making numerical program analysis fast
play

Making Numerical Program Analysis Fast Gagandeep Singh Markus - PowerPoint PPT Presentation

Making Numerical Program Analysis Fast Gagandeep Singh Markus Pschel Martin Vechev Department of Computer Science ETH Zrich Static Program Analysis Static Program Analysis public static void verify() { int[] ptr = new int[8]; int start


  1. Making Numerical Program Analysis Fast Gagandeep Singh Markus Püschel Martin Vechev Department of Computer Science ETH Zürich

  2. Static Program Analysis

  3. Static Program Analysis public static void verify() { int[] ptr = new int[8]; int start = 0; for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } int y3 = * 2 x 1 ; int index4 = 0; if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } if (y3 == 36) { index4 = 8; } if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; } } }

  4. Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } int y3 = * 2 x 1 ; Numerical int index4 = 0; if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; } } } Other String

  5. Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; Buffer Overflow for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } Division by Zero int y3 = * 2 x 1 ; Numerical int index4 = 0; Integer Overflow if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } Alias Analysis if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; Data Races } } } Other String

  6. Static Program Analysis Abstract Domains public static void verify() { int[] ptr = new int[8]; int start = 0; Buffer Overflow Octagon Polyhedra for(int i0 = 0; i0 < 8; ++i0) { int x1 = i0 | start; for(int x2 = 0; x2<100000;++x2) } Division by Zero int y3 = * 2 x 1 ; Numerical int index4 = 0; Integer Overflow if (y3 == 0) { index4 = 1; } if (y3 == 49) { index4 = 8; } Heap if (y3 == 36) { index4 = 8; } Interval Pentagon Other Alias Analysis if (y3 == -1) { index4 = 0; } if (y3 == 50) { index4 = 9; } ptr[index4] = 1; Data Races } } } Other String

  7. Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ }

  8. Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ } Octagon

  9. Octagon Abstract Domain (Miné, HOSC, 2006) • Octagonal Inequalities : • Binary: ±x ± y ≤ c, 𝑦 ≠ 𝑧 • Unary: ±2x ≤ 2 d • c, d ∈ ℝ ∪ { ∞ } 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 4 3 2 𝑦 − 2 0 2 1 𝑧 + 1 2 0 2 𝑧 − 2 3 4 0 Difference Bound Matrix (DBM) Octagon

  10. Octagon Analysis is Expensive Example : Static analyzer for TouchDevelop (Brutschy et al . OOPSLA, 2014) Using APRON Other 4 s 262 s Octagon Single Core

  11. Octagon Analysis is Expensive Example : Static analyzer for TouchDevelop (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA Other 4 s 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core

  12. Octagon Analysis is Expensive Our Contribution: drop-in Example : Static analyzer for TouchDevelop replacement for APRON (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA Other 4 s 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core

  13. Octagon Analysis is Expensive Our Contribution: drop-in Example : Static analyzer for TouchDevelop replacement for APRON (Brutschy et al . OOPSLA, 2014) Using APRON Using ELINA • Octagon Speedup: 26 x Other 4 s • Overall Speedup: 19 x • No loss in precision 262 s Octagon Other 4 s Octagon 10 s Single Core Single Core

  14. Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  15. Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  16. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 . 𝑦 − . 0 𝑧 + . . 0 . x = 1; {} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (

  17. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 . 𝑦 − . 0 𝑧 + . . 0 . x = 1; {} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { x ≤ 1, -x ≤ -1 } { x ≤ 1, -x ≤ -1 } 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 𝑧 + . . 0 . {2x ≤ 2, -2x ≤ -2 } 𝑧 − . . 0 𝑛 + . . . . 0 . 𝑛 − . . . . . 0

  18. Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  19. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . . 0 . x = 1; {2x ≤ 2, -2x ≤ -2} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (

  20. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . . 0 . x = 1; {2x ≤ 2, -2x ≤ -2} 𝑧 − . . 0 . y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { y-x ≤ 0, x-y ≤ 0 } { y -x ≤ 0, x-y ≤ 0} 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 𝑧 + . 0 . 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} 𝑧 − . 0 0 𝑛 + . . . . 0 . 𝑛 − . . . . . 0

  21. Octagon Analysis x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  22. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (

  23. Octagon Analysis 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; { x-m ≤ 0 } {x-m ≤ 0 } 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0, 𝑧 + . 0 . 0 x – m ≤ 0 } 𝑧 − . 0 0 𝑛 + . . . 0 . 0 𝑛 − . . . . . 0

  24. Closure (*) increases precision of Join ) ⊔ ) operator x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  25. Closure (*) increases precision of Join ) ⊔ ) operator 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (

  26. Closure (*) increases precision of Join ) ⊔ ) operator 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + . 0 . x = 1; 0 𝑧 − . 0 0 . {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0} y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; * * 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 - 2 assert (y >= m ; ( 𝑦 − 2 0 {2x ≤ 2, -2x ≤ -2, y - x ≤ 0, x – y ≤ 0, 𝑧 + 0 0 -2 -2 -x – y ≤ -2, x + y ≤ 2, -2y ≤ -2, 2y ≤ 2 } 𝑧 − 0 2 0 2 𝑛 + . . . 0 . . 𝑛 − . . . . . 0

  27. Join ( ⊔ ) of two closed Octagons x = 1; y = x ; while (x <= m ( x = x + 1; y = y + x; assert (y >= m ; (

  28. Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑧 − 0 2 0 2 y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; y = y + x; assert (y >= m ; (

  29. Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑧 − 0 2 0 2 y = x ; 𝑛 + . . . . 0 . while (x <= m ( 𝑛 − . . . . . 0 x = x + 1; 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − y = y + x; 𝑦 + 0 -4 assert (y >= m ; ( 𝑦 − 0 4 𝑧 + 0 -1 -5 -6 𝑧 − 0 5 1 6 𝑛 + 0 2 -4 1 -3 -2 𝑛 − . . . . . 0

  30. Join ( ⊔ ) of two closed Octagons 𝑛 + 𝑛 − 𝑦 + 𝑦 − 𝑧 + 𝑧 − 𝑦 + 0 -2 𝑦 − 0 2 𝑧 + 0 x = 1; 0 -2 -2 𝑛 + 𝑛 − 𝑦 − 𝑦 + 𝑧 + 𝑧 − 𝑧 − 0 2 0 2 y = x ; 𝑦 + 0 𝑛 + . . . . 0 . -2 while (x <= m ( 𝑦 − 0 𝑛 − . . . . . 0 4 𝑧 + 0 x = x + 1; 0 -2 -2 𝑛 + 𝑛 − 𝑦 − 𝑧 − 𝑦 + 𝑧 + 𝑧 − 0 5 1 6 y = y + x; 𝑛 + 𝑦 + 0 0 . . . . . -4 assert (y >= m ; ( 𝑛 − . . . . 𝑦 − . 0 0 4 𝑧 + 0 -1 -5 -6 𝑧 − 0 5 1 6 𝑛 + 0 2 -4 1 -3 -2 𝑛 − . . . . . 0

Recommend


More recommend