2018/11/08 by Nikos Gorogiannis, Peter W. O'Hearn, Ilya Sergey · 25 citations
Computer Science · #Advanced Malware Detection Techniques #Detector #False positive paradox #Rendering (computer graphics) #Software Engineering Research #Software Testing and Debugging Techniques #Static analysis #Symbolic execution #Variety (cybernetics) #cs.PL
paper · pdf · doi:10.1145/3290370
published in Proceedings of the ACM on Programming Languages 3(POPL), 1-29 (Association for Computing Machinery)
arxiv created 2018/11/08 · arxiv updated 2018/11/09 · openalex created_date 2018/11/16 · openalex publication_date 2019/01/02 · openalex updated_date 2026/08/05
RacerD is a static race detector that has been proven to be effective in engineering practice: it has seen thousands of data races fixed by developers before reaching production, and has supported the migration of Facebook's Android app rendering infrastructure from a single-threaded to a multi-threaded architecture. We prove a True Positives Theorem stating that, under certain assumptions, an idealized theoretical version of the analysis never reports a false positive. We also provide an empirical evaluation of an implementation of this analysis, versus the original RacerD. The theorem was motivated in the first case by the desire to understand the observation from production that RacerD was providing remarkably accurate signal to developers, and then the theorem guided further analyzer design decisions. Technically, our result can be seen as saying that the analysis computes an under-approximation of an over-approximation, which is the reverse of the more usual (over of under) situation in static analysis. Until now, static analyzers that are effective in practice but unsound have often been regarded as ad hoc; in contrast, we suggest that, in the future, theorems of this variety might be generally useful in understanding, justifying and designing effective static analyses for bug catching.