Two techniques to improve the precision of a demand-driven null-dereference verification approach

Abstract

The problem addressed in this paper is sound, scalable, demand-driven nulldereference verification for Java programs. Our approach consists conceptually of a base analysis, plus two major extensions for enhanced precision. The base analysis is a dataflow analysis wherein we propagate formulas in the backward direction from a given dereference, and compute a necessary condition at the entry of the program for the dereference to be potentially unsafe. The extensions are motivated by the presence of certain "difficult" constructs in real programs, e.g., virtual calls with too many candidate targets, and library method calls, which happen to need excessive analysis time to be analyzed fully. The base analysis is hence configured to skip such a difficult construct when it is encountered by dropping all information that has been tracked so far that could potentially be affected by the construct. Our extensions are essentially more precise ways to account for the effect of these constructs on information that is being tracked, without requiring full analysis of these constructs. The first extension is a novel scheme to transmit formulas along certain kinds of def-use edges, while the second extension is based on using manually constructed backwarddirection summary functions of library methods. We have implemented our approach, and applied it on a set of real-life benchmarks. The base analysis is on average able to declare about 84% of dereferences in each benchmark as safe, while the two extensions push this number up to 91%.

Optimizing demand‐driven null dereference verification via merging branches

“…The cost of time and memory is related to the number of explored paths, so if the number of explored paths is reduced, the cost can be reduced. Since our approach adds more predicates compared with Margoor and Komondoor (2015), we reduce the time and space overhead as much as possible by merging branch points while ensuring high accuracy. The experiment in this paper mainly shows the accuracy and the efficiency of merging.…”

“…To evaluate the accuracy of our approach, we compare MNDV with optimized null dereference verification (Margoor & Komondoor, 2015) (we call it ONDV in brief). Table 5 presents the result of the two approaches.…”

“…The state transformation of each statement in IR is shown as in Table 1. Based on the transformation rules in ONDV (Margoor & Komondoor, 2015), in MNDV, we add several rules for statements of type BINARYOP, CONDITIONAL and INVOKE. In addition, to prevent inaccurate alias analysis caused by WALA, alias analysis is not used to calculate variable alias relationship with current state for PUTFIELD rule.…”

“…There are many approaches to detect or verify null references, the main techniques used include static analysis (Ayewah & Pugh, 2010;Loginov et al, 2008;Madhavan & Komondoor, 2011;Margoor & Komondoor, 2015;Nanda & Sinha, 2009) and dynamic analysis (Gerasimov & Kruglov, 2018;Jiang et al, 2012;Zhao et al, 2011). Among all the works, Xylem (Nanda & Sinha, 2009) and Margoor and Komondoor (2015) verification techniques are the most related work to ours. Xylem proposed an inter-procedural data flow analysis method to detect the null dereference of Java programs.…”