Iterative Program Analysis Abstract Interpretation
description
Transcript of Iterative Program Analysis Abstract Interpretation
1
Iterative Program AnalysisAbstract Interpretation
Mooly Sagivhttp://www.cs.tau.ac.il/~msagiv/courses/pa11.html
Tel Aviv University
640-6706
Textbook: Principles of Program AnalysisChapter 4
CC79, CC92
Outline The abstract interpretation technique
– The main theorem
– Applications
– Precision
– Complexity
– Widening
Later on– Combining Analysis
– Interprocedural Analysis
– Shape Analysis
Soundness Theorem(1)
1. Let (, ) form Galois connection from C to A
2. f: C C be a monotone function
3. f# : A A be a monotone function
4. aA: f((a)) (f#(a))
lfp(f) (lfp(f#))
(lfp(f)) lfp(f#)
Soundness Theorem(2)
1. Let (, ) form Galois connection from C to A
2. f: C C be a monotone function
3. f# : A A be a monotone function
4. cC: (f(c)) f#((c))
(lfp(f)) lfp(f#)
lfp(f) (lfp(f#))
Soundness Theorem(3)
1. Let (, ) form Galois connection from C to A
2. f: C C be a monotone function
3. f# : A A be a monotone function
4. aA: (f((a))) f#(a)
(lfp(f)) lfp(f#)
lfp(f) (lfp(f#))
Completeness
(lfp(f)) = lfp(f#)
lfp(f) = (lfp(f#))
Constant Propagation : [Var Z] [Var Z{, }]
() = () : P([Var Z]) [Var Z{, }]
(X) = {() | X} = { | X} :[Var Z {, }] P([Var Z])
(#) = { | () # } = { | # }
Local Soundness st#(#) ({st | (#) = {st | # }
Optimality (Induced) st#(#) = ({st | (#)} = {st | # }
Soundness Completeness
Example Interval Analysis Find a lower and an upper bound of the value of a
variable Usages? Lattice
L = (Z{-, }Z {-, }, , , , ,)– [a, b] [c, d] if c a and d b– [a, b] [c, d] = [min(a, c), max(b, d)]
– [a, b] [c, d] = [max(a, c), min(b, d)] = =
Domains with Infinite Heights for Integers
y
x
Intervals CC’77: xi b
Octagons SKS’00, Mine’01: xi yi b
Polyhedra Cousot& Halbwachs’78: ai*xi b
Formal available expression Find out which expressions are available at a given
program point Example program
x = y + t //{(y+t)} z = y + r //{(y+t), (y+r)} while (…) { // {(y+t), (y+r)} t = t + (y + r) // {(y+t), (y+r), t + (y +r )} }
Available expression lattice
P(Fexp) X Y X Y X Y = X Y = Fexp =
Available expressions
Computing Fexp for whiles ::= skip { s.Fexp := }s := id = exp { s.Fexp = {exp.rep }s := s ; s { s.Fexp := s[1].Fexp s[2].Fexp }s := while exp do s { s.Fexp := {exp.rep} s[1].Fexp }s := if exp then s else s { s.Fexp := {exp.rep} s[1].Fexp s[2].Fexp }
Instrumented Semantics Available expressions
S Stm : State P(Fexp) State P(Fexp) S id := a (, ae) = ([a a a ], notArg(id, ae {a} ) S skip (, ae) = (, ae)
CS Stm : P(State P(Fexp)) P(State P(Fexp)) CS s (X) ={S s (, ae) | (, ae) X}
Collecting Semantics Example
x = y * z;
if (x == 6)
y = z+ t;
…
if (x == 6)
r = z + t;
Formal Available Expressions Abstraction
: [Var Z] P(Fexp) P(Fexp) (, ae) = (ae)
: P(P([Var Z] P(Fexp)) P(Fexp) (X) = {() | X} = {ae | (, ae) X}
: P(Fexp) P(P([Var Z] P(Fexp)) (ae#) = {(, ae) | (, ae) ae# } = {(, ae) | ae
ae# }
Formal Available Expressions AI
S Stm # : P(Fexp) P(Fexp) S id := a # (ae) = notArg(id, ae {a} ) S skip # (ae) = (ae) Local Soundness
st#(ae#) {(st (, ae)[1] | ae ae# }
Optimality st#(ae#) = ({st (, ae) | (, ae) (#)} = {(st (, ae)[1] | ae
ae# } The initial value at the entry is Example program
x = y + t //{(y+t)} z = y + r //{(y+t), (y+r)} while (…) { // {(y+t), (y+r)} t = t + (y + r) // { (y+r)} }
Soundness and Completeness
Example: May-Be-Garbage A variable x may-be-garbage at a program point v
if there exists a execution path leading to v in which x’s value is unpredictable:– Was not assigned
– Was assigned using an unpredictable expression
Lattice Galois connection Basic statements Soundness
The PWhile Programming Language Abstract Syntax
a := x | *x | &x | n | a1 opa a2
b := true | false | not b | b1 opb b2 | a1 opr a2
S := x := a | *x := a | skip | S1 ; S2 | if b then S1 else S2 | while b do S
Concrete Semantics for PWhile
For every atomic statement S
S : States1 States1
x := a ()=[loc(x) Aa ]
x := &y ()
x := *y ()
x := y ()
*x := y ()
State1= [LocLocZ]
Points-To Analysis Lattice Lpt =
Galois connection Meaning of statements
t := &a; y := &b;
z := &c;
if x> 0 then p:= &y;
else p:= &z;
*p := t;
/* */ t := &a; /* {(t, a)}*/ /* {(t, a)}*/ y := &b; /* {(t, a), (y, b) }*/
/* {(t, a), (y, b)}*/ z := &c; /* {(t, a), (y, b), (z, c) }*/
if x> 0; then p:= &y; /* {(t, a), (y, b), (z, c), (p, y)}*/
else p:= &z; /* {(t, a), (y, b), (z, c), (p, z)}*/ /* {(t, a), (y, b), (z, c), (p, y), (p, z)}*/
*p := t;
/* {(t, a), (y, b), (y, c), (p, y), (p, z), (y, a), (z, a)}*/
Abstract Semantics for PWhile
For every atomic statement S
x := a ()
x := &y ()
x := *y ()
x := y ()
*x := y ()
State#= P(Var* Var*)
/* */ t := &a; /* {(t, a)}*/ /* {(t, a)}*/ y := &b; /* {(t, a), (y, b) }*/
/* {(t, a), (y, b)}*/ z := &c; /* {(t, a), (y, b), (z, c) }*/
if x> 0; then p:= &y; /* {(t, a), (y, b), (z, c), (p, y)}*/
else p:= &z; /* {(t, a), (y, b), (z, c), (p, z)}*/ /* {(t, a), (y, b), (z, c), (p, y), (p, z)}*/
*p := t;
/* {(t, a), (y, b), (y, c), (p, y), (p, z), (y, a), (z, a)}*/
Flow insensitive points-to-analysisSteengard 1996
Ignore control flow One set of points-to per program Can be represented as a directed graph Conservative approximation
– Accumulate pointers
Can be computed in almost linear time– Union find
t := &a; y := &b;
z := &c;
if x> 0; then p:= &y;
else p:= &z;
*p := t;
Precision
We cannot usually have (CS) = DF
on all programs
But can we say something about precision in all programs?
The Join-Over-All-Paths (JOP)
Let paths(v) denote the potentially infinite set paths from start to v (written as sequences of edges)
For a sequence of edges [e1, e2, …, en] definef #[e1, e2, …, en]: L L by composing the effects of basic blocksf #[e1, e2, …, en](l) = f#(en) (… (f#(e2) (f
#(e1) (l)) …)
JOP[v] = {f#[e1, e2, …,en]() [e1, e2, …, en] paths(v)}
JOP vs. Least Solution The df solution obtained by Chaotic iteration satisfies for
every v: – JOP[v] df(v)
A function f# is additive (distributive) if – f#({x| x X}) = {f#(x) | X}
If every f# (u,v) is additive (distributive) for all the edges (u,v)
– JOP[v] = df(v)
Examples– Maybe garbage
– Available expressions
– Constant Propagation
– Points-to
Notions of precision
CS = (df) (CS) = df Meet(Join) over all paths Using best transformers Good enough
Complexity of Chaotic Iterations
Usually depends on the height of the lattice In some cases better bound exist A function f is fast if f (f(l)) l f(l) For fast functions the Chaotic iterations can be
implemented in O(nest * |V|) iterations– nest is the number of nested loop
– |V| is the number of control flow nodes
Conclusion
Chaotic iterations is a powerful technique Easy to implement Rather precise But expensive
– More efficient methods exist for structured programs
Abstract interpretation relates runtime semantics and static information
The concrete semantics serves as a tool in designing abstractions– More intuition will be given in the sequel