Crystalizing Sophisticated Code Analyses - - PowerPoint PPT Presentation

▶
crystal izing sophisticated code analyses
SMART_READER_LITE
LIVE PREVIEW

Crystalizing Sophisticated Code Analyses - - PowerPoint PPT Presentation

Apr 04, 2023 169 likes •538 views

Crystalizing Sophisticated Code Analyses

slide-1
SLIDE 1

Crystalizing Sophisticated Code Analyses

slide-2
SLIDE 2

Installation

  • !
  • "
  • #
  • $%%"&!!&%%'%(%

$%%&!!&%%" )

slide-3
SLIDE 3

Crystal

  • '!"
  • *'
  • *
  • (
  • "

$%%&!!&%%" +

  • "
  • ""
  • "
  • ,"
  • -./$
  • #"
slide-4
SLIDE 4

Crystal in the classroom

  • "0(!"
  • $"*1!"
  • *$&&12
  • *
  • .#"

"

$%%&!!&%%" 3

"

  • .'#"
slide-5
SLIDE 5

Crystal in research

  • 4!#"

"

  • "3""
  • +#55*67815579155*679

$%%&!!&%%" :

  • "
  • !
  • .!&!;
slide-6
SLIDE 6

Demonstration

  • ,"
  • !
  • "
  • <!"
  • <"

$%%&!!&%%" =

  • <"
  • <"!
slide-7
SLIDE 7

Register and Run

  • !;
  • 0'"
  • ,,""
  • <!>""

!&>

$%%&!!&%%" ?

  • *<@<!A
  • 0'!
  • <BC"

"&

slide-8
SLIDE 8

Steps for making an analysis

  • ,"
  • <!"
  • "

$%%&!!&%%" 8

  • #"
slide-9
SLIDE 9

Use an AST walker

  • .2"'"&
  • D

$%%&!!&%%" 9

  • D
  • "
  • !"#$%&

'

slide-10
SLIDE 10

Everything running?

  • ;
  • "E
  • "@0""

$%%&!!&%%" F7

  • (
  • ."
  • *'
slide-11
SLIDE 11

Steps for making an analysis

  • ,"
  • <!"
  • *'

$%%&!!&%%" FF

  • #"
slide-12
SLIDE 12

Abstract interpretation concepts

  • 6
  • #!#
  • !
  • !*

$%%&!!&%%" F)

  • 4!"

!

  • .'!
  • !
slide-13
SLIDE 13
  • 6
  • #!#
  • !
  • !*

Abstract interpretation concepts

$%%&!!&%%" F+

  • 4!"

!

  • .'!
  • !
slide-14
SLIDE 14

Lattice review

  • "E
  • 0!
  • (#>"
  • $%%&!!&%%"

F3

  • ⊥

a b ⊥

slide-15
SLIDE 15

Transfer function review

  • G
  • !σ
  • !!σ2

$%%&!!&%%" F:

  • ƒinstr1σ Hσ2
  • 0'"
slide-16
SLIDE 16

A simple null analysis

σ "! #

  • ƒx = null1σ H

σIxNULLJ

  • ƒx = y1σ H

σ σ

MAYBE_NULL NOT_NULL NULL ⊥

$%%&!!&%%" F=

  • 0#
  • #
  • 6$

'"

  • σIxσy J
  • ƒx = new C()1σ H

σIxNOT_NULLJ

  • ƒx = y.m(z1,3,zn)1σ H

σIyNOT_NULLJ

  • "11&

⊥

slide-17
SLIDE 17

The lattice

  • 111"#
  • "##""
  • '"#"1'

$%%&!!&%%" F?

  • '"#"1'
  • 6
  • .6
  • "#

NullLatticeElement { , , , ; }

slide-18
SLIDE 18

The lattice

  • ()
  • )
  • *

$%%&!!&%%" F8

  • +,-.,+/
  • 6#
  • #6616
  • 6;616
  • 6"6
slide-19
SLIDE 19

Setting up the flow analysis

  • "!"#>
  • +(0

$%%&!!&%%" F9

  • +(0
  • ,"K !65
  • 2"
  • .2

"

slide-20
SLIDE 20

Transfer functions

1

  • L$'!
  • $'!
  • "!!$'!!

$%%&!!&%%" )7

  • "!!$'!!
  • '%'

'

slide-21
SLIDE 21

You now have a Crystal flow analysis

  • 23
  • D12;!!
  • $
  • "$#
  • $%%&!!&%%"

)F

  • .2
  • ""

!

slide-22
SLIDE 22

Why Three Address Code

  • '#*
  • 4
  • #>
  • "'

$%%&!!&%%" ))

  • "'
  • *#

"

slide-23
SLIDE 23

Relevant packages

  • '!"
  • *
  • *

$%%&!!&%%" )+

  • *"
slide-24
SLIDE 24

Steps for making an analysis

  • ,"
  • <!"
  • *'
  • "

$%%&!!&%%" )3

  • #"
slide-25
SLIDE 25

Annotations

  • L
  • 4'

$%%&!!&%%" ):

  • 4'
  • ;""
  • 0'##!"E

@Target({ElementType., ElementType.}) NonNull {}

slide-26
SLIDE 26

Annotations

'

  • ,
  • #*
  • !
  • L!!

$%%&!!&%%" )=

  • L!!
  • 56(
  • #
  • M"NLL
  • !">
  • N,->HH"BH#/
slide-27
SLIDE 27

Annotations

  • '
  • 56(

$%%&!!&%%" )?

  • 56(
  • M"NLL
  • '
slide-28
SLIDE 28

Steps for making an analysis

  • ,"
  • <!"
  • *'
  • "

$%%&!!&%%" )8

  • ()'
slide-29
SLIDE 29

Branchsensitivity

  • '!'!

!!

  • *">

!

  • 2

>>

(x != ) { //hey, it’s safe //to use x in here! } {

$%%&!!&%%" )9

>>

  • 6##

!

  • "

(

{ //but it’s an //error in here! }

slide-30
SLIDE 30

On paper3

  • L#"

ƒx == y1σ Hσ

  • "

ƒx == y1σ H σx OMAYBE_NULL

$%%&!!&%%" +7

σx OMAYBE_NULL σIyσx J σy OMAYBE_NULL σIxσy J

  • σ
  • *#ƒ0x == y1σ
slide-31
SLIDE 31

Branching example

foo()

(foo()) { ; } { ; } ;

a b true false

$%%&!!&%%" +F

; foo()

c

slide-32
SLIDE 32

Branching example, with exceptions

foo()

{ (foo()) { ; } { ; } ;

a b d true false MyException

$%%&!!&%%" +)

; } (MyException exp) { ; } ; foo() MyException;

c e

slide-33
SLIDE 33

Types of labels

  • %
  • 11P$1&
  • 0#
  • "QQ1O1HH1&
  • >
  • 0>

$%%&!!&%%" ++

  • 0>
  • D"
  • *
  • ,
  • L
slide-34
SLIDE 34

Changing to branchsensitive analyses

F& ,#*D )& !!

LE transfer(TACInstruction instr, LE value)

⇓

IResult<LE> transfer(TACInstruction instr,

$%%&!!&%%" +3

+& .,< 1"#

List<ILabel> labels, LE value) value;

⇓

LabeledSingleResult.(value, labels);

slide-35
SLIDE 35

Using the branches

  • '

(

  • >HH"
  • >BH"

$%%&!!&%%" +:

  • ,(7(

'

  • "#
  • !
  • #!#
slide-36
SLIDE 36

Crystal Static Analysis Framework

  • D"
  • "
  • ,"
  • D

$%%&!!&%%" +=

  • 8'(
  • 3"
  • ("2