We present an SMT-based symbolic model checking algorithm for safety verification of
recursive programs. The algorithm is modular and analyzes procedures individually. Unlike …

We propose the class of visibly pushdown languages as embeddings of context-free
languages that is rich enough to model program analysis questions and yet is tractable and …

Dynamic test generation is a form of dynamic program analysis that attempts to compute test
inputs to drive a program along a specific program path. Directed Automated Random …

We propose the model of nested words for representation of data with both a linear ordering
and a hierarchically nested matching of items. Examples of data with such dual linear …

We present an algorithm DASH to check if a program P satisfies a safety property phi. The
unique feature of the algorithm is that it uses only test generation operations, and it refines …

There is more than a decade-long history of using static analysis to find bugs in systems
such as Linux. Most of the existing static analyses developed for these systems are simple …

We define Recursive Markov Chains (RMCs), a class of finitely presented denumerable
Markov chains, and we study algorithms for their analysis. Informally, an RMC consists of a …

Context-free language reachability (CFL-reachability) is a fundamental framework for
program analysis. A large variety of static analyses can be formulated as CFL-reachability …

The context-free language (CFL) reachability problem is a well-known fundamental
formulation in program analysis. In practice, many program analyses, especially pointer …

Given an edge-labeled graph, context-free language reachability (CFL-reachability)
computes reachable node pairs by deriving new edges and adding them to the graph. The …