A Fixed-Point Algorithm for Automated Static Detection of Infinite Loops
We present an algorithm for automated detectionof infinite loop bugs in programs. It relies on a SatisfiabilityModulo Theories (SMT) solver backend and can be runconveniently with SMT-constrained symbolic execution. Thealgorithm detects infinite loop bugs for single-path, multi-pathand nested loops. We prove soundness of the algorithm, i.e.there are no false positive detections of infinite loops. Part of thealgorithm is a fixed-point based termination check for ’simple’loops, whose soundness is a consequence of Brouwer’s fixed-point theorem. The algorithm further yields no false negativedetections for context-sensitive detection of periodic loop orbitswith sum of prefix iterations and periodicity of up to theanalysis loop unroll depth (bounded completeness), if the SMTsolver answers the fixed-point satisfiability query in time. Wedescribe an example implementation as plug-in extension ofEclipse CDT. The implementation is validated with the infiniteloop test cases from the Juliet test suite and benchmarks areprovided.
A Fixed-Point Algorithm for Automated Static Detection of Infinite Loops
IEEE Int. Symp. High Assurance Systems Eng.
Authors: | Andreas Ibing and A. Mai |
Year/month: | 2015/1 |
Booktitle: | IEEE Int. Symp. High Assurance Systems Eng. |
Fulltext: | ibing15infloops.pdf |
Abstract |
|
We present an algorithm for automated detectionof infinite loop bugs in programs. It relies on a SatisfiabilityModulo Theories (SMT) solver backend and can be runconveniently with SMT-constrained symbolic execution. Thealgorithm detects infinite loop bugs for single-path, multi-pathand nested loops. We prove soundness of the algorithm, i.e.there are no false positive detections of infinite loops. Part of thealgorithm is a fixed-point based termination check for ’simple’loops, whose soundness is a consequence of Brouwer’s fixed-point theorem. The algorithm further yields no false negativedetections for context-sensitive detection of periodic loop orbitswith sum of prefix iterations and periodicity of up to theanalysis loop unroll depth (bounded completeness), if the SMTsolver answers the fixed-point satisfiability query in time. Wedescribe an example implementation as plug-in extension ofEclipse CDT. The implementation is validated with the infiniteloop test cases from the Juliet test suite and benchmarks areprovided. |
Bibtex:
@inproceedings {author = { Andreas Ibing and A. Mai},
title = { A Fixed-Point Algorithm for Automated Static Detection of Infinite Loops },
year = { 2015 },
month = { January },
booktitle = { IEEE Int. Symp. High Assurance Systems Eng. },
url = {https://www.sec.in.tum.de/i20/publications/a-fixed-point-algorithm-for-automated-static-detection-of-infinite-loops/@@download/file/ibing15infloops.pdf}
}