Solving String Constraints With Regex-Dependent Functions Through Transducers With Priorities And Variables

by   Taolue Chen, et al.

Regular expressions are a classical concept in formal language theory. Regular expressions in programming languages (RegEx) such as JavaScript, feature non-standard semantics of operators (e.g. greedy/lazy Kleene star), as well as additional features such as capturing groups and references. While symbolic execution of programs containing RegExes appeals to string solvers natively supporting important features of RegEx, such a string solver is hitherto missing. In this paper, we propose the first string theory and string solver that natively provide such a support. The key idea of our string solver is to introduce a new automata model, called prioritized streaming string transducers (PSST), to formalize the semantics of RegEx-dependent string functions. PSSTs combine priorities, which have previously been introduced in prioritized finite-state automata to capture greedy/lazy semantics, with string variables as in streaming string transducers to model capturing groups. We validate the consistency of the formal semantics with the actual JavaScript semantics by extensive experiments. Furthermore, to solve the string constraints, we show that PSSTs enjoy nice closure and algorithmic properties, in particular, the regularity-preserving property (i.e., pre-images of regular constraints under PSSTs are regular), and introduce a sound sequent calculus that exploits these properties and performs propagation of regular constraints by means of taking post-images or pre-images. Although the satisfiability of the string constraint language is undecidable, we show that our approach is complete for the so-called straight-line fragment. We evaluate the performance of our string solver on over 195000 string constraints generated from an open-source RegEx library. The experimental results show the efficacy of our approach, drastically improving the existing methods in both precision and efficiency.



There are no comments yet.


page 1


What Is Decidable about String Constraints with the ReplaceAll Function

Recently, it was shown that any theory of strings containing the string-...

Sound Regular Expression Semantics for Dynamic Symbolic Execution of JavaScript

Existing support for regular expressions in automated test generation or...

CertiStr: A Certified String Solver (technical report)

Theories over strings are among the most heavily researched logical theo...

Implicit automata in typed λ-calculi II: streaming transducers vs categorical semantics

We characterize regular string transductions as programs in a linear λ-c...

On the Separability Problem of String Constraints

We address the separability problem for straight-line string constraints...

Decision Procedures for Path Feasibility of String-Manipulating Programs with Complex Operations

The design and implementation of decision procedures for checking path f...

Twinning automata and regular expressions for string static analysis

In this paper we formalize and prove the soundness of Tarsis, a new abst...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.