Relative Store Fragments for Singleton Abstraction

Facchinetti, Leandro; Palmer, Zachary; Smith, Scott F.

doi:10.1007/978-3-319-66706-5_6

Cited by 4 publications

(1 citation statement)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their techniques keep applying transfer functions that infer preconditions backward from given post-conditions until they find any contradictory condition that refutes the queries. Demand-driven analysis [8,10,22,29,30,34] also performs a backward analysis, by which it finds relevant parts of programs to prove given queries and applies context-sensitivity to the functions that require higher precision in the program parts. Their goal of using backward analysis is different from ours in that they use a backward analysis to find contradictory pre-conditions or relevant program parts for proving some queries, while we use it to find major causes of analysis imprecision from some preceding forward analysis results.…”

Section: Cegar Approachmentioning

confidence: 99%

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

2019

View full text Add to dashboard Cite

Researchers have developed various techniques for static analysis of JavaScript to improve analysis precision. To develop such techniques, they first identify causes of the precision losses for unproven properties. While most of the existing work has diagnosed main causes of imprecision in static analysis by manual investigation, manually tracing the imprecision causes is challenging because it requires detailed knowledge of analyzer internals. Recently, several studies proposed to localize the analysis imprecision causes automatically, but these localization techniques work for only specific analysis techniques.In this paper, we present an automatic technique that can trace analysis imprecision causes of JavaScript applications starting from user-selected variables. Given a set of program variables, our technique stops an analysis when any of the variables gets imprecise analysis values. It then traces the imprecise analysis values using intermediate analysis results back to program points where the imprecision first started. Our technique shows the trace information with a new representation called tracing graphs, whose nodes and edges together represent traces from imprecise points to precise points. In order to detect major causes of analysis imprecision automatically, we present four node/edge patterns in tracing graphs for common imprecision causes. We formalized the technique of generating tracing graphs and identifying patterns, and implemented them on SAFE, a state-of-the-art JavaScript static analyzer with various analysis configurations, such as contextsensitivity, loop-sensitivity, and heap cloning. Our evaluation demonstrates that the technique can easily find 96 % of the major causes of the imprecision problems in 17 applications by only automatic detection in tracing graphs using the patterns, and selectively adopting various advanced techniques can eliminate the found causes of imprecision. ACM CCS 2012Software and its engineering → Software verification; Automated static analysis;

show abstract

Section: Cegar Approachmentioning

confidence: 99%

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

2019

View full text Add to dashboard Cite

show abstract

A Set-Based Context Model for Program Analysis

Fachinetti

Palmer

Smith

et al. 2020

Programming Languages and Systems

View full text Add to dashboard Cite

Higher-order Demand-driven Program Analysis

Facchinetti

Palmer

Smith

2019

ACM Trans. Program. Lang. Syst.

Self Cite

View full text Add to dashboard Cite

We explore a novel approach to higher-order program analysis that brings ideas of on-demand lookup from first-order CFL-reachability program analyses to higher-order programs. The analysis needs to produce only a control-flow graph; it can derive all other information including values of variables directly from the graph. Several challenges had to be overcome, including how to build the control-flow graph on-the-fly and how to deal with non-local variables in functions. The resulting analysis is flow-and context-sensitive with a provable polynomial-time bound. The analysis is formalized and proved correct and terminating, and an initial implementation is described.

show abstract

Relative Store Fragments for Singleton Abstraction

Cited by 4 publications

References 32 publications

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

A Set-Based Context Model for Program Analysis

Higher-order Demand-driven Program Analysis

Contact Info

Product

Resources

About