History. One breakthrough paper Cousot & Cousot 77 (?) Abstract Interpretation. Inspired by. Lecture 16. Enthusiastically embraced by the community

Size: px

Start display at page:

Download "History. One breakthrough paper Cousot & Cousot 77 (?) Abstract Interpretation. Inspired by. Lecture 16. Enthusiastically embraced by the community"

Kristopher Lee
5 years ago
Views:

1 Hstory Abstract Intrprtaton On brakthrough papr Cousot & Cousot 77 (?) Insprd by Dataflow analyss Dnotatonal smantcs 1 Enthusastcally mbracd by th communty At last th functonal communty... At last th frst half of th papr... A Tny Languag Consdr a languag wth only ntgrs and multplcaton. = µ : Ep Int µ () = µ ( ) = µ ( ) µ ( ) 1 1 An Abstracton Dfn an abstract smantcs that computs only th sgn of th rsult. σ:ep { +,-,0} + f > σ ( ) = 0 f = f 0 < σ( ) = σ( ) σ( ) Soundnss W can show that ths abstracton s corrct n th sns that t corrctly prdcts th sgn of an prsson. Proof s by structural nducton on. µ ( ) > 0 σ( ) = + µ ( ) = 0 σ( ) = 0 µ ( ) < 0 σ( ) = Anothr Vw of Soundnss Th soundnss proof s clunky ach cas rpats th sam da. Instad, drctly assocat ach abstract valu wth th st of concrt valus t rprsnts. γ :{ +,0, } { } { } { } γ ( + ) = > 0 γ (0) = 0 Int γ ( ) = < !

2 Anothr Vw (Cont.) Abstract Intrprtaton Th concrtzaton functon Mappng from abstract valus to (sts of) concrt valus Lt D b th concrt doman, A th abstract doman. µ ( ) γ( σ( )) Ep σ µ A γ Ths s an abstract ntrprtaton. Computaton n an abstract doman In ths cas {+,0,-}. Th abstract smantcs s sound appromats th standard smantcs. Th concrtzaton functon stablshs th conncton btwn th two domans. D 7 8 Addng - Etnd our languag wth unary - Addng + Addng addton s not so asy. Th abstract valus ar not closd undr addton. µ ( ) = µ ( ) + 0 σ( ) = σ( ) 0 + µ µ µ ( 1 + ) = ( 1) + ( ) + + +? σ( + ) = σ( ) + σ( ) 0 + 0? 9 10 Soluton W nd anothr abstract valu to rprsnt a rsult that can b any ntgr. Fndng a doman closd undr all th abstract opratons s oftn a ky dsgn problm T T T γ (T) = Int T T T T T T T T Etndng Othr Opratons W also nd to tnd th othr abstract opratons to work wth T. + 0 T T T T T 0 T T + 0 T 0 + T 11 1!

3 Eampls Addng / (Intgr Dvson) Abstract computaton loss nformaton µ ((1 + ) + 3) = 0 σ ((1 + ) + 3) = ( ) + ( + ) = T No loss of nformaton µ ((5 5) + 6) = 31 σ ((5 5) + 6) = ( + + ) + + = + 13 Addng / s straghtforward cpt for th cas of dvson by 0. If w dvd ach ntgr n a st by 0, what st of ntgrs rsults? Th mpty st. γ ( ) = / + 0 T T T T T 0 T T 14 Addng / (Cont.) Th Abstract Doman As bfor w nd to tnd th othr abstract opratons. In ths cas, vry ntry nvolvng bottom s bottom all opratons ar strct n bottom + = = = 15 Our abstract doman forms a lattc. A partal ordr y γ( ) γ( y) Evry fnt subst has a last uppr bound (lub) & gratst lowr bound (glb). W wrt A for an abstract doman a st of valus + an ordrng T Lattc Lngo Th Abstracton Functon A lattc s complt f vry subst (fnt or nfnt) has lub s and glb s. Evry fnt lattc s complt Thus vry lattc has a top/bottom lmnt. Usually ndd n abstract ntrprtatons. Th abstracton functon maps concrt valus to abstract valus. Th dual of concrtzaton. Th smallst valu of A that s th abstracton of a st of concrt valus. α Int : A ({ } { } { }) α( S) = lub < 0 S, 0 0 S, + > 0 S !

4 A Gnral Dfnton An abstract ntrprtaton conssts of An abstract doman A and concrt doman D Concrtzaton and abstracton functons formng a Galos nsrton. A (sound) abstract smantc functon. Galos Insrtons Th abstract doman can b thought of as dvdng th concrt doman nto substs (not dsjont). Th abstracton functon maps a subst of th doman to th smallst contanng abstract valu. Galos nsrton: D. γα ( ( )) a A. = αγ ( ( )) or d γα d = αγ 19 d γα d = αγ 0 Pctur Gnral Condtons for Corrctnss In corrct abstract ntrprtatons, w pct th followng dagram to commut. Ep σ µ A D γ α 1 Thr condtons guarant corrctnss n gnral: α and γ form a Galos nsrton d γ oα, d = α oγ α and γ ar monotonc y α( ) α( y) Abstract opratons op ar locally corrct: γ(op( s,..., s )) op( γ( s ),..., γ( s )) 1 n 1 n Gnrc Corrctnss Proof A Scond Noton of Corrctnss Proof by nducton on th structur of : µ ( ) γ( σ( )) = = µ ( op ) 1 µ ( ) op µ ( ) df. of µ 1 γσ ( ( )) op γσ ( ( )) by nducton 1 γσ ( ( ) op σ( )) local corrctnss 1 γ( σ( op )) df of σ 1 W can dfn corrctnss usng abstracton nstad of concrtzaton. µ ( ) γ( σ( )) α ({ µ ( )}) σ( ) drcton µ ( ) γ( σ( )) α ({ µ ( )}) α( γ( σ( ))) monotoncty α ({ µ ( )}) σ( ) α oγ = d 3 4 4!

5 Corrctnss (Cont.) Th othr drcton... µ ( ) γ( σ( )) α ({ µ ( )}) σ( ) A Languag wth Input Th nt stp s to add languag faturs bsds nw opratons. W bgn wth nput, modld as a sngl fr varabl n prssons. drcton α ({ µ ( )}) σ( ) γα ( ({ µ ( )})) γσ ( ( )) monotoncty µ ( ) γ( σ( )) d γ oα = Smantcs Th manng functon now has typ µ : Ep Int Int W wrt th functon currd wth th prsson as a subscrpt. µ ( j) µ ( j) = = µ ( j) = µ ( j) µ ( j) 1 1 µ ( j) = µ ( j) + µ ( j) =... j Abstract Smantcs Abstract smantc functon: σ : Ep A A Also wrt ths smantcs currd. σ ( j) = σ ( j) = j σ ( j) = σ ( j) σ ( j) 1 1 σ ( j) = σ ( j) + σ ( j) =... = α({ }) 7 8 Corrctnss Local Corrctnss Th corrctnss condton nds to b gnralzd. Ths s th frst ral us of th abstracton functon. Th followng ar all quvalnt:. µ ( ) γ( σ ( α({ }))) D µ γ oσ oα A α oµ σ oα A α σ µ D A D γ α 9 W also nd a modfd local corrctnss condton. ( γσ ( ( )),..., ( ( )) ) ( ( ( ),..., ( )) γσ ) 1 γ σ n σ 1 n op j j op j j 30 5!

6 Proof of Corrctnss If-Thn-Els Thm µ ( j) γ( σ ( j)) Proof (by nducton) Bass. µ ( j) = γ( ) = γ( σ ( j)) Stp µ µ ( j) = j γ( j) = γ( σ ( j)) op ( 1,..., n ) 1 1 ( j ) = op( µ ( j ),..., µ ( j )) df. of µ n op( γσ ( ( j )),..., γσ ( ( j )) nducton n γ( op( σ ( j),..., σ ( j))) local corrctnss 1 op ( 1,..., n ) n = γ( σ ( j )) df. of σ =... f = thn ls... µ f 1= thn 3 ls 4 f 1= thn 3 ls 4 µ ( ) f µ ( ) ( ) 3 = µ 1 () = µ ( ) f µ ( ) ( ) 4 µ 1 σ () = σ () 7 σ () 3 4 Not th lub opraton n th abstract functon; ths s why w nd lattcs as domans Corrctnss of If-Thn-Els Assum th tru branch s takn. (Th argumnt for th fals branch s symmtrc.) Rcurson Add rcursv dfntons of a sngl varabl for smplcty Th smantc functon s µ () 3 γσ ( ( )) by nducton 3 γσ ( ( )) 7 γσ ( ( )) 3 4 ( 7 ) 3 4 γ σ ( ) σ ( ) monotoncty of γ µ : Ep Int Int program = df f ( ) = =... f( ) Rvsd Manng Functon Manng of Rcursv Functons Dfn an aulary smantcs takng a functon (for th fr varabl f) and an ntgr (for ). µ : Ep Int Int µ ʹ : Ep (Int Int ) Int Int µ ʹ : Ep (Int Int ) Int Int µ ʹ ( g)( j) = g( µ ʹ ( g)( j)) f ( ) µ ʹ ( g)( j) = j µ ʹ ( g)( j) = µ ʹ ( g)( j) + µ ʹ ( g)( j) Consdr a functon Dfn an ascndng chan f, f,... n Int Int f = λ. 0 f = µ ʹ ( f) + 1 Dfn µ = f f U df f = !

7 Abstract Smantcs Rvsd Dfn an analogous aulary functon for th abstract smantcs. Abstract Smantcs Rvsd II W nd on mor condton for th abstract smantcs. σ ʹ : Ep (A A) A A σʹ f ( ) ( g)( ) = g( σʹ ( g)( )) σ ʹ ( g)( ) = σʹ ( g)( ) = σʹ ( g)( ) + σʹ ( g)( ) 1+ Profs. Akn, Barrtt 1 & Dll CS All abstract functons ar rqurd to b monotonc. Thm. Any monotonc functon on a complt lattc has a last fd pont. 38 Abstract Manng of Rcurson Corrctnss σ : Ep A A σ ': Ep ( A A) A A Consdr a functon df f = Dfn an ascndng chan f 0, f 1,... n A A f 0 = λa. f + 1 = σ ʹ ( f ) f ( j) f( j) 1 f ( j) 0 γ γ γ f ( j) f 1( j) f 0( j) Dfn σ = f f U Corrspondng lmnts of th chan stand n th corrct rlatonshp Corrctnss (Cont.) Eampl. f( j) γ ( f ( j)) f( j) γ ( f ( j)) chans stablz 0 0 Uf ( j) γ Uf ( j) monotoncty of γ 0 0 U µ ( j) γ( σ ( j)) by dfnton f U f df f() = f = 0 thn 1 ls f( + -1) Abstracton: ( σ ʹ ( = + )) lfp f 0 thn 1 ls f( -1) Smplfd: ( λ λ + ( + )) lfp f.. f( ) !

8 Strctnss W wll assum our languag s strct. Maks lttl dffrnc n qualty of analyss for ths ampl. Assum that f ( ) = Thrfor t s sound to dfn f ( ) = Calculatng th LFP ( λ λ + ( + )) lfp f.. f( ) 0 + T f 0 = 0 + T f 1 = T f = T T + T 0 + T f 3 = T T T T Nots In ths cas, th abstracton ylds no usful nformaton! Not that squnc of functons forms a strctly ascndng chan untl stablzaton f0 < f1 < f < f3 = f4 = f5 =... But th squnc of valus at partcular ponts may not b strctly ascndng: f ( + ) < f( + ) = f ( + ) < f ( + ) = f ( + ) = f ( + ) = Nots (Cont.) Lsson: Th fd pont s bng computd n th doman (A A) A A Th fd pont s not bng computd n A A Mak sur you chck th doman of th fd pont oprator Strctnss Analyss Ovrvw In lazy functonal languags, t may b dsrabl to chang call-by-nd (lazy valuaton) to call-by-valu. Strctnss Analyss CBN rqurs buldng thunks (closurs) to captur th lcal nvronmnt of unvaluatd prssons. CBV valuats ts argumnt mmdatly, whch s wastful (or vn wrong) f th argumnt s nvr valuatd undr CBN !

9 Corrctnss Substtutng CBV for CBN s always corrct f w somhow know that a functon valuats ts argumnt(s). A functon f s strct f f ( ) = Obsrvaton: f f s strct, thn t s corrct to pass argumnts to f by valu. Outln Dcdng whthr a functon s strct s undcdabl. Mycroft s da: Us abstract ntrprtaton. Corrctnss condton: If f s non-strct, w must rport that t s non-strct Th Abstract Doman Concrtzaton/Abstracton Contnu workng wth th sam languag (1 rcursv functon of 1 varabl). Nw abstract doman : 1 0 Th concrtzaton/abstracton functons say 0 mans th computaton dfntly dvrgs 1 mans nothng s known about th computaton D s th concrt doman γ(0) = { } α( { }) = 0 γ(1) = D α( S) = 1 f S { } 51 5 Abstract Smantcs Abstract Smantcs (Cont.) Nt stp s to dfn an abstract smantcs Transform f:int Int to f: Transform valus v:int To tst strctnss chck f to v: f(0) = 0 An a stands for an abstract valu (0 or 1). Trat 0,1 as fals, tru rspctvly. σ ʹ ( g)( a) = a σ ʹ ( g)( a) = 1 σʹ ( g)( a) = σʹ ( g)( a) σʹ ( )( ) ( )( ) ( )( ) 1 g a = σʹ g a σʹ 1 g a σ' ( g)( a) = g( σʹ ( g)( a)) f ( ) !

10 Th Rst of th Ruls An Eampl σʹ 1 ( g)( a) = σʹ ( g)( a) σʹ ( )( ) 1 g a + σʹ ( g)( a) = σʹ ( g)( a) σʹ ( g)( a) 1/ = f 1 thn 3 ls 4 df f 1 ( ) σʹ ( g)( a) = σʹ ( g)( a) σʹ ( g)( a) σʹ ( g)( a) σʹ ( g)( a) σ = = lfp σʹ df f() = f = 0 thn 1 ls f( + -1) ( σ ʹ ( = + )) lfp f 0 thn 1 ls f( -1) ( ) lfp λf. λ. = λaa. ( λaa. ) 0 = 0 Th functon s strct n Calculatng th LFP Anothr Eampl ( λ λ ( )) lfp f ( f( 1)) 0 1 f 0 = f 1 = f = 0 1 Gnralz to rcursv functons of two varabls. df f(,y) = f = 0 thn 0 ls f( + -1,f(,y)) ( σ ( )) lfp ʹ f = 0 thn 0 ls f( + -1,f(,y)) = lfp( λf. λ(, y). 1 (1...)) = λ(,y) Eampl (Cont.) Summary of Strctnss Analyss For mult-argumnt functons, chck ach argumnt combnaton of th form (1,,1,0,1,,1). ( λ ) ( λ ) (, y). (0,1) = 0 (, y). (1,0) = 1 X can b passd by valu. Unsaf to pass Y by valu. Mycroft s tchnqu s sound and practcal. Wdly mplmntd for lazy functonal languags. Maks modst mprovmnt n prformanc (a fw %). Th thory of abstract ntrprtaton s crtcal hr. Mycroft s tchnqu trats all valus as atomc. No rfnmnt for componnts of lsts, tupls, tc. Many rsarch paprs tak up mprovmnts for data typs, hghr-ordr functons, tc. Most of ths ar vry slow !

11 Conclusons Th Cousot&Cousot papr(s) gnratd an normous amount of othr rsarch. Abstract ntrprtaton as a thory and abstract ntrprtaton as a mthod of constructng tools ar oftn confusd. Slogan of most rsarchrs: Whr s Abstract Intrprtaton Wak? Thory s compltly gnral Th part of th orgnal papr popl undrstand s lmtd Fnt domans + monotonc functons Fnt Lattcs + Monotonc Functons = Program Analyss 61 6 Data Structurs and th Hap Sz of Domans Rqurs a fnt abstracton Whch may b tund to th program Mor oftn s mpty lst, lst of lngth 1, unknown lngth Smlar commnts apply to analyzng hap proprts E.g., a cll has 0 rfrncs, 1 rfrncs, many rfrncs Larg domans = slow analyss In practc, domans ar forcd to b small Chan hght s th crtcal masur Th focus n abstract ntrprtaton s on corrctnss Not much nsght nto ffcnt algorthms Contt Snstvty Hghr-Ordr Functons No partcular nsght nto contt snstvty Any rasonabl tchnqu s an abstract ntrprtaton Maks clar how to handl hghr-ordr functons Modl as abstract, fnt functons Ordrng on functons s pontws Problm: hug domans Brak wth th dpndnc on control-flow graphs !

12 Forwards vs. Backwards Th forwards vs. backwards mntalty prmats much of th abstract ntrprtaton ltratur But nothng n th thory says t has to b that way 67 1!

Abstract Interpretation. Lecture 5. Profs. Aiken, Barrett & Dill CS 357 Lecture 5 1

Abstract Interpretation. Lecture 5. Profs. Aiken, Barrett & Dill CS 357 Lecture 5 1 Abstract Intrprtation 1 History On brakthrough papr Cousot & Cousot 77 (?) Inspird by Dataflow analysis Dnotational smantics Enthusiastically mbracd by th community At last th functional community... At