Reachability Analysis of Program Variables c 1 , 2 and Fausto Spoto 1 - - PowerPoint PPT Presentation

▶
reachability analysis of program variables
SMART_READER_LITE
LIVE PREVIEW

Reachability Analysis of Program Variables c 1 , 2 and Fausto Spoto 1 - - PowerPoint PPT Presentation

Nov 19, 2022 457 likes •945 views

Reachability Analysis of Program Variables c 1 , 2 and Fausto Spoto 1 urica Nikoli 1. - Dipartimento di Informatica, University of Verona (Italy) 2. - Microsoft Research - University of Trento Centre for Computational and Systems Biology

slide-1
SLIDE 1

Julia

Reachability Analysis of Program Variables

Ðurica Nikoli´ c1,2 and Fausto Spoto1

  • 1. - Dipartimento di Informatica, University of Verona (Italy)
  • 2. - Microsoft Research - University of Trento Centre for Computational and Systems Biology

June 29th, 2012

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 1 / 15

slide-2
SLIDE 2

Introduction

Intuitive definition of Reachability

A A f f g g h h

  • 1
  • 2

x

null null null null

y

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 2 / 15

slide-3
SLIDE 3

Introduction

Intuitive definition of Reachability

A A B m n B m n f f g g 10 45 h h

null

  • 1
  • 3
  • 4
  • 2

x

null null

y

Is there a sequence of fields f1, . . . , fk such that x.f1.. . . .fk = y?

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 2 / 15

slide-4
SLIDE 4

Introduction

Intuitive definition of Reachability

A A B m n B m n f g 10 h

null

  • 1
  • 3
  • 4
  • 2

x

null

45

null

f g h

y

Is there a sequence of fields f1, . . . , fk such that x.f1.. . . .fk = y? x.f.m.n = y

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 2 / 15

slide-5
SLIDE 5

Introduction

Intuitive definition of Reachability

A A B m n B m n f g 10 h

null

  • 1
  • 3
  • 4
  • 2

x

null

45

null

f g h

y

Is there a sequence of fields f1, . . . , fk such that x.f1.. . . .fk = y? x.f.m.n = y

⇒

x reaches y

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 2 / 15

slide-6
SLIDE 6

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-7
SLIDE 7

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Sharing Analysis A A B m n B m n f f g g 10 45 h h

null

  • 1
  • 3
  • 4
  • 2

x

null null

y

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-8
SLIDE 8

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Sharing Analysis A A B m n B m n f f g g 10 45 h h

null

  • 1
  • 3
  • 4
  • 2

x

null null

y

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-9
SLIDE 9

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Sharing Analysis A A B m n B m n f f g g 10 45 h h

null

  • 1
  • 3
  • 4
  • 2

x

null null

y

REACHABILITY entails SHARING SHARING entails REACHABILITY

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-10
SLIDE 10

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Sharing Analysis Aliasing Analysis A A B m n B m n f f g g 10 45 h h

null

  • 1
  • 3
  • 4
  • 2

x y

null null

ALIASING entails REACHABILITY REACHABILITY entails ALIASING

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-11
SLIDE 11

Introduction

Haven’t we solved this problem yet?

There is a lot of pointer analyses: [Hind01] surveys more than 75 papers

Sharing Analysis Aliasing Analysis Shape Analysis

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 3 / 15

slide-12
SLIDE 12

Introduction

Where can it be useful?

Cyclicity Analysis: An assignment y.h = x might make y cyclical?

if x and y share

might happen A A B m n B m n f f g g 10 45 h h

  • 1
  • 3
  • 4
  • 2

x

null null

y

null null

A A B m n B m n f f g g 10 45 h h

  • 1
  • 3
  • 4
  • 2

x

null null

y

null

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 4 / 15

slide-13
SLIDE 13

Introduction

Where can it be useful?

Cyclicity Analysis: An assignment y.h = x might make y cyclical?

if x and y share if x reaches y

YES A A B m n B m n f f g g 10 45 h h

  • 1
  • 3
  • 4
  • 2

x

null null

y

null null

A A B m n B m n f f g g 10 45 h h

  • 1
  • 3
  • 4
  • 2

x

null null

y

null

might happen

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 4 / 15

slide-14
SLIDE 14

Introduction Julia static analyzer - www.juliasoft.com

Julia - a static analyzer for Java and Android

Reachability Analysis has been implemented inside Julia as a supporting analysis for Cyclicity Analysis Side-Effects Analysis Field Initialization Analysis Path-length Analysis               

supporting analyses of Nullness and Termination

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 5 / 15

slide-15
SLIDE 15

Syntax and Semantics of Java Bytecode

Target language: Java bytecode

...

tmp.tail = list;

...

tmp ←→

l4

list ←→

l1 load 4 ListStudent load 1 ListStudent putfield ListStudent.tail: ListStudent

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 6 / 15

slide-16
SLIDE 16

Syntax and Semantics of Java Bytecode

State

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ s0 s1 @ℓ4 @ℓ2

Student

name st1

@ℓ1

ListStudent

head

@ℓ2

tail

Student

name st2

@ℓ3

ListStudent

head

@ℓ4

tail null

Memory µ

local variables stack elements

null

σ = [@ℓ2, 2, @ℓ3, @ℓ4]

  • L

@ℓ2 :: @ℓ4

  • S

, µ

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 7 / 15

slide-17
SLIDE 17

Definition of Reachability

Reachable locations and variables

Reachable locations Lσ(a) Given a state σ = ϕ, µ and a location @ℓ, locations reachable from @ℓ in σ are Lσ(@ℓ) = lfpi≥0Li

σ(@ℓ), where Li σ(@ℓ) represents the set of locations

reachable from @ℓ in i steps, i.e., Li

σ(@ℓ) =

           {@ℓ}

if i = 0

  • @ℓ1∈Li−1

σ (@ℓ)

(rng(µ(@ℓ1).φ) ∩ L) ∪ Li−1

σ (@ℓ)

  • therwise.

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-18
SLIDE 18

Definition of Reachability

Reachable locations and variables

Reachable locations Lσ(a) Given a state σ = ϕ, µ and a location @ℓ, locations reachable from @ℓ in σ are Lσ(@ℓ) = lfpi≥0Li

σ(@ℓ), where Li σ(@ℓ) represents the set of locations

reachable from @ℓ in i steps, i.e., Li

σ(@ℓ) =

           {@ℓ}

if i = 0

  • @ℓ1∈Li−1

σ (@ℓ)

(rng(µ(@ℓ1).φ) ∩ L) ∪ Li−1

σ (@ℓ)

  • therwise.

Reachability of variables aσb We say that a variable b is reachable from a variable a in σ, and we denote it aσb iff ϕ(a), ϕ(b) ∈ L and ϕ(b) ∈ Lσ(a).

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-19
SLIDE 19

Definition of Reachability

Reachable locations and variables

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ

Student

name st1

@ℓ1

ListStudent

head

@ℓ2

tail

Student

name st2

@ℓ3

ListStudent

head

@ℓ4

tail null

Memory µ

local variables stack elements

which locations are reachable from @ℓ4?

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-20
SLIDE 20

Definition of Reachability

Reachable locations and variables

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ

Student

name st1

@ℓ1

ListStudent

head

@ℓ2

tail

Student

name st2

@ℓ3 @ℓ4

tail null

Memory µ

local variables stack elements

ListStudent

head

which locations are reachable from @ℓ4? L0

σ(@ℓ4)

= {@ℓ4}

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-21
SLIDE 21

Definition of Reachability

Reachable locations and variables

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ

Student

name st1

@ℓ1 @ℓ2 @ℓ3

Memory µ

local variables stack elements

ListStudent

head tail null

Student

name st2 tail head

@ℓ4

ListStudent

which locations are reachable from @ℓ4? L0

σ(@ℓ4)

= {@ℓ4} L1

σ(@ℓ4)

= {@ℓ2, @ℓ3, @ℓ4}

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-22
SLIDE 22

Definition of Reachability

Reachable locations and variables

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ

@ℓ1

Memory µ

local variables stack elements

name st1

Student

@ℓ2 @ℓ3 @ℓ4

tail

ListStudent

head

ListStudent

null

Student

name st2 head tail

which locations are reachable from @ℓ4? L0

σ(@ℓ4)

= {@ℓ4} L1

σ(@ℓ4)

= {@ℓ2, @ℓ3, @ℓ4} L2

σ(@ℓ4)

= {@ℓ1, @ℓ2, @ℓ3, @ℓ4} ⇒ Lσ(@ℓ4) = {@ℓ1, @ℓ2, @ℓ3, @ℓ4}

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-23
SLIDE 23

Definition of Reachability

Reachable locations and variables

l1 l2 l3 l4 @ℓ2 2 @ℓ3 @ℓ4 Environment ϕ

@ℓ1

Memory µ

local variables stack elements

name st1

Student

@ℓ2 @ℓ3 @ℓ4

tail

ListStudent

head

ListStudent

null

Student

name st2 head tail

which locations are reachable from @ℓ4? L0

σ(@ℓ4)

= {@ℓ4} L1

σ(@ℓ4)

= {@ℓ2, @ℓ3, @ℓ4} L2

σ(@ℓ4)

= {@ℓ1, @ℓ2, @ℓ3, @ℓ4} ⇒ Lσ(@ℓ4) = {@ℓ1, @ℓ2, @ℓ3, @ℓ4} ϕ(l4) = @ℓ4 ⇒ l4σl4 ϕ(l1) = @ℓ2 ⇒ l4σl1 ϕ(l3) = @ℓ3 ⇒ l4σl3

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 8 / 15

slide-24
SLIDE 24

Reachability Analysis

Abstract Interpretation Framework [CousotCousot77]

C A

α γ

C A

f f ♯ α γ

best correct approximation: f bca = α ◦ f ◦ γ in practice: f ♯ is less precise than f bca and introduces over-approximation

concrete domain abstract domain abstraction map concretization map

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 9 / 15

slide-25
SLIDE 25

Reachability Analysis Abstract states

Concrete and Abstract Domains

Σ - set of all states

V - set of all variables Concrete Domain: C = ℘(Σ), ⊆ Abstract Domain: A = ℘(V × V), ⊆

an abstract element R ∈ A represents those concrete states whose reachability information is over-approximated by the pairs of variables in R we write ab to denote a, b

Concretization Map:

γ(R) = {σ ∈ Σ | ∀a, b ∈ V.aσb ⇒ ab ∈ R}

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 10 / 15

slide-26
SLIDE 26

Reachability Analysis Abstract semantics

Constraint-based static analysis - example

Abstract Constraint Graph (ACG= V, E) gives rise to an

  • ver-approximation of the reachability information

at each point of a program P. the cfg of P gives rise to the nodes and arcs of the ACG, i.e., there is a node for every bytecode and there is an arc between 2 nodes if their corresponding bytecodes are adjacent in the CFG.

each node is decorated by an abstract element,

i.e., by a set of ordered pairs of variables representing an

  • ver-approximation of the reachability information at that point.

arcs propagate approximations of the reachability of their sources,

i.e., they represent abstract semantics of bytecodes. the reachability information of the initial node, corresponding to the beginning of the main method is ∅, and it is propagated through the ACG.

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 11 / 15

slide-27
SLIDE 27

Reachability Analysis Abstract semantics

Constraint-based static analysis - example

load 0 ListStudent call java.lang.Object.init() : void load 0 ListStudent load 1 Student putfield ListStudent.head: Student load 0 ListStudent load 2 ListStudent putfield ListStudent.tail: ListStudent return void catch throw java.lang.Throwable

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 11 / 15

slide-28
SLIDE 28

Reachability Analysis Abstract semantics

Constraint-based static analysis - example

load 0 ListStudent call java.lang.Object.init() : void load 0 ListStudent load 1 Student putfield ListStudent.head: Student load 0 ListStudent load 2 ListStudent putfield ListStudent.tail: ListStudent return void catch throw java.lang.Throwable

e x c e p t i

  • n

e x i t

node A node C catch node 13 exception@init node B store 4 Student node 10 exit@init call ListStudent.init(Student, ListStudent): void node 1 load 0 ListStudent node 2 call java.lang.Object.init() : void node 3 load 0 ListStudent node 4 load 1 Student node 5

putfield ListStudent.head: Student

node 6 load 0 ListStudent node 7 load 2 ListStudent node 8

putfield ListStudent.tail: ListStudent

node 9 return void node 11 catch node 12 throw java.lang.Throwable

♯14 ♯16 ♯16 ♯3 ♯16 ♯12 ♯12 ♯16 ♯7 ♯3 ♯3 ♯6 ♯3 ♯3 ♯6 ♯8 ♯10 ♯13 ♯13

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 11 / 15

slide-29
SLIDE 29

Reachability Analysis Abstract semantics

Constraint-based static analysis - example

load 0 ListStudent call java.lang.Object.init() : void load 0 ListStudent load 1 Student putfield ListStudent.head: Student load 0 ListStudent load 2 ListStudent putfield ListStudent.tail: ListStudent return void catch throw java.lang.Throwable

e x c e p t i

  • n

e x i t

node A node C catch node 13 exception@init node B store 4 Student node 10 exit@init call ListStudent.init(Student, ListStudent): void node 1 load 0 ListStudent node 2 call java.lang.Object.init() : void node 3 load 0 ListStudent node 4 load 1 Student node 5

putfield ListStudent.head: Student

node 6 load 0 ListStudent node 7 load 2 ListStudent node 8

putfield ListStudent.tail: ListStudent

node 9 return void node 11 catch node 12 throw java.lang.Throwable

♯14 ♯16 ♯16 ♯3 ♯16 ♯12 ♯12 ♯16 ♯7 ♯3 ♯3 ♯6 ♯3 ♯3 ♯6 ♯8 ♯10 ♯13 ♯13

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 11 / 15

slide-30
SLIDE 30

Reachability Analysis Abstract semantics

Constraint-based static analysis - example

node 4 load 1 Student node 5

putfield ListStudent.head: Student

node 6 load 0 ListStudent

♯3 ♯6

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 11 / 15

slide-31
SLIDE 31

Reachability Analysis Abstract semantics

Propagation rules - example

ListStudentStudentListStudentListStudent

initial approximation

l0 l0, l0 s0, l1 l1,

l0 l1 l2

type environment

l2 l2, s0 l0, s0 s0

putfield ListStudent.head: Student node 5 load 1 Student node 4

s0

final approximation type environment

#3

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-32
SLIDE 32

Reachability Analysis Abstract semantics

Propagation rules - example

ListStudent ListStudentListStudent

initial approximation

l0 l0, l0 s0, l1 l1,

l0 l1 l2

type environment

l2 l2, s0 l0, s0 s0

putfield ListStudent.head: Student node 5 load 1 Student node 4

s0

final approximation type environment

#3

ListStudent ListStudentListStudent l0 l1 l2 s0 s1 Student Student Student

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-33
SLIDE 33

Reachability Analysis Abstract semantics

Propagation rules - example

ListStudent ListStudentListStudent

initial approximation

l0 l0, l0 s0, l1 l1,

l0 l1 l2

type environment

l2 l2, s0 l0, s0 s0

s0

final approximation type environment

#3

ListStudent ListStudentListStudent l0 l1 l2 s0 s1 Student Student Student

propagation rule

  • if l1
  • a at node 4,

then s1 a at node 5

  • if a
  • l1 at node 4,

then a s1 at node 5

  • l1 s1, s1 l1, s1 s1

load 1 Student node 4 putfield ListStudent.head: Student node 5

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-34
SLIDE 34

Reachability Analysis Abstract semantics

Propagation rules - example

ListStudent ListStudentListStudent

initial approximation

l0 l1 l2

type environment

l2 l2, s0 l0, s0 s0

putfield ListStudent.head: Student node 5 load 1 Student node 4

s0

final approximation type environment

#3

ListStudent ListStudentListStudent l0 l1 l2 s0 s1 Student Student Student

l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1 l0 l0, l0 s0, l1 l1,

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-35
SLIDE 35

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-36
SLIDE 36

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

type environment

ListStudentStudentListStudent l0 l1 l2

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-37
SLIDE 37

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

type environment

ListStudentStudentListStudent l0 l1 l2

  • if ab at node 5

and a, b / ∈{s0, s1}, then ab at node 6

  • if a s0 and s1 b at node 5

and a, b / ∈{s0, s1}, then ab at node 6

propagation rule

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-38
SLIDE 38

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

type environment

ListStudentStudentListStudent l0 l1 l2

  • if ab at node 5

and a, b / ∈{s0, s1}, then ab at node 6

  • if a s0 and s1 b at node 5

and a, b / ∈{s0, s1}, then ab at node 6

propagation rule

l0 l0, l1 l1, l2 l2

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-39
SLIDE 39

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

type environment

ListStudentStudentListStudent l0 l1 l2

  • if ab at node 5

and a, b / ∈{s0, s1}, then ab at node 6

  • if a s0 and s1 b at node 5

and a, b / ∈{s0, s1}, then ab at node 6

propagation rule

l0 l1 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1 l0 s0 s1 l1

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-40
SLIDE 40

Reachability Analysis Abstract semantics

Propagation rules - example

initial approximation type environment

ListStudentStudentListStudentListStudent l0 l1 l2 s0 Student s1

#6 l0 l0, l0 s0, l1 l1, l1 s1, l2 l2, s0 l0, s0 s0, s1 l1, s1 s1

load 0 ListStudent node 6 putfield ListStudent.head: Student node 5

final approximation type environment

l0 l0, l0 l1, l1 l1, l2 l2 ListStudentStudentListStudent

l0 l1 l2

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 12 / 15

slide-41
SLIDE 41

Reachability Analysis Experimental evaluation

reachability analysis side-effects analysis

field initializat.

analysis

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 13 / 15

slide-42
SLIDE 42

Reachability Analysis Experimental evaluation

reachability analysis

45.07%

side-effects analysis

field initializat.

analysis the ratio of pairs of variables v, w such that the analysis concludes that v might reach w, over the total number of pairs of variables of reference type: the lower the ratio, the higher the precision

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 13 / 15

slide-43
SLIDE 43

Reachability Analysis Experimental evaluation

reachability analysis

45.07%

side-effects analysis

−23.47%

field initializat.

analysis which parameters p of a method might be affected by its execution: the method might update a field of an object reachable from p: the lower the numbers, the better the precision

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 13 / 15

slide-44
SLIDE 44

Reachability Analysis Experimental evaluation

reachability analysis

45.07%

side-effects analysis

−23.47%

field initializat.

analysis

+3.46%

the number of fields of reference type proven to be always initialized before being read, in all constructors of their defining class: the higher the numbers, the better the precision

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 13 / 15

slide-45
SLIDE 45

Reachability Analysis Experimental evaluation

reachability analysis

45.07%

side-effects analysis

−23.47%

field initializat.

analysis

+3.46% runtime

nullness analysis

−7.77%

termination analysis

−1.62% warnings −3.38% 0%

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 13 / 15

slide-46
SLIDE 46

Conclusions

Goal: define, formally prove correct and implement a Reachability Analysis of Program Variables for Java bytecode

1

definition a concrete operational semantics of Java bytecode;

2

formal definition a notion of reachability;

3

a constraint-based inter-procedural static analysis based on abstract interpretation;

4

formal proof of correctness of the analysis;

5

implementation of our inter-procedural analysis for full Java bytecode;

6

experimental evaluation of our approach.

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 14 / 15

slide-47
SLIDE 47

Conclusions

Thank You!!!

Ð. Nikoli´ c, F. Spoto (IJCAR 2012) Reachability Analysis of Program Variables June 29th, 2012 15 / 15