Program verification by reachability searching over dynamic call tree

Abstract

Dynamic call graph represents runtime calls between entities in a program. Existed studies have used call graph to facilitate program comprehension and verification. However, the dynamic call graph produced by a program execution is complicated, especially when multithreads, loops and recursions are involved. In this paper, we retrieve dynamic call graph from program execution and transform it to call tree, and provide an approach of tree simplification by reducing loops and recursions. We formally define reachability properties over a call tree and reachability based tree isomorphism. We prove the soundness of tree simplification and the applicability to transform safety concerns verification to reachability properties searching. We implement the Dynamic Program Analyzer, and show how the behaviors of multithread programs can be retrieved, comprehended and verified.