Describing Gen/Kill Static Analysis Techniques with Kleene Algebra

A Survey of Parametric Static Analysis

ACM Computing Surveys ◽

10.1145/3464457 ◽

2021 ◽

Vol 54 (7) ◽

pp. 1-37

Author(s):

Jihyeok Park ◽

Hongki Lee ◽

Sukyoung Ryu

Keyword(s):

Recent Work ◽

Static Analysis ◽

Abstract Interpretation ◽

Black Box ◽

Parameter Selection ◽

Survey Analysis ◽

Future Directions ◽

Analysis Techniques ◽

Analysis Quality

Understanding program behaviors is important to verify program properties or to optimize programs. Static analysis is a widely used technique to approximate program behaviors via abstract interpretation. To evaluate the quality of static analysis, researchers have used three metrics: performance, precision, and soundness. The static analysis quality depends on the analysis techniques used, but the best combination of such techniques may be different for different programs. To find the best combination of analysis techniques for specific programs, recent work has proposed parametric static analysis . It considers static analysis as black-box parameterized by analysis parameters , which are techniques that may be configured without analysis details. We formally define the parametric static analysis, and we survey analysis parameters and their parameter selection in the literature. We also discuss open challenges and future directions of the parametric static analysis.

Download Full-text

Detecting Uninitialized Variables in C++ with the Clang Static Analyzer

Acta Cybernetica ◽

10.14232/actacyb.282900 ◽

2020 ◽

Author(s):

Kristóf Umann ◽

Zoltán Porkoláb

Keyword(s):

Software Engineering ◽

Open Source ◽

Programming Languages ◽

Static Analysis ◽

Common Source ◽

Initial Value ◽

Analysis Techniques ◽

Specific Variable ◽

Prototype Tool ◽

Run Time

Uninitialized variables have been a source of errors since the beginning of software engineering. Some programming languages (e.g. Java and Python) will automatically zero-initialize such variables, but others, like C and C++, leave their state undefined. While laying aside initialization in C and C++ might be a performance advantage if an initial value can't be supplied, working with such variables is an undefined behavior, and is a common source of instabilities and crashes. To avoid such errors, whenever meaningful initialization is possible, it should be used. Tools for detecting these errors run time have existed for decades, but those require the problematic code to be executed. Since in many cases the number of possible execution paths are combinatoric, static analysis techniques emerged as an alternative. In this paper, we overview the technique for detecting uninitialized C++ variables using the Clang Static Analyzer, and describe various heuristics to guess whether a specific variable was left in an undefined state intentionally. We implemented a prototype tool based on our idea and successfully tested it on large open source projects.

Download Full-text