Practical memory leak detection using guarded value-flow analysis

CheremSigmund,; PrincehouseLonnie,; RuginaRadu,

doi:10.1145/1273442.1250789

Cited by 36 publications

(58 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Though this fix is technically safe, it may not be efficient because the deallocation may be too far from its last use. This problem does not exist in leak detection algorithms [9,12], as a detection in main still detects the leak.…”

Section: B Basic Ideamentioning

confidence: 99%

“…As a result, we can treat the body of the loop as an independent procedure and check within the procedure. Many existing approaches on leaks [23,9,12] also only track leaks in one iteration, though the techniques are somewhat different. Fig.…”

Section: ) Loopsmentioning

confidence: 99%

“…First, dealing with memory leak is an important problem in software development. While many approaches [7,8,9,10,11,12,13] have been proposed to detect memory leaks, it is still difficult to fix a [14,15]. Second, memory leaks cannot be easily handled by general bug-fixing approaches, as we cannot easily specify the condition of "no leak" as an assertion or a test case.…”

Section: Introductionmentioning

confidence: 99%

“…In this example, the leaked allocation will be inside the procedures get_next and search_for_next, where the actual leak occurs in another procedure. Fastcheck [9] is a detection approach that gives a path where the memory is leaked. This noticeably reduces the search space for identifying the leak, but it is still difficult to correctly fix the leak.…”

Section: Introductionmentioning

confidence: 99%

“…Since leak detection is strongly interrelated with pointer analysis, existing leak detection approaches often build their approaches as a special pointer analysis process [9,12]. Recently, there are significant improvements on the efficiency of pointer analysis [16,17,18], so it makes sense to reuse existing pointer analysis algorithms as black boxes.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Safe Memory-Leak Fixing for C Programs

Gao

Xiong

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

View full text Add to dashboard Cite

Abstract-Automatic bug fixing has become a promising direction for reducing manual effort in debugging. However, general approaches to automatic bug fixing may face some fundamental difficulties. In this paper, we argue that automatic fixing of specific types of bugs can be a useful complement.This paper reports our first attempt towards automatically fixing memory leaks in C programs. Our approach generates only safe fixes, which are guaranteed not to interrupt normal execution of the program. To design such an approach, we have to deal with several challenging problems such as inter-procedural leaks, global variables, loops, and leaks from multiple allocations. We propose solutions to all the problems and integrate the solutions into a coherent approach.We implemented our inter-procedural memory leak fixing into a tool named LeakF ix and evaluated LeakF ix on 15 programs with 522k lines of code. Our evaluation shows that LeakF ix is able to successfully fix a substantial number of memory leaks, and LeakF ix is scalable for large applications.

show abstract

Section: B Basic Ideamentioning

confidence: 99%

Section: ) Loopsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Safe Memory-Leak Fixing for C Programs

Gao

Xiong

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

Making context-sensitive inclusion-based pointer analysis practical for compilers using parameterised summarisation

Sui

Xue

et al. 2013

Softw. Pract. Exper.

View full text Add to dashboard Cite

SUMMARYBecause of its high precision as a flow‐insensitive pointer analysis, Andersen's analysis has been deployed in some modern optimising compilers. To obtain improved precision, we describe how to add context sensitivity on top of Andersen's analysis. The resulting analysis, called ICON, is efficient to analyse large programs while being sufficiently precise to drive compiler optimisations. Its novelty lies in summarising the side effects of a procedure by using one transfer function on virtual variables that represent fully parameterised locations accessed via its formal parameters. As a result, a good balance between efficiency and precision is made, resulting in ICON that is more powerful than a 1‐callsite‐sensitive analysis and less so than a call‐path‐sensitive analysis (when the recursion cycles in a program are collapsed in all cases). We have compared ICON with FULCRA, a state of the art Andersen's analysis that is context sensitive by acyclic call paths, in Open64 (with recursion cycles collapsed in both cases) using the 16 C/C++ benchmarks in SPEC2000 (totalling 600 KLOC) and 5 C applications (totalling 2.1 MLOC). Our results demonstrate scalability of ICON and lack of scalability of FULCRA. FULCRA spends over 2 h in analysing SPEC2000 and fails to run to completion within 5 h for two of the five applications tested. In contrast, ICON spends just under 7 min on the 16 benchmarks in SPEC2000 and just under 26 min on the same two applications. For the 19 benchmarks analysable by FULCRA, ICON is nearly as accurate as FULCRA in terms of the quality of the built Static Single Assignment (SSA) form and the precision of the discovered alias information. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

Per-Dereference Verification of Temporal Heap Safety via Adaptive Context-Sensitive Analysis

et al. 2019

View full text Add to dashboard Cite

We address the problem of verifying the temporal safety of heap memory at each pointer dereference. Unlike separation-logic-based approaches, our whole-program analysis approach is undertaken from the perspective of pointer analysis, allowing us to leverage the advantages of and advances in pointer analysis to improve precision and scalability. A dereference ω, say, via pointer q is unsafe iff there exists a deallocation ψ, say, via pointer p such that on a control-flow path ρ, p aliases with q (with both pointing to an object o representing an allocation), denoted A ψ ω (ρ), and ψ reaches ω on ρ via control flow, denoted R ψ ω (ρ). Applying directly any existing pointer analysis, which is typically solved separately with an associated control-flow reachability analysis, will render such verification highly imprecise, since ∃ρ.Ae., ∃ does not distribute over ∧). For precision, we solve ∃ρ.A ψ ω (ρ) ∧ R ψ ω (ρ), with a control-flow path ρ containing an allocation o, a deallocation ψ and a dereference ω abstracted by a tuple of three contexts (c o , c ψ , c ω ). For scalability, a demand-driven full context-sensitive (modulo recursion) pointer analysis, which operates on pre-computed def-use chains with adaptive context-sensitivity, is used to infer (c o , c ψ , c ω ), without losing soundness or precision. Our evaluation shows that our approach can successfully verify the safety of 81.3% (or 93,141 114,508 ) of all the dereferences in a set of 10 C programs totalling 1,166 KLOC.

show abstract

Practical memory leak detection using guarded value-flow analysis

Cited by 36 publications

References 19 publications

Safe Memory-Leak Fixing for C Programs

Safe Memory-Leak Fixing for C Programs

Making context-sensitive inclusion-based pointer analysis practical for compilers using parameterised summarisation

Per-Dereference Verification of Temporal Heap Safety via Adaptive Context-Sensitive Analysis

Contact Info

Product

Resources

About