1 / 57

Program analysis & Synthesis

Lecture 07 – Shape Analysis. Program analysis & Synthesis. Eran Yahav. Previously . LFP computation and join-over-all-paths I nter-procedural analysis call-string approach functional approach. Today. Shape Analysis Typestate Verification. Shape Analysis.

komala
Download Presentation

Program analysis & Synthesis

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Lecture 07 – Shape Analysis Program analysis & Synthesis EranYahav

  2. Previously • LFP computation and join-over-all-paths • Inter-procedural analysis • call-string approach • functional approach

  3. Today • Shape Analysis • Typestate Verification

  4. Shape Analysis Automatically verify properties of programs manipulating dynamically allocated storage Identify all possible shapes (layout) of the heap

  5. Timeline: Shape Analysis Flow analysis and optimization of Lisp-like structures Parametric Shape Analysis via 3-valued Logic A Local Shape Analysis Based on Separation Logic Verifying Linearizability with Heap Decomposition Verifying Concurrent Heap Manipulating Programs Analysis of pointers and structures Numerical Abstractions Verifying Linearizability Logical Char. of Heap Abstractions Thread ModularShape Analysis Interprocedural / Recursive Programs Procedure Local Heaps 1990 1981 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008

  6. Timeline: Shape Analysis via 3-Valued Logic Parametric Shape Analysis via 3-valued Logic [Sagiv, Reps, Wilhelm POPL’99 ,TOPLAS’02] A Local Shape Analysis Based on Separation Logic Verifying Linearizability with Heap Decomposition Verifying Concurrent Heap Manipulating Programs [Yahav, Sagiv, POPL’01] Numerical Abstractions Verifying Linearizability [Amit et.al., CAV’07] Interprocedural / Recursive Programs Logical Char. of Heap Abstractions Procedure Local Heaps Thread ModularShape Analysis 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008

  7. Sequential Stack void push(int v){ Node x = malloc(sizeof(Node)); x->d = v; x->n = Top; Top = x; } intpop(){ • if (Top == NULL) return EMPTY; • Node *s = Top->n; • int r = Top->d; • Top = s; • return r; • } Want to Verify No Null Dereference Underlying list remains acyclic after each operation

  8. Shape Analysis via 3-valued Logic 1) Abstraction • 3-valued logical structure • canonical abstraction 2) Transformers • via logical formulae • soundness by construction • embedding theorem, [SRW02]

  9. Concrete State • represent a concrete state as a two-valued logical structure • Individuals = heap allocated objects • Unary predicates = object properties • Binary predicates = relations • parametric vocabulary n n u1 u2 u3 Top (storeless, no heap addresses)

  10. Concrete State • S = <U,  > over a vocabulary P • U – universe •  - interpretation, mapping each predicate from p to its truth value in S n n u1 u2 u3 Top • U = { u1, u2, u3} • P = { Top, n } • (n)(u1,u2) = 1, (n)(u1,u3)=0, (n)(u2,u1)=0,… • (Top)(u1)=1, (Top)(u2)=0, (Top)(u3)=0

  11. Formulae for Observing Properties n n u1 u2 u3 Top void push(int v){ Node x = malloc(sizeof(Node)); xd = v; xn = Top; Top = x; } Top != null w: x(w) 1 w:Top(w) w: x(w) No node precedes Top v1,v2: n(v1, v2) Top(v2) 1 No Cycles 1 v1,v2: n(v1, v2)  n*(v2, v1) v1,v2: n(v1, v2)  n*(v2, v1) v1,v2: n(v1, v2) Top(v2)

  12. Concrete Interpretation Rules

  13. Example: s = Topn s’(v) = v1: Top(v1)  n(v1,v) s u2 u3 u1 u2 u3 u1 Top Top

  14. Collecting Semantics if v = entry { <,> } •  { st(w)(S) | S  CSS[w] }  (w,v)  E(G), w  Assignments(G) •  { S | S  CSS[w] }  (w,v)  E(G), w  Skip(G) CSS [v] = • { S | S  CSS[w] and S  cond(w)}  othrewise (w,v)  True-Branches(G)  { S | S  CSS[w] and S  cond(w)} (w,v)  False-Branches(G)

  15. Collecting Semantics • At every program point – a potentially infinite set of two-valued logical structures • Representing (at least) all possible heaps that can arise at the program point • Next step: find a bounded abstract representation

  16. 3-Valued Logic 1/2 • 1= true • 0 = false • 1/2 = unknown • A join semi-lattice, 0 1 = 1/2 information order 0 1 logical order

  17. 3-Valued Logical Structures • A set of individuals (nodes) U • Relation meaning • Interpretation of relation symbols in Pp0()  {0,1, 1/2}p1(v)  {0,1, 1/2}p2(u,v)  {0,1, 1/2} • A join semi-lattice: 01 = 1/2

  18. Boolean Connectives [Kleene]

  19. Property Space • 3-struct[P] = the set of 3-valued logical structures over a vocabulary (set of predicates) P • Abstract domain • (3-Struct[P]) •  is  • We will see alternatives later (maybe)

  20. Embedding Order • Given two structures S = <U, >, S’ = <U’, ’> and an onto function f : U  U’ mapping individuals in U to individuals in U’ • We say that f embeds S in S’ (denoted by S f S’) if • for every predicate symbol p  P of arity k: u1, …, uk U, (p)(u1, ..., uk) ’(p)(f(u1), ..., f (uk)) • and for all u’  U’( | { u | f (u) = u’} | > 1) ’(sm)(u’) • We say that S can be embedded in S’ (denoted by S  S’) if there exists a function f such that S f S’

  21. Tight Embedding • S’ = <U’, ’> is a tight embedding of S=< U,  > with respect to a function f if: • S’ does not lose unnecessary information’(u’1,…, u’k) = {(u1 ..., uk) | f(u1)=u’1,..., f(uk)=u’k} • One way to get tight embedding is canonical abstraction

  22. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top [Sagiv, Reps, Wilhelm, TOPLAS02]

  23. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top Top [Sagiv, Reps, Wilhelm, TOPLAS02]

  24. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top Top

  25. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top Top

  26. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top Top

  27. Canonical Abstraction n n u1 u2 u3 u1 u2 u3 Top Top

  28. Canonical Abstraction () • Merge all nodes with the same unary predicate values into a single summary node • Join predicate values ’(u’1 ,..., u’k) =  {(u1 ,..., uk) | f(u1)=u’1 ,..., f(uk)=u’k } • Converts a state of arbitrary size into a 3-valued abstract state of bounded size • (C) =  { (c) | c  C }

  29. Information Loss n n Top Top Top Top Canonical abstraction n n n Top n n Top

  30. Instrumentation Predicates n n Top c Top Top • Record additional derived information via predicates n n n rx(v) = v1: x(v1)  n*(v1,v) c c Top c(v) = v1: n(v1, v)  n*(v, v1) Canonical abstraction

  31. Embedding Theorem: Conservatively Observing Properties Top rTop rTop No Cycles No cycles (derived) 1/2 1 v1,v2: n(v1, v2)  n*(v2, v1) v:c(v)

  32. Operational Semantics void push(int v){ Node x = malloc(sizeof(Node)); x->d = v; x->n = Top; Top = x; } n n u1 u2 u3 Top intpop(){ • if (Top == NULL) return EMPTY; • Node *s = Top->n; • int r = Top->d; • Top = s; • return r; • } n n u1 u2 u3 Top s s = Top->n s’(v) = v1: Top(v1)  n(v1,v)

  33. Abstract Semantics ? s = Topn s rTop rTop Top Top rTop rTop s = Top->n s’(v) = v1: Top(v1)  n(v1,v)

  34. Best Transformer (s= Topn) s ConcreteSemantics rTop Top rTop Top rTop rTop s rTop rTop rTop Top s’(v) = v1: Top(v1)  n(v1,v) Top rTop rTop rTop . . . . . . Canonical Abstraction  s ? Top rTop rTop AbstractSemantics s rTop Top rTop Top rTop rTop rTop

  35. Then aMiracle Occurs

  36. Semantic Reduction • Improve the precision of the analysis by recovering properties of the program semantics • A Galois connection (C, , , A) • An operation op:AAis a semantic reduction when • lL2 op(l)l and • (op(l)) = (l)  l op  C A

  37. The Focus Operation • Focus: Formula((3-Struct)  (3-Struct)) • Generalizes materialization • For every formula  • Focus()(X) yields structure in which  evaluates to a definite values in all assignments • Only maximal in terms of embedding • Focus() is a semantic reduction • But Focus()(X) may be undefined for some X

  38. Partial Concretization Based on Transformer (s=Topn) s AbstractSemantics rTop rTop Top Top rTop rTop,rs s Top rTop rTop rTop s’(v) = v1: Top(v1)  n(v1,v) rTop rTop rTop Top Canonical Abstraction Focus (Topn) Partial Concretization u: top(u) n(u, v) s rTop rTop Top AbstractSemantics s Top rTop rTop Top rTop rTop rTop

  39. Partial Concretization Locally refine the abstract domain per statement Soundness is immediate Employed in other shape analysis algorithms [Distefano et.al., TACAS’06, Evan et.al., SAS’07, POPL’08] Emplyed in other analysis algorithms[Typestate verification, ISSTA’06]

  40. The Coercion Principle • Another Semantic Reduction • Can be applied after Focus or after Update or both • Increase precision by exploiting some structural properties possessed by all stores (Global invariants) • Structural properties captured by constraints • Apply a constraint solver

  41. Apply Constraint Solver  Top rTop rTop x x Top Top rTop rTop rTop rTop n n n n n n n x x rx rx,ry rx rx,ry rx,ry rx,ry n y y

  42. Sources of Constraints • Properties of the operational semantics • Domain specific knowledge • Instrumentation predicates • User supplied

  43. Example Constraints x(v1) x(v2)eq(v1, v2) n(v, v1) n(v,v2)eq(v1, v2) n(v1, v) n(v2,v)eq(v1, v2)is(v) n*(v3, v4)t[n](v1, v2)

  44. Abstract Transformers: Summary • Kleene evaluation yields sound solution • Focus is a statement-specific partial concretization • Coerce applies global constraints

  45. Abstract Semantics if v = entry { <,> } •  { t_embed(coerce(st(w)3(focusF(w)(SS[w] ))))  (w,v)  E(G), w  Assignments(G) •  { S | S  SS[w] }  othrewise (w,v)  E(G), w  Skip(G) SS [v] = • { t_embed(S) | S  coerce(st(w)3(focusF(w)(SS[w] )))and S 3 cond(w)}  (w,v)  True-Branches(G) • { t_embed(S) | S  coerce(st(w)3(focusF(w)(SS[w] ))) and S 3 cond(w)}  (w,v)  False-Branches(G)

  46. Recap • Abstraction • canonical abstraction • recording derived information • Transformers • partial concretization (focus) • constraint solver (coerce) • sound information extraction

  47. Stack Push emp … Top void push(int v){ Node x = alloc(sizeof(Node)); xd = v; xn = Top; Top = x; } x x x Top v: x(v) v: x(v) x Top x x Top Top Top v1,v2: n(v1, v2) Top(v2) v:c(v) Top

  48. Non-blocking Stack[Treiber 1986] [1] void push(Stack *S, data_type v) {[2] Node *x = alloc(sizeof(Node));[3] x->d = v;[4] do {[5] Node *t = S->Top;[6] x->n = t;[7] } while (!CAS(&S->Top,t,x));[8] } #define EMPTY -1typedefintdata_type;typedefstruct node t {data_typed;struct node t *n} Node;typedefstruct stack t {struct node t *Top;} Stack; [9] data_type pop(Stack *S){[10] do {[11] Node *t = S->Top;[12] if (t == NULL)[13] return EMPTY;[14] Node *s = t->n;[15] data_typer = t->d;[16] } while (!CAS(&S->Top,t,s));[17] return r;[18] }

  49. Concurrent Shape Analysis • a thread is represented as a thread object • add predicates to vocabulary • Recipe • abstraction: canonical abstraction • transformers: interleaving + as before • Bounded threads • Static thread names • Unbounded threads • thread objects abstracted via canonical abstraction

More Related