Polymorphic type inference for machine code

For many compiled languages, source-level types are erased very early in the compilation process. As a result, further compiler passes may convert type-safe source into type-unsafe machine code. Type-unsafe idioms in the original source and type-unsafe optimizations mean that type information in a stripped binary is essentially nonexistent. The problem of recovering high-level types by performing type inference over stripped machine code is called type reconstruction, and offers a useful capability in support of reverse engineering and decompilation. In this paper, we motivate and develop a novel type system and algorithm for machine-code type inference. The features of this type system were developed by surveying a wide collection of common source- and machine-code idioms, building a catalog of challenging cases for type reconstruction. We found that these idioms place a sophisticated set of requirements on the type system, inducing features such as recursively-constrained polymorphic types. Many of the features we identify are often seen only in expressive and powerful type systems used by high-level functional languages. Using these type-system features as a guideline, we have developed Retypd: a novel static type-inference algorithm for machine code that supports recursive types, polymorphism, and subtyping. Retypd yields more accurate inferred types than existing algorithms, while also enabling new capabilities such as reconstruction of pointer const annotations with 98% recall. Retypd can operate on weaker program representations than the current state of the art, removing the need for high-quality points-to information that may be impractical to compute.

With the introduction of parametric types in Java, the type system becomes more complex to handle. The Java generics requires more programming efforts to instantiate appropriate types. In such a situation, a sound type inference algorithm may reduce programming load and ensure safety. Java type inference algorithm has eased programming efforts by reducing explicit instantiation of types. The Java type inference algorithm is being expanded. Still, the impact of inference in mainstream programming is limited. Moreover, the unsound approach for inference causes unpredictable behavior in program code. The limitations and unsoundness of Java type inference need to be discussed to avoid the failure of codes. In this paper, we discuss limitations and issues of type inference algorithm, such as the incapability to infer wildcards as return type in generic methods, and limitations of local variable type inference. Further, we discuss how the machine learning approaches can help to develop a safe type inference algorithm.

Certain variants of object-oriented Datalog can be compiled to Datalog with negation. We seek to apply optimisations akin to virtual method resolution (a well-known technique in compiling Java and other OO languages) to improve efficiency of the resulting Datalog programs. The effectiveness of such optimisations strongly depends on the precision of the underlying type inference algorithm. Previous work on type inference for Datalog has focussed on Cartesian abstractions, where the type of each field is computed separately. Such Cartesian type inference is inherently imprecise in the presence of field equalities. We propose a type system where equalities are tracked, and present a type inference algorithm. The algorithm is proved sound. We also prove that it is optimal for Datalog without negation, in the sense that the inferred type is as tight as possible. Extensive experiments with our type-based optimisations, in a commercial implementation of object-oriented Datalog, confirm the benefits of this non-Cartesian type inference algorithm.

Hindley and Milner's type system, in its purest form, allows what one might call full type inference. Even when a program contains no explicit type information, its very structure gives rise to a conjunction of type equations (or, more generally, to a constraint) whose resolution allows reconstructing the type of every variable and of every sub-expression. Actual programming languages based on this type system, such as Standard ML, Objective Caml, and Haskell, do allow users to provide explicit type information via optional type annotations. Yet, this extra information does not make type inference any easier: it simply gives rise to extra equations, leading to a more specific constraint.There are extensions of Hindley and Milner's type system where full type inference becomes undecidable or intractable. Then, it is common to require explicit type information, via mandatory type annotations. Polymorphic recursion is a simple and well-known instance of this phenomenon. This talk presents two more elaborate instances, commonly known as arbitrary-rank polymorphism and generalized algebraic data types.In both cases, type inference is made tractable thanks to mandatory type annotations. There is a twist, though: these required annotations are often numerous and redundant. So, it seems desirable to make them optional again, and to set up a distinct mechanism to guess some of the elided annotations. This mechanism, referred to as elaboration, can be heuristic. It must be predictable. In the two cases considered in this talk, it is a form of local type inference.This approach leads to a so-called stratified type inference system, where type information is propagated first in a local, ad hoc manner during elaboration, then in a possibly nonlocal, but well-specified manner during constraint solving. This appears to be one of the less displeasing ways of describing type inference systems that are able to exploit optional type annotations to infer better (or different) types.

A common approach to improve software quality is to use programming guidelines to avoid common kinds of errors. In this paper, we consider the problem of enforcing guidelines for Featherweight Java (FJ). We formalize guidelines as sets of finite or infinite execution traces and develop a region-based type and effect system for FJ that can enforce such guidelines. We build on the work by Erbatur, Hofmann and Z\u{a}linescu, who presented a type system for verifying the finite event traces of terminating FJ programs. We refine this type system, separating region typing from FJ typing, and use ideas of Hofmann and Chen to extend it to capture also infinite traces produced by non-terminating programs. Our type and effect system can express properties of both finite and infinite traces and can compute information about the possible infinite traces of FJ programs. Specifically, the set of infinite traces of a method is constructed as the greatest fixed point of the operator which calculates the possible traces of method bodies. Our type inference algorithm is realized by working with the finitary abstraction of the system based on B\"uchi automata.

This paper presents a polymorphic type inference algorithm for a small subset of JavaScript. The goal is to prevent accessing undefined members of objects. We define a type system that allows explicit extension of objects through add operation and implicit extension through method calls. The type system also permits strong updates and unrestricted extensions to new objects. The type inference algorithm is modular so that each function definition is only analyzed once and larger programs can be checked incrementally.

Article Free Access Share on Refinement types for ML Authors: Tim Freeman School of Computer Science, Carnegie Mellon University, Pittsburgh, Pennsylvania School of Computer Science, Carnegie Mellon University, Pittsburgh, PennsylvaniaView Profile , Frank Pfenning School of Computer Science, Carnegie Mellon University, Pittsburgh, Pennsylvania School of Computer Science, Carnegie Mellon University, Pittsburgh, PennsylvaniaView Profile Authors Info & Claims PLDI '91: Proceedings of the ACM SIGPLAN 1991 conference on Programming language design and implementationMay 1991 Pages 268–277https://doi.org/10.1145/113445.113468Online:01 May 1991Publication History 293citation1,256DownloadsMetricsTotal Citations293Total Downloads1,256Last 12 Months93Last 6 weeks10 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

We investigate finite-rank intersection type systems, analyzing the complexity of their type inference problems and their relation to the problem of recognizing semantically equivalent terms. Intersection types allow something of type τ 1 Λ τ 2 to be used in some places at type τ 1 and in other places at type τ 2 . A finite-rank intersection type system bounds how deeply the Λ can appear in type expressions. Such type systems enjoy strong normalization, subject reduction, and computable type inference, and they support a pragmatics for implementing parametric polymorphism. As a consequence, they provide a conceptually simple and tractable alternative to the impredicative polymorphism of System F and its extensions, while typing many more programs than the Hindley-Milner type system found in ML and Haskell.While type inference is computable at every rank, we show that its complexity grows exponentially as rank increases. Let K (0, n ) = n and K ( t + 1, n ) = 2 K ( t,n ) ; we prove that recognizing the pure λ-terms of size n that are typable at rank k is complete for DTIME [ K ( k −1, n )]. We then consider the problem of deciding whether two λ-terms typable at rank k have the same normal form, generalizing a well-known result of Statman from simple types to finite-rank intersection types. We show that the equivalence problem is DTIME [ K ( K ( k − 1, n ), 2)]-complete. This relationship between the complexity of typability and expressiveness is identical in wellknown decidable type systems such as simple types and Hindley-Milner types, but seems to fail for System F and its generalizations. The correspondence gives rise to a conjecture that if Τ is a predicative type system where typability has complexity t ( n ) and expressiveness has complexity e ( n ), then t ( n ) = Ω(log* e ( n )).

A mixin module is a programming abstraction that simultaneously generalizes λ-abstractions, records, and mutually recursive definitions. Although various mixin module type systems have been developed, no one has investigated principal typings or developed type inference for first-class mixin modules, nor has anyone added Milner's let-polymorphism to such a system.This paper proves that typability is NP-complete for the naive approach followed by previous mixin module type systems. Because a λ-calculus extended with record concatenation is a simple restriction of our mixin module calculus, we also prove the folk belief that typability is NP-complete for the naive early type systems for record concatenation.To allow feasible type inference, we present Martini, a new system of simple types for mixin modules with principal typings . Martini is conceptually simple, with no subtyping and a clean and balanced separation between unification-based type inference with type and row variables and constraint solving for safety of linking and field extraction. We have implemented a type inference algorithm and we prove its complexity to be O ( n 2 ), or O ( n ) given a fixed bound on the number of field labels. To prove the complexity, we need to present an algorithm for row unification that may have been implemented by others, but which we could not find written down anywhere. Because Martini has principal typings, we successfully extend it with Milner's let-polymorphism.

The response of compilers to programs with type errors can be unpredictable and confusing. In part this is because the point at which type inference fails may not be the point at which the programmer has made a mistake. This paper explores a way of making type inference algorithms fail at different locations in programs so that clearer error messages may then be produced. Critical to the operation of type inference algorithms is their use of substitutions. We will see that the way in which substitutions are applied in type inference algorithm W means that errors are detected towards the right-hand side of expressions. This paper introduces a new operation -- unification of substitutions -- which allows greater control over the use of substitutions so that this bias can be removed.

Types are a good starting point for various software reengineering tasks. Unfortunately, programs requiring reengineering most desperately are written in languages without an adequate type system (such as COBOL). To solve this problem, we propose a method of automated type inference for these languages. The main ingredients are that if variables are compared using some relational operator their types must be the same; likewise if an expression is assigned to a variable, the type of the expression must be a subtype of that of the variable. We present the formal type system and inference rules for this approach, show their effect on various real life COBOL fragments, describe the implementation of our ideas in a prototype type inference tool for COBOL, and discuss a number of applications.

MLF is a type system that seamlessly merges ML-style type inference with System-F polymorphism. We propose a system of graphic (type) constraints that can be used to perform type inference in both ML or MLF. We show that this constraint system is a small extension of the formalism of graphic types, originally introduced to represent MLF types. We give a few semantic preserving transformations on constraints and propose a strategy for applying them to solve constraints. We show that the resulting algorithm has optimal complexity for MLF type inference, and argue that, as for ML, this complexity is linear under reasonable assumptions.

Object-oriented scripting languages like Javascript and Python are popular partly because of their dynamic features. These include the runtime modification of objects and classes through addition of fields or updating of methods. These features make static typing difficult and so usually dynamic typing is used. Consequently, errors such as access to non-existent members are not detected until runtime.We first develop a formalism for an object based language, JS0 with features from Javascript, including dynamic addition of fields and updating of methods. We give an operational semantics and static type system for JS0using structural types. Our types allow objects to evolve in a controlled manner by classifying members as definite or potential.We define a type inference algorithm for JS0 that is sound with respect to the type system. If the type inference algorithm succeeds, then the program is typeable. Therefore, programmers can benefit from the safety offered by the type system, without the need to write explicitly types in their programs.

The S and K combinator expressions form a well-known Turing-complete subset of the lambda calculus. Using Prolog as a meta-language, we specify evaluation, type inference and combinatorial generation algorithms for SK-combinator trees. In the process, we unravel properties shedding new light on interesting aspects of their structure and distribution. We study the proportion of well-typed terms among size-limited SK-expressions as well as the type-directed generation of terms of sizes smaller than the size of their simple types. We also introduce the well-typed frontier of an untypable term and we use it to design a simplification algorithm for untypable terms taking advantage of the fact that well-typed terms are normalizable.

Typed Clojure is an optional type system for Clojure, a dynamic language in the Lisp family that targets the JVM. Typed Clojure enables Clojure programmers to gain greater confidence in the correctness of their code via static type checking while remaining in the Clojure world, and has acquired significant adoption in the Clojure community. Typed Clojure repurposes Typed Racket’s occurrence typing, an approach to statically reasoning about predicate tests, and also includes several new type system features to handle existing Clojure idioms. In this paper, we describe Typed Clojure and present these type system extensions, focusing on three features widely used in Clojure. First, multimethods provide extensible operations, and their Clojure semantics turns out to have a surprising synergy with the underlying occurrence typing framework. Second, Java interoperability is central to Clojure’s mission but introduces challenges such as ubiquitous null; Typed Clojure handles Java interoperability while ensuring the absence of null-pointer exceptions in typed programs. Third, Clojure programmers idiomatically use immutable dictionaries for data structures; Typed Clojure handles this with multiple forms of heterogeneous dictionary types. We provide a formal model of the Typed Clojure type system incorporating these and other features, with a proof of soundness. Additionally, Typed Clojure is now in use by numerous corporations and developers working with Clojure, and we present a quantitative analysis on the use of type system features in two substantial code bases.