Compositional May-Must Program Analysis: Unleashing the Power of Alternation

Program analysis tools typically compute two types of information: (1) may information that is true of all program executions and is used to prove the absence of bugs in the program, and (2) must information that is true of some program executions and is used to prove the existence of bugs in the program. In this paper, we propose a new algorithm, dubbed SMASH, which computes both may and must information compositionally. At each procedure boundary, may and must information is represented and stored as may and must summaries, respectively. Those summaries are computed in a demand-driven manner and possibly using summaries of the oppoe. We have implemented SMASH using predicate abstraction (as in SLAM) for the may part and using dynamic test generation (as in DART) for the must part. Results of experiments with 69 Microsoft Windows Vista device drivers show that SMASH can significantly outperform may-only, must-only and non-compositional may-must algorithms. Indeed, our empirical resul...

• Type: Conference
• Year: 2010
• Where: POPL
• Authors: Aditya V. Nori, Patrice Godefroid, SaiDeep Tetali, Sriram K. Rajamani
• Keywords: Complex Code Fragments, POPL 2010, Program Executions, Programming Languages, Summaries Allows Smash