On Temporal Path Conditions in Dependence Graphs

Abstract

Program dependence graphs are a well-established device to represent possible information flow in a program. Path conditions in dependence graphs have been proposed to express more detailed circumstances of a particular flow; they provide precise necessary conditions for information flow along a path or chop in a dependence graph. Ordinary boolean path conditions, however, cannot express temporal properties, e.g. that for a specific flow it is necessary that some condition holds, and later another specific condition holds.In this contribution, we introduce temporal path conditions, which extend ordinary path conditions by temporal operators in order to express temporal dependencies between conditions for a flow. We present motivating examples, generation and simplification rules, application of model checking to generate witnesses for a specific flow, and a case study. We prove the following soundness property: if a temporal path condition for a path is satisfiable, then the ordinary boolean path condition for the path is satisfiable. The converse does not hold, indicating that temporal path conditions are more precise.

Static path conditions for Java

“…Boolean conditions become conservative when analyzing loops and conditions that involve loop variables. A recent approach by Lochbihler and Snelting [24] extends path conditions with temporal logic to circumvent these imprecisions. Witnesses are created by model checking instead of constraint solvers.…”

On Temporal Path Conditions in Dependence Graphs

“…This contribution is an extended version of the one published at SCAM 2007 (Lochbihler and Snelting 2007). Apart from extra examples, definitions and intuition in all major sections, the issues with loop-carried dependences and shortcomings of boolean path conditions with respect to them are now discussed in detail in Sec.…”

“…A slightly stronger lemma is shown in (Lochbihler 2006). The key idea is that all SSA variables that occur in the maximal conjunction are defined in nodes which cannot be executed between u and v. Hence, they have the same value at both states before and after the U operator.…”

“…A proof can be found in (Lochbihler 2006). Theorem 1 says that if a witness for an influence along a PDG path π is found for the LTL formula then we can obtain a satisfying assignment for the boolean path condition from the witness.…”

“…In this section, we present a short case study in which we have applied LTL path conditions to discover a way of manipulating a weighing scale. A more detailed description can be found in (Lochbihler 2006). Fig.…”