Debugging via Run-Time Type Checking

Abstract

This paper describes the design and implementation of a tool for C programs that provides run-time checks based on type information. The tool instruments a program to monitor the type stored in each memory location. Whenever a value is written into a location, the location's run-time type tag is updated to match the type of the value. Also, the location's static type is compared with the value's type; if there is a mismatch, a warning message is issued. Whenever the value in a location is used, its run-time type tag is checked, and if the type is inappropriate in the context in which the value is being used, an error message is issued. The tool has been used to pinpoint the cause of bugs in several Solaris utilities and Olden benchmarks, usually providing information that is succinct and precise.

Run-Time Type Checking for Binary Programs

“…Loginov et al [7] present a run-time type checker that uses a shadow memory similar to ours. However, they use source-to-source translation to embed the checking and maintenance code into the target.…”

“…Loginov et al present a system similar to ours that employs source-to-source translation to insert code to maintain and check shadow memory [7]. Relying on source code translation limits their handling of libraries and mixed-language programs, and their tool does not preserve the instruction stream of the original program.…”

State of the Union: Type Inference Via Craig Interpolation

“…Semantics. We define the operational semantics of the language using a store and a memory in the standard way but additionally taking into account the runtime type information [15]. We assume a store Σ mapping variables to values, a partial mapping memory M from addresses to values, and a partial mapping runtime type information (RTTI) W from variables and addresses to types.…”

“…Here either our generated invariant was too weak, the predicate guard used variables that were not allowed, or there was a bug. For the cases where our invariants are too weak, more precise invariant generators (e.g., Blast [10]) can be used to statically verify that the edge predicates hold at the cast points, or alternatively, dynamic checking can be inserted to ensure typesafety at runtime [18,7,15]. One bug is when the programmer forget to check the predicate before the access, leaving the possibility of an unsafe access.…”

“…There is a large body of recent work on statically proving memory safety of C programs (augmented with adding runtime checks) to make them execute safely [15,18,2]. CCured [18] performs a pointer-kind inference and adds runtime checks to make C programs memory safe.…”