Generating Precise and Concise Procedure Summaries Greta Yorsh Eran Yahav Satish Chandra

2 Our Framework abstract domain & transformers Summary Generator foo(…) { … } summary of foo function from input to output abstract values

3 Our Framework abstract domain & transformers bar(…) { … foo(); … } summary of foo summary of bar Summary Generator

4 Our Framework Summaries abstract domain & transformers Analyzer client library preciseprecise efficientefficient conciseconcise Summary Generator   (restricted) client …

5 class DataReader { FileComp f;... void setComponent(FileComp p) { this.f = p; } FileComp getComponent() { return this.f; }... void nop() { FileComp t; t = getComponent(); setComponent(t); } Example Composition of transformers tr 13  tr 12  tr 23 (A1)(A2) (A3) tr 13 tr 12 A1: A2: A3: tr 23

6 … Main Challenge Composition of transformers Finite representation of iterated composition of transformers loop iterations calling contexts …

7 Express constraints on intermediate states in terms of initial and final states Restrict the representation of transformers –covers all basic statements –closed under composition –finite language Our Approach tr 13 tr 12 tr 23

8 Our Contributions precise, efficient and conciseFramework for generating precise, efficient and concise summaries –language of transformers –composition algorithm Instances of the framework include –known classes: IFDS, IDE –modular constant propagation with aliasing –modular typestate verification with aliasing Prototype and evaluation for typestate

9 Transformers are defined using conditional micro-transformers –partition values into finite number of classes with uniform behavior –compose using case-splitting –restrict the way partitions defined  e.g., no quantifiers Lift to aggregate domains –powerset, product, union –transformers follow domain structure –dependencies between components Key Ideas tr 13 tr 23 tr 12

10 Simple Example: Tracking “Nullness” Abstract value is a set of access paths –e.g., { x.f, y } must have null value Abstract transformer tr operates pointwise on individual access paths using tr AP : tr(X) =   X tr AP (  ) Conditional micro-transformer tr AP maps an access path  to a set of access paths

11 Example: Conditional Micro-Transformer   t  =this.f  t   this.f  =this.f this.f t = this.f { this.f, t } if  = this.f { } if  = t {  }if   t    this.f tr AP (  ) ≡ preconditions (under certain restrictions)

12 class DataReader { FileComp f;... void setComponent(FileComp p) { this.f = p; } FileComp getComponent() { return this.f; }... void nop() { FileComp t; t = getComponent(); setComponent(t); } Example: Composition Algorithm A1: A2: A3: (A1)(A2) (A3) tr 13 tr 12 tr 23 tr 13 (X) =   X (tr AP  tr AP )(  ) 1223 tr 12 (X) =   X tr AP (  ) tr 23 (X) =   X tr AP (  )

13 t = getComponent() setComponent(t)   t  =this.f  t   this.f  =this.f this.f   t  =t  this.f   t  =t this.f   t  =t  this.f   t  =t this.f   t  =t  this.f   t  =t this.f  :=this.f  := t  :=  Example: Composition Algorithm substitution t = getComponent(); setComponent(t) tr AP 12 23

14    =this.f  t   this.f  =this.f  t  =t this.f this.f=t this.f t=t tttthis.f this.f  this.f  this.f  t  this.f   t t  this.f  t  t    t  this.f  :=this.f  :=t  :=  Example: Composition Algorithm t = getComponent(); setComponent(t)

15   =this.f  t   this.f  t=t tthis.f  this.f   t  Example: Composition Algorithm t = getComponent(); setComponent(t)  t  =this.f  t   this.f  =this.f this.f  t = getComponent(); setComponent(t)

16 Case splitting Substitution Consistency checking Simplification Invert operation (details in the paper) Basic Ingredients of Composition t = getComponent(); setComponent(t)   t  =this.f  t   this.f  =this.f this.f t = getComponent() setComponent(t)   t  =t  this.f   t  =t this.f  t  =this.f  t   this.f  =this.f this.f  

17 Related Work Static determination of dynamic properties of recursive procedures [Cousot-Cousot ’79] Functional approach [Sharir-Pnueli ‘81] IFDS problems [Reps-Horwitz-Sagiv POPL’95] IDE problems [Sagiv-Reps-Horwitz TCS ‘96] Relevant Context Inference [Chatterjee-Ryder-Landi POPL’99]

18 Summary Language of transformers Composition algorithm The language is closed under composition The language is expressive Precise and concise procedure summaries