Hybrid Top-down and Bottom-up Interprocedural Analysis

  • View
    87

  • Download
    8

Embed Size (px)

DESCRIPTION

Hybrid Top-down and Bottom-up Interprocedural Analysis. Xin Zhang, Ravi Mangal , Mayur Naik Georgia Tech. Hongseok Yang Oxford University. Two approaches to interprocedural analysis. Top-down approach. Bottom-up approach. m ain(){ f(); … f(); }. f(){ g (); - PowerPoint PPT Presentation

Text of Hybrid Top-down and Bottom-up Interprocedural Analysis

On Abstraction Refinement for Program Analyses in Datalog

Hybrid Top-down and Bottom-up Interprocedural AnalysisXin Zhang, Ravi Mangal, Mayur NaikGeorgia TechHongseok YangOxford University

16/10/20142Two approaches to interprocedural analysisProgramming Language Design and Implementation, 2014Top-down approachBottom-up approachmain(){ f(); f();}f(){ g(); g();}26/10/20143Two approaches to interprocedural analysisProgramming Language Design and Implementation, 2014Consider only contexts in program.Monomorphic summaries.Low reusability.Blow-up with number of contexts.Cheap to compute.Cheap to instantiate.Easy to implement.Consider all possible contexts.Polymorphic summaries.High reusability.Blow-up with number of cases.Expensive to compute.Expensive to instantiate.Hard to implement.Top-down approachBottom-up approachSWIFT36/10/20144Typestate analysis example [Fink et al. ISSTA06]Programming Language Design and Implementation, 2014main() { v1 = new File(); // h1p1: foo(v1); v2 = new File(); // h2p2: foo(v2); v3 = new File(); // h3p3: foo(v3);}

foo(File f) { f.open(); f.close();}openederrorclosedopenclosecloseopen6/10/20145Top-down approachProgramming Language Design and Implementation, 2014Allocation sitefoo(File f) {

f.open();

f.close();

}6/10/20146Top-down approachProgramming Language Design and Implementation, 2014Type-statefoo(File f) {

f.open();

f.close();

}6/10/20147Top-down approachProgramming Language Design and Implementation, 2014Must-alias accesspath setfoo(File f) {

f.open();

f.close();

}6/10/20148Top-down approachProgramming Language Design and Implementation, 2014Must-not-alias accesspath setfoo(File f) {

f.open();

f.close();

}6/10/20149Top-down approachProgramming Language Design and Implementation, 2014foo(File f) {

f.open();

f.close();

}6/10/201410Top-down approachProgramming Language Design and Implementation, 2014Top-down summariesT16/10/201411Top-down approachProgramming Language Design and Implementation, 2014Top-down summariesfoo(File f) { f.open();f.close();}Low ReusabilityT26/10/201412Bottom-up approachProgramming Language Design and Implementation, 20146/10/201413Bottom-up approachProgramming Language Design and Implementation, 2014Symbolic abstract object6/10/201414Bottom-up approachProgramming Language Design and Implementation, 2014Case condition6/10/201415Bottom-up approachProgramming Language Design and Implementation, 2014f.open()Exponential blowup6/10/201416Bottom-up approachProgramming Language Design and Implementation, 2014f.close()6/10/201417Bottom-up approachProgramming Language Design and Implementation, 2014foo(File f) { f.open(); f.close();}Bottom-up summaries6/10/201418Top-down summaries vs. bottom-up summariesProgramming Language Design and Implementation, 2014Bottom-up summariesTop-down summaries6/10/201419Top-down summaries vs. bottom-up summariesProgramming Language Design and Implementation, 2014Bottom-up summariesTop-down summaries6/10/201420Programming Language Design and Implementation, 2014Top-downBottom-upf(){ a; }aprune6/10/201421Programming Language Design and Implementation, 2014Top-down summaries6/10/201422Programming Language Design and Implementation, 2014Top-down summariesf.open()6/10/201423Programming Language Design and Implementation, 2014Top-down summariesf.open()6/10/201424Programming Language Design and Implementation, 2014foo(File f) { f.open(); f.close();}Bottom-up summaries6/10/201425Programming Language Design and Implementation, 2014Bottom-up summariesGeneric framework atop JChord to analyze Java programsTop-down part (TD) based on tabulation algorithmBottom-up part (BU) based on relational analysis with pruning

Obligations on analysis designer:TD and BU instances meeting certain coincidence conditionsValues of parameters k and

Instantiated the framework for:Type-state analysis (based on SAFE [Fink et al. ISSTA06])kill-gen analyses (reaching definitions, live variables, etc.)6/10/201426ImplementationProgramming Language Design and Implementation, 20146/10/201427BenchmarksProgramming Language Design and Implementation, 2014classesmethodsbytecode (KB)KLOCjpat-p1767663978elevator1888995288toba-s1587455669javasrc-p1357896066hedc3532.1k140153antlr3502.4k186131luindex6193.7k235190lusearch6403.9k250198kawa-c5293.4k174186avrora1.5k6.2k325193rhino-a3302.3k162153sablecc-j8765.1k276257TD(top-down)BU(bottom-up)SWIFTspeedupover TDspeedupover BUjpat-p0.91s15.62s1.79s0.5X9Xelevator1.59s6m35s3.36s0.5X118Xtoba-s20.4stimeout5s4X-javasrc-p4m44stimeout12s24X-hedc22m57stimeout41s33X-antlr35m28stimeout36s59X-luindex43m26stimeout1m53s23X-lusearch31m39stimeout1m52s17X-kawa-c23m52stimeout1m6s22X-avroratimeouttimeout6m35s--rhino-atimeouttimeout6m39s--sable-cctimeouttimeout4m25s--6/10/201428Experiment results: running time (k = 5, = 1)Programming Language Design and Implementation, 2014top-downbottom-upTDSWIFTdropBUSWIFTdropjpat-p6.5k1.7k74%2.3k0.3k87%elevator8.4k2.9k66%12k0.5k96%toba-s68.5k3.5k95%-0.6k-javasrc-p319k5k98%-0.7k-hedc891k11k99%-1.8k-antlr1.3m13k99%-2k-luindex2.3m20k99%-3k-lusearch1.9m21k99%-3.5k-kawa-c1.7m19k99%-3k-avrora-91k--5.4k-rhino-a-16k--2k-sable-cc-26k--4.8k-6/10/201429Experiment results: number of summariesProgramming Language Design and Implementation, 2014

6/10/201430Number of top-down summaries per methodProgramming Language Design and Implementation, 20146/10/201431Number of top-down summaries per methodProgramming Language Design and Implementation, 2014

Applying SWIFT to analyses with richer abstract domainsPredicate abstraction, shape analysis, integer analysis, etc.

Automating SWIFT to reduce analysis designer obligationsIdentifying analysis classes like kill/genAutomatically synthesizing TD from BU, or vice versa

Extending SWIFT to reuse summaries across programsPrograms increasingly use large libraries (e.g., JDK, Android)Key challenge: higher-order functions (callbacks)

6/10/201432Future directionsProgramming Language Design and Implementation, 2014A new approach for scaling interprocedural analysisSynergistically combines two dominant approaches:top-down and bottom-up

General formal framework embodying the approachCoincidence conditions and tuning parameters

Implementation of the framework for JavaInstantiated on type-state analysis and kill/gen analysesOutperforms baseline approaches on upto 250 KLOC6/10/201433ConclusionProgramming Language Design and Implementation, 2014