dataesr/scientific-paragraphs-categorization huggingface dataset:
the U-BIOPRED (IMI n 115010 grant to C. A. ) and eTRIKS (IMI n 115446 grant to C. A. , R. B. , R. S. ) Consortia funded by the European Union and the European Federation of Pharmaceutical Industry Associations, the Coordinating action for the implementation of systems medicine in Europe (CASyM FP7 grant n 305333 to C. A. , R. B. ), the COLOSYS grant ANR-15-CMED-0001-04, provided by the Agence Nationale de la Recherche under the frame of ERACoSysMed-1, the ERA-Net for Systems Medicine in clinical research and medical practice (to I. K. , E. B. , A. Z. ).
Acknowledgements The authors would like to thank the DMC members, whose participation in the discussions in the meeting helped greatly to shape the contents of this article:  Joaquin Dopazo ,  Alvaro Gallego-Martinez ,  David Hoksza ,  Jose Antonio Lopez-Escamez ,  Susana Kalko ,  Francisco J. Lopez-Hernandez ,  Cecilia Jimenez Mallebrera ,  Jennifer Modamio ,  Sune S. Nielsen ,  Catarina Pereira ,  Hoda Sharifian ,  Vidisha Singh ,  Ling Xiao  and  Erfan Younesi.
We present a new, general methodology for developing compositional analyses for languages that do not satisfy the frame property, and apply it to the design of the symbolic execution of Cosette. In contrast to existing tools, the symbolic analysis of Cosette is fully formalised in a way that guides the implementation and is also trusted, in that it follows the JavaScript semantics and does not produce false positive bug reports. We apply Cosette to whole-program symbolic testing of real-world JavaScript libraries and compositional debugging of separation logic specifications of JavaScript programs. We illustrate these use cases in §2. We show the architecture of Cosette on the right. We extend JS with constructs for creating and reasoning about symbolic values. Using JS-2-JSIL  [22] , a trusted compiler from JS to the JSIL intermediate language, we compile the extended JS program to an extended JSIL program.
The key innovation is to have the instrumented semantics as a proper interim stage in the design of the symbolic execution, obtaining more modular reasoning and substantially simpler proofs. We present this methodology in §3. An essential goal for us was to establish trust in Cosette. In §3. 5, we give a bounded soundness result for the JSIL symbolic semantics and prove that Cosette never produces false positive bug reports. These results, combined with the correctness of JS-2-JSIL and the fact that the memory models of JavaScript and JSIL are the same by design, enable us to lift the results of analyses done on compiled JSIL code back to JS (cf. §3. 7, §4. 4). We implement the JSIL instrumented interpreter following the instrumented semantics of §3. 3 to the letter. We test the combination of JS-2-JSIL and the JSIL instrumented interpreter using Test262, the official ECMAScript test suite  [19].
Out of the 10469 tests for ES5 Strict, we identify 8330 tests appropriate for our coverage, of which we pass 100%. Finally, we ensure that the JSIL symbolic interpreter obtained by the Rosette lifting of the instrumented interpreter is consistent with the symbolic semantics of §3. 4 by constructing symbolic unit tests for each JSIL command, assuming the premises and asserting the conclusion of the appropriate rule of the symbolic semantics. We apply Cosette to whole-program symbolic testing. A general developer can use Cosette for symbolic testing of their code by having symbolic inputs instead of concrete inputs and stating the constraints that the output needs to satisfy as simple, intuitive first-order assertions over these inputs. If a test fails, Cosette provides the concrete input that causes it to fail, exposing bugs in the tested code.
In §5, we evaluate Cosette on two real-world JavaScript data structure libraries, where, using fewer tests, we achieve better coverage (100%) than the concrete unit test suites shipped with the libraries, and discover unexpected bugs in both libraries. We also apply Cosette to specification-driven bug-finding. Functional correctness specifications of JS programs are highly intricate, with only a few tools (JaVerT  [22]  and KJS  [16, 36] ) supporting such expressivity. When these tools cannot prove that a given function satisfies a specification, the developer has to understand a complicated proof trace to discover the error (JaVerT), or act with essentially no feedback (KJS). In §2. 2, we show how Cosette can be used for debugging separation logic (SL) specifications of JS programs in JaVerT, made possible by its compositionality.
USING COSETTE We illustrate how Cosette can be used both for whole-program and compositional symbolic testing of JavaScript programs. We demonstrate how Cosette explicitly exposes the resilience of JavaScript programs to the environment, not considered by standard symbolic execution tools, but essential for compositional analysis. Our running example is a key-value map implementation, given in Figure  1a. It contains four functions: Map, for constructing an empty map; get, for retrieving the value associated with a given key; put, for inserting/updating key-value pairs; and validKey, for deciding whether or not a key is valid. The library implements a key-value map as an object with property _contents, denoting the object storing the map contents. The named properties of _contents and their value attributes correspond to the map keys and values.
Whole-program Symbolic Testing Developers are used to writing unit tests-verifying that, given some concrete inputs, their code produces the expected outputs. Using Cosette, they can write unit tests with symbolic inputs and outputs, testing a broad range of behaviours with a single symbolic test. For example, one unit test for the put function consists of inserting a valid key-value pair (k, v) into a map and then verifying that it has been inserted correctly. In Cosette, this test can be written as in Figure  1c. First, we declare k to be a symbolic string and v to be an symbolic number, using Cosette's constructs for creating symbolic variables. Next, we assume that k is a valid key. Next, we create a new map, put the (symbolic) key-value pair (k, v) into the map and retrieve the value corresponding to k.
Specification-driven Bug-finding Cosette can also be used for compositional symbolic analysis of JS functions in isolation, where the user specifies the functions using pre-and post-conditions. These specifications may account for only the parts of the heap required for running the function and can involve recursive and non-recursive predicates. We always unfold recursive predicates to a bound specified by the user. Just as symbolic tests generalise concrete tests, so specifications generalise symbolic tests. Given a JavaScript function, its specification, and the unfold depth for predicates, Cosette generates symbolic tests to verify that the function conforms to the specification up to that given depth. If this is not the case, Cosette will return a concrete counter-model that invalidates the specification.
Unlike whole-program analysis tools, Cosette also tests if the given specification is compositional: that is, if it is resilient against all possible contexts in which the function can be run. It reports back to the user any found sources of non-compositionality. Cosette supports the specification of symbolic states via simple separation logic assertions in the style of JaVerT  [22]. Developers have at their disposal a number of built-in predicates that capture the fundamental concepts of JavaScript (discussed throughout the text), and can define their own predicates as well. For instance, learning from the previous symbolic test, we could define the following predicate for describing valid keys: ValidKey(k) := types(k : Str) * (k <> "hasOwnProperty"), meaning that k is a valid key if it is a string that is not equal to "hasOwnProperty".
However, if we were to forget the highlighted parts in the Map definition and put specification, we would encounter other issues, exposing the tension between compositionality and dynamic languages. First, if we omitted the part of the Map predicate highlighted in red, Cosette would complain, when testing the put function, that it has no information about the property "put" of the map object m and cannot perform the lookup m. put (Fig. 2, above ). This means that the library code is not resilient to frames in which a map object m has the property put. Analogous issues would arise for the "get" and "validKey" properties. Second, if we omitted the parts highlighted in blue, when executing this. _contents[k] = v (Fig. 1a , line 12), Cosette would complain that it has no information about the property k in the prototype chain of the contents object (Fig.
At its core are the GetCell and GetDomain functions, which precisely pinpoint the way in which JSIL interacts with the heap, factoring out the common behaviour of JSIL basic commands. It also provides standard constructs for reasoning about symbolic values, whose concrete and instrumented semantics are trivial. The abstract semantics is parametric on abstract states Σ ∈ S and abstract values v, p, l ∈ V. Abstract states are assumed to have a store P : X ⇀ V, mapping program variables x ∈ X to abstract values. Stores are accessible via a store selector, Σ. sto. We use the special symbol (read: none) to denote the absence of a property in an object, write V for the set V ∪ { } and range over it using v. Abstract states expose the following functions and relations: JSIL Expression Evaluation, Ev (P, e), which evaluates to the value of the JSIL expression e under store P.
Also, if we remove (l o , "get") → from the initial heap, the instrumented execution will get stuck in the execution of line 0. Example: Instrumented GetCell. To better understand the interaction between Get-Cell, the heap, and the domain table, consider the program on the right and its execution trace in Figure  5  (left). When executing the first property assignment, following the abstract Property Assignment rule, we must call GC(o, "foo") to obtain the current value of the property. As the property is not in the heap, we are in the Not Found case of GetCell. The domain is extended with "foo", and the heap is extended with the none-cell (l o , "foo") → , whose value is then updated to 42 by the heap update. After the deletion, its value is reset to. The following property assignment will again call GC(o, "foo"), but this time, we will be in the Found case of GetCell, as the property is in the heap.
Implementation Our three semantics for JSIL ( §3. 2- §3. 4) are specifically designed with implementation in mind: one only needs to follow the rules, which are written operationally, modularly, and are syntax-directed. However, implementing the entailment engine required by the symbolic semantics and practically handling the state explosion problem  [15]  is a challenging task. For this reason, we develop the first, proof-of-concept version of Cosette leveraging on Rosette  [48, 49] , a symbolic virtual machine that enables the development of solver-aided languages. Rosette extends Racket  [37]  with symbolic values and first-order assertions over these values, and languages implemented in Rosette can make use of its solver-aided facilities. We implement the instrumented JSIL interpreter of §3.
SPECIFICATION-DRIVEN BUG-FINDING We show how to use Cosette for debugging JSIL code annotated with separation logic (SL) specifications. To achieve this, we extend the JSIL symbolic interpreter with a mechanism for asserting SLassertions ( §4. 1) and show how to implement this mechanism by giving a sound decision procedure for solving the frame inference problem (FIP)  [7]  in the context of symbolic execution ( §4. 2). In §4. 3, we present an algorithm for generating symbolic tests from SL-specifications, which guarantees that when a symbolic test fails, Cosette produces a concrete counter-model that invalidates the corresponding specification. We conclude with a discussion on how to lift the presented results to JavaScript ( §4. 4).
Lifting the results to JavaScript JaVerT specifications of JS functions are analogous to JSIL specifications of JSIL procedures. A JaVerT specification fl : {P JS } f (x ) {Q JS } is valid for a JS program s, written s |= fl : {P JS } f (x ) {Q JS } if and only if s contains a function literal with identifier f and "whenever f is executed in a state satisfying P JS , then, if it terminates, it does so in a state satisfying Q JS , with return mode fl". JS-2-JSIL is proven to correctly compile JaVerT specifications to JSIL specifications  [22]. Testing JaVerT Specifications. We generate symbolic tests from a JS program and its JaVerT specifications by: converting them to a JSIL program with JSIL specifications, using JS-2-JSIL; generating a set of symbolic tests from the obtained JSIL program and JSIL specifications, as described in §4.
3; and running the generated JSIL symbolic tests using the JSIL symbolic semantics described in §3. 4. If Cosette finds a bug while running the tests, we will obtain a concrete counter-example triggering a specification violation. Formal Guarantees. The correctness of JS-2-JSIL ensures that a JaVerT specification fl : {P JS } f (x ) {Q JS } is valid for a given JS program s iff the translated specification C(fl : {P JS } f (x ) {Q JS }) is valid for the compilation of s. Hence, we can lift Theorem 4. 3 to the JavaScript level in a straightforward way, as shown below. Corollary 4. 4 (Bug-finding for JaVerT Specifications).
Apart from the coverage of JS-2-JSIL, there are not many limitations to the reasoning capabilities of Cosette. Due to the limitations of Rosette, Cosette does not support the eval statement. Also, it supports the for-in statement with a fixed property enumeration. This is sound, because if a bug is found for a particular enumeration order, it still exists for an arbitrary enumeration order. Whole-program Symbolic Testing. We first created a number of simple symbolic tests to demonstrate that Cosette can reason about essential JavaScript features, such as prototype inheritance, function closures, arrays, strings, as well as the substantially more challenging for-in statement and dynamic dispatch. We have also analysed two real-world data structure libraries: Buckets. js [41] , and queue-pri  [27].
We chose these two libraries because they exercise many essential JavaScript features, because they come equipped with unit test suites, and because they do not have external dependencies. In addition, Buckets. js is widely used by developers, having over 65k downloads on npm  [34]. For both libraries, we wrote comprehensive symbolic unit tests for all functions and compared them with the concrete unit tests that ship with the libraries. The results are presented in Table  2. For each file in the libraries, we report the number of JS executable lines in the code itself and including dependencies (slash-separated), the corresponding numbers of JSIL lines, the number of symbolic unit tests created by us and the number of concrete unit tests created by the library developers, the number of JS lines in the symbolic and concrete tests, their coverage measured as percentage of lines, and the average Cosette run time for the symbolic tests.
The results we obtained clearly demonstrate the benefits of symbolic testing using Cosette. In both cases, we were able to obtain 100% line coverage, improving the coverage of the Buckets. js library Table  2 : Tests for the Buckets. js and queue-pri libraries by 12%. We achieved this using a total of 60% fewer tests, and each test had on average 10% fewer lines of code. We also discovered one bug in the Buckets. js library, as well as one in the queue-pri library. For the testing, we used a machine with an Intel Core i7-4980HQ CPU 2. 80 GHz and DDR3 RAM 16GB. We measured the execution time of each symbolic test and averaged the times across tests for each library file. The times we obtain reflect the fact that Rosette code is interpreted, rather than run natively. We aim at implementing our own symbolic execution tool from scratch in the future, which, given our experience with JaVerT, should reduce execution times by at least an order of magnitude.
Bug: Multi-dictionary in Buckets. js. We discovered a bug in the implementation of the Buckets. js multi-dictionary library. A multidictionary is a key-value map in which a single key holds an array of distinct values. Our symbolic tests for the remove(key, value) function, which removes a given key-value pair from the multidictionary, have revealed that the library wrongly treats the case in which we try to remove a key-value pair for a key with no associated values. In practice, a runtime error is thrown instead of remove returning false. This bug was not detected by the concrete unit tests associated with the library due to their incomplete coverage; we have fixed it and submitted an appropriate pull request. A simplified version of the failing code is shown below. The parent variable is an internal variable of the multidict object that holds a Buckets.
js raises an error. We fixed the bug by adding a check for undefined after line 3 in the code of remove, after which Cosette successfully discharged the assertion. Bug: queue-pri. This library implements a priority queue that stores data with an optional priority value, which is either a number (the lower the value, the higher the priority) or null if no priority is provided, in which case the associated element is put at the end of the queue. Our symbolic tests of the enqueue(data, pri) method of the library show that elements enqueued with priority 0 were being wrongly enqueued at the end of the queue. We traced the bug to the way in which priority was calculated inside enqueue: priority = pri || null, which evaluates to null if the priority is not supplied, but also, due to JS semantics, if it is equal to 0.
We have observed that very few unfoldings are sufficient for achieving full coverage. In particular, the tests generated for the key-value map, priority queue, and the sorted list have full coverage already for unfold depth set to 1, while those for the BST reach full coverage for unfold depth set to 2. To test the compositionality of Cosette, we crippled the specifications of the key-value map and the priority queue, exposing frame-related bugs, such as the ones shown in §2. 2. Cosette was already able to detect all bugs with the unfold depth set to 1, which shows that it can successfully reason given partial state information, in contrast to standard symbolic execution tools for JavaScript.
[17]  proposed a SAT-based approach for testing Java code annotated with relational logic specifications. To the best of our knowledge, there are no tools for specification-driven testing of JavaScript, and no tools for test generation based on separation logic specifications. Logic-based Verification for JavaScript. Our work has been strongly influenced by JaVerT  [22] , a verification toolchain for JavaScript based on separation logic. JaVerT comes with a trusted compiler, JS-2-JSIL, from JavaScript to JSIL. We use JS-2-JSIL in Cosette, extending it with constructs for creating and reasoning about symbolic values. Like Cosette, JaVerT also performs its analysis on compiled JSIL code. However, the separation logic proof rules of JaVerT are not syntax-directed and offer little implementation insight.
There is also the work of Swamy et al. [46] , who prove absence of runtime errors for higher-order JavaScript (ES3) programs by: compiling JS programs to the logic of F*; generating verification conditions for the absence of runtime errors; and automatically discharging these conditions using Z3. However, as this analysis does not consider specifications, it was not possible for us to reuse its results for Cosette. All of the above-mentioned verification tools provide strong correctness guarantees, but have severe scalability limitations, as they require loop invariants and abstractions for the recursive structures that the programs use. For instance, the Buckets. js library would be out of their reach, as they do not come with abstractions to accurately describe, for example, JavaScript arrays, for-in loop invariants, and higher-order functions.
CONCLUSIONS We have presented Cosette, a trustworthy, compositional symbolic execution framework for JavaScript, combining the JS-2-JSIL compiler and our JSIL symbolic interpreter written in Rosette. We have applied Cosette to whole-program symbolic testing of real-world JavaScript libraries and compositional debugging of separation logic specifications of JavaScript programs. We have developed a methodology for designing compositional program analyses for dynamic languages in general, and symbolic execution for JSIL in particular. We achieved this by introducing a new, abstract semantics for JSIL, which we instantiated to obtain the concrete, instrumented, and symbolic semantics. This abstract semantics is the bedrock for both the theoretical results and the implementation of the analysis.
We prove that the JSIL symbolic execution of Cosette is sound, frame-resilient and does not generate false positives. We establish additional trust by using the theory to precisely guide the implementation and by thorough testing. Cosette brings ideas from current separation logic research to the well-established setting of classical symbolic execution  [3]. We believe that it is a stepping stone towards a fully automatic compositional symbolic execution tool for JavaScript in the style of Infer  [12]. In future, our goal is to implement such a tool, drawing inspiration the JSIL abstract semantics presented here.
ACKNOWLEDGMENTS We would like to thank the anonymous reviewers, whose comments have improved the overall quality of the paper. Fragoso Santos, Gardner, and Maksimović were supported by the  EPSRC   Programme Grant 'REMS: Rigorous Engineering for Mainstream Systems'  ( EP/K008528/1 ), and the  Department of Computing at Imperial College London. Maksimović was partially supported by the  Serbian Ministry of Education and Science through the Mathematical Institute of the Serbian Academy of Sciences and Arts , projects  ON174026  and  III44006.
Glacier Speed and Ice Front Evolution We obtain time series of ice front velocity using data from the U. S. Landsat series, the Japanese ALOS PALSAR: Advanced Land Observing Satellite Phased Array type L-band Synthetic Aperture Radar, the European ERS-1/2, the Canadian RADARSAT-1/2, and the European Sentinel-1a/b, spanning from the 1980s to 2017. Ice speed is averaged across the ice front to calculate an average speed across the glacier width, which is lower than the speed at the glacier center. The mean speed of AVA is 1,080 m/yr. We find significant seasonal fluctuations in speed, especially in recent years. We digitize the summer ice front positions using aerial photos from 1964  (Carbonnell & Bauer, 1968)  and Landsat imagery spanning 1976 to 2017. AVA did not retreat at a significant level (150-200 m) during the entire time period (Figure  1 ).
Airborne Gravity On 16-27 August 2012, we conducted a helicopter-borne (Eurocopter AS-355 B2), high-resolution gravimetric survey using SGL's AIRGrav system. AIRGrav uses three orthogonal accelerometers and two 2-degrees-of-freedom gyroscopes mounted on an inertial platform  (Argyle et al. , 2000). The primary accelerometer is held within 10 ′′ (0. 0028 ∘ ) of level by a Schuler tuned inertial platform to the local vertical  (Sander et al. , 2005). A Novatel OEM4 and OEMV GPS receivers and data loggers provide average position of the helicopter and raw range information at 10 Hz. Data resolution and accuracy depend on survey speed and height above ground  (An et al. , 2017). The survey was flown at an average speed of 56 knots or 29 m/s with a ground clearance of 80 m at a 500 m spacing grid (Figure  1 )  (An et al.