AAA616: Program Analysis. Lecture 7 The Octagon Abstract Domain

Size: px

Start display at page:

Download "AAA616: Program Analysis. Lecture 7 The Octagon Abstract Domain"

Elfreda Smith
6 years ago
Views:

1 AAA616: Program Analysis Lecture 7 The Octagon Abstract Domain Hakjoo Oh 2016 Fall Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

2 Reference Antoine Miné. The Octagon Abstract Domain. Higher-Order and Symbolic Computation. Volume 19 Issue 1, March 2006 Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

3 Numerical Abstract Domains Infer numerical properties of program variables: e.g., division by zero, array index out of bounds, integer overflow, etc. Well-known numerical domains: interval domain: x [l, u] octagon domain: ±x ± y c polyhedron domain (affine inequalities): a 1 x a n x n c Karr s domain (affine equalities): a 1 x a n x n = c congruence domain: x az + b The octagon domain is a restriction of the polyhedron domain where each constraint involves at most two variables and unit coefficients. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

4 Interval vs. Octagon Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

5 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

6 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

7 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

8 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

9 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

10 Octagon A finite set V = {V 1,..., V n } of variables. An environment ρ (V I) (ρ I n ), where I can be Z, Q, or R. An octagonal constraint is a constraint of the form ±V i ± V j c. An octagon is the set of points satisfying a conjunction of octagonal constraints. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

11 Potential Constraints A potential constraint (i.e., difference constraint): V i V j c. Let C be a set of potential constraints. C can be represented by a potential graph G = (V, ). ( ) V V I V i c V j (V j V i c) C Assume that, for every Vi, V j, there is at most one arc from V i to V j. A potential set of C is the set of points in I n that satisfy C. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

12 Difference Bound Matrices (DBMs) A DBM m is a n n square matrix, where n is the number of program variables, with elements in Ī = I {+ }. { c (Vi V m ij = j c) C + o.w. DBM = Ī n n : the set of all DBMS. The potential set described by m: γ Pot (m) = {(v 1,..., v n ) I n i, j.v j v i m ij } Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

13 Example Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

14 Encoding Octagonal Constraints as Potential Constraints V = {V 1,..., V n }: the set of program variables. Define V = {V 1,..., V 2n }, where each V i V has both a positive form V 2n 1 and a negative form V 2n V 2n 1 = V i and V 2n = V n A conjunction of octagonal constraints on V can be represented as a conjunction of potential constraints on V. 2n 2n DBM with elements in Ī i, V 2i 1 = V 2i holds for any DBM that encodes octagonal constraints Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

15 Concretization Given a DBM m of dimension 2n, the octagon described by m is defined as follows: γ Oct : DBM (V I) γ Oct (m) = {(v 1,..., v n ) I n (v 1, v 1,..., v n, v n ) γ Pot (m)} Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

16 Coherence A DBM m must be coherent if it encodes a set of octagonal constraints: m is coherent i, j. m ij = m jī where switches between the positive and negative forms of a variable: { i + 1 if i is odd ī = i 1 if i is even Let CDBM be the set of all coherent DBMs. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

17 Lattice Structure The set of DBMs forms a complete lattice (I Q): (CDBM,,,,, ) is a DBM such that ij = + is a new smallest element m. m m. m = m = m m. m = m = m m, n. m n i, j. m ij n ij (m, n ) m, n. (m n) ij = max(m ij, n ij ) (m, n ) m, n. (m n) ij = min(m ij, n ij ) (m, n ) Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

18 Galois Connection α Oct ( ) = ( α Oct (R) ) ij = γ Oct (V I) CDBM α Oct max{ρ(v l ) ρ(v k ) ρ R} i = 2k 1, j = 2l 1 or i = 2l, j = 2k max{ρ(v l ) + ρ(v k ) ρ R} i = 2k, j = 2l 1 max{ ρ(v l ) ρ(v k ) ρ R} i = 2k 1, j = 2l Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

19 Normalization Different, incomparable DBMs may represent the same potential set: Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

20 Shortest-Path Closure The shortest-path closure m of m is defined as follows: The closure m of m is the smallest DBM representing γ Pot (m): X DBM. γ Pot (m) = γ Pot (X) = m X Floyd-Warshall Algorithm: Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

21 Implicit Constraints Closuring a DBM makes implicit constraints explicit: V j V k c V k V l d = V j V i c + d Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

22 Strong Closure The closure m of m may not be the smallest DBM representing γ Oct (m): Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

23 Strong Closure The strong closure m of m is the smallest DBM representing γ Oct. m is strongly closed iff: i, j, k. m ij m ik + m kj i, j. m ij (m i ī + m jj )/2 i, m ii = 0 The encoding of octagonal constraints implies V j V j c V ī V i d = V j V i (c + d)/2 Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

24 Abstract Transfer Functions Abstract counterparts of concrete transfer functions: union, intersection assignment test (guard) Soundness condition: F γ γ ˆF Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

25 Union The union of two octagons may not be an octagon. gives a sound approximation. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

26 Intersection The intersection of two octagons is always an octagon. gives the exact intersection of two octagons. Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

27 Assignment (the forget operator) Concrete semantics: Abstract semantics: Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

28 Assignment (the forget operator) When the argument is strongly closed, the result is exact: Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

29 Assignments Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

30 Variable Clustering A collection Π : ( (V)) of variable clusters such that The complete lattice: π Π π = V O Π = π Π where O π is the lattice of Octagon for variables in π. Challenge: How to choose a good Π? Heo et al. Learning a Variable-Clustering Strategy for Octagon from Labeled Data Generated by a Static Analysis. SAS 2016 O π Hakjoo Oh AAA Fall, Lecture 7 November 3, / 30

The Octagon Abstract Domain

The Octagon Abstract Domain Antoine Miné (mine@di.ens.fr) Département d Informatique, École Normale Supérieure Abstract. This article presents the octagon abstract domain, a relational numerical abstract