Result Certification of Static Program Analysers with Automated Theorem Provers

Abstract

Abstract. The automation of the deductive approach to program verification crucially depends on the ability to efficiently infer and discharge program invariants. In an ideal world, user-provided invariants would be strengthened by incorporating the result of static analysers as untrusted annotations and discharged by automated theorem provers. However, the results of object-oriented analyses are heavily quantified and cannot be discharged, within reasonable time limits, by state-of-the-art automated theorem provers. In the present work, we investigate an original approach for verifying automatically and efficiently the result of certain classes of object-oriented static analyses using off-the-shelf automated theorem provers. We propose to generate verification conditions that are generic enough to capture, not a single, but a family of analyses which encompasses Java bytecode verification and Fähndrich and Leino typesystem for checking null pointers. For those analyses, we show how to generate tractable verification conditions that are still quantified but fall in a decidable logic fragment that is reducible to the Effectively Propositional logic. Our experiments confirm that such verification conditions are efficiently discharged by off-the-shelf automated theorem provers.

Cooperative verifier-based testing with CoVeriTest

“…To improve on AFL, VeriFuzz applies verification techniques to compute initial inputs and to set the parameters for AFL. For the comparison of CoVeriTest with Veri-Fuzz, and Klee, we used VeriFuzz's and Klee's results 8 from Test-Comp 2019 [12], 9 where the coverage of the test suites was measured using the test-suite validator TestCov [34] in version v1.2, 10 which is based on gcov 11 to measure branch coverage.…”

“…state-space information [3,10,86,110], transform the state space into verification conditions [9,46,75,114], or transform the program into an easier verifiable program [87].…”

Differentially testing soundness and precision of program analyzers

“…In the literature, there are several techniques for evaluating different qualities of program analyzers. Especially to ensure soundness of an analyzer, existing work has explored a wide spectrum of techniques requiring varying degrees of human effort, for instance, manual proofs (e.g., [44]), interactive and automatic proofs (e.g., [45], [46]), testing (e.g., [47], [48]), and "smoke checking" [13]. There also exist evaluations of the efficiency [49] and precision [50] of various analyses.…”

An Experimental Evaluation of Deliberate Unsoundness in a Static Program Analyzer

“…There are, however, several approaches for ensuring soundness of static analyzers and checkers, ranging from manual proofs [14], over interactive and automatic proofs [3,4], to less formal techniques, such as "smoke checking" [1].…”