| 摘要: |
| 提出了一种链表抽象表示方法.该方法隐式存储链表结点之间的边信息,并采用了一种紧致的链表状态表示,存储开销较低,且维护了链表长度信息,精确度较高.具体而言,根据变量对链表结点的可达性质定义了变量可达向量,采用带计数的变量可达向量集描述链表的形态及数量性质,并定义了基本链表操作的抽象语义.通过简单扩展,该方法可以建模包括环形链表在内的所有单向链表.最后,为了验证该链表抽象方法的正确性,在符号执行框架中进行实验,并对常见链表操作程序的运行时错误、长度相关性质等关键性质进行了分析与验证. |
| 关键词: 链表抽象方法 符号执行 链表操作程序 变量可达向量 |
| DOI：10.3724/SP.J.1001.2012.04132 |
| 分类号: |
| 基金项目:国家自然科学基金(90818024, 60725206); 国家高技术研究发展计划(863)(2011AA010106) |
|
| List Abstraction Method Based on Variable Reachability Vector |
|
LI Ren-Jian1, LIU Wan-Wei2, CHEN Li-Qian1, WANG Ji1
|
|
1.National Key Laboratory of Parallel and Distributed Processing, College of Computer, National University of Defense Technology, Changsha 410073, China;2.Department of Computer Science and Technology, College of Computer, National University of Defense Technology, Changsha 410073, China
|
| Abstract: |
| This paper presents a list abstraction method. This method enjoys low space overhead by storing the edges between nodes in a list implicitly in a compact manner. It also enjoys high precision by keeping the length of lists. Specifically, the study introduces a so-called variable reachability vector to encode the reachability properties of variables to list nodes, and use variable reachability vector set with counters as an abstract model for each list state. Based on this model, abstract semantics are then defined for basic list operations. This approach could model all singly-linked lists including cyclic cases after a simple extension is brought in. On this basis, the study designs and implements a symbolic execution framework, which could automatically analyze programs manipulating lists automatically. Finally, this approach is applied to analyzing some typical list-manipulating programs for non-trivial properties, such as run-time errors, length related properties and termination. |
| Key words: list abstraction symbolic execution list manipulating program variable reachability vector |
