Implementing Partial Evaluator Via Symbolic Execution (Work in - - PowerPoint PPT Presentation

▶
implementing partial evaluator via symbolic execution
SMART_READER_LITE
LIVE PREVIEW

Implementing Partial Evaluator Via Symbolic Execution (Work in - - PowerPoint PPT Presentation

Aug 16, 2022 133 likes •1.05k views

Implementing Partial Evaluator Via Symbolic Execution (Work in Progress) Ran Ji Joint work with Reiner H ahnle and Richard Bubel Department of Computer Science and Engineering Chalmers University of Technology May 26, 2010

slide-1
SLIDE 1

Implementing Partial Evaluator Via Symbolic Execution (Work in Progress)

Ran Ji

Joint work with Reiner H¨ ahnle and Richard Bubel

Department of Computer Science and Engineering Chalmers University of Technology May 26, 2010 www.key-project.org www.hats-project.eu

Ran Ji KeY’10 100526 1 / 19

slide-2
SLIDE 2

Outline

◮ Introduction to partial evaluation ◮ Interleaving symbolic execution and partial evaluation ◮ Implementing partial evaluator via symbolic execution ◮ Summary

Ran Ji KeY’10 100526 2 / 19

slide-3
SLIDE 3

Partial Evaluation

Theorem (smn Theorem, Kleene, 1943) Let f ( x, y) be a computable function with x = x1, . . . , xm, y = y1, . . . , yn. There is an m + 1-ary primitive recursive function sm

n such that:

φsm

n (f ,

x) = λ

y.f ( x, y) Proof. Choose sm

n such that φsm

n (f ,

x) binds the first m free variables of f to the

first m arguments, then run f .

Ran Ji KeY’10 100526 3 / 19

slide-4
SLIDE 4

Partial Evaluation

Theorem (smn Theorem, Kleene, 1943) Let f ( x, y) be a computable function with x = x1, . . . , xm, y = y1, . . . , yn. There is an m + 1-ary primitive recursive function sm

n such that:

φsm

n (f ,

x) = λ

y.f ( x, y) Proof. Choose sm

n such that φsm

n (f ,

x) binds the first m free variables of f to the

first m arguments, then run f . Research Programme of Partial Evaluation Prove the smn Theorem in a non-trivial way such that:

1 φsm n (f ,

x) is more efficient than f

2 for programs, not only functions Ran Ji KeY’10 100526 3 / 19

slide-5
SLIDE 5

Partial Evaluation, Cont’d

Program specialization with optimization as goal

◮ Intended to be fully automatic (cf. program transformation) ◮ Research started 1964ff, 1980s “golden time” ◮ Mainly used in functional/logic programming ◮ Mainly used in compilation, compiler generation, meta-interpretation ◮ Techniques:

  • folding, constant propagation
  • binding time analysis (what can be considered as static?)
  • program point specialization (define+fold)
  • symbolic execution

◮ side effects, dynamic calls, aliases — gets ugly and somewhat ad hoc ◮ Seemingly no advanced PE for recent Java available (JSpec dead?)

Ran Ji KeY’10 100526 4 / 19

slide-6
SLIDE 6

Symbolic Execution or Partial Evaluation

Both viewed as generalization of standard program execution

Ran Ji KeY’10 100526 5 / 19

slide-7
SLIDE 7

Symbolic Execution or Partial Evaluation

Both viewed as generalization of standard program execution Symbolic Execution Execution of one program run with symbolic values

Ran Ji KeY’10 100526 5 / 19

slide-8
SLIDE 8

Symbolic Execution or Partial Evaluation

Both viewed as generalization of standard program execution Symbolic Execution Execution of one program run with symbolic values Partial Evaluation partial evaluator mix static input

  • x

specialized pro- gram p

x

specialized program p

x

  • utput

dynamic input y target program p

Ran Ji KeY’10 100526 5 / 19

slide-9
SLIDE 9

Symbolic Execution and Partial Evaluation: Opportunities

Ran Ji KeY’10 100526 6 / 19

slide-10
SLIDE 10

Symbolic Execution and Partial Evaluation: Opportunities

◮ Symbolic execution cannot specialize its target code:

employ partial evaluation

Ran Ji KeY’10 100526 6 / 19

slide-11
SLIDE 11

Symbolic Execution and Partial Evaluation: Opportunities

◮ Symbolic execution cannot specialize its target code:

employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09)

Ran Ji KeY’10 100526 6 / 19

slide-12
SLIDE 12

Symbolic Execution and Partial Evaluation: Opportunities

◮ Symbolic execution cannot specialize its target code:

employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09)

◮ Partial evaluation approximates operational semantics:

gain precision with complete symbolic execution engine

Ran Ji KeY’10 100526 6 / 19

slide-13
SLIDE 13

Symbolic Execution and Partial Evaluation: Opportunities

◮ Symbolic execution cannot specialize its target code:

employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09)

◮ Partial evaluation approximates operational semantics:

gain precision with complete symbolic execution engine Interleaving symbolic execution and partial evaluation, to achieve a sophisticated partial evaluator (Work in progress!)

Ran Ji KeY’10 100526 6 / 19

slide-14
SLIDE 14

Running Example: Control Circuit

y = 80; threshold = 100; if (y > threshold) { decrease = true; } else { decrease = false; } while (|y−threshold| > eps) { y = decrease ? y−1 : y+1; }

Ran Ji KeY’10 100526 7 / 19

slide-15
SLIDE 15

Control-Flow Graph (CFG)

y=80 threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • y = 80;

threshold = 100; if (y > threshold) { decrease = true; } else { decrease = false;} while (|y−threshold| > eps) { y = decrease ? y−1 : y+1; }

Ran Ji KeY’10 100526 8 / 19

slide-16
SLIDE 16

Partial Evaluation On CFG

y=80 threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y threshold decrease Static information propagated along CFG:

Ran Ji KeY’10 100526 9 / 19

slide-17
SLIDE 17

Partial Evaluation On CFG

y=80 threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold decrease Static information propagated along CFG:

Ran Ji KeY’10 100526 9 / 19

slide-18
SLIDE 18

Partial Evaluation On CFG

y=80 threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease Static information propagated along CFG:

Ran Ji KeY’10 100526 9 / 19

slide-19
SLIDE 19

Partial Evaluation On CFG

y=80 threshold=100 80>100 ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease Static information propagated along CFG:

◮ constant propagation

Ran Ji KeY’10 100526 9 / 19

slide-20
SLIDE 20

Partial Evaluation On CFG

y=80 threshold=100 false decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

Ran Ji KeY’10 100526 9 / 19

slide-21
SLIDE 21

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-22
SLIDE 22

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-23
SLIDE 23

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y 80 threshold 100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-24
SLIDE 24

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-25
SLIDE 25

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−100| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-26
SLIDE 26

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−100| > eps ? decrease ? y=y−1 y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-27
SLIDE 27

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−100| > eps ? false y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-28
SLIDE 28

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−100| > eps ? false y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination

Ran Ji KeY’10 100526 9 / 19

slide-29
SLIDE 29

Partial Evaluation On CFG

y=80 threshold=100 false decrease=false |y−100| > eps ? false y=y+1

  • Variables

Value y

  • threshold

100 decrease false Static information propagated along CFG:

◮ constant propagation ◮ constant expression

evaluation

◮ dead code elimination ◮ also: type coercion,

safe dereferencing, etc.

Ran Ji KeY’10 100526 9 / 19

slide-30
SLIDE 30

Same Example But More Realistic

y=80 threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Ran Ji

KeY’10 100526 10 / 19

slide-31
SLIDE 31

Same Example But More Realistic

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • Ran Ji

KeY’10 100526 10 / 19

slide-32
SLIDE 32

Same Example But More Realistic

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold| > eps ? decrease ? y=y−1 y=y+1

  • mix

threshold=100 y>100 ? decrease=true decrease=false |y−100| > eps ? decrease ? y=y−1 y=y+1

  • Ran Ji

KeY’10 100526 10 / 19

slide-33
SLIDE 33

Symbolic Execution: Unwinding the CFG

threshold=100

Ran Ji KeY’10 100526 11 / 19

slide-34
SLIDE 34

Symbolic Execution: Unwinding the CFG

threshold=100 y>threshold ?

Ran Ji KeY’10 100526 11 / 19

slide-35
SLIDE 35

Symbolic Execution: Unwinding the CFG

threshold=100 y>threshold ? decrease=true decrease=false

Ran Ji KeY’10 100526 11 / 19

slide-36
SLIDE 36

Symbolic Execution: Unwinding the CFG

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

Ran Ji KeY’10 100526 11 / 19

slide-37
SLIDE 37

Symbolic Execution: Unwinding the CFG

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 Ran Ji KeY’10 100526 11 / 19

slide-38
SLIDE 38

Symbolic Execution: Unwinding the CFG

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 Ran Ji KeY’10 100526 11 / 19

slide-39
SLIDE 39

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 Ran Ji KeY’10 100526 12 / 19

slide-40
SLIDE 40

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 Ran Ji KeY’10 100526 12 / 19

slide-41
SLIDE 41

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>threshold ? decrease=true decrease=false |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−threshold|>eps ? |y−threshold|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

mix

Ran Ji KeY’10 100526 12 / 19

slide-42
SLIDE 42

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>100 ? decrease=true decrease=false |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

mix

Ran Ji KeY’10 100526 12 / 19

slide-43
SLIDE 43

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>100 ? decrease=true decrease=false |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 Ran Ji KeY’10 100526 12 / 19

slide-44
SLIDE 44

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>100 ? decrease=true decrease=false |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

|y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1 |y−100|>eps ? |y−100|>eps ? decrease ? decrease ? y=y−1 y=y+1 y=y−1 y=y+1

mix mix

Ran Ji KeY’10 100526 12 / 19

slide-45
SLIDE 45

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>100 ? decrease=true decrease=false |y−100|>eps ? |y−100|>eps ? true false y=y−1 y=y+1 y=y−1 y=y+1

|y−100|>eps ? |y−100|>eps ? true true y=y−1 y=y+1 y=y−1 y=y+1 |y−100|>eps ? |y−100|>eps ? false false y=y−1 y=y+1 y=y−1 y=y+1

mix mix

Ran Ji KeY’10 100526 12 / 19

slide-46
SLIDE 46

Interleaving Symbolic Execution and Partial Evaluation

threshold=100 y>100 ? decrease=true decrease=false |y−100|>eps ? |y−100|>eps ? true false y=y−1 y=y+1

|y−100|>eps ? true y=y−1 |y−100|>eps ? false y=y+1

mix mix

Ran Ji KeY’10 100526 12 / 19

slide-47
SLIDE 47

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs?

Ran Ji KeY’10 100526 13 / 19

slide-48
SLIDE 48

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs? Basic approach: Interleave symbolic execution and partial evaluation as before

Ran Ji KeY’10 100526 13 / 19

slide-49
SLIDE 49

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs? Basic approach: Interleave symbolic execution and partial evaluation as before After exhaustive symbolic execution:

◮ Collect simplified statements along execution path

Ran Ji KeY’10 100526 13 / 19

slide-50
SLIDE 50

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs? Basic approach: Interleave symbolic execution and partial evaluation as before After exhaustive symbolic execution:

◮ Collect simplified statements along execution path ◮ Merge execution paths:

  • Introducing conditional statements

Ran Ji KeY’10 100526 13 / 19

slide-51
SLIDE 51

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs? Basic approach: Interleave symbolic execution and partial evaluation as before After exhaustive symbolic execution:

◮ Collect simplified statements along execution path ◮ Merge execution paths:

  • Introducing conditional statements
  • Exploiting dynamic dispatch

Ran Ji KeY’10 100526 13 / 19

slide-52
SLIDE 52

A Partial Evaluator for Java based on Symbolic Execution

Work in progress

Up-to-now: Partial evaluation used to speed up symbolic execution More technical details refer to FMCO’09 paper Can we obtain a partial evaluator for Java programs? Basic approach: Interleave symbolic execution and partial evaluation as before After exhaustive symbolic execution:

◮ Collect simplified statements along execution path ◮ Merge execution paths:

  • Introducing conditional statements
  • Exploiting dynamic dispatch
  • Generalization of expressions

Ran Ji KeY’10 100526 13 / 19

slide-53
SLIDE 53

Basic Approach

Program CFG SE+PE Merge Point Generalization Rigid Statement Elimination Specialized Program

Ran Ji KeY’10 100526 14 / 19

slide-54
SLIDE 54

Example: Binary operators and a power function

abstract class Binary { abstract int eval(int x,int y); abstract int neutral(); } class Add extends Binary { int eval(int x,int y) { return x+y; } int neutral() { return 0; } } class Mult extends Binary { int eval(int x,int y) { return x∗y; } int neutral() { return 1; } } class Power { int exp; Binary op; Power(int exp,Binary op) { this.exp = exp; this.op = op; } int raise(int base) { int result = op.neutral(); int e = exp; while( e−− > 0 ) result = op.eval(result,base); return result; } }

Ran Ji KeY’10 100526 15 / 19

slide-55
SLIDE 55

Control-Flow Graph (CFG)

(new Power(y, new Mult())).raise(x)

Ran Ji KeY’10 100526 16 / 19

slide-56
SLIDE 56

Control-Flow Graph (CFG)

(new Power(y, new Mult())).raise(x) exp=y

  • p=Mult
  • p=Add ?

result =0 result =1 e=exp e>0 ?

  • p=Add ?

result =result+x result =result∗x e=e−1 return result

Ran Ji KeY’10 100526 16 / 19

slide-57
SLIDE 57

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult

Ran Ji KeY’10 100526 17 / 19

slide-58
SLIDE 58

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult
  • p=Add ?

Ran Ji KeY’10 100526 17 / 19

slide-59
SLIDE 59

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp

Ran Ji KeY’10 100526 17 / 19

slide-60
SLIDE 60

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

Ran Ji KeY’10 100526 17 / 19

slide-61
SLIDE 61

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x Ran Ji KeY’10 100526 17 / 19

slide-62
SLIDE 62

Symbolic Execution: Unwinding the CFG

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x Ran Ji KeY’10 100526 17 / 19

slide-63
SLIDE 63

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-64
SLIDE 64

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-65
SLIDE 65

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=exp e=exp e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-66
SLIDE 66

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=1 e=1 e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-67
SLIDE 67

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=1 e=1 e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-68
SLIDE 68

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult
  • p=Add ?

rst=0 rst=1 e=1 e=1 e>0 ? e>0 ? return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

  • p=Add ?
  • p=Add ?

rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-69
SLIDE 69

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

Mult=Add ? rst=0 rst=1 e=1 e=1 e>0 ? e>0 ? return rst return rst Mult=Add ? Mult=Add ? rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

Mult=Add ? Mult=Add ? rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

Mult=Add ? Mult=Add ? rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-70
SLIDE 70

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=0 rst=1 e=1 e=1 e>0 ? e>0 ? return rst return rst false false rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e=e−1 e=e−1 e=e−1 e=e−1

e>0 ? e>0 ?

return rst return rst

false false rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x e>0 ? e>0 ?

return rst return rst

false false rst=rst+x rst=rst∗x rst=rst+x rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-71
SLIDE 71

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 e>0 ? return rst false rst=rst∗x e=e−1

e>0 ?

return rst

false rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-72
SLIDE 72

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 e>0 ? return rst false rst=rst∗x e=e−1

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-73
SLIDE 73

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 e>0 ? return 1 false rst=1∗x e=e−1

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-74
SLIDE 74

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 e>0 ? return 1 false rst=x e=e−1

e>0 ?

return rst

false rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-75
SLIDE 75

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 e>0 ? return 1 false rst=x e=e−1

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-76
SLIDE 76

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 1>0 ? return 1 false rst=x e=1−1

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-77
SLIDE 77

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true return 1 false rst=x e=0

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-78
SLIDE 78

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-79
SLIDE 79

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return rst

false rst=rst∗x Ran Ji KeY’10 100526 18 / 19

slide-80
SLIDE 80

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return rst

false rst=rst∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-81
SLIDE 81

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return x

false rst=x∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-82
SLIDE 82

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return x

false rst=x∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-83
SLIDE 83

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return x

false rst=x∗x Ran Ji KeY’10 100526 18 / 19

slide-84
SLIDE 84

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

e>0 ?

return x

false rst=x∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-85
SLIDE 85

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

0>0 ?

return x

false rst=x∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-86
SLIDE 86

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

false

return x

false rst=x∗x

mix

Ran Ji KeY’10 100526 18 / 19

slide-87
SLIDE 87

Interleaving Symbolic Execution and Partial Evaluation

exp=1

  • p=Mult

false rst=1 e=1 true false rst=x e=0

false

return x

Ran Ji KeY’10 100526 18 / 19

slide-88
SLIDE 88

Interleaving Symbolic Execution and Partial Evaluation

rst=x return x

Ran Ji KeY’10 100526 18 / 19

slide-89
SLIDE 89

Interleaving Symbolic Execution and Partial Evaluation

rst=x return x result = x; return x;

Ran Ji KeY’10 100526 18 / 19

slide-90
SLIDE 90

Summary

◮ SE and PE generalize computation in complementary ways ◮ One possibility to combine SE and PE:

Symbolic execution is boosted with partial evaluation

  • Replace search (theorem proving) with computation (PE)
  • Eliminate execution paths before they are symbolically executed
  • Prototypic implementation in KeY with naive PE is promising

◮ Another possibility to combine SE and PE:

Implementing partial evaluator via symbolic execution

  • Achieve binding time analysis (BTA) through computation (SE+PE)
  • Sophisticated partial evaluator for Java
  • Work in progress...

Ran Ji KeY’10 100526 19 / 19