Affiliations: [a] School of Computing and Information Systems, The University of Melbourne, Australia. [email protected] | [b] School of Computing and Information Systems, The University of Melbourne, Australia. [email protected] | [c] Oracle Labs, Brisbane, Australia. [email protected] | [d] Oracle Labs, Brisbane, Australia. [email protected] | [e] School of Computing and Information Systems, The University of Melbourne, Australia. [email protected] | [f] School of Computing and Information Systems, The University of Melbourne, Australia. [email protected] | [g] School of Computing and Information Systems, The University of Melbourne, Australia. [email protected] | [h] College of Information Science and Technology, Jinan University, Guangzhou, China. [email protected]
Correspondence:
[*]
Address for correspondence: School of Computing and Information Systems, The University of Melbourne, Victoria 3010, Australia.
Note: [†] Work performed while at Oracle Labs.
Abstract: Abstract interpretation is a well established theory that supports reasoning about the run-time behaviour of programs. It achieves tractable reasoning by considering abstractions of run-time states, rather than the states themselves. The chosen set of abstractions is referred to as the abstract domain. We develop a novel framework for combining (a possibly large number of) abstract domains. It achieves the effect of the so-called reduced product without requiring a quadratic number of functions to translate information among abstract domains. A central notion is a reference domain, a medium for information exchange. Our approach suggests a novel and simpler way to manage the integration of large numbers of abstract domains. We instantiate our framework in the context of string analysis. Browser-embedded dynamic programming languages such as JavaScript and PHP encourage the use of strings as a universal data type for both code and data values. The ensuing vulnerabilities have made string analysis a focus of much recent research. String analysis tends to combine many elementary string abstract domains, each designed to capture a specific aspect of strings. For this instance the set of regular languages, while too expensive to use directly for analysis, provides an attractive reference domain, enabling the efficient simulation of reduced products of multiple string abstract domains.
