Click here to load reader

Noam Rinetzky Lecture 14: Shape Domains & Interprocedural Analysis

  • View
    49

  • Download
    0

Embed Size (px)

DESCRIPTION

Program Analysis and Verification 0368- 4479 http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.html. Noam Rinetzky Lecture 14: Shape Domains & Interprocedural Analysis. Slides credit: Roman Manevich , Mooly Sagiv , Eran Yahav. Abstract (conservative) interpretation. - PowerPoint PPT Presentation

Text of Noam Rinetzky Lecture 14: Shape Domains & Interprocedural Analysis

Program Analysis and Verification

Program Analysis and Verification 0368-4479http://www.cs.tau.ac.il/~maon/teaching/2013-2014/paav/paav1314b.htmlNoam Rinetzky

Lecture 14: Shape Domains & Interprocedural AnalysisSlides credit: Roman Manevich, Mooly Sagiv, Eran YahavAbstract (conservative) interpretationset of statesset of statesoperational semantics(concrete semantics)statement Sset of statesabstract representationabstract semanticsstatement Sabstract representationconcretizationconcretization2The collecting latticeLattice for a given control-flow node v: Lv=(2State, , , , , State)Lattice for entire control-flow graph with nodes V:LCFG = Map(V, Lv)We will use this lattice as a baseline for static analysis and define abstractions of its elements3Galois Connection: ((a)) a13((a))2(a)aCAWhat a represents in C(its meaning)4Resulting algorithm Kleenes fixed point theorem gives a constructive method for computing the lfplfpfn()f()f2()d := while f(d) d do d := d f(d)return dAlgorithmlfp(f) = nN fn()Mathematical definition5Shape Analysis6Automatically verify properties of programs manipulating dynamically allocated storage

Identify all possible shapes (layout) of the heap 6Shape Analysis via 3-valued Logic1) Abstraction3-valued logical structurecanonical abstraction

2) Transformersvia logical formulaesoundness by construction embedding theorem, [SRW02]77Concrete Staterepresent a concrete state as a two-valued logical structureIndividuals = heap allocated objectsUnary predicates = object propertiesBinary predicates = relationsparametric vocabulary

8Topnnu1u2u3(storeless, no heap addresses)8Concrete StateS = over a vocabulary PU universe - interpretation, mapping each predicate from p to its truth value in S9Topnnu1u2u3U = { u1, u2, u3} P = { Top, n } (n)(u1,u2) = 1, (n)(u1,u3)=0, (n)(u2,u1)=0, (Top)(u1)=1, (Top)(u2)=0, (Top)(u3)=09Collecting SemanticsAt every program point a potentially infinite set of two-valued logical structuresRepresenting (at least) all possible heaps that can arise at the program point

Challenge: find a bounded abstract representation10Canonical Abstraction: Abstraction by Partinioning 11Topnnu1u2u3u1u2u3Top113-Valued Logic1 = true0 = false1/2 = unknown

A join semi-lattice, 0 1 = 1/2

121/201information orderlogical order123-Valued Logical Structures A set of individuals (nodes) URelation meaningInterpretation of relation symbols in Pp0() {0,1, 1/2}p1(v) {0,1, 1/2}p2(u,v) {0,1, 1/2}A join semi-lattice: 0 1 = 1/21313Canonical Abstraction ()Merge all nodes with the same unary predicate values into a single summary node Join predicate values

(u1 ,..., uk) = { (u1 ,..., uk) | f(u1)=u1 ,..., f(uk)=uk }

Converts a state of arbitrary size into a 3-valued abstract state of bounded size

(C) = { (c) | c C }

1414Information Loss15TopnnTopnnnTopTopTopCanonical abstractionTopnn15Shape Analysis via 3-valued Logic1) Abstraction3-valued logical structurecanonical abstraction

2) Transformersvia logical formulaesoundness by construction embedding theorem, [SRW02]1616Concrete Interpretation RulesStatementUpdate formulax =NULLx(v)= 0x= malloc()x(v) = IsNew(v)x=yx(v)= y(v)x=y next x(v)= w: y(w) n(w, v)x next=yn(v, w) = (x(v) n(v, w)) (x(v) y(w))17Example: s = Topn18Tops(v) = v1: Top(v1) n(v1,v)u1u2u3Topsu1u2u3Topu11u20u30nu1u2U3u1010u2001u3000su10u20u30Topu11u20u30nu1u2U3u1010u2001u3000su10u21u30Abstract Semantics19Tops = Topn?rToprTopToprToprTopss(v) = v1: Top(v1) n(v1,v)s = Top->n19Problem: Information Loss20TopnnTopnnnTopTopTopCanonical abstractionTopnn20Instrumentation PredicatesRecord additional derived information via predicates

21rx(v) = v1: x(v1) n*(v1,v)c(v) = v1: n(v1, v) n*(v, v1)TopnncTopcnnnTopcTopCanonical abstraction21Embedding Theorem: Conservatively Observing Properties22No Cyclesv1,v2: n(v1, v2) n*(v2, v1)1/2ToprToprTopNo cycles (derived)v:c(v)122Top23Best Transformer (s = Topn)ConcreteSemanticsCanonical AbstractionAbstractSemantics?rToprTop...ToprToprTopToprToprToprTop...TopsrToprTopTopsrToprToprTopTopsrToprTopTopsrToprToprTops(v) = v1: Top(v1) n(v1,v)23Abstract Semantics24Tops = Topn?rToprTopToprToprTopss(v) = v1: Top(v1) n(v1,v)s = Top->n24Problem: Imprecise Transformers25Semantic ReductionImprove the precision of the analysis by recovering properties of the program semanticsA Galois connection (C, , , A)An operation op:AA is a semantic reduction whenlL2 op(l)l and (op(l)) = (l)lCAop26The Focus OperationFocus: Formula((3-Struct) (3-Struct))Generalizes materializationFor every formula Focus()(X) yields structure in which evaluates to a definite values in all assignmentsOnly maximal in terms of embeddingFocus() is a semantic reductionBut Focus()(X) may be undefined for some X27ToprToprTopToprToprToprTop28Partial Concretization Based on Transformer (s=Topn)AbstractSemanticsPartial ConcretizationCanonical AbstractionAbstractSemanticsTopsrToprTopTopsrToprToprTopToprToprToprTopsTopsrToprTopToprToprTops(v) = v1: Top(v1) n(v1,v)u: top(u) n(u, v)Focus (Topn)2829Partial ConcretizationLocally refine the abstract domain per statementSoundness is immediateEmployed in other shape analysis algorithms [Distefano et.al., TACAS06, Evan et.al., SAS07, POPL08]29The Coercion PrincipleAnother Semantic ReductionCan be applied after Focus or after Update or bothIncrease precision by exploiting some structural properties possessed by all stores (Global invariants)Structural properties captured by constraintsApply a constraint solver30Apply Constraint SolverToprToprTopxToprToprTopxxrxrx,rynrx,rynnnynToprToprTopxrxrx,rynrx,rynyn31Sources of ConstraintsProperties of the operational semanticsDomain specific knowledgeInstrumentation predicatesUser supplied32Example Constraintsx(v1) x(v2)eq(v1, v2)n(v, v1) n(v,v2)eq(v1, v2)n(v1, v) n(v2,v)eq(v1, v2)is(v)n*(v3, v4)t[n](v1, v2)33Abstract Transformers: SummaryKleene evaluation yields sound solutionFocus is a statement-specific partial concretizationCoerce applies global constraints34Abstract Semantics35 { t_embed(coerce(st(w)3(focusF(w)(SS[w] ))))

(w,v) E(G), w Assignments(G){ }SS [v] = if v = entry { S | S SS[w] }

(w,v) E(G), w Skip(G) { t_embed(S) | S coerce(st(w)3(focusF(w)(SS[w] ))) and S 3 cond(w)}

(w,v) True-Branches(G) { t_embed(S) | S coerce(st(w)3(focusF(w)(SS[w] ))) and S 3 cond(w)}

(w,v) False-Branches(G)othrewiseRecap Abstractioncanonical abstraction recording derived information

Transformerspartial concretization (focus)constraint solver (coerce)sound information extraction3636Stack Pushvoid push (int v) { Node x = alloc(sizeof(Node));

xd = v;

xn = Top;

Top = x;

}

37TopxTopTopxTopTopxempxxxTopTopv:c(v)v: x(v)v: x(v)v1,v2: n(v1, v2) Top(v2)37Interprocedural Analysis38TodayAnalyzing programs with procedures

Precision (consider calling contexts)Performance 239Procedural programint p(int a) { return a + 1;}void main() { int x; x = p(7); x = p(9);}40Effect of proceduresThe effect of calling a procedure is the effect of executing its bodycall bar()foo()bar()

41Interprocedural Analysisgoal: compute the abstract effect of calling a procedurecall bar()foo()bar()

42Reduction to intraprocedural analysis Procedure inlining Naive solution: call-as-goto43Reminder: Constant Propagation-0-11ZNo informationVariable not a constant44Reminder: Constant Propagation L = (Var Z , ) 1 2 iff x: 1(x) 2(x) ordering in the Z lattice

Examples: [x , y 42, z ] [x , y 42, z 73] [x , y 42, z 73] [x , y 42, z ]1345Reminder: Constant PropagationConservative Solution Every detected constant is indeed constant But may fail to identify some constantsEvery potential impact is identified Superfluous impacts46Procedure Inliningint p(int a) { return a + 1;}void main() { int x; x = p(7); x = p(9);}47Procedure Inliningint p(int a) { return a + 1;}void main() { int x; x = p(7); x = p(9);}void main() { int a, x, ret;

a = 7; ret = a+1; x = ret;

a = 9; ret = a+1; x = ret;

}[a , x , ret ][a 7, x 8, ret 8][a 9, x 10, ret 10]48Procedure InliningPros SimpleCons Does not handle recursion Exponential blow up Reanalyzing the body of procedures p1 { call p2 call p2}p2 { call p3 call p3}p3{}49A Naive Interprocedural solutionTreat procedure calls as gotos50Simple Exampleint p(int a) { return a + 1; }void main() { int x ; x = p(7); x = p(9) ;}

51Simple Exampleint p(int a) { [a 7] return a + 1;}void main() { int x ; x = p(7); x = p(9) ;}

52Simple Exampleint p(int a) { [a 7] return a + 1; [a 7, $$ 8]

}void main() { int x ; x = p(7); x = p(9) ;}

53Simple Exampleint p(int a) { [a 7] return a + 1; [a 7, $$ 8]

}void main() { int x ; x = p(7); [x 8] x = p(9) ; [x 8]}

54Simple Exampleint p(int a) { [a 7] return a + 1; [a 7, $$ 8]

}void main() { int x ; x = p(7); [x 8] x = p(9) ; [x 8]}

55Simple Exampleint p(int a) { [a 7] [a 9] return a + 1; [a 7, $$ 8]

}void main() { int x ; x = p(7); [x 8] x = p(9) ; [x 8]}

56Simple Exampleint p(int a) { [a ] return a + 1; [a 7, $$ 8]

}void main() { int x ; x = p(7); [x 8] x = p(9) ; [x 8]}

57Simple Exampleint p(int a) { [a ] return a + 1; [a , $$ ]

}void main() { int x ; x = p(7); [x 8] x = p(9); [x 8]

}

58Simple Exampleint p(int a) { [a ] return a + 1; [a , $$ ]

}void main() { int x ; x = p(7) ; [x ] x = p(9) ; [x ]

}

59A Naive Interprocedural solutionTreat procedure calls as gotosPros: Simple Usually fast Cons: Abstract call/

Search related