Finding optimum abstractions in parametric dataflow analysis
This presentation is the property of its rightful owner.
Sponsored Links
1 / 39

Finding Optimum Abstractions in Parametric Dataflow Analysis PowerPoint PPT Presentation


  • 63 Views
  • Uploaded on
  • Presentation posted in: General

Finding Optimum Abstractions in Parametric Dataflow Analysis. Xin Zhang Georgia Tech. Mayur Naik Georgia Tech. Hongseok Yang University of Oxford. A Key Challenge for Static Analysis. Scalability. Precision. Our setting. Abstraction a. assert(x != null). Static Analysis S. Program p.

Download Presentation

Finding Optimum Abstractions in Parametric Dataflow Analysis

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Finding optimum abstractions in parametric dataflow analysis

Finding Optimum Abstractions in Parametric Dataflow Analysis

Xin Zhang

Georgia Tech

MayurNaik

Georgia Tech

Hongseok Yang

University of Oxford


A key challenge for static analysis

A Key Challenge for Static Analysis

Scalability

Precision


Our setting

Our setting

Abstraction a

assert(x != null)

Static Analysis S

Program p

Query q

p ` q

p 0 q


Our setting1

Our setting

a1

a2

S

S

p

q1

q2

p ` q1 ?

p ` q2 ?


Our setting2

Our setting

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Example 1 predicate abstraction

Example 1: Predicate Abstraction

Predicates to use as abstraction predicates

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Example 2 cloning based pointer analysis

Example 2: Cloning­‐based Pointer Analysis

K value to use for each call and each allocation site

Predicates to use in predicate abstraction

S

S

p

q1

q2

p ` q1?

p ` q2 ?


Problem statement

Problem Statement

  • An efficient algorithm with:

    INPUTS:

    • program p and property q

    • abstractions A = { a1, …, an }

    • boolean function S(p, q, a)

      OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

      8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

a

S

p

q

Optimum Abstraction

p ` q ?


Problem statement1

Problem Statement

1111 most expensive

  • An efficient algorithm with:

    INPUTS:

    • program p and property q

    • abstractions A = { a1, …, an }

    • boolean function S(p, q, a)

      OUTPUT:

    • Proof: a 2 A: S(p, q, a) = true

      8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a

    • Impossibility: @ a 2 A: S(p, q, a) = true

A

S(p, q, a)

!S(p, q, a)

0110 optimum

0000 least expensive

Optimum Abstraction


Example typestate analysis

Example: Typestate Analysis

Type-state set ts

open()

x = new File;

<{closed}, {x}>

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

opened

closed

close()

close()

open()

error


Example typestate analysis1

Example: Typestate Analysis

Must-alias accesspath set ms

x = new File;

<{closed}, {x}>

y = x;

<{closed}, {x}>

z = x;

<{closed}, {x}>

x.open();

<{opened}, {x}>

y.close();

<{opened, closed}, {x}>

assert1(x, closed);

assert2(x, opened);

Only allows the accesspaths specified in the abstraction

Strong update

Weak update

Failed

Failed


Example typestate analysis2

Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);


Example typestate analysis3

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

{}

Failed

Naïve approach: calculating weakest precondition (WP)


Example typestate analysis4

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

unreachable

Exponential Blowup!

{}

Failed

Naïve approach: calculating weakest precondition (WP)


Example typestate analysis5

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Too large?

Let’s ignore part of it!


Example typestate analysis6

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Unreachable


Example typestate analysis7

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Intersect with the forward state


Example typestate analysis8

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Keep as many disjuncts as possible

Intersect with forward state


Example typestate analysis9

Example: Typestate Analysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis10

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis11

Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis12

Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z= x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened}, {x}>

assert1(x, closed);

Failed

Our approach: WP + Underapproximation


Example typestate analysis13

Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x, y}>

z = x;

↓<{closed}, {x, y}>

x.open();

↓<{opened}, {x, y}>

y.close();

↓<{closed}, {x, y}>

assert1(x, closed);

Proof!

Our approach: WP + Underapproximation


Example typestate analysis14

Example: TypestateAnalysis

x = new File;

y = x;

z = x;

x.open();

y.close();

assert1(x, closed);

assert2(x, opened);

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis15

Example: TypestateAnalysis

x = new File;

↓<{closed}, {}>

y = x;

↓<{closed}, {}>

z = x;

↓<{closed}, {}>

x.open();

↓<{closed, opened}, {}>

y.close();

↓top

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis16

Example: TypestateAnalysis

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Example typestate analysis17

Example: TypestateAnalysis

In paper: a general framework for parametric dataflow analysis

Impossibility!

x = new File;

↓<{closed}, {x}>

y = x;

↓<{closed}, {x}>

z = x;

↓<{closed}, {x}>

x.open();

↓<{opened}, {x}>

y.close();

↓<{opened,closed}, {x}>

assert2(x, opened);

Failed

Our approach: WP + Underapproximation


Experiment

Experiment

  • Implementation in Chord for Java programs

  • 2 Client Analyses: Typestate and Thread-Escape

    • Both fully context- and flow-sensitive analyses

    • Only scale with sparse parameters

  • 7 Java Benchmarks


Benchmarks

Benchmarks


Precision thread escape analysis

Precision: Thread-Escape Analysis

209 221 552 658 5857 14322 6726 (Total # Queries)

Resolved: ~90%

Previous: ~40% [POPL12]


Precision typestate analysis

Precision: Typestate Analysis

12 72 170 71 7903 5052 3644 (Total # Queries)


Scalability number of iterations

Scalability: Number of iterations


Scalability number of iterations1

Scalability: Number of iterations


Scalability running time

Scalability: Running time


Scalability running time1

Scalability: Running time


Size of optimal abstractions

Size of optimal abstractions


Size of optimal abstractions1

Size of optimal abstractions


Related work

Related work

  • Modern pointer analysis

    • Demand-driven, query-driven, …

    • Heintze & Tardieu ’01, Guyer & Lin ’03, Sridharan & Bodik’06, ...

  • CEGAR model checkers: SLAM, BLAST, YOGI, …

    • Work on concrete counterexamples

      • Can disprove queries

No optimality guarantee – can over-refineand hurt scalability.

No impossibility - can cause divergence.


Thank you

Thank you!

Q&A


  • Login