We describe an abstract interpretation based framework for proving relationships between sizes of memory partitions. Instances of this framework can prove traditional properties such as memory safety and program termination but can also establish upper bounds on usage of dynamically allocated memory. Our framework also stands out in its ability to prove properties of programs manipulating both heap and arrays which is considered a difficult task. Technically, we define an abstract domain that is parameterized by an abstract domain for tracking memory partitions (sets of memory locations) and by a numerical abstract domain for tracking relationships between cardinalities of the partitions. We describe algorithms to construct the transfer functions for the abstract domain in terms of the corresponding transfer functions of the parameterized abstract domains. A prototype of the framework was implemented and used to prove interesting properties of realistic programs, including programs that could not have been automatically analyzed before.

We describe a new tool that automatically identifies impact of customization changes, i.e., how changes affect software behavior. As opposed to existing static analysis tools that aim at aiding programmers or improve performance, our tool is designed for end-users without prior knowledge in programming. We utilize state-of-the-art static analysis algorithms for the programs within an Enterprise Resource Planning system (ERP). Key challenges in analyzing real world ERP programs are their significant size and the interdependency between programs. In particular, we describe and compare three customization change impact analyses for real-world programs, and a balancing algorithm built upon the three independent analyses. This paper presents PanayaImpactAnalysis (PanayaIA), a web on-demand tool, providing ERP professionals a clear view of the impact of a customization change on the system. In addition we report empirical results of PanayaIA when used by end-users on an ERP system of tens of millions LOCs.

A method for finding bugs in code is presented. For given small numbers j and k, the code of a procedure is translated into a rela-tional formula whose models represent all execution traces that involve at most j heap cells and k loop iterations. This formula is conjoined with the negation of the procedure's specification. The models of the resulting formula, obtained using a constraint solver, are counterexamples: executions of the code that violate the specification.