Splitting the Control Flow with Boolean Flags Axel Simon ´ Ecole Normale Sup´ erieure, Paris, France A.Simon@ens.fr July 2008 Axel Simon Splitting the Control Flow with Boolean Flags
Good States are Usually Convex Declare C variable int array[12]; . 0 1 2 3 4 5 6 7 8 9 10 11 i Access array[i] within bound if 0 ≤ i and i ≤ 11. Axel Simon Splitting the Control Flow with Boolean Flags
Good States are Usually Convex Declare C variable int array[s]; where s is any int . s -1 0 1 2 3 4 5 6 7 8 9 i Access array[i] within bound if 0 ≤ i and i ≤ s − 1. Axel Simon Splitting the Control Flow with Boolean Flags
Good States are Usually Convex Declare C variable int array[s]; where s is any int . s -1 0 1 2 3 4 5 6 7 8 9 i Access array[i] within bound if 0 ≤ i and i ≤ s − 1. Observations: ◮ One conjunction of linear inequalities is sufficient. Axel Simon Splitting the Control Flow with Boolean Flags
Good States are Usually Convex Declare C variable int array[s]; where s is any int . s -1 0 1 2 3 4 5 6 7 8 9 i Access array[i] within bound if 0 ≤ i and i ≤ s − 1. Observations: ◮ One conjunction of linear inequalities is sufficient. ◮ Such a conjunction defines a convex polyhedron. Axel Simon Splitting the Control Flow with Boolean Flags
Good States are Usually Convex Declare C variable int array[s]; where s is any int . s -1 0 1 2 3 4 5 6 7 8 9 i Access array[i] within bound if 0 ≤ i and i ≤ s − 1. Observations: ◮ One conjunction of linear inequalities is sufficient. ◮ Such a conjunction defines a convex polyhedron. ◮ Verification often possible by inferring a single polyhedron. Axel Simon Splitting the Control Flow with Boolean Flags
Domain of Convex Polyhedra ◮ Properties are expressed over abstract variables X ◮ e.g. value of p is expressed by x p ∈ X ◮ let � x = � x 1 , . . . x n � and { x 1 , . . . x n } = X Axel Simon Splitting the Control Flow with Boolean Flags
Domain of Convex Polyhedra ◮ Properties are expressed over abstract variables X ◮ e.g. value of p is expressed by x p ∈ X ◮ let � x = � x 1 , . . . x n � and { x 1 , . . . x n } = X ◮ The domain of convex polyhedra � Poly X , ⊑ , ⊔ , ⊓� : Ineq X : the set of linear inequalities � a · � x ≤ c , a ∈ Z n , c ∈ Z . � Poly X : subsets of Q n that can be delimited by finite sets of I ⊂ Ineq X ]: subspace of Q n that satisfies � a · � x ≤ c ] a · � x ≤ c [ [ � P 1 ⊑ P 2 : entailment; P 1 ⊆ P 2 P 1 ⊔ P 2 : join; closure of the convex hull of P 1 and P 2 . P 1 ⊓ P 2 : meet; for instance P 1 ⊓ P 2 := P 1 ∩ P 2 Axel Simon Splitting the Control Flow with Boolean Flags
Example: Division by Zero Let − 9 ≤ d ≤ 9 in abstract state P and execute: int r=MAX_INT; if (d!=0) r=v/d; Task: Verify that d is not zero when dividing. Axel Simon Splitting the Control Flow with Boolean Flags
Example: Division by Zero Let − 9 ≤ d ≤ 9 in abstract state P and execute: int r=MAX_INT; if (d!=0) r=v/d; Task: Verify that d is not zero when dividing. ◮ Model d!=0 by P ′ = ( P ⊓ [ [ d ≤ − 1] ]) ⊔ ( P ⊓ [ [ d ≥ 1] ]). ◮ Approximation results in − 9 ≤ d ≤ 9 in P ′ . ◮ Cannot prove v/d correct using P ′ . Axel Simon Splitting the Control Flow with Boolean Flags
Example: Division by Zero Let − 9 ≤ d ≤ 9 in abstract state P and execute: int r=MAX_INT; if (d!=0) r=v/d; Task: Verify that d is not zero when dividing. ◮ Model d!=0 by P ′ = ( P ⊓ [ [ d ≤ − 1] ]) ⊔ ( P ⊓ [ [ d ≥ 1] ]). ◮ Approximation results in − 9 ≤ d ≤ 9 in P ′ . ◮ Cannot prove v/d correct using P ′ . ◮ One solution: Do not join the states P ⊓ [ [ d ≤ − 1] ] and P ⊓ [ [ d ≥ 1] ] until after the division (trace partitioning). ◮ Partitioning the traces: when to split and when to join? Axel Simon Splitting the Control Flow with Boolean Flags
One Polyhedron and one Boolean Flag Idea: add a Boolean flag f to the states that are to be separated. Let P − = P ⊓ [ ] and P + = P ⊓ [ [ { d ≤ − 1 , f = 0 } ] [ { d ≥ 1 , f = 1 } ] ]. Axel Simon Splitting the Control Flow with Boolean Flags
One Polyhedron and one Boolean Flag Idea: add a Boolean flag f to the states that are to be separated. Let P − = P ⊓ [ ] and P + = P ⊓ [ [ { d ≤ − 1 , f = 0 } ] [ { d ≥ 1 , f = 1 } ] ]. Analyze v/d using the state P ′ = P − ⊔ P + : f d=0 + P 1 0 P - d -9 -5 -1 0 1 5 9 Axel Simon Splitting the Control Flow with Boolean Flags
One Polyhedron and one Boolean Flag Idea: add a Boolean flag f to the states that are to be separated. Let P − = P ⊓ [ ] and P + = P ⊓ [ [ { d ≤ − 1 , f = 0 } ] [ { d ≥ 1 , f = 1 } ] ]. Analyze v/d using the state P ′ = P − ⊔ P + : f d=0 + P 1 0 P - d -9 -5 -1 0 1 5 9 ◮ Division by zero possible if P ′ ⊓ [ [ d = 0] ] � = ∅ . Axel Simon Splitting the Control Flow with Boolean Flags
One Polyhedron and one Boolean Flag Idea: add a Boolean flag f to the states that are to be separated. Let P − = P ⊓ [ ] and P + = P ⊓ [ [ { d ≤ − 1 , f = 0 } ] [ { d ≥ 1 , f = 1 } ] ]. Analyze v/d using the state P ′ = P − ⊔ P + : f d=0 + P 1 0 P - d -9 -5 -1 0 1 5 9 ◮ Division by zero possible if P ′ ⊓ [ [ d = 0] ] � = ∅ . ◮ Since d integral, we can conclude that P ′ ∩ [ ] ∩ Z n = ∅ . [ d = 0] Axel Simon Splitting the Control Flow with Boolean Flags
The Main Observation Let P 1 , P 2 ∈ Poly X and let P = ( P 1 ⊓ [ [ f = 0] ]) ⊔ ( P 2 ⊓ [ [ f = 1] ]). Then: ◮ P 1 and P 2 can be recovered from P if ◮ ⊓ satisfies P 1 ⊓ P 2 = � S s.th. S ∩ Z n = P 1 ∩ P 2 ∩ Z n , ◮ P 1 and P 2 are bounded. ◮ Otherwise a loss of information may occur. f d=0 + P 1 0 P - d -9 -5 -1 0 1 5 9 Axel Simon Splitting the Control Flow with Boolean Flags
The Main Observation Let P 1 , P 2 ∈ Poly X and let P = ( P 1 ⊓ [ [ f = 0] ]) ⊔ ( P 2 ⊓ [ [ f = 1] ]). Then: ◮ P 1 and P 2 can be recovered from P if ◮ ⊓ satisfies P 1 ⊓ P 2 = � S s.th. S ∩ Z n = P 1 ∩ P 2 ∩ Z n , ◮ P 1 and P 2 are bounded. ◮ Otherwise a loss of information may occur. E.g.: d ≥ − 9: f d=0 + P 1 0 P - d -9 -5 -1 0 1 5 10 Axel Simon Splitting the Control Flow with Boolean Flags
Using Boolean Flags instead of Reanalyzing a Path Separating two states using a Boolean flag ◮ is conceptually simpler, ◮ still need to decide where to split, ◮ but joining paths is automatic. Axel Simon Splitting the Control Flow with Boolean Flags
Using Boolean Flags instead of Reanalyzing a Path Separating two states using a Boolean flag ◮ is conceptually simpler, ◮ still need to decide where to split, ◮ but joining paths is automatic. Complexity: Polyhedra with integral tightening can express any Boolean function. Examples over two variables: x ⋁ y x ⋀ y x ⊕ y x ⇒ y y y y y 1 1 1 1 0 0 0 0 1 x 1 x 1 x 1 x 0 0 0 0 Axel Simon Splitting the Control Flow with Boolean Flags
Using Boolean Flags instead of Reanalyzing a Path Separating two states using a Boolean flag ◮ is conceptually simpler, ◮ still need to decide where to split, ◮ but joining paths is automatic. Complexity: Polyhedra with integral tightening can express any Boolean function. Examples over two variables: x ⋁ y x ⋀ y x ⊕ y x ⇒ y y y y y 1 1 1 1 0 0 0 0 1 x 1 x 1 x 1 x 0 0 0 0 Indeed, deciding if P ∩ Z n = ∅ is NP-complete. [Schrijver86] Axel Simon Splitting the Control Flow with Boolean Flags
Using Polyhedral Sub-Domains Reduce the complexity by using sub-domains of Z -polyhedra, e.g.: Axel Simon Splitting the Control Flow with Boolean Flags
Using Polyhedral Sub-Domains Reduce the complexity by using sub-domains of Z -polyhedra, e.g.: Octagons [Mine06]: Restrict Ineq X to ± x ± y ≤ c , c ∈ Z . ◮ Modifying the closure yields Z -Octagons and a decision procedure for 2-SAT. [Bagnara08] Axel Simon Splitting the Control Flow with Boolean Flags
Using Polyhedral Sub-Domains Reduce the complexity by using sub-domains of Z -polyhedra, e.g.: Octagons [Mine06]: Restrict Ineq X to ± x ± y ≤ c , c ∈ Z . ◮ Modifying the closure yields Z -Octagons and a decision procedure for 2-SAT. [Bagnara08] TVPI [Simon02]: Restrict Ineq X to ax + by ≤ c . ◮ Emptiness test for TVPI system over Z n is NP-complete [Lagarias85]. Approximation via Planar Integer Hull algorithm [Harvey99]. Axel Simon Splitting the Control Flow with Boolean Flags
Using Polyhedral Sub-Domains Reduce the complexity by using sub-domains of Z -polyhedra, e.g.: Octagons [Mine06]: Restrict Ineq X to ± x ± y ≤ c , c ∈ Z . ◮ Modifying the closure yields Z -Octagons and a decision procedure for 2-SAT. [Bagnara08] TVPI [Simon02]: Restrict Ineq X to ax + by ≤ c . ◮ Emptiness test for TVPI system over Z n is NP-complete [Lagarias85]. Approximation via Planar Integer Hull algorithm [Harvey99]. Polyhedra with Tightening: � a · � x ≤ c where gcd( � a ) = 1. ◮ Refine with Gomory’s cutting plane method. Axel Simon Splitting the Control Flow with Boolean Flags
Recommend
More recommend
