Dynamic heap type inference for program understanding and debugging

C programs can be difficult to debug due to lax type enforcement and low-level access to memory. We present a dynamic analysis for C that checks heap snapshots for consistency with program types. Our approach builds on ideas from physical subtyping and conservative garbage collection. We infer a program-defined type for each allocated storage location or identify "untypable" blocks that reveal heap corruption or type safety violations. The analysis exploits symbolic debug information if present, but requires no annotation or recompilation beyond a list of defined program types and allocated heap blocks. We have integrated our analysis into the GNU Debugger (gdb), and describe our initial experience using this tool with several small to medium-sized programs. Categories and Subject Descriptors D.2.5 (Software Engineer- ing): Testing and Debugging—Debugging aids; D.3.2 (Program- ming Languages): Language Classifications—C; D.3.3 (Program- ming Languages): Language Constructs and Features—Data types and structures, Dynamic storage management; F.3.3 (Logics and Meanings of Programs): Studies of Program Constructs—Type structure