Todays Goal See whats inside Airac V Airac V s Design Overview - PowerPoint PPT Presentation

Airac V ’s Design 1 Jaeho Shin � netj@ropas.snu.ac.kr � ROPAS Show&Tell 2005-12-02 1 Many design choices originate from heavy discussions with Jaehwang Kim.

Airac V ’s Design Today’s Goal ◮ See what’s inside Airac V

Airac V ’s Design Overview Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Program as Graph Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Program as Graph Control Flow Graph Control Flow Graph ◮ A directed, connected graph ◮ Node = basic block ◮ Flow edge ◮ Return edge

Airac V ’s Design Program as Graph Control Flow Graph Why CFG? ◮ Inevitable due to goto s (need to know the target of them anyway) ◮ Natural to treat programs as graphs

Airac V ’s Design Program as Graph Control Flow Graph Node ◮ Three types n : Node = n | ENTRY | EXIT n ◮ Has associated basic block blkof : Node → Block

Airac V ’s Design Program as Graph Control Flow Graph Flow Edges ◮ Successors = set of nodes control flow to Node → 2 Node succ : ◮ Predecessors = set of nodes control flow from Node → 2 Node pred :

Airac V ’s Design Program as Graph Control Flow Graph Basic Block ◮ Two types: call or commands blk : Block CALL | cmd ∗ ::= blk

Airac V ’s Design Program as Graph Control Flow Graph ENTRY and EXIT ◮ One CFG for each procedure ◮ Single ENTRY and single EXIT for a CFG ◮ ENTRY = where procedure begins ◮ EXIT = where procedure ends ◮ C program = set of CFGs

Airac V ’s Design Program as Graph Control Flow Graph Calls and Returns ◮ Call node = whose basic block is CALL ◮ Two edges for a procedure call ◮ call node to procedure’s ENTRY ◮ procedure’s EXIT to return node ◮ Return edge = return node for a call : Node → Node rtrn

Airac V ’s Design Program as Graph Commands Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Program as Graph Commands Commands cmd ∗ | CALL block blk ::= ::= command cmd SET( lv , e ) | ALLOC( lv , a ) | ASSERT( r ) | ESCAPE( e )

Airac V ’s Design Program as Graph Commands Expressesions e ::= n | e + e | lv | & lv expression x | * e | e [ e ] | e . x lvalue lv ::= [ e ] | { x ∗ } a ::= allocation e = e | e < e | ! r relation r ::=

Airac V ’s Design Concrete World Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Concrete World Concrete Domain State = Pos × Mem × Alloc State

Airac V ’s Design Concrete World Concrete Domain Control State = Ctx × Node Pos ( ProcId × RtPos × EscAddr ) ∗ Ctx = = RtPos Pos EscAddr = Addr

Airac V ’s Design Concrete World Concrete Domain Data State Addr fin Mem = → Val = Region × SubAddr + Ctx × Var Addr SubAddr = Index + FieldName Val = Num + Addr + Proc ProcId × Var ∗ Proc =

Airac V ’s Design Concrete World Concrete Domain Allocation State Region fin = → Info Alloc Region = Ctx × History × AllocSite Pos ∗ History = AllocSite = Pos Size + FieldName ∗ Info = = Size Z

Airac V ’s Design Concrete World Concrete Semantics Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Concrete World Concrete Semantics Semantics as Trace ◮ Standard semantics State ∗ = Trace ◮ Collecting semantics 2 Trace

Airac V ’s Design Concrete World Concrete Semantics Transition State after a single transition by � : Trace τ σ, σ ′ : State σ ′ τσ � · · · ◮ Transition depends on the Node of Pos ◮ Node of block is either cmd ∗ or CALL

Airac V ’s Design Concrete World Concrete Semantics Reaction R cmd ∗ ( Mem × Alloc ) → ( Mem × Alloc ) : · · ·

Airac V ’s Design Concrete World Concrete Semantics Values V e : Mem → Val V n m = n V e 1 + e 2 m = ( V e 1 m + V e 2 m ) V lv m m ( L lv m ) = V & lv m = L lv m

Airac V ’s Design Concrete World Concrete Semantics Addresses L lv Mem → Addr : L x m = ( ctx , x ) L * e m = V e m L e 1 [ e 2 ] m = ( a, i + ( V e 2 m )) where ( a, i ) = V e 1 m L e . x m = ( a, x ) where ( a, 0) = V e m

Airac V ’s Design Concrete World Concrete Semantics Relations P r Mem → { true , false } : · · ·

Airac V ’s Design Abstract World Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Abstract World Abstract Domain Control State 2 ˆ Pos × ˆ ˆ Pos Graph = ˆ ˆ Pos = Ctx × Node ˆ = Ctx ProcId 2 Trace → ˆ : α Flow Graph Pos → ˆ pp : Pos Ctx → ˆ cp : Ctx

Airac V ’s Design Abstract World Abstract Domain Data State Pos fin ˆ ˆ ˆ Table = → Mem Addr fin ˆ ˆ → ˆ Mem = Val 2 Trace → ˆ α Data : Table 2 Mem → ˆ : Mem α Mem

Airac V ’s Design Abstract World Abstract Domain Abstract Values ˆ ˆ ˆ ˆ Z × Addr × Val = Proc ˆ SubAddr + ˆ ˆ ˆ Region × Ctx × Var = 2 Addr ˆ ˆ SubAddr = Index + FieldName ˆ 2 Proc Proc = 2 Val → ˆ : Val α Val 2 Addr → ˆ : α Addr Addr 2 Num → ˆ α Num : Z

Airac V ’s Design Abstract World Abstract Domain Allocation State ˆ Region fin ˆ ˆ = → Alloc Info ˆ Size × 2 FieldName ∗ ˆ Info = ˆ ˆ Region = Ctx × AllocSite 2 Trace → ˆ : Alloc α Alloc 2 Info → ˆ : α Info Info

Airac V ’s Design Abstract World Abstract Domain Escape Addresses Ctx fin ˆ ˆ ˆ Dump = → Addr 2 Trace → ˆ : Dump α Dump

Airac V ’s Design Abstract World Trace Abstraction Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

Airac V ’s Design Abstract World Trace Abstraction Trace Abstraction Four components of abstract semantics ˆ ˆ ˆ ˆ Graph × Table × Alloc × ( Dump ) 2 Trace → ( ˆ ˆ ˆ ˆ Graph × Table × Alloc × α : Dump ) = � α Flow , α Data , α Alloc , α Dump � α

Airac V ’s Design Abstract World Trace Abstraction Control State Abstraction 2 Trace → ˆ : α Flow Graph = { (( cp c 1 , n 1 ) , ( cp c 2 , n 2 )) | α Flow T ( · · · , ( p 1 , m 1 , a 1 ) , ( p 2 , m 2 , a 2 ) , · · · ) ∈ T, ( c 1 , n 1 ) = p 1 , ( c 2 , n 2 ) = p 2 }

� � � Airac V ’s Design Abstract World Trace Abstraction Slicing Traces 2 Trace → 2 Pos × Mem × Alloc states : id � 2 State ∗ 2 Trace S ◦{ slices } states 2 Pos × Mem × Alloc 2 State id

� � � � Airac V ’s Design Abstract World Trace Abstraction Allocation State Abstraction 2 Trace → ˆ α Alloc : Alloc { π 3 }◦ states � 2 Alloc id � 2 Region → Info 2 Trace merge Region → 2 Info α Alloc α → ( rp ,α Info ) ˆ ˆ ˆ Region → Info Alloc id

� � � � Airac V ’s Design Abstract World Trace Abstraction Allocation Info Abstraction 2 Info → ˆ : Alloc α Info id � 2 Size + FieldName ∗ 2 Info split 2 Size × 2 FieldName ∗ α Info � � α Num , id � � ˆ ˆ Size × 2 FieldName ∗ Alloc id

� � � � � � Airac V ’s Design Abstract World Trace Abstraction Dump Abstraction 2 Trace → ˆ : α Dump Dump { π 1 }◦ states id � 2 Pos � 2 Ctx × Node 2 Trace { π 1 } 2 Ctx × Ctx 2 Ctx { π 1 , 1 } index α Dump Ctx → 2 Ctx α → ( cp ,α EscAddr ◦ S ) ˆ ˆ ˆ Dump Ctx → Addr id

� � � � Airac V ’s Design Abstract World Trace Abstraction Escape Address Abstraction id � 2 ( ProcId × RtPos × EscAddr ) ∗ 2 Ctx S ◦{ slices } 2 ProcId × RtPos × EscAddr α EscAddr { π 3 } ˆ 2 EscAddr Addr α Addr

Airac V ’s Design Abstract World Data State Abstraction Now, Program as Graph Control Flow Graph Commands Concrete World Concrete Domain Concrete Semantics Abstract World Abstract Domain Trace Abstraction Data State Abstraction Partitioning Abstract Semantics

� � � � Airac V ’s Design Abstract World Data State Abstraction Data State Abstraction 2 Trace → ˆ α Data : Table { π 1 , 2 }◦ states � 2 Pos × Mem 2 Trace index Pos → 2 Mem α Data α → ( pp ,α Mem ◦ S ) ˆ ˆ ˆ Table Pos → Mem id