Automated Formal Static Analysis and Retrieval of Source Code - JKU

Abstract
In this thesis two approaches to source code analysis are theoretically investigated and implemented
in two prototype systems: formal static analysis and retrieval. An integration of the formal
static analysis prototype into the code search prototype is designed.
The formal static analysis method is based on forward symbolic execution and functional
semantics. It systematically generates the verification conditions which are necessary for program
correctness.
We formalize the notions of syntax, semantics, partial correctness and termination of imperative
recursive programs in a purely logic manner. The partial correctness and the termination principles
are expressed in the underlying theory of programs. The termination property is expressed
as an induction principle depending on the structure of the program with respect to recursion and it
plays a central role in the existence and the uniqueness of the function computed by the program,
without which the total correctness formula is trivial due to inconsistency of the assumptions. The
method is implemented in a verification condition generator (FwdVCG) which generates the proof
obligations that insure the correctness of the program. A formulae simplifier is then applied and
reduces them to [system(s)] of equalities and/or inequalities.
Another achievement in this thesis is the integration of a source code retrieval engine Mindbreeze
Code Search into an information retrieval system Mindbreeze Enterprise Search. The
integration required slight modifications of the information retrieval system architecture and components:
a database, a source code custom crawler, a new data source representing the source
code files category were integrated. The context interface of the Query Service was enhanced to
provide context items specific to source code files category.
One of the components of the custom crawler is a tagger which extracts rapidly programming
languages constructs. The crawled source code is made available for retrieval by being structured
and inserted into an index or database. A new data source, representing the source code files,
was integrated into the system by deploying on the server a context provider, category icon and
category descriptor source code category specific. Moreover, we had to provide to this new data
source, category specific icons and menus. To this aim, we improved the Query Service Context
Interface with category icons and menus specific for the source code category specific.
Keywords : program verification, symbolic execution, forward reasoning, functional semantics,
Theorema, tagging, parsing, crawling, indexing, Mindbreeze Enterprise Search.