polystat / awesome-bugs

A taxonomy of defects with a benchmarking script that validates which of them can be spot by which static analyzers

This is an experimental polyglot static analyzer.

Read the White Paper first.

Download polystat-*-jar-with-dependencies.jar from Maven Central and then run (replace the asterisk with the latest version):

$ java -jar polystat-*-jar-with-dependencies.jar src temp

The src/test.eo file must contain the code in EOLANG with a single object named test. For example, try this simple program that has a division by zero bug:

[x] > test
  div. > @
    42
    x

The output of Polystat will show you which values of x may cause this program to crash. A new directory temp/ will be created automatically and will contain temporary files.

You can also play with it by editing the files in sandbox/ and then running ./try.sh.

awesome-bugs's Issues

J2EO & Polystat compatibility. Declarations

Declarations

Normal class declarations (without generics):

Java:

public class A extends B { }

Eo:

[] > class__A
  class__Object > super
  super > @
  [] > new
    [] > this
      class__Object.new > super
      super > @
      "class__A" > className
      [this] > init
        seq > @
          TRUE
    seq > @
      this
  # null :: null -> void
  [this] > constructor
    seq > @
      initialization
      s1471868639
      this
    [] > initialization
      this.init > @
        this
    [] > s1471868639
      super.constructor > @
        this

Nested normal class declarations (without generics) are supposed to be a static:

Java:

public class Main {
    static class Inner {}
}

Eo:

[] > class__Main
  class__Object > super
  super > @
  [] > new
    [] > this
      class__Object.new > super
      super > @
      "class__Main" > className
      [this] > init
        seq > @
          TRUE
    seq > @
      this
  [] > class__Inner
    class__Object > super
    super > @
    [] > new
      [] > this
        class__Object.new > super
        super > @
        "class__Inner" > className
        [this] > init
          seq > @
            TRUE
      seq > @
        this
    # null :: null -> void
    [this] > constructor
      seq > @
        initialization
        s724125922
        this
      [] > initialization
        this.init > @
          this
      [] > s724125922
        super.constructor > @
          this
  # null :: null -> void
  [this] > constructor
    seq > @
      initialization
      s1846412426
      this
    [] > initialization
      this.init > @
        this
    [] > s1846412426
      super.constructor > @
        this

Method declarations (without generics):

Java:

public int f(int a, B b) {
    return a + b.v;
}
...
public static int g(int a, int b) {
    return a * b;
}

Eo:

[this a b] > f
  seq > @
    s1073533248
  [] > s1073533248
    b1782148126 > @
  [] > b1782148126
    s_r306206744.add > @
      f_a827084938
  [] > s_r306206744
    a > @
  [] > f_a827084938
    s_r280265505.v > @
  [] > s_r280265505
    b > @
...
[a b] > g
  seq > @
    s1607305514
  [] > s1607305514
    b40472007 > @
  [] > b40472007
    s_r398110318.mul > @
      s_r1765250898
  [] > s_r398110318
    a > @
  [] > s_r1765250898
    b > @

Constructor declarations with explicit super call:

Java:

public A(int a, int b) {
    super(a);
    this.v = a + b;
}

Eo:

[this a b] > constructor
  seq > @
    initialization
    s1392906938
    s1485697819
    this
  [] > initialization
    this.init > @
      this
  [] > s1392906938
    super.constructor > @
      this
      s_r660879561
  [] > s_r660879561
    a > @
  [] > s1485697819
    f_a2007331442.write > @
      b1904324159
  [] > f_a2007331442
    t1176735295.v > @
  [] > t1176735295
    this > @
  [] > b1904324159
    s_r1848415041.add > @
      s_r843467284
  [] > s_r1848415041
    a > @
  [] > s_r843467284
      b > @

Variable declarations (without var and non-static):

Java:

A a;
int b;
C c = new C();
float d = 1.9 + f;

Eo:

seq > @
  d1849201180
  d1691875296
  d667346055
  d1366025231
cage > a
[] > d1849201180
  TRUE > @
prim__int.constructor_1 > b
  prim__int.new
[] > d1691875296
  TRUE > @
cage > c
[] > d667346055
  c.write > @
    i_s1669712678
[] > i_s1669712678
  inst513700442 > @
[] > inst513700442
  C.constructor > @
    C.new
prim__float.constructor_1 > d
  prim__float.new
[] > d1366025231
  d.write > @
    i_s1007309018
[] > i_s1007309018
  b1684792003 > @
[] > b1684792003
  l2008966511.add > @
    s_r433874882
[] > l2008966511
  prim__float.constructor_2 > @
    prim__float.new
    1.9
[] > s_r433874882
  f > @

J2EO & Polystat compatibility. Blocks

Blocks

if with it's body (has runtime support):

Java:

if (condition) {
    then_part();
} else {
    else_part();
}

Eo:

seq > @
  s1641313620
[] > s1641313620
  s_r577405636.if > @
    b1691538257
    b459848100
[] > s_r577405636
  condition > @
[] > b1691538257
  seq > @
    s393040818
  [] > s393040818
    then_part > @
      this
[] > b459848100
  seq > @
    s1658926803
  [] > s1658926803
    else_part > @
      this

Where condition is an expression with &&, || and brackets

while with it's body (has runtime support):

Java:

while (condition) {
    block();
}

Eo:

seq > @
  s480971771
[] > s480971771
  s_r255944888.while > @
    [while_i]
      b1948863195 > @
[] > s_r255944888
  condition > @
[] > b1948863195
  seq > @
    s1890187342
  [] > s1890187342
    block > @
      this

Where condition is an expression with &&, || and brackets

do with it's body (hasn't runtime support):

Java:

do {
    block();
} while (condition);

Eo:

seq > @
  s322836221
[] > s322836221
  s_r1032000752.do > @
    [do_i]
      b770911223 > @
[] > s_r1032000752
  condition > @
[] > b770911223
  seq > @
    s1392906938
  [] > s1392906938
    block > @
      this

Where condition is an expression with &&, || and brackets

J@EO & Polystat compatibility. Expressions

Expressions

Supported all ariphmetic expressions with +, -, ++, --, (, ), *, / (without implicit casting):

Java:

a + b - c * (d / e++);

Eo:

seq > @
  s2145970759
[] > s2145970759
  b992768706.sub > @
    b1226204845
[] > b992768706
  s_r393040818.add > @
    s_r158453976
[] > s_r393040818
  a > @
[] > s_r158453976
  b > @
[] > b1226204845
  s_r1368594774.mul > @
    p1658926803
[] > s_r1368594774
  c > @
[] > p1658926803
  b210652080 > @
[] > b210652080
  s_r1652149987.div > @
    u_post1107730949
[] > s_r1652149987
  d > @
[] > u_post1107730949
  s_r700072760.inc_post > @
[] > s_r700072760
  e > @

Notice: all calculations has runtime support as calculation on Java long and Java double respectively.

Method calls. All calls are supposed to be non-static until callee is not class itself:

Java:

a.b.c.d(e, f, g);
...
String.valueOf(1);

Eo:

seq > @
  s1906808037
[] > s1906808037
  a.b.c.d > @
    a.b.c
    s_r1048027629
    s_r1073533248
    s_r599491651
[] > s_r1048027629
  e > @
[] > s_r1073533248
  f > @
[] > s_r599491651
  g > @
...
seq > @
  s912011468
[] > s912011468
  class__String.valueOf > @
    l11902257
[] > l11902257
  prim__int.constructor_2 > @
    prim__int.new
    1

Any cast to int:

Java:

(int) 1.0;

Eo:

seq > @
  s852445367
[] > s852445367
  prim__int.from > @
    l2142080121
[] > l2142080121
  prim__float.constructor_2 > @
    prim__float.new
    1.0

Ternary is not supported, but for converting boolean to int use cast:

Java:

(int) true;

Field access (any access to object attribute should start from this):

Java:

a.b.c.d;

Eo:

seq > @
  s912011468
[] > s912011468
  f_a1308109015.d > @
[] > f_a1308109015
  f_a11902257.c > @
[] > f_a11902257
  s_r1660794022.b > @
[] > s_r1660794022
  a > @

Instance creation, if there is only one defined constructor:

Java:

new A(b, c, d);

Eo:

seq > @
  s770911223
[] > s770911223
  class__A.constructor > @
    class__A.new
    s_r1890187342
    s_r19986569
    s_r294184992
[] > s_r1890187342
  b > @
[] > s_r19986569
  c > @
[] > s_r294184992
  d > @

Array creation with array initializer:

int[] a; // Supported
int a[]; // Unsupported
int[] a = {1}; // Unsupported
int[] a = new int[1]; // Unsupported

Java:

int[] a = {1, 2, 3};

Eo:

seq > @
  d673186785
cage > a
[] > d673186785
  a.write > @
    i_a1906808037
[] > i_a1906808037
  * > @
    i_s1983025922
    i_s1579526446
    i_s1308109015
[] > i_s1983025922
  l11902257 > @
[] > l11902257
  prim__int.constructor_2 > @
    prim__int.new
    1
[] > i_s1579526446
  l599491651 > @
[] > l599491651
  prim__int.constructor_2 > @
    prim__int.new
    2
[] > i_s1308109015
  l293002476 > @
[] > l293002476
  prim__int.constructor_2 > @
    prim__int.new
    3

Array access:

Java:

a[0][0];

Eo:

seq > @
  s1795960102
[] > s1795960102
  a_a1669712678.get > @
    l943081537.v
[] > a_a1669712678
  s_r683962652.get > @
    l1500608548.v
[] > s_r683962652
  a > @
[] > l1500608548
  prim__int.constructor_2 > @
    prim__int.new
    0
[] > l943081537
  prim__int.constructor_2 > @
    prim__int.new
    0

pep8 style checking

Since we use Python, let's add pep8 to the build, to make sure all our .py files have the same style.

Hi! Take a moment.

There are tests or unit-tests in this project? Thanks.

Run report for particular tests only

For development purposes it's useful to run particular tests in isolation (for example when adding new test case).
Let's make run.sh configurable with tests (files) filter:

sudo ./run.sh "inheritance/**/*.yml"

This would run only tests under inheritance/ folder.

SVF setup has missing step in `run.sh`

SVF requires cloning itself from git repo just like it's done in CI configuration main.yml:
git clone https://github.com/SVF-tools/SVF.git

Need to add this command into run.sh

J2EO & Polystat compatibility. About runtime support

Runtime support

It's collection of files that makes translated code runnable by Eo compiler.

Now supported:

• Partially all primitives (operations +, -, *, / and %; casting to int)
• Partially String (operation +; String.valueOf)
• Partially System (System.out.println)
• Partially Random (nextInt; nextFloat)

Example Eo:

# 2022-05-30T14:14:20.359245787
# j2eo team
+alias stdlib.lang.class__Object
+alias stdlib.lang.class__System
+alias stdlib.lang.class__String

[] > class__Main
  class__Object > super
  super > @
  [] > new
    [] > this
      class__Object.new > super
      super > @
      "class__Main" > className
      [this] > init
        seq > @
          TRUE
    seq > @
      this
  # main :: String[] -> void
  [args] > main
    seq > @
      s1048027629
    [] > s1048027629
      class__System.out.println > @
        class__System.out
        l928466577
    [] > l928466577
      class__String.constructor_2 > @
        class__String.new
        "Hello!"
  # null :: null -> void
  [this] > constructor
    seq > @
      initialization
      s1691875296
      this
    [] > initialization
      this.init > @
        this
    [] > s1691875296
      super.constructor > @
        this.super

[args...] > main
  class__Main.main > @
    *

Runtime out:

Hello!

Onboard buffer overrun case from `clang-tidy-mistakes` repo to `awesome-bugs`

To consolidate cases for static analysis let's move first case from clang-tidy-mistakes: https://github.com/polystat/clang-tidy-mistakes/blob/master/false-negative/buffer-overrun.cpp

For that need to create bad/good code fragments for c++, Java, Python.
Initial code needs to be cleaned up from comments and irrelevant structures/statements.

to add metric: area under the ROC curve

Can we add one more metric to p. 2.2 (Metrics) which is called AUC (Area Under Curve)? By creating ROC (Receiver operating characteristic) graphical plot.
e.g.

.rultor.yml is missing

We don't have .rultor.yml in this repository. Because of this, we can't automatically merge our PRs. Let's add this config file.

`SVF` folder is missing

Running the analyser like this:

$awsome-bugs\> sudo .\run.sh

Got the following errors:

SVF build has started
./run.sh: line 30: cd: SVF: No such file or directory
./run.sh: line 31: ./build.sh: No such file or directory

SVF folder is missing in the root of awsome-bugs.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Update actions/setup-python action to v5
• Update actions/upload-artifact action to v4
• Update dependency packaging to v24
• Update dependency parsy to v2
• Update dependency ubuntu to v22
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency pylatex to v1.4.2
• Update JamesIves/github-pages-deploy-action action to v4.6.1
• Update actions/setup-python action to v2.3.4
• Update dependency openpyxl to v3.1.3
• Update dependency packaging to v21.3
• Update dependency parsy to v1.4.0
• Update yegor256/latexmk-action action to v0.11.1
• Update actions/checkout action to v4
• Update actions/setup-java action to v4
• Update dependency PyYAML to v6
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/main.yml

• actions/checkout v2
• actions/setup-python v2.2.2
• ricardochaves/python-lint v1.4.0
• actions/setup-java v3
• yegor256/latexmk-action 0.4.0
• actions/upload-artifact v2
• JamesIves/github-pages-deploy-action 4.1.4

.github/workflows/pdd.yml

• actions/checkout v3
• ubuntu 20.04

.github/workflows/xcop.yml

• actions/checkout v3
• ubuntu 20.04

pip_requirements

scripts/requirements.txt

• et-xmlfile ==1.1.0
• openpyxl ==3.0.9
• packaging ==21.0
• parsy ==1.3.0
• PyYAML ==5.4.1
• pylatex ==1.4.1

---

• Check this box to trigger a request for Renovate to run again on this repository