finding bugs with a constraint solver daniel jackson. mandana vaziri mit laboratory for computer science issta 2000

2 overview goal finding bugs in code efficiently supports specs declarative specs relating different program points structural properties pre-defined partial code technique fully automatic errors missed, but no spurious errors

3 example: linked list delete class List {List next; Val val; void static delete (List p, Val v){ List prev = null; while (p != null) if (p.val == v) { prev.next = p.next; return;} else { prev = p; p = p.next; }..} // spec: no cell with value v after no c : p.*next’ | c.val’ = v

4 checking the spec user provides number of loop iterations number of objects in each class (scope) tool finds an execution of delete that contradicts the spec

5 counterexample to the spec Domains List = {L0} Val = {V0} Sets E01 = traversed E12 = (null) E13 = traversed E34 = traversed … p = L0 p1 = L0 prev = L0 prev1 = (null) prev2 = (null) prev’ = (null) v = V0 Relations next = {} next1 = {} val = {L0 -> V0} next’ = {} next1’ = {} val’ = {L0 -> V0} Skolem Constants c = L0

6 counterexample to the spec pre: v-- valnext p post: v-- val’next’ p class List {List next; Val val; void static delete (List p, Val v){ List prev = null; while (p != null) if (p.val == v) { prev.next = p.next; return;} else { prev = p; p = p.next; }..} // spec: no cell with value v after no c : p.*next’ | c.val’ = v

7 more specs //no cells added p.*next’ in p.*next //cells with value v removed p.*next’ = p.*next – {c | c.val = v} //no cells mutated all c | c.val = c.val’ //no cycles introduced no c : p.*next | c in c.+next  no c : p.*next’ | c in c.+next’

8 method code compiler # iters. code constraint all bounded executions in alloy (first order logic)

9 method code spec scope compiler  alloy analyzer #iters. code constraint ¬ final constraint translator boolean formula SAT solver counter

10 compiler steps encode state encode set of executions encoding set of executions construct computation graph from code label variables translate edges into alloy (encoding data flow) derive constraint from graph (encoding control flow)

11 modelling state for delete class List {List next; Val val; void static delete (List p, Val v){ List prev = null; while (p != null) if (p.val == v) { prev.next = p.next; return;} else { prev = p; p = p.next; } … } domain List, Val state p: List? v: Val? prev: List? next: List  List? val: List  Val?

12 computation graph unrolled control flow graph node ~ program point edge ~ predicate & elementary statement single entry, single exit no cycles loops unrolled a ; while (p) s ; b  a ; if (p) s ; assert !p ; b

13 computation graph for delete p = p.next prev = null p != null p == null p.val != v p.val == v prev = pprev.next= p.next return p == null class List {List next; Val val; void static delete (List p, Val v){ List prev = null; while (p != null) if (p.val == v) { prev.next = p.next; return;} else { prev = p; p = p.next; }..}

14 variable labeling example x := a ; x := x + b  x1 = a  x2 = x1 + b nodes hold labeling of each variable labels distinct on any given path same label for two connected nodes if no variable update minimize labels

15 variable labeling for delete prev = null p != null p == null p.val != v p.val == v prev = p prev.next = p.next p = p.next return p == null p, prev, next, val,v prev1 prev2 p1p1 next1

16 encoding data & control flow data translate edge label to alloy formula control for each path conjoin formulas from edges combined paths disjoin path formulas

17 encoding data & control for delete 0 p1 = p.next no prev some p no p p.val != v p.val == v prev1 = p prev1.next1 = p.next return no p no prev some p no p p.val != v p.val == v prev1 = p prev1.next1 = p.next p1 = p.next return no p2      

18 experiments benchmark suite of procedures from (Sagiv et al) destructive update of linked lists specs: null dereferences creation of cycles user-defined all anomalies found in scope of 1 times less than 1 sec for scope 3

19 times for hardest check merge: result.*next = p.*next + q.*next s s s m23s scope iters bits time

20 future work issues scalability (big procs, long chains) variety of datatypes approach partial analysis abstraction use specs instead of procedure calls

21 related work testing symbolic execution (King), PREfix (Pincus) model checking bounded model checking (Biere et al) Bandera project (Kansas State, Hawaii, UMass) Java Pathfinder (NASA Ames) SLAM project (Microsoft Research) ESC (Detlefs et al) parametric shape analysis (Sagiv et al)

22 comparison user does not provide inputs (testing) all possible inputs considered (PSA, testing) handles huge #executions (testing, sym exec) addresses structure (MC, ESC, PREfix) handles declarative specs (MC, testing, sym exec, PSA) no spurious errors (PSA) no numbers (testing, sym exec, Prefix) no proof (PSA, ESC)

23 control data spec finding bugs with a constraint solver