Abstract Interpretation: concrete and abstract semantics

Transcription

1 Abstract Intrprtation: concrt and abstract smantics

2 Concrt smantics W considr a vry tiny languag that manags arithmtic oprations on intgrs valus. Th (concrt) smantics of th languags cab b dfind by th funzcion m dfind by: i m : Exp Int m() i i m( ) m( ) m( )

3 Abstract Smantics Considr now an abstract smantics ovr th domain of signs :Exp,-,0 if i 0 0 ( i) 0 if i 0 0 if i ( ) ( ) ( )

4 From a diffrnt prspctiv W can associat to ach abstract valu th st of concrt lmnts it rprsnts. Th concrtization function : : {,0, } 2 ( ) i i 0 (0) 0 Int ( ) i i 0 4

5 Concrtization Th concrtization function maps an abstract valu to a st of concrt lmnts Lt D dnot th comncrt domain and A dnot th abstract domain. Th corrctnss of th abstract smantics wrt th concrt on can b xprssd by: A m( ) ( ( )) Exp m 2 D 5

6 Abstract Intrprtation Abstract Intrprtation is: Computing th smantics of a program in an abstract domain In th cas of signs, th domain so far is {+,0,-}. Th abstract smantics should b corrct it is an ovr approximation of th concrt smantics Th rlatrion btwn t two domains is givn by a concrtization function 6

7 Considr th unary oprator - Lt us add to our languag th unary oprator - m( ) m( ) 0 ( ) ( ) 0 7

8 Considr th binary opration + Adding th addition oprator focrcs us to modify th domain, as th prvious on is not abl to rprsnt th rsult of adding numbrs of opposit sign 0 m( ) m( ) m( ) ? ( ) ( ) ( ) ? 8

9 So W add to th domain a nw lmnt that rprsnts all th intgr numbrs (both positiv and ngativ, and zro) 0 T T T (T) Int 0 0 T T T T T T T T 9

10 Th oprations should b rvisitd 0 T 0 T T T T 0 T T 0 T 0 T 10

11 Exampls Somtims thr is information loss du to th abstract oprations m((1 2) 3) 0 ((1 2) 3) ( ) ( ) T Somtims thr is no information loss, with rspct to th abstraction m((5 5) 6) 31 ((5 5) 6) ( ) 11

12 Considr th division oprator / Problm: what is th rsult of dividing by zro? No numbr! So w nd a nw lmnt in our domain that rprsnts th mpty st of intgrs (i.. a failur stat) But.. What s wrong in th tabl blow? / 0 T 0 T x ( ) 0 0 T x T T 0 T T 12

13 Th rsulting abstract domain It is a finit complt lattic Th partial ordr is cohrnt wrt th concrtization function: T x y ( x ) ( y ) 0 13

14 Th abstraction function Th concrtization function has an adjoint function, th abstraction function a. Function a maps a st of concrt valus into th bst rprsntation of this st in th abstract domain (th smallr lmnt f th abstract domain that rprsnts of of ths lmnts) In our xampl:, Int a : 2 A a( S ) lub i 0 i S, 0 0 S, i 0 i S ( i) a({ i}) 14

15 A gnral dfinition An Abstract Intrprtation consists of: An abstract domain A and a concrt domain D A and D ar complt lattics. Smallr mans mor prcis Two monoton adjoint function that njoy ch formino una insrzion di Galois. Abstract oprations that ar corrct wrt th concrt ons A fixpoint algorithm D Galois insrtion: a x 2. x ( ( x )) a A. x a ( ( x )) 15

16 Corrctnss rvisitd If cas of Galois insrtion, ths corrctnss conditions ar quivalnt (prov it!) m( ) ( ( )) ( ) a({ m( )}) Exp m A 2 D a 16

17 Corrctnss W show that in ordr to nsur th corrctnss of th whol analysis th following conditions ar sufficint: 1. Th function a and ar monoton 2. Th function a and form a Galois insrtion 3. Th abstract oprations ar locally corrct, i.. (op( s,..., s )) op( ( s ),..., ( s )) 1 n 1 n Notic that thr is always a way to dfin a locally corrct abstract opration. It is sufficint to considr th oprations that rturns th top lmnt of th abstract domain. 17

18 Local corrctnss A op A (op( s1,..., s n )) 2 D op 2 D op( ( s ),..., ( s n )) 1 18

19 Corrctnss proof W show by structural induction on that: m( ) ( ( )) Basic stp: m() i i df. di m {} i a ( ({ i })) insrzion di Galois ( (i) ) df di 19

20 Corrctnss proof Inductiv Stp m( ) ( ( )) m( op ) 1 2 m( ) op m( ) 1 2 ( ( )) op ( ( )) 1 2 ( ( ) op ( )) 1 2 ( ( op )) 1 2 df. di m pr ipotsi induttiva corrttzza local df di 20

21 Adding an input W can xtnd our tiny languag with th possibility to gt an input valu from th usr This mans that w hav a variabl x in th xprssions i... x 21

22 Concrt smantics Th smantic function m bcoms m : Exp Int Int And w may xprss it in trms of a family of functions, having xprssions as indcs and a singl paramtr (th input valu) m ( j) i m ( j) x i j m ( j ) m ( j ) m ( j ) m ( j ) m ( j ) m ( j )

23 Abstract smantics Th sam holds for th abstract smantic function : Exp A A Also in this cas w can xprss by a family of functions: ( j) i x ( j) i j ( j ) ( j ) ( j ) ( j ) ( j ) ( j ) i a({ i}) 23

24 Corrctnss Th following conditions ar quivalnt i. m ( i ) ( ( a({ i }))) m a D a m a A A a A a m 2 D 2 D 24

25 Local corrctnss W can xprss th local corrntss condition by: ( ( )),..., ( ( )) ( ( ),..., ( )) op j j op j j 1 n 1 n 25

26 Conditional statmnt... if thn ls... Concrt smantics m if thn ls () i m ( i ) if m m 3 ( i ) 1 ( i ) 2 m ( i ) if m ( ) m ( ) 4 i 1 i 2 Abstract smantics ( i ) ( i ) ( i ) if thn ls Notic th rol of th lub in th abstract domain 26

27 Corrctnss of th conditional statm. Assum that th condition is tru (th othr cas is analogous) m ( ( i )) pr induzion ( ( i)) ( ( i)) 3 () i ( i) ( i) monotonia di 3 4 ( ( i )) if thn ls