Check out the new USENIX Web site. next up previous
Next: Unannotated Functions. Up: 3.2 Added Features Previous: 3.2 Added Features

Taint Flow Paths.

Recall from Section 2.4 that the subtyping constraints can be thought of as inducing a directed graph among qualifiers. A path in the constraint graph from tainted to untainted indicates a type error.

For each type error, we provide a hyperlink to a display of the particular path from tainted to untainted that caused that error. Since each path in the constraint graph typically corresponds to a flow of data through the program, this helps identify the unsafe sequence of operations that lead to a type error. However, since there are typically many such paths (and possibly even cycles) in the constraint graph, displaying all of them may overload the user. Therefore, to reduce the burden on the user, we display the shortest such path, as computed with a breadth-first search. In our experience, this heuristic is very important for usability.

Figure 5 shows one example. Each qualifier in the path is hyperlinked to the definition of the identifier with that qualifier, which makes it easy to navigate the source code to determine the cause of the error.


next up previous
Next: Unannotated Functions. Up: 3.2 Added Features Previous: 3.2 Added Features
Umesh Shankar 2001-05-16