Data-flow Analysis of Programs with Associative Arrays

Hauzar, David; Kofroň, Jan; Baštecký, Pavel

doi:10.4204/eptcs.150.6

Cited by 5 publications

(2 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The field-sensitive static taint analysis tracks variable value, which is the second parameter of method put(). To cope with heap-reachable data-flows, field-sensitive analyses commonly propagate data-flow facts in the form of access paths [1,2,4,5,6,10,14,41,42]. An access path comprises a local variable followed by a sequence of field accesses, and every field-store statement adds an element to the sequence.…”

Section: Taint Analysismentioning

confidence: 99%

Applications of Synchronized Pushdown Systems

Späth

2020

Ernst Denert Award for Software Engineering 2019

View full text Add to dashboard Cite

A precise static data-flow analysis transforms the program into a context-sensitive and field-sensitive approximation of the program. It is challenging to design an analysis of this precision efficiently due to the fact that the analysis is undecidable per se. Synchronized pushdown systems (SPDS) present a highly precise approximation of context-sensitive and field-sensitive data-flow analysis. This chapter presents some data-flow analyses that SPDS can be used for. Further on, this chapter summarizes two other contributions of the thesis “Synchronized Pushdown System for Pointer and Data-Flow Analysis” called Boomerang and IDEal. Boomerang is a demand-driven pointer analysis that builds on top of SPDS and minimizes the highly computational effort of a whole-program pointer analysis by restricting the computation to the minimal program slice necessary for an individual query. IDEal is a generic and efficient framework for data-flow analyses, e.g., typestate analysis. IDEal resolves pointer relations automatically and efficiently by the help of Boomerang. This reduces the burden of implementing pointer relations into an analysis. Further on, IDEal performs strong updates, which makes the analysis sound and precise.

show abstract

Section: Taint Analysismentioning

confidence: 99%

Applications of Synchronized Pushdown Systems

Späth

2020

Ernst Denert Award for Software Engineering 2019

View full text Add to dashboard Cite

show abstract

“…Let us assume a context-sensitive, flow-sensitive, and fieldsensitive static taint analysis that tracks the inserted value, which is a parameter to the method put(). To cope with heap-reachable data-flows, field-sensitive analyses commonly propagate dataflow facts in the form of access paths [Arzt et al 2014;Balatsouras et al 2017;Cheng and Hwu 2000;De and D'Souza 2012;Deutsch 1994;Feng et al 2015;Hauzar et al 2014;Tripp et al 2013Tripp et al , 2009. An access path comprises a local variable followed by a sequence of field accesses, and every field-store statement adds an element to the sequence.…”

Section: Introductionmentioning

confidence: 99%

Context-, flow-, and field-sensitive data-flow analysis using synchronized Pushdown systems

Späth

Ali

Bodden

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Precise static analyses are context-, field-and flow-sensitive. Context-and field-sensitivity are both expressible as context-free language (CFL) reachability problems. Solving both CFL problems along the same data-flow path is undecidable, which is why most flow-sensitive data-flow analyses over-approximate field-sensitivity through k-limited access-path, or through access graphs. Unfortunately, as our experience and this paper show, both representations do not scale very well when used to analyze programs with recursive data structures. Any single CFL-reachability problem is efficiently solvable, by means of a pushdown system. This work thus introduces the concept of synchronized pushdown systems (SPDS). SPDS encode both procedure calls/returns and field stores/loads as separate but "synchronized" CFL reachability problems. An SPDS solves both individual problems precisely, and approximation occurs only in corner cases that are apparently rare in practice: at statements where both problems are satisfied but not along the same data-flow path. SPDS are also efficient: formal complexity analysis shows that SPDS shift the complexity from ⋃︀F⋃︀ 3k under k-limiting to ⋃︀S⋃︀⋃︀F⋃︀ 2 , where F is the set of fields and S the set of statements involved in a data-flow. Our evaluation using DaCapo shows this shift to pay off in practice: SPDS are almost as efficient as k-limiting with k ≙ 1 although their precision equals k ≙ ∞. For a typestate analysis SPDS accelerate the analysis up to 83× for data-flows of objects that involve many field accesses but span rather few methods. We conclude that SPDS can provide high precision and further improve scalability, in particularly when used in analyses that expose rather local data flows.

show abstract

WeVerca: Web Applications Verification for PHP

Hauzar

Kofroň

2014

Software Engineering and Formal Methods

View full text Add to dashboard Cite

Data-flow Analysis of Programs with Associative Arrays

Cited by 5 publications

References 13 publications

Applications of Synchronized Pushdown Systems

Applications of Synchronized Pushdown Systems

Context-, flow-, and field-sensitive data-flow analysis using synchronized Pushdown systems

WeVerca: Web Applications Verification for PHP

Contact Info

Product

Resources

About