An Abstract Domain for Trees with Numeric Relations

Abstract

We present an abstract domain able to infer invariants on programs manipulating trees. Trees considered in the article are defined over a finite alphabet and can contain unbounded numeric values at their leaves. Our domain can infer the possible shapes of the tree values of each variable and find numeric relations between: the values at the leaves as well as the size and depth of the tree values of different variables. The abstract domain is described as a product of (1) a symbolic domain based on a tree automata representation and (2) a numerical domain lifted, for the occasion, to describe numerical maps with potentially infinite and heterogeneous definition set. In addition to abstract set operations and widening we define concrete and abstract transformers on these environments. We present possible applications, such as the ability to describe memory zones, or track symbolic equalities between program variables. We implemented our domain in a static analysis platform and present preliminary results analyzing a tree-manipulating toy-language.

Combinations of Reusable Abstract Domains for a Multilingual Static Analyzer

“…and applying them to the reachability analysis of two widely different languages: Python and C (including a library modeling language). In addition to the implementation of classic abstractions, Mopsa has also been used to implement and test novel abstract domains such as [10], [11], and [12].…”

“…To illustrate this form of cooperation, consider the classic example of reducing intervals and congruences [16]. Given an interval [11,12] and a congruence 2Z+1, we can refine both values in two steps. Firstly, using the fact that the value is odd, the interval is refined into [11,11].…”

“…Although Mopsa is not yet able to analyze large-scale C nor realistic Python programs, we believe that these results are encouraging as few tools have yet shown the ability to analyze languages as dynamic as Python, nor been able to factor the analysis of such different languages as C and Python in the same framework. Moreover, Mopsa is intended as a platform for research, and has been exploited in several exploratory works on analyzing Python [10], strings [11], and trees [12]. We plan to release our implementation as open-source software.…”

Lifting Numeric Relational Domains to Algebraic Data Types

“…Lattice tree automata [16,17] augment tree automata with elements of an arbitrary abstract domain at their leaves, and allow to express non-relational integer constraints on the leaves of trees. More recently, [25,26] use a combination of tree automata and of a relational domain whose keys are regular expressions to express relational constraints between the numeric leaves of trees. They use regular expressions to denote sets of access paths within those trees, and thus to support structures of unbounded heights.…”

“…In this paper, we focus on the automatic analysis of programs that perform numeric operations and manipulate ADTs. So far, few works [16,25,26] have put emphasis on the analysis of such programs. They provide additional safety guarantees specifically related to this combination-such as the unreachability of branches of a pattern matching.…”