Computing Invariants with Transformers: Experimental Scalability and - PowerPoint PPT Presentation

Computing Invariants with Transformers: Experimental Scalability and Accuracy Vivien Maisonneuve Olivier Hermant François Irigoin The Fifth International Workshop on Numerical and Symbolic Abstract Domains (NSAD 2014) Munich, September 10, 2014

Introduction Abstract domains needed to approximate complex program behaviors. x 1 x 2 Program analysis ⇒ computation of invariants (e.g. model checking). Here: affine invariants = systems of linear (in)equalities. x 1 + 7 ≥ 2 x 2 x 2 ≥ 5 − x 1 x 2 ≥ 1 2 / 22

• Propagation • Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 Classic Linear Relation Analysis (LRA) P 7 Example by Halbwachs & Henry [SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { • Propagation // P 0 : Ω 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { • Propagation // P 0 : Ω // P 1 : n = 0 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { • Propagation // P 0 : Ω // P 1 : n = 0 // P 2 : n = 0 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] P 6 P 2 P 7 if (n < 60) n++; } else n = 0; n 1 if (rand()) while (true) int n = 0; void foo() { 0 • Propagation // P 0 : Ω // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) } P 2 P 7 Example by Halbwachs & Henry [SAS’12] if (n < 60) n++; else n = 0; n 0 1 if (rand()) while (true) int n = 0; void foo() { P 6 • Propagation in each branch // P 0 : Ω // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 // P 4 : n = 1 3 / 22

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) 1 n 0 P 6 P 2 P 7 } Example by Halbwachs & Henry [SAS’12] else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { • Propagation in each branch // P 0 : Ω // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 // P 4 : n = 1 // P 5 : ∅ 3 / 22

• Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] 1 n 0 P 6 P 2 P 7 } else n = 0; if (n < 60) n++; void foo() { if (rand()) while (true) int n = 0; • Propagation in each branch // P 0 : Ω • Branch output P 6 : either P 4 or P 5 // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 // P 4 : n = 1 // P 5 : ∅ // P 6 : ? 3 / 22

• Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) Example by Halbwachs & Henry [SAS’12] 1 n 0 P 6 P 2 P 7 } if (n < 60) n++; else n = 0; void foo() { if (rand()) while (true) int n = 0; • Propagation in each branch // P 0 : Ω • Branch output P 6 : either P 4 or P 5 // P 1 : n = 0 P 6 = P 4 ⊔ P 5 : n = 1 // P 2 : n = 0 // P 3 : n = 0 // P 4 : n = 1 // P 5 : ∅ // P 6 : n = 1 3 / 22

• Loop invariant: P 2 entering the loop P 7 after one iteration Classic Linear Relation Analysis (LRA) } Example by Halbwachs & Henry [SAS’12] else n = 0; if (n < 60) n++; if (rand()) while (true) int n = 0; void foo() { • Propagation in each branch // P 0 : Ω • Branch output P 6 : either P 4 or P 5 // P 1 : n = 0 P 6 = P 4 ⊔ P 5 : n = 1 // P 2 : n = 0 • Branch output P 7 : P 7 = P 2 ⊔ P 6 : 0 ≤ n ≤ 1 // P 3 : n = 0 // P 4 : n = 1 // P 5 : ∅ // P 6 : n = 1 // P 7 : 0 ≤ n ≤ 1 3 / 22

Classic Linear Relation Analysis (LRA) while (true) Example by Halbwachs & Henry [SAS’12] else n = 0; if (n < 60) n++; if (rand()) int n = 0; void foo() { } • Propagation in each branch // P 0 : Ω • Branch output P 6 : either P 4 or P 5 // P 1 : n = 0 P 6 = P 4 ⊔ P 5 : n = 1 // P 2 : n = 0 • Branch output P 7 : P 7 = P 2 ⊔ P 6 : 0 ≤ n ≤ 1 // P 3 : n = 0 • Loop invariant: P 2 entering the loop // P 4 : n = 1 P 7 after one iteration // P 5 : ∅ // P 6 : n = 1 // P 7 : 0 ≤ n ≤ 1 3 / 22

Classic Linear Relation Analysis (LRA) if (rand()) Widening: } Example by Halbwachs & Henry [SAS’12] else n = 0; if (n < 60) n++; 3 / 22 while (true) void foo() { int n = 0; • Propagation in each branch // P 0 : Ω • Branch output P 6 : either P 4 or P 5 // P 1 : n = 0 P 6 = P 4 ⊔ P 5 : n = 1 // P 2 : n = 0 • Branch output P 7 : P 7 = P 2 ⊔ P 6 : 0 ≤ n ≤ 1 // P 3 : n = 0 • Loop invariant: P 2 entering the loop // P 4 : n = 1 P 7 after one iteration P ∗ = P 2 ∇ P 7 : 0 ≤ n // P 5 : ∅ // P 6 : n = 1 // P 7 : 0 ≤ n ≤ 1

• Interprocedural analysis • Nested loops • Double abstraction • Worst case complexity: 2 2 V vs. 2 V PIPS Approach PIPS: “A source-to-source compilation framework for analyzing and transforming C and Fortran programs” 1 Abstraction of each program instruction, block, function by a 2 Invariant propagation using transformers Pros: Supports large applications Cons: less accurate transformer = polyhedral approximation of the transfer function 4 / 22

PIPS Approach PIPS: “A source-to-source compilation framework for analyzing and transforming C and Fortran programs” 1 Abstraction of each program instruction, block, function by a 2 Invariant propagation using transformers Pros: Cons: transformer = polyhedral approximation of the transfer function • Interprocedural analysis • Nested loops ⇒ Supports large applications • Double abstraction ⇒ less accurate • Worst case complexity: 2 2 | V | vs. 2 | V | 4 / 22

• Elementary instructions • Invariant propagation using • Compound statements • Transitive closure PIPS: Transformers void foo() { int n = 0; while (true) if (rand()) if (n < 60) n++; else n = 0; } [Ancourt et al. , NSAD’10] transformers 5 / 22

• Invariant propagation using • Compound statements • Transitive closure PIPS: Transformers void foo() { while (true) if (rand()) if (n < 60) n++; else n = 0; } [Ancourt et al. , NSAD’10] transformers int n = 0; // T 0 : n ′ = 0 • Elementary instructions 5 / 22

• Invariant propagation using • Compound statements • Transitive closure PIPS: Transformers void foo() { while (true) if (rand()) else n = 0; } [Ancourt et al. , NSAD’10] transformers int n = 0; // T 0 : n ′ = 0 if (n < 60) n++; // T 4 : n ′ ≤ 60 , n ′ = n + 1 • Elementary instructions 5 / 22

• Invariant propagation using • Compound statements • Transitive closure PIPS: Transformers void foo() { while (true) if (rand()) } [Ancourt et al. , NSAD’10] transformers int n = 0; // T 0 : n ′ = 0 if (n < 60) n++; // T 4 : n ′ ≤ 60 , n ′ = n + 1 else n = 0; // T 5 : n > 60 , n ′ = 0 • Elementary instructions 5 / 22

• Invariant propagation using • Transitive closure PIPS: Transformers void foo() { while (true) if (rand()) } [Ancourt et al. , NSAD’10] transformers int n = 0; // T 0 : n ′ = 0 // T 3 = T 4 ⊔ T 5 : n ′ ≤ 60 , n ′ ≤ n + 1 if (n < 60) n++; // T 4 : n ′ ≤ 60 , n ′ = n + 1 else n = 0; // T 5 : n > 60 , n ′ = 0 • Elementary instructions • Compound statements 5 / 22

• Invariant propagation using • Transitive closure PIPS: Transformers void foo() { while (true) } [Ancourt et al. , NSAD’10] transformers int n = 0; // T 0 : n ′ = 0 if (rand()) // T 2 = T 3 ⊔ Id : n ′ ≤ n + 1 // T 3 = T 4 ⊔ T 5 : n ′ ≤ 60 , n ′ ≤ n + 1 if (n < 60) n++; // T 4 : n ′ ≤ 60 , n ′ = n + 1 else n = 0; // T 5 : n > 60 , n ′ = 0 • Elementary instructions • Compound statements 5 / 22

• Invariant propagation using PIPS: Transformers [Ancourt et al. , NSAD’10] void foo() { } transformers int n = 0; // T 0 : n ′ = 0 2 : n ′ ≤ n + 1 while (true) // T 1 = T ∗ if (rand()) // T 2 = T 3 ⊔ Id : n ′ ≤ n + 1 // T 3 = T 4 ⊔ T 5 : n ′ ≤ 60 , n ′ ≤ n + 1 if (n < 60) n++; // T 4 : n ′ ≤ 60 , n ′ = n + 1 else n = 0; // T 5 : n > 60 , n ′ = 0 • Elementary instructions • Compound statements • Transitive closure 5 / 22