1. Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 12: Abstract Interpretation IV Roman Manevich Ben-Gurion University

2. סקר הוראה מופץ באימייל אנונימי 2

3. Syllabus Semantics Natural Semantics Structural semantics Axiomatic Verification Static Analysis Automating Hoare Logic Control Flow Graphs Equation Systems Collecting Semantics Abstract Interpretation fundamentals LatticesFixed-Points Chaotic Iteration Galois Connections Domain constructors Widening/ Narrowing Analysis Techniques Numerical Domains Alias analysis Interprocedural Analysis Shape Analysis CEGAR Crafting your own Soot From proofs to abstractions Systematically developing transformers 3

4. Previously Solving monotone systems via chaotic iteration Relating abstract semantics and concrete semantics – Galois connection – Sound abstract transformers – Partial reduction – Completeness Implementing transformers 4

5. Agenda Question: given existing abstract interpreters (GC + transformers) can we reuse them to construct a new abstract interpreter? Composing abstract domains (and GCs) Reduced product Implementing composition of analyses 5

6. Composing lattices 6

7. Three example analyses Abstract states are conjunctions of constraints Variable Equalities – VE-factoids = { x=y | x, y  Var}  false VE = (2 VE-factoids, , , , false,  ) Constant Propagation – CP-factoids = { x=c | x  Var, c  Z}  false CP = (2 CP-factoids, , , , false,  ) Available Expressions – AE-factoids = { x=y+z | x  Var, y,z  Var  Z}  false AE = (2 AE-factoids, , , , false,  ) 7

8. Lattice combinators reminder Cartesian Product – L 1 = (D 1,  1,  1,  1,  1,  1 ) L 2 = (D 2,  2,  2,  2,  2,  2 ) – Cart(L 1, L 2 ) = (D 1  D 2,  cart,  cart,  cart,  cart,  cart ) Disjunctive completion – L = (D, , , , ,  ) – Disj(L) = (2 D,  ,  ,  ,  ,   ) Relational Product – Rel(L 1, L 2 ) = Disj(Cart(L 1, L 2 )) 8

9. Cartesian product of complete lattices For two complete lattices L 1 = (D 1,  1,  1,  1,  1,  1 ) L 2 = (D 2,  2,  2,  2,  2,  2 ) Define the poset L cart = (D 1  D 2,  cart,  cart,  cart,  cart,  cart ) as follows: – (x 1, x 2 )  cart (y 1, y 2 ) iff x 1  1 y 1 and x 2  2 y 2 Lemma: L is a complete lattice Define the Cartesian constructor L cart = Cart(L 1, L 2 ) 9

10. Composing Galois connections 10

11. Goal Given two Galois connections, can we combine them to form a new Galois connection? 11

12. Product connection: abstraction 12 CP  VE lattice {a=9, c=9}{c=a} {[a  9, c  9]} collecting lattice {} 

13. Product connection: concretization 13 CP  VE lattice {a=9}{c=a} {[a  9, c  0] [a  9, c  1] [a  9, c  9]... } collecting lattice {} {[a  9, c  9] [a  1, c  1] [a  2, c  2]... }  

14. Product connection: concretization 14 CP  VE lattice {a=9}{c=a} collecting lattice {}  {[a  9, c  9]}

15. Cartesian product of GCs GC A =(C,  A,  A, A) GC B =(C,  B,  B, B) Cartesian Product GC A  B = (C,  A  B,  A  B, A  B) –  A  B (X) = ? –  A  B (  Y 1,Y 2  ) = ? 15

16. Cartesian product of GCs GC A =(C,  A,  A, A) GC B =(C,  B,  B, B) Cartesian Product GC A  B = (C,  A  B,  A  B, A  B) –  A  B (X) =   A (X),  B (X)  –  A  B (  Y 1,Y 2  ) =  A (Y 1 )   B (Y 2 ) 16

17. Product vs. reduced product 17

18. Product vs. reduced product 18 CP  VE lattice {a=9}{c=a}{c=9}{c=a} {a=9, c=9}{c=a} {[a  9, c  9]} collecting lattice {}    

19. Reduced product For two complete lattices L 1 = (D 1,  1,  1,  1,  1,  1 ) L 2 = (D 2,  2,  2,  2,  2,  2 ) Define the reduced poset D 1  D 2 = {(d 1,d 2 )  D 1  D 2 | (d 1,d 2 ) =    (d 1,d 2 ) } L 1  L 2 = (D 1  D 2,  cart,  cart,  cart,  cart,  cart ) 19

20. Cartesian product transformers GC A =(C,  A,  A, A)F A [st] : A  A GC B =(C,  B,  B, B)F B [st] : B  B Cartesian Product GC A  B = (C,  A  B,  A  B, A  B) –  A  B (X) = (  A (X),  B (X)) –  A  B (Y) =  A (X)   B (X) How should we define F A  B [st] : A  B  A  B ? 20

21. Cartesian product transformers GC A =(C,  A,  A, A)F A [st] : A  A GC B =(C,  B,  B, B)F B [st] : B  B Cartesian Product GC A  B = (C,  A  B,  A  B, A  B) –  A  B (X) = (  A (X),  B (X)) –  A  B (Y) =  A (X)   B (X) How should we define F A  B [st] : A  B  A  B ? Idea: F A  B [st](a, b) = (F A [st] a, F B [st] b) Are component-wise transformers precise? 21

22. Cartesian product analysis example Abstract interpreter 1: Constant Propagation Abstract interpreter 2: Variable Equalities Let’s compare – Running them separately and combining results – Running the analysis with their Cartesian product 22 a := 9; b := 9; c := a; CP analysisVE analysis {a=9} {a=9, b=9} {a=9, b=9, c=9} {} {} {c=a}

23. Cartesian product analysis example Abstract interpreter 1: Constant Propagation Abstract interpreter 2: Variable Equalities Let’s compare – Running them separately and combining results – Running the analysis with their Cartesian product 23 CP analysis + VE analysis a := 9; b := 9; c := a; {a=9} {a=9, b=9} {a=9, b=9, c=9, c=a}

24. Cartesian product analysis example Abstract interpreter 1: Constant Propagation Abstract interpreter 2: Variable Equalities Let’s compare – Running them separately and combining results – Running the analysis with their Cartesian product 24 CP  VE analysis Missing {a=b, b=c} a := 9; b := 9; c := a; {a=9} {a=9, b=9} {a=9, b=9, c=9, c=a}

25. Transformers for Cartesian product Naïve (component-wise) transformers do not utilize information from both components – Same as running analyses separately and then combining results Can we treat transformers from each analysis as black box and obtain best transformer for their combination? 25

26. Can we combine transformers modularly? 26 No generic method for any abstract interpretations

27. Implementing approximate reduced product 27

28. Reducing values for CP  VE X = set of CP constraints of the form x=c (e.g., a=9 ) Y = set of VE constraints of the form x=y Reduce CP  VE (X, Y) = (X’, Y’) such that (X’, Y’)  (X’, Y’) Ideas? 28

29. Reducing values for CP  VE X = set of CP constraints of the form x=c (e.g., a=9 ) Y = set of VE constraints of the form x=y Reduce CP  VE (X, Y) = (X’, Y’) such that (X’, Y’)  (X’, Y’) ReduceLeft: – if a=c  X and a=b  Y then add b=c to X ReduceRight: – If a=c and b=c  X then add a=b to Y Keep applying ReduceLeft and ReduceRight and reductions on each domain separately until reaching a fixed-point 29

30. All the code you need to obtain a basic CP  VE implementation 30

31. Implementing reduction for CP  VE 31

32. Transformers for Cartesian product Do we get the best transformer by applying component-wise transformer followed by reduction? – Unfortunately, no (what’s the intuition?) Can we do better? – Logical Product [Gulwani and Tiwari, PLDI 2006] 32

33. A modular approach for approximating reduced product 33

34. Logical product-- Idea: use equalities as common reasoning tool to pass information between two domains Assume A=(D,…) is an abstract domain that supports two operations: for x  D – inferEqualities(x) = { a=b |  (x)  a=b } returns a set of equalities between variables that are satisfied in all states given by x – refineFromEqualities(x, {a=b}) = y such that  (x)=  (y) y  x 34

35. Need to implement interface 35 When interface not implemented default versions of these operations are used

36. VE 36

37. CP 37

38. Implementing CP  VE  AE 38

39. Reducing Cartesian elements 39

40. 40

41. Logical Product- 41 basically the strongest postcondition safely abstracting the existential quantifier

42. Abstracting the existential 42 Reduce the pair Abstract away existential quantifier for each domain

43. Combined analysis example 43

44. Disjunctive completion for path sensitivity 44

45. Information loss example (CP) 45 if (…) b := 5 else b := -5 if (b>0) b := b-5 else b := b+5 assert b==0 {} {b=5} {b=-5} {true} can’t prove

46. Constant Propagation example 46 Lost all information about b at control-flow join

47. Disjunctive completion of a lattice For a complete lattice L = (D, , , , ,  ) Define the powerset lattice L  = (2 D,  ,  ,  ,  ,   )   = ?   = ?   = ?   = ?   = ? Lemma: L  is a complete lattice L  contains all subsets of D, which can be thought of as disjunctions of the corresponding predicates Define the disjunctive completion constructor L  = Disj(L) 47

48. Disjunctive completion for GCs GC A =(C,  A,  C, A) Disjunctive completion GC P(A) = (C,  P(A),  P(A), P(A)) –  P(A) (X) = ? –  P(A) (Y) = ? 48

49. Disjunctive completion for GCs GC A =(C,  A,  C, A) Disjunctive completion GC P(A) = (C,  P(A),  P(A), P(A)) –  P(A) (X) = {  A ({x}) | x  X} –  P(A) (Y) =  {  A (y) | y  Y} What about transformers? 49

50. Information loss example 50 if (…) b := 5 else b := -5 if (b>0) b := b-5 else b := b+5 assert b==0 {} {b=5} {b=-5} {b= 5  b=-5 } {b= 0 } proved

51. Disj(CP) example 51

52. The base lattice CP false 52 {x=0} true {x=-1}{x=-2}{x=1}{x=2} …… false

53. The disjunctive completion of CP false 53 true false {x=-2  x=-1}{x=-2  x=0}{x=-2  x=1}{x=1  x=2} ……… What is the height of this lattice? {x=0}{x=-1}{x=-2}{x=1}{x=2} …… {x=0  x=1  x=2}{x=-1  x=1  x=-2} ……… …

54. Mixing product and disjunctive completion 54

55. Taming disjunctive completion Disjunctive completion is very precise – Maintains distinction between different execution paths – Helps handle conditions precisely – But very expensive – number of abstract states grows exponentially in the number of conditions – May lead to non-termination Base analysis is less precise but terminates How can we increase precision and avoid non- termination? 55

56. Taming disjunctive completion Use different abstractions for different program locations – At loop heads use coarse abstraction (base) – At other points use disjunctive completion Termination is guaranteed (by base domain) Precision increased inside loop body 56

57. With Disj(CP) 57 while (…) { x := x+1 if (…) b := 5 else b := -5 if (b>0) b := b-5 else b := b+5 assert b==0 } Doesn’t terminate

58. With tamed Disj(CP) 58 while (…) { x := x+1 if (…) b := 5 else b := -5 if (b>0) b := b-5 else b := b+5 assert b==0 } terminates CP Disj(CP) What DisjunctiveDomain implements

59. DisjunctiveDomain(CP) example 59

60. Reducing disjunctive elements A disjunctive set X may contain within it an ascending chain Y=a  b  c… We only need max(Y) – remove all elements below 60

61. Relational product construction 61

62. Cartesian product example 62 Lost all information about b at control-flow join

63. Relational product of lattices L 1 = (D 1,  1,  1,  1,  1,  1 ) L 2 = (D 2,  2,  2,  2,  2,  2 ) L rel = (2 D 1  D 2,  rel,  rel,  rel,  rel,  rel ) as follows: – L rel = ? 63

64. Relational product of lattices L 1 = (D 1,  1,  1,  1,  1,  1 ) L 2 = (D 2,  2,  2,  2,  2,  2 ) L rel = (2 D 1  D 2,  rel,  rel,  rel,  rel,  rel ) as follows: – L rel = Disj(Cart(L 1, L 2 )) Lemma: L is a complete lattice What does it buy us? – How is it relative to Cart(Disj(L 1 ), Disj(L 2 ))? What about transformers? 64

65. Relational product of GCs GC A =(C,  A,  A, A) GC B =(C,  B,  B, B) Relational Product GC P(A  B) = (C,  P(A  B),  P(A  B), P(A  B)) –  P(A  B) (X) = ? –  P(A  B) (Y) = ? 65

66. Relational product of GCs GC A =(C,  A,  A, A) GC B =(C,  B,  B, B) Relational Product GC P(A  B) = (C,  P(A  B),  P(A  B), P(A  B)) –  P(A  B) (X) = {(  A ({x}),  B ({x})) | x  X} –  P(A  B) (Y) =  {  A (y A )   B (y B ) | (y A,y B )  Y} 66

67. Relational product example 67 Correlations preserved

68. Function space construction 68

69. Function space GC A =(C,  A,  C, A) GC B =(C,  B,  C, B) Denote the set of monotone functions from A to B by A  B Define  for elements of A  B as follows (a 1, b 1 )  (a 2, b 2 ) = if a 1 =a 2 then {(a 1, b 1  B b 1 )} else {(a 1, b 1 ), (a 2, b 2 )} Reduced cardinal power GC A  B = (C,  A  B,  A  B, A  B) –  A  B (X) =  {(  A ({x}),  B ({x})) | x  X} –  A  B (Y) =  {  A (y A )   B (y B ) | (y A,y B )  Y} Useful when A is small and B is much larger – E.g., typestate verification 69

70. Next lecture: abstract interpretation V