Making Numerical Program Analysis Fast Gagandeep Singh Markus Püschel Martin Vechev Department of Computer Science ETH Zürich
Static Program Analysis
Static Program Analysis public static void verify() { int[] ptr = new int[8]; int start = 0; for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } int y3 = * 2 x 1 ; int index4 = 0; if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } if (y3 == 36) { index4 = 8; } if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; } } }
Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } int y3 = * 2 x 1 ; Numerical int index4 = 0; if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; } } } Other String
Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; Buffer Overflow for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } Division by Zero int y3 = * 2 x 1 ; Numerical int index4 = 0; Integer Overflow if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } Alias Analysis if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; Data Races } } } Other String
Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; Buffer Overflow Octagon Polyhedra for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } Division by Zero int y3 = * 2 x 1 ; Numerical int index4 = 0; Integer Overflow if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } Interval Pentagon Other Alias Analysis if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; Data Races } } } Other String
Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ }
Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ } Octagon
Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ } 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 4 3 2 𝑦 − 2 0 2 1 𝑧 + 1 2 0 2 𝑧 − 2 3 4 0 Difference Bound Matrix (DBM) Octagon
Octagon Analysis is Expensive Example : Static analyzer for TouchDevelop (Brutschy et al . OOPSLA, 2014) Using APRON Other 4 s 262 s Octagon Single Core
Octagon Analysis is Expensive Example : Static analyzer for TouchDevelop (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA Other 4 s 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core
Octagon Analysis is Expensive Our Contribution: drop-in Example : Static analyzer for TouchDevelop replacement for APRON (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA Other 4 s 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core
Octagon Analysis is Expensive Our Contribution: drop-in Example : Static analyzer for TouchDevelop replacement for APRON (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA • Octagon Speedup: 26 x Other 4 s • Overall Speedup: 19 x • No loss in precision 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core
Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 . 𝑦 − . 0 𝑧 + . . 0 . x = 1; {} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 . 𝑦 − . 0 𝑧 + . . 0 . x = 1; {} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { x ≤ 1, -x ≤ -1 } { x ≤ 1, -x ≤ -1 } 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 𝑧 + . . 0 . {2x ≤ 2, -2x ≤ -2 } 𝑧 − . . 0 𝑛 + . . . . 0 . 𝑛 − . . . . . 0
Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . . 0 . x = 1; {2x ≤ 2, -2x ≤ -2} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . . 0 . x = 1; {2x ≤ 2, -2x ≤ -2} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { y-x ≤ 0, x-y ≤ 0 } { y -x ≤ 0, x-y ≤ 0} 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 𝑧 + . 0 . 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} 𝑧 − . 0 0 𝑛 + . . . . 0 . 𝑛 − . . . . . 0
Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (
Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { x-m ≤ 0 } {x-m ≤ 0 } 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0, 𝑧 + . 0 . 0 x – m ≤ 0 } 𝑧 − . 0 0 𝑛 + . . . 0 . 0 𝑛 − . . . . . 0
Closure (*) increases precision of Join ) ⊔ ) operator x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Closure (*) increases precision of Join ) ⊔ ) operator 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (
Closure (*) increases precision of Join ) ⊔ ) operator 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; * * 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0, 𝑧 + 0 0 -2 -2 -x – y ≤ -2, x + y ≤ 2, -2y ≤ -2, 2y ≤ 2 } 𝑧 − 0 2 0 2 𝑛 + . . . 0 . . 𝑛 − . . . . . 0
Join ( ⊔ ) of two closed Octagons x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (
Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑧 − 0 2 0 2 y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (
Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑧 − 0 2 0 2 y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 -4 assert (y >= m ; ( 𝑦 − 0 4 𝑧 + 0 -1 -5 -6 𝑧 − 0 5 1 6 𝑛 + 0 2 -4 1 -3 -2 𝑛 − . . . . . 0
Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − 𝑧 − 0 2 0 2 y = x ; 𝑦 + 0 𝑛 + . . . . 0 . -2 while (x <= m ( 𝑦 − 0 𝑛 − . . . . . 0 4 𝑧 + 0 x = x + 1; 0 -2 -2 𝑛 + 𝑛 − 𝑦 − 𝑧 − 𝑦 + 𝑧 + 𝑧 − 0 5 1 6 y = y + x; 𝑛 + 𝑦 + 0 0 . . . . . -4 assert (y >= m ; ( 𝑛 − . . . . 𝑦 − . 0 0 4 𝑧 + 0 -1 -5 -6 𝑧 − 0 5 1 6 𝑛 + 0 2 -4 1 -3 -2 𝑛 − . . . . . 0
Recommend
More recommend
