
iltering for evolving software,” in ISEC 2011, pp. 103–106.
S. K. Lahiri, K. L. McMillan, R. Sharma, and C. Hawblitzel, “Di
ff
erential assertion checking,” in ESEC/FSE 2013, pp. 345–355.

5. archimedes
auto-apt
dict-gcide
mtr
0% 25% 50% 75% 100%
Suppressed Impacted New
How many
alarms can be
suppressed?

6. archimedes
auto-apt
dict-gcide
mtr
0% 25% 50% 75% 100%
Impacted New

7. int x,y,z,a[50]; int x,y,z,a[50];
int b[10] = {...}; int b[10] = {...};
void foo(int p){ void foo(int p){
int m=2,t1; int m=2,t1;
x = lib1(); x = lib3();
y = lib2(); y = lib2();
if(nondet()) if(nondet())
m = 4; m = x;
bar(m); bar(m);
x = 100 / p; New: POI-added
t1=x/y; t1=x/(y-2); New: POI-changed
} }
void bar(int i){ void bar(int i){
int t = y, t2; int t = y, t2;
z = lib3(); z = lib4();
t2 = b[z]; t2 = b[z]; Impacted: data-dependency
if(x > 20) if(x > 20)
t = b[y]; t = b[y]; Impacted: control-dependency
a[i]=5; a[i]=5; New: Result changed (POI is the same)
print(5/t); print(5/t); Impacted: value-dependency
} }
v1 v2

8. Impacted New
Control-
dependency
Value-
dependency
Data-
dependency
POI-added
POI-changed
Results changed
More important
Less important
Loss: 2%
Loss: 29%
S. Kumar, A. Sanyal, and U. P. Khedker, “Value slice: A new slicing concept for scalable property checking,” in International
Conference on Tools and Algorithms for the Construction and Analysis of Systems. Springer, 2015, pp. 101–115.

9. archimedes
auto-apt
dict-gcide
mtr
gzip
rhash
smp-utils
0% 25% 50% 75% 100%
Control-dep Value-dep Data-dep
POI-changed POI-added Results-changed

10. archimedes
auto-apt
dict-gcide
mtr
gzip
rhash
smp-utils
0% 25% 50% 75% 100%
Control-dep Value-dep Data-dep
POI-changed POI-added Results-changed
else if(strcmp(s,"INSB")==0) type=INSB;
[++] else if(strcmp(s,"ALSB")==0) type=ALSB;
else {
printf("%s : unknown speci
f
ied material!n", progname);
exit(0);
}
archimedes/readinput
f
ile.h, ll.125-130
365 control-dep imp alarms

11. @TukaramMuske
@aserebrenik