Finding optimum abstractions in parametric dataflow analysis
Download
1 / 39

Finding Optimum Abstractions in Parametric Dataflow Analysis - PowerPoint PPT Presentation


  • 99 Views
  • Uploaded on

Finding Optimum Abstractions in Parametric Dataflow Analysis. Xin Zhang Georgia Tech. Mayur Naik Georgia Tech. Hongseok Yang University of Oxford. A Key Challenge for Static Analysis. Scalability. Precision. Our setting. Abstraction a. assert(x != null). Static Analysis S. Program p.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Finding Optimum Abstractions in Parametric Dataflow Analysis' - damita


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Finding optimum abstractions in parametric dataflow analysis

Finding Optimum Abstractions in Parametric Dataflow Analysis

Xin Zhang

Georgia Tech

MayurNaik

Georgia Tech

Hongseok Yang

University of Oxford



Our setting
Our setting

Abstraction a

assert(x != null)

Static Analysis S

Program p

Query q

p ` q

p 0 q


Our setting1
Our setting

a1

a2

S

S

p

q1

q2

p ` q1 ?

p ` q2 ?


Our setting2
Our setting

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Example 1 predicate abstraction
Example 1: Predicate Abstraction

Predicates to use as abstraction predicates

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Example 2 cloning based pointer analysis
Example 2: Cloning­‐based Pointer Analysis

K value to use for each call and each allocation site

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Problem statement
Problem Statement

  • An efficient algorithm with:

    INPUTS:

    • program p and property q

    • abstractions A = { a1, …, an }

    • boolean function S(p, q, a)

      OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

      8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

a

S

p

q

Optimum Abstraction

p ` q ?


Problem statement1
Problem Statement

1111 most expensive

  • An efficient algorithm with:

    INPUTS:

    • program p and property q

    • abstractions A = { a1, …, an }

    • boolean function S(p, q, a)

      OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

      8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

A

S(p, q, a)

!S(p, q, a)

0110 optimum

0000 least expensive

Optimum Abstraction


Example typestate analysis
Example: Typestate Analysis

Type-state set ts

open()

x = new File;

<{closed}, {x}>

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

opened

closed

close()

close()

open()

error


Example typestate analysis1
Example: Typestate Analysis

Must-alias accesspath set ms

x = new File;

<{closed}, {x}>

y = x;

<{closed}, {x}>

z = x;

<{closed}, {x}>

x.open();

<{opened}, {x}>

y.close();

<{opened, closed}, {x}>

assert1(x, closed);

assert2(x, opened);

Only allows the accesspaths specified in the abstraction

Strong update

Weak update

Failed

Failed


Example typestate analysis2
Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);


Example typestate analysis3
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

{}

Failed

Naïve approach: calculating weakest precondition (WP)


Example typestate analysis4
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

unreachable

Exponential Blowup!

{}

Failed

Naïve approach: calculating weakest precondition (WP)


Example typestate analysis5
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Too large?

Let’s ignore part of it!


Example typestate analysis6
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Unreachable


Example typestate analysis7
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Intersect with the forward state


Example typestate analysis8
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Keep as many disjuncts as possible

Intersect with forward state


Example typestate analysis9
Example: Typestate Analysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis10
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis11
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis12
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis13
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x, y}>

z = x;

↓<{closed}, {x, y}>

x.open();

↓<{opened}, {x, y}>

y.close();

↓<{closed}, {x, y}>

assert1(x, closed);

Proof!

Our approach: WP + Underapproximation


Example typestate analysis14
Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis15
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis16
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis17
Example: TypestateAnalysis

In paper: a general framework for parametric dataflow analysis

Impossibility!

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Experiment
Experiment

  • Implementation in Chord for Java programs

  • 2 Client Analyses: Typestate and Thread-Escape

    • Both fully context- and flow-sensitive analyses

    • Only scale with sparse parameters

  • 7 Java Benchmarks



Precision thread escape analysis
Precision: Thread-Escape Analysis

209 221 552 658 5857 14322 6726 (Total # Queries)

Resolved: ~90%

Previous: ~40% [POPL12]


Precision typestate analysis
Precision: Typestate Analysis

12 72 170 71 7903 5052 3644 (Total # Queries)



Scalability number of iterations1
Scalability: Number of iterations






Related work
Related work

  • Modern pointer analysis

    • Demand-driven, query-driven, …

    • Heintze & Tardieu ’01, Guyer & Lin ’03, Sridharan & Bodik’06, ...

  • CEGAR model checkers: SLAM, BLAST, YOGI, …

    • Work on concrete counterexamples

      • Can disprove queries

No optimality guarantee – can over-refineand hurt scalability.

No impossibility - can cause divergence.



ad