Bytecode Model Checking: An Experimental Analysis

Abstract

Java bytecode verification is traditionally performed by a polynomial time dataflow algorithm. We investigate an alternative based on reducing bytecode verification to model checking. Despite an exponential worst case time complexity, model checking type-correct bytecode is polynomial in practice when carried out using an explicit state, onthe-fly model checker like Spin. We investigate this theoretically and experimentally and explain the practical advantages of this alternative.

Points-to analysis using BDDs

“…Bandera [9] is a tool-set applying such ideas to analyzing realistic programs. Like some other work [6], it abstracts program properties to linear temporal logic (LTL) or computational tree logic (CTL) formulas, which can be verified efficiently by existing model checking tools. Martena and Pietro [21] studied the application of a model checker, Spin, to solve intraprocedural alias analysis for C. In a different program analysis setting, BDD-based groundness analysis for constraint (logic) programs has become one of the standard approaches [14].…”