PSE: explaining program failures via postmortem static analysis

In this paper, we describe PSE (Postmortem Symbolic Evaluation), a static analysis algorithm that can be used by programmers to diagnose software failures. The algorithm requires minimal information about a failure, namely its kind (e.g. NULL dereference), and its location in the program's source code. It produces a set of execution traces along which the program can be driven to the given failure. PSE tracks the flow of a single value of interest from the point in the program where the failure occurred back to the points in the program where the value may have originated. The algorithm combines a novel dataflow analysis and memory alias analysis in a manner that allows for precise exploration of the program's behavior in polynomial time. We have applied PSE to the problem of diagnosing potential NULL-dereference errors in a suite of C programs, including several SPEC benchmarks and a large commercial operating system. In most cases, the analysis is able to either validate a...

• Type: Conference
• Year: 2004
• Where: SIGSOFT
• Authors: Roman Manevich, Manu Sridharan, Stephen Adams, Manuvir Das, Zhe Yang
• Keywords: Keywords Postmortem Analysis, Memory Alias Analysis, SIGSOFT 2004, Software Engineering, Static Analysis Algorithm