An overview of the saturn project

We present an overview of the Saturn program analysis system, including a rationale for three major design decisions: the use of function-at-a-time, or summary-based, analysis, the use of constraints, and the use of a logic programming language to express program analysis algorithms. We argue that the combination of summaries and constraints allows Saturn to achieve both great scalability and great precision, while the use of a logic programming language with constraints allows for succinct, high-level expression of program analyses.

[1]  George C. Necula,et al.  CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs , 2002, CC.

[2]  Isil Dillig,et al.  Static error detection using semantic inconsistency inference , 2007, PLDI '07.

[3]  Daniel Kroening,et al.  A Tool for Checking ANSI-C Programs , 2004, TACAS.

[4]  Robin Milner,et al.  A Theory of Type Polymorphism in Programming , 1978, J. Comput. Syst. Sci..

[5]  David Maier,et al.  Magic sets and other strange ways to implement logic programs (extended abstract) , 1985, PODS '86.

[6]  Benjamin Livshits,et al.  Context-sensitive program analysis as database queries , 2005, PODS.

[7]  Alexander Aiken,et al.  Banshee: A Scalable Constraint-Based Analysis Toolkit , 2005, SAS.

[8]  Zoltan Somogyi,et al.  The Execution Algorithm of Mercury, an Efficient Purely Declarative Logic Programming Language , 1996, J. Log. Program..

[9]  Jens Palsberg,et al.  Object-oriented type inference , 1991, OOPSLA '91.

[10]  Alexander Aiken,et al.  Context- and path-sensitive memory leak detection , 2005, ESEC/FSE-13.

[11]  Alexander Aiken,et al.  Program Analysis Using Mixed Term and Set Constraints , 1997, SAS.

[12]  Alexander Aiken,et al.  The set constraint/CFL reachability connection in practice , 2004, PLDI '04.

[13]  Roger F. Crew.  ASTLOG: A Language for Examining Abstract Syntax Trees , 1997, DSL.

[14]  Armin Biere,et al.  Bounded Model Checking Using Satisfiability Solving , 2001, Formal Methods Syst. Des..

[15]  Alexander Aiken,et al.  Scalable error detection using boolean satisfiability , 2005, POPL '05.

[16]  Jeffrey D. Uuman.  Principles of database and knowledge- base systems , 1989 .

[17]  Thomas W. Reps,et al.  Demand Interprocedural Program Analysis Using Logic Databases , 1993, Workshop on Programming with Logic Databases , ILPS.

[18]  Benjamin Livshits,et al.  Tracking pointers with path and context sensitivity for bug detection in C programs , 2003, ESEC/FSE-11.

[19]  Alexander Aiken,et al.  How is aliasing used in systems software? , 2006, SIGSOFT '06/FSE-14.

[20]  Zhe Yang,et al.  Modular checking for buffer overflows in the large , 2006, ICSE.