Symbolic Shape Analysis Thomas Wies University of Freiburg, Germany - PowerPoint PPT Presentation

Symbolic Shape Analysis Thomas Wies University of Freiburg, Germany

Motivation class SortedList { private static Node f i r s t ; public static specvar content / ∗ : : : objset ; vardefs v � = n u l l ∧ next ∗ " content == { v . f i r s t v } " ; invariant " tree [ next ] " ; invariant " ∀ v . v ∈ content ∧ v . next � = n u l l − → v . . Node . data ≤ v . next . data " ; ∗ / public static void i n s e r t (Node n ) requires / ∗ : "n � = n u l l ∧ n / ∈ content " modifies content ensures " content = old content ∪ { n } " ∗ / { Node prev = n u l l ; Node curr = f i r s t ; while ( ( curr ! = n u l l ) && ( curr . data < n . data ) ) { prev = curr ; curr = curr . next ; } n . next = curr ; i f ( prev ! = n u l l ) prev . next = n ; else f i r s t = n ; } } Thomas Wies Symbolic Shape Analysis 2 / 34

Motivation Bohne, Symbolic Shape Analysis Implementation Properties verified in previous example: • correctly inserts the element into the list (relates pre- and post states of procedure) • list remains sorted • data structure remains acyclic list • no null pointer dereferences Bohne • accepts annotated Java programs as input • annotations are user-specied formulae: • data structure invariants • procedure contracts (pre- and post conditions) • automatically computes quantified loop invariants • proves desired properties and absence of errors Thomas Wies Symbolic Shape Analysis 3 / 34

Motivation Predicate Abstraction • take transition graph (nodes are states) • define partitioning of nodes through state predicates • abstract transition graph is graph of abstract nodes • abstract nodes are equivalence classes of concrete nodes infinite state space Thomas Wies Symbolic Shape Analysis 4 / 34

Motivation Predicate Abstraction • take transition graph (nodes are states) • define partitioning of nodes through state predicates • abstract transition graph is graph of abstract nodes • abstract nodes are equivalence classes of concrete nodes P 1 ∧ ¬ P 2 ∧ P 3 infinite state space state predicates: P 1 , P 2 , P 3 Thomas Wies Symbolic Shape Analysis 4 / 34

Motivation Shape Analysis à la Sagiv, Reps, and Wilhelm • states are graphs • define partitioning of nodes through predicates on nodes • abstract states are graphs of abstract nodes • abstract nodes are equivalence classes of concrete nodes next next next x next next next y Thomas Wies Symbolic Shape Analysis 5 / 34

Motivation Shape Analysis à la Sagiv, Reps, and Wilhelm • states are graphs • define partitioning of nodes through predicates on nodes • abstract states are graphs of abstract nodes • abstract nodes are equivalence classes of concrete nodes next next next x next next next y Thomas Wies Symbolic Shape Analysis 5 / 34

Motivation shape analysis = 2 predicate abstraction Thomas Wies Symbolic Shape Analysis 6 / 34

Motivation Why go symbolic? Thomas Wies Symbolic Shape Analysis 7 / 34

Motivation Apply not only idea, but also techniques of predicate abstraction. Thomas Wies Symbolic Shape Analysis 8 / 34

Motivation Generic Benefits of Predicate Abstraction • use formulae to represent infinite sets of states • no need to define meaning of abstract values • abstract domain ⊆ concrete domain | • abstraction = entailment = Thomas Wies Symbolic Shape Analysis 9 / 34

Motivation Generic Benefits of Predicate Abstraction • use formulae to represent infinite sets of states • no need to define meaning of abstract values • abstract domain ⊆ concrete domain | • abstraction = entailment = • use reasoning procedures • automation • separation of concerns (black-boxing) • soundness by construction, loss of precision identifiable • get leverage from theorem proving community ⊢ • abstraction = provable entailments Thomas Wies Symbolic Shape Analysis 9 / 34

Motivation Generic Benefits of Predicate Abstraction • use formulae to represent infinite sets of states • no need to define meaning of abstract values • abstract domain ⊆ concrete domain | • abstraction = entailment = • use reasoning procedures • automation • separation of concerns (black-boxing) • soundness by construction, loss of precision identifiable • get leverage from theorem proving community ⊢ • abstraction = provable entailments • abstraction refinement • more automation • symbolic execution of counterexamples • abstract domain ⊂ refined abstract domain Thomas Wies Symbolic Shape Analysis 9 / 34

Symbolic Shape Analysis Outline 1 Boolean heaps (abstract domain) 2 Cartesian post (abstract transformer) 3 Abstraction refinement Thomas Wies Symbolic Shape Analysis 10 / 34

Boolean Heaps Boolean Heaps Partition heap according to finitely many predicates on heap objects. P 1 = { v | v = x } P 2 = { v | v = null } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ ¬ P 2 ∧ P 3 ¬ P 1 ∧ ¬ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next next x . . . null Describe partitioning as a universally quantified formula ∀ v . P 1 ∧ ¬ P 2 ∧ P 3 ∨ ¬ P 1 ∧ ¬ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 ➜ Boolean heaps Thomas Wies Symbolic Shape Analysis 11 / 34

Boolean Heaps Abstract domain = {sets of Boolean heaps} Abstract element Boolean heap � � � � �� � ∀ v . P i , j , k ( v ) abstract node i j k � �� � abstract node ∨ � �� � Boolean heap � �� � ∨ set of Boolean heaps � �� � set of Boolean heaps Thomas Wies Symbolic Shape Analysis 12 / 34

Boolean Heaps Symbolic shape analysis � � � ∀ v . P i , j , k ( v ) i j k ➜ sets of sets of bit-vectors � �� � abstract node (sets of BDDs) � �� � Boolean heap ∼ = abstract state � �� � set of Boolean heaps Predicate abstraction � � P i , j i j ➜ sets of bit-vectors (BDDs) � �� � abstract state � �� � sets of abstract states ➜ Boolean heaps provide extra precision needed for shape analysis. Thomas Wies Symbolic Shape Analysis 13 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps How to compute abstract post on Boolean heaps? post # ( H ) = ? Thomas Wies Symbolic Shape Analysis 14 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps How to compute abstract post on Boolean heaps? post # ( H ) = α ◦ post ◦ γ ( H ) post # is most precise abstract post, but it is also hard to compute. Thomas Wies Symbolic Shape Analysis 14 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps How to compute abstract post on Boolean heaps? post # ( H ) = α ◦ post ◦ γ ( H ) post # is most precise abstract post, but it is also hard to compute. Bohne implements an abstraction of post # that can be computed efficiently. Next slides: Cartesian post. Thomas Wies Symbolic Shape Analysis 14 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps P 1 = { v | v = x } P 2 = { v | next ∗ ( v , null ) } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null ∀ v . P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 Thomas Wies Symbolic Shape Analysis 15 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps P 1 = { v | v = x } P 2 = { v | next ∗ ( v , null ) } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null α ◦ post c ◦ γ ( ∀ v . P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 ) for command c = ( x:=x.next ) Thomas Wies Symbolic Shape Analysis 15 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps P 1 = { v | v = x } P 2 = { v | next ∗ ( v , null ) } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null α ◦ post c ◦ γ ( ∀ v . P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 ) for command c = ( x:=x.next ) next next next x null Thomas Wies Symbolic Shape Analysis 15 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps P 1 = { v | v = x } P 2 = { v | next ∗ ( v , null ) } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null α ◦ post c ◦ γ ( ∀ v . P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 ) for command c = ( x:=x.next ) ¬ P 1 ∧ P 2 ∧ ¬ P 3 P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null ∀ v . ¬ P 1 ∧ P 2 ∧ ¬ P 3 ∨ P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 Thomas Wies Symbolic Shape Analysis 15 / 34

Abstract Transformer Cartesian Post Abstract Post on Boolean Heaps P 1 = { v | v = x } P 2 = { v | next ∗ ( v , null ) } P 3 = { v | next ∗ ( x , v ) } P 1 ∧ P 2 ∧ P 3 ¬ P 1 ∧ P 2 ∧ P 3 next next next x null CartesianPost c ( ∀ v . P 1 ∧ P 2 ∧ P 3 ∨ ¬ P 1 ∧ P 2 ∧ P 3 ) for command c = ( x:=x.next ) ¬ P 1 ∧ P 2 ∧ ¬ P 3 P 2 ∧ P 3 next next next x null ∀ v . ¬ P 1 ∧ P 2 ∧ ¬ P 3 ∨ P 2 ∧ P 3 Thomas Wies Symbolic Shape Analysis 15 / 34