Interactive, scalable, declarative program analysis

Abstract

Static analyses provide the semantic foundation for tools ranging from optimizing compilers to refactoring browsers and advanced debuggers. Unfortunately, developing new analysis specifications and implementations is often difficult and error-prone. Since analysis specifications are generally written in a declarative style, logic programming presents an attractive model for producing executable specifications of analyses. However, prior work on using logic programming for program analysis has focused exclusively on solving constraints derived from program texts by an external preprocessor. In this paper, we present DIMPLE, an analysis framework for Java bytecodes implemented in the Yap Prolog system [8]. DIM-PLE provides both a representation of Java bytecodes in a database of relations and a declarative domain-specific language for specifying new analyses as queries over this database. DIMPLE thus enables researchers to use logic programming for every step of the analysis development process, from specification to prototype to implementation. We demonstrate that our approach facilitates rapid prototyping of new program analyses and produces executable analysis implementations that are speed-competitive with specialized analysis toolkits.

From Datalog to flix: a declarative language for fixed points on lattices

“…Undoubtedly, the "killer-app" for Datalog has been points-to analysis of object-oriented programs [4,7,30,37,54,55,63]. This involves the specification and computation of sophisticated whole-program subset-based points-to analysis [1,31].…”

Strictly declarative specification of sophisticated points-to analyses

“…Previous pointer analysis algorithms in Datalog (mainly Whaley et al's bddbddb and its client analyses [21,28,29]) did not support onthe-fly call-graph discovery, except for very simple, contextinsensitive, analyses. 1 For a concrete instance of the mutual recursion, we can look at one of the rules defining the CallGraphEdge relation (which is used to compute VarPointsTo and itself uses VarPointsTo). The rule computes call graph edges due to virtual method invocations and is shown in Figure 1.…”

“…We discussed the relation to Whaley's work on context-sensitive pointer analysis using Datalog and BDDs [29] throughout this paper. The D [1] analysis framework has shown to be competitive in performance for context-insensitive pointer analysis using tabled Prolog. The demonstrated pointer analysis of D uses a conservative, pre-computed call graph, so the analysis is reduced to propagation of points-to information of assignments, which can be very efficient.…”

Mostly-Functional Behavior in Java Programs

“…We analyzed these programs with version 0.92 of the GNU Classpath library, using the Soot compiler framework [3] and the dimple + version of our dimple static analysis tool [4], running on version 5.1.3 of the Yap Prolog system [5]. We timed our analyses by running them on one core of a 2 ghz Opteron workstation with 16 gb of ram.…”