Abstract interpretation by dynamic partitioning

Abstract

The essential part of abstract interpretation is to build a machine-representable abstract domain expressing interesting properties about the possible states reached by a program at runtime. Many techniques have been developed which assume that one knows in advance the class of properties that are of interest. There are cases however when there are no a priori indications about the 'best' abstract properties to use. We introduce a new framework that enables non-unique representations of abstract program properties to be used, and expose a method, called dynamic partitioning, that allows the dynamic determination of interesting abstract domains using data structures built over simpler domains. Finally, we show how dynamic partitioning can be used to compute non-trivial approximations of functions over infinite domains and give an application to the computation of minimal function graphs.

Managing the granularity of constraint-based analyses by rule transformation

“…They make analysis scalable by making set-variables for methods, fields, or classes. The basic idea of designing analyses at a larger granularity has also been applied in data flow analysis [9], where syntactic tokens are used to group execution traces and coalesce the memory states associated with them, and abstract interpretation [2,3], where a semantic function for every control point is approximated by partitioning control points and defining a new semantic function over it.…”

A Policy Iteration Algorithm for Computing Fixed Points in Static Analysis of Programs

“…It consists of a parser for a simple imperative language (a very simplified C), a generator of abstract semantic equations using the interval abstraction, and the corresponding solver, using the policy iteration algorithm described in Section 3. A policy is a table that associates to each intersection node in the semantic abstraction, a value modeling which policy is chosen among l, r, m or m op , in Equation (1). There is a number of heuristics that one might choose concerning the initial policy, which should be a guess of the value of G 1 ∩G 2 in Equation (1).…”

“…The first iteration using Algorithm K with this policy, finds the value (i 1 6 , j 1 6 ) = ( [1,12], [0,11]). But the value for variable j given by equation 6, given using the previous result, is [0,10] instead of [0,11], meaning that the policy on equation 6 for j should be improved.…”

“…The first one relies on specific information about the structure of the program under analysis. For instance, one can define refined iteration strategies for loop nests [2], or for interprocedural analysis [1]. These methods are completely orthogonal to the method we are introducing here, which does not use such structural properties.…”

Static Analysis of the Accuracy in Control Systems: Principles and Experiments

“…Indeed, in tests, the branch followed by the floating-point and the corresponding real value of a variable can be different, we then call them unstable tests (as in [26]). Consider for example the following portion of code, supposing input x is in interval [1,3] with an error equal to 1.0e-5 :…”