Trace-based control-flow analysis

Montagu, Benoît; Jensen, Thomas

doi:10.1145/3453483.3454057

Cited by 6 publications

(5 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The role of the fixpoint solver is to find a post-fixpoint of this functional. Similar approaches-leveraging fixpoint solvers to define static analysers-have been successfully used in other work on static analysis [22,64,50,4]. Our abstract interpreter is defined in Figure 2, where t eval E denotes the abstract value of type m ♯ A obtained by analysing the program t under the abstract environment E, and using the analysis function eval for recursive calls.…”

Section: A Monadic Abstract Interpreter In Open Recursive Stylementioning

confidence: 99%

“…Our analyser is context sensitive: we implemented a form of call site sensitivity, that is akin to an abstraction of the call stack. Following [50], we retain full sensitivity until the list of call sites becomes maximal, i.e., when a program point appears more than once in that list, which may indicate a recursive call to some function. In addition, we always remember the last call site.…”

Section: Refinements With Respect To the Formal Presentationmentioning

confidence: 99%

“…In practice, the list of call sites is an additional parameter to the abstract interpreter. Following [50] again, we use this list of call sites to decide when widening on the environments should be performed: it is performed only when eval is called on a maximal list of call sites. The same list of call sites is also used to derive dynamic exception names and abstract pointers (see §6.4 and §6.5).…”

Section: Refinements With Respect To the Formal Presentationmentioning

confidence: 99%

“…The goal of CFA is to determine which functions might be called at a call site, and on which arguments. CFA can be expressed as instances of abstract interpretation [46,44,47,50]. CFA can easily be extended to analyse exceptions.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

Lermusiaux,

Montagu

2024

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Exception handling is a key feature in modern programming languages. Exceptions can be used to deal with errors, or as a means to control the flow of execution of a program. Since they might unexpectedly terminate a program, unhandled exceptions are a serious safety concern. We propose a static analysis to detect uncaught exceptions in functional programs, that is defined as an abstract interpreter. It computes a description of the values potentially returned by a program using a novel abstract domain, that can express inductively defined sets of values. Simultaneously, the analysis infers the possibly raised exceptions, by computing in the abstract exception monad. This abstract interpreter has been implemented as an effective static analyser for a large subset of programs, that supports mutable data types, the module system, and dynamically extensible data types such as the exception type. The analyser has been evaluated on several hundreds of programs.

show abstract

Section: A Monadic Abstract Interpreter In Open Recursive Stylementioning

confidence: 99%

Section: Refinements With Respect To the Formal Presentationmentioning

confidence: 99%

Section: Refinements With Respect To the Formal Presentationmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

Lermusiaux,

Montagu

2024

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…In a sequential setting, splitting control locations according to some abstraction of reaching traces is a common technique for improving the precision of dataflow analyses [9,27] or abstract interpretation [25,34,41,47]. Control point splitting can be understood as an instance of the reduced cardinal power domain [12,13,22].…”

Section: Monat and Minémentioning

confidence: 99%

Clustered Relational Thread-Modular Abstract Interpretation with Local Traces

Schwarz

Saan

Seidl

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We construct novel thread-modular analyses that track relational information for potentially overlapping clusters of global variables – given that they are protected by common mutexes. We provide a framework to systematically increase the precision of clustered relational analyses by splitting control locations based on abstractions of local traces. As one instance, we obtain an analysis of dynamic thread creation and joining. Interestingly, tracking less relational information for globals may result in higher precision. We consider the class of 2-decomposable domains that encompasses many weakly relational domains (e.g., Octagons). For these domains, we prove that maximal precision is attained already for clusters of globals of sizes at most 2.

show abstract

The digest framework: concurrency-sensitivity for abstract interpretation

Schwarz,

Erhard

2024

Int J Softw Tools Technol Transfer

View full text Add to dashboard Cite

Thread-modular approaches to static analysis help mitigate the state space explosion encountered when analyzing multi-threaded programs. This is enabled by abstracting away some aspects of interactions between threads. We propose the notion of concurrency-sensitivity, which determines how an analysis takes the computation history of a multi-threaded program into account to exclude spurious thread interactions. Just as for other form of sensitivity, such as flow-, context, and path-sensitivity, there is a trade-off to be made between precision and scalability. The choice of concurrency-sensitivity is typically hard-coded into the analysis. However, the suitability of a chosen sensitivity hinges on the program and property to be analyzed. We thus propose to decouple the concurrency-sensitivity from the analysis and realize this in a generic framework. The framework allows for the seamless incorporation of custom abstractions of the computation history of a thread, so-called digests, to exclude spurious thread interactions. While concrete digests track properties precisely, the framework enables further abstraction through abstract digests. These may decrease analysis cost while hopefully retaining precision for the property of interest. We propose digests that, e.g., track held mutexes, thread IDs, or observed events. Digests tailored to programming language features, such as condition variables or recursive mutexes, highlight the framework’s versatility.

show abstract

Trace-based control-flow analysis

Cited by 6 publications

References 41 publications

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

Clustered Relational Thread-Modular Abstract Interpretation with Local Traces

The digest framework: concurrency-sensitivity for abstract interpretation

Contact Info

Product

Resources

About