Tailoring Programs for Static Analysis via Program TransformationTechnical
Static analysis is a proven technique for ensuring software quality automatically catching bugs early during development. However, analysis tooling must approximate, both theoretically and in the interest of practicality. False positives are a pervading manifestation of such approximations–tool configuration and customization is therefore crucial for usability and directing analysis behavior. To suppress false positives, developers readily disable bug checks or insert comments that suppress spurious bug reports. Existing work shows that these mechanisms fall short of developer needs and present a significant pain point for using or adopting analyses. We draw on the insight that an analysis user always has one notable ability to influence analysis behavior regardless of analysis options and implementation: modifying their program. Indeed, developers find that they can effectively suppress false positives by changing their code slightly; this exercise is however manual, ad-hoc, and can introduce awkward or redundant code. We present a new technique for automated, generic, and temporary code changes that tailor to suppress spurious analysis errors. We adopt a rule-based approach where simple, declarative templates describe general syntactic changes for code patterns that are known to be problematic for the analyzer. Our technique promotes program transformation as a general primitive for improving the fidelity of analysis reports (we treat any given analyzer as a black box). Our evaluation is the first systematic study to broadly demonstrate the applicability and benefits of this technique and perspective: we evaluate using five different static analyzers supporting three different languages (C, Java, and PHP) on large, real world programs (>800KLOC). We show that our approach is effective in sidestepping long-standing and complex issues in analysis implementations.