Automated Detection of Non-termination and NullPointerExceptions for Java Bytecode

  • Marc Brockschmidt
  • Thomas Ströder
  • Carsten Otto
  • Jürgen Giesl
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7421)


Recently, we developed an approach for automated termination proofs of Java Bytecode (JBC), which is based on constructing and analyzing termination graphs. These graphs represent all possible program executions in a finite way. In this paper, we show that this approach can also be used to detect non-termination or NullPointerExceptions. Our approach automatically generates witnesses, i.e., calling the program with these witness arguments indeed leads to non-termination resp. to a NullPointerException. Thus, we never obtain “false positives”. We implemented our results in the termination prover AProVE and provide experimental evidence for the power of our approach.


Outgoing Edge Termination Graph Symbolic Evaluation Concrete State Loop Condition 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
    Ayewah, N., Hovemeyer, D., Morgenthaler, J.D., Penix, J., Pugh, W.: Using static analysis to find bugs. IEEE Software 25(5), 22–29 (2008)CrossRefGoogle Scholar
  3. 3.
    Beckert, B., Hähnle, R., Schmitt, P.H.: Verification of Object-Oriented Software: The KeY Approach. LNCS, vol. 4334 (2007)Google Scholar
  4. 4.
    Brockschmidt, M., Otto, C., von Essen, C., Giesl, J.: Termination Graphs for Java Bytecode. In: Siegler, S., Wasser, N. (eds.) Walther Festschrift. LNCS, vol. 6463, pp. 17–37. Springer, Heidelberg (2010); Extended version (with proofs) available [1]CrossRefGoogle Scholar
  5. 5.
    Brockschmidt, M., Ströder, T., Otto, C., Giesl, J.: Automated detection of non-termination and NullPointerExceptions for Java Bytecode. Report AIB 2011-17, RWTH Aachen, 2011. Available at [1],
  6. 6.
    Brockschmidt, M., Otto, C., Giesl, J.: Modular termination proofs of recursive Java Bytecode programs by term rewriting. In: Proc. RTA 2011. LIPIcs, vol. 10, pp. 155–170 (2011); Extended version (with proofs) available at [1]Google Scholar
  7. 7.
    Bubel, R., Hähnle, R., Ji, R.: Interleaving Symbolic Execution and Partial Evaluation. In: de Boer, F.S., Bonsangue, M.M., Hallerstede, S., Leuschel, M. (eds.) FMCO 2009. LNCS, vol. 6286, pp. 125–146. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  8. 8.
    Cousot, P., Cousot, R.: Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proc. POPL  1977, pp. 238–252. ACM Press (1977)Google Scholar
  9. 9.
    Csallner, C., Smaragdakis, Y., Xie, T.: DSD-Crasher: A hybrid analysis tool for bug finding. ACM Trans. Softw. Eng. Methodol. 17, 8:1–8:37 (2008)Google Scholar
  10. 10.
    de Moura, L., Bjørner, N.: Z3: An Efficient SMT Solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  11. 11.
    Giesl, J., Thiemann, R., Schneider-Kamp, P.: Proving and Disproving Termination of Higher-Order Functions. In: Gramlich, B. (ed.) FroCos 2005. LNCS (LNAI), vol. 3717, pp. 216–231. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  12. 12.
    Giesl, J., Schneider-Kamp, P., Thiemann, R.: AProVE 1.2: Automatic Termination Proofs in the Dependency Pair Framework. In: Furbach, U., Shankar, N. (eds.) IJCAR 2006. LNCS (LNAI), vol. 4130, pp. 281–286. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  13. 13.
    Godefroid, P., Klarlund, N., Sen, K.: DART: Directed automated random testing. In: Proc. PLDI 2005, pp. 213–223. ACM Press (2005)Google Scholar
  14. 14.
    Gupta, A., Henzinger, T.A., Majumdar, R., Rybalchenko, A., Xu, R.: Proving non-termination. In: Proc. POPL 2008, pp. 147–158. ACM Press (2008)Google Scholar
  15. 15.
    Hubert, L., Jensen, T., Pichardie, D.: Semantic Foundations and Inference of Non-null Annotations. In: Barthe, G., de Boer, F.S. (eds.) FMOODS 2008. LNCS, vol. 5051, pp. 132–149. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  16. 16.
    Lindholm, T., Yellin, F.: Java Virtual Machine Specification. Prentice Hall (1999)Google Scholar
  17. 17.
    Otto, C., Brockschmidt, M., von Essen, C., Giesl, J.: Automated termination analysis of Java Bytecode by term rewriting. In: Proc. RTA 2010. LIPIcs, vol. 6, pp. 259–276 (2010); Extended version (with proofs) available at [1]Google Scholar
  18. 18.
    Payet, É., Mesnard, F.: Nontermination inference of logic programs. ACM Trans. Prog. Lang. Syst. 28, 256–289 (2006)CrossRefGoogle Scholar
  19. 19.
    Payet, É.: Loop detection in term rewriting using the eliminating unfoldings. Theoretical Computer Science 403, 307–327 (2008)MathSciNetzbMATHCrossRefGoogle Scholar
  20. 20.
    Payet, É., Spoto, F.: Experiments with non-termination analysis for Java Bytecode. In: Proc. BYTECODE 2009. ENTCS, vol. 5, pp. 83–96 (2009)Google Scholar
  21. 21.
    Sen, K., Marinov, D., Agha, G.: CUTE: A concolic unit testing engine for C. In: Proc. FSE  2010, pp. 263–272. ACM Press (2005)Google Scholar
  22. 22.
    Sørensen, M.H., Glück, R.: An algorithm of generalization in positive supercompilation. In: Proc. ILPS  1995, pp. 465–479. MIT Press (1995)Google Scholar
  23. 23.
    Spoto, F.: Precise null-pointer analysis. Softw. Syst. Model. 10, 219–252 (2011)CrossRefGoogle Scholar
  24. 24.
    Velroyen, H., Rümmer, P.: Non-termination Checking for Imperative Programs. In: Beckert, B., Hähnle, R. (eds.) TAP 2008. LNCS, vol. 4966, pp. 154–170. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  25. 25.
    Yang, H., Lee, O., Berdine, J., Calcagno, C., Cook, B., Distefano, D., O’Hearn, P.: Scalable Shape Analysis for Systems Code. In: Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 385–398. Springer, Heidelberg (2008)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Marc Brockschmidt
    • 1
  • Thomas Ströder
    • 1
  • Carsten Otto
    • 1
  • Jürgen Giesl
    • 1
  1. 1.LuFG Informatik 2RWTH Aachen UniversityGermany

Personalised recommendations