The set constraint/CFL reachability connection in practice

Kodumal, John; Aiken, Alex

doi:10.1145/996841.996867

Cited by 72 publications

(57 citation statements)

References 18 publications

(15 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…PN -reachability was previously used for conservative static analysis [9,30,19]. However, in SDSE, we are always asking about PN -reachability from the current instruction.…”

Section: Shortest-distance Symbolic Executionmentioning

confidence: 99%

Directed Symbolic Execution

Phang

Foster

et al. 2011

Lecture Notes in Computer Science

143

132

View full text Add to dashboard Cite

Abstract. In this paper, we study the problem of automatically finding program executions that reach a particular target line. This problem arises in many debugging scenarios; for example, a developer may want to confirm that a bug reported by a static analysis tool on a particular line is a true positive. We propose two new directed symbolic execution strategies that aim to solve this problem: shortest-distance symbolic execution (SDSE) uses a distance metric in an interprocedural control flow graph to guide symbolic execution toward a particular target; and call-chain-backward symbolic execution (CCBSE) iteratively runs forward symbolic execution, starting in the function containing the target line, and then jumping backward up the call chain until it finds a feasible path from the start of the program. We also propose a hybrid strategy, Mix-CCBSE, which alternates CCBSE with another (forward) search strategy. We compare these three with several existing strategies from the literature on a suite of six GNU coreutils programs. We find that SDSE performs extremely well in many cases but may fail badly. CCBSE also performs quite well, but imposes additional overhead that sometimes makes it slower than SDSE. Considering all our benchmarks together, Mix-CCBSE performed best on average, combining to good effect the features of its constituent components.

show abstract

“…PN -reachability was previously used for conservative static analysis [9,30,19]. However, in SDSE, we are always asking about PN -reachability from the current instruction.…”

Section: Shortest-distance Symbolic Executionmentioning

confidence: 99%

Directed Symbolic Execution

Phang

Foster

et al. 2011

Lecture Notes in Computer Science

143

132

View full text Add to dashboard Cite

show abstract

“…CFL-reachability [22,38] is an extension of graph reachability that is equivalent to the reachability problem formulated in terms of either recursive state machines [7] or set constraints [14]. Each reachable path in a PAG has a string formed by concatenating in order the labels of edges in the path, where load/store pairs on the same field must be matched (field sensitivity) and entry/exit pairs for the same callsite must be matched (context sensitivity).…”

Section: Points-to Analysis With Cfl-reachabilitymentioning

confidence: 99%

An Incremental Points-to Analysis with CFL-Reachability

Lü

Shang

Xie

et al. 2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract.Developing scalable and precise points-to analyses is increasingly important for analysing and optimising object-oriented programs where pointers are used pervasively. An incremental analysis for a program updates the existing analysis information after program changes to avoid reanalysing it from scratch. This can be efficiently deployed in software development environments where code changes are often small and frequent. This paper presents an incremental approach for demand-driven context-sensitive points-to analyses based on ContextFree Language (CFL) reachability. By tracing the CFL-reachable paths traversed in computing points-to sets, we can precisely identify and recompute on demand only the points-to sets affected by the program changes made. Combined with a flexible policy for controlling the granularity of traces, our analysis achieves significant speedups with little space overhead over reanalysis from scratch when evaluated with a null dereferencing client using 14 Java benchmarks.

show abstract

“…They also show how to extend the result to Heintze's ML set constraints [61] for closure analysis. Recently Kodumal and Aiken [90] have shown a particularly simple reduction from a context-free-language reachability problem to set constraints in the special case of Dyck context-free languages, i.e., languages of matching parentheses.…”

Section: Equivalences Between Cfl Reachability and Analysesmentioning

confidence: 99%

Control-flow analysis of functional programs

Midtgaard

2012

ACM Comput. Surv.

View full text Add to dashboard Cite

We present a survey of control-flow analysis of functional programs, which has been the subject of extensive investigation throughout the past 25 years. Analyses of the control flow of functional programs have been formulated in multiple settings and have led to many different approximations, starting with the seminal works of Jones, Shivers, and Sestoft. In this paper we survey control-flow analysis of functional programs by structuring the multitude of formulations and approximations and comparing them. * IT-parken,

show abstract

The set constraint/CFL reachability connection in practice

Cited by 72 publications

References 18 publications

Directed Symbolic Execution

Directed Symbolic Execution

An Incremental Points-to Analysis with CFL-Reachability

Control-flow analysis of functional programs

Contact Info

Product

Resources

About