Abstract
Static analysis designers must carefully balance precision and efficiency. In our experience, many static analysis tools are built around an elegant, core algorithm, but that algorithm is then extensively tweaked to add just enough precision for the coding idioms seen in practice, without sacrificing too much efficiency. There are several downsides to adding precision in this way: the tool's implementation becomes much more complicated; it can be hard for an end-user to interpret the tool's results; and as software systems vary tremendously in their coding styles, it may require significant algorithmic engineering to enhance a tool to perform well in a particular software domain.
In this paper, we present Mix, a novel system that mixes type checking and symbolic execution. The key aspect of our approach is that these analyses are applied independently on disjoint parts of the program, in an off-the-shelf manner. At the boundaries between nested type checked and symbolically executed code regions, we use special mix rules to communicate information between the off-the-shelf systems. The resulting mixture is a provably sound analysis that is more precise than type checking alone and more efficient than exclusive symbolic execution. In addition, we also describe a prototype implementation, Mixy, for C. Mixy checks for potential null dereferences by mixing a null/non-null type qualifier inference system with a symbolic executor.
- Thomas Ball and Sriram K. Rajamani. The SLAM project: debugging system software via static analysis. In Principles of Programming Languages (POPL), pages 1--3, 2002. Google Scholar
Digital Library
- Richard Bornat. Proving pointer programs in Hoare logic. In Mathematics of Program Construction (MPC), pages 102--126, 2000. Google Scholar
Digital Library
- Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, and Dawson R. Engler. EXE: automatically generating inputs of death. In Computer and Communications Security (CCS), pages 322--335, 2006. Google Scholar
Digital Library
- Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, and Kenneth L. McMillan. Abstractions from proofs. In Principles of Programming Languages (POPL), pages 232--244, 2004. Google Scholar
Digital Library
- Khoo Yit Phang, Bor-Yuh Evan Chang, and Jeffrey S. Foster. Mixing type checking and symbolic execution (extended version). Technical Report CS-TR-4954, Department of Computer Science, University of Maryland, College Park, 2010.Google Scholar
- James C. King. Symbolic execution and program testing. Commun. ACM, 19(7):385--394, 1976. Google Scholar
Digital Library
- Sorin Lerner, David Grove, and Craig Chambers. Composing dataflow analyses and transformations. In Principles of Programming Languages (POPL), pages 270--282, 2002. Google Scholar
Digital Library
- Rupak Majumdar and Koushik Sen. Hybrid concolic testing. In International Conference on Software Engineering (ICSE), pages 416--426, 2007. Google Scholar
Digital Library
- Joe M. Morris. A general axiom of assignment. Assignment and linked data structure. A proof of the Schorr-Waite algorithm. In Theoretical Foundations of Programming Methodology, pages 25--51, 1982.Google Scholar
Cross Ref
- George C. Necula, Scott McPeak, Shree Prakash Rahul, and Westley Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In Compiler Construction (CC), pages 213--228, 2002. Google Scholar
Digital Library
- Greg Nelson and Derek C. Oppen. Simplification by cooperating decision procedures. ACM Trans. Program. Lang. Syst., 1(2):245--257, 1979. Google Scholar
Digital Library
- Jens Palsberg and Todd Millstein. Type Systems: Advances and Applications. In The Compiler Design Handbook: Optimizations and Machine Code Generation, chapter 9. 2008.Google Scholar
- Polyvios Pratikakis, Jeffrey S. Foster, and Michael W. Hicks. Locksmith: context-sensitive correlation analysis for race detection. In PLDI, pages 320--331, 2006. Google Scholar
Digital Library
- Elnatan Reisner, Charles Song, Kin-Keung Ma, Jeffrey S. Foster, and Adam Porter. Using symbolic evaluation to understand behavior in configurable software systems. In International Conference on Software Engineering (ICSE), 2010. To appear. Google Scholar
Digital Library
- Patrick M. Rondon, Ming Kawaguci, and Ranjit Jhala.Liquid types. In Programming Language Design and Implementation (PLDI), pages 159--169, 2008. Google Scholar
Digital Library
- Patrick M. Rondon, Ming Kawaguchi, and Ranjit Jhala. Low-level liquid types. In Principles of Programming Languages (POPL), pages 131--144, 2010. Google Scholar
Digital Library
- Koushik Sen, Darko Marinov, and Gul Agha. CUTE: a concolic unit testing engine for C. In Foundations of Software Engineering (FSE), pages 263--272, 2005. Google Scholar
Digital Library
- Hongwei Xi and Frank Pfenning. Dependent types in practical programming. In Principles of Programming Languages (POPL), pages 214--227, 1999. Google Scholar
Digital Library
- Kwangkeun Yi and Williams Ludwell Harrison, III. Automatic generation and management of interprocedural program analyses. In Principles of Programming Languages (POPL), pages 246--259, 1993. Google Scholar
Digital Library
- Cristian Cadar, Daniel Dunbar, and Dawson R. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Operating Systems Design and Implementation (OSDI), pages 209--224, 2008. Google Scholar
Digital Library
- James C. Corbett, Matthew B. Dwyer, John Hatcliff, Shawn Laubach, Corina S. Păsăreanu, Robby, and Hongjun Zheng. Bandera: extracting finite-state models from Java source code. In International Conference on Software Engineering (ICSE), pages 439--448, 2000. Google Scholar
Digital Library
- Patrick Cousot and Radhia Cousot. Systematic design of program analysis frameworks. In Principles of Programming Languages (POPL), pages 269--282, 1979. Google Scholar
Digital Library
- Cormac Flanagan. Hybrid type checking. In Principles of Programming Languages (POPL), pages 245--256, 2006. Google Scholar
Digital Library
- Jeffrey S. Foster, Robert Johnson, John Kodumal, and Alex Aiken. Flow- insensitive type qualifiers. ACM Trans. Program. Lang. Syst., 28(6): 1035--1087, 2006. Google Scholar
Digital Library
- Vijay Ganesh and David L. Dill. A decision procedure for bit-vectors and arrays. In Computer-Aided Verification (CAV), pages 519--531, July 2007. Google Scholar
Digital Library
- Patrice Godefroid. Compositional dynamic test generation. In Principles of Programming Languages (POPL), pages 47--54, 2007. Google Scholar
Digital Library
- Patrice Godefroid, Nils Klarlund, and Koushik Sen. DART: directed automated random testing. In Programming Language Design and Implementation (PLDI), pages 213--223, 2005. Google Scholar
Digital Library
- Sumit Gulwani and Ashish Tiwari. Combining abstract interpreters. In Programming Language Design and Implementation (PLDI), pages 376--386, 2006. Google Scholar
Digital Library
- Samuel Z. Guyer and Calvin Lin. Error checking with client-driven pointer analysis. Sci. Comput. Program., 58(1-2): 83--114, 2005. Google Scholar
Digital Library
Index Terms
Mixing type checking and symbolic execution
Recommendations
Mixing type checking and symbolic execution
PLDI '10: Proceedings of the 31st ACM SIGPLAN Conference on Programming Language Design and ImplementationStatic analysis designers must carefully balance precision and efficiency. In our experience, many static analysis tools are built around an elegant, core algorithm, but that algorithm is then extensively tweaked to add just enough precision for the ...
Symbolic range analysis of pointers
CGO '16: Proceedings of the 2016 International Symposium on Code Generation and OptimizationAlias analysis is one of the most fundamental techniques that compilers use to optimize languages with pointers. However, in spite of all the attention that this topic has received, the current state-of-the-art approaches inside compilers still face ...
Type checking beyond type checkers, via slice & run
TAPAS 2020: Proceedings of the 11th ACM SIGPLAN International Workshop on Tools for Automatic Program AnalysisType checkers are the most commonly used form of static analysis, but their design is coupled to the rest of the language, making it hard or impossible to bring new kinds of reasoning to existing, unmodified code. We propose a novel approach to checking ...







Comments