Declarative Intraprocedural Flow Analysis of Java Source Code

2015

We propose FLOWMINER, a tool for mining expressive, fine-grained data-flow summaries from Java library bytecode. FLOWMINER captures enough information to enable context, type, field, object and flow-sensitive partial program analysis of applications using the library. FLOWMINER’s summaries are compactflow details of a library that are noncritical for future partial program analysis of applications are elided into simple edges between elements that are accuracycritical. Hence, summaries extracted by FLOWMINER are an order of magnitude smaller than the original library. We present (i) novel algorithms to extract expressive, fine-grained, compact summary data-flows from a Java library, (ii) graph summarization paradigm that uses a multi-attributed directed graph as the mathematical abstraction to represent summaries, (iii) opensource implementation (FLOWMINER) of the above that saves summaries in a portable format usable by existing analysis tools, and (iv) experiments with recent vers...

Information and Control Systems

Introduction: Over the last years program analysis methods were widely used for software quality assurance. Different types of program analysis require various levels of program representation, analysis methods, etc. Platforms that provide utilities to implement different types of analysis on their basis become very important because they allow one to simplify the process of development. Purpose: Development of a platform for analysis of JVM programs. Results: In this paper we present Kex, a platform for building program analysis tools for JVM bytecode. Kex provides three abstraction levels. First is Kfg, which is an SSA-based control flow graph representation for bytecode-level analysis and transformation. Second is a symbolic program representation called Predicate State, which consists of first order logic predicates that represent instructions of the original program, constraints, etc. The final level is SMT integration layer for constraint solving. It currently provides an inte...

Higher-Order and Symbolic Computation, 2010

Static analyses based on denotational semantics can naturally model functional behaviours of the code in a compositional and completely context and flow sensitive way. But they only model the functional i.e., input/output behaviour of a program P , not enough if one needs P 's internal behaviours i.e., from the input to some internal program points. This is, however, a frequent requirement for a useful static analysis. In this paper, we overcome this limitation, for the case of mono-threaded Java bytecode, with a technique used up to now for logic programs only. Namely, we define a program transformation that adds new magic blocks of code to the program P , whose functional behaviours are the internal behaviours of P . We prove the transformation correct w.r.t. an operational semantics and define an equivalent denotational semantics, devised for abstract interpretation, whose denotations for the magic blocks are hence the internal behaviours of P . We implement our transformation and instantiate it with abstract domains modelling sharing of two variables, non-cyclicity of variables, nullness of variables, class initialisation information and size of the values bound to program variables. We get a static analyser for full mono-threaded Java bytecode that is faster and scales better than another operational pair-sharing analyser. It has the same speed but is more precise than a constraint-based nullness analyser. It makes a polyhedral size analysis of Java bytecode scale up to 1300 methods in a couple of minutes and a zone-based size analysis scale to still larger applications.

2007

interpretation has been widely used for the analysis of object-oriented languages and, in particular, Java source and bytecode. However, while most existing work deals with the problem of finding expressive abstract domains that track accurately the characteristics of a particular concrete property, the underlying fixpoint algorithms have received comparatively less attention. In fact, many existing (abstract interpretation based-) fixpoint algorithms rely on relatively inefficient techniques for solving inter-procedural call graphs or are specific and tied to particular analyses. We also argue that the design of an efficient fixpoint algorithm is pivotal to supporting the analysis of large programs. In this paper we introduce a novel algorithm for analysis of Java bytecode which includes a number of optimizations in order to reduce the number of iterations. The algorithm is parametric-in the sense that it is independent of the abstract domain used and it can be applied to different domains as "plug-ins"-, multivariant, and flow-sensitive. Also, is based on a program transformation, prior to the analysis, that results in a highly uniform representation of all the features in the language and therefore simplifies analysis. Detailed descriptions of decompilation solutions are given and discussed with an example. We also provide some performance data from a preliminary implementation of the analysis.

ArXiv, 2017

Since decade understanding of programs has become a compulsory task for the students as well as for others who are involved in the process of developing software and providing solutions to open problems. In that aspect showing the problem in a pictorial presentation in a best manner is a key advantage to better understand it. We provide model and structure for Java programs to understand the control and data flow analysis of execution. Especially it helps to understand the static analysis of Java programs, which is an uttermost important phase for software maintenance. We provided information and model for visualization of Java programs that may help better understanding of programs for a learning and analysis purpose. The idea provided for building visualization tool is extracting data and control analysis from execution of Java programs. We presented case studies to prove that our idea is most important for better understanding of Java programs which may help towards static analys...

Electronic Notes in Theoretical Computer Science, 2005

We present an abstract interpretation framework for a subset of Java (without concurrency). The framework uses a structural abstract domain whose concretization function is parameterized on a relation between abstract and concrete locations. When structurally incomptatible objects may be referred to by the same variable at a given program point, structural information is discarded and replaced by an approximated information about the objects (our presentation concentrates on type information). Plain structural information allows precise intra-procedural analysis but is quickly lost when returning from a method call. To overcome this limitation, relational structural information is introduced, which enables a precise inter-procedural analysis without resorting to inlining. The paper contains an overview of the work. We describe parts of the standard and abstract semantics; then, we briefly explain the fixpoint algorithms used by our implementation; lastly, we provide experimental results for small programs.

IEEE Transactions on Software Engineering, 1998

Constructing code analyzers may be costly and error prone if inadequate technologies and tools are used. If they are written in a conventional programming language, for instance, several thousand lines of code may be required even for relatively simple analyses. One way of facilitating the development of code analyzers is to define a very high-level domain-oriented language and implement an application generator that creates the analyzers from the specification of the analyses they are intended to perform. This paper presents a system for developing code analyzers that uses a database to store both a no-loss fine-grained intermediate representation and the results of the analyses. The system uses an algebraic representation, called F p ( ) , as the user-visible intermediate representation. Analyzers are specified in a declarative language, called F p ( ) − l, which enables an analysis to be specified in the form of a traversal of an algebraic expression, with access to, and storage of, the database information the algebraic expression indices. A foreign language interface allows the analyzers to be embedded in C programs. This is useful for implementing the user interface of an analyzer, for example, or to facilitate interoperation of the generated analyzers with pre-existing tools. The paper evaluates the strengths and limitations of the proposed system, and compares it to other related approaches.

2006

This paper presents a declarative approach to the debugging of object-oriented programs and illustrates the methodology through an extension of a novel interactive visualization system for Java developed in our previous research. Unlike traditional "procedural" debugging, we use the term "declarative debugging" to refer to a flexible set of queries on individual execution states and also over the entire history of execution (or portion of the history). Examples include queries to find all values assigned to a variable over its lifetime ; which variable has a certain value; the calling sequence that results in a certain outcome; whether a certain statement was executed; etc. These queries were arrived at by a systematic study of errors in objectoriented programs in our previous research. Our proposed system, JavaDD, maintains the execution history as a relational database of salient events, such as method call/return, thread start/end, variable assignment, etc. An important property of our approach is that these queries can be posed interactively (at any step of execution), and there is no need to develop a compiler to instrument the source code, as in related research projects. Furthermore, we also sketch a visual interface so that both queries and answers can be composed using inituitive object and sequence diagrams. We believe such an approach is a significant contribution to the art of program debugging. We present the architecture of JavaDD, a detailed catalog of our queries and their translation, and several examples illustrating the approach. We also compare our approach related research efforts in the area of query-based analysis of object-oriented programs.

2016

Many current program analyses require highly precise pointer information about small, tar- geted parts of a given program. This motivates the need for demand-driven pointer analyses that compute information only where required. Pointer analyses generally compute points-to sets of program variables or answer boolean alias queries. However, many client analyses require richer pointer information. For example, taint and typestate analyses often need to know the set of all aliases of a given variable under a certain calling context. With most current pointer analyses, clients must compute such information through repeated points-to or alias queries, increasing complexity and computation time for them. This paper presents Boomerang, a demand-driven, flow-, field-, and context-sensitive pointer analysis for Java programs. Boomerang computes rich results that include both the possible allocation sites of a given pointer (points-to information) and all pointers that can point to those alloc...

Science of Computer Programming, 2003

We describe JastAdd, a Java-based system for compiler construction. JastAdd is centered around an object-oriented representation of the abstract syntax tree where reference variables can be used to link together di erent parts of the tree. JastAdd supports the combination of declarative techniques (using Reference Attributed Grammars) and imperative techniques (using ordinary Java code) in implementing the compiler. The behavior can be modularized into di erent aspects, e.g. name analysis, type checking, code generation, etc., that are woven together into classes using aspect-oriented programming techniques, providing a safer and more powerful alternative to the Visitor pattern. The JastAdd system is independent of the underlying parsing technology and supports any noncircular dependencies between computations, thereby allowing general multi-pass compilation. The attribute evaluator (optimal recursive evaluation) is implemented very conveniently using Java classes, interfaces, and virtual methods.