Compilation and Program Analysis (#8) : Abstract Interpretation
|
|
- Lora Stone
- 5 years ago
- Views:
Transcription
1 Compilation and Program Analysis (#8) : Abstract Interpretation Laure Gonnord Laure.Gonnord@ens-lyon.fr Master, ENS de Lyon Nov 7
2 Objective Compilation vs program analysis : Compilation : generate code (with the same semantics). Program Analysis : infer properties, prove absence of bugs. Programs are inputs. Inspiration for slides : M course Program Analysis, D. Monniaux, D. Hirschkoff, P. Roux,.... Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
3 Reference book Chapters. (dataflow) and (abstract interpretation). A nice paper (in french), about ocaml implementation for finite lattices : http: //perso.ens-lyon.fr/pierre.roux/media/jfla.pdf Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
4 Program analysis & Abstract Interpretation Typical questions we want to ask/bugs to avoid x:=a/b make sure that b. x:=t[i] make sure that i is within the bounds of t. i:=i+ make sure there is no overflow. or more complex properties. Fully automatic! Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
5 Come back on dataflow Come back on dataflow A bit of theory : IA on finite lattices Computing Invariants in infinite height lattices. Application - Tools Designing Analyses that scale Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
6 Come back on dataflow Liveness entry Block l exit LV exit (l) = {LVentry (l ) (l, l ) flow(g)} if l = final LV entry (l) = ( LV exit (l)\kill LV (l) ) gen LV (l) Backward set of recurrence equations. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
7 Come back on dataflow Available expressions entry Block l exit AE entry (l) = {AEexit (l ) (l, l) flow(g)} if l = init AE exit (l) = ( AE entry (l)\kill AE (l) ) gen AE (l) Forward set of recurrence equations. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
8 Come back on dataflow Common points Computing growing sets from via fixpoint iterations. (or the dual) Sets of equations of the form (collecting semantics) : S(l) = f(s(l )) (l,l) E where f is computed w.r.t. the program statements S is an abstract interpretation of the program. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
9 A bit of theory : IA on finite lattices Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Application - Tools Designing Analyses that scale Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
10 A bit of theory : IA on finite lattices Concrete semantics : refreshing memories Program control points are denoted by l L. Environnements assign values to variables. Operational semantics : Recursive equations involving sets of environments. The fixpoint yields a function of type L P(Var Val). (set of possible memory states of each variable at each line). Concrete semantics = least fixpoint. It exists (Knaster-Tarski s theorem). No hope to compute it. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
11 A bit of theory : IA on finite lattices Concrete semantics-revisited cos(y) x x := x+ k init k true y := y + x y y := y x Semantics of the programs as transition systems : A state is a pair (k, Val) : Val : Var N d Var is [,..., d ] (finite set, d vars) N is N, Z, Q Initial states : (k init, allv). + transition relation (concrete) denoted by. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
12 A bit of theory : IA on finite lattices Computing concrete semantics-reachability Notations : Σ concrete states, (σ a state). Σ Σ : set of initial states. reachable states : σ is reachable iff : σ Σ σ σ R(X) = {y Σ x X x y}. X n : set of states reachable in at most n steps : X = Σ, X = Σ R(Σ ), X = Σ R(Σ ) R(R(Σ )), etc. The sequence X k is ascending for. Its limit (= the union of all iterates) is the set of reachable states. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
13 A bit of theory : IA on finite lattices Computing invariants Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
14 A bit of theory : IA on finite lattices Computing invariants Computing concrete semantics-iterative computation Remark X n+ = φ(x n ) with φ(x) = Σ R(X). How to compute efficiently the X n? And the limit? Explicit representations of X n (list all states) : If Σ finite, X n converges in at most Σ iterations. else, we have to cope with two problems : Representing the X i s and computing R(X i ). Computing the limit? X = φ n (X ) is the strongest invariant of the program Looking for overapproximations : X X result also called invariant. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
15 A bit of theory : IA on finite lattices Computing invariants Invariants for programs init x := loop x 99 x++ x end {x N, x } is the most precise invariant in control point loop. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
16 A bit of theory : IA on finite lattices Computing invariants Inductive invariants (Inductive) invariant : set X of states s.t. φ(x) X : with φ(x) = X {y Σ x X x y} Properties : If X et Y two invariants, then so is X Y. φ monotonic for (if X Y, then φ(x) φ(y )). φ(x Y ) φ(x) X, same for Y, thus φ(x Y ) X Y. Same for intersections of infinitely many invariants. Thus the strongest invariant can be defined as the intersection of all invariants. This invariant satisfies φ(x) = X, it is the least fixed point of φ. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
17 A bit of theory : IA on finite lattices Computing invariants Back to our problem Given a program (or an interpreted automaton), find inductive invariants for each control point : Recall : a state is a pair (pc, Val) : Val : Var N d We want to compute lfp(φ) with φ(x) = X {y Σ x X x y} and entails the concrete semantics of the program. This is unfeasible in general Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
18 A bit of theory : IA on finite lattices Two problems to solve Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
19 A bit of theory : IA on finite lattices Two problems to solve Representing sets of valuations First problem to cope with : represent sets of valuations Val : Var N d Var is [,..., d ] (finite set, d vars) N is N, Z, Q Find a finite representation! abstract value/abstract domain. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
20 A bit of theory : IA on finite lattices Two problems to solve Representing sets of valuations / Represent values of variables : R pc P(N d ) by a finite computable superset R pc : y y y x x x And compute such abstract values for each control point. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
21 A bit of theory : IA on finite lattices Two problems to solve Computing R Second problem to cope with : computing the transition relation R(l, X) = {(l, x ) x X and (l, x) (l, x )} X is a (representation of a) set of valuations is the program transition function (the semantics) We have to adapt into an abstract semantics. R will be changed into R. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
22 A bit of theory : IA on finite lattices Two problems to solve Some examples of abstractions For numerical values, we can abstract P(Var Val) by : Signs Constant+Value / Non Constant Intervals (Boxes) More complex shapes (see later). The function used to abstract elements of P(Var Val) is denoted by α and called abstraction. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
23 A bit of theory : IA on finite lattices Two problems to solve From a lattice to an abstract domain A lattice : elements, (greatest), (least element), partial order. join (union), meet (intersection), emptiness test. Abstract Domain : Abstraction (α : val element) of the lattice, and concretization (γ) s.t. X γ(α(x) (Galois Connection). Abstract transfer functions : each f is adapted into f s.t. : f(x) γ(f (α(x))) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
24 A bit of theory : IA on finite lattices Two problems to solve Abstract Domain for signs Lattice for a single element : take the cross product (for all variables), and modify meet, join, order... accordingly. Abstract domain : α, γ? (on board) Give the abstract transfer function for + (on board) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
25 A bit of theory : IA on finite lattices Two problems to solve Abstract Interpretation, Algorithm (High-level) Algorithm : Write the abstract equations corresponding to the abstract semantics. Interpret the program from the beginning, but abstractly : Compute a lattice element per control point. Always make the union (join) with the former value. Stop when the iteration has stabilized (for all control points). credit examples, P. Roux for Onera Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47 A bit of theory : IA on finite lattices Two problems to solve Abstraction, concretisation for constants Abstraction : α is? Concretization : γ is? Lattice : Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
48 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + 7 8
49 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) 6 (, ) 7 8
50 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) 6 (, ) 7 8
51 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) 6 (, ) 7 8
52 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) 6 (, ) (, 7) (, ) 7 8
53 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) 6 (, ) 7 8
54 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) 6 (, ) 7 8
55 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) 7 8
56 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) (, ) 7 8
57 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) (, ) 7 8
58 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) (, ) 7 8
59 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) (, ) (, 7) (, +8) 7 8
60 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, ) (, 8) 6 (, ) (, ) 7 8
61 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, 8) (, ) (, 8) 6 (, ) (, ) 7 8
62 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, 8) (, ) (, 8) (, 8) 6 (, ) (, ) 7 8
63 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, 8) (, ) (, 8) (, 8) 6 (, ) (, ) (, ) 7 8
64 > / / > + = + = + [ ] + = + [ [ ] ] ()+ 7 + = + + = + [ ] + ()/ + = + [ ] + () + () + 6 = + (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, ) (, 8) (, 8) (, ) (, 8) (, 8) 6 (, ) (, ) (, ) 7 8
65 A bit of theory : IA on finite lattices Two problems to solve Result Termination If the underlying lattice is of finite height, then the fixpoint iteration terminates and the least abstract fixpoint is computed. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
66 A bit of theory : IA on finite lattices Two problems to solve Abstract Interpretation, implementation choices Control Flow Graph, and an abstract value per block. Propagate on the edges of the CFG. On the Abstract Syntax tree, a visitor, and the propagation is made by induction on the syntax. The only stopping test is inside the while visitor. For lab 7, you choose. You are totally free (apart from ANTLR + Python). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
67 Computing Invariants in infinite height lattices. Come back on dataflow A bit of theory : IA on finite lattices Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
68 Computing Invariants in infinite height lattices. In a nutshell The two problems also occur : representation of sets of valuations. abstract transitions (transfer functions). there is another one, how to terminate! Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
69 Computing Invariants in infinite height lattices. Intervals Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
70 Computing Invariants in infinite height lattices. Intervals A first example - Intervals Try to compute an interval for each variable at each program point using interval arithmetic : assume ( x >= && x<= ) ; assume ( y >= && y= ) ; assume ( z >= && z= ) ; t = ( x+y ) z ; Interval for z? [6, 6] Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
71 Computing Invariants in infinite height lattices. Intervals The interval lattice See the exercise sheet. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
72 Computing Invariants in infinite height lattices. Intervals An example that terminates i n t x =; while ( x <) { x=x +; } Loop iterations [, ], [, ], [, ], [, ],... How? φ(x) = Initial state R(X), thus φ([a, b]) = {} [a +, min(b, 999) + ] Stricly growing interval during iterations, then stabilizes : [, ] is an invariant. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
73 Computing Invariants in infinite height lattices. Intervals Termination Problem Third problem to cope with : stopping the computation : Too many computations unbounded loops Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
74 Computing Invariants in infinite height lattices. Intervals One solution... Extrapolation! [, ], [, ], [, ], [, ] [, + ) Push interval : i n t x =; / [, ] / while / [, + i n f t y ) / ( x <) { } / [, ] / x=x +; / [, ] / Yes! [, [ is stable! Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
75 Computing Invariants in infinite height lattices. Intervals Computing inductive invariants as intervals Representation : intervals. The union leads to an overapproximation. We don t know how to compute R(P ) with P interval (The statements may be too complex,...) Replace computation by simpler over-approximation R(X) R (X). The convergence is ensured by extrapolation/widening. We always compute φ (X) with : φ(x) φ (X) In the end, over-approximation of the least fixed point of φ. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
76 Computing Invariants in infinite height lattices. Intervals Computing inductive invariants as intervals - (abstract) Interval operations : +,, on intervals : interval arithmetic union : [a, b] [c, d] : loosing info! widening : (I I with I I ) I = I [a, b] [c, d] = [if c < a then else a, if d > b then + else b] The idea is to infer the dynamic of the intervals thanks to the first terms. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
77 Computing Invariants in infinite height lattices. Intervals Computing inductive invariants as intervals - The widening operator being designed, we compute (x F (x)) Σ, Y = Σ F (Σ ), Y = Y F (Y )... finite computation instead of : Σ, F (Σ ), F (Σ ),... which can be infinite. Theorem (Cousot/Cousot 77) Iteratively computing the reachable states from the entry point with the interval operators and applying widening at entry nodes of loops converges in a finite number of steps to a overapproximation of the least invariant (aka postfixpoint). The widening operators must satisfy the non ascending chain condition (see Cousot/Cousot 977). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
78 Computing Invariants in infinite height lattices. Intervals Invariants for programs - ex init x := loop x 99 x++ x end x [, + ] in loop. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
79 Computing Invariants in infinite height lattices. Intervals Computing inductive invariants as intervals - ex x = random (, 7 ) ; y = cos ( x )+ x while ( y <=) { i f ( x >) x ; else { y = ; x ; } } Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
80 Computing Invariants in infinite height lattices. Intervals Nested loops / Several loops (Bourdoncle, 99) Computing strongly connected subcomponents and iterate inside each : Gray nodes are widening nodes Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
81 Computing Invariants in infinite height lattices. Intervals Improving precision after convergence i n t x =; / [, ] / while / [, + i n f t y ) / ( x <) { } / [, ] / x=x +; / [, ] / we got [, + ) instead of [, 999]. Run one more iteration of the loop : {} [, ] = [, ]. Check if [, ] is an inductive invariant? YES This is called narrowing or descending sequence : ends when we have an inductive invariant or after k applications of the transition function. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
82 Computing Invariants in infinite height lattices. Toward more relational abstract domains Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
83 Computing Invariants in infinite height lattices. Toward more relational abstract domains When intervals are not sufficient assume ( x >= && x <= ) ; y = x ; z = x y ; The human (intelligent) sees z = thus interval [, ], taking into account y = x. Interval arithmetic does not see z = because it does not take y = x into account. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
84 Computing Invariants in infinite height lattices. Toward more relational abstract domains How to track relations Using relational domains. E.g. : keep for each variable an interval for each pair of variables (x, y) an information x y C. (One obtains x = y by x y and y x.) How to compute on that? Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
85 Computing Invariants in infinite height lattices. Toward more relational abstract domains Bounds on differences : practical example Suppose x y, computation is z = x +, then we know z y 7. Suppose x z, that x y and that y z 6, then we know x z. We know how to compute on these relations (transitive closure / shortest path). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
86 Computing Invariants in infinite height lattices. Toward more relational abstract domains Why this is useful Let t(..n) an array in the program. The program writes t(i). Need to know whether i n, otherwise said find bounds on i and on n i... Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
87 Computing Invariants in infinite height lattices. Toward more relational abstract domains Can we do better? How about tracking relations such as x + y 6? At a given program point, a set of linear inequalities. In other words, a convex polyhedron (Linear Relation Anlysis). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
88 Computing Invariants in infinite height lattices. Toward more relational abstract domains Classical Linear Relation Analysis (Halbwachs/Cousot 979) Abstract Interpretation in the Polyhedral domain Infinite Domain with many particularities Discover affine relations on variables Classically used in verification problems. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
89 Computing Invariants in infinite height lattices. Toward more relational abstract domains The polyhedral domain () Convex polyhedra representation : Effective and efficient algorithmic (emptyness test, union, affine transformation... ) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
90 Computing Invariants in infinite height lattices. Toward more relational abstract domains The polyhedral domain() Intersection, emptyness Affine Transformation : a(p ) = {CX + D X P }. Convex hull (loss of precision) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
91 Computing Invariants in infinite height lattices. Toward more relational abstract domains The Polyhedral domain () Widening : P Q : limit extrapolation. P Q constraints : take Q constraints and remove those which are not saturated by P. Trick (!) : {x = y = } = { y x } Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
92 Computing Invariants in infinite height lattices. Toward more relational abstract domains Analysis example - x:=;y:= while (x<=) do read(b); if b then x:=x+ else begin x:=x+; y:=y+; end; endif endwhile x x := x + y := y + p in p p out (x,y) := (,) x x x := x + Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
93 Computing Invariants in infinite height lattices. Toward more relational abstract domains Example - p in (x,y) := (,) x x := x + y := y + p x x x := x + p out Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 / 89
94 Computing Invariants in infinite height lattices. Toward more relational abstract domains Linear Relation Analysis - Problems Complexity increases with : number of control points number of numerical variables Approximation is due to : Convex hulls Widening (credits for these slides : Nicolas Halbwachs) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
95 Computing Invariants in infinite height lattices. Toward more relational abstract domains Complexity (In general) The more precise we are, the higher the costs. Intervals : algorithms O(n), n number of variables. Differences x y C : algorithms O(n ) Octagons ±x ± y C (Miné) : algorithms O(n ) Polyhedra (Cousot / Halbwachs) : algorithms often O( n ). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
96 Computing Invariants in infinite height lattices. Toward more relational abstract domains Delaying widening - Halbwachs 99 / Goubault / Blanchet et al. Fix k and compute : if n = X n = F (X n ) if n < k X n F (X n ) else. Similar to unrolling loops, costly but useful (regular behaviour after a constant number of iterations). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
97 Computing Invariants in infinite height lattices. Toward more relational abstract domains Delaying widening - - ex q p x := ;y := x x := x + x = x := x + y := y + Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 9 / 89
98 Computing Invariants in infinite height lattices. Toward more relational abstract domains Improving the widening operator While applying P Q, intersect with constraints that are satisfied by both P and Q. The constraints must be precomputed. init x := loop x 99 x++ x end Here, with x in the pool of constraints, it avoids narrowing. Warning widening is not monotone, so improving locally is not necessarily a good idea! Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
99 Computing Invariants in infinite height lattices. Toward more relational abstract domains Local improvement with acceleration (Gonnord/Halbwachs 6, Schrammel ) Idea : Sometimes, a fixpoint of a loop can be easily computed without any fixpoint iteration. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
100 Computing Invariants in infinite height lattices. Toward more relational abstract domains Good path heuristic (Gonnord/Monniaux ) Idea : find interesting paths by means of smt-queries Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
101 Application - Tools Come back on dataflow A bit of theory : IA on finite lattices Computing Invariants in infinite height lattices. Application - Tools Designing Analyses that scale Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
102 Application - Tools Applications Bounds on iterators of arrays (intervals, differences on bounds) Dead code elimination (all domains) - especially when the code has been automatically generated / asserts Vectorization : computations that can be permuted Memory optimisation : this int can be encoded in 6 bits? Preconditions for code specialization (on going work with F. Rastello) Safety analysis. Termination. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
103 Application - Tools Tools Frama-C : analysing/ proving correction of C programs (see Apron : numerical domain interface ( Interproc : IA analyser connected to Apron (see http: //pop-art.inrialpes.fr/interproc/interprocweb.cgi Rose / LLVM : C (and more) parsers and API for manipulating C programs. Rose is more decidated to program transformation, LLVM to compiler construction( and Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 6 / 89
104 Application - Tools Industrial succes stories Polyspace Astree Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 66 / 89
105 Application - Tools Demo Time : PAGAI. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 67 / 89
106 Designing Analyses that scale Come back on dataflow A bit of theory : IA on finite lattices Computing Invariants in infinite height lattices. Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 68 / 89
107 Designing Analyses that scale Challenges in Abstract Interpretation Precision of the abstract domain. Thousands, millions of lines of code to analyze. Static analyzers and compilers are complex programs (that also have bugs) Growing need for simple specialized analyses that scale Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 69 / 89
108 Designing Analyses that scale Designing a scalable static analysis : an example OOPSLA : A technique to prove that (some) memory accesses are safe : Less need for additional guards. Based on abstract interpretation. Precision and cost compromise. Implemented in LLVM-compiler infrastructure : Eliminate % of the guards inserted by AddressSanitizer SPEC CPU 6 7% faster Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
109 Designing Analyses that scale Overview Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
110 Designing Analyses that scale Overview A bit on sanitizing memory accesses Different techniques : but all have an overhead. Ex : Address Sanitizer Shadow every memory allocated : byte bit (allocated or not). Guard every array access : check if its shadow bit is valid. slows down SPEC CPU 6 by % We want to remove these guards. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
111 Designing Analyses that scale Overview Green Arrays : overview / Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
112 Designing Analyses that scale Overview Green Arrays : overview / Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
113 Designing Analyses that scale Overview Symbolic ranges : How to ensure scalability? The idea is to work on the intermediate representation to ensure the following key property : SSI Property All abstract values are stable on their live ranges. How? Splitting variables (v, i in the last example). (technical stuff later if there remains time) Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 7 / 89
114 Designing Analyses that scale Scalable symbolic abstract domain Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 76 / 89
115 Designing Analyses that scale Scalable symbolic abstract domain Symbolic Ranges (SRA) : Running example i n t main ( i n t argc ) { i n t v = malloc ( sizeof ( i n t ) argc ) ; i n t i = argc ; v [ i ] = ; i f (? ) { v = r e a l l o c ( sizeof ( i n t ) ) ; i = ; } v [ i ] = ; } Are all accesses to v safe? Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 77 / 89
116 Designing Analyses that scale Scalable symbolic abstract domain Symbolic Ranges (SRA) : On the SSA form Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 78 / 89
117 Designing Analyses that scale Scalable symbolic abstract domain SRA on SSA form : a sparse analysis An abtract interpretation-based technique. Very similar to classic range analysis. One abstract value (R) per variable : sparsity. Easy to implement (simple algorithm, simple data structure). Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 79 / 89
118 Designing Analyses that scale Scalable symbolic abstract domain SRA on SSA form : constraint system v = R(v) = [v, v] v = o R(v) = R(o) v = v v R(v) = R(v ) I R(v ) v = φ(v, v ) R(v) = R(v ) R(v ) other instructions I : abstract effect of the operation on two intervals. : convex hull of two intervals. All these operation are performed symbolically thanks to GiNaC Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
119 Designing Analyses that scale Scalable symbolic abstract domain SRA on SSA form : an example N = randunsigned () i_ = i_ = phi ( i_, i_ ) i_ < N? i_ = i_ + R(i ) = [, ] R(i ) = [, + ] R(i ) = [, + ] Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
120 Designing Analyses that scale Scalable symbolic abstract domain Improving precision of SRA : live-range splitting / e-ssa form. Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
121 Designing Analyses that scale Scalable symbolic abstract domain Improving precision of SRA : live-range splitting / Rule for live-range splitting : a f = σ(a) b f = σ(b) t = a < b br (t, l) l a t = σ(a) b t = σ(b) All simplications are done by GiNaC. R(a t ) = [R(a), min(r(b), R(a) )] R(b t ) = [max(r(a) +, R(a) ), R(b) ] R(a f ) = [max(r(a), R(a) ), R(a) ] R(b t ) = [R(b), min(r(a), R(b) )] Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
122 Designing Analyses that scale Scalable symbolic abstract domain SRA + live-range on an example N = randunsigned () i_ = i_ = phi ( i_, i_ ) i_ < N? i_t = sigma ( i_ ) i_ = i_t + R(i t ) = [R(i ), min(n, R(i ) )] R(i ) = [, ] R(i ) = [, N] Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
123 Designing Analyses that scale Experimental results Come back on dataflow A bit of theory : IA on finite lattices Computing invariants Two problems to solve Computing Invariants in infinite height lattices. Intervals Toward more relational abstract domains Application - Tools Designing Analyses that scale Overview Scalable symbolic abstract domain Experimental results Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 8 / 89
124 Designing Analyses that scale Experimental results Experimental setup Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 86 / 89
125 Designing Analyses that scale Experimental results Percentage of bound checks removed Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 87 / 89
126 Designing Analyses that scale Experimental results Runtime improvement Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 88 / 89
127 Designing Analyses that scale Experimental results In the paper (OOPSLA ) A complete formalisation of all the analyses : Concrete and abstract semantics. Safety is proved. Interprocedural analysis. Remaining question : improving precision of the symbolic range analysis? Laure Gonnord (M/DI-ENSL) Compilation and Program Analysis (#8): Abstract Interpretation 7 89 / 89
Program verification
Program verification Data-flow analyses, numerical domains Laure Gonnord and David Monniaux University of Lyon / LIP September 29, 2015 1 / 75 Context Program Verification / Code generation: Variables
More informationStatic Program Analysis using Abstract Interpretation
Static Program Analysis using Abstract Interpretation Introduction Static Program Analysis Static program analysis consists of automatically discovering properties of a program that hold for all possible
More informationDisjunctive relational abstract interpretation for interprocedural program analysis
Disjunctive relational abstract interpretation for interprocedural program analysis Nicolas Halbwachs, joint work with Rémy Boutonnet Verimag/CNRS, and Grenoble-Alpes University Grenoble, France R. Boutonnet,
More informationDiscrete Fixpoint Approximation Methods in Program Static Analysis
Discrete Fixpoint Approximation Methods in Program Static Analysis P. Cousot Département de Mathématiques et Informatique École Normale Supérieure Paris
More informationAutomatic Generation of Polynomial Invariants for System Verification
Automatic Generation of Polynomial Invariants for System Verification Enric Rodríguez-Carbonell Technical University of Catalonia Talk at EPFL Nov. 2006 p.1/60 Plan of the Talk Introduction Need for program
More informationPrinciples of Program Analysis: A Sampler of Approaches
Principles of Program Analysis: A Sampler of Approaches Transparencies based on Chapter 1 of the book: Flemming Nielson, Hanne Riis Nielson and Chris Hankin: Principles of Program Analysis Springer Verlag
More informationVerification of Real-Time Systems Numerical Abstractions
Verification of Real-Time Systems Numerical Abstractions Jan Reineke Advanced Lecture, Summer 2015 Recap: From Local to Global Correctness: Kleene Iteration Abstract Domain F # F #... F # γ a γ a γ a Concrete
More informationCMSC 631 Program Analysis and Understanding Fall Abstract Interpretation
Program Analysis and Understanding Fall 2017 Abstract Interpretation Based on lectures by David Schmidt, Alex Aiken, Tom Ball, and Cousot & Cousot What is an Abstraction? A property from some domain Blue
More informationSoftware Verification
Software Verification Grégoire Sutre LaBRI, University of Bordeaux, CNRS, France Summer School on Verification Technology, Systems & Applications September 2008 Grégoire Sutre Software Verification VTSA
More informationAbstract Interpretation II
Abstract Interpretation II Semantics and Application to Program Verification Antoine Miné École normale supérieure, Paris year 2015 2016 Course 11 13 May 2016 Course 11 Abstract Interpretation II Antoine
More informationAutomatic determination of numerical properties of software and systems
Automatic determination of numerical properties of software and systems Eric Goubault and Sylvie Putot Modelling and Analysis of Interacting Systems, CEA LIST MASCOT-NUM 2012 Meeting, March 21-23, 2012
More informationModel Checking & Program Analysis
Model Checking & Program Analysis Markus Müller-Olm Dortmund University Overview Introduction Model Checking Flow Analysis Some Links between MC and FA Conclusion Apology for not giving proper credit to
More informationGeneralizing Data-flow Analysis
Generalizing Data-flow Analysis Announcements PA1 grades have been posted Today Other types of data-flow analysis Reaching definitions, available expressions, reaching constants Abstracting data-flow analysis
More informationFormal Methods in Software Engineering
Formal Methods in Software Engineering An Introduction to Model-Based Analyis and Testing Vesal Vojdani Department of Computer Science University of Tartu Fall 2014 Vesal Vojdani (University of Tartu)
More informationMechanics of Static Analysis
Escuela 03 III / 1 Mechanics of Static Analysis David Schmidt Kansas State University www.cis.ksu.edu/~schmidt Escuela 03 III / 2 Outline 1. Small-step semantics: trace generation 2. State generation and
More informationBASIC CONCEPTS OF ABSTRACT INTERPRETATION
BASIC CONCEPTS OF ABSTRACT INTERPRETATION Patrick Cousot École Normale Supérieure 45 rue d Ulm 75230 Paris cedex 05, France Patrick.Cousot@ens.fr Radhia Cousot CNRS & École Polytechnique 91128 Palaiseau
More informationGeometric Quantifier Elimination Heuristics for Automatically Generating Octagonal and Max-plus Invariants
Geometric Quantifier Elimination Heuristics for Automatically Generating Octagonal and Max-plus Invariants Deepak Kapur 1 Zhihai Zhang 2 Matthias Horbach 1 Hengjun Zhao 3 Qi Lu 1 and ThanhVu Nguyen 1 1
More informationDataflow Analysis. A sample program int fib10(void) { int n = 10; int older = 0; int old = 1; Simple Constant Propagation
-74 Lecture 2 Dataflow Analysis Basic Blocks Related Optimizations SSA Copyright Seth Copen Goldstein 200-8 Dataflow Analysis Last time we looked at code transformations Constant propagation Copy propagation
More informationStatic Program Analysis
Static Program Analysis Xiangyu Zhang The slides are compiled from Alex Aiken s Michael D. Ernst s Sorin Lerner s A Scary Outline Type-based analysis Data-flow analysis Abstract interpretation Theorem
More informationNotes on Abstract Interpretation
Notes on Abstract Interpretation Alexandru Sălcianu salcianu@mit.edu November 2001 1 Introduction This paper summarizes our view of the abstract interpretation field. It is based on the original abstract
More informationThe Trace Partitioning Abstract Domain
The Trace Partitioning Abstract Domain XAVIER RIVAL and LAURENT MAUBORGNE École Normale Supérieure In order to achieve better precision of abstract interpretation based static analysis, we introduce a
More informationAn Abstract Domain to Infer Ordinal-Valued Ranking Functions
An Abstract Domain to Infer Ordinal-Valued Ranking Functions Caterina Urban and Antoine Miné ÉNS & CNRS & INRIA, Paris, France urban@di.ens.fr, mine@di.ens.fr Abstract. The traditional method for proving
More informationPrecise Program Analysis through (Linear) Algebra
Precise Program Analysis through (Linear) Algebra Markus Müller-Olm FernUniversität Hagen (on leave from Universität Dortmund) Joint work with Helmut Seidl (TU München) CP+CV 4, Barcelona, March 8, 4 Overview
More informationA New Numerical Abstract Domain Based on Difference-Bound Matrices
A New Numerical Abstract Domain Based on Difference-Bound Matrices Antoine Miné École Normale Supérieure de Paris, France, mine@di.ens.fr, http://www.di.ens.fr/~mine Abstract. This paper presents a new
More informationIntra-procedural Data Flow Analysis Backwards analyses
Live variables Dead code elimination Very Busy Expressions Code hoisting Bitvector frameworks Monotone frameworks Intra-procedural Data Flow Analysis Backwards analyses Hanne Riis Nielson and Flemming
More informationGeneration of. Polynomial Equality Invariants. by Abstract Interpretation
Generation of Polynomial Equality Invariants by Abstract Interpretation Enric Rodríguez-Carbonell Universitat Politècnica de Catalunya (UPC) Barcelona Joint work with Deepak Kapur (UNM) 1 Introduction
More informationAbstract Acceleration in Linear Relation Analysis
Abstract Acceleration in Linear Relation Analysis Laure Gonnord, Peter Schrammel To cite this version: Laure Gonnord, Peter Schrammel. Abstract Acceleration in Linear Relation Analysis. Science of Computer
More informationA Certified Denotational Abstract Interpreter (Proof Pearl)
A Certified Denotational Abstract Interpreter (Proof Pearl) David Pichardie INRIA Rennes David Cachera IRISA / ENS Cachan (Bretagne) Static Analysis Static Analysis Static analysis by abstract interpretation
More informationDataflow Analysis. Chapter 9, Section 9.2, 9.3, 9.4
Dataflow Analysis Chapter 9, Section 9.2, 9.3, 9.4 2 Dataflow Analysis Dataflow analysis is a sub area of static program analysis Used in the compiler back end for optimizations of three address code and
More informationWhat is SSA? each assignment to a variable is given a unique name all of the uses reached by that assignment are renamed
Another Form of Data-Flow Analysis Propagation of values for a variable reference, where is the value produced? for a variable definition, where is the value consumed? Possible answers reaching definitions,
More informationSoftware Verification using Predicate Abstraction and Iterative Refinement: Part 1
using Predicate Abstraction and Iterative Refinement: Part 1 15-414 Bug Catching: Automated Program Verification and Testing Sagar Chaki November 28, 2011 Outline Overview of Model Checking Creating Models
More informationAn Abstract Interpretation Approach. for Automatic Generation of. Polynomial Invariants
An Abstract Interpretation Approach for Automatic Generation of Polynomial Invariants Enric Rodríguez-Carbonell Universitat Politècnica de Catalunya Barcelona Deepak Kapur University of New Mexico Albuquerque
More informationCMSC 631 Program Analysis and Understanding. Spring Data Flow Analysis
CMSC 631 Program Analysis and Understanding Spring 2013 Data Flow Analysis Data Flow Analysis A framework for proving facts about programs Reasons about lots of little facts Little or no interaction between
More information«ATutorialon Abstract Interpretation»
«ATutorialon Abstract Interpretation» Patrick Cousot École normale supérieure 45 rue d Ulm 75230 Paris cedex 05, France Patrick.Cousot@ens.fr www.di.ens.fr/~cousot VMCAI 05 Industrial Day VMCAI 05 Industrial
More informationAxiomatic Semantics: Verification Conditions. Review of Soundness and Completeness of Axiomatic Semantics. Announcements
Axiomatic Semantics: Verification Conditions Meeting 12, CSCI 5535, Spring 2009 Announcements Homework 4 is due tonight Wed forum: papers on automated testing using symbolic execution 2 Questions? Review
More informationCours M.2-6 «Interprétation abstraite: applications à la vérification et à l analyse statique» Examen partiel. Patrick Cousot.
Master Parisien de Recherche en Informatique École normale supérieure Année scolaire 2010/2011 Cours M.2-6 «Interprétation abstraite: applications à la vérification et à l analyse statique» Examen partiel
More informationA Semantic Basis for Specialising Domain Constraints
A Semantic Basis for Specialising Domain Constraints Jacob M. Howe 1 and Andy King 2 Computing Laboratory, University of Kent, Canterbury, CT2 7NF, UK Abstract This paper formalises an analysis of finite
More informationThe Octagon Abstract Domain
1 The Octagon Abstract Domain Antoine Miné École Normale Supérieure de Paris, France, mine@di.ens.fr, http://www.di.ens.fr/~mine arxiv:cs/0703084v2 cs.pl] 16 Mar 2007 Abstract This article presents a new
More informationAn Algorithm Inspired by Constraint Solvers to Infer Inductive Invariants in Numeric Programs
An Algorithm Inspired by Constraint Solvers to Infer Inductive Invariants in Numeric Programs Antoine Miné 1, Jason Breck 2, and Thomas Reps 2,3 1 LIP6, Paris, France 2 University of Wisconsin; Madison,
More informationA Tutorial on Program Analysis
A Tutorial on Program Analysis Markus Müller-Olm Dortmund University Thanks! Helmut Seidl (TU München) and Bernhard Steffen (Universität Dortmund) for discussions, inspiration, joint work,... 1 Dream of
More informationNotes. Corneliu Popeea. May 3, 2013
Notes Corneliu Popeea May 3, 2013 1 Propositional logic Syntax We rely on a set of atomic propositions, AP, containing atoms like p, q. A propositional logic formula φ Formula is then defined by the following
More informationAlgorithmic verification
Algorithmic verification Ahmed Rezine IDA, Linköpings Universitet Hösttermin 2018 Outline Overview Model checking Symbolic execution Outline Overview Model checking Symbolic execution Program verification
More informationSpring 2016 Program Analysis and Verification. Lecture 3: Axiomatic Semantics I. Roman Manevich Ben-Gurion University
Spring 2016 Program Analysis and Verification Lecture 3: Axiomatic Semantics I Roman Manevich Ben-Gurion University Warm-up exercises 1. Define program state: 2. Define structural semantics configurations:
More informationDeductive Verification
Deductive Verification Mooly Sagiv Slides from Zvonimir Rakamaric First-Order Logic A formal notation for mathematics, with expressions involving Propositional symbols Predicates Functions and constant
More informationProbabilistic Model Checking and [Program] Analysis (CO469)
Probabilistic Model Checking and [Program] Analysis (CO469) Program Analysis Herbert Wiklicky herbert@doc.ic.ac.uk Spring 208 / 64 Overview Topics we will cover in this part will include:. Language WHILE
More informationAn Abstract Domain to Discover Interval Linear Equalities
An Abstract Domain to Discover Interval Linear Equalities Liqian Chen 1,2, Antoine Miné 1,3, Ji Wang 2, and Patrick Cousot 1,4 1 École Normale Supérieure, Paris, France {chen,mine,cousot}@di.ens.fr 2 National
More informationIntroduction to Abstract Interpretation. ECE 584 Sayan Mitra Lecture 18
Introduction to Abstract Interpretation ECE 584 Sayan Mitra Lecture 18 References Patrick Cousot,RadhiaCousot:Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction
More informationDataflow Analysis - 2. Monotone Dataflow Frameworks
Dataflow Analysis - 2 Monotone dataflow frameworks Definition Convergence Safety Relation of MOP to MFP Constant propagation Categorization of dataflow problems DataflowAnalysis 2, Sp06 BGRyder 1 Monotone
More informationHoare Logic I. Introduction to Deductive Program Verification. Simple Imperative Programming Language. Hoare Logic. Meaning of Hoare Triples
Hoare Logic I Introduction to Deductive Program Verification Işıl Dillig Program Spec Deductive verifier FOL formula Theorem prover valid contingent Example specs: safety (no crashes), absence of arithmetic
More informationData flow analysis. DataFlow analysis
Data flow analysis DataFlow analysis compile time reasoning about the runtime flow of values in the program represent facts about runtime behavior represent effect of executing each basic block propagate
More informationData Flow Analysis. Lecture 6 ECS 240. ECS 240 Data Flow Analysis 1
Data Flow Analysis Lecture 6 ECS 240 ECS 240 Data Flow Analysis 1 The Plan Introduce a few example analyses Generalize to see the underlying theory Discuss some more advanced issues ECS 240 Data Flow Analysis
More informationAAA616: Program Analysis. Lecture 7 The Octagon Abstract Domain
AAA616: Program Analysis Lecture 7 The Octagon Abstract Domain Hakjoo Oh 2016 Fall Hakjoo Oh AAA616 2016 Fall, Lecture 7 November 3, 2016 1 / 30 Reference Antoine Miné. The Octagon Abstract Domain. Higher-Order
More informationIterative Dataflow Analysis
Iterative Dataflow Analysis CS 352 9/24/07 Slides adapted from Nielson, Nielson, Hankin Principles of Program Analysis Key Ideas Need a mechanism to evaluate (statically) statements in a program Problem:
More informationStatic Analysis: Applications and Logics
Escuela 03 IV / 1 Static Analysis: Applications and Logics David Schmidt Kansas State University www.cis.ksu.edu/~schmidt Escuela 03 IV / 2 Outline 1. Applications: abstract testing and safety checking
More informationAnalysis of a Boost Converter Circuit Using Linear Hybrid Automata
Analysis of a Boost Converter Circuit Using Linear Hybrid Automata Ulrich Kühne LSV ENS de Cachan, 94235 Cachan Cedex, France, kuehne@lsv.ens-cachan.fr 1 Introduction Boost converter circuits are an important
More informationLogical Abstract Domains and Interpretations
Logical Abstract Domains and Interpretations Patrick Cousot 2,3, Radhia Cousot 3,1, and Laurent Mauborgne 3,4 1 Centre National de la Recherche Scientifique, Paris 2 Courant Institute of Mathematical Sciences,
More informationDataflow analysis. Theory and Applications. cs6463 1
Dataflow analysis Theory and Applications cs6463 1 Control-flow graph Graphical representation of runtime control-flow paths Nodes of graph: basic blocks (straight-line computations) Edges of graph: flows
More informationSpace-aware data flow analysis
Space-aware data flow analysis C. Bernardeschi, G. Lettieri, L. Martini, P. Masci Dip. di Ingegneria dell Informazione, Università di Pisa, Via Diotisalvi 2, 56126 Pisa, Italy {cinzia,g.lettieri,luca.martini,paolo.masci}@iet.unipi.it
More informationThe algorithmic analysis of hybrid system
The algorithmic analysis of hybrid system Authors: R.Alur, C. Courcoubetis etc. Course teacher: Prof. Ugo Buy Xin Li, Huiyong Xiao Nov. 13, 2002 Summary What s a hybrid system? Definition of Hybrid Automaton
More informationData-Flow Analysis. Compiler Design CSE 504. Preliminaries
Data-Flow Analysis Compiler Design CSE 504 1 Preliminaries 2 Live Variables 3 Data Flow Equations 4 Other Analyses Last modifled: Thu May 02 2013 at 09:01:11 EDT Version: 1.3 15:28:44 2015/01/25 Compiled
More informationModel Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies
Model Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies Tom Henzinger EPFL Three Verification Communities Model checking: -automatic, but inefficient
More informationIC3 and Beyond: Incremental, Inductive Verification
IC3 and Beyond: Incremental, Inductive Verification Aaron R. Bradley ECEE, CU Boulder & Summit Middle School IC3 and Beyond: Incremental, Inductive Verification 1/62 Induction Foundation of verification
More informationCOSE312: Compilers. Lecture 17 Intermediate Representation (2)
COSE312: Compilers Lecture 17 Intermediate Representation (2) Hakjoo Oh 2017 Spring Hakjoo Oh COSE312 2017 Spring, Lecture 17 May 31, 2017 1 / 19 Common Intermediate Representations Three-address code
More informationIncremental Proof-Based Verification of Compiler Optimizations
Incremental Proof-Based Verification of Compiler Optimizations Grigory Fedyukovich joint work with Arie Gurfinkel and Natasha Sharygina 5 of May, 2015, Attersee, Austria counter-example change impact Big
More information(Optimal) Program Analysis of Sequential and Parallel Programs
(Optimal) Program Analysis of Sequential and Parallel Programs Markus Müller-Olm Westfälische Wilhelms-Universität Münster, Germany 3rd Summer School on Verification Technology, Systems, and Applications
More informationPolynomial Precise Interval Analysis Revisited
Polynomial Precise Interval Analysis Revisited Thomas Gawlitza 1, Jérôme Leroux 2, Jan Reineke 3, Helmut Seidl 1, Grégoire Sutre 2, and Reinhard Wilhelm 3 1 TU München, Institut für Informatik, I2 80333
More informationMIT Martin Rinard Laboratory for Computer Science Massachusetts Institute of Technology
MIT 6.035 Foundations of Dataflow Analysis Martin Rinard Laboratory for Computer Science Massachusetts Institute of Technology Dataflow Analysis Compile-Time Reasoning About Run-Time Values of Variables
More informationOrganization of a Modern Compiler. Middle1
Organization of a Modern Compiler Source Program Front-end syntax analysis + type-checking + symbol table High-level Intermediate Representation (loops,array references are preserved) Middle1 loop-level
More informationInterprocedurally Analyzing Polynomial Identities
Interprocedurally Analyzing Polynomial Identities Markus Müller-Olm 1, Michael Petter 2, and Helmut Seidl 2 1 Westfälische Wilhelms-Universität Münster, Institut für Informatik Einsteinstr. 62, 48149 Münster,
More informationThe Assignment Axiom (Hoare)
The Assignment Axiom (Hoare) Syntax: V := E Semantics: value of V in final state is value of E in initial state Example: X:=X+ (adds one to the value of the variable X) The Assignment Axiom {Q[E/V ]} V
More informationCSC D70: Compiler Optimization Dataflow-2 and Loops
CSC D70: Compiler Optimization Dataflow-2 and Loops Prof. Gennady Pekhimenko University of Toronto Winter 2018 The content of this lecture is adapted from the lectures of Todd Mowry and Phillip Gibbons
More informationPrecise Relational Invariants Through Strategy Iteration
Precise Relational Invariants Through Strategy Iteration Thomas Gawlitza and Helmut Seidl TU München, Institut für Informatik, I2 85748 München, Germany {gawlitza, seidl}@in.tum.de Abstract. We present
More informationTopic-I-C Dataflow Analysis
Topic-I-C Dataflow Analysis 2012/3/2 \course\cpeg421-08s\topic4-a.ppt 1 Global Dataflow Analysis Motivation We need to know variable def and use information between basic blocks for: constant folding dead-code
More informationLecture 11: Data Flow Analysis III
CS 515 Programming Language and Compilers I Lecture 11: Data Flow Analysis III (The lectures are based on the slides copyrighted by Keith Cooper and Linda Torczon from Rice University.) Zheng (Eddy) Zhang
More informationDense-Timed Pushdown Automata
Dense-Timed Pushdown Automata Parosh Aziz Abdulla Uppsala University Sweden Mohamed Faouzi Atig Uppsala University Sweden Jari Stenman Uppsala University Sweden Abstract We propose a model that captures
More informationDataflow Analysis Lecture 2. Simple Constant Propagation. A sample program int fib10(void) {
-4 Lecture Dataflow Analysis Basic Blocks Related Optimizations Copyright Seth Copen Goldstein 00 Dataflow Analysis Last time we looked at code transformations Constant propagation Copy propagation Common
More informationSize-Change Termination and Transition Invariants
Size-Change Termination and Transition Invariants Matthias Heizmann 1, Neil D. Jones 2, and Andreas Podelski 1 1 University of Freiburg, Germany 2 University of Copenhagen, Denmark Abstract. Two directions
More informationThe Octagon Abstract Domain
The Octagon Abstract Domain Antoine Miné (mine@di.ens.fr) Département d Informatique, École Normale Supérieure Abstract. This article presents the octagon abstract domain, a relational numerical abstract
More informationConstraint Solving for Program Verification: Theory and Practice by Example
Constraint Solving for Program Verification: Theory and Practice by Example Andrey Rybalchenko Technische Universität München Abstract. Program verification relies on the construction of auxiliary assertions
More informationStatic Analysis of Numerical Programs and Systems. Sylvie Putot
Static Analysis of Numerical Programs and Systems Sylvie Putot joint work with O. Bouissou, K. Ghorbal, E. Goubault, T. Le Gall, K. Tekkal, F. Védrine Laboratoire LMEASI, CEA LIST Digicosme Spring School,
More informationPredicate Abstraction: A Tutorial
Predicate Abstraction: A Tutorial Predicate Abstraction Daniel Kroening May 28 2012 Outline Introduction Existential Abstraction Predicate Abstraction for Software Counterexample-Guided Abstraction Refinement
More informationCompositional Recurrence Analysis Revisited
Compositional Recurrence Analysis Revisited Zachary Kincaid Princeton Univ., USA zkincaid@cs.princeton.edu Jason Breck Ashkan Forouhi Boroujeni Univ. of Wisconsin, USA {jbreck,ashkanfb@cs.wisc.edu Thomas
More informationTemporal logics and explicit-state model checking. Pierre Wolper Université de Liège
Temporal logics and explicit-state model checking Pierre Wolper Université de Liège 1 Topics to be covered Introducing explicit-state model checking Finite automata on infinite words Temporal Logics and
More informationExtending abstract acceleration methods to data-flow programs with numerical inputs
Extending abstract acceleration methods to data-flow programs with numerical inputs Article (Published Version) Schrammel, Peter and Jeannet, Bertrand (200) Extending abstract acceleration methods to data-flow
More informationCSC D70: Compiler Optimization Static Single Assignment (SSA)
CSC D70: Compiler Optimization Static Single Assignment (SSA) Prof. Gennady Pekhimenko University of Toronto Winter 08 The content of this lecture is adapted from the lectures of Todd Mowry and Phillip
More informationStatic Program Analysis
Static Program Analysis Thomas Noll Software Modeling and Verification Group RWTH Aachen University https://moves.rwth-aachen.de/teaching/ss-18/spa/ Recap: Interprocedural Dataflow Analysis Outline of
More informationSpring 2015 Program Analysis and Verification. Lecture 4: Axiomatic Semantics I. Roman Manevich Ben-Gurion University
Spring 2015 Program Analysis and Verification Lecture 4: Axiomatic Semantics I Roman Manevich Ben-Gurion University Agenda Basic concepts of correctness Axiomatic semantics (pages 175-183) Hoare Logic
More informationPrecise Interprocedural Analysis through Linear Algebra
Precise Interprocedural Analysis through Linear Algebra Markus Müller-Olm FernUniversität Hagen, LG Praktische Informatik 5 58084 Hagen, Germany mmo@ls5csuni-dortmundde Helmut Seidl TU München, Lehrstuhl
More informationCS 188: Artificial Intelligence. Bayes Nets
CS 188: Artificial Intelligence Probabilistic Inference: Enumeration, Variable Elimination, Sampling Pieter Abbeel UC Berkeley Many slides over this course adapted from Dan Klein, Stuart Russell, Andrew
More informationInformatique Fondamentale IMA S8
Informatique Fondamentale IMA S8 Cours 4 : graphs, problems and algorithms on graphs, (notions of) NP completeness Laure Gonnord http://laure.gonnord.org/pro/teaching/ Laure.Gonnord@polytech-lille.fr Université
More informationDataflow Analysis. Dragon book, Chapter 9, Section 9.2, 9.3, 9.4
Dataflow Analysis Dragon book, Chapter 9, Section 9.2, 9.3, 9.4 2 Dataflow Analysis Dataflow analysis is a sub-area of static program analysis Used in the compiler back end for optimizations of three-address
More informationConstraint-Based Static Analysis of Programs
Constraint-Based Static Analysis of Programs Joint work with Michael Colon, Sriram Sankaranarayanan, Aaron Bradley and Zohar Manna Henny Sipma Stanford University Master Class Seminar at Washington University
More informationIntroduction to Program Analysis and Abstract Interpretation (Part I)
Introduction to Program Analysis and Abstract Interpretation (Part I) Axel Simon Olaf Chitil Lawrence Beadle Materials: http://www.cs.kent.ac.uk/research/ groups/tcs/pgradtrain/abstract.html Acknowledgments:
More informationAutomata-Theoretic LTL Model-Checking
Automata-Theoretic LTL Model-Checking Arie Gurfinkel arie@cmu.edu SEI/CMU Automata-Theoretic LTL Model-Checking p.1 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions
More informationStatic Analysis by Policy Iteration on Relational Domains
Static Analysis by Policy Iteration on Relational Domains Stephane Gaubert 1, Eric Goubault 2, Ankur Taly 3, Sarah Zennou 2 1 INRIA Rocquencourt, stephane.gaubert@inria.fr 2 CEA-LIST, MeASI, {eric.goubault,
More informationPrinciples of Program Analysis: Control Flow Analysis
Principles of Program Analysis: Control Flow Analysis Transparencies based on Chapter 3 of the book: Flemming Nielson, Hanne Riis Nielson and Chris Hankin: Principles of Program Analysis. Springer Verlag
More informationTopic 17. Analysis of Algorithms
Topic 17 Analysis of Algorithms Analysis of Algorithms- Review Efficiency of an algorithm can be measured in terms of : Time complexity: a measure of the amount of time required to execute an algorithm
More informationMIT Loop Optimizations. Martin Rinard
MIT 6.035 Loop Optimizations Martin Rinard Loop Optimizations Important because lots of computation occurs in loops We will study two optimizations Loop-invariant code motion Induction variable elimination
More informationLogical Abduction and its Applications in Program Verification. Isil Dillig MSR Cambridge
Logical Abduction and its Applications in Program Verification? Isil Dillig MSR Cambridge What is Abduction? Abduction: Opposite of deduction 2 / 21 What is Abduction? Abduction: Opposite of deduction
More information