Optimistic Bug Finding David Gupta and Junfeng Yang

Basic Idea Undecidability Problem with Path Sensitivity: Undecidability Problem with Path Sensitivity: –Aliasing –Undetermined inputs –Unknown source code (library functions) Assumption: Correct branches usually have fewer bugs Assumption: Correct branches usually have fewer bugs Solution: Choose the branches with fewest bugs based on global analysis Solution: Choose the branches with fewest bugs based on global analysis Difference: Avoiding hard analysis by making clever inferences Difference: Avoiding hard analysis by making clever inferences

Example Foo (p, q, x) { A: If (p) lock(x); … B: If (q) unlock(x); } If x is locked at A, p should be false and q should be true If x is unlocked, p and q should both be true or false

Example(cont.) Foo(p, q, x) { A: If(p) lock(x); … B: If(q) unlock(x); C: } /* end of the program */ program */ Solution for x == unlocked: No errors A == true and B == true Or A == false and B == false Solution for x == locked: No errors A == false and B == true

The Algorithm eL min_errors(pP p, st s, {(pP, st)} S) { eL L, L1, L2; While (!is_predicate (p)) { L += errors (p, s); s = next_state (p, s); } If ((p, s) belongs_to S) return L; L1 = min_errors(true_branch(p), s, S + (p, s)); L2 = min_errors(false_branch(p), s, S + (p, s)); L +=min(L1, L2); Return L; }

First Step Don’t track values Don’t track values Assume all the predicates are uncorrelated Assume all the predicates are uncorrelated Why do we think this will work? Why do we think this will work? We think the algorithm can automatically figure out what is correlated In the previous example, the relation between p and q is implied in the solution

Other Steps Optimize (Caching?) Optimize (Caching?) Keep track of the values Keep track of the values –False path pruning in Metal –Simple alias analysis Try to find the correlation between predicates Try to find the correlation between predicates e.g. (x (x (x < 5) (p == true) -> (p == true) (p == true) -> (p == true)

Evaluation Method Compare results of Metal, FirstStep and OtherSteps. Compare results of Metal, FirstStep and OtherSteps. Interesting questions Interesting questions –Are the errors reported by our algorithm real errors? –Do we miss too many errors? –How many false positives can we eliminate? –Can we find some errors not found by Metal? –Is it slow? (Can we do some optimization?)

Related Work Metal Metal –Caching –False path pruning –Bugs as Deviant Behavior ESP ESP –Path sensitive only for interesting properties SLAM SLAM –Unknown values