Efficiently intertwining widening and narrowing Kalmer Apinis - - PowerPoint PPT Presentation

▶

Dec 03, 2022 20 likes •284 views

Efficiently intertwining widening and narrowing Kalmer Apinis Helmut Seidl Vesal Vojdani Gianluca Amato Francesca Scozzari Kalmer Apinis Rogosi, 2015 2 The Plan Static analysis ` a la Bourdoncle 1 Localized Widening & Narrowing

SLIDE 1

Efficiently intertwining widening and narrowing

Kalmer Apinis Helmut Seidl Vesal Vojdani Gianluca Amato Francesca Scozzari

Kalmer Apinis Rogosi, 2015

SLIDE 2

2 The Plan

Static analysis `

a la Bourdoncle1

Localized Widening & Narrowing2
Static analysis `

a la Goblint

Adaptation of Localized Widening & Narrowing
Conclusion

1Efficient chaotic iteration strategies with widenings, Bourdoncle 2Localizing widening and narrowing, Amato&Scozzari

SLIDE 3

3 Bourdoncle

1. AST → dependency graph + equation system

SLIDE 4

3 Bourdoncle

1. AST → dependency graph + equation system

             x1 = start x2 = x := 0♯ x1 . . . x8 = (x 10♯ x2) ⊔ (x 10♯ x7)

control points → equation system variables
transitions → right-hand sides

SLIDE 5

4 Bourdoncle (cont.)

2. dependency graph → w.t.o. → iteration strategy

hierarchical ordering A hierarchical ordering of a set is a well-parenthesized permutation of this set without two consecutive ‘(’. Example: 1 2 (3 4 (5 6) 7) 8, ω(6) = {5, 3} weak topological ordering A weak topological ordering of a directed graph (w.t.o. for short) is a hierarchical ordering of its vertices such that for everry edge u → v: (u ≺ v ∧ v / ∈ ω(u)) ∨ (v u ∧ v ∈ ω(u))

SLIDE 6

5 Recursively iterate based on the w.t.o.

State:
variable assignment
set of stable variables
Example: 1 2 [3 4 [5 6]∗ 7]∗ 8

             x1 = start x2 = x := 0♯ x1 . . . x8 = (x 10♯ x2) ⊔ (x 10♯ x7)

SLIDE 7

6 Interval Domain Example

x = 0; while (x <= 100) x++; 1 2 3

SLIDE 8

6 Interval Domain Example

x = 0; while (x <= 100) x++; 1 2 3

     x1 = [0, 0] ⊔ (x2 + [1, 1]) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞]

SLIDE 9

6 Interval Domain Example

x = 0; while (x <= 100) x++; 1 2 3

     x1 = [0, 0] ⊔ (x2 + [1, 1]) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗ 3 → x1 = [0, 101]

SLIDE 10

6 Interval Domain Example

x = 0; while (x <= 100) x++; 1 2 3

     x1 = [0, 0] ⊔ (x2 + [1, 1]) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗ 3 → x1 = [0, 101] Takes too many iterations!

SLIDE 11

6 Interval Domain Example

x = 0; while (x <= 100) x++; 1 2 3

     x1 = [0, 0] ⊔ (x2 + [1, 1]) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗ 3 → x1 = [0, 101] Takes too many iterations! Solution: make component heads widening points!

SLIDE 12

7 Widening intervals

x = 0; while (x <= 100) x++; 1 2 3

     x1 = x1 ([0, 0] ⊔ (x2 + [1, 1])) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗ 3 → x1 = [0, ∞] Widening: — makes increasing chains stabilize in finite steps. E.g., [0, 0] [0, 1] = [0, ∞]

SLIDE 13

7 Widening intervals

x = 0; while (x <= 100) x++; 1 2 3

     x1 = x1 ([0, 0] ⊔ (x2 + [1, 1])) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗ 3 → x1 = [0, ∞] Widening: — makes increasing chains stabilize in finite steps. E.g., [0, 0] [0, 1] = [0, ∞] Bourdoncle: “. . . , narrowing operators can be used to improve the post-fixed points . . . ”. But how?

SLIDE 14

8 Amato&Scozzari: Idea 0

Intertwined widening and narrowing.

Examples
[1 2]∗

w[1 2]∗ n 3

1 2 [3 4 [5 6]∗

w [5 6]∗ n 7]∗ w

[3 4 [5 6]∗

w [5 6]∗ n 7]∗ n 8

Iterate widening until stabilization.
Iterate narrowing “a few times”.

Termination for monotonic right-hand sides proven!

SLIDE 15

9 Intertwining W/N Example

x = 0; while (x <= 100) x++; 1 2 3

     x1 = x1 ([0, 0] ⊔ (x2 + [1, 1])) x2 = x1 ⊓ [−∞, 100] x3 = x1 ⊓ [101, ∞] Iteration strategy: [1 2]∗

w [1 2]∗ n 3

→ x1 = [0, 101]

SLIDE 16

10 Amato&Scozzari: Idea 1

Localized Widening:

Replace

x = x (in ⊔ back) with x = in ⊔ (x back)

in back … … …

SLIDE 17

11 Localized Widening Example

Example i = 0; while(i<10){ j = 0; while (j<10) { // 0 i < 10 j = j + 1; } i = i + 1; }

i=0 i<10 i>=10 j=0 j>=10 j<10 j=j+1 i=i+1

SLIDE 18

12 Amato&Scozzari: Idea 2

Localized Narrowing

Reset the loop body after (each) update to loop head.

Example: [1 2]∗

w [1 R2 2]∗ n 3

1 3 2

SLIDE 19

13 Amato&Scozzari: Conclusion

First classical concrete description on

“intertwining widening and narrowing”.

Interesting optimizations: first — easy, second — general.

SLIDE 20

13 Amato&Scozzari: Conclusion

(First) (classical) concrete description on

“intertwining widening and narrowing”.

Interesting optimizations: first — easy, second — general.

SLIDE 21

14 Goblint

Differences:

Infinite systems — cannot (pre)compute everything.
Dynamic deps. — do not want to over-approximate
Uses demand-driven solving

Generalize the ideas —

similar effect for examples, and
correctness generally.

SLIDE 22

15 The problem in detail

x = f(a, b, c)

a b c x

Questions that need answers:

How to find component heads?
How to find back edges?
How to find loop nodes?

SLIDE 23

16 Loop detection

in back 1 2 5 4 3

Label nodes with increasing numbers (from the back).
Edge to a bigger number — loop.
Starting node is the loop head.

Problem: detection at the wrong edge.

SLIDE 24

17 Back-edge detection

in back 1 2 5 4 3

By example:

Mark 2 for widening any time 4 is updated
Remove mark after recomputing 2

SLIDE 25

18 Loop body detection

2 1 5 4 3

Dynamic loop body detection: Nodes with larger label that influence the loop head. (Loop head has the smallest label in the loop)

SLIDE 26

19 Conclusion

Not solved — fine control on when to restart.
Small examples work as precisely as Amato&Scozzari
Works with dynamic deps. & infinite eq. systems.
Restarting is computationally expensive.