Value and allocation sensitivity in static Python analyses

Abstract

Sound static analyses for large subsets of static programming languages such as C are now widespread. For example the Astrée static analyzer soundly overapproximates the behavior of C programs that do not contain any dynamic code loading, longjmp statements nor recursive functions. The sound and precise analysis of widely used dynamic programming languages like JavaScript and Python remains a challenge. This paper examines the variation of static analyses of Python-in precision, time and memory usage-by adapting three parameters: (i) the value sensitivity, (ii) the allocation sensitivity and (iii) the activation of an abstract garbage collector. It is not clear yet which level of sensitivity constitutes a sweet spot in terms of precision versus efficiency to achieve a meaningful Python analysis. We thus perform an experimental evaluation using a prototype static analyzer on benchmarks a few thousand lines long. Key findings are: the value analysis does not improve the precision over type-related alarms; the value analysis is three times costlier than the type analysis; the allocation sensitivity depends on the value sensitivity; using an abstract garbage collector lowers memory usage and running times, but does not affect precision. CCS Concepts: • Theory of computation → Program analysis; • Software and its engineering → Semantics.

A memory footprint optimization framework for Python applications targeting edge devices

“…Aiming to enable the efficient deployment of Python applications in embedded systems and micro-controllers, the authors of [24] introduce a run-time system that allows the execution of high-level languages and they discuss the static memory allocation behavior of Python. Additionally, the work in [25] proposes an abstract garbage collector (AGC), which detects and removes unreachable abstract addresses and works as a tracing garbage collector. A similar approach in [26] describes a dynamic memory leak detection method for dynamic languages.…”

A Multilanguage Static Analysis of Python Programs with Native C Extensions

“…We assume the abstract semantics of Python and C are provided through E # p • , E # c • . These can be instantiated in practice using previous works [37,34]. We assume that each language's abstract state relies on an address allocation abstraction (such as the callsite abstraction or the recency abstraction [2]) and a numeric abstraction (such as intervals, octagons, …).…”

“…A specific feature of Mopsa is to provide loosely-coupled abstract domains that the user combines through a configuration file to define the analysis. We were able to reuse off-the-shelf value analyses of C programs [37] and Python programs [34] already implemented into Mopsa. The only modification needed was to add a multilanguage domain, implementing the semantics of the operators at the boundary, just as our semantics (both concrete and abstract) do.…”

“…Our analyzer works by induction on the syntax and switches from one language to the other just as the concrete program execution does. We present a multilanguage static analysis built upon pre-existing value static analyses by abstract interpretation [9] of C [37] and Python [33,34]. It detects runtime errors in the native C code (invalid pointer operations, invalid memory accesses, integer overflows), in the Python code (raised exceptions), and at the boundary between the languages.…”