Implementing Partial Evaluator Via Symbolic Execution (Work in - PowerPoint PPT Presentation

Implementing Partial Evaluator Via Symbolic Execution (Work in Progress) Ran Ji Joint work with Reiner H¨ ahnle and Richard Bubel Department of Computer Science and Engineering Chalmers University of Technology May 26, 2010 www.key-project.org www.hats-project.eu Ran Ji KeY’10 100526 1 / 19

Outline ◮ Introduction to partial evaluation ◮ Interleaving symbolic execution and partial evaluation ◮ Implementing partial evaluator via symbolic execution ◮ Summary Ran Ji KeY’10 100526 2 / 19

Partial Evaluation Theorem ( s mn Theorem, Kleene, 1943) Let f ( � y ) be a computable function with � x = x 1 , . . . , x m , � y = y 1 , . . . , y n . x ,� There is an m + 1 -ary primitive recursive function s m n such that: x ) = λ� y . f ( � y ) φ s m x ,� n ( f ,� Proof. Choose s m n such that φ s m x ) binds the first m free variables of f to the n ( f ,� first m arguments, then run f . Ran Ji KeY’10 100526 3 / 19

Partial Evaluation Theorem ( s mn Theorem, Kleene, 1943) Let f ( � y ) be a computable function with � x = x 1 , . . . , x m , � y = y 1 , . . . , y n . x ,� There is an m + 1 -ary primitive recursive function s m n such that: x ) = λ� y . f ( � y ) φ s m x ,� n ( f ,� Proof. Choose s m n such that φ s m x ) binds the first m free variables of f to the n ( f ,� first m arguments, then run f . Research Programme of Partial Evaluation Prove the s mn Theorem in a non-trivial way such that: 1 φ s m x ) is more efficient than f n ( f ,� 2 for programs, not only functions Ran Ji KeY’10 100526 3 / 19

Partial Evaluation, Cont’d Program specialization with optimization as goal ◮ Intended to be fully automatic (cf. program transformation) ◮ Research started 1964ff, 1980s “golden time” ◮ Mainly used in functional/logic programming ◮ Mainly used in compilation, compiler generation, meta-interpretation ◮ Techniques: • folding, constant propagation • binding time analysis (what can be considered as static?) • program point specialization (define+fold) • symbolic execution ◮ side effects, dynamic calls, aliases — gets ugly and somewhat ad hoc ◮ Seemingly no advanced PE for recent Java available (JSpec dead?) Ran Ji KeY’10 100526 4 / 19

Symbolic Execution or Partial Evaluation Both viewed as generalization of standard program execution Ran Ji KeY’10 100526 5 / 19

Symbolic Execution or Partial Evaluation Both viewed as generalization of standard program execution Symbolic Execution Execution of one program run with symbolic values Ran Ji KeY’10 100526 5 / 19

Symbolic Execution or Partial Evaluation Both viewed as generalization of standard program execution Symbolic Execution Execution of one program run with symbolic values Partial Evaluation static input � x partial target evaluator program p mix dynamic specialized pro- specialized output input � gram p � program p � y x x Ran Ji KeY’10 100526 5 / 19

Symbolic Execution and Partial Evaluation: Opportunities Ran Ji KeY’10 100526 6 / 19

Symbolic Execution and Partial Evaluation: Opportunities ◮ Symbolic execution cannot specialize its target code: employ partial evaluation Ran Ji KeY’10 100526 6 / 19

Symbolic Execution and Partial Evaluation: Opportunities ◮ Symbolic execution cannot specialize its target code: employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09) Ran Ji KeY’10 100526 6 / 19

Symbolic Execution and Partial Evaluation: Opportunities ◮ Symbolic execution cannot specialize its target code: employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09) ◮ Partial evaluation approximates operational semantics: gain precision with complete symbolic execution engine Ran Ji KeY’10 100526 6 / 19

Symbolic Execution and Partial Evaluation: Opportunities ◮ Symbolic execution cannot specialize its target code: employ partial evaluation Interleaving symbolic execution and partial evaluation, to boost the performance of symbolic execution (FMCO’09) ◮ Partial evaluation approximates operational semantics: gain precision with complete symbolic execution engine Interleaving symbolic execution and partial evaluation, to achieve a sophisticated partial evaluator (Work in progress!) Ran Ji KeY’10 100526 6 / 19

Running Example: Control Circuit y = 80; threshold = 100; if (y > threshold) { decrease = true ; } else { decrease = false ; } while ( | y − threshold | > eps) { y = decrease ? y − 1 : y+1; } Ran Ji KeY’10 100526 7 / 19

Control-Flow Graph (CFG) y=80 y = 80; threshold=100 threshold = 100; y > threshold ? if (y > threshold) decrease= true decrease= false { decrease = true ; } else { decrease = false ; } | y − threshold | > eps ? while ( | y − threshold | > eps) { decrease ? y = decrease ? y − 1 : y+1; y=y − 1 y=y+1 } • • Ran Ji KeY’10 100526 8 / 19

Partial Evaluation On CFG y=80 Variables Value y threshold=100 threshold y > threshold ? decrease decrease= true decrease= false Static information propagated along CFG: | y − threshold | > eps ? decrease ? y=y − 1 y=y+1 • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold y > threshold ? decrease decrease= true decrease= false Static information propagated along CFG: | y − threshold | > eps ? decrease ? y=y − 1 y=y+1 • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 y > threshold ? decrease decrease= true decrease= false Static information propagated along CFG: | y − threshold | > eps ? decrease ? y=y − 1 y=y+1 • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 80 > 100 ? decrease decrease= true decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation decrease ? y=y − 1 y=y+1 • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 decrease false decrease= true decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 decrease false decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y 80 threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y - threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − threshold | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y - threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − 100 | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y - threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − 100 | > eps ? ◮ constant propagation ◮ constant expression decrease ? evaluation y=y − 1 y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y - threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − 100 | > eps ? ◮ constant propagation ◮ constant expression false evaluation y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19

Partial Evaluation On CFG y=80 Variables Value y - threshold=100 threshold 100 decrease false false decrease= false Static information propagated along CFG: | y − 100 | > eps ? ◮ constant propagation ◮ constant expression false evaluation y=y+1 ◮ dead code elimination • • Ran Ji KeY’10 100526 9 / 19