Checking race freedom via linear programming

Abstract

We present a new static analysis for race freedom and race detection. The analysis checks race freedom by reducing the problem to (rational) linear programming. Unlike conventional static analyses for race freedom or race detection, our analysis avoids explicit computation of locksets and lock linearity/must-aliasness. Our analysis can handle a variety of synchronization idioms that more conventional approaches often have difficulties with, such as thread joining, semaphores, and signals. We achieve efficiency by utilizing modern linear programming solvers that can quickly solve large linear programming instances. This paper reports on the formal properties of the analysis and the experience with applying an implementation to real world C programs.

Fractional Ownerships for Safe Memory Deallocation

“…He extended input/output modes to capabilities ranging over [−1, 1], and used them to guarantee that there is no leakage of memory cells for storing constructors. Our type system actually seems closer to his system than to other later fractional capability systems [1,12,13]. In particular, his system assigns a capability (or, an ownership in our terminology) to each node reachable from a variable (just as our type system assigns an ownership to each pointer reachable from a variable), and the unification constraint X = Y between variables plays a role similar to our assert commands.…”

“…Other potential advantages of our type-based approach are: (i) By allowing programmers to declare ownership types, they may serve as good specifications of functions or modules, and also enhance modular verification, (ii) Our approach can probably be extended to deal with multi-threaded programs, along the line of previous work using fractional capabilities [1,12,13], and (iii) There is a clear proof of soundness of the analysis, based on a standard technique for proving type soundness (see the longer version [4]). A main limitation of our approach is that our type system cannot properly handle cycles (recall the discussion in Section 4) and value-dependent (or, path-sensitive) behaviors.…”

“…Terauchi [12,13] later found another advantage of using fractions: inference of fractional permissions (or capabilities) can be reduced to a linear programming problem (rather than integer linear programming), which can be solved in polynomial time. The type system of this paper mainly exploits the latter advantage.…”

Safe Locking for Multi-threaded Java

“…Besides that, our analysis can handle re-entrant locks, which are common in object-oriented languages such as Java or C , whereas [15] covers only binary locks. The same restriction applies to [16], which represents a type system assuring race-freedom. Gerakios et.al.…”

Type-Based Automated Verification of Authenticity in Cryptographic Protocols

“…The idea of using rational numbers in type systems goes back to the work of Boyland [17], and has been extensively studied by Terauchi [18][19][20].…”