Deriving descriptions of possible values of program variables by means of abstract interpretation

Janssens, Gerda; Bruynooghe, Maurice

doi:10.1016/0743-1066(92)90032-x

Cited by 112 publications

(117 citation statements)

References 4 publications

Supporting

Mentioning

115

Contrasting

Unclassified

Order By: Relevance

“…Our domains are less expensive to implement because some of the information that is represented by shape graphs in e.g., [6,14,25] is replaced by an abstract type information. This is similar to the difference between the abstract domains Pattern [19] and Types [18] in logic programming. 4.…”

Section: Pointer and Sharing Analysismentioning

confidence: 76%

See 1 more Smart Citation

Distinctness and Sharing Domains for Static Analysis of Java Programs

Pollet

Charlier

Cortesi

2001

ECOOP 2001 — Object-Oriented Programming

View full text Add to dashboard Cite

Abstract. The application field of static analysis techniques for objectoriented programming is getting broader, ranging from compiler optimizations to security issues. This leads to the need of methodologies that support reusability not only at the code level but also at higher (semantic) levels, in order to minimize the effort of proving correctness of the analyses. Abstract interpretation may be the most appropriate approach in that respect. This paper is a contribution towards the design of a general framework for abstract interpretation of Java programs. We introduce two generic abstract domains that express type, structural, and sharing information about dynamically created objects. These generic domains can be instantiated to get specific analyses either for optimization or verification issues. The semantics of the domains are precisely defined by means of concretization functions based on mappings between concrete and abstract locations. The main abstract operations, i.e., upper bound and assignment, are discussed. An application of the domains to source-to-source program specialization is sketched to illustrate the effectiveness of the analysis.

show abstract

Section: Pointer and Sharing Analysismentioning

confidence: 76%

“…For instance, we can improve the expressiveness of the domains by adding various attributes to abstract locations as in e.g., [14]. More powerful (and expensive) domains can be obtained by introducing some form of 'disjunctive completion' in the domains as in [18], where so-called OR-nodes are used. 2.…”

Section: Future Workmentioning

confidence: 99%

Distinctness and Sharing Domains for Static Analysis of Java Programs

Pollet

Charlier

Cortesi

2001

ECOOP 2001 — Object-Oriented Programming

View full text Add to dashboard Cite

show abstract

“…The last abstract domain we introduce exploits type graphs, a data structure which represents tree automata [15], adapting them to represent sets of strings. A type graph T is a triplet (N, A F , A B ) where (N, A F ) is a rooted tree whose arcs in A F are called forward arcs, and A B is a restricted class of arcs, backward arcs, superimposed on (N, A F ).…”

Section: String Graphsmentioning

confidence: 99%

“…The existence of superfluous nodes and arcs makes operations needed during abstract interpretation, such as the ≤-operation, quite complex and inefficient. In order to reduce this variety of type graphs, additional restrictions are imposed (for details see [15]), defining normal type graphs. We added a few other restrictions (specific for string graphs), thus obtaining the definition of normal string graphs.…”

Section: Fig 5 An Example Of String Graphmentioning

confidence: 99%

See 1 more Smart Citation

Static Analysis of String Values

Costantini

Ferrara

Cortesi

2011

Formal Methods and Software Engineering

View full text Add to dashboard Cite

show abstract

A suite of abstract domains for static analysis of string values

2013

View full text Add to dashboard Cite

Strings are widely used in modern programming languages in various scenarios. For instance, strings are used to build up Structured Query Language (SQL) queries that are then executed. Malformed strings may lead to subtle bugs, as well as non-sanitized strings may raise security issues in an application. For these reasons, the application of static analysis to compute safety properties over string values at compile time is particularly appealing. In this article, we propose a generic approach for the static analysis of string values based on abstract interpretation. In particular, we design a suite of abstract semantics for strings, where each abstract domain tracks a different kind of information. We discuss the trade-off between efficiency and accuracy when using such domains to catch the properties of interest. In this way, the analysis can be tuned at different levels of precision and efficiency, and it can address specific properties. The concrete semantics of these operators is approximated in different ways by the five different abstract domains. In addition, after 30 years of practice with numerical domains, it is clear that a monolithic domain precise on any program and property (e.g., Polyhedra [14]) gives up in terms of efficiency, whereas to achieve scalability, we need specific approximations on a given property (e.g., Pentagons [17]) or class of programs (e.g., ASTRÉE [18]). With this scenario in mind, we develop several domains inside the same framework to tune the analysis at different levels of precision and efficiency with respect to the analyzed class of programs and property. Other abstractions are possible and welcomed, and we expect our framework to be generic enough to support them.This article ‡ is structured as follows. In the rest of this section, we introduce two running examples, and we recall some basic concepts of abstract interpretation. Section 2 defines the syntax of the string operators that we will consider in the rest of the article. Section 3 introduces their concrete semantics, whereas in Section 4, the five abstract domains and the core of this work are formalized and are used to analyze the running examples. In Section 5, more experimental results are presented. Finally, Section 6 discusses the related work, and Section 7 concludes. Running examplesThroughout all the article, we will always refer to the two examples reported in Figures 1(a) and 1(b).The first Java program, prog1, is taken from [7], and it dynamically builds an SQL query by concatenating several strings. One of these concatenations applies only if a given input value, unknown at compile time, is not null. We are interested in checking if the SQL query resulting by ‡ The article is a fully revised and extended version of [19]

show abstract

Deriving descriptions of possible values of program variables by means of abstract interpretation

Cited by 112 publications

References 4 publications

Distinctness and Sharing Domains for Static Analysis of Java Programs

Distinctness and Sharing Domains for Static Analysis of Java Programs

Static Analysis of String Values

A suite of abstract domains for static analysis of string values

Contact Info

Product

Resources

About