A Generic Framework for Interprocedural Analysis of Numerical - PowerPoint PPT Presentation

Exploiting the Abstraction: • 5 + 2 x 1 − 13 x 2 = 0 ⇐ = ⇒ [5 , 2 , − 13] [ x 1 , . . . , x k ] t • a An affine relation holds for iff a · x = 0 x = [1 , x 1 , . . . , x k ] t . for ⇐ ⇒ = Thus, affine relation of the state linear relation of the extended state :-) 52

Exploiting the Abstraction: • 5 + 2 x 1 − 13 x 2 = 0 ⇐ = ⇒ [5 , 2 , − 13] [ x 1 , . . . , x k ] t • a An affine relation holds for iff a · x = 0 x = [1 , x 1 , . . . , x k ] t . for ⇐ ⇒ = Thus, affine relation of the state linear relation of the extended state :-) 53

Observation: The following statements are equivalent for X ⊆ R k +1 : a · x for all x ∈ X = 0 (1) a · x for all x ∈ � X � R = 0 (2) ⇒ = = The abstraction α R is lossless :-) 54

Observation: The following statements are equivalent for X ⊆ R k +1 : a · x for all x ∈ X = 0 (1) a · x for all x ∈ � X � R = 0 (2) ⇒ = = The abstraction α R is lossless :-) 55

Our Example: R = Q 2 A relation is valid at point iff it satisfies: a 0 + 2 a 1 + 4 a 2 = 0 a 0 + 6 a 1 − 8 a 2 = 0 a 0 − 2 a 1 − 4 a 2 = 0 = = ⇒ No affine relation holds :-) 56

Our Example: R = Q 2 A relation is valid at point iff it satisfies: a 0 + 2 a 1 + 4 a 2 = 0 a 0 + 6 a 1 − 8 a 2 = 0 a 0 − 2 a 1 − 4 a 2 = 0 = = ⇒ No affine relation holds :-) 57

Corollary: For every PIR R , the set of all affine relations which are valid at a program point can be computed. R Complexity n · k 3 field n · k 3 · log( m ) Z m 58

Outline: • Background • The framework for affine relations • Granger’s analysis • Procedures • Guards • Conclusion 59

R = Z : The Particular Case The following statements are equivalent for X ⊆ Z k +1 : a · x for all x ∈ X = 0 (1) a · x for all x ∈ � X � Z = 0 (2) ⇒ = = The abstraction α Q is good enough !!! 60

R = Z : The Particular Case The following statements are equivalent for X ⊆ Z k +1 : a · x for all x ∈ X = 0 (1) a · x for all x ∈ � X � Z = 0 (2) a · x = 0 for all x ∈ � X � Q (3) ⇒ = = The abstraction α Q is good enough !!! 61

Observation: Granger 1991 The Z -linear closure allows to derive ... • all valid linear relations; and furthermore, • m all valid linear relations modulo any such as 10 + 3 x 1 + x 2 = 0 [20] linear congruence relations ⇒ = = 62

Observation: Granger 1991 The Z -linear closure allows to derive ... • all valid linear relations; • m all valid linear relations modulo any such as 10 + 3 x 1 + x 2 = 0 [20] linear congruence relations ⇒ = = 63

Our Example: R = Z 16 2 A relation is valid at point iff it satisfies: a 0 + 2 a 1 + 4 a 2 = 0 [16] a 0 + 6 a 1 − 8 a 2 = 0 [16] a 0 − 2 a 1 − 4 a 2 = 0 [16] [0 , 0 , 4] , [8 , 4 , 0] Valid affine relations: :-) 64

Our Example: R = Z 16 2 A relation is valid at point iff it satisfies: a 0 + 2 a 1 + 4 a 2 = 0 [16] a 0 + 6 a 1 − 8 a 2 = 0 [16] a 0 − 2 a 1 − 4 a 2 = 0 [16] [0 , 0 , 4] , [8 , 4 , 0] Valid affine relations: :-) 65

Observation: MMO, Seidl 2005 M ⊆ Z k +1 Every Z -module (1) can be characterized by: • all valid linear equalities; together with • all valid linear equalities modulo one suitable m :-) (2) Every other valid congruence relation can be deduced :-) 66

Observation: MMO, Seidl 2005 M ⊆ Z k +1 Every Z -module (1) can be characterized by: • all valid linear equalities; together with • all valid linear equalities modulo one suitable m :-) (2) Every other valid congruence relation can be deduced :-) 67

Our Example: M = � G � Z where         1 1 1             = G  ,  , − 2 2 6               − 8 − 4 4   Idea: m Choose as the determinant :-) ⇒ = = m = 80 68

Our Example: M = � G � Z m The valid relations modulo therefore must satisfy: a 0 + 2 a 1 + 4 a 2 = 0 [80] a 0 + 6 a 1 − 8 a 2 = 0 [80] a 0 − 2 a 1 − 4 a 2 = 0 [80] [40 , 20 , 0] , [8 , 68 , 4] These are: 69

The Algorithm: C ♯ (1) Compute the least solution of Q ; Determine for every u , all valid linear equalities; (2) m ( u ) ; Determine for every u , a suitable modulus (3) C ♯ m = m ( u ) , determine Z m [ u ] ; (4) For Determine the valid Z m -linear equalities at u . (5) 70

The Algorithm: C ♯ (1) Compute the least solution of Q ; Determine for every u , all valid linear equalities; (2) m ( u ) ; Determine for every u , a suitable modulus (3) C ♯ m = m ( u ) , determine Z m [ u ] ; (4) For Determine the valid Z m -linear equalities at u . (5) 71

Theorem 2: MMO., Seidl 2005 C ♯ • Q [ u ] = � G � Q If for some linearly independent G ⊆ C [ u ] , then m ( u ) can be chosen as the determinant of G . • The set of all valid linear congruence equations at program point u can be computed in polynomial time :-) 72

Theorem 2: MMO., Seidl 2005 C ♯ • Q [ u ] = � G � Q If for some linearly independent G ⊆ C [ u ] , then m ( u ) can be chosen as the determinant of G . • The set of all valid linear congruence equations at program point u can be computed in polynomial time :-) 73

Outline: • Background • The framework for affine relations • Granger’s analysis • Procedures • Guards • Conclusion 74

An Example Program: q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 Main : x 1 := 2 4 x 2 := 0 1 q () 5 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 6 3 75

Interprocedural Analysis for Affine Programs: Horwitz et al. linear constants 1996 MMO., S. affine relations over fields 2003 affine relations over random Z p Gulwani, Necula 2005 affine relations over Z m MMO., S. 2005 MMO., S. affine relations over PIRs 2005 76

Interprocedural Analysis for Affine Programs: Horwitz et al. linear constants 1996 MMO., S. affine relations over fields 2003 affine relations over random Z p Gulwani, Necula 2005 affine relations over Z m MMO., S. 2005 MMO., S. affine relations over PIRs 2005 77

The Collecting Semantics • A run through a procedure is a linear transformation of the extended program state :-) • The effect of a procedure is a set of linear transformations :-) • These sets can be described by a constraint system ... 78

Constraint System: ⊇ { Id } E [ start q ] ⊇ E [ q ] E [ return q ] ⊇ ] · E [ u ] E [ v ] [ [ x j := t ] ( u, x j := t, v ) control-flow edge ⊇ E [ q ] · E [ u ] E [ v ] ( u, q, v ) control-flow edge 79

Idea: Apply α R to Sets of Matrices !!! 80

Idea: Apply α R to Sets of Matrices !!! E ♯ ⊒ � Id � R R [ start q ] E ♯ E ♯ ⊒ R [ q ] R [ return q ] E ♯ ] · E ♯ ⊒ R [ v ] [ [ x j := t ] R [ u ] ( u, x j := t, v ) control-flow edge E ♯ E ♯ R [ q ] · E ♯ ⊒ R [ v ] R [ u ] ( u, q, v ) control-flow edge 81

The Example: 1 0 0 0 1 0 0 0 1 q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 1 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 3 82

The Example: 1 0 0 0 1 0 0 0 1 q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 1 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 1 0 0 3 0 1 0 0 0 1 83

The Example: 1 0 0 0 1 0 0 0 1 q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 1 1 0 0 q () 0 3 0 1 0 0 0 3 1 0 3 0 x 1 := 5 ∗ x 1 2 0 3 1 x 2 := x 1 + x 2 1 0 0 1 0 0 3 0 1 0 0 15 0 0 0 1 0 18 1 84

The Example: 1 0 0 0 1 0 0 0 1 q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 1 1 0 0 1 0 0 q () 0 45 0 0 3 0 0 57 1 1 0 0 0 3 1 0 3 0 x 1 := 5 ∗ x 1 2 0 3 1 x 2 := x 1 + x 2 0 0 1 0 0 1 0 0 1 3 0 1 0 0 15 0 0 225 0 0 0 1 0 18 1 0 282 1 85

The Example: 1 0 0 0 1 0 0 0 1 q : x 1 := 3 ∗ x 1 0 x 2 := x 1 + x 2 1 0 0 1 0 0 1 0 0 1 q () 675 0 0 45 0 0 0 3 0 0 57 1 0 849 1 1 0 0 0 3 1 0 3 0 x 1 := 5 ∗ x 1 2 0 3 1 x 2 := x 1 + x 2 0 0 1 0 0 1 0 0 1 3 0 1 0 0 15 0 0 225 0 0 0 1 0 18 1 0 282 1 86

E ♯ R [ q ] The abstract effects can be used to determine the precise linear closure of the reachable extended states: C ♯ R k +1 R [ Main ] ⊒ C ♯ C ♯ R [ start q ] ⊒ R [ q ] 87

E ♯ R [ q ] The abstract effects can be used to determine the precise linear closure of the reachable extended states: C ♯ R k +1 R [ Main ] ⊒ C ♯ C ♯ R [ start q ] ⊒ R [ q ] C ♯ ] ( C ♯ ⊒ R [ v ] [ [ x j := t ] R [ u ]) ( u, x j := t, v ) control-flow edge 88

E ♯ R [ q ] The abstract effects can be used to determine the precise linear closure of the reachable extended states: C ♯ R k +1 R [ Main ] ⊒ C ♯ C ♯ R [ start q ] ⊒ R [ q ] C ♯ ] ( C ♯ ⊒ R [ v ] [ [ x j := t ] R [ u ]) ( u, x j := t, v ) control-flow edge C ♯ E ♯ R [ q ] ( C ♯ R [ v ] ⊒ R [ u ]) , and C ♯ C ♯ R [ q ] ⊒ R [ u ] , ( u, q, v ) control-flow edge 89

Our Example: 1 1 1 0 1 0 q : x 1 := 3 ∗ x 1 0 0 0 1 x 2 := x 1 + x 2 Main : x 1 := 2 4 x 2 := 0 1 q () 5 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 6 0 0 1 0 0 1 0 0 1 225 0 0 1 0 0 15 0 0 3 0 0 1 0 18 1 0 282 1 90

Our Example: 1 1 1 0 1 0 q : x 1 := 3 ∗ x 1 0 0 0 1 x 2 := x 1 + x 2 Main : x 1 := 2 4 x 2 := 0 1 1 2 q () 0 5 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 6 0 0 1 0 0 1 0 0 1 225 0 0 1 0 0 15 0 0 3 0 0 1 0 18 1 0 282 1 91

Our Example: 1 1 1 0 1 0 q : x 1 := 3 ∗ x 1 0 0 0 1 x 2 := x 1 + x 2 Main : x 1 := 2 4 x 2 := 0 1 1 2 q () 0 5 q () x 1 := 5 ∗ x 1 2 x 2 := x 1 + x 2 6 0 0 1 0 0 1 0 0 1 1 1 1 225 0 0 1 0 0 15 0 0 2 30 450 3 0 0 1 0 18 1 0 282 1 0 36 564 92

Theorem 3: E ♯ • precisely yields the linear closure of E :-) R C ♯ • C precisely yields the linear closure of :-) R E ♯ R [ p ] , C ♯ • R [ u ] If R is a PIR, the values are computable :-) R Complexity n · k 8 field n · k 8 · log( m ) Z m 93

Corollary: For every PIR R , the set of all affine relations which are valid at a program point can be computed. R Complexity n · k 8 field n · k 8 · log( m ) Z m n 2 · k 8 · ∆ Z 94

Local Variables, Parameters, Return Values For simplicity assume, • All procedures have equally many locals; • All locals are passed as parameters; • Return values are are passed in global variables. 95

Local Variables, Parameters, Return Values For simplicity assume, • All procedures have equally many locals; • All locals are passed as parameters; • Return values are are passed in global variables. Idea: Projections 96

Example: Globals: x 1 , x 2 Locals: x 3     1 0 0 0 0 0 0 0     0 1 0 0 0 0 0 0     Π glob = Π locs =         0 0 1 0 0 0 0 0         0 0 0 0 0 0 0 1 97

Example: x 1 , x 2 Globals: Locals: x 3     1 0 0 0 0 0 0 0     0 1 0 0 0 0 0 0     Π glob = Π locs =         0 0 1 0 0 0 0 0         0 0 0 0 0 0 0 1 f () The effect of a call is obtained by the operator: H ( � A 1 , . . . , A r � R ) = � Π locs + Π Glob · A i | i = 1 , . . . , r � R 98

Outline: • Background • The framework for affine relations • Granger’s analysis • Procedures • Guards • Conclusion 99

Example: x 1 := 0 x 1 := x 1 + 1 0 1 x 1 = 10? 2 100