Towards Deductive Compilation: Implementing a Partial Evaluator Via - - PowerPoint PPT Presentation

▶
towards deductive compilation implementing a partial
SMART_READER_LITE
LIVE PREVIEW

Towards Deductive Compilation: Implementing a Partial Evaluator Via - - PowerPoint PPT Presentation

Dec 08, 2022 283 likes •1.12k views

Towards Deductive Compilation: Implementing a Partial Evaluator Via a Software Verification Tool Reiner H ahnle (joint work with Richard Bubel and Ran Ji) Chalmers University of Technology Department of Computer Science and Engineering 10

slide-1
SLIDE 1

Towards Deductive Compilation: Implementing a Partial Evaluator Via a Software Verification Tool

Reiner H¨ ahnle

(joint work with Richard Bubel and Ran Ji)

Chalmers University of Technology Department of Computer Science and Engineering

10 March 2011 Seminar “Deduction at Scale” Schloss Ringberg, March 2011

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 1 / 20

slide-2
SLIDE 2

Introduction

Starting Point Program verification tool (KeY) based on Dynamic logic for Java source code First-order theorem proving Symbolic execution Invariant reasoning

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 2 / 20

slide-3
SLIDE 3

Introduction

Starting Point Program verification tool (KeY) based on Dynamic logic for Java source code First-order theorem proving Symbolic execution Invariant reasoning Constructing a specialized program from a verification proof attempt

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 2 / 20

slide-4
SLIDE 4

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} h = a.length; ⇐ pc l = 0; ✇❤✐❧❡ (a[(h-l)/2] >0) { body } rest

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-5
SLIDE 5

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✇❤✐❧❡ (a[(h-l)/2] >0) {⇐ body } rest h=a.length l=0 {h := a.length | l := 0} a!=♥✉❧❧ && a.length>0

1 Precondition is path condition in SE tree; nodes have symbolic state Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-6
SLIDE 6

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✐♥t _i = a.length -0; ⇐ ✐♥t _j = _i/2; ✐♥t _k = a[_j]; ❜♦♦❧❡❛♥ _g = (_k >0); ✇❤✐❧❡ (_g) { body } rest h=a.length l=0 {h := a.length | l := 0} a!=♥✉❧❧ && a.length>0

1 Precondition is path condition in SE tree; nodes have symbolic state 2 Local program transformation: simple, side-effect free expressions Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-7
SLIDE 7

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ❜♦♦❧❡❛♥ _g = (_k >0); ⇐ ✇❤✐❧❡ (_g) { body } rest h=a.length l=0 _k=a[a.length/2] a!=♥✉❧❧ && a.length>0

1 Precondition is path condition in SE tree; nodes have symbolic state 2 Local program transformation: simple, side-effect free expressions Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-8
SLIDE 8

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ❜♦♦❧❡❛♥ _g = (_k >0); ⇐ ✇❤✐❧❡ (_g) { body } rest h=a.length l=0 _k=a[a.length/2] a!=♥✉❧❧ && a.length>0

simplification c h e c k

1 Precondition is path condition in SE tree; nodes have symbolic state 2 Local program transformation: simple, side-effect free expressions 3 First-order reasoning required for simplification, checking bounds Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-9
SLIDE 9

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✇❤✐❧❡ (_g) { body } rest _g=... ✇❤✐❧❡ body rest _g && I !_g && I

1 Precondition is path condition in SE tree; nodes have symbolic state 2 Local program transformation: simple, side-effect free expressions 3 First-order reasoning required for simplification, checking bounds 4 Execute loop under suitable invariant Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-10
SLIDE 10

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✇❤✐❧❡ (_g) { body } rest _g=... ✇❤✐❧❡ body rest _g && I !_g && I

1 Precondition is path condition in SE tree; nodes have symbolic state 2 Local program transformation: simple, side-effect free expressions 3 First-order reasoning required for simplification, checking bounds 4 Execute loop under suitable invariant 5 View SE as depth left first AST traversal (inlined first argument of ;) Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-11
SLIDE 11

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✇❤✐❧❡ (_g) { body } rest _g=... ✇❤✐❧❡ body rest _g && I !_g && I

Observations

1

Transformation of complex assignments, symbolic state simplification: single static assignment (SSA) form easily obtainable

2

If strongest postcondition not needed, can use tr✉❡ as invariant

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-12
SLIDE 12

Overview of Symbolic Execution

{a!=♥✉❧❧ && a.length >0} ✇❤✐❧❡ (_g) { body } rest _g=... ✇❤✐❧❡ body rest _g && I !_g && I

Observations

1

Transformation of complex assignments, symbolic state simplification: single static assignment (SSA) form easily obtainable

2

If strongest postcondition not needed, can use tr✉❡ as invariant

3

May synthesize specialized program by bottom-up AST traversal: Backward Analysis used variables, etc. Program Specialisation dead code elimination, condition evaluation

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 3 / 20

slide-13
SLIDE 13

Program Logic Calculus

Calculus

ruleName

Γ1 = ⇒ U1[p1] . . . Γn = ⇒ Un[pn] Γ = ⇒ U[p]

Notation:

Γ: path conditions (set of formulas) U: update (information from the program has been excuted) p: Java program (program to be excuted)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 4 / 20

slide-14
SLIDE 14

Program Logic Calculus

Calculus

ruleName

Γ1 = ⇒ U1[p1] . . . Γn = ⇒ Un[pn] Γ = ⇒ U[p]

Notation:

Γ: path conditions (set of formulas) U: update (information from the program has been excuted) p: Java program (program to be excuted) rule application from bottom-to-top postcondition ignored

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 4 / 20

slide-15
SLIDE 15

Interleaving Symbolic Execution and Partial Evaluation

Proof-Search Space Reduction can be achieved by adding calculus rules performing (or invoking) a basic partial evaluator (FMCO 2009): constant propagation constant expression evaluation dead-code elimination

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 5 / 20

slide-16
SLIDE 16

Interleaving Symbolic Execution and Partial Evaluation

Proof-Search Space Reduction can be achieved by adding calculus rules performing (or invoking) a basic partial evaluator (FMCO 2009): constant propagation constant expression evaluation dead-code elimination One reason why this is a good idea: Proof branching during symbolic execution creates new static input values: U(b) = ⇒ U[ack=true;r] U(¬b) = ⇒ U[ack=false;r] = ⇒ U[if (b) {ack=true;} else {ack=false;} r]

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 5 / 20

slide-17
SLIDE 17

Interleaving Symbolic Execution and Partial Evaluation

Proof-Search Space Reduction can be achieved by adding calculus rules performing (or invoking) a basic partial evaluator (FMCO 2009): constant propagation constant expression evaluation dead-code elimination One reason why this is a good idea: Proof branching during symbolic execution creates new static input values: U(b) = ⇒ U[ack=true;r] U(¬b) = ⇒ U[ack=false;r] = ⇒ U[if (b) {ack=true;} else {ack=false;} r] Can we extract a specialized program out of a verification proof?

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 5 / 20

slide-18
SLIDE 18

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p]

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-19
SLIDE 19

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-20
SLIDE 20

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal Fwd: program information maintained in forward analysis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-21
SLIDE 21

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal Fwd: program information maintained in forward analysis

◮ program variables potentially read in continuation of p Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-22
SLIDE 22

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal Fwd: program information maintained in forward analysis

◮ program variables potentially read in continuation of p

Bk = sp, use: program information synthesized in backward analysis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-23
SLIDE 23

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal Fwd: program information maintained in forward analysis

◮ program variables potentially read in continuation of p

Bk = sp, use: program information synthesized in backward analysis

◮ sp: generated specialized program of Java source program p ◮ use: program variables used in p (or continuation of p) Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-24
SLIDE 24

Program Specialization

Extended Symbolic State Node Γ = ⇒ U[p] | (Fwd)(Bk) Sequent annotated with (Fwd)(Bk) : program analysis and synthesis results from AST traversal Fwd: program information maintained in forward analysis

◮ program variables potentially read in continuation of p

Bk = sp, use: program information synthesized in backward analysis

◮ sp: generated specialized program of Java source program p ◮ use: program variables used in p (or continuation of p)

In general, Fwd and Bk could contain other information

◮ View as specific pre-/postconditions or constraint system Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 6 / 20

slide-25
SLIDE 25

Program Generation Rules

Γ1 = ⇒ U1[p1] | (X1)(sp1, use1) . . . Γn = ⇒ Un[pn] | (Xn)(spn, usen) Γ = ⇒ U[p] | (X)(sp, use)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 7 / 20

slide-26
SLIDE 26

Program Generation Rules

Γ1 = ⇒ U1[p1] | (X1)(sp1, use1) . . . Γn = ⇒ Un[pn] | (Xn)(spn, usen) Γ = ⇒ U[p] | (X)(sp, use)

symb. exec.

Java source code executed

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 7 / 20

slide-27
SLIDE 27

Program Generation Rules

Γ1 = ⇒ U1[p1] | (X1)(sp1, use1) . . . Γn = ⇒ Un[pn] | (Xn)(spn, usen) Γ = ⇒ U[p] | (X)(sp, use)

symb. exec. progr. synth.

Java source code executed then specialized program synthesized

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 7 / 20

slide-28
SLIDE 28

Program Generation Rules

Γ1 = ⇒ U1[p1] | (X1)(sp1, use1) . . . Γn = ⇒ Un[pn] | (Xn)(spn, usen) Γ = ⇒ U[p] | (X)(sp, use)

symb. exec. progr. synth.

Java source code executed then specialized program synthesized Establishing rule correctness requires to prove bisimulation property of

  • riginal and specialized program

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 7 / 20

slide-29
SLIDE 29

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-30
SLIDE 30

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-31
SLIDE 31

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis ensures variables X read in program continuation are in used variables set (e.g., return variable)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-32
SLIDE 32

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis ensures variables X read in program continuation are in used variables set (e.g., return variable) assignment Γ = ⇒ U{l := r}[rest] | (X)(rest, use) Γ = ⇒ U[l = r;rest] | (X) l = r; rest, (use − {l} ∪ locs(r)) if l ∈ use rest, use

  • therwise
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-33
SLIDE 33

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis ensures variables X read in program continuation are in used variables set (e.g., return variable) assignment Γ = ⇒ U{l := r}[rest] | (X)(rest, use) Γ = ⇒ U[l = r;rest] | (X) l = r; rest, (use − {l} ∪ locs(r)) if l ∈ use rest, use

  • therwise
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-34
SLIDE 34

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis ensures variables X read in program continuation are in used variables set (e.g., return variable) assignment Γ = ⇒ U{l := r}[rest] | (X)(rest, use) Γ = ⇒ U[l = r;rest] | (X) l = r; rest, (use − {l} ∪ locs(r)) if l ∈ use rest, use

  • therwise
  • updates used variable set

assignment to unused variable deleted

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-35
SLIDE 35

Selected Program Generation Rules

emptyBox Γ = ⇒ U | (X)( , ) Γ = ⇒ U[] | (X)(nop, X) ’initiates’ backward program synthesis ensures variables X read in program continuation are in used variables set (e.g., return variable) assignment Γ = ⇒ U{l := r}[rest] | (X)(rest, use) Γ = ⇒ U[l = r;rest] | (X) l = r; rest, (use − {l} ∪ locs(r)) if l ∈ use rest, use

  • therwise
  • updates used variable set

assignment to unused variable deleted

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 8 / 20

slide-36
SLIDE 36

Conditional Rule

conditional

Γ, Ub = ⇒ U[p;rest] | (X) (p; rest, usep;rest) Γ, U(¬b) = ⇒ U[q;rest] | (X) (q; rest, useq;rest) Γ = ⇒ U[if (b) {p} else {q};rest] | (X) if (b) {p; rest} else {q; rest} , (usep;rest ∪ useq;rest ∪ locs(b))

  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 9 / 20

slide-37
SLIDE 37

Conditional Rule

conditional

Γ, Ub = ⇒ U[p;rest] | (X) (p; rest, usep;rest) Γ, U(¬b) = ⇒ U[q;rest] | (X) (q; rest, useq;rest) Γ = ⇒ U[if (b) {p} else {q};rest] | (X) if (b) {p; rest} else {q; rest} , (usep;rest ∪ useq;rest ∪ locs(b))

  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 9 / 20

slide-38
SLIDE 38

Conditional Rule

conditional

Γ, Ub = ⇒ U[p;rest] | (X) (p; rest, usep;rest) Γ, U(¬b) = ⇒ U[q;rest] | (X) (q; rest, useq;rest) Γ = ⇒ U[if (b) {p} else {q};rest] | (X) if (b) {p; rest} else {q; rest} , (usep;rest ∪ useq;rest ∪ locs(b))

  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 9 / 20

slide-39
SLIDE 39

Conditional Rule

conditional

Γ, Ub = ⇒ U[p;rest] | (X) (p; rest, usep;rest) Γ, U(¬b) = ⇒ U[q;rest] | (X) (q; rest, useq;rest) Γ = ⇒ U[if (b) {p} else {q};rest] | (X) if (b) {p; rest} else {q; rest} , (usep;rest ∪ useq;rest ∪ locs(b))

  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 9 / 20

slide-40
SLIDE 40

Generating Specialized Programs containing Loops

loopUnwind

Γ = ⇒ U[✐❢ (b) { p; ✇❤✐❧❡ (b) p} rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Γ =

⇒ U[✇❤✐❧❡ (b) {p}; rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 10 / 20

slide-41
SLIDE 41

Generating Specialized Programs containing Loops

loopUnwind

Γ = ⇒ U[✐❢ (b) { p; ✇❤✐❧❡ (b) p} rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Γ =

⇒ U[✇❤✐❧❡ (b) {p}; rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 10 / 20

slide-42
SLIDE 42

Generating Specialized Programs containing Loops

loopUnwind

Γ = ⇒ U[✐❢ (b) { p; ✇❤✐❧❡ (b) p} rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Γ =

⇒ U[✇❤✐❧❡ (b) {p}; rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 10 / 20

slide-43
SLIDE 43

Generating Specialized Programs containing Loops

loopUnwind

Γ = ⇒ U[✐❢ (b) { p; ✇❤✐❧❡ (b) p} rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Γ =

⇒ U[✇❤✐❧❡ (b) {p}; rest] | (X)

  • if(b){p; while(b)p} rest , use
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 10 / 20

slide-44
SLIDE 44

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] tr✉❡

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-45
SLIDE 45

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] Since we are not interested in proving correctness, use tr✉❡ as invariant!

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-46
SLIDE 46

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] Since we are not interested in proving correctness, use tr✉❡ as invariant!

loopInvariantTrue

Γ, UVab = ⇒ [p] | (X ∪ userest ∪ locs(b)) (p, usebody) Γ, UVa¬b = ⇒ [rest] | (X) (rest, userest) Γ = ⇒ U[while (b) {p} rest] | (X)

  • while(b){p} rest , (usebody ∪ userest ∪ locs(b))
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-47
SLIDE 47

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] Since we are not interested in proving correctness, use tr✉❡ as invariant!

loopInvariantTrue

Γ, UVab = ⇒ [p] | (X ∪ userest ∪ locs(b)) (p, usebody) Γ, UVa¬b = ⇒ [rest] | (X) (rest, userest) Γ = ⇒ U[while (b) {p} rest] | (X)

  • while(b){p} rest , (usebody ∪ userest ∪ locs(b))
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-48
SLIDE 48

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] Since we are not interested in proving correctness, use tr✉❡ as invariant!

loopInvariantTrue

Γ, UVab = ⇒ [p] | (X ∪ userest ∪ locs(b)) (p, usebody) Γ, UVa¬b = ⇒ [rest] | (X) (rest, userest) Γ = ⇒ U[while (b) {p} rest] | (X)

  • while(b){p} rest , (usebody ∪ userest ∪ locs(b))
  • Bubel/H¨

ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-49
SLIDE 49

Loop Invariant Rule

loopInvariant

Γ = ⇒ UInv Γ, UVa(Inv ∧ b) = ⇒ [p]Inv Γ, UVa(Inv ∧ ¬b) = ⇒ [rest] Γ = ⇒ U[while (b) {p} rest] Since we are not interested in proving correctness, use tr✉❡ as invariant!

loopInvariantTrue

Γ, UVab = ⇒ [p] | (X ∪ userest ∪ locs(b)) (p, usebody) Γ, UVa¬b = ⇒ [rest] | (X) (rest, userest) Γ = ⇒ U[while (b) {p} rest] | (X)

  • while(b){p} rest , (usebody ∪ userest ∪ locs(b))
  • In “preserves invariant” branch the program variables used in the

continuation of the loop body must be reflected correctly

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 11 / 20

slide-50
SLIDE 50

Work Flow of Synthesizing Loop

... ✇❤✐❧❡ body rest b !b 1 3 4 2

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 12 / 20

slide-51
SLIDE 51

Work Flow of Synthesizing Loop

... ✇❤✐❧❡ body rest b !b 1 3 4 2 Differs from traditional symbolic execution

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 12 / 20

slide-52
SLIDE 52

Work Flow of Synthesizing Loop

... ✇❤✐❧❡ body rest b !b 1 3 4 2 Differs from traditional symbolic execution Differs from strict forward/backward static analysis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 12 / 20

slide-53
SLIDE 53

Example

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Analysis

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 13 / 20

slide-54
SLIDE 54

Example

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Analysis

= ⇒ [i=0;...] | (tot)(sp0, use0)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 13 / 20

slide-55
SLIDE 55

Example

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Analysis

= ⇒ {i := 0}[count=n;...] | (tot)(sp1, use1) = ⇒ [i=0;...] | (tot)(sp0, use0)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 13 / 20

slide-56
SLIDE 56

Example

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Analysis

= ⇒ {. . . ||count := n}[tot=0;while(i<=n)...] | (tot)(sp2, use2) = ⇒ {i := 0}[count=n;...] | (tot)(sp1, use1) = ⇒ [i=0;...] | (tot)(sp0, use0)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 13 / 20

slide-57
SLIDE 57

Example

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Analysis

= ⇒ {. . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3) = ⇒ {. . . ||count := n}[tot=0;while(i<=n)...] | (tot)(sp2, use2) = ⇒ {i := 0}[count=n;...] | (tot)(sp1, use1) = ⇒ [i=0;...] | (tot)(sp0, use0)

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 13 / 20

slide-58
SLIDE 58

Example Cont’d: Loop Unwind

= ⇒ {i := 0|| . . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 14 / 20

slide-59
SLIDE 59

Example Cont’d: Loop Unwind

= ⇒ {i := 0|| . . .}[if(i<=n){...;if(i>=2 && cpn)...;i++;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 14 / 20

slide-60
SLIDE 60

Example Cont’d: Loop Unwind

= ⇒ {i := 0|| . . .}[if(0<=n){...;if(0>=2 && cpn)...;i=0+1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . .}[if(i<=n){...;if(i>=2 && cpn)...;i++;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 14 / 20

slide-61
SLIDE 61

Example Cont’d: Loop Unwind

= ⇒ {i := 0|| . . . ; tot := 0}[if(0<=n){...;tot=0+m;i=1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . .}[if(0<=n){...;if(0>=2 && cpn)...;i=0+1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . .}[if(i<=n){...;if(i>=2 && cpn)...;i++;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 14 / 20

slide-62
SLIDE 62

Example Cont’d: Loop Unwind

= ⇒ {i := 0|| . . . ||tot := 0}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . . ; tot := 0}[if(0<=n){...;tot=0+m;i=1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . .}[if(0<=n){...;if(0>=2 && cpn)...;i=0+1;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . .}[if(i<=n){...;if(i>=2 && cpn)...;i++;while...}] | (tot)(sp3, use3) = ⇒ {i := 0|| . . . ||tot := 0}[while(i<=n)...] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 14 / 20

slide-63
SLIDE 63

Example Cont’d: Loop Unwind 2nd Round

= ⇒ {. . .}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 15 / 20

slide-64
SLIDE 64

Example Cont’d: Loop Unwind 2nd Round

¬(0 <= n) = ⇒ {. . .}[] | (tot)(nop, tot) 0 <= n = ⇒ {. . .}[int m=read();...] | (tot)(sp4, use4) = ⇒ {. . .}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 15 / 20

slide-65
SLIDE 65

Example Cont’d: Loop Unwind 2nd Round

0 <= n = ⇒ {. . . m := read()tot := mi := 1}[while(i<=n)...] | (tot)(sp5, use5) . . . ¬(0 <= n) = ⇒ {. . .}[] | (tot)(nop, tot) 0 <= n = ⇒ {. . .}[int m=read();...] | (tot)(sp4, use4) = ⇒ {. . .}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 15 / 20

slide-66
SLIDE 66

Example Cont’d: Loop Unwind 2nd Round

0 <= n = ⇒ {. . .}[if(i<=n)...;while...] | (tot)(sp5, use5) 0 <= n = ⇒ {. . . m := read()tot := mi := 1}[while(i<=n)...] | (tot)(sp5, use5) . . . ¬(0 <= n) = ⇒ {. . .}[] | (tot)(nop, tot) 0 <= n = ⇒ {. . .}[int m=read();...] | (tot)(sp4, use4) = ⇒ {. . .}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 15 / 20

slide-67
SLIDE 67

Example Cont’d: Loop Unwind 2nd Round

1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6) . . . 0 <= n = ⇒ {. . .}[if(i<=n)...;while...] | (tot)(sp5, use5) 0 <= n = ⇒ {. . . m := read()tot := mi := 1}[while(i<=n)...] | (tot)(sp5, use5) . . . ¬(0 <= n) = ⇒ {. . .}[] | (tot)(nop, tot) 0 <= n = ⇒ {. . .}[int m=read();...] | (tot)(sp4, use4) = ⇒ {. . .}[if(0<=n){int m=read();tot=m;i=1;while...}] | (tot)(sp3, use3)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 15 / 20

slide-68
SLIDE 68

Example Cont’d: Loop Invariant True

1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-69
SLIDE 69

Example Cont’d: Loop Invariant True

. . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-70
SLIDE 70

Example Cont’d: Loop Invariant True

. . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-71
SLIDE 71

Example Cont’d: Loop Invariant True

. . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-72
SLIDE 72

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-73
SLIDE 73

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . i := i+1}[] | (tot ∪ i)(sp12, use12) . . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Original Java Code

... ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-74
SLIDE 74

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . i := i+1}[] | (tot ∪ i)(sp12, use12) . . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Synthesis

sp12 : nop use12 : {tot, i}

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-75
SLIDE 75

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . i := i+1}[] | (tot ∪ i)(sp12, use12) . . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Synthesis

sp12 : nop use12 : {tot, i} sp10 : tot = tot + m; i + +; use10 : {tot, i}

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-76
SLIDE 76

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . i := i+1}[] | (tot ∪ i)(sp12, use12) . . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Synthesis

sp12 : nop use12 : {tot, i} sp10 : tot = tot + m; i + +; use10 : {tot, i} sp8 : if (cpn){tot = tot + m ∗ 0.9; i + +; } else{tot = tot + m; i + +; } use8 : {tot, i, cpn}

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-77
SLIDE 77

Example Cont’d: Loop Invariant True

. . . = ⇒ {. . . i := i+1}[] | (tot ∪ i)(sp12, use12) . . . = ⇒ {. . . tot := tot+m}[i++;] | (tot ∪ i)(sp11, use11) . . . , cpn = ⇒ . . . | (tot ∪ i)(sp9, use9) . . . , ¬cpn = ⇒ {. . .}[tot=tot+m;...] | (tot ∪ i)(sp10, use10) . . . = ⇒ {m := read()}[if(cpn)...] | (tot ∪ i)(sp8, use8) . . . , ¬(i <= n) = ⇒ [] | (tot)(nop, tot) . . . , i <= n = ⇒ [int ...] | (tot ∪ i ∪ tot)(sp7, use7) 1 <= n = ⇒ {. . . i := 2}[while(i<=n)...] | (tot)(sp6, use6)

Synthesis

sp12 : nop use12 : {tot, i} sp10 : tot = tot + m; i + +; use10 : {tot, i} sp8 : if (cpn){tot = tot + m ∗ 0.9; i + +; } else{tot = tot + m; i + +; } use8 : {tot, i, cpn} sp6 : while(i <= n){int m = read(); if (cpn){tot = tot + m ∗ 0.9; i + +; } else{tot = tot + m; i + +; }} use6 : {tot, i, cpn}

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 16 / 20

slide-78
SLIDE 78

Specialized Program

✇❤✐❧❡ ✐♥t ✐❢ ❡❧s❡ r❡t✉r♥

Specialized Java Code

tot = 0; ✐❢(0 <= n) { ✐♥t m = read(); tot = m; ✐❢(1 <= n) { ✐♥t m = read(); tot = tot + m; i = 2; ✇❤✐❧❡(i <= n) { ✐♥t m = read(); ✐❢ (cpn) { tot = tot + 0.9 ∗ m; i++; } ❡❧s❡ { tot = tot + m; i++; } } } } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 17 / 20

slide-79
SLIDE 79

Specialized Program

Original Java Code

i = 0; count = n; tot = 0; ✇❤✐❧❡(i <= count) { ✐♥t m = read(); ✐❢(i >=2 && cpn) tot = tot + m ∗ 0.9; ❡❧s❡ tot = tot + m; i++; } r❡t✉r♥ tot;

Specialized Java Code

tot = 0; ✐❢(0 <= n) { ✐♥t m = read(); tot = m; ✐❢(1 <= n) { ✐♥t m = read(); tot = tot + m; i = 2; ✇❤✐❧❡(i <= n) { ✐♥t m = read(); ✐❢ (cpn) { tot = tot + 0.9 ∗ m; i++; } ❡❧s❡ { tot = tot + m; i++; } } } } r❡t✉r♥ tot;

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 17 / 20

slide-80
SLIDE 80

Bytecode Compilation

Γ = ⇒ {l := r}[rest] (rest, use) Γ = ⇒ [l=r;rest] iload r; istore l; rest, ((use − {l}) ∪ {r}) if l ∈ use rest, use

  • therwise
  • Realise a rule-based Java bytecode compiler:

Change the target language from Java source code to Java bytecode Single static assignment form: easy to synthesize bytecode Compiler correctness: soundness of program logic + local bisimulation Some available optimizations (FO reasoning, partial evaluation):

◮ dead code elimination (can’t reach unexecuted code in closed branches) ◮ type inference ◮ safety analysis (avoid creation of exception handlers) ◮ constant propagation, expression simplification ◮ precise usage, binding time analysis of variables Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 18 / 20

slide-81
SLIDE 81

Summary

New architecture to construct verified compilers: Verification + PE + local transformation = (verified) compiler Correctness of symbolic execution rules & bisimulation property guarantee correct specialisation/compilation Symbolic execution permits in dynamic analysis at compile time First-order reasoning, partial evaluation integrated

◮ Infeasible path detection + Interleaving partial evaluation:

⇒ specialized and optimized programs

Use-definition chains are maintained to eliminate unused assignments

◮ Further analyses can be added

Contracts (variable import/export) computed automatically: compositional (can compile methods independently) Implementation in KeY verification system ongoing

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 19 / 20

slide-82
SLIDE 82

Related Work, Outlook

Related Work

Compiler verification Hoare’s Grand Challenge “The Verifying Compiler” ⇒ “The Compiling Verifier” Rule-based compilation Translation validation of optimizing compilers Online partial evaluation MSR trace-based compilation

Outlook

Invariants in recursive calls, parallelize independent code Room for heuristics:

◮ to unwind or not to unwind ◮ merge tails (e.g., by computing product)

Import information from other tools, e.g., invariants Add security/safety properties in asserts or postcondition: detect violation and patch with inlined monitors, wrappers, etc.

Bubel/H¨ ahnle/Ji (CTH) Deductive Compilation 10 March 2011 20 / 20