Predicate Abstraction and Canonical Abstraction for Singly - linked Lists

1. Predicate Abstraction andCanonical Abstractionfor Singly-linked Lists Roman ManevichMooly SagivTel Aviv University Eran Yahav G. RamalingamIBM T.J. Watson

2. curr Motivating Example 1: CEGAR curr = head; while (curr != tail) { assert (curr != null); curr = curr.n; } Counterexample-guided abstraction refinement generates following predicates:curr.n ≠ null ,curr.n.n ≠ null ,… after i refinement steps:curr(.n)i ≠ null n n n n … tail head

3. curr Motivating Example 1: CEGAR curr = head; while (curr != tail) { assert (curr != null); curr = curr.n; } n n n n … tail head In general, problem is undecidable:V. Chakaravathy [POPL 2003] State-of-the-art canonical abstractions can prove assertion

4. Motivating Example 2 // @pre cyclic(x)t = null; y = x; while (t != x && y.data < low) { t = y.n; y = t; } z = y; while (z != x && z.data < high) { t = z.n; z = t; } t = null; if (y != z) { y.n = null; y.n = z; }// @post cyclic(x)

5. Motivating Example 2 @pre cyclic(x) @post cyclic(x) z z n n n n n x x n n n n n n n y y

6. Existing Canonical Abstraction concrete abstract z,cnrx,ry,rz order between variables lost!cannot establish @post cyclic(x) z n n n n x,cnrx,ry,rz x n n n n n n n cnrx,ry,rz n n n y y,cnrx,ry,rz

7. Overview and Main Results • Current predicate abstraction refinement methods not adequate for analyzing heaps • Predicate abstraction can simulate arbitrary finite abstract domains • Often requires too many predicates • New family of abstractions for lists • Bounded number of sharing patterns • Handles cycles more precisely than existing canonical abstractions • Encode abstraction with two methods: • Canonical abstraction • Polynomial predicate abstraction

8. Outline • New abstractions for lists • Observations on concrete shapes • Static naming scheme • Encoding via predicate abstraction • Encoding via canonical abstraction • Controlling the number of predicates via heap-sharing depth parameter • Experimental results • Related work • Conclusion

9. Concrete Shapes • Assume the following class of (list-) heaps • Heap contains only singly-linked lists • No garbage (easy to handle) • A heap can be decomposed into • Basic shape (sharing pattern) • List lengths

10. Concrete Shapes class SLL {Object value; SLL n;} n n n n n n n n n n x n n n n y

11. Interrupting Nodes Interruption: node pointed-to by a variableor shared by n fields n n n n n n n n n n x n n n n y #interruptions ≤ 2 · #variables(bounded number of sharing patterns)

12. Maximal Uninterrupted Lists Maximal uninterrupted list: maximal list segment between two interruptionsnot containing interruptions in-between n n n n n n n n n n x n n n n y

13. Maximal Uninterrupted Lists max. uninterrupted 1 max. uninterrupted 2 n n n n n n n n n n x n n n n y max. uninterrupted 3 max. uninterrupted 4

14. Maximal Uninterrupted Lists number of links 4 2 n n n n n n n n n n x 4 4 n n n n y

15. Maximal Uninterrupted Lists Abstract lengths: {1,2,>2} >2 2 n n n n n n n n n n x >2 >2 n n n n y

16. Using Static Names • Goal: name all sharing patterns • Prepare static names for interruptions • Derive predicates for canonical abstraction • Prepare static names for max. uninterrupted lists • Derive predicates for predicate abstraction • All names expressed by FOTC formulae

17. Naming Interruptions We name interruptions by adding auxiliary variables For every variable x : x1,…,xk (k=#variables) x2 x1 n n n n n n n n n n x x n n n n y y y1 y2

18. Naming Max. Uninterrupted Lists [x1,x2][x1,y2][y1,x2][y1,y2] [x,x1][x,y1] x2 x1 n n n n n n n n n n x x n n n n y y y1 [x2,x2][x2,y2][y2,x2][y2,y2] y2 [y,x1][y,y1]

19. A Predicate Abstraction • For every pair of variables x,y (regular and auxiliary) • Aliased[x,y] = x and y point to same node • UList1[x,y] = max. uninterrupted list of length 1 • UList2[x,y] = max. uninterrupted list of length 2 • UList[x,y] = max. uninterrupted list of any length • For every variable x (regular and auxiliary) • UList1[x,null] = max. uninterrupted list of length 1 • UList2[x,null] = max. uninterrupted list of length 2 • UList[x,null] = max. uninterrupted list of any length • Predicates expressed by FOTC formulae

20. Predicate Abstraction Example x2 x1 n n n n n n n n n n x x concrete n n n n y y y1 y2 abstract

21. A Canonical Abstraction • For every variable x (regular and auxiliary) • x(v) = v is pointed-to by x • cul[x](v) = uninterrupted list from node pointed-to by x to v • Predicates expressed by FOTC formulae

22. Canonical Abstraction Example concrete cul[x1]cul[y1] cul[x2]cul[y2] cul[x] x2 x1 n n n n n n n n n n x x n n n n y y y1 y2 cul[y]

23. Canonical Abstraction Example abstract cul[x1]cul[y1] cul[x2]cul[y2] cul[x] x2 x1 n n n n n n x x n n n n y y y1 n y2 cul[y]

24. Canonical Abstractionof Cyclic List concrete abstract cul[z] z z n n n n n x x n n n n n n n n n cul[x] cul[y] y y

25. Canonical Abstractionof Cyclic List abstract pre abstract post cul[z] z cul[z] z n n n n x x n n n n n n n n cul[x] cul[x] cul[y] cul[y] y y

26. Heap-sharing Depth In this example the heap-sharing depth is 2In practice depth expected to be low (≤ 1) x2 x1 n n n n n n n n n n x x n n n n y y y1 y2

27. Setting the Heap-sharing Depth Setting the heap-sharing depth parameter to 1results in lost information about shape x1 n n n n n n n n n n x x n n n n y y y1 Heap-sharing depth parameter d determinesnumber of static names : control over number of predicates

28. Experimental Results

29. Related Work • Dor, Rode and Sagiv [SAS ’00] • Checking cleanness in lists • Sagiv, Reps and Wilhelm [TOPLAS ‘02] • General framework + abstractions for lists • Dams and Namjoshi [VMCAI ’03] • Semi-automatic predicate abstraction for shape analysis • Balaban, Pnueli and Zuck [VMCAI ’05] • Predicate abstraction for shapes via small models • Deutsch [PLDI ’94] • Symbolic access paths with lengths

30. Conclusion • New abstractions for lists • Observations about concrete shapes • Precise for programs containing heaps with sharing and cycles, ignoring list lengths • Parametric in sharing-depth d:[1…k] • Encoded new abstractions via • Canonical abstraction O(d·k) • Polynomial predicate abstraction O(d2·k2) • d=1 sufficient for all examples

31. Missing from Talk • Simulating abstract domains by pred. abs. • Formal definition of abstractions • Abstract transformers • Decidable logic  can be automatically derived • Abstraction equivalence:for every two concrete heaps H1,H2βPA(H1)=βPA(H2) iff βC(H1)=βC(H2) • Abstractions with less predicates • Cycle breaking • Linear static naming scheme

32. Merci

33. Simulating Finite Domainsby Predicate Abstraction • Assume finite abstract domain of numbered elements {1,…,n} • Naïve simulation • Predicates {Pi} i=1…n • Pi Holds when abstract program state is i • Simulation using logarithmic number of predicates • Use binary representation of numbers • Predicates {Pj} j=1…log n • Pj Holds when j-th bit of abstract program state is 1