research-article

Mixing type checking and symbolic execution

Authors:

Yit Phang Khoo,

Bor-Yuh Evan Chang,

Jeffrey S. FosterAuthors Info & Claims

PLDI '10: Proceedings of the 31st ACM SIGPLAN Conference on Programming Language Design and Implementation

Pages 436 - 447

https://doi.org/10.1145/1806596.1806645

Published: 05 June 2010 Publication History

Abstract

Static analysis designers must carefully balance precision and efficiency. In our experience, many static analysis tools are built around an elegant, core algorithm, but that algorithm is then extensively tweaked to add just enough precision for the coding idioms seen in practice, without sacrificing too much efficiency. There are several downsides to adding precision in this way: the tool's implementation becomes much more complicated; it can be hard for an end-user to interpret the tool's results; and as software systems vary tremendously in their coding styles, it may require significant algorithmic engineering to enhance a tool to perform well in a particular software domain.

In this paper, we present Mix, a novel system that mixes type checking and symbolic execution. The key aspect of our approach is that these analyses are applied independently on disjoint parts of the program, in an off-the-shelf manner. At the boundaries between nested type checked and symbolically executed code regions, we use special mix rules to communicate information between the off-the-shelf systems. The resulting mixture is a provably sound analysis that is more precise than type checking alone and more efficient than exclusive symbolic execution. In addition, we also describe a prototype implementation, Mixy, for C. Mixy checks for potential null dereferences by mixing a null/non-null type qualifier inference system with a symbolic executor.

References

[1]

Thomas Ball and Sriram K. Rajamani. The SLAM project: debugging system software via static analysis. In Principles of Programming Languages (POPL), pages 1--3, 2002.

Digital Library

[2]

Richard Bornat. Proving pointer programs in Hoare logic. In Mathematics of Program Construction (MPC), pages 102--126, 2000.

Digital Library

[3]

Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, and Dawson R. Engler. EXE: automatically generating inputs of death. In Computer and Communications Security (CCS), pages 322--335, 2006.

Digital Library

[4]

Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, and Kenneth L. McMillan. Abstractions from proofs. In Principles of Programming Languages (POPL), pages 232--244, 2004.

Digital Library

[5]

Khoo Yit Phang, Bor-Yuh Evan Chang, and Jeffrey S. Foster. Mixing type checking and symbolic execution (extended version). Technical Report CS-TR-4954, Department of Computer Science, University of Maryland, College Park, 2010.

[6]

James C. King. Symbolic execution and program testing. Commun. ACM, 19(7):385--394, 1976.

Digital Library

[7]

Sorin Lerner, David Grove, and Craig Chambers. Composing dataflow analyses and transformations. In Principles of Programming Languages (POPL), pages 270--282, 2002.

Digital Library

[8]

Rupak Majumdar and Koushik Sen. Hybrid concolic testing. In International Conference on Software Engineering (ICSE), pages 416--426, 2007.

Digital Library

[9]

Joe M. Morris. A general axiom of assignment. Assignment and linked data structure. A proof of the Schorr-Waite algorithm. In Theoretical Foundations of Programming Methodology, pages 25--51, 1982.

[10]

George C. Necula, Scott McPeak, Shree Prakash Rahul, and Westley Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In Compiler Construction (CC), pages 213--228, 2002.

Digital Library

[11]

Greg Nelson and Derek C. Oppen. Simplification by cooperating decision procedures. ACM Trans. Program. Lang. Syst., 1(2):245--257, 1979.

Digital Library

[12]

Jens Palsberg and Todd Millstein. Type Systems: Advances and Applications. In The Compiler Design Handbook: Optimizations and Machine Code Generation, chapter 9. 2008.

[13]

Polyvios Pratikakis, Jeffrey S. Foster, and Michael W. Hicks. Locksmith: context-sensitive correlation analysis for race detection. In PLDI, pages 320--331, 2006.

Digital Library

[14]

Elnatan Reisner, Charles Song, Kin-Keung Ma, Jeffrey S. Foster, and Adam Porter. Using symbolic evaluation to understand behavior in configurable software systems. In International Conference on Software Engineering (ICSE), 2010. To appear.

Digital Library

[15]

Patrick M. Rondon, Ming Kawaguci, and Ranjit Jhala.Liquid types. In Programming Language Design and Implementation (PLDI), pages 159--169, 2008.

Digital Library

[16]

Patrick M. Rondon, Ming Kawaguchi, and Ranjit Jhala. Low-level liquid types. In Principles of Programming Languages (POPL), pages 131--144, 2010.

Digital Library

[17]

Koushik Sen, Darko Marinov, and Gul Agha. CUTE: a concolic unit testing engine for C. In Foundations of Software Engineering (FSE), pages 263--272, 2005.

Digital Library

[18]

Hongwei Xi and Frank Pfenning. Dependent types in practical programming. In Principles of Programming Languages (POPL), pages 214--227, 1999.

Digital Library

[19]

Kwangkeun Yi and Williams Ludwell Harrison, III. Automatic generation and management of interprocedural program analyses. In Principles of Programming Languages (POPL), pages 246--259, 1993.

Digital Library

[20]

Cristian Cadar, Daniel Dunbar, and Dawson R. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Operating Systems Design and Implementation (OSDI), pages 209--224, 2008.

Digital Library

[21]

James C. Corbett, Matthew B. Dwyer, John Hatcliff, Shawn Laubach, Corina S. Păsăreanu, Robby, and Hongjun Zheng. Bandera: extracting finite-state models from Java source code. In International Conference on Software Engineering (ICSE), pages 439--448, 2000.

Digital Library

[22]

Patrick Cousot and Radhia Cousot. Systematic design of program analysis frameworks. In Principles of Programming Languages (POPL), pages 269--282, 1979.

Digital Library

[23]

Cormac Flanagan. Hybrid type checking. In Principles of Programming Languages (POPL), pages 245--256, 2006.

Digital Library

[24]

Jeffrey S. Foster, Robert Johnson, John Kodumal, and Alex Aiken. Flow- insensitive type qualifiers. ACM Trans. Program. Lang. Syst., 28(6): 1035--1087, 2006.

Digital Library

[25]

Vijay Ganesh and David L. Dill. A decision procedure for bit-vectors and arrays. In Computer-Aided Verification (CAV), pages 519--531, July 2007.

Digital Library

[26]

Patrice Godefroid. Compositional dynamic test generation. In Principles of Programming Languages (POPL), pages 47--54, 2007.

Digital Library

[27]

Patrice Godefroid, Nils Klarlund, and Koushik Sen. DART: directed automated random testing. In Programming Language Design and Implementation (PLDI), pages 213--223, 2005.

Digital Library

[28]

Sumit Gulwani and Ashish Tiwari. Combining abstract interpreters. In Programming Language Design and Implementation (PLDI), pages 376--386, 2006.

Digital Library

[29]

Samuel Z. Guyer and Calvin Lin. Error checking with client-driven pointer analysis. Sci. Comput. Program., 58(1-2): 83--114, 2005.

Digital Library

Cited By

Zimmerman CDiVincenzo JAldrich J(2024)Sound Gradual Verification with Symbolic ExecutionProceedings of the ACM on Programming Languages10.1145/36329278:POPL(2547-2576)Online publication date: 5-Jan-2024
https://dl.acm.org/doi/10.1145/3632927
Baldoni RCoppa ED’elia DDemetrescu CFinocchi I(2018)A Survey of Symbolic Execution TechniquesACM Computing Surveys10.1145/318265751:3(1-39)Online publication date: 23-May-2018
https://dl.acm.org/doi/10.1145/3182657
Coughlin DChang B(2014)Fissile type analysisACM SIGPLAN Notices10.1145/2578855.253585549:1(73-85)Online publication date: 8-Jan-2014
https://dl.acm.org/doi/10.1145/2578855.2535855
Show More Cited By

Recommendations

Mixing type checking and symbolic execution
PLDI '10

Static analysis designers must carefully balance precision and efficiency. In our experience, many static analysis tools are built around an elegant, core algorithm, but that algorithm is then extensively tweaked to add just enough precision for the ...
Symbolic range analysis of pointers
CGO '16: Proceedings of the 2016 International Symposium on Code Generation and Optimization

Alias analysis is one of the most fundamental techniques that compilers use to optimize languages with pointers. However, in spite of all the attention that this topic has received, the current state-of-the-art approaches inside compilers still face ...
Theoretical aspects of compositional symbolic execution
FASE'11/ETAPS'11: Proceedings of the 14th international conference on Fundamental approaches to software engineering: part of the joint European conferences on theory and practice of software

Given a program and an assertion in that program, determining if the assertion can fail is one of the key applications of program analysis. Symbolic execution is a well-known technique for finding such assertion violations that can enjoy the following ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

PLDI '10: Proceedings of the 31st ACM SIGPLAN Conference on Programming Language Design and Implementation

June 2010

514 pages

ISBN:9781450300193

DOI:10.1145/1806596

General Chair:
Ben Zorn
Microsoft Research
,
Program Chair:
Alex Aiken
Stanford University

ACM SIGPLAN Notices Volume 45, Issue 6
PLDI '10
June 2010
496 pages
ISSN:0362-1340
EISSN:1558-1160
DOI:10.1145/1809028
Issue’s Table of Contents

Copyright © 2010 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGPLAN: ACM Special Interest Group on Programming Languages

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 05 June 2010

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

PLDI '10

Sponsor:

SIGPLAN

PLDI '10: ACM SIGPLAN Conference on Programming Language Design and Implementation

June 5 - 10, 2010

Ontario, Toronto, Canada

Acceptance Rates

Overall Acceptance Rate 406 of 2,067 submissions, 20%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

27
Total Citations
View Citations
683
Total Downloads

Downloads (Last 12 months)26
Downloads (Last 6 weeks)2

Reflects downloads up to 12 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Zimmerman CDiVincenzo JAldrich J(2024)Sound Gradual Verification with Symbolic ExecutionProceedings of the ACM on Programming Languages10.1145/36329278:POPL(2547-2576)Online publication date: 5-Jan-2024
https://dl.acm.org/doi/10.1145/3632927
Baldoni RCoppa ED’elia DDemetrescu CFinocchi I(2018)A Survey of Symbolic Execution TechniquesACM Computing Surveys10.1145/318265751:3(1-39)Online publication date: 23-May-2018
https://dl.acm.org/doi/10.1145/3182657
Coughlin DChang B(2014)Fissile type analysisACM SIGPLAN Notices10.1145/2578855.253585549:1(73-85)Online publication date: 8-Jan-2014
https://dl.acm.org/doi/10.1145/2578855.2535855
Coughlin DChang BJagannathan SSewell P(2014)Fissile type analysisProceedings of the 41st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages10.1145/2535838.2535855(73-85)Online publication date: 11-Jan-2014
https://dl.acm.org/doi/10.1145/2535838.2535855
Xu DKiselyov OThompson S(2012)Hybrid contract checking via symbolic simplificationProceedings of the ACM SIGPLAN 2012 workshop on Partial evaluation and program manipulation10.1145/2103746.2103767(107-116)Online publication date: 23-Jan-2012
https://dl.acm.org/doi/10.1145/2103746.2103767
Ma KPhang KFoster JHicks M(2011)Directed symbolic executionProceedings of the 18th international conference on Static analysis10.5555/2041552.2041563(95-111)Online publication date: 14-Sep-2011
https://dl.acm.org/doi/10.5555/2041552.2041563
Parameswaran AVenetis PGarcia-Molina H(2011)Recommendation systems with complex constraintsACM Transactions on Information Systems10.1145/2037661.203766529:4(1-33)Online publication date: 8-Dec-2011
https://dl.acm.org/doi/10.1145/2037661.2037665
Chen KBai JZheng Z(2011)Ranking function adaptation with boosting treesACM Transactions on Information Systems10.1145/2037661.203766329:4(1-31)Online publication date: 8-Dec-2011
https://dl.acm.org/doi/10.1145/2037661.2037663
Macdonald COunis ITonellotto N(2011)Upper-bound approximations for dynamic pruningACM Transactions on Information Systems10.1145/2037661.203766229:4(1-28)Online publication date: 8-Dec-2011
https://dl.acm.org/doi/10.1145/2037661.2037662
An JChaudhuri AFoster JHicks MBall TSagiv M(2011)Dynamic inference of static types for rubyProceedings of the 38th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages10.1145/1926385.1926437(459-472)Online publication date: 26-Jan-2011
https://dl.acm.org/doi/10.1145/1926385.1926437
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents