## A relational approach to interprocedural shape analysis (2004)

### Cached

### Download Links

- [www.cs.tau.ac.il]
- [www.irisa.fr]
- [www.cs.wisc.edu]
- [www.cs.wisc.edu]
- [www.cs.wisc.edu]
- [research.cs.wisc.edu]
- [www.cs.wisc.edu]
- [research.cs.wisc.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | In 11th SAS |

Citations: | 45 - 12 self |

### BibTeX

@INPROCEEDINGS{Loginov04arelational,

author = {Alexey Loginov and Thomas Reps and Mooly Sagiv},

title = {A relational approach to interprocedural shape analysis},

booktitle = {In 11th SAS},

year = {2004},

pages = {246--264}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. This paper addresses the verification of properties of imperative programs withrecursive procedure calls, heap-allocated storage, and destructive updating of pointer-valued fields--i.e., interprocedural shape analysis. It presents a way to harness some previouslyknown approaches to interprocedural dataflow analysis--which in past work have been applied only to much less rich settings--for interprocedural shape analysis. 1 Introduction This paper concerns techniques for static analysis of recursive programs that manipulateheap-allocated storage and perform destructive updating of pointer-valued fields. The goal is to recover shape descriptors that provide information about the characteristicsof the data structures that a program's pointer variables can point to. Such information can be used to help programmers understand certain aspects of the program's behavior,to verify properties of the program, and to optimize or parallelize the program.

### Citations

538 | Parametric shape analysis via 3-valued logic
- Sagiv, Reps, et al.
(Show Context)
Citation Context ...to verify properties of the program, and to optimize or parallelize the program. The work reported in the paper builds on past work by several of the authors on static analysis based on -valued logic =-=[1, 2]-=- and its implementation in the TVLA system [3]. In this setting, two related logics come into play: an ordinary -valued logic, as well as a related -valued logic. A memory configuration, or store, is ... |

369 | Precise interprocedural dataflow analysis via graph reachability
- Reps, Horwitz, et al.
- 1995
(Show Context)
Citation Context ...nsformers that have a composable representation. For some problems, it is possible to address this issue by working pointwise, tabulating composed transformers as sets of pairs of input/output values =-=[7, 8, 10]-=-. However, for interprocedural shape analysis, this approach fails to produce useful information. The -valued-logic approach to shape analysis is a storeless one: individuals, which model memory cells... |

302 |
Two approaches to interprocedural data flow analysis
- Sharir, Pnueli
- 1981
(Show Context)
Citation Context ...tudied in [11]. The approach used in the present paper was inspired by the functional approaches of [4–6]. In contrast, the approach used in [11] is more reminiscent of the “call-strings” approach of =-=[5]-=-. A method for performing interprocedural shape analysis using procedure specifications and assume-guarantee reasoning is presented in [16]. There it is assumed that a specification for each procedure... |

232 | The Octagon Abstract Domain
- Miné
(Show Context)
Citation Context ...s � � � . Statements such as x := y+1can be transformed into composable abstract transformers for programs that manipulate numeric data, using several numeric lattices (e.g., polyhedra [19], octagons =-=[20]-=-, etc.). In contrast, Observation 1 provides a way to create composable abstract transformers for the analysis of programs that support both dynamically-allocated storage and destructive updating of p... |

112 | TVLA: A system for implementing static analyses
- Lev-Ami, Sagiv
- 2000
(Show Context)
Citation Context ...ize or parallelize the program. The work reported in the paper builds on past work by several of the authors on static analysis based on -valued logic [1, 2] and its implementation in the TVLA system =-=[3]-=-. In this setting, two related logics come into play: an ordinary -valued logic, as well as a related -valued logic. A memory configuration, or store, is modeled by what logicians call a logical struc... |

103 | A flexible approach to interprocedural data flow analysis and programs with recursive data structures - Jones, Muchnick - 1982 |

103 | Weighted pushdown systems and their application to interprocedural dataflow analysis
- Reps, Schwoon, et al.
- 2005
(Show Context)
Citation Context ... � with each structure, so that a -valued structure is now a triple: � �� �� �. (� is generally � .) A set of constraints � represents the set of concrete structures that satisfy �: � ��� � � � �� �� =-=(9)-=- in the same way that a 3-valued structure represents the set of concrete structures � � that can be embedded into via canonical abstraction [1]. Assume now that we have an operation � � Ð � that asso... |

92 |
Static determination of dynamic properties of recursive procedures
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...stores at main (1) � � �Id�� StartNodes, �� main,and�� range � (2) main� pf � � CallToStartEdges� � � � � � � Æ � for , � ReturnSites � StartNodes (3) � �� � Æ � call for ReturnSites, and call calls =-=(4)-=- Eqns. (1)–(4) can be understood as a variant of the “functional approach” of Sharir and Pnueli [5]; in [5], this is expressed with two fixed-point-finding phases: the first phase propagates transform... |

85 | The Interprocedural Coincidence Theorem
- Knoop, Steffen
- 1992
(Show Context)
Citation Context ...ansformers Æ ,whereand are - vocabulary -valued structures (which are really -vocabulary -valued structures) is expressed as follows: � Æ def � � � �tmp � out� out � � ℄ �tmp � � � � � � ℄ �tmp � � ℄ =-=(6)-=- The effect is to perform a natural join on the �tmp℄ predicates to create structures that have ’s �in℄ predicates, ’s �out℄ predicates, and common �tmp℄ predicates. The �tmp℄ predicates are then elim... |

75 |
On determining lifetime and aliasing of dynamically allocated data in higher-order functional specifications
- Deutsch
- 1990
(Show Context)
Citation Context ...t-sensitive interprocedural shape analysis was also studied in [11]. A major difference is that [11] augments the store to include the runtime stack as an explicit data structure (an idea proposed in =-=[12, 13]-=-); the storage abstraction used in [11] is an abstraction of the store augmented in this fashion. In contrast, in our work the stack is not materialized as an explicit data structure; our approach is ... |

58 | Program derivation by fixed point computation - Cai, Paige - 1989 |

51 | Symbolically computing most-precise abstract operations for shape analysis
- Yorsh, Reps, et al.
- 2004
(Show Context)
Citation Context ...written) lead to a less modular analysis that requires a fixed-point iteration over the entire program.age of canonical abstraction—such that the set describes the same set of concrete structures as =-=[16]-=-. – We define the meet of two -valued structures that have the same set of individuals. Let � � � and � � � be two logical structures with the same universe and vocabulary . The interpretations � �� m... |

40 |
Bebop: A path-sensitive interprocedural dataflow engine. In: Prog. Analysis for Softw. Tools and Eng
- Ball, Rajamani
- 2001
(Show Context)
Citation Context ...nsformers that have a composable representation. For some problems, it is possible to address this issue by working pointwise, tabulating composed transformers as sets of pairs of input/output values =-=[7, 8, 10]-=-. However, for interprocedural shape analysis, this approach fails to produce useful information. The -valued-logic approach to shape analysis is a storeless one: individuals, which model memory cells... |

35 |
Automatic discovery of linear constraints among variables of a program
- Cousot, Halbwachs
- 1978
(Show Context)
Citation Context ... be expressed as � � � . Statements such as x := y+1can be transformed into composable abstract transformers for programs that manipulate numeric data, using several numeric lattices (e.g., polyhedra =-=[19]-=-, octagons [20], etc.). In contrast, Observation 1 provides a way to create composable abstract transformers for the analysis of programs that support both dynamically-allocated storage and destructiv... |

35 | Finite differencing of logical formulas for static analysis. Trans. on Prog. Lang. and Syst. 6, 32. A System for Generating Abstract
- Reps, Sagiv, et al.
- 2004
(Show Context)
Citation Context ...omputed incrementally from the known value of in �. An algorithm that uses � and ’s defining formula � ����� � to generate an appropriate incremental predicate-maintenance formula for is presented in =-=[2]-=-. The problem of automatically identifying appropriate instrumentation predicates, using a process of abstraction refinement, is addressed in [15]. In that paper, the inputrequired to specify a progr... |

30 | Logical characterizations of heap abstractions
- Yorsh
- 2003
(Show Context)
Citation Context ...terpretation that is constrained by the set , which represents the summary transformer of the callee. Converting a -valued structure to a set of constraints. To achieve this, we adapted a result from =-=[18]-=-, which shows how to characterize a -valued logical structure that is in the image of canonical abstraction by means of a formula in first-order logic with transitive closure. The resulting formula ca... |

29 | Numeric domains with summarized dimensions - Gopan, DiMaio, et al. - 2004 |

27 | Propagating Differences: An Efficient New Fixpoint Algorithm for Distributive Constraint Systems - Fecht, Seidl - 1998 |

26 | M.: Interprocedural shape analysis for recursive programs
- Rinetzky, Sagiv
- 2001
(Show Context)
Citation Context ...sensitive shape-analysis algorithm for recursive programs that manipulate heap-allocated storage and perform destructive updating. Context-sensitive interprocedural shape analysis was also studied in =-=[11]-=-. A major difference is that [11] augments the store to include the runtime stack as an explicit data structure (an idea proposed in [12, 13]); the storage abstraction used in [11] is an abstraction o... |

3 |
M.: Numeric domains with summarized dimensions. In: Tools and Algs. for the Construct. and Anal. of Syst
- Gopan, DiMaio, et al.
- 2004
(Show Context)
Citation Context ...rder of two nodes’ data values. Alternatively, numericvalued entities can be handled by combining abstractions of logical structures with previously known techniques for creating numeric abstractions =-=[14]-=-.The following graphical notation is used for depicting -valued structures: – An individual is represented by a circle with its name inside. – A unary predicate is represented by having a solid arrow... |

2 |
M.: Abstraction refinement for -valued-logic analysis
- Loginov, Reps, et al.
- 2004
(Show Context)
Citation Context ...ntal predicate-maintenance formula for is presented in [2]. The problem of automatically identifying appropriate instrumentation predicates, using a process of abstraction refinement, is addressed in =-=[15]-=-. In that paper, the inputrequired to specify a program analysis consists of (i) a program, (ii) a characterization of the inputs, and (iii) a query (i.e., a formula that characterizes the intended o... |