Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3106237.3106249acmconferencesArticle/Chapter ViewAbstractPublication PagesfseConference Proceedingsconference-collections
research-article
Public Access

Failure-directed program trimming

Published: 21 August 2017 Publication History

Abstract

This paper describes a new program simplification technique called program trimming that aims to improve the scalability and precision of safety checking tools. Given a program P, program trimming generates a new program P' such that P and P' are equi-safe (i.e., P' has a bug if and only if P has a bug), but P' has fewer execution paths than P. Since many program analyzers are sensitive to the number of execution paths, program trimming has the potential to improve the effectiveness of safety checking tools.
In addition to introducing the concept of program trimming, this paper also presents a lightweight static analysis that can be used as a pre-processing step to remove program paths while retaining equi-safety. We have implemented the proposed technique in a tool called Trimmer and evaluate it in the context of two program analysis techniques, namely abstract interpretation and dynamic symbolic execution. Our experiments show that program trimming significantly improves the effectiveness of both techniques.

References

[1]
Hiralal Agrawal and Joseph Robert Horgan. 1990. Dynamic Program Slicing. In PLDI. ACM, 246–256.
[2]
Alex Aiken, Suhabe Bugrara, Isil Dillig, Thomas Dillig, Brian Hackett, and Peter Hawkins. 2007. An Overview of the Saturn Project. In PASTE. ACM, 43–48.
[3]
Aws Albarghouthi, Isil Dillig, and Arie Gurfinkel. 2016. Maximal Specification Synthesis. In POPL. ACM, 789–801.
[4]
Thomas Ball, Rupak Majumdar, Todd D. Millstein, and Sriram K. Rajamani. 2001. Automatic Predicate Abstraction of C Programs. In PLDI. ACM, 203–213.
[5]
Thomas Ball, Mayur Naik, and Sriram K. Rajamani. 2003. From Symptom to Cause: Localizing Errors in Counterexample Traces. In POPL. ACM, 97–105.
[6]
Thomas Ball and Sriram K. Rajamani. 2001. The SLAM Toolkit. In CAV (LNCS), Vol. 2102. Springer, 260–264.
[7]
Thomas Ball and Sriram K. Rajamani. 2002. The SLAM Project: Debugging System Software via Static Analysis. In POPL. ACM, 1–3.
[8]
Michael Barnett, Bor-Yuh Evan Chang, Robert DeLine, Bart Jacobs, and K. Rustan M. Leino. 2005. Boogie: A Modular Reusable Verifier for Object-Oriented Programs. In FMCO (LNCS), Vol. 4111. Springer, 364–387.
[9]
Mike Barnett, Manuel Fähndrich, K. Rustan M. Leino, Peter Müller, Wolfram Schulte, and Herman Venter. 2011. Specification and Verification: The Spec# Experience. CACM 54 (2011), 81–91. Issue 6.
[10]
Mike Barnett and K. Rustan M. Leino. 2005. Weakest-Precondition of Unstructured Programs. In PASTE. ACM, 82–87.
[11]
Dirk Beyer. 2017. Competition on Software Verification (SV-COMP). (2017). https://sv-comp.sosy-lab.org.
[12]
Dirk Beyer, Thomas A. Henzinger, Ranjit Jhala, and Rupak Majumdar. 2007. The Software Model Checker BLAST: Applications to Software Engineering. STTT 9 (2007), 505–525. Issue 5.
[13]
Dirk Beyer, Thomas A. Henzinger, M. Erkan Keremoglu, and Philipp Wendler. 2012. Conditional Model Checking: A Technique to Pass Information between Verifiers. In FSE. ACM, 57–67.
[14]
Armin Biere, Alessandro Cimatti, Edmund M. Clarke, and Yunshan Zhu. 1999. Symbolic Model Checking without BDDs. In TACAS (LNCS), Vol. 1579. Springer, 193–207.
[15]
David Binkley and Keith Brian Gallagher. 1996. Program Slicing. Advances in Computers 43 (1996), 1–50.
[16]
Aaron R. Bradley. 2011. SAT-Based Model Checking Without Unrolling. In VMCAI (LNCS), Vol. 6538. Springer, 70–87.
[17]
Cristian Cadar, Daniel Dunbar, and Dawson R. Engler. 2008. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In OSDI. USENIX, 209–224.
[18]
Cristian Cadar and Dawson R. Engler. 2005. Execution Generated Test Cases: How to Make Systems Code Crash Itself. In SPIN (LNCS), Vol. 3639. Springer, 2–23.
[19]
Cristiano Calcagno, Dino Distefano, Peter W. O’Hearn, and Hongseok Yang. 2009. Compositional Shape Analysis by Means of Bi-Abduction. In POPL. ACM, 289–300.
[20]
Gerardo Canfora, Aniello Cimitile, and Andrea de Lucia. 1998. Conditioned Program Slicing. IST 40 (1998), 595–607. Issue 11–12.
[21]
Satish Chandra, Stephen J. Fink, and Manu Sridharan. 2009. Snugglebug: A Powerful Approach to Weakest Preconditions. In PLDI. ACM, 363–374.
[22]
Omar Chebaro, Nikolai Kosmatov, Alain Giorgetti, and Jacques Julliand. 2012. Program Slicing Enhances a Verification Technique Combining Static and Dynamic Analysis. In SAC. ACM, 1284–1291.
[23]
Yunja Choi, Mingyu Park, Taejoon Byun, and Dongwoo Kim. 2015. Efficient Safety Checking for Automotive Operating Systems Using Property-Based Slicing and Constraint-Based Environment Generation. Sci. Comput. Program. 103 (2015), 51–70. Issue 1.
[24]
Maria Christakis. 2015. Narrowing the Gap between Verification and Systematic Testing. Ph.D. Dissertation. ETH Zurich, Switzerland.
[25]
Maria Christakis, Peter Müller, and Valentin Wüstholz. 2012. Collaborative Verification and Testing with Explicit Assumptions. In FM (LNCS), Vol. 7436.
[26]
Springer, 132–146.
[27]
Maria Christakis, Peter Müller, and Valentin Wüstholz. 2016. Guiding Dynamic Symbolic Execution Toward Unverified Program Executions. In ICSE. ACM, 144–155.
[28]
Maria Christakis and Valentin Wüstholz. 2016. Bounded Abstract Interpretation. In SAS (LNCS), Vol. 9837. Springer, 105–125.
[29]
Edmund M. Clarke, Armin Biere, Richard Raimi, and Yunshan Zhu. 2001. Bounded Model Checking Using Satisfiability Solving. FMSD 19 (2001), 7–34. Issue 1.
[30]
Edmund M. Clarke, Orna Grumberg, Somesh Jha, Yuan Lu, and Helmut Veith. 2000. Counterexample-Guided Abstraction Refinement. In CAV (LNCS), Vol. 1855.
[31]
Springer, 154–169.
[32]
Joseph J. Comuzzi and Johnson M. Hart. 1996. Program Slicing Using Weakest Preconditions. In FME (LNCS), Vol. 1051. Springer, 557–575.
[33]
Patrick Cousot and Radhia Cousot. 1977. Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints. In POPL. ACM, 238–252.
[34]
Patrick Cousot, Radhia Cousot, Manuel Fähndrich, and Francesco Logozzo. 2013. Automatic Inference of Necessary Preconditions. In VMCAI (LNCS), Vol. 7737.
[35]
Springer, 128–148.
[36]
Patrick Cousot, Radhia Cousot, and Francesco Logozzo. 2011. Precondition Inference from Intermittent Assertions and Application to Contracts on Collections. In VMCAI (LNCS), Vol. 6538. Springer, 150–168.
[37]
Mike Czech, Marie-Christine Jakobs, and Heike Wehrheim. 2015. Just Test What You Cannot Verify!. In FASE (LNCS), Vol. 9033. Springer, 100–114.
[38]
Przemyslaw Daca, Ashutosh Gupta, Henzinger, and Thomas A. 2016. Abstraction-Driven Concolic Testing. In VMCAI (LNCS), Vol. 9583. Springer, 328–347.
[39]
Leonardo de Moura and Nikolaj Bjørner. 2008. Z3: An Efficient SMT Solver. In TACAS (LNCS), Vol. 4963. Springer, 337–340.
[40]
Edsger W. Dijkstra. 1975. Guarded Commands, Nondeterminacy and Formal Derivation of Programs. CACM 18 (1975), 453–457. Issue 8.
[41]
Isil Dillig and Thomas Dillig. 2013. Explain: A Tool for Performing Abductive Inference. In CAV (LNCS), Vol. 8044. Springer, 684–689.
[42]
Isil Dillig, Thomas Dillig, and Alex Aiken. 2008. Sound, Complete and Scalable Path-Sensitive Analysis. In PLDI. ACM, 270–280.
[43]
Isil Dillig, Thomas Dillig, and Alex Aiken. 2010. Fluid Updates: Beyond Strong vs. Weak Updates. In ESOP (LNCS), Vol. 6012. Springer, 246–266.
[44]
Isil Dillig, Thomas Dillig, and Alex Aiken. 2011. Precise Reasoning for Programs Using Containers. In POPL. ACM, 187–200.
[45]
Isil Dillig, Thomas Dillig, Boyang Li, and Kenneth L. McMillan. 2013. Inductive Invariant Generation via Abductive Inference. In OOPSLA. ACM, 443–456.
[46]
Thomas Dillig, Isil Dillig, and Swarat Chaudhuri. 2014. Optimal Guard Synthesis for Memory Safety. In CAV (LNCS), Vol. 8559. Springer, 491–507.
[47]
Julian Dolby, Mandana Vaziri, and Frank Tip. 2007. Finding Bugs Efficiently with a SAT Solver. In ESEC/FSE. ACM, 195–204.
[48]
Manuel Fähndrich and Francesco Logozzo. 2010. Static Contract Checking with Abstract Interpretation. In FoVeOOS (LNCS), Vol. 6528. Springer, 10–30.
[49]
Kostas Ferles, Valentin Wüstholz, Maria Christakis, and Isil Dillig. 2017. Failure-Directed Program Trimming (Extended Version). CoRR abs/1706.04468 (2017).
[50]
John Field, Ganesan Ramalingam, and Frank Tip. 1995. Parametric Program Slicing. In POPL. ACM, 379–392.
[51]
Cormac Flanagan, K. Rustan M. Leino, Mark Lillibridge, Greg Nelson, James B. Saxe, and Raymie Stata. 2002. Extended Static Checking for Java. In PLDI. ACM, 234–245.
[52]
Graeme Gange, Jorge A. Navas, Peter Schachte, Harald Søndergaard, and Peter J. Stuckey. 2016. An Abstract Domain of Uninterpreted Functions. In VMCAI (LNCS), Vol. 9583. Springer, 85–103.
[53]
Graeme Gange, Jorge A. Navas, Peter Schachte, Harald Søndergaard, and Peter J. Stuckey. 2016. Exploiting Sparsity in Difference-Bound Matrices. In SAS (LNCS), Vol. 9837. Springer, 189–211.
[54]
Patrice Godefroid, Nils Klarlund, and Koushik Sen. 2005. DART: Directed Automated Random Testing. In PLDI. ACM, 213–223.
[55]
Patrice Godefroid, Aditya V. Nori, Sriram K. Rajamani, and SaiDeep Tetali. 2010. Compositional May-Must Program Analysis: Unleashing the Power of Alternation. In POPL. ACM, 43–56.
[56]
Susanne Graf and Hassen Saïdi. 1997. Construction of Abstract State Graphs with PVS. In CAV (LNCS), Vol. 1254. Springer, 72–83.
[57]
Arie Gurfinkel, Ou Wei, and Marsha Chechik. 2008. Model Checking Recursive Programs with Exact Predicate Abstraction. In ATVA (LNCS), Vol. 5311. Springer, 95–110.
[58]
Mark Harman, Robert M. Hierons, Chris Fox, Sebastian Danicic, and John Howroyd. 2001. Pre/Post Conditioned Slicing. In ICSM. IEEE Computer Society, 138–147.
[59]
John Hatcliff, Matthew B. Dwyer, and Hongjun Zheng. 2000. Slicing Software for Model Construction. Higher-Order and Symbolic Computation 13 (2000), 315–353. Issue 4.
[60]
Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, and Kenneth L. McMillan. 2004. Abstractions from proofs. In POPL. ACM, 232–244.
[61]
Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, and Grégoire Sutre. 2002. Lazy Abstraction. In POPL. ACM, 58–70.
[62]
C. A. R. Hoare. 1969. An Axiomatic Basis for Computer Programming. CACM 12 (1969), 576–580. Issue 10.
[63]
C. A. R. Hoare. 1971. Procedures and Parameters: An Axiomatic Approach. In Symposium on Semantics of Algorithmic Languages. Lecture Notes in Mathematics, Vol. 188. Springer, 102–116.
[64]
C. A. R. Hoare and Jifeng He. 1987. The Weakest Prespecification. Inf. Process. Lett. 24 (1987), 127–132. Issue 2.
[65]
Krystof Hoder and Nikolaj Bjørner. 2012. Generalized Property Directed Reachability. In SAT (LNCS), Vol. 7317. Springer, 157–171.
[66]
Franjo Ivancic, Zijiang Yang, Malay K. Ganai, Aarti Gupta, Ilya Shlyakhter, and Pranav Ashar. 2005. F-Soft: Software Verification Platform. In CAV (LNCS), Vol. 3576. Springer, 301–306. ESEC/FSE’17, September 4–8, 2017, Paderborn, Germany Kostas Ferles, Valentin Wüstholz, Maria Christakis, and Isil Dillig
[67]
Joxan Jaffar and Vijayaraghavan Murali. 2014. A Path-Sensitively Sliced Control Flow Graph. In FSE. ACM, 133–143.
[68]
Ranjit Jhala and Rupak Majumdar. 2005. Path Slicing. In PLDI. ACM, 38–47.
[69]
James C. King. 1976. Symbolic Execution and Program Testing. CACM 19 (1976), 385–394. Issue 7.
[70]
Akash Lal and Shaz Qadeer. 2014. A Program Transformation for Faster Goal-Directed Search. In FMCAD. IEEE Computer Society, 147–154.
[71]
Chris Lattner and Vikram S. Adve. 2004. LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In CGO. IEEE Computer Society, 75–88.
[72]
Chris Lattner, Andrew Lenharth, and Vikram S. Adve. 2007. Making Context-Sensitive Points-to Analysis with Heap Cloning Practical for the Real World. In PLDI. ACM, 278–289.
[73]
K. Rustan M. Leino. 2005. Efficient Weakest Preconditions. IPL 93 (2005), 281–288. Issue 6.
[74]
Boyang Li, Isil Dillig, Thomas Dillig, Kenneth L. McMillan, and Mooly Sagiv. 2013. Synthesis of Circular Compositional Program Proofs via Abduction. In TACAS (LNCS), Vol. 7795. Springer, 370–384.
[75]
You Li, Zhendong Su, Linzhang Wang, and Xuandong Li. 2013. Steering Symbolic Execution to Less Traveled Paths. In OOPSLA. ACM, 19–32.
[76]
Francesco Logozzo and Thomas Ball. 2012. Modular and Verified Automatic Program Repair. In OOPSLA. ACM, 133–146.
[77]
Francesco Logozzo, Shuvendu K. Lahiri, Manuel Fähndrich, and Sam Blackshear. 2014. Verification Modulo Versions: Towards Usable Verification. In PLDI. ACM, 294–304.
[78]
Kin-Keung Ma, Yit Phang Khoo, Jeffrey S. Foster, and Michael Hicks. 2011. Directed Symbolic Execution. In SAS (LNCS), Vol. 6887. Springer, 95–111.
[79]
Lynette I. Millett and Tim Teitelbaum. 2000. Issues in Slicing PROMELA and Its Applications to Model Checking, Protocol Understanding, and Simulation. STTT 2 (2000), 343–349. Issue 4.
[80]
Antoine Miné. 2004. Weakly Relational Numerical Abstract Domains. (Domaines Numériques Abstraits Faiblement Relationnels). Ph.D. Dissertation. École Polytechnique, Palaiseau, France.
[81]
Yannick Moy. 2008. Sufficient Preconditions for Modular Assertion Checking. In VMCAI (LNCS), Vol. 4905. Springer, 188–202.
[82]
Mayur Naik, Hongseok Yang, Ghila Castelnuovo, and Mooly Sagiv. 2012. Abstractions from Tests. In POPL. ACM, 373–386.
[83]
Aditya V. Nori, Sriram K. Rajamani, Saideep Tetali, and Aditya V. Thakur. 2009. The YOGI Project: Software Property Checking via Static Analysis and Testing. In TACAS (LNCS), Vol. 5505. Springer, 178–181.
[84]
Amir Pnueli and Micha Sharir. 1981. Two Approaches to Interprocedural Data Flow Analysis. Program Flow Analysis: Theory and Applications (1981), 189–234.
[85]
Noam Rinetzky and Sharon Shoham. 2016. Property Directed Abstract Interpretation. In VMCAI (LNCS), Vol. 9583. Springer, 104–123.
[86]
Koushik Sen, Haruto Tanno, Xiaojing Zhang, and Takashi Hoshino. 2015. GuideSE: Annotations for Guiding Concolic Testing. In AST. IEEE Computer Society, 23–27.
[87]
Rahul Sharma, Isil Dillig, Thomas Dillig, and Alex Aiken. 2011. Simplifying Loop Invariant Generation Using Splitter Predicates. In CAV (LNCS), Vol. 6806.
[88]
Springer, 703–719.
[89]
Frank Tip. 1995. A Survey of Program Slicing Techniques. J. Prog. Lang. 3 (1995), 121–189. Issue 3.
[90]
Mark Weiser. 1981. Program Slicing. In ICSE. IEEE Computer Society, 439–449.
[91]
Glynn Winskel. 2012. The Formal Semantics of Programming Languages: An Introduction. MIT Press.
[92]
Valentin Wüstholz. 2015. Partial Verification Results. Ph.D. Dissertation. ETH Zurich, Switzerland.
[93]
Greta Yorsh, Eran Yahav, and Satish Chandra. 2008. Generating Precise and Concise Procedure Summaries. In POPL. ACM, 221–234.
[94]
Xin Zhang, Mayur Naik, and Hongseok Yang. 2013. Finding Optimum Abstractions in Parametric Dataflow Analysis. In PLDI. ACM, 365–376.
[95]
Haiyan Zhu, Thomas Dillig, and Isil Dillig. 2013. Automated Inference of Library Specifications for Source-Sink Property Verification. In APLAS (LNCS), Vol. 8301.

Cited By

View all
  • (2024)Parallel Program Analysis on Path RangesScience of Computer Programming10.1016/j.scico.2024.103154(103154)Online publication date: May-2024
  • (2023)Parallel Program Analysis via Range SplittingFundamental Approaches to Software Engineering10.1007/978-3-031-30826-0_11(195-219)Online publication date: 22-Apr-2023
  • (2022)Studying and Understanding the Tradeoffs Between Generality and Reduction in Software DebloatingProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering10.1145/3551349.3556970(1-13)Online publication date: 10-Oct-2022
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
ESEC/FSE 2017: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering
August 2017
1073 pages
ISBN:9781450351058
DOI:10.1145/3106237
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 21 August 2017

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Condition inference
  2. abstract interpretation
  3. dynamic symbolic execution

Qualifiers

  • Research-article

Funding Sources

Conference

ESEC/FSE'17
Sponsor:

Acceptance Rates

Overall Acceptance Rate 112 of 543 submissions, 21%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)66
  • Downloads (Last 6 weeks)9
Reflects downloads up to 15 Oct 2024

Other Metrics

Citations

Cited By

View all
  • (2024)Parallel Program Analysis on Path RangesScience of Computer Programming10.1016/j.scico.2024.103154(103154)Online publication date: May-2024
  • (2023)Parallel Program Analysis via Range SplittingFundamental Approaches to Software Engineering10.1007/978-3-031-30826-0_11(195-219)Online publication date: 22-Apr-2023
  • (2022)Studying and Understanding the Tradeoffs Between Generality and Reduction in Software DebloatingProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering10.1145/3551349.3556970(1-13)Online publication date: 10-Oct-2022
  • (2022)XDebloat: Towards Automated Feature-Oriented App DebloatingIEEE Transactions on Software Engineering10.1109/TSE.2021.312021348:11(4501-4520)Online publication date: 1-Nov-2022
  • (2022)Conditional Quantitative Program AnalysisIEEE Transactions on Software Engineering10.1109/TSE.2020.301677848:4(1212-1227)Online publication date: 1-Apr-2022
  • (2022)BEACON: Directed Grey-Box Fuzzing with Provable Path Pruning2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833751(36-50)Online publication date: May-2022
  • (2022)Reusing Predicate Precision in Value AnalysisIntegrated Formal Methods10.1007/978-3-031-07727-2_5(63-85)Online publication date: 1-Jun-2022
  • (2020)JShrink: in-depth investigation into debloating modern Java applicationsProceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering10.1145/3368089.3409738(135-146)Online publication date: 8-Nov-2020
  • (2020)Subdomain-based generality-aware debloatingProceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering10.1145/3324884.3416644(224-236)Online publication date: 21-Dec-2020
  • (2019)BDA: practical dependence analysis for binary executables by unbiased whole-program path sampling and per-path abstract interpretationProceedings of the ACM on Programming Languages10.1145/33605633:OOPSLA(1-31)Online publication date: 10-Oct-2019
  • Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Get Access

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media