Runtime Instrumentation for Precise Flow-Sensitive Type Analysis

Abstract

Abstract. We describe a combination of runtime information and static analysis for checking properties of complex and configurable systems. The basic idea of our approach is to 1) let the program execute and thereby read the important dynamic configuration data, then 2) invoke static analysis from this runtime state to detect possible errors that can happen in the continued execution. This approach improves analysis precision, particularly with respect to types of global variables and nested data structures. It also enables the resolution of modules that are loaded based on dynamically computed information. We describe an implementation of this approach in a tool that statically computes possible types of variables in PHP applications, including detailed types of nested maps (arrays). PHP is a dynamically typed language; PHP programs extensively use nested value maps, as well as 'include' directives whose arguments are dynamically computed file names. We have applied our analysis tool to over 50'000 lines of PHP code, including the popular DokuWiki software, which has a plug-in architecture. The analysis identified 200 problems in the code and in the type hints of the original source code base. Some of these problems can cause exploits, infinite loops, and crashes. Our experiments show that dynamic information simplifies the development of the analysis and decreases the number of false alarms compared to a purely static analysis approach.

Dynamic determinacy analysis

“…Kneuss et al [21] describe an (unsound) analysis for finding type errors in PHP that uses a flow-sensitive static analysis starting from a program state recorded by a dynamic analysis.…”

Trustworthy numerical computation in Scala

“…Currently, the developers have no reliable automated method to determine these approximation errors. It is striking that, for many important program correctness properties we now have type systems and static analyzers that can establish them over all executions [7,15,19,22,36,37,54], whereas for numerical errors, we lack practical methods to estimate errors even for one, given, execution. Namely, it is difficult to determine whether a given execution is correct in the sense that its final result is close to the result of the corresponding sequence of operations in real analysis.…”

Data-flow Analysis of Programs with Associative Arrays

“…An update can involve more than one element and can be statically unknown. The update at line 4 is statically unknown and thus may or may not influence accesses at lines 5,7,8,9,15, and 20. Similarly, line 11 can access index 2 in any index at the first level.…”

“…Phantm [5] is a PHP 5 static analyzer for type mismatch based on data-flow analysis; it aims at detection of type errors. It combines run-time information from the bootstrapping phase of an application and static analysis when instrumentation using this information is used.…”