SaiDeepTetali PatriceGodefroid,AdityaV.Nori,SriramK.Rajamani - - PowerPoint PPT Presentation

▶
sai deep tetali patrice godefroid aditya v nori sriram k
SMART_READER_LITE
LIVE PREVIEW

SaiDeepTetali PatriceGodefroid,AdityaV.Nori,SriramK.Rajamani - - PowerPoint PPT Presentation

Dec 11, 2023 356 likes •657 views

SaiDeepTetali PatriceGodefroid,AdityaV.Nori,SriramK.Rajamani MicrosoftResearch UCLosAngeles Question Doestheassertionholdforallpossibleinputs?

slide-1
SLIDE 1

Patrice
Godefroid,
Aditya
V.
Nori,
Sriram
K.
Rajamani


Microsoft
Research


Sai
Deep
Tetali


UC
Los
Angeles


slide-2
SLIDE 2

 



Question


Does
the
assertion
hold
for
all
possible
inputs?
 Must
analysis:
finds
bugs,
but
can’t
prove
their

 absence
 May
analysis:
can
prove
the
absence
of
bugs,

 but
can
result
in
false
errors


slide-3
SLIDE 3

 May
analysis
=
predicate
abstraction
(SLAM)
  Must
analysis
=
symbolic
execution
+
tests
(DART)
  Compositional
May‐Must
analysis:



  • Interprocedural
analysis

  • Memoize
and
re‐use
may/must
summaries

  • Allows
fine‐grained
coupling
and
alternation


SMASH ≫ Compositional-May || Compositional-Must!


slide-4
SLIDE 4

void f() { 0: *p = 4; 1: *q = 5; }

test

slide-5
SLIDE 5

proof

1 2 1

void f() { 0: *p = 4; 1: *q = 5; }

slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

7

slide-10
SLIDE 10

1 2 4 6 7 3 5 2

slide-11
SLIDE 11

1 2 4 6 7 3 5 2

slide-12
SLIDE 12

1 2 4 6 7 3 5

frontier


slide-13
SLIDE 13

1 2 4 6 7 3 5

frontier


slide-14
SLIDE 14

1 2 4 6 7 3 5 2

frontier


slide-15
SLIDE 15

must summary

slide-16
SLIDE 16
  • Generate
post
states
by
using
must
summaries


must summary

slide-17
SLIDE 17

must summary

slide-18
SLIDE 18
slide-19
SLIDE 19

1 2 4 6 7 3 5

slide-20
SLIDE 20

1 2 4 6 7 3 5 2

slide-21
SLIDE 21

1 2 4 6 7 3 5

frontier
 must summary

slide-22
SLIDE 22

1 2 4 6 7 3 5

frontier
 must summary

slide-23
SLIDE 23

1 2 4 6 7 3 5 2

frontier


slide-24
SLIDE 24

must must must must must must must must must

slide-25
SLIDE 25

 The
SMASH
implementation
is
a


deterministic
realization
of
the
declarative
 rules


 Input
C
program
is
first
abstractly
interpreted


  • No
pointer
arithmetic
‐‐
*(p+i) is
treated
as
*p
  • Logic
encoding
‐‐
propositional
logic,
linear


arithmetic
and
uninterpreted
functions


 Theorem
prover:
Z3

slide-26
SLIDE 26

We
have
unleashed
the
power
of
alternation!


Statistics
 Das h SMAS H 39 12 Number
of
proofs
 2176 2228 Number
of
bugs
 64 64 Time‐outs
 61 9 Time
(hours)
 117 44

69 drivers
(342000
LOC)
and
85
properties

slide-27
SLIDE 27

 SMASH
is
a
unified
framework
for
compositional


may‐must
program
analysis


 We
have
explained
SMASH
in
the
context
of


existing
analyses
(SLAM,
DART,
Synergy/Dash
…)
 in
the
area


 Empirical
evaluation
shows
that
SMASH can


significantly
outperform
may‐only,
must‐only
and
 non‐compositional
may‐must
algorithms


slide-28
SLIDE 28

http://research.microsoft.com/yogi