Using Program Synthesis for Program Analysis

Abstract

In this paper, we identify a fragment of second-order logic with restricted quantification that is expressive enough to capture numerous static analysis problems (e.g. safety proving, bug finding, termination and non-termination proving, superoptimisation). We call this fragment the synthesis fragment. Satisfiability of a formula in the synthesis fragment is decidable over finite domains; specifically the decision problem is NEXPTIME-complete. If a formula in this fragment is satisfiable, a solution consists of a satisfying assignment from the second order variables to functions over finite domains. To concretely find these solutions, we synthesise programs that compute the functions. Our program synthesis algorithm is complete for finite state programs, i.e. every function over finite domains is computed by some program that we can synthesise. We can therefore use our synthesiser as a decision procedure for the synthesis fragment of second-order logic, which in turn allows us to use it as a powerful backend for many program analysis tasks. To show the tractability of our approach, we evaluate the program synthesiser on several static analysis problems.

Counterexample Guided Inductive Synthesis Modulo Theories

“…Heuristics for constant synthesis are presented in [11], where the solution language is parameterised, inducing a lattice of progressively more expressive languages. One of the parameters is word width, which allows synthesizing programs with constants that satisfy the specification for smaller word widths.…”

Sound and Automated Synthesis of Digital Stabilizing Controllers for Continuous Plants

“…Program synthesizers implementing Counter-Example Guided Inductive Synthesis (CEGIS) [34] are now able to generate programs for highly non-trivial specifications with a very high degree of automation. Modern synthesis engines combine automated testing, genetic algorithms, and SMT-based automated reasoning [1,11].…”

Program synthesis: challenges and opportunities

“…An important aspect of any CEGIS-based synthesis algorithm is the manner in which the space of candidate programs is being searched. Next, we describe the most popular strategies, which are run in parallel in [ 9 ].…”

“…Then, proving safety of loop L is equivalent to proving the satisfiability of the formula [ S ]. If, as shown below, we augment the previous example with an initial state and an assertion, then the program synthesizer in [ 9 ] finds I ( x ) = x ≥ 0 as a safety invariant:…”