Compositional may-must program analysis

GodefroidPatrice,; NoriAditya, V; RajamaniSriram, K; Deep, TetaliSai

doi:10.1145/1707801.1706307

Cited by 47 publications

(2 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Nesting approaches [3,4,25,26,30,32,49,82,84] use one or more approaches as components in a main approach. Interleaved approaches [1,2,5,10,42,50,55,58,62,68,75,78,90,97] alternate between different approaches that may or may not exchange information. Testification approaches [28,29,39,43,52,74,81] often sequentially combine a verification and a validation approach and prioritize or only report confirmed proofs and alarms.…”

Section: Related Workmentioning

confidence: 99%

Parallel Program Analysis via Range Splitting

Haltermann

Jakobs

Richter

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Ranged symbolic execution has been proposed as a way of scaling symbolic execution by splitting the task of path exploration onto several workers running in parallel. The split is conducted along path ranges which – simply speaking – describe sets of paths. Workers can then explore path ranges in parallel.In this paper, we propose ranged analysis as the generalization of ranged symbolic execution to arbitrary program analyses. This allows us to not only parallelize a single analysis, but also run different analyses on different ranges of a program in parallel. Besides this generalization, we also provide a novel range splitting strategy operating along loop bounds, complementing the existing random strategy of the original proposal. We implemented ranged analysis within the tool CPAchecker and evaluated it on programs from the SV-COMP benchmark. The evaluation in particular shows the superiority of loop bounds splitting over random splitting. We furthermore find that compositions of ranged analyses can solve analysis tasks that none of the constituent analysis alone can solve.

show abstract

Section: Related Workmentioning

confidence: 99%

Parallel Program Analysis via Range Splitting

Haltermann

Jakobs

Richter

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Note that it often makes sense to use both may and must summaries [138]. In the case of symbolic execution, we might use may summaries to check for function preconditions and must summaries to summarize the effects of the function.…”

Section: Summariesmentioning

confidence: 99%

Static Analyses for C++ in the Presence of Separate Compilation

Horváth¹

2020

View full text Add to dashboard Cite

List of Figures vi List of Tables viiiListings ix for all their care and help. From time to time, my friends helped me escape from my research, which made me more productive and focused upon return.I also want to thank everyone who helped me with their technical expertise, especially my supervisor, Norbert Pataki, who started counseling me during my BSc studies. His counsel was indispensable for completing my dissertation, and it made Chapter 2 possible. I am thankful for my former employers and colleagues who were very supportive in allowing me to continue my research and inspired me for new problems to study. My special thanks go to Zoltán Porkoláb, Dániel Krupp, Gábor Márton, and the whole CodeChecker team at Ericsson. I could not have completed Chapter 4 and Chapter 6 without them. Moreover, I am beholden to Artem Dergachev and Aleksei Sidorin, who laid the first stepping stones for the cross translation unit analysis that is discussed in Chapter 4.Besides, I am thankful to all my co-authors, the participants of ELTE's Software Technology Laboratory, and the students who chose me as their thesis advisor. They all contributed a significant amount of work to my studies. Contributions from Réka Kovács, Péter Szécsi, Kristóf Umann, Richárd Szalay, and Barnabás Bittner were exceeding all expectations.Furthermore, I am grateful for my Google Summer of Code mentor, Ted Kremenek, who counseled me while I was implementing textual summaries for Clang discussed in Chapter 5. His insights were invaluable.Additionally, I want to thank Herb Sutter, Kyle Reed from Microsoft, and Matthias Gehre from Silexica for all their contributions to Chapter 3. My work was based on Herb's paper, while the implementation was built on top of Matthias' initial version. Kyle was working on another implementation of the lifetime analysis for the MSVC toolchain and helped my work with his insightful feedback.Finally, I am indebted to Fuchsia's toolchain team and some other engineers at Google, including Petr Hosek and Dmitri Gribenko. Petr made it possible for me to continue my research during my internship at Google. Dmitri was an enormous help in upstreaming some of the work I did on lifetime analysis.

show abstract

Design and implementation of a dynamic symbolic execution tool for windows executables

Chen

Zhang

Zhu

et al. 2013

J Software Evolu Process

View full text Add to dashboard Cite

Dynamic symbolic execution, or DSE for short, has become a promising technique in software testing. However, the implementation details of DSE have not been described in depth in existing works. Although some open-source DSE tools are available nowadays, to design and implement a specific DSE tool from scratch is necessary for some reasons. To this end, we implement a Smart Fuzzing Tool for Windows Native Executables, or SMAFE for short, which utilizes Pin and STP for instrumentation and constraint solving, respectively. Advantages of Pin and STP make SMAFE portable. The major contribution of this paper is our detailed description of the implementation of DSE, including symbolization of inputs, tracking of symbols, synchronization of overlapped symbols, environment modeling, and so on. A practical case study validates the effectiveness of SMAFE. Then, the experiments with two benchmark sets present that the code coverage is above 90% on average. Benefits from this paper are at least twofold: moderating learning curve for scholars and shortening the development circle for practitioners.instructions that affect EFLAGS is considerably large. Hence, the cost of the complete method is rather expensive. Furthermore, the complete method is more complete than we need because we empirically observed that only three instructions CMP, TEST, and SUB are commonly utilized for comparison in practice (account for 100% of comparisons in our experiments).As other instructions, comparison instructions also need to convert into the CRD language. CMP and SUB are converted into 'CMPn' operation straightforwardly. But the conversion of TEST is different. SMAFE does the conversion according to the semantics of TEST. For instance, here is an instruction 'TEST al, 10' and the register al is symbolized as input1. The conversion result in CRD language is '(CMP8 (AND8 input1 10) 0)'. Figure 9. Heuristic rules for searching in memory tables. 1262 T. CHEN ET AL.

show abstract

Compositional may-must program analysis

Cited by 47 publications

References 30 publications

Parallel Program Analysis via Range Splitting

Parallel Program Analysis via Range Splitting

Static Analyses for C++ in the Presence of Separate Compilation

Design and implementation of a dynamic symbolic execution tool for windows executables

Contact Info

Product

Resources

About