Catching Bugs in the Web of Program Invariants Proseminar „Programmanalyse”, Prof. Dr. Heike Wehrheim Universität Paderborn, WS 2011/2012 Anton Tonkushin

Static debugging Array indexing outside of its proper bounds Division by zero Referencing of null pointers Jumping to non-function pointers etc Identifying problems at compile- or runtime Solution: Magic Tool Assisting the programmer in verifying the preconditions of program operations Immediate errors’ signaling Programmanalyse, WS 2011/2012, Anton Tonkushin 2

MrSpidey Interactive, static debugger for Scheme Understanding complex programs Debugging complex programs Introduction & Goals Main functions: Describes the set of possible values for each program variable and expression (value set invariant) Identifies possibly unsafe program operations that may cause run-time errors Provides a supporting graphical explanation for these invariants Programmanalyse, WS 2011/2012, Anton Tonkushin 3

Set-based analysis in MrSpidey Introduction: Program variables and expressions are viewed as sets of values Possibly infinite sets of values represented finitely using abstract values Each abstract value corresponds to a particular constructor expression in the analyzed program Programmanalyse, WS 2011/2012, Anton Tonkushin 4

Sample source language Λ Programmanalyse, WS 2011/2012, Anton Tonkushin Introduction: P ∈ Program ::= (define x M)... M, N ∈ Λ ::= V l Ι (M M) l Ι (cons M M) l Ι (car M) l Ι (cdr M) l V ∈ Value ::= c Ι x Ι (λx.M) l Ι (cons V V) c ∈ Const=Num ∪ {nil,...} n ∈ Num={0, 1, 2,...} x ∈ Vars={x, y, z,...} l ∈ Label 5

Abstract values & abstract store Abstract values Abstract store Result of the set-based analysis Finite table Maps variables and labels to sets of abstract values S ∈ AbsStore = (Vars ∪ Label) → P(AbsValue P ) Programmanalyse, WS 2011/2012, Anton Tonkushin 6

Two stage algorithm of MrSpidey Deriving constraints in a syntax-directed manner from the program text Determining the minimal (i.e., most accurate) abstract store satisfying these constraints Programmanalyse, WS 2011/2012, Anton Tonkushin Example 7

A sample analysis: deriving constraints Programmanalyse, WS 2011/2012, Anton Tonkushin 8

A sample analysis: solving constraints Programmanalyse, WS 2011/2012, Anton Tonkushin 9

Value Flow & Value Flow Browser Programmanalyse, WS 2011/2012, Anton Tonkushin Construction of a value flow graph from the subset relations Each edge in this graph -> arrow overlaid on the program text 10

Questions? 11