QUIC Graphs: Relational Invariant Generation for Containers

Cox, Arlen; Chang, Bor-Yuh Evan; Sankaranarayanan, Sriram

doi:10.1007/978-3-642-39038-8_17

Cited by 9 publications

(14 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Boxed on the right are constraints on attribute partitions. These constraints are represented by a relational abstraction for sets, such as QUIC graphs [10].…”

Section: Overviewmentioning

confidence: 99%

Automatic Analysis of Open Objects in Dynamic Language Programs

2014

Self Cite

View full text Add to dashboard Cite

Abstract. In dynamic languages, objects are open-they support iteration over and dynamic addition/deletion of their attributes. Open objects, because they have an unbounded number of attributes, are difficult to abstract without a priori knowledge of all or nearly all of the attributes and thus pose a significant challenge for precise static analysis. To address this challenge, we present the HOO (Heap with Open Objects) abstraction that can precisely represent and infer properties about open-objectmanipulating programs without any knowledge of specific attributes. It achieves this by building upon a relational abstract domain for sets that is used to reason about partitions of object attributes. An implementation of the resulting static analysis is used to verify specifications for dynamic language framework code that makes extensive use of open objects, thus demonstrating the effectiveness of this approach.

show abstract

“…Boxed on the right are constraints on attribute partitions. These constraints are represented by a relational abstraction for sets, such as QUIC graphs [10].…”

Section: Overviewmentioning

confidence: 99%

Automatic Analysis of Open Objects in Dynamic Language Programs

2014

Self Cite

View full text Add to dashboard Cite

show abstract

“…The QUICr library provides an implementation of the QUIC graphs [12] abstract domain combinator for numeric domains. It is used as part of an abstract interpretation system (see inset) that not only proves properties of programs, but performs necessary invariant generation.…”

Section: Overview Of Quic Graphsmentioning

confidence: 99%

“…Unlike the implementation in [12], QUICr is more general and comes with four numerical domains provided: (1) a simple equivalence class abstract domain, where variables can be equal to each other and numeric constants; and domains provided by Apron: (2) boxes; (3) octagons; and (4) polyhedra. Additionally, it can be instantiated with any numeric domain that meets the Apron interface (such as PPL [16]).…”

Section: Quicr Usage and Extensionmentioning

confidence: 99%

“…Therefore, when verifying programs, it is vital to support containers as well as scalar values. In the decision procedures community, this is widely recognized with support for arrays, sets, and maps [1][2][3], but when invariant generation is concerned, such as in abstract interpretation [4], only arrays have been carefully considered [5][6][7][8][9][10][11], leaving other containers rarely explored [12][13][14]. Given that there is a plethora of abstract domains for reasoning about scalars [15,16], it is necessary to build abstract domains that not only reason about containers, but also interact efficiently and precisely with existing domains for scalars.…”

Section: Introductionmentioning

confidence: 99%

“…The best way to ensure interaction is, rather than building abstract domains for containers, building domain combinators that construct abstract domains for containers from existing abstract domains for numbers. Recently, such a domain for arrays was created [5], and a domain for sets was created [12]. This paper describes an implementation of the domain for sets called QUICr 1 .…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

QUICr: A Reusable Library for Parametric Abstraction of Sets and Numbers

Cox

Chang

Sriram

2014

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

Abstract. This paper introduces QUICr, an abstract domain combinator library that lifts any domain for numbers into an efficient domain for numbers and sets of numbers. As a library, it is useful for inferring relational data invariants in programs that manipulate data structures. As a testbed, it allows easy extension of widening and join heuristics, enabling adaptations to new and varied applications. In this paper we present the architecture of the library, guidelines on how to select heuristics, and an example instantiation of the library using the Apron library to verify set-manipulating programs.

show abstract

Weakly sensitive analysis for JavaScript object‐manipulating programs

Rival

Ryu

2019

Softw Pract Exp

View full text Add to dashboard Cite

While JavaScript programs have become pervasive in web applications, they remain hard to reason about. In this context, most static analyses for JavaScript programs require precise call graph information, since the presence of large numbers of spurious callees significantly deteriorates precision. One of the most challenging JavaScript features that complicate the inference of precise static call graph information is read/write accesses to object fields, the names of which are computed at runtime. JavaScript framework libraries often exploit this facility to build objects from other objects, as a way to simulate sophisticated high-level programming constructions. Such code patterns are difficult to analyze precisely, due to weak updates and limitations of unrolling techniques. In this paper, we observe that precise field origination relations can be inferred by locally reasoning about object copies, both regarding to the object and to the program structure, and we propose an abstraction that allows to separately reason about field read/write access patterns working on different fields and to carefully handle the sets of JavaScript object fields. We formalize and implement an analysis based on this technique. We evaluate the performance and precision of the analysis on the computation of call graph information for examples from jQuery tutorials. KEYWORDSabstract interpretation, JavaScript, object abstraction, static analysis, string abstraction, trace partitioning abstractionThe results in this paper are based in part on findings presented in the proceeding of APLAS'17. 840 FIGURE 1 A simplified excerpt from jQuery 1.7.2 and an example use case [Colour figure can be viewed at wileyonlinelibrary.com]One of the problematic JavaScript features that complicate the precise static call graph construction is read/write accesses to object fields, the names of which are computed at runtime. In JavaScript, an object has a set of fields, each of which consists of a name and value pair, and the field lookup and update operations take the value of an expression as an index that designates the field to read or write. JavaScript framework libraries often exploit this facility to build an object from another object by copying all the fields one by one (shallow copy) or by computing values using the fields in the source object (eg, to simulate accessor methods). To reason over such field copy or transformation patterns (for short, FCT patterns), analysis tools need to resolve precisely the fields of objects, and the relations among them.As an example, we consider the jQuery implementation of class inheritance using field copies of an object, as shown in Figure 1. To achieve that, function fix copies the fields of oE designated by the elements of array copy into array e. This copy of the fields of object oE takes place in the loop at lines 3-7. More generally, an FCT pattern boils down to an assignment of the form o1where v is a variable, o1 and o2 are two objects, f is a function over field names, and g is a function over values. ...

show abstract

QUIC Graphs: Relational Invariant Generation for Containers

Cited by 9 publications

References 27 publications

Automatic Analysis of Open Objects in Dynamic Language Programs

Automatic Analysis of Open Objects in Dynamic Language Programs

QUICr: A Reusable Library for Parametric Abstraction of Sets and Numbers

Weakly sensitive analysis for JavaScript object‐manipulating programs

Contact Info

Product

Resources

About