Abstractions from Tests Mayur Naik (Georgia Institute of Technology) - PowerPoint PPT Presentation

Abstractions from Tests Mayur Naik (Georgia Institute of Technology) Hongseok Yang (University of Oxford) Ghila Castelnuovo (Tel-Aviv University) Mooly Sagiv (Tel-Aviv University) Monday, 27 February 2012

Motivation • Great success stories in automatic program verification based on static analysis techniques (SDV, Astree, etc). • Yet balancing precision and performance of a static analysis is still an art. • We want to do this balancing automatically. Monday, 27 February 2012

Typical static analysis program P query q parameterised static analysis don’t proved know Monday, 27 February 2012

Our approach program P query q parameter parameterised static analysis don’t proved know Monday, 27 February 2012

Our approach program P query q info parameter parameterised dynamic parameter static analysis analysis inference disproved don’t proved know Monday, 27 February 2012

Hypothesis • If a query is simple, we can find why the query holds simply by looking at a few execution traces. Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD ɳ s,s’ ɳ 0 ɳ 1 Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD Can separate? ɳ s,s’ ɳ 0 ɳ 1 Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD Can separate? ɳ s 0 ,s 1 ɳ 0 ɳ 1 Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD Can separate? ɳ s 0 ,s 1 ɳ 0 ɳ 1 Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD YES NO Can separate? ɳ s,s’ ɳ 0 ɳ 1 • Computes a separability condition. • Among separable ɳ i , choose a minimal ɳ according to an order (approximately reflecting precision). Monday, 27 February 2012

Parameter inference based on separability and minimality instrumented parameter parameter ɳ states s,s’ inference GOOD BAD YES NO Can separate? ɳ s,s’ ɳ 0 ɳ 1 • Computes a separability condition. • Among separable ɳ i ’s, choose a minimal ɳ according to an order (which approximately reflects precision). Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 x0.start(); h2 x2 pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 x0.start(); h2 x2 pc: x2.id = i; //local(x2)? f3 x3.start(); h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 x0.start(); h2 x2 pc: x2.id = i; //local(x2)? f3 x3.start(); h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 x0.start(); h2 x2 pc: x2.id = i; //local(x2)? f3 x3.start(); h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 x0 = new h0; f1 x1 = new h1; x1.f1 = x0; h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 x0.start(); h2 x2 pc: x2.id = i; //local(x2)? f3 x3.start(); h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 h0 x0 = new h0; f1 f1 x1 = new h1; x1.f1 = x0; h1 h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 f2 x0.start(); h2 h2 x2 pc: x2.id = i; //local(x2)? f3 f3 x3.start(); h3 h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 h0 x0 = new h0; f1 f1 x1 = new h1; x1.f1 = x0; h1 h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 f2 x0.start(); h2 h2 x2 pc: x2.id = i; //local(x2)? f3 f3 x3.start(); h3 h3 x3 } Monday, 27 February 2012

Thread-escape query • Does a local variable point to an object that cannot be reached from other threads? for (i = 0; i < n; i++) { x0 h0 h0 x0 = new h0; f1 f1 x1 = new h1; x1.f1 = x0; h1 h1 x1 x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; f2 f2 x0.start(); h2 h2 x2 pc: x2.id = i; //local(x2)? f3 f3 x3.start(); h3 h3 x3 } Monday, 27 February 2012

Thread-escape analysis • Summarise all heap objects with only two abstract nodes E and L. • ɤ (E) consists of all the thread-escaping objects and possibly more. • ɤ (L) contains only thread-local objects. Monday, 27 February 2012

Parameterisation Param = AllocSite → { l , e } • For each allocation site, it decides whether L or E is used to summarise allocated objects. • Changes the transfer function of “x=new h i ”. • Objects summarised by L can move to E, but not vice versa. Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 = new h0; x1 = new h1; x1.f1 = x0; x2 = new h2; x2.f2 = x1; x3 = new h3; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 = new h0/E; x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 x0 = new h0/E; E x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 x0 = new h0/E; E x1 x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; x3 = new h3/L; x3.f3 = x2; x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 x0 = new h0/E; E x1 x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; f2 x3 = new h3/L; x3.f3 = x2; L x2 x0.start(); pc: x2.id = i; //local(x2)? x3.start(); } Monday, 27 February 2012

Thread-escape analysis • Parameter ɳ = [{h0,h1} ↦ E, {h2,h3} ↦ L] for (i = 0; i < n; i++) { x0 x0 = new h0/E; E x1 x1 = new h1/E; x1.f1 = x0; x2 = new h2/L; x2.f2 = x1; f2 x3 = new h3/L; x3.f3 = x2; L x2 x0.start(); f3 pc: x2.id = i; //local(x2)? x3 x3.start(); } Monday, 27 February 2012