18,091 Hits in 5.0 sec

Shape Analysis in the Absence of Pointers and Structure [chapter]

Matthew Might
2010 Lecture Notes in Computer Science  
In particular, we promote "anodization" as a way to generalize both singleton abstraction and the notion of focusing, and we promote "binding invariants" as the analog of shape predicates.  ...  Shape analyses (Chase et al. 1990 , Sagiv et al. 2002 ) discover properties of dynamic and/or mutable structures.  ...  Singleton abstraction has been used in pointer and shape analyses to drive mustalias analysis; we extend singleton abstraction, and the framework of anodization, to determine the equivalence of bindings  ... 
doi:10.1007/978-3-642-11319-2_20 fatcat:6iudb7wlbvfwxd7u2vhfrcbv2e

Shape Analysis

Bor-Yuh Evan Chang, Cezara Drăgoi, Roman Manevich, Noam Rinetzky, Xavier Rival
2020 Foundations and Trends® in Programming Languages  
Bor-Yuh Evan Chang, Cezara Drăgoi, Roman Manevich, Noam Rinetzky and Xavier Rival (2020), "Shape Analysis", Foundations and Trends R in Programming Languages: Vol. 6, No. 1-2, pp 1-158.  ...  Shape Analysis Shape analyses, in contrast to pointer analyses, aim at computing global structural properties of unbounded sets of memory cells and pointers, such as the shape invariants of the data structures  ...  Similarly, the acyclicity of a data structure expresses the absence of certain patterns in pointer paths, can only be established by reasoning over arbitrarily long paths.  ... 
doi:10.1561/2500000037 fatcat:77d5la5xw5alrkkr5oleqjhzbe

Shape Analysis [chapter]

Reinhard Wilhelm, Mooly Sagiv, Thomas Reps
2000 Lecture Notes in Computer Science  
A shape-analysis algorithm statically analyzes a program to determine information about the heap-allocated data structures that the program manipulates.  ...  The results can be used to understand or verify programs. They also contain information valuable for debugging, compile-time garbage collection, instruction scheduling, and parallelization.  ...  Acknowledgements Tal Lev-Ami carried out the implementation of TVLA. One instantiation of TVLA was used to analyze the example program and generate the figures used in the paper.  ... 
doi:10.1007/3-540-46423-9_1 fatcat:da7e7wacqnccflu37omo3d2opu

Verifying Programs that Manipulate Pointers

Anders Møller
2004 Electronical Notes in Theoretical Computer Science  
Then, we consider parametric shape analysis by Sagiv, Reps, and Wilhelm [3]. This approach is based on data-flow 1  ...  Outline of the Talk Reasoning about the correctness of programs that manipulate data structures using pointers is notoriously difficult: Destructive updating through pointers can make complex structures  ...  analysis and three-valued logic. The heap is modeled as a logical structure, and properties are expressed in first-order logic with transitive closure.  ... 
doi:10.1016/j.entcs.2003.10.002 fatcat:ukfo26zlf5c7jfcbx7slsvr6pm

Concrete Memory Models for Shape Analysis

Pascal Sotin, Bertrand Jeannet, Xavier Rival
2010 Electronical Notes in Theoretical Computer Science  
We characterize memory models by the class of pointers they support and whether they use numerical or symbolic offsets to address values in a block.  ...  The language we consider is a fragment of Leroy's Clight, including arrays, pointer arithmetics but excluding casts.  ...  Shape analysis goes beyond alias and null-pointer analyses, in term of expressivity and precision.  ... 
doi:10.1016/j.entcs.2010.09.012 fatcat:vwgbc3kx3bcb3nvb5visp3licq

Shape Refinement through Explicit Heap Analysis [chapter]

Dirk Beyer, Thomas A. Henzinger, Grégory Théoduloz, Damien Zufferey
2010 Lecture Notes in Computer Science  
The challenge is to automatically determine the data-structure type, and to supply the shape analysis with the necessary information about the data structure.  ...  The approach uses two techniques to guide the refinement of shape abstractions: (1) during program exploration, an explicit heap analysis collects sample instances of the heap structures, which are used  ...  Since the interpolants mention pointers of a recursive data structure, we need to observe them via a shape analysis tracking l1, l2, and p (and their aliases).  ... 
doi:10.1007/978-3-642-12029-9_19 fatcat:o4t5abrmlnbzvcdobjjupybmzm

Shape Analysis of Low-Level C with Overlapping Structures [chapter]

Jörg Kreiker, Helmut Seidl, Vesal Vojdani
2010 Lecture Notes in Computer Science  
Shape analyses have traditionally relied on a graph-based representation of memory where a node corresponds to a whole record and edges to pointers.  ...  Device drivers often keep data in multiple data structures simultaneously while embedding list or tree related records into the records containing the actual data; this results in overlapping structures  ...  Our interest in shape analysis of overlapping records is derived from attempts to verify absence of data races in low-level C.  ... 
doi:10.1007/978-3-642-11319-2_17 fatcat:yx7xudehave5xhc72x4ivsinty

2LS: Heap Analysis and Memory Safety (Competition Contribution) [article]

Viktor Malik, Martin Hruska, Peter Schrammel, Tomas Vojnar
2020 arXiv   pre-print
The main improvements in this year's version are the ability of 2LS to analyse programs requiring combined reasoning about shape and content of dynamic data structures, and an instrumentation for memory  ...  2LS is a framework for analysis of sequential C programs that can verify and refute program assertions and termination.  ...  The domain over-approximates the points-to relation between pointers and symbolic addresses of memory objects in the analysed program: for each pointer-typed variable and each pointer-typed field of an  ... 
arXiv:1903.00712v2 fatcat:dy3qn7vwuvgkvjxk2kqzxin3za

Computation of Alias Sets from Shape Graphs for Comparison of Shape Analysis Precision

V. Pavlu, M. Schordan, A. Krall
2011 2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation  
Shape analysis is a static pointer analysis technique that models heap-allocated data structures in greater detail than the typical pointer analysis does.  ...  The aim of this work is to make the precision of shape analysis results comparable. Our solution is based on extracting alias information from shape analysis results.  ...  We are therefore able to compare the precision of shape analyses to that of pointer analyses and give an overview of related work in the fields of alias-and shape analysis. Emami et. al.  ... 
doi:10.1109/scam.2011.11 dblp:conf/scam/PavluSK11 fatcat:oxlibommsncz5phkfdwurmmvb4

Computation of alias sets from shape graphs for comparison of shape analysis precision

Viktor Pavlu, Andreas Krall, Markus Schordan
2014 IET Software  
Shape analysis is a static pointer analysis technique that models heap-allocated data structures in greater detail than the typical pointer analysis does.  ...  The aim of this work is to make the precision of shape analysis results comparable. Our solution is based on extracting alias information from shape analysis results.  ...  We are therefore able to compare the precision of shape analyses to that of pointer analyses and give an overview of related work in the fields of alias-and shape analysis. Emami et. al.  ... 
doi:10.1049/iet-sen.2012.0049 fatcat:oqcivzeh6rag5onkup27ezecqm

Automated Verification of the Deutsch-Schorr-Waite Tree-Traversal Algorithm [chapter]

Alexey Loginov, Thomas Reps, Mooly Sagiv
2006 Lecture Notes in Computer Science  
DSW is an algorithm for traversing a binary tree without the use of a stack by means of destructive pointer manipulation.  ...  With the introduction of a few simple core and instrumentation relations, TVLA was able to establish the partial correctness and termination of DSW.  ...  The concept of tree-specific shape analysis (see §2.1) is of general utility. It can be reused for any analysis in which all input, output, and intermediate data structures are trees.  ... 
doi:10.1007/11823230_17 fatcat:fmsgg4p5zfdgtoqpo3no746zda

Shape Analysis for Unstructured Sharing [chapter]

Huisong Li, Xavier Rival, Bor-Yuh Evan Chang
2015 Lecture Notes in Computer Science  
Shape analysis aims to infer precise structural properties of imperative memory states and has been applied heavily to verify safety properties on imperative code over pointer-based data structures.  ...  In this paper, we propose a global abstraction of sharing based on set-valued variables that when integrated with inductive definitions enables the specification and shape analysis of structures with unstructured  ...  We would like to thank Arlen Cox for suggestions about the implementation of the set domain, and François Bérenger for providing very helpful tool support.  ... 
doi:10.1007/978-3-662-48288-9_6 fatcat:26n3pfir7nbqtln4gsxubmjpge

MemPick: High-level data structure detection in C/C++ binaries

Istvan Haller, Asia Slowinska, Herbert Bos
2013 2013 20th Working Conference on Reverse Engineering (WCRE)  
Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard.  ...  To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries.  ...  RELATED WORK Recovery of data structures is relevant to the fields of shape analysis and reverse engineering.  ... 
doi:10.1109/wcre.2013.6671278 dblp:conf/wcre/HallerSB13 fatcat:ec2bjx3ycjf5rg4znbxyscuo5q

Precise shape analysis using field sensitivity

Sandeep Dasgupta, Amey Karkare
2012 Proceedings of the 27th Annual ACM Symposium on Applied Computing - SAC '12  
In this work, we present a novel field sensitive shape analysis technique to identify the shapes of the heap structures.  ...  Shape analysis refers to the class of techniques that statically approximate the run-time structures created on the heap.  ...  We proposed a field sensitive shape analysis tecnique that helps in precise inference of the shape of the heap data structures.  ... 
doi:10.1145/2245276.2231982 dblp:conf/sac/DasguptaK12 fatcat:nvvn2vuyqfeezo3txdklnfth4m

Shape Neutral Analysis of Graph-based Data-structures

2018 Theory and Practice of Logic Programming  
A key property of our program analysis is that the target data-structure properties are shape neutral, i.e., the analysis does not check for properties relating to a given data-structure graph shape, such  ...  The generated solver is implemented using a Constraint Handling Rules (CHR) extension of built-in heap, integer and equality solvers.  ...  None of these properties depend on the shape of the data-structure. Importantly, all of the properties 1-4 are independent of the data-structure shape, i.e. the analysis is shape neutral.  ... 
doi:10.1017/s147106841800025x fatcat:fdqioqug2bhkretdwkegtilsnm
« Previous Showing results 1 — 15 out of 18,091 results