Abstractions from Tests Mayur Naik (Georgia Institute of Technology) - - PowerPoint PPT Presentation

▶
abstractions from tests
SMART_READER_LITE
LIVE PREVIEW

Abstractions from Tests Mayur Naik (Georgia Institute of Technology) - - PowerPoint PPT Presentation

Nov 09, 2022 716 likes •1.39k views

Abstractions from Tests Mayur Naik (Georgia Institute of Technology) Hongseok Yang (University of Oxford) Ghila Castelnuovo (Tel-Aviv University) Mooly Sagiv (Tel-Aviv University) Monday, 27 February 2012 Motivation Great success stories

slide-1
SLIDE 1

Abstractions from Tests

Mayur Naik (Georgia Institute of Technology) Hongseok Yang (University of Oxford) Ghila Castelnuovo (Tel-Aviv University) Mooly Sagiv (Tel-Aviv University)

Monday, 27 February 2012

slide-2
SLIDE 2

Motivation

  • Great success stories in automatic program

verification based on static analysis techniques (SDV, Astree, etc).

  • Yet balancing precision and performance of a

static analysis is still an art.

  • We want to do this balancing automatically.

Monday, 27 February 2012

slide-3
SLIDE 3

Typical static analysis

program P query q parameterised static analysis proved don’t know

Monday, 27 February 2012

slide-4
SLIDE 4

Our approach

program P query q parameterised static analysis proved don’t know parameter

Monday, 27 February 2012

slide-5
SLIDE 5

Our approach

program P query q dynamic analysis parameter inference parameterised static analysis disproved proved don’t know info parameter

Monday, 27 February 2012

slide-6
SLIDE 6

Hypothesis

  • If a query is simple, we can find why the query holds

simply by looking at a few execution traces.

Monday, 27 February 2012

slide-7
SLIDE 7

parameter inference instrumented states s,s’ GOOD BAD ɳ0 ɳ1 ɳ parameter ɳ s,s’

Parameter inference based on separability and minimality

Monday, 27 February 2012

slide-8
SLIDE 8

parameter inference GOOD BAD ɳ0 ɳ1 Can separate? ɳ parameter ɳ s,s’ instrumented states s,s’

Parameter inference based on separability and minimality

Monday, 27 February 2012

slide-9
SLIDE 9

parameter inference instrumented states s,s’ GOOD BAD ɳ0 ɳ1 Can separate? ɳ parameter ɳ s0,s1

Parameter inference based on separability and minimality

Monday, 27 February 2012

slide-10
SLIDE 10

parameter inference instrumented states s,s’ GOOD BAD ɳ0 ɳ1 Can separate? ɳ parameter ɳ s0,s1

Parameter inference based on separability and minimality

Monday, 27 February 2012

slide-11
SLIDE 11

parameter inference instrumented states s,s’ GOOD BAD ɳ0 ɳ1 Can separate? YES NO ɳ parameter ɳ s,s’

Parameter inference based on separability and minimality

  • Computes a separability condition.
  • Among separable ɳi, choose a minimal ɳ according

to an order (approximately reflecting precision).

Monday, 27 February 2012

slide-12
SLIDE 12

parameter inference instrumented states s,s’ GOOD BAD ɳ0 ɳ1 Can separate? YES NO ɳ parameter ɳ s,s’

  • Computes a separability condition.
  • Among separable ɳi’s, choose a minimal ɳ according

to an order (which approximately reflects precision).

Parameter inference based on separability and minimality

Monday, 27 February 2012

slide-13
SLIDE 13

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-14
SLIDE 14

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-15
SLIDE 15

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-16
SLIDE 16

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h0 x0

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-17
SLIDE 17

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h1 h0 x0 x1

f1

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-18
SLIDE 18

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h1 h0 h2 x0 x1 x2

f1 f2

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-19
SLIDE 19

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h1 h0 h2 h3 x0 x1 x2 x3

f1 f2 f3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-20
SLIDE 20

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h1 h0 h2 h3 x0 x1 x2 x3

f1 f2 f3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-21
SLIDE 21

Thread-escape query

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } h1 h0 h2 h3 x0 x1 x2 x3

f1 f2 f3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-22
SLIDE 22

Thread-escape query

h1 h0 h2 h3 x0 x1 x2 x3

f1 f2 f3

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-23
SLIDE 23

Thread-escape query

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } x0 x1 x2 x3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-24
SLIDE 24

Thread-escape query

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } x0 x1 x2 x3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-25
SLIDE 25

Thread-escape query

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } x0 x1 x2 x3

  • Does a local variable point to an object that

cannot be reached from other threads?

Monday, 27 February 2012

slide-26
SLIDE 26

Thread-escape analysis

  • Summarise all heap objects with only two

abstract nodes E and L.

  • ɤ(E) consists of all the thread-escaping
  • bjects and possibly more.
  • ɤ(L) contains only thread-local objects.

Monday, 27 February 2012

slide-27
SLIDE 27

Parameterisation

  • For each allocation site, it decides whether L
  • r E is used to summarise allocated objects.
  • Changes the transfer function of “x=new hi”.
  • Objects summarised by L can move to E, but

not vice versa.

Param = AllocSite → {l, e}

Monday, 27 February 2012

slide-28
SLIDE 28

Thread-escape analysis

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

Monday, 27 February 2012

slide-29
SLIDE 29

Thread-escape analysis

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

Monday, 27 February 2012

slide-30
SLIDE 30

Thread-escape analysis

E

x0

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-31
SLIDE 31

Thread-escape analysis

E

x0 x1

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-32
SLIDE 32

Thread-escape analysis

L E

x0 x1 x2

f2

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-33
SLIDE 33

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-34
SLIDE 34

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-35
SLIDE 35

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-36
SLIDE 36

Thread-escape analysis

E

x0 x1 x2 x3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-37
SLIDE 37

Thread-escape analysis

E

x0 x1 x2 x3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-38
SLIDE 38

Thread-escape analysis

E

x0 x1 x2 x3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-39
SLIDE 39

Thread-escape analysis

L E

x0 x2

f2

x1 x2 x3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-40
SLIDE 40

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-41
SLIDE 41

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-42
SLIDE 42

Thread-escape analysis

L E

x0 x1 x2 x3

f2 f3

  • Parameter ɳ = [{h0,h1}↦E, {h2,h3}↦L]

for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-43
SLIDE 43

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • But more L doesn’t always mean more precision.

Monday, 27 February 2012

slide-44
SLIDE 44

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • But more L doesn’t always mean more precision.

L E

x0 x1 x2 x3

f2 f3

L E

x0 x1 x2 x3

f1 f2 f3

[{h0,h1}↦E, {h2,h3}↦L] [{h0}↦E, {h1,h2,h3}↦L]

Monday, 27 February 2012

slide-45
SLIDE 45

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

Monday, 27 February 2012

slide-46
SLIDE 46

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-47
SLIDE 47

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

for (i = 0; i < n; i++) { x0 = new h0/L; x1 = new h1/L; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-48
SLIDE 48

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

L

x0 x1 x2 x3

f1 f2 f3

for (i = 0; i < n; i++) { x0 = new h0/L; x1 = new h1/L; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-49
SLIDE 49

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

E

x0 x1 x2 x3 for (i = 0; i < n; i++) { x0 = new h0/L; x1 = new h1/L; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-50
SLIDE 50

Difficulties in choosing a good parameter

  • Using more L makes the analysis more expensive.
  • More L doesn’t always mean more precision.

E

x0 x1 x2 x3 for (i = 0; i < n; i++) { x0 = new h0/L; x1 = new h1/L; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); }

Monday, 27 February 2012

slide-51
SLIDE 51

Separability question

local(x2) ¬local(x2) s, s’

  • Does analysis(ɳ) have an abstract element d

separating {s, s’} from ¬local(x2)?

  • We use a generic answer to this question

during our parameter inference.

d

Monday, 27 February 2012

slide-52
SLIDE 52

Separability from ¬local(x2)

  • This state satisfies local(x2).
  • Separated from ¬local(x2) by analysis(ɳ) iff

ɳ(h2) = ɳ(h3) = L

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

Monday, 27 February 2012

slide-53
SLIDE 53

Separability from ¬local(x2)

  • This state satisfies local(x2).
  • Separated from ¬local(x2) by analysis(ɳ) iff

(ɳ o allocSite o backReach)(x2) = {L}.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

ɳ(h2) = L ∧ ɳ(h3) = L

Monday, 27 February 2012

slide-54
SLIDE 54

Parameter inference

  • 1. Testing gives states

where local(x2) holds.

  • 2. Compute the alloc. sites

H of objects backward- reachable from x2.

  • 3. ɳ(h) = L, if h is in H;

ɳ(h) = E, otherwise.

  • 4. Return ɳ.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

Monday, 27 February 2012

slide-55
SLIDE 55

Parameter inference

  • 1. Testing gives states

where local(x2) holds.

  • 2. Compute the alloc. sites

H of objects that can reach x2.

  • 3. ɳ(h) = L, if h is in H;

ɳ(h) = E, otherwise.

  • 4. Return ɳ.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

H = {h2, h3} ɳ = [{h0,h1}↦E, {h2,h3}↦L]

Monday, 27 February 2012

slide-56
SLIDE 56

Parameter inference

  • 1. Testing gives states

where local(x2) holds.

  • 2. Compute the alloc. sites

H of objects that can reach x2.

  • 3. ɳ(h) = L, if h is in H;

ɳ(h) = E, otherwise.

  • 4. Return ɳ.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

H = {h2, h3} ɳ = [{h0,h1}↦E, {h2,h3}↦L]

Monday, 27 February 2012

slide-57
SLIDE 57

Parameter inference

  • 1. Testing gives states

where local(x2) holds.

  • 2. Compute the alloc. sites

H of objects that can reach x2.

  • 3. ɳ(h) = L, if h is in H;

ɳ(h) = E, otherwise.

  • 4. Return ɳ.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

H = {h2, h3} ɳ = [{h0,h1}↦E, {h2,h3}↦L]

separability

Monday, 27 February 2012

slide-58
SLIDE 58

Parameter inference

  • 1. Testing gives states

where local(x2) holds.

  • 2. Compute the alloc. sites

H of objects that can reach x2.

  • 3. ɳ(h) = L, if h is in H;

ɳ(h) = E, otherwise.

  • 4. Return ɳ.

h1 h0 h2 h3

f1 f2 f3

h1 h0 h2 h3

f1 f2 f3

x0 x1 x2 x3

separability minimality

H = {h2, h3} ɳ = [{h0,h1}↦E, {h2,h3}↦L]

Monday, 27 February 2012

slide-59
SLIDE 59

Does it work?

Monday, 27 February 2012

slide-60
SLIDE 60

Setting of experiments

  • 6 concurrent Java programs from Dacapo:
  • 161K - 491K bytecode (including analysed JDK).
  • Up to 5K allocation sites per program.
  • 47K queries, but only 17K(37%) reached during

testing.

  • Considered only these reachable queries.

Monday, 27 February 2012

slide-61
SLIDE 61

6 Java prog. (161K-491K) up to 5K sites 17K queries dynamic analysis parameter inference parameterised static analysis disproved proved don’t know info parameter

Monday, 27 February 2012

slide-62
SLIDE 62

6 Java prog. (161K-491K) up to 5K sites 17K queries dynamic analysis parameter inference parameterised static analysis disproved proved don’t know parameter 28% disproved 52% proved 20% don’t know info

Monday, 27 February 2012

slide-63
SLIDE 63

6 Java prog. (161K-491K) up to 5K sites 17K queries dynamic analysis parameter inference parameterised static analysis disproved proved don’t know parameter 28% disproved 52% proved 20% don’t know per prog: 6s - 8m per program: 38s - 86m info

Monday, 27 February 2012

slide-64
SLIDE 64

6 Java prog. (161K-491K) up to 5K sites 17K queries dynamic analysis parameter inference parameterised static analysis disproved proved don’t know parameter 28% disproved 52% proved 20% don’t know L-mapped sites: avg 4.8, max 195 per prog: 6s - 8m info per program: 38s - 86m

Monday, 27 February 2012

slide-65
SLIDE 65

6 Java prog. (161K-491K) up to 5K sites 17K queries parameterised static analysis proved don’t know All sites mapped to L

Monday, 27 February 2012

slide-66
SLIDE 66

6 Java prog. (161K-491K) up to 5K sites 17K queries parameterised static analysis proved don’t know All sites mapped to L Out of memory for all programs

Monday, 27 February 2012