COMBINING PARTIAL EVALUATION AND SYMBOLIC EXECUTION Reiner Hhnle - PowerPoint PPT Presentation

COMBINING PARTIAL EVALUATION AND SYMBOLIC EXECUTION Reiner Hähnle & Richard Bubel Chalmers University Symposium’09 Speyer

CONTROL CIRCUIT y = 80; threshold = 100; if (y > threshold) { decrease = true; } else { decrease = false; } while ( | y-threshold | > eps) { y = decrease ? y-1 : y+1; }

CONTROL-FLOW GRAPH y = 80 y = 80; threshold=100 threshold = 100; y>threshold ? if (y > threshold) { decrease = true; decrease = true; decrease = false; } else { decrease = false; } | y-threshold | > eps ? while ( | y-threshold | > eps) { decrease ? y = decrease ? y-1 : y+1; y=y-1; y=y+1; }

PARTIAL EVALUATION Evaluator Evaluator y 80 threshold 100 Static information y = 80 decrease false propagated along CFG threshold=100 • constant propagation 80>100 ? false y>threshold ? • constant expression evaluation decrease = true; decrease = false; • dead-code elimination Evaluator Evaluator • other: type coercion, y - | y-threshold | > eps ? | y-100 | > eps ? threshold 100 safe dereferencing etc. decrease false decrease ? false y=y-1; y=y+1;

PARTIAL EVALUATION A Bit More Realistic y = 80 threshold=100 threshold=100 y>100 ? y>threshold ? decrease = true; decrease = true; decrease = false; decrease = false; | y-threshold | > eps ? | y-100 | > eps ? decrease ? decrease ? y=y-1; y=y+1; y=y-1; y=y+1;

SYMBOLIC EXECUTION threshold=100 y>threshold ? decrease = true; decrease = false; | y-threshold | > eps ? decrease ? y=y-1; y=y+1;

SYMBOLIC EXECUTION threshold=100 threshold=100 y>threshold ? y>threshold ? decrease = true; decrease = false; decrease = true; decrease=false; | y-threshold | > eps ? | y-threshold | > eps ? | y-threshold | > eps ? decrease ? y=y-1; y=y+1; decrease ? decrease ? y=y-1; y=y+1; y=y-1; y=y+1; |y-threshold| > eps ? | y-threshold | > eps ? | y-threshold | > eps ? | y-threshold | > eps ? decrease ? decrease ? decrease ? decrease ? y=y+1; y=y+1; y=y+1; y=y+1; y=y-1; y=y-1; y=y-1; y=y-1;

OPTIMIZING SYMBOLIC EXECUTION Symbolic Execution • unfolds control-flow graph into tree • unfeasible paths must be closed by first-order proof search interleave partial evaluation and symbolic execution

INTERLEAVING threshold=100 threshold=100 y>threshold ? y>threshold ? y>100 ? decrease = true; decrease = false; decrease=false; decrease=true; | y-threshold | > eps ? decrease ? y=y-1; y=y+1; | y-threshold | > eps ? | y-threshold | > eps ? | y-100 | > eps ? | y-100 | > eps ? true false decrease ? decrease ? y=y-1; y=y+1; y=y-1; y=y+1; | y-threshold | > eps ? | y-100 | > eps ? | y-threshold | > eps ? | y-100 | > eps ? | y-threshold | > eps ? | y-100 | > eps ? | y-threshold | > eps ? | y-100 | > eps ? true true false false decrease ? decrease ? decrease ? decrease ? y=y+1; y=y+1; y=y+1; y=y-1; y=y-1; y=y+1; y=y-1; y=y-1;

INTERLEAVING threshold=100 threshold=100 y>100 ? y>threshold ? decrease=true; decrease=false; decrease = true; decrease = false; | y-threshold | > eps ? | y-100 | > eps ? | y-100 | > eps ? decrease ? y=y-1; y=y+1; true false y=y-1; y=y+1; | y-100 | > eps ? | y-100 | > eps ? true false y=y-1; y=y+1;

PROGRAM LOGIC Programming Language Simple OO-Programming Language • single inheritance • dereferencing null, division by zero etc. cause non- termination • dynamic method binding • no nested expressions

PROGRAM LOGIC Syntax Dynamic Logic with Updates: (as usual) Specialisation operator ↓ : PrgEl × Upd × For → PrgEl where PrgEl = Statement ˙ ∪ Expression denotes a program equivalent to if is executed ( ↓ ) U p ϕ p p , in a state s satisfying and coinciding on U ϕ Examples: • x =( y ) ↓ ( y := 3 , true )+ 3 ; • ( x = o . a + 3 ) ↓ ( o.a := 10 , o != null )

PROGRAM LOGIC Notions Signature Σ : Program variables and attributes are modelled as non-rigid constants and unary function symbols First-order structure ( D, I ) : • Domain : sorted universe (interpretes sorts) D • Interpretation : interpretes rigid function and I predicate symbols States : s ∈ S interpretes program variables and attributes

PROGRAM LOGIC Signature Extension Partial Evaluation may extend the signature (temporary variables, anonymous updates ) p ↓ Σ ′⊇ Σ ( U , ϕ ) where and and β Σ ′ ⊇ β Σ ( D, I ) Σ ′ ⊇ ( D, I ) Σ s Σ ′ ⊇ s Σ

PROGRAM LOGIC Soundness Condition on the Specialisation Operator p ↓ Σ ′⊇ Σ ( U , ϕ ) For all formulas over Σ for all ( D, I ) Σ ′ , s Σ ′ , β Σ ′ , : ψ ( D, I ) Σ ′ , s Σ ′ , β Σ ′ | = � � � p ↓ ( U , ϕ ) � ψ → {U} ( ϕ → � p � ψ )

PROGRAM LOGIC Partial Evaluation Rules Correctness Rewrite Action Requirement if ( b ) { p } else { q } ↓ ( U , ϕ ) U ( ϕ → b . Dead-Code = true ) Elimination � p ↓ ( U , ϕ ) o . a ↓ ( U , ϕ ) Safe Field U ( ϕ → !( o . � = null )) Access @( o . a ) ↓ ( U , ϕ ) ⊢ respModStrong( p , mod ) Partial ( p ; q ) ↓ ( U , ϕ ) � U ′ := UV mod Evaluator p ↓ ( U , ϕ ); q ↓ ( U ′ , ϕ ′ ) ( D, I ) | = {U}{V mod } ϕ ′ Propagation ⇒ ( D, I ) | = {U} � p � ϕ

PROGRAM LOGIC Partial Evaluator Introduction Rules Γ ⊢ U !( o . = null ) , ∆ Γ ⊢ U{ o . a := t } � q ↓ ( o . a := t , ! o . = null ) � φ , ∆ Γ ⊢ U � o . a = t ; q � φ , ∆ and several others

PROGRAM LOGIC Type Inference Rules res = o . m ( a 1 , . . . , a n ) ↓ ( ϕ , U ) ⊢ U ( ϕ → o ! . = null & o ′ = o ↓ ( ϕ , U ) C :: instance ( o )) res = @(( C ) o ′ ) . m ( a 1 ↓ ( ϕ , U ) , . . . , a n ↓ ( ϕ , U ))

PROGRAM LOGIC Type Inference Rules A A a = ...; a is an instance of C equals(Obj) boolean eq = a.equals(c); B C Evaluator equals(Obj) equals(Obj) ... equals(Obj) equals(Obj) equals(Obj) equals(Obj) equals(Obj) equals(Obj) equals(Obj) equals(Obj) equals(Obj)

DEMO

FUTURE WORK • Simplification of specifications ‣ Partial evaluation of contracts and loop invariants ‣ Applicable to JavaCardDL / JML / OCL • Investigate applicability to application engineering

FUTURE WORK Application Engineering Model Driven Application Partial Architecture Engineering Evaluation Platform Productline Program Independent Artefacts p Model Platform Definition ( U , ϕ ) Feature Model Configuration Platform Specific Application ( ↓ ) U Model p ϕ ,

CONCLUSION (for the moment) β y = 80; threshold = 100; if (y > threshold) { decrease = true; } else { decrease = false; } while (y-threshold > eps) { y = decrease ? y-1 : y+1; } partial eval. as replaced generalisation of computation ↓ proof search ⊢ β -reduction linear in by number of locs in computation ↓ Hoare/VCG