predicates-tr914 - Selecting, Refining, and Evaluating...

Info iconThis preview shows pages 1–2. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Selecting, Refining, and Evaluating Predicates for Program Analysis Nii Dodoo Lee Lin Michael D. Ernst Technical Report MIT-LCS-TR-914 July 21, 2003 MIT Lab for Computer Science 200 Technology Square Cambridge, MA 02139 USA { dodoo,leelin,mernst } Abstract This research proposes and evaluates techniques for se- lecting predicates for conditional program properties — that is, implications such as p ⇒ q whose consequent must be true whenever the predicate is true. Conditional properties are prevalent in recursive data structures, which behave dif- ferently in their base and recursive cases, in programs that contain branches, in programs that fail only on some inputs, and in many other situations. The experimental context of the research is dynamic detection of likely program invari- ants, but the ideas are applicable to other domains. Trying every possible predicate for conditional proper- ties is computationally infeasible and yields too many un- desirable properties. This paper compares four policies for selecting predicates: procedure return analysis, code con- ditionals, clustering, and random selection. It also shows how to improve predicates via iterated analysis. An experi- mental evaluation demonstrates that the techniques improve performance on two tasks: statically proving the absence of run-time errors with a theorem-prover, and separating faulty from correct executions of erroneous programs. 1 Introduction The goal of program analysis is to determine facts about a program. The facts are presented to a user, depended on by a transformation, or used to aid another analysis. The properties frequently take the form of logical formulae that are true at a particular program point or points. The usefulness of a program analysis depends on what properties it can report. A major challenge is increasing the grammar of a program analysis without making the analy- sis unreasonably more expensive and without degrading the quality of the output, when measured by human or machine users of the output. This paper investigates techniques for expanding the out- put grammar of a program analysis to include implications of the form a ⇒ b . Disjunctions such as a ∨ b are a spe- cial case of implications, since ( a ⇒ b ) ≡ ( ¬ a ∨ b ) . Our implementation and experimental evaluation are for a spe- cific dynamic program analysis that, given program execu- tions, produces likely invariants as output. The base analy- sis reports properties such as preconditions, postconditions, and object invariants that are unconditionally true over a test suite. (Section 2.3 describes the technique.) A conditional property is one whose consequent is not universally true, but is true when the predicate is true. (Equivalently, the consequent is false only when the predicate is false.) For instance, the local invariant over a node n of a sorted binary tree, ( n . left . value ≤ n . value ) ∧ ( n . right . value ≥ n . value ) , is true unless one of...
View Full Document

This note was uploaded on 02/24/2012 for the course CSE 503 taught by Professor Davidnotikin during the Spring '11 term at University of Washington.

Page1 / 12

predicates-tr914 - Selecting, Refining, and Evaluating...

This preview shows document pages 1 - 2. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online