[PPT] - in the Range-Based Constraint Manager dm Balogh PowerPoint Presentation

SLIDE 1 Ericsson Internal | 2018-02-21

Multiplication and Division in the Range-Based Constraint Manager

Ádám Balogh adam.balogh@ericsson.com

Euro LLVM 2019 Brussels, Belgium Ericsson 2019-04-08

SLIDE 2 Ericsson Internal | 2018-02-21

Range-Based Constraint Manager

— Default in Clang Static Analyzer

SLIDE 3 Ericsson Internal | 2018-02-21

Range-Based Constraint Manager

— Default in Clang Static Analyzer — Good performance: more than 20 times faster than MS Z3 (our measurement)

SLIDE 4 Ericsson Internal | 2018-02-21

Range-Based Constraint Manager

— Default in Clang Static Analyzer — Good performance: more than 20 times faster than MS Z3 (our measurement) — Limited deduction capabilities: only symbol plus/minus concrete integer compared to another integer

SLIDE 5 Ericsson Internal | 2018-02-21

Range-Based Constraint Manager

— Default in Clang Static Analyzer — Good performance: more than 20 times faster than MS Z3 (our measurement) — Limited deduction capabilities: only symbol plus/minus concrete integer compared to another integer

signed char n = get_number(); assert(i >= 100); assert(i + 20 <= -120);

Code

n: [-128..127] n: [100..127] == [-128..127]&[100..127] n: [108..116] == [100..127]&([-128..-120]-20)

Ranges

SLIDE 6 Ericsson Internal | 2018-02-21

The Problem: False Positive

— The result of multiplicative operations is unknown:

int size = 4, n, i; for (i = 0; i < size - 2; ++i) init(&n); use(n); // no warning

true_negative.c

int size = 4, n, i; for (i = 0; i < size / 2; ++i) init(&n); use(n); // warning: n unitialized

false_positive.c

 

SLIDE 7 Ericsson Internal | 2018-02-21

The Problem: False Positive

— The result of multiplicative operations is unknown:

int size = 4, n, i; for (i = 0; i < size - 2; ++i) init(&n); use(n); // no warning

true_negative.c

int size = 4, n, i; for (i = 0; i < size / 2; ++i) init(&n); use(n); // warning: n unitialized

false_positive.c

int size = 4, n, i; for (i = 0; i < size - 2; ++i) init(&n); use(n); // no warning int size = 4, n, i; for (i = 0; i < size / 2; ++i) init(&n); use(n); // warning: n unitialized

 

SLIDE 8 Ericsson Internal | 2018-02-21

The Problem: False Positive

— The result of multiplicative operations is unknown:

int size = 4, n, i; for (i = 0; i < size - 2; ++i) init(&n); use(n); // no warning

true_negative.c

int size = 4, n, i; for (i = 0; i < size / 2; ++i) init(&n); use(n); // warning: n unitialized

false_positive.c

int size = 4, n, i; for (i = 0; i < size - 2; ++i) init(&n); use(n); // no warning int size = 4, n, i; for (i = 0; i < size / 2; ++i) init(&n); use(n); // warning: n unitialized

 

— Z3 refutation may help to get rid of these false positives

SLIDE 9 Ericsson Internal | 2018-02-21

The Problem: False Negative

— Z3 refutation, does not help to get rid of false negatives

int n = get_number(); assert (n <= 2); assert (n + 2 >= 4); 1 / (n - 2); // div. by zero

true_positive.c

int n = get_number(); assert (n <= 2); assert (n * 2 >= 4); 1 / (n - 2); // no warning

false_negative.c

 

SLIDE 10 Ericsson Internal | 2018-02-21

The Problem: False Negative

— Z3 refutation, does not help to get rid of false negatives

int n = get_number(); assert (n <= 2); assert (n + 2 >= 4); 1 / (n - 2); // div. by zero

true_positive.c

int n = get_number(); assert (n <= 2); assert (n * 2 >= 4); 1 / (n - 2); // no warning

false_negative.c

int n = get_number(); assert (n <= 2); assert (n + 2 >= 4); 1 / (n - 2); // div. by zero int n = get_number(); assert (n <= 2); assert (n * 2 >= 4); 1 / (n - 2); // no warning

 

SLIDE 11 Ericsson Internal | 2018-02-21

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly)

SLIDE 12 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly)

SLIDE 13 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly)

n * 6 == 8

84

44

SLIDE 14 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly)

n * 6 == 8

84

44 n * 3 < 7

84

43 87

42

2

SLIDE 15 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly) — May result in huge number of ranges if multiplier is a large number (performance impact)

n * 6 == 8

84

44 n * 3 < 7

84

43 87

42

2

SLIDE 16 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly) — May result in huge number of ranges if multiplier is a large number (performance impact) — Negative multipliers and divisors reverse the inequality operator

n * 6 == 8

84

44 n * 3 < 7

84

43 87

42

2

SLIDE 17 Ericsson Internal | 2018-02-21

n / 20 == 5 100 119

Patches Implementing Multiplicative Arithmetic

— Much more complex than addition and subtraction (== shifting ranges circularly) — May result in huge number of ranges if multiplier is a large number (performance impact) — Negative multipliers and divisors reverse the inequality operator — Patches under review: https://reviews.llvm.org/D50256 & https://reviews.llvm.org/D49074

n * 6 == 8

84

44 n * 3 < 7

84

43 87

42

2

SLIDE 18

Thank You! adam.balogh@ericsson.com