Results 1  10
of
35
Satisfiability modulo recursive programs
 In Static Analysis Symposium (SAS
, 2011
"... Abstract. We present a semidecision procedure for checking satisfiability of expressive correctness properties of recursive firstorder functional programs. In our approach, both properties and programs are expressed in the same language, a subset of Scala. We implemented our procedure and integrat ..."
Abstract

Cited by 31 (15 self)
 Add to MetaCart
(Show Context)
Abstract. We present a semidecision procedure for checking satisfiability of expressive correctness properties of recursive firstorder functional programs. In our approach, both properties and programs are expressed in the same language, a subset of Scala. We implemented our procedure and integrated it with the Z3 SMT solver and the Scala compiler. Our procedure is sound for counterexamples and for proofs of terminating functions. It is terminating and thus complete for many important classes of specifications, including all satisfiable formulas and all formulas where recursive functions satisfy certain syntactic restrictions. Using our system, Leon, we verified detailed correctness properties for functional data structure implementations, as well as syntax tree manipulations. We have found our system to be fast for both finding counterexamples and finding correctness proofs, and to scale to larger programs than alternative techniques. 1
Live Heap Space Analysis for Languages with Garbage Collection
 In ISMM’09: Proceedings of the 8th international symposium on Memory management
, 2009
"... The peak heap consumption of a program is the maximum size of the live data on the heap during the execution of the program, i.e., the minimum amount of heap space needed to run the program without exhausting the memory. It is wellknown that garbage collection (GC) makes the problem of predicting t ..."
Abstract

Cited by 19 (6 self)
 Add to MetaCart
(Show Context)
The peak heap consumption of a program is the maximum size of the live data on the heap during the execution of the program, i.e., the minimum amount of heap space needed to run the program without exhausting the memory. It is wellknown that garbage collection (GC) makes the problem of predicting the memory required to run a program difficult. This paper presents, the best of our knowledge, the first live heap space analysis for garbagecollected languages which infers accurate upper bounds on the peak heap usage of a program’s execution that are not restricted to any complexity class, i.e., we can infer exponential, logarithmic, polynomial, etc., bounds. Our analysis is developed for an (sequential) objectoriented bytecode language with a scopedmemory manager that reclaims unreachable memory when methods return. We also show how our analysis can accommodate other GC schemes which are closer to the ideal GC which collects objects as soon as they become unreachable. The practicality of our approach is experimentally evaluated on a prototype implementation. We demonstrate that it is fully automatic, reasonably accurate and efficient by inferring live heap space bounds for a standardized set of benchmarks, the JOlden suite.
Decompilation of Java Bytecode to Prolog by Partial Evaluation
, 2009
"... Reasoning about Java bytecode (JBC) is complicated due to its unstructured controlflow, the use of threeaddress code combined with the use of an operand stack, etc. Therefore, many static analyzers and model checkers for JBC first convert the code into a higherlevel representation. In contrast to ..."
Abstract

Cited by 15 (9 self)
 Add to MetaCart
Reasoning about Java bytecode (JBC) is complicated due to its unstructured controlflow, the use of threeaddress code combined with the use of an operand stack, etc. Therefore, many static analyzers and model checkers for JBC first convert the code into a higherlevel representation. In contrast to traditional decompilation, such representation is often not Java source, but rather some intermediate language which is a good input for the subsequent phases of the tool. Interpretive decompilation consists in partially evaluating an interpreter for the compiled language (in this case JBC) written in a highlevel language w.r.t. the code to be decompiled. There have been proofsofconcept that interpretive decompilation is feasible, but there remain important open issues when it comes to decompile a real language such as JBC. This paper presents, to the best of our knowledge, the first modular scheme to enable interpretive decompilation of a realistic programming language to a highlevel representation, namely of JBC to Prolog. We introduce two notions of optimality which together require that decompilation does not generate code more than once for each program point. We demonstrate the impact of our modular approach and optimality issues on a series of realistic benchmarks. Decompilation times and decompiled program sizes are linear with the size of the input bytecode program. This demonstrates empirically the scalability of modular decompilation of JBC by partial evaluation.
On the Termination of Integer Loops
, 2012
"... In this paper we study the decidability of termination of several variants of simple integer loops, without branching in the loop body and with affine constraints as the loop guard (and possibly a precondition). We show that termination of such loops is undecidable in some cases, in particular, when ..."
Abstract

Cited by 12 (0 self)
 Add to MetaCart
In this paper we study the decidability of termination of several variants of simple integer loops, without branching in the loop body and with affine constraints as the loop guard (and possibly a precondition). We show that termination of such loops is undecidable in some cases, in particular, when the body of the loop is expressed by a set of linear inequalities where the coefficients are from Z∪{r} with r an arbitrary irrational; when the loop is a sequence of instructions, that compute either linear expressions or the step function; and when the loop body is a piecewise linear deterministic update with two pieces. The undecidability result is proven by a reduction from counter programs, whose termination is known to be undecidable. For the common case of integer linearconstraint loops with rational coefficients we have not succeeded in proving either decidability or undecidability of termination, but we show that a Petri net can be simulated with such a loop; this implies some interesting lower bounds. For example, termination for a partiallyspecified input is at least EXPSPACEhard.
Amortised resource analysis with separation logic
 IN EUROPEAN SYMPOSIUM ON PROGRAMMING (ESOP
, 2010
"... Typebased amortised resource analysis following Hofmann and Jost—where resources are associated with individual elements of data structures and doled out to the programmer under a linear typing discipline—have been successful in providing concrete resource bounds for functional programs, with good ..."
Abstract

Cited by 12 (1 self)
 Add to MetaCart
(Show Context)
Typebased amortised resource analysis following Hofmann and Jost—where resources are associated with individual elements of data structures and doled out to the programmer under a linear typing discipline—have been successful in providing concrete resource bounds for functional programs, with good support for inference. In this work we translate the idea of amortised resource analysis to imperative languages by embedding a logic of resources, based on Bunched Implications, within Separation Logic. The Separation Logic component allows us to assert the presence and shape of mutable data structures on the heap, while the resource component allows us to state the resources associated with each member of the structure. We present the logic on a small imperative language with procedures and mutable heap, based on Java bytecode. We have formalised the logic within the Coq proof assistant and extracted a certified verification condition generator. We demonstrate the logic on some examples, including proving termination of inplace list reversal on lists with cyclic tails.
Efficient typechecking for amortised heapspace analysis
 in CSL, ser. LNCS
"... Abstract. The prediction of resource consumption in programs has gained interest in the last years. It is important for a number of areas, notably embedded systems and safety critical systems. Different approaches to achieve bounded resource consumption have been analysed. One of them, based on an ..."
Abstract

Cited by 8 (2 self)
 Add to MetaCart
Abstract. The prediction of resource consumption in programs has gained interest in the last years. It is important for a number of areas, notably embedded systems and safety critical systems. Different approaches to achieve bounded resource consumption have been analysed. One of them, based on an amortised complexity analysis, has been studied by Hofmann and Jost in 2006 for a Javalike language. In this paper we present an extension of this type system consisting of more general subtyping and sharing relations that allows us to type more examples. Moreover we describe efficient automated typechecking for a finite, annotated version of the system. We prove soundness and completeness of the type checking algorithm and show its efficiency.
Validating Timed Models of Deployment Components with Parametric Concurrency
"... Many software systems today are designed without assuming a fixed underlying architecture, and may be adapted for sequential, multicore, or distributed deployment. Examples of such systems are found in, e.g., software product lines, serviceoriented computing, information systems, embedded systems ..."
Abstract

Cited by 7 (6 self)
 Add to MetaCart
(Show Context)
Many software systems today are designed without assuming a fixed underlying architecture, and may be adapted for sequential, multicore, or distributed deployment. Examples of such systems are found in, e.g., software product lines, serviceoriented computing, information systems, embedded systems, operating systems, and telephony. Models of such systems need to capture and range over relevant deployment scenarios, so it is interesting to lift aspects of lowlevel deployment concerns to the abstraction level of the modeling language. This paper proposes an abstract model of deployment components for concurrent objects, extending the Creol modeling language. The deployment components are parametric in the amount of concurrency they provide; i.e., they vary in processing resources. We give a formal semantics of deployment components and characterize equivalence between deployment components which differ in concurrent resources in terms of test suites. Our semantics is executable on Maude, which allows simulations and test suites to be applied to a deployment component with different concurrent resources.
Proving termination starting from the end
, 2013
"... We present a novel technique for proving program termination which introduces a new dimension of modularity. Existing techniques use the program to incrementally construct a termination proof. While the proof keeps changing, the program remains the same. Our technique goes a step further. We show ..."
Abstract

Cited by 6 (0 self)
 Add to MetaCart
(Show Context)
We present a novel technique for proving program termination which introduces a new dimension of modularity. Existing techniques use the program to incrementally construct a termination proof. While the proof keeps changing, the program remains the same. Our technique goes a step further. We show how to use the current partial proof to partition the transition relation into those behaviors known to be terminating from the current proof, and those whose status (terminating or not) is not known yet. This partition enables a new and unexplored dimension of incremental reasoning on the program side. In addition, we show that our approach naturally applies to conditional termination which searches for a precondition ensuring termination. We further report on a prototype implementation that advances the stateoftheart on the grounds of termination and conditional termination.
Tasklevel analysis for a language with async/finish parallelism
 In LCTES
"... The task level of a program is the maximum number of tasks that can be available (i.e., not finished nor suspended) simultaneously during its execution for any input data. Static knowledge of the task level is of utmost importance for understanding and debugging parallel programs as well as for guid ..."
Abstract

Cited by 5 (5 self)
 Add to MetaCart
(Show Context)
The task level of a program is the maximum number of tasks that can be available (i.e., not finished nor suspended) simultaneously during its execution for any input data. Static knowledge of the task level is of utmost importance for understanding and debugging parallel programs as well as for guiding task schedulers. We present, to the best of our knowledge, the first static analysis which infers safe and precise approximations on the task level for a language with asyncfinish parallelism. In parallel languages, async and finish are basic constructs for, respectively, spawning tasks and waiting until they terminate. They are the core of modern, parallel, distributed languages like X10. Given a (parallel) program, our analysis returns a tasklevel upper bound, i.e., a function on the program’s input arguments that guarantees that the task level of the program will never exceed its value along any execution. Our analysis provides a series of useful (over)approximations, going from the total number of tasks spawned in the execution up to an accurate estimation of the task level.