finding optimum abstractions in parametric dataflow analysis
Download
Skip this Video
Download Presentation
Finding Optimum Abstractions in Parametric Dataflow Analysis

Loading in 2 Seconds...

play fullscreen
1 / 39

Finding Optimum Abstractions in Parametric Dataflow Analysis - PowerPoint PPT Presentation


  • 100 Views
  • Uploaded on

Finding Optimum Abstractions in Parametric Dataflow Analysis. Xin Zhang Georgia Tech. Mayur Naik Georgia Tech. Hongseok Yang University of Oxford. A Key Challenge for Static Analysis. Scalability. Precision. Our setting. Abstraction a. assert(x != null). Static Analysis S. Program p.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Finding Optimum Abstractions in Parametric Dataflow Analysis' - damita


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
finding optimum abstractions in parametric dataflow analysis

Finding Optimum Abstractions in Parametric Dataflow Analysis

Xin Zhang

Georgia Tech

MayurNaik

Georgia Tech

Hongseok Yang

University of Oxford

our setting
Our setting

Abstraction a

assert(x != null)

Static Analysis S

Program p

Query q

p ` q

p 0 q

our setting1
Our setting

a1

a2

S

S

p

q1

q2

p ` q1 ?

p ` q2 ?

our setting2
Our setting

S

S

p

q1

q2

p ` q1?

p ` q2 ?

example 1 predicate abstraction
Example 1: Predicate Abstraction

Predicates to use as abstraction predicates

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?

example 2 cloning based pointer analysis
Example 2: Cloning­‐based Pointer Analysis

K value to use for each call and each allocation site

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?

problem statement
Problem Statement
  • An efficient algorithm with:

INPUTS:

    • program p and property q
    • abstractions A = { a1, …, an }
    • boolean function S(p, q, a)

OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

a

S

p

q

Optimum Abstraction

p ` q ?

problem statement1
Problem Statement

1111 most expensive

  • An efficient algorithm with:

INPUTS:

    • program p and property q
    • abstractions A = { a1, …, an }
    • boolean function S(p, q, a)

OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

A

S(p, q, a)

!S(p, q, a)

0110 optimum

0000 least expensive

Optimum Abstraction

example typestate analysis
Example: Typestate Analysis

Type-state set ts

open()

x = new File;

<{closed}, {x}>

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

opened

closed

close()

close()

open()

error

example typestate analysis1
Example: Typestate Analysis

Must-alias accesspath set ms

x = new File;

<{closed}, {x}>

y = x;

<{closed}, {x}>

z = x;

<{closed}, {x}>

x.open();

<{opened}, {x}>

y.close();

<{opened, closed}, {x}>

assert1(x, closed);

assert2(x, opened);

Only allows the accesspaths specified in the abstraction

Strong update

Weak update

Failed

Failed

example typestate analysis2
Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

example typestate analysis3
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

{}

Failed

Naïve approach: calculating weakest precondition (WP)

example typestate analysis4
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

unreachable

Exponential Blowup!

{}

Failed

Naïve approach: calculating weakest precondition (WP)

example typestate analysis5
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Too large?

Let’s ignore part of it!

example typestate analysis6
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Unreachable

example typestate analysis7
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Intersect with the forward state

example typestate analysis8
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Keep as many disjuncts as possible

Intersect with forward state

example typestate analysis9
Example: Typestate Analysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation

example typestate analysis10
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation

example typestate analysis11
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation

example typestate analysis12
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation

example typestate analysis13
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x, y}>

z = x;

↓<{closed}, {x, y}>

x.open();

↓<{opened}, {x, y}>

y.close();

↓<{closed}, {x, y}>

assert1(x, closed);

Proof!

Our approach: WP + Underapproximation

example typestate analysis14
Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation

example typestate analysis15
Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation

example typestate analysis16
Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation

example typestate analysis17
Example: TypestateAnalysis

In paper: a general framework for parametric dataflow analysis

Impossibility!

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation

experiment
Experiment
  • Implementation in Chord for Java programs
  • 2 Client Analyses: Typestate and Thread-Escape
    • Both fully context- and flow-sensitive analyses
    • Only scale with sparse parameters
  • 7 Java Benchmarks
precision thread escape analysis
Precision: Thread-Escape Analysis

209 221 552 658 5857 14322 6726 (Total # Queries)

Resolved: ~90%

Previous: ~40% [POPL12]

precision typestate analysis
Precision: Typestate Analysis

12 72 170 71 7903 5052 3644 (Total # Queries)

related work
Related work
  • Modern pointer analysis
    • Demand-driven, query-driven, …
    • Heintze & Tardieu ’01, Guyer & Lin ’03, Sridharan & Bodik’06, ...
  • CEGAR model checkers: SLAM, BLAST, YOGI, …
    • Work on concrete counterexamples
      • Can disprove queries

No optimality guarantee – can over-refineand hurt scalability.

No impossibility - can cause divergence.

ad