Automatic Detection of Uninitialized Variables

Abstract

One of the most common programming errors is the use of a variable before its definition. This undefined value may produce incorrect results, memory violations, unpredictable behaviors and program failure. To detect this kind of error, two approaches can be used: compile-time analysis and run-time checking. However, compile-time analysis is far from perfect because of complicated data and control flows as well as arrays with non-linear, indirection subscripts, etc. On the other hand, dynamic checking, although supported by hardware and compiler techniques, is costly due to heavy code instrumentation while information available at compile-time is not taken into account. This paper presents a combination of an efficient compile-time analysis and a source code instrumentation for run-time checking. All kinds of variables are checked by PIPS, a Fortran research compiler for program analyses, transformation, parallelization and verification. Uninitialized array elements are detected by using imported array region, an efficient inter-procedural array data flow analysis. If exact array regions cannot be computed and compile-time information is not sufficient, array elements are initialized to a special value and their utilization is accompanied by a value test to assert the legality of the access. In comparison to the dynamic instrumentation, our method greatly reduces the number of variables to be initialized and to be checked. Code instrumentation is only needed for some array sections, not for the whole array. Tests are generated as early as possible. In addition, programs can be proved to be free from used-before-set errors statically at compile-time or, on the contrary, have real undefined errors. Experiments on SPEC95 CFP show encouraging results on analysis cost and run-time overheads.

Precise detection of un-initialized variables in large, real-life COBOL programs in presence of unrealizable paths

“…Making use of both dynamic and static analysis techniques, Nguyen et al [8] present a combination of compiletime analysis along with source code instrumentation for run-time checking, but only for Fortran programs. In this approach, the authors propose inter-procedural array dataflow analysis.…”

Author retrospective for semantical interprocedural parallelization

“…We combined static and dynamic analyses to obtain both safety and efficiency: array overflows, aliasing detection and proper variable initialization [27,26,28]. We also had to analyze non-integer variables and non-affine expressions because they control the behaviors of large applications.…”

Efficient Interprocedural Data-Flow Analysis Using Treedepth and Treewidth

“…Data-flow. Data-flow analysis is a catch-all term for a wide and expressive variety of static program analyses that include common tasks such as reaching definitions [30], points-to and alias analysis [74,76,77,80,81,82], null-pointer dereferencing [58,55,32], uninitialized variables [61] and dead code elimination [43], as well as several other standard frameworks, e.g. gen-kill and bit-vector problems [49,50,47].…”