Alias Analysis: Beyond the Code

Alias analysis is perhaps one of the most crucial and widely used analyses, and has attracted tremendous research efforts over the years. Yet, advanced alias analyses are extremely difficult to get right, and the bugs in these analyses are most likely the reason that they have not been adopted to production compilers. This paper presents NEONGOBY, a system for effectively detecting errors in alias analysis implementations, improving their correctness and hopefully widening their adoption. NEONGOBY works by dynamically observing pointer addresses during the execution of a test program and then checking these addresses against an alias analysis for errors. It is explicitly designed to (1) be agnostic to the alias analysis it checks for maximum applicability and ease of use and (2) detect alias analysis errors that manifest on real-world programs and workloads. It reduces false positives and performance overhead using a practical selection of techniques. Evaluation on three popular alias analyses and real-world programs Apache and MySQL shows that NEONGOBY effectively finds 29 alias analysis bugs with only 2 false positives and reasonable overhead. To enable alias analysis builders to start using NEONGOBY today, we have released it open-source at https://github.com/wujingyue/neongoby, along with our error detection results and proposed patches.

We present a class of domains for Abstract Interpretation, the cofibered domains, that are obtained by “glueing∝ a category of partially ordered sets together. The internal structure of these domains is well suited to the compositional design of approximations and widening operators, and we give generic methods for performing such constructions. We illustrate the interest of these domains by developing an alias analysis of untyped programs handling structured data. The results obtained with this analysis are comparable in accuracy to those obtained with the most powerful alias analyses existing for typed languages.

Dynamic languages such as Python allow programs to be written more easily using high-level constructs such as comprehensions for queries and using generic code. Efficient execution of programs then requires powerful optimizations - incrementalization of expensive queries and specialization of generic code. Effective incrementalization and specialization of dynamic languages require precise and scalable alias analysis. This paper describes the development and experimental evaluation of a may-alias analysis for a full dynamic object-oriented language, for program optimization by incrementalization and specialization. The analysis is flow-sensitive; we show that this is necessary for effective optimization of dynamic languages. It uses precise type analysis and a powerful form of context sensitivity, called trace sensitivity, to further improve analysis precision. It uses a compressed representation to significantly reduce the memory used by flow-sensitive analyses.We evaluate the effectiveness of this analysis and 17 variants of it for incrementalization and specialization of Python programs, and we evaluate the precision, memory usage, and running time of these analyses on programs of diverse sizes. The results show that our analysis has acceptable precision and efficiency and represents the best trade-off between them compared to the variants.

This paper proposes a pointer alias analysis for automatic error detection. State-of-the-art pointer alias analyses are either too slow or too imprecise for finding errors in real-life programs. We propose a hybrid pointer analysis that tracks actively manipulated pointers held in local variables and parameters accurately with path and context sensitivity and handles pointers stored in recursive data structures less precisely but efficiently. We make the unsound assumption that pointers passed into a procedure, in parameters, global variables, and locations reached by applying simple access paths to parameters and global variables, are all distinct from each other and from any other locations. This assumption matches the semantics of many functions, reduces spurious aliases and speeds up the analysis.We present a program representation, called IPSSA, which captures intraprocedural and interprocedural definition-use relationships of directly and indirectly accessed memory locations. This representation makes it easy to create demand-driven path-sensitive and context-sensitive analyses.We demonstrate how a program checker based on IPSSA can be used to find security violations. Our checker, when applied to 10 programs, found 6 new violations and 8 previously reported ones. The checker generated only one false warning, suggesting that our approach is effective in creating practical and easy-to-use bug detection tools.

The New Partnership for Africa’s Development (NEPAD) Agency recognizes that Africa is in a period of transition and that this demands exploring and harnessing safe advances made in science-based innovations including modern biotechnology. To advance the science of biotechnology in Africa effectively, while at the same time safeguarding human health and the environment, the African Union (AU) adopted a High-Level Panel report on modern biotechnology entitled, Freedom to Innovate, which advocated for a coevolutionary approach where technology development goes hand in hand with regulation. Furthermore, most AU member states are Parties to the Cartagena Protocol on Biosafety (CPB), a legally binding international agreement negotiated, concluded and adopted within the framework of the Convention on Biological Diversity. This seeks to guide Parties in developing systems for the environmentally sound management of modern biotechnology applications. Currently, 49 AU Member States have signed and ratified the CPB, of which 12 have passed biosafety laws.African Union (AU) member states are at different stages in the development of regulatory frameworks for applications of modern biotechnology, which include genetically modified (GM) products and other emerging technologies. Biosafety regulatory frameworks comprise: biotechnology and/or biosafety policy; laws, regulations and guidelines; administrative systems; decision-making systems; and mechanisms for public engagement. To assist Member States to implement functional regulatory frameworks for both agriculture and health applications, the NEPAD Agency established the African Biosafety Network of Expertise (ABNE) and the African Medicines Regulatory Harmonization (AMRH).Currently, transgenic insects and GM crops are regulated by Competent National Authorities whose mandate derives from national biosafety laws. For GM crops, a lot of research has been conducted up to the confined field trial (CFT) and multi-location trials stages in a number of African countries. Burkina Faso has fully functional containment facilities for transgenic mosquitoes while Mali and Uganda are developing theirs. The Burkina Faso regulatory agency has granted permits and has already received sets of sterile mosquito eggs for trials in the contained facility. It is instructive to note that both ABNE and AMRH have worked with national and regional regulatory bodies in Africa to enhance their technical capacities for informed decision making, adoption of best practices, and compliance with international standards. It is against the backdrop of a rich blend of on-the-ground knowledge, experience, expertise, and insight into the context and political sensitivities of member states that the NEPAD Agency seeks to expand existing support. This would include capacity strengthening in the regulation of emerging technologies, such as the application of gene drives in the development of transgenic mosquito for the control of malaria transmission.

In software testing process, test data generation represents an important step for high quality software, even for mobile devices. As proposed in previous works, a potential source for random data generation is represented by the UI layout files that are used for almost all mobile platforms (Android, iOS, Windows Phone/Mobile). This paper continues the previous work and presents a test data generation system based on Android layout files. The test data generator uses DSL files as input and generates test data that conform to several testing principles. The generated test data could be stored in XML files or any format required by the testing frameworks.

Writing correct multithreaded programs is difficult. Existing tools for finding bugs in multithreaded programs primarily focus on finding generic concurrency problems such as data races, atomicity violations, and deadlocks. However, these generic bugs may sometimes be benign and may not help to catch other functional errors in multithreaded programs. In this paper, we focus on a high-level programming error, called typestate error, which happens when a program does not follow the correct usage protocol of an object. We present a novel technique that finds typestate errors in multithreaded programs by looking at a successful execution. An appealing aspect of our technique is that it not only finds typestate errors that occur during a program execution, but also many other typestate errors that could have occurred in a different execution. We have implemented this technique in a prototype tool for Java and have experimented it with a number of real-world Java programs.

The appearance of the programming language Java and visual programming environments based on this language give new opportunities to teach introductory programming to university students. The authors are working on a new set of programming courses starting with Visual Programming. In this course the possibilities of visual programming environments are used to teach programming in an application oriented way with more emphasis on building user interfaces and using standard class libraries. Less attention is paid to algorithms. Because the applications in the course are of general interest, the course is suited for a broader audience than computer science students only.

Ecological expertise is considered as a factor of the capitalization of land resources. The conducted research shows that without taking into account the environmental component of the national economy, the process of involving and capitalization of land resources in the economic circulation within the framework of the land development mechanism cannot be realized. The principles of ecological expertise in the article are presented in the form of a scheme. The introduction of green standards for the construction of Olympic facilities and infrastructure in Sochi is the most relevant example of the synthesis of economic, environmental and innovative aspects. Comparative characteristics of the international green standards BREEAM and LEED* (*BREAM (British Building Research Establishment Environmental Assessment Method) are presented. Comparative analysis showed that the BREEAM standard presupposes very stringent requirements (clearly formulated, not allowing deviations, a complicated cumbersome system, the high cost of obtaining approvals), while the LEED Standard is adapted only for the social and economic realities of the United States and provides for stringent requirements for the preparation of documentation, the lack of an independent audit of the evaluation activities; hard link of functionality with architectural forms that are not always acceptable outside of the USA. The application of green standards makes it possible to significantly increase the market value of land plots and necessitates the application of these standards in the development and implementation of investment and construction projects and programs.

Pro Spring MVC provides in-depth coverage of Spring MVC and Spring Web Flow, two highly customizable and powerful web frameworks brought to you by the developers and community of the Spring Framework. Spring MVC is a modern web application framework built upon the Spring Framework, and Spring Web Flow is a project that complements Spring MVC for building reusable web controller modules that encapsulate rich page navigation rules. Along with detailed analysis of the code and functionality, plus the first published coverage of Spring Web Flow 2.x, this book includes numerous tips and tricks to help you get the most out of Spring MVC, Spring Web Flow, and web development in general. Spring MVC and Spring Web Flow have been upgraded in the new Spring Framework 3.1 and are engineered with important considerations for design patterns and expert object-oriented programming techniques. This book explains not only the design decisions of the frameworks, but also how you can apply similar designs and techniques to your own code. This book takes great care in covering every inch of Spring MVC and Spring Web Flow to give you the complete picture. Along with all the best known features of these frameworks, youll discover some new hidden treasures. Youll also learn how to correctly and safely extend the frameworks to create customized solutions. This bookis for anyone who wishes to write robust, modern, and useful web applications with the Spring Framework. What youll learn Key Spring Framework fundamentals How to use the Spring MVC architecture How to develop with the DispatcherServlet How to write Controllers How to work with Resolving and Implementing Views What are the supported View Types How to customize your website What isand how to use the Spring Web Flow framework How to test your Spring MVC applications How to implement Spring Security Who this book is for This book is for Spring or Java EE application developers who want to learn and fully leverage Spring's Web-tier creator and framework, Spring MVC. This book is also for experienced enterprise and Java programmers who are new to the Spring Framework. Table of Contents Configuring a Spring Development Environment Spring Framework Fundamentals Web Application Architecture Spring MVC Architecture Implementing Controllers Implementing Controllers Advanced REST and AJAX Resolving and Implementing Views Testing Spring MVC Applications Spring Web Flow Building Applications with Spring Web Flow Advanced Spring Web Flow Spring Security Cloud Foundry - Deploying to the Cloud

Data-centric synchronization groups fields of objects into atomic sets to indicate they must be updated atomically. Each atomic set has associated units of work, code fragments that preserve the consistency of that atomic set. We present a type system for data-centric synchronization that enables separate compilation and supports atomic sets that span multiple objects, thus allowing recursive data structures to be updated atomically. The type system supports full encapsulation for more efficient code generation. We evaluate our proposal using AJ, which extends the Java programming language with data-centric synchronization. We report on the implementation of a compiler and on refactoring classes from standard libraries and a multi-threaded benchmark to use atomic sets. Our results suggest that data-centric synchronization enjoys low annotation overhead while preventing high-level data races.

Web applications represent an important category of applications that owe much of their popularity to the ubiquitous accessibility using standard web browsers. The complexity of web applications is steadily increasing since the inception of the Internet and the way it is perceived changes from a pure information source to a platform for applications. Many different web frameworks exist that support recurring and tedious development tasks in order to simplify the process of building web applications. Most of the currently available web frameworks adhere to the widely accepted Model 2 design pattern that targets a clean separation of model, view and controller parts of an application in the sense of MVC. Nevertheless, existing frameworks are conceived to work with standard object-oriented business applications only and do not respect the particularities and possibilities of agent applications. Hence, in this paper a new architecture, in accordance with the Model 2 design pattern, is proposed that is able to combine the strengths of agent-based computing with web interactions. This architecture is the basis for the Jadex Webbridge framework, which enables a seamless integration of the Jadex BDI framework with state-of-the art JSP technology. The usage of web technology in combination with agents is further exemplified by an electronic bookstore case study.

How Java APIs break – An empirical study

In a pre and postcondition-style specification, it is difficult to specify the allowed sequences of method calls, referred to as protocols. The protocols are essential properties of reusable object-oriented classes and application frameworks, and the approaches based on the pre and postconditions, such as design by contracts (DBC) and formal behavioral interface specification languages (BISL), are being accepted as a practical and effective tool for describing precise interfaces of (reusable) program modules. We propose a simple extension to the Java Modeling Language (JML), a BISL for Java, to specify protocol properties in an intuitive and concise manner. The key idea of our approach is to separate protocol properties from functional properties written in pre and post-conditions and to specify them in a regular expression-like notation. The semantics of our extension is formally defined and provides a foundation for implementing runtime checks. Case studies have been performed to show the effectiveness our approach. We believe that our approach can be adopted by other BISLs.

Developing secure software in a world where companies like Anthem Blue Cross, Twitter, Facebook, and target have had massive amounts of data stolen by hackers is as challenging as it is important. Insecure coding practices are major contributors to software security vulnerabilities. Even though several static analysis tools are available that can search for and identify security holes in software applications, this process usually runs too late and any remediation will be more costly after large portions of the software have been built. The early detection tools that do exist are closed source and utilise proprietary software vulnerability rule sets. What is missing is an open-source secure coding enforcement tool utilising well-documented rules that software developers can use to predict potential pitfalls, learn from their mistakes and aid in the construction of secure programs as they build them. To address the need, we have designed a new tool called secure coding assistant for the Eclipse development environment that semi-automates several secure coding rules set forth by the CERT division at Carnegie Mellon University. The tool detects violations of the CERT rules for the Java programming language but it is easily extensible to other languages supported by Eclipse. It is an open-source tool with an emphasis on educating software developers in secure coding practices. The tool and a tool demo is disseminated via github at http://benw408701.github.io/SecureCodingAssistant/.