Static Analysis of String Values

Costantini, Giulia; Ferrara, Pietro; Cortesi, Agostino

doi:10.1007/978-3-642-24559-6_34

Cited by 32 publications

(25 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Costantini et al presents an abstract interpretation-based framework for string analysis and instantiates the framework for four different abstract domains [4]: a) The character inclusion domain, which tracks what characters may or must occur within the string, b) the prefix/suffix domain, which tracks the k first and last characters of the string, c) the bricks domain, where a brick b = [P(s)] max min represents all strings that can be generated by concatenating elements of P(s) between min and max times, and d) the string graph domain for which we refer the reader to [4] for details. Costantini et al's work does not discuss string equality which is a key issue for our work.…”

Section: Related Workmentioning

confidence: 99%

String Analysis for Dynamic Field Access

Madsen

Andreasen

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In JavaScript, and scripting languages in general, dynamic field access is a commonly used feature. Unfortunately, current static analysis tools either completely ignore dynamic field access or use overly conservative approximations that lead to poor precision and scalability.We present new string domains to reason about dynamic field access in a static analysis tool. A key feature of the domains is that the equal, concatenate and join operations take O(1) time.Experimental evaluation on four common JavaScript libraries, including jQuery and Prototype, shows that traditional string domains are insufficient. For instance, the commonly used constant string domain can only ensure that at most 21% dynamic field accesses are without false positives. In contrast, our string domain H ensures no false positives for up to 90% of all dynamic field accesses.We demonstrate that a dataflow analysis equipped with the H domain gains significant precision resulting in an analysis speedup of more than 1.5x for 7 out of 10 benchmark programs.

show abstract

Section: Related Workmentioning

confidence: 99%

String Analysis for Dynamic Field Access

Madsen

Andreasen

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…One alternative to c2i for proving these examples involves designing a new abstract interpretation [14,13], which requires designing an abstract domain that incorporates both strings and integers, an abstraction function, a widening operator, and abstract transfer functions that are precise enough to find disjunctive invariants like the one shown above. Such an alternative requires significantly greater effort than instantiating c2i.…”

Section: Stringsmentioning

confidence: 99%

From Invariant Checking to Invariant Inference Using Randomized Search

Sharma

Aiken

2014

Computer Aided Verification

View full text Add to dashboard Cite

Abstract. We describe a general framework c2i for generating an invariant inference procedure from an invariant checking procedure. Given a checker and a language of possible invariants, c2i generates an inference procedure that iteratively invokes two phases. The search phase uses randomized search to discover candidate invariants and the validate phase uses the checker to either prove or refute that the candidate is an actual invariant. To demonstrate the applicability of c2i, we use it to generate inference procedures that prove safety properties of numerical programs, prove non-termination of numerical programs, prove functional specifications of array manipulating programs, prove safety properties of string manipulating programs, and prove functional specifications of heap manipulating programs that use linked list data structures.

show abstract

“…They are all caused by code that concatenates and splits strings, and then makes assumptions about the size of the resulting strings. We could address this issue by adopting a more precise (and more expensive) string analysis [7]. However, our experience shows that this additional precision would be useful only in a few cases; therefore, we decided to opt for a faster but less precise string analysis.…”

Section: Precisionmentioning

confidence: 99%