skip to main content
research-article

Mixing type checking and symbolic execution

Published:05 June 2010Publication History
Skip Abstract Section

Abstract

Static analysis designers must carefully balance precision and efficiency. In our experience, many static analysis tools are built around an elegant, core algorithm, but that algorithm is then extensively tweaked to add just enough precision for the coding idioms seen in practice, without sacrificing too much efficiency. There are several downsides to adding precision in this way: the tool's implementation becomes much more complicated; it can be hard for an end-user to interpret the tool's results; and as software systems vary tremendously in their coding styles, it may require significant algorithmic engineering to enhance a tool to perform well in a particular software domain.

In this paper, we present Mix, a novel system that mixes type checking and symbolic execution. The key aspect of our approach is that these analyses are applied independently on disjoint parts of the program, in an off-the-shelf manner. At the boundaries between nested type checked and symbolically executed code regions, we use special mix rules to communicate information between the off-the-shelf systems. The resulting mixture is a provably sound analysis that is more precise than type checking alone and more efficient than exclusive symbolic execution. In addition, we also describe a prototype implementation, Mixy, for C. Mixy checks for potential null dereferences by mixing a null/non-null type qualifier inference system with a symbolic executor.

References

  1. Thomas Ball and Sriram K. Rajamani. The SLAM project: debugging system software via static analysis. In Principles of Programming Languages (POPL), pages 1--3, 2002. Google ScholarGoogle ScholarDigital LibraryDigital Library
  2. Richard Bornat. Proving pointer programs in Hoare logic. In Mathematics of Program Construction (MPC), pages 102--126, 2000. Google ScholarGoogle ScholarDigital LibraryDigital Library
  3. Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, and Dawson R. Engler. EXE: automatically generating inputs of death. In Computer and Communications Security (CCS), pages 322--335, 2006. Google ScholarGoogle ScholarDigital LibraryDigital Library
  4. Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, and Kenneth L. McMillan. Abstractions from proofs. In Principles of Programming Languages (POPL), pages 232--244, 2004. Google ScholarGoogle ScholarDigital LibraryDigital Library
  5. Khoo Yit Phang, Bor-Yuh Evan Chang, and Jeffrey S. Foster. Mixing type checking and symbolic execution (extended version). Technical Report CS-TR-4954, Department of Computer Science, University of Maryland, College Park, 2010.Google ScholarGoogle Scholar
  6. James C. King. Symbolic execution and program testing. Commun. ACM, 19(7):385--394, 1976. Google ScholarGoogle ScholarDigital LibraryDigital Library
  7. Sorin Lerner, David Grove, and Craig Chambers. Composing dataflow analyses and transformations. In Principles of Programming Languages (POPL), pages 270--282, 2002. Google ScholarGoogle ScholarDigital LibraryDigital Library
  8. Rupak Majumdar and Koushik Sen. Hybrid concolic testing. In International Conference on Software Engineering (ICSE), pages 416--426, 2007. Google ScholarGoogle ScholarDigital LibraryDigital Library
  9. Joe M. Morris. A general axiom of assignment. Assignment and linked data structure. A proof of the Schorr-Waite algorithm. In Theoretical Foundations of Programming Methodology, pages 25--51, 1982.Google ScholarGoogle ScholarCross RefCross Ref
  10. George C. Necula, Scott McPeak, Shree Prakash Rahul, and Westley Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In Compiler Construction (CC), pages 213--228, 2002. Google ScholarGoogle ScholarDigital LibraryDigital Library
  11. Greg Nelson and Derek C. Oppen. Simplification by cooperating decision procedures. ACM Trans. Program. Lang. Syst., 1(2):245--257, 1979. Google ScholarGoogle ScholarDigital LibraryDigital Library
  12. Jens Palsberg and Todd Millstein. Type Systems: Advances and Applications. In The Compiler Design Handbook: Optimizations and Machine Code Generation, chapter 9. 2008.Google ScholarGoogle Scholar
  13. Polyvios Pratikakis, Jeffrey S. Foster, and Michael W. Hicks. Locksmith: context-sensitive correlation analysis for race detection. In PLDI, pages 320--331, 2006. Google ScholarGoogle ScholarDigital LibraryDigital Library
  14. Elnatan Reisner, Charles Song, Kin-Keung Ma, Jeffrey S. Foster, and Adam Porter. Using symbolic evaluation to understand behavior in configurable software systems. In International Conference on Software Engineering (ICSE), 2010. To appear. Google ScholarGoogle ScholarDigital LibraryDigital Library
  15. Patrick M. Rondon, Ming Kawaguci, and Ranjit Jhala.Liquid types. In Programming Language Design and Implementation (PLDI), pages 159--169, 2008. Google ScholarGoogle ScholarDigital LibraryDigital Library
  16. Patrick M. Rondon, Ming Kawaguchi, and Ranjit Jhala. Low-level liquid types. In Principles of Programming Languages (POPL), pages 131--144, 2010. Google ScholarGoogle ScholarDigital LibraryDigital Library
  17. Koushik Sen, Darko Marinov, and Gul Agha. CUTE: a concolic unit testing engine for C. In Foundations of Software Engineering (FSE), pages 263--272, 2005. Google ScholarGoogle ScholarDigital LibraryDigital Library
  18. Hongwei Xi and Frank Pfenning. Dependent types in practical programming. In Principles of Programming Languages (POPL), pages 214--227, 1999. Google ScholarGoogle ScholarDigital LibraryDigital Library
  19. Kwangkeun Yi and Williams Ludwell Harrison, III. Automatic generation and management of interprocedural program analyses. In Principles of Programming Languages (POPL), pages 246--259, 1993. Google ScholarGoogle ScholarDigital LibraryDigital Library
  20. Cristian Cadar, Daniel Dunbar, and Dawson R. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Operating Systems Design and Implementation (OSDI), pages 209--224, 2008. Google ScholarGoogle ScholarDigital LibraryDigital Library
  21. James C. Corbett, Matthew B. Dwyer, John Hatcliff, Shawn Laubach, Corina S. Păsăreanu, Robby, and Hongjun Zheng. Bandera: extracting finite-state models from Java source code. In International Conference on Software Engineering (ICSE), pages 439--448, 2000. Google ScholarGoogle ScholarDigital LibraryDigital Library
  22. Patrick Cousot and Radhia Cousot. Systematic design of program analysis frameworks. In Principles of Programming Languages (POPL), pages 269--282, 1979. Google ScholarGoogle ScholarDigital LibraryDigital Library
  23. Cormac Flanagan. Hybrid type checking. In Principles of Programming Languages (POPL), pages 245--256, 2006. Google ScholarGoogle ScholarDigital LibraryDigital Library
  24. Jeffrey S. Foster, Robert Johnson, John Kodumal, and Alex Aiken. Flow- insensitive type qualifiers. ACM Trans. Program. Lang. Syst., 28(6): 1035--1087, 2006. Google ScholarGoogle ScholarDigital LibraryDigital Library
  25. Vijay Ganesh and David L. Dill. A decision procedure for bit-vectors and arrays. In Computer-Aided Verification (CAV), pages 519--531, July 2007. Google ScholarGoogle ScholarDigital LibraryDigital Library
  26. Patrice Godefroid. Compositional dynamic test generation. In Principles of Programming Languages (POPL), pages 47--54, 2007. Google ScholarGoogle ScholarDigital LibraryDigital Library
  27. Patrice Godefroid, Nils Klarlund, and Koushik Sen. DART: directed automated random testing. In Programming Language Design and Implementation (PLDI), pages 213--223, 2005. Google ScholarGoogle ScholarDigital LibraryDigital Library
  28. Sumit Gulwani and Ashish Tiwari. Combining abstract interpreters. In Programming Language Design and Implementation (PLDI), pages 376--386, 2006. Google ScholarGoogle ScholarDigital LibraryDigital Library
  29. Samuel Z. Guyer and Calvin Lin. Error checking with client-driven pointer analysis. Sci. Comput. Program., 58(1-2): 83--114, 2005. Google ScholarGoogle ScholarDigital LibraryDigital Library

Index Terms

  1. Mixing type checking and symbolic execution

                    Recommendations

                    Comments

                    Login options

                    Check if you have access through your login credentials or your institution to get full access on this article.

                    Sign in

                    Full Access

                    PDF Format

                    View or Download as a PDF file.

                    PDF

                    eReader

                    View online with eReader.

                    eReader
                    About Cookies On This Site

                    We use cookies to ensure that we give you the best experience on our website.

                    Learn more

                    Got it!