cuplv/dai

DAI: Demanded Abstract Interpretation

dai's Issues

Build fails: tree_sitter_java not found

I am trying to build the master branch as suggested in the README, but the build fails with

File "src/frontend/dune", line 3, characters 23-39:
3 |  (libraries dai syntax tree_sitter_java patience_diff)
                           ^^^^^^^^^^^^^^^^
Error: Library "tree_sitter_java" not found.

I am new to Ocaml, so I might be missing something.

• I've tried opam install tree_sitter_java, but the library is not found.
• I've also tried to Google for such a library in Ocaml, but can't find it either.

Unsound interprocedural Array_bounds analysis when array is modified

solved_ArraySwap.dsg.zip
Here is a Java version of bucket_swap.js from DAI's benchmarks:

public class ArraySwap {
    static boolean swap(int[] array, int i, int j) {
        int temp;
        if (i < 0 || i >= array.length || j < 0 || j >= array.length) {
            return false;
        }
        temp = array[i];
        array[i] = array[j];
        array[j] = temp;
        return true;
    }
    
    public static void main(String[] args) {
        int[] numberArray = {1, 8, 10};//;1, 8, 8, 8, 10, 10};
        boolean mustTrue = numberArray[1] == 8;
        
        // test cases "swap only accepts valid positions"
        boolean test1 = swap(numberArray, 0, 2);
        boolean test2 = swap(numberArray, 0, 1);
        
        // the analysis is unsound: it reports true here
        boolean mustFalse = numberArray[1] == 8;
        
        // test cases "swap accepts bad positions"
        boolean test3 = swap(numberArray, 42, 1);
    }
}

Interprocedural analysis with Array_bounds computes mustFalse to be true.

Looking at the DAIG of swap, I see that elements of the input array are removed from the abstract memory when the array is modified. And then in the main function, abstract memory remains the same, "forgetting" the fact the array has changed.

[UPD] The DSG is attached.

Unsound octagon analysis due to limited environment

dai/src/analysis/domain/octagon.ml

Line 297 in dc9bc57

if Environment.size env >= max_env_size then oct

Because of this, the analysis succeeds but produces unsound results. Would it be better to fail rather than silently proceed?