Selective context-sensitivity guided by impact pre-analysis

Oh, Hakjoo; Lee, Wonchan; Heo, Kihong; Yang, Hongseok; Yi, Kwangkeun

doi:10.1145/2594291.2594318

Cited by 56 publications

(22 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For analyzers that come with a proof of soundness, the criterion often used is that of precision, i.e., that the analyzer does not report too many false positives. The rate of true positives can be improved by chaining the main analysis with a suitably tailored pre-analysis (Oh et al 2014), or by involving a user into the loop and taking her feedback into account (Raghothaman et al 2018).…”

Section: Discussion and Related Workmentioning

confidence: 99%

A true positives theorem for a static race detector

Gorogiannis

O’Hearn

Sergey

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

RacerD is a static race detector that has been proven to be effective in engineering practice: it has seen thousands of data races fixed by developers before reaching production, and has supported the migration of Facebook's Android app rendering infrastructure from a single-threaded to a multi-threaded architecture. We prove a True Positives Theorem stating that, under certain assumptions, an idealized theoretical version of the analysis never reports a false positive. We also provide an empirical evaluation of an implementation of this analysis, versus the original RacerD.The theorem was motivated in the first case by the desire to understand the observation from production that RacerD was providing remarkably accurate signal to developers, and then the theorem guided further analyzer design decisions. Technically, our result can be seen as saying that the analysis computes an underapproximation of an over-approximation, which is the reverse of the more usual (over of under) situation in static analysis. Until now, static analyzers that are effective in practice but unsound have often been regarded as ad hoc; in contrast, we suggest that, in the future, theorems of this variety might be generally useful in understanding, justifying and designing effective static analyses for bug catching.RacerD is not sound in the sense of computing an over-approximation of some abstraction of executions. Over-approximations support a theorem: if the analyzer says there are no bugs, then there are none. I.e., there are no false negatives (when the program has no bugs), which is often considered as a "soundness" theorem. RacerD favours reducing false positives over false negatives. A design goal was to "detect actionable races that developers find useful and respond to" but "no need to (provably) find them all". In fact, it is very easy to generate artificial false negatives, but Blackshear et al. (2018) say that few have been reported in over a year of RacerD in production.One can react to this by saying that RacerD is simply an ad hoc, if effective, tool. But, the tool does not heuristically filter out bug reports in order to reduce false positives. It first does computations with an abstract domain, and then issues data race reports if any potential races are found according to the abstract domain. Its architecture is like that of a principled analyzer based on abstract interpretation, even though it does not satisfy the usual soundness theorem. This suggests that saying RacerD is ad hoc because it does not satisfy a standard soundness theorem is somehow missing something: It would be better if a demonstrably-effective analyzer with a principled design came with a theoretical explanation, even if partial, for its effectiveness. That is the research problem we set ourselves to solve in this work.A natural question is if it is possible to actually modify RacerD so as to make it sound, without losing its effectiveness in generating signal-actionable and useful data race reports that developers are keen to fix. RacerD's initial d...

show abstract

Section: Discussion and Related Workmentioning

confidence: 99%

A true positives theorem for a static race detector

Gorogiannis

O’Hearn

Sergey

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…Then, subsequent analyses apply different contextsensitivities to functions depending on their characteristics. Another approach applies selective analysis to improve analysis scalability in proving queries related to buffer overflow [21]. At a pre-analysis stage, it uses a simple abstract value domain only with two elements that denote positive and unknown signs of buffer indices.…”

Section: Related Workmentioning

confidence: 99%

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

2019

View full text Add to dashboard Cite

Researchers have developed various techniques for static analysis of JavaScript to improve analysis precision. To develop such techniques, they first identify causes of the precision losses for unproven properties. While most of the existing work has diagnosed main causes of imprecision in static analysis by manual investigation, manually tracing the imprecision causes is challenging because it requires detailed knowledge of analyzer internals. Recently, several studies proposed to localize the analysis imprecision causes automatically, but these localization techniques work for only specific analysis techniques.In this paper, we present an automatic technique that can trace analysis imprecision causes of JavaScript applications starting from user-selected variables. Given a set of program variables, our technique stops an analysis when any of the variables gets imprecise analysis values. It then traces the imprecise analysis values using intermediate analysis results back to program points where the imprecision first started. Our technique shows the trace information with a new representation called tracing graphs, whose nodes and edges together represent traces from imprecise points to precise points. In order to detect major causes of analysis imprecision automatically, we present four node/edge patterns in tracing graphs for common imprecision causes. We formalized the technique of generating tracing graphs and identifying patterns, and implemented them on SAFE, a state-of-the-art JavaScript static analyzer with various analysis configurations, such as contextsensitivity, loop-sensitivity, and heap cloning. Our evaluation demonstrates that the technique can easily find 96 % of the major causes of the imprecision problems in 17 applications by only automatic detection in tracing graphs using the patterns, and selectively adopting various advanced techniques can eliminate the found causes of imprecision. ACM CCS 2012Software and its engineering → Software verification; Automated static analysis;

show abstract

“…It uses various analysis techniques such as a general sparse analysis framework [Oh et al 2012] for scalability and alarm clustering [Lee et al 2012b] for convenience. In addition to traditional sensitivities, Sparrow supports a way to use context-sensitivity selectively [Oh et al 2014]. After estimating the impact of contextsensitivity on the analysis's precision, it turns on and off context-sensitivity depending on whether it improves the analysis precision.…”

Section: Sparrowmentioning

confidence: 99%

“…Selective context-sensitivity serves an important role in the analysis precision with modest overhead. For example, [Oh et al 2014] performs a comparison between the baseline context-insensitive interval analysis and the selective context-sensitive analysis: the selective sensitivity reduces the number of (false) alarms by 24.4%, while increasing the analysis cost by 27.8% on average. As the selective sensitivity method also improves the precision of a relational analysis, it may be applicable to other sensitive analyses like flow-sensitive analysis and loop-sensitive analysis [Park and Ryu 2015].…”

Section: Sparrowmentioning

confidence: 99%

A Theoretical Foundation of Sensitivity in an Abstract Interpretation Framework

Kim¹,

Rival

Ryu

2018

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

xx A Theoretical Foundation of Sensitivity in an Abstract Interpretation FrameworkSE-WON KIM, S-Core 1 XAVIER RIVAL, CNRS, ENS, INRIA Paris-Rocquencourt, PSL* University SUKYOUNG RYU, KAIST Program analyses often utilize various forms of sensitivity such as context sensitivity, call-site sensitivity, and object sensitivity. These techniques all allow for more precise program analyses, that are able to compute more precise program invariants, and to verify stronger properties. Despite the fact that sensitivity techniques are now part of the standard toolkit of static analyses designers and implementers, no comprehensive frameworks allow the description of all common forms of sensitivity. As a consequence, the soundness proofs of static analysis tools involving sensitivity often rely on ad hoc formalization, which are not always carried out in an abstract interpretation framework. Moreover, this also means that opportunities to identify similarities between analysis techniques to better improve abstractions or to tune static analysis tools can easily be missed.In this paper, we present and formalize a framework for the description of sensitivity in static analysis. Our framework is based on a powerful abstract domain construction, and utilizes reduced cardinal power to tie basic abstract predicates to the properties analyses are sensitive to. We formalize this abstraction, and the main abstract operations that are needed to turn it into a generic abstract domain construction. We demonstrate that our approach can allow for a more precise description of program states, and that it can also describe a large set of sensitivity techniques, both when sensitivity criteria are static (known before the analysis) or dynamic (inferred as part of the analysis), and sensitive analysis tuning parameters. Last, we show that sensitivity techniques used in state of the art static analysis tools can be described in our framework.

show abstract

Selective context-sensitivity guided by impact pre-analysis

Cited by 56 publications

References 18 publications

A true positives theorem for a static race detector

A true positives theorem for a static race detector

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

A Theoretical Foundation of Sensitivity in an Abstract Interpretation Framework

Contact Info

Product

Resources

About