Combinations of Reusable Abstract Domains for a Multilingual Static Analyzer

  • Matthieu Journault
  • Antoine MinéEmail author
  • Raphaël Monat
  • Abdelraouf Ouadjaout
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 12031)


We discuss the design of Mopsa, an ongoing effort to design a novel semantic static analyzer by abstract interpretation. Mopsa strives to achieve a high degree of modularity and extensibility by considering value abstractions for numeric, pointer, objects, arrays, etc. as well as syntax-driven iterators and control-flow abstractions uniformly as domain modules, which offer a unified signature and loose coupling, so that they can be combined and reused at will. Moreover, domains can dynamically rewrite expressions, which simplifies the design of relational abstractions, encourages a design based on layered semantics, and enables domain reuse across different analyses and different languages. We present preliminary applications of Mopsa analyzing simple programs in subsets of the C and Python programming languages, checking them for run-time errors and uncaught exceptions.


Static analysis Program verification Abstract interpretation Tool design 


  1. 1.
    Balakrishnan, G., Reps, T.: Recency-abstraction for heap-allocated storage. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 221–239. Springer, Heidelberg (2006). Scholar
  2. 2.
    Bertrane, J., et al.: Static analysis and verification of aerospace software by abstract interpretation. In: AIAA Infotech\(@\) Aerospace AIAA, No. 2010–3385, pp. 1–38, April 2010Google Scholar
  3. 3.
    Calcagno, C., Distefano, D., Dubreil, J., Gabi, D., Hooimeijer, P., Luca, M., O’Hearn, P., Papakonstantinou, I., Purbrick, J., Rodriguez, D.: Moving fast with software verification. In: Havelund, K., Holzmann, G., Joshi, R. (eds.) NFM 2015. LNCS, vol. 9058, pp. 3–11. Springer, Cham (2015). Scholar
  4. 4.
    Cousot, P., Cousot, R.: Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proceedings of the POPL 1977, pp. 238–252. ACM, January 1977Google Scholar
  5. 5.
    Cousot, P., Cousot, R.: Systematic design of program analysis frameworks. In: Proceedings of the POPL 1979. pp. 269–282. ACM Press (1979)Google Scholar
  6. 6.
    Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Miné, A., Monniaux, D., Rival, X.: Combination of abstractions in the ASTRÉE static analyzer. In: Okada, M., Satoh, I. (eds.) ASIAN 2006. LNCS, vol. 4435, pp. 272–300. Springer, Heidelberg (2007). Scholar
  7. 7.
    Cousot, P., Cousot, R., Mauborgne, L.: The Reduced product of abstract domains and the combination of decision procedures. In: Hofmann, M. (ed.) FoSSaCS 2011. LNCS, vol. 6604, pp. 456–472. Springer, Heidelberg (2011). Scholar
  8. 8.
    Cousot, P., Halbwachs, N.: Automatic discovery of linear restraints among variables of a program. In: Conference Record of the 5th Annual ACM SIGPLAN/SIGACT Symposium on Principles of Programming Languages POPL 1978, pp. 84–97. ACM (1978)Google Scholar
  9. 9.
    Cuoq, P., Kirchner, F., Kosmatov, N., Prevosto, V., Signoles, J., Yakobowski, B.: Frama-C: a software analysis perspective. Formal Aspects Comput. 27, 573–609 (2012)MathSciNetGoogle Scholar
  10. 10.
    Fromherz, A., Ouadjaout, A., Miné, A.: Static value analysis of python programs by abstract interpretation. In: Dutle, A., Muñoz, C., Narkawicz, A. (eds.) NFM 2018. LNCS, vol. 10811, pp. 185–202. Springer, Cham (2018). Scholar
  11. 11.
    Journault, M., Miné, A., Ouadjaout, A.: Modular static analysis of string manipulations in C programs. In: Podelski, A. (ed.) SAS 2018. LNCS, vol. 11002, pp. 243–262. Springer, Cham (2018). Scholar
  12. 12.
    Journault, M., Miné, A., Ouadjaout, A.: An abstract domain for trees with numeric relations. In: Caires, L. (ed.) ESOP 2019. LNCS, vol. 11423, pp. 724–751. Springer, Cham (2019). Scholar
  13. 13.
    Kästner, D., et al.: Astrée: proving the absence of runtime errors. In: Proceedings of the ERTS2 2010, May 2010Google Scholar
  14. 14.
    Lattner, C., Adve, V.: LLVM: a compilation framework for lifelong program analysis & transformation. In: Proceedings of the CGO 2004, March 2004Google Scholar
  15. 15.
    Miné, A.: Field-sensitive value analysis of embedded C programs with union types and pointer arithmetics. In: Proceedings of the LCTES 2006, pp. 54–63. ACM, June 2006CrossRefGoogle Scholar
  16. 16.
    Miné, A.: Tutorial on static inference of numeric invariants by abstract interpretation. Found. Trends Programm. Lang. (FnTPL) 4(3–4), 120–372 (2017)CrossRefGoogle Scholar
  17. 17.
    Miné, A., Ouadjaout, A., Journault, M.: Design of a modular platform for static analysis. In: Proceedings of the 9th Workshop on Tools for Automatic Program Analysis (TAPAS 2018), p. 4, 28 August 2018 Google Scholar
  18. 18.
    Namjoshi, K.S., Pavlinovic, Z.: The impact of program transformations on static program analysis. In: Podelski, A. (ed.) SAS 2018. LNCS, vol. 11002, pp. 306–325. Springer, Cham (2018). Scholar
  19. 19.
    Oh, H., Heo, K., Lee, W., Lee, W., Yi, K.: Design and implementation of sparse global analyses for C-like languages. SIGPLAN Not. 47(6), 229–238 (2012)CrossRefGoogle Scholar
  20. 20.
    Spoto, F.: Julia: a generic static analyser for the Java bytecode. In: Proceedings of FTfJP 2005. p. 17, July 2005Google Scholar

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  • Matthieu Journault
    • 1
  • Antoine Miné
    • 1
    • 2
    Email author
  • Raphaël Monat
    • 1
  • Abdelraouf Ouadjaout
    • 1
  1. 1.Sorbonne Université, CNRS, LIP6ParisFrance
  2. 2.Institut Universitaire de FranceParisFrance

Personalised recommendations