STLlint: lifting static checking from languages to libraries

Abstract

Traditional static checking centers around finding bugs in programs by isolating cases where the language has been used incorrectly. These language-based checkers do not understand the semantics of software libraries, and therefore cannot be used to detect errors in the use of libraries. In this paper, we introduce STLlint, a program analysis we have implemented for the C++ Standard Template Library and similar, generic software libraries, and we present the general approach that underlies STLlint. We show that static checking of library semantics differs greatly from checking of language semantics, requiring new representations of program behavior and new algorithms. Major challenges include checking the use of generic algorithms, loop analysis for interfaces, and organizing behavioral specifications for extensibility. STLlint: LIFTING STATIC CHECKING FROM LANGUAGES TO LIBRARIES 227 and 'sorted' post-condition describe particular orderings on the values that will be referenced by the given iterators. Overall, static checking given such a high-level specification must cope with abstractions far from the language itself, including user-defined data types described only by their conceptual requirements, and must provide checking for semantic guarantees written in terms of these abstractions.We present here the challenges of 'lifting' a static checker from the language level to the level of abstract, generic software libraries. We focus on the widely used C++ STL and its abstractions, and present our 'higher-level' static checker STLlint [14] that performs checking of the use of the STL. Characteristic of our approach is that it is based on symbolic execution rather than on abstract interpretation, which proved to be too imprecise for our purpose. While most of the symbolic techniques we employ are not new themselves, we combine them in a way that they together can address the unique challenges of library analysis. In addition, we present the first attempt at user-centric, extensible static checking for generic software libraries such as the C++ STL. The resulting tool, STLlint, can handle STL in its entirety, with no restrictions; empirical tests of STLlint include comprehensive sets of examples from two standard textbooks and showed a low false positive rate of 0.59%.This article is presented as follows. Section 2 describes the motivation behind STLlint, illustrating the shortcomings of language-level static checking and the need for library-aware static checkers. We then describe the challenges we have faced in the construction of STLlint and the methods we have used to overcome those challenges, including our approach to checking with abstractions in Section 3, the challenges of dealing with iterators as higher-level induction variables in Section 4, and a way to manage extensibility in a large generic library in Section 5.

Correct Code Containing Containers

“…On the other hand, Gregor and Schupp [13] focus, like we do, on the certification of user programs. They present an unsound static analysis of C++ programs using STL containers.…”

A fully verified container library

“…Gregor and Schupp [GS06] perform static checking (based on symbolic execution) of C ++ 's Standard Template Library (STL) containers. The basic idea is dealing with STL's idiomatic iterator features as if they were language extensions, whose semantics is hard-coded as symbolic execution constraints.…”

Semantic-Aware Automatic Parallelization of Modern Applications Using High-Level Abstractions

“…They focused on language and runtime support for optimistic parallelization while we aim to extend the classic compiler-based parallelization. STLlint [11] performs static checking for STL usage based on symbolic execution. Yi and Quinlan [34] developed a set of sophisticated semantic annotations to enable conventional sequential loop optimizations on user-defined array classes.…”