Bytecode'13 presentation

Field-Sensitive Unreachability and Non-Cyclicity Analysis

Enrico Scapin and Fausto Spoto

Dipartimento di Informatica - University of Verona (Italy)

BYTECODE/ETAPS 2013

Scapin and Spoto (univr.it) Unreachability & Non-Cyclicity Analysis BYTECODE’13 1 / 15

Static Analysis

Static Analysis

Deﬁnition
Static analysis consists in building compile-time techniques in order to
prove properties of programs before actually running them.

Shape Analyses try to understand how the program execution
manipulates the heap.
e.g.,
sharing analysis determines if two variables might be bound to
overlapping data structures.
reachability analysis determines if exists a path in memory that links
two variables.
cyclicity analysis determines if a variable is bound to a cyclical data
structure.


State of the Art

State of the Art
Reachability and Cyclicity, state of the art:
Stefano Rossignoli and Fausto Spoto, "Detecting non-cyclicity by abstract compilation into boolean
functions". In: VMCAI’06
Samir Genaim and Damiano Zanardini, "Reachability-based Acyclicity Analysis by Abstract Interpretation".
In: CoRR’12
Ðurica Nikolić and Fausto Spoto, "Reachability Analysis of Program Varibles". In: IJCAR’12

x.next=y; This assignment makes x cyclical if and only
if y reaches x.


State of the Art

State of the Art
Reachability and Cyclicity, state of the art:
Stefano Rossignoli and Fausto Spoto, "Detecting non-cyclicity by abstract compilation into boolean
functions". In: VMCAI’06
Samir Genaim and Damiano Zanardini, "Reachability-based Acyclicity Analysis by Abstract Interpretation".
In: CoRR’12
Ðurica Nikolić and Fausto Spoto, "Reachability Analysis of Program Varibles". In: IJCAR’12

x.next=y; This assignment makes x cyclical if and only
if y reaches x.
We deﬁned a state as σ = ρ, µ , where:
Heap
Environment
l1 ... l2
ρ maps variables
x y
to locations; µ
ρ l1 l2 Element Element
...
µ binds locations value next value next

to objects. tikzpicture
...
tikzpicture


Scenario

Scenario

Given the following Java instructions,
while ( x != null )
x = x . next ;

Does the loop halt?


Scenario

Scenario

while ( x != null )
x = x . next ;

Does the loop halt?
Assuming ρ(x) = l1 before starting the loop.
Heap

l1 l2 l3 l4
o1 o2 o3 tikzpicture o
4 The loop
Element Element Element Element terminates in 3
value next value next value next value next
iterations!
tikzpicture tikzpicture tikzpicture tikzpicture


Scenario

Scenario

while ( x != null )
x = x . next ;

Does the loop halt?
Assuming ρ(x) = l1 before starting the loop.
Heap

l1 l2 l3 l4
o1 o2 o3 tikzpicture o
4

Element Element Element Element
The loop does
not terminate!

It depends on the cyclicity of variable x.


Properties

Can we refine them?
Yes, by developing a field-sensitive analysis!
while ( x != null ) x .next= y ;
x = x .next;

Goal
For each program point, maintain a set of static fields F such that a
program property holds.


Properties

Can we refine them?
Yes, by developing a field-sensitive analysis!
while ( x != null ) x .next= y ;
x = x .next;

Goal
For each program point, maintain a set of static fields F such that a
program property holds.

We introduce the concept of path P as a tuple of fields linking two
locations inside the heap µ.
Heap

l1 l2 l3 l4
e.g., P
1 µ 4 o1 o2 o3 tikzpicture o
4

Element Element Element Element
with P =
El.next, El.next, El.next


Properties

Field-sensitive properties

Let
F: set of all fields;
Lσ (x): set of all locations reachable from x.

Unreachability for each path from x to y in state σ, the fields in F
are not part of that path.

∀P ⊆ F x P y =⇒ P ∩ F = ∅ ≡ x Fy
σ σ

Non-cyclicity for each cycle reachable from x in state σ, the fields
in F are not part of the cycle.

P F
∀ ∈ Lσ (x), ∀P ⊆ F µ ⇒P ∩F =∅ ≡ x σ


Abstract Interpretation


In order to make our analysis computable, we use the general framework of
Abstract Interpretation.



Concrete and Abstract Domains

Σ - set of all states
V - set of all variables
F - set of all program ﬁelds

Concrete domain: C = ℘(Σ)
Abstract domain: A = ℘(V × V × ℘(F)) ∪ ℘(V × ℘(F))
Concretization map γ : A → C
 
F F

 ∀a b ∈ I , ∃F ⊆ F . a σ b∧F ⊆F ∧

γ(I ∈ A) = σ ∈ Σ
F F

 ∀c ∈ I , ∃F ⊆ F . c σ ∧F ⊆ F 


Our properties are under-approximated by the information in I .


Methodology

Methodology

1 Program Under Analysis
class Element {
private Object value ;
private Element prec , next ;

public Element ( Object value ){
this . value = value ;
}
public Element ( Object value , Element prec ){
this . prec = prec ;
prec . next = this ;
}
}
public class MWexample {
public static void main ( String [] args ){
Element top = new Element ( new Integer (0));
for ( int i =1; i <=3; i ++)
top = new Element ( new Integer ( i ) , top );
}
}


Methodology

Methodology

2 Java Bytecode
invokespecial #1 < Object / < init >() V >
aload_0
1 Program Under Analysis aload_1
putfield #2 Element . value : Object
aload_0
class Element {
aload_2
putfield #3 Element . prec : Element
aload_2
aload_0
putfield #4 Element . next : Element
return
}
public Element(Object value, Element prec){
this.value=value;
this.prec=prec;
prec.next=this;
}
}
public class MWexample {
public static void main ( String [] args ){
Element top = new Element ( new Integer (0));
for ( int i =1; i <=3; i ++)
top = new Element ( new Integer ( i ) , top );
}
}


Methodology

Methodology

2 Java Bytecode
invokespecial #1 < Object / < init >() V >
aload_0
1 Program Under Analysis aload_1
putfield #2 Element . value : Object
aload_0
class Element {
aload_2
putfield #3 Element . prec : Element
aload_2
aload_0
putfield #4 Element . next : Element
return
}
public Element(Object value, Element prec){
this.value=value;
this.prec=prec; 3 Control Flow Graph
prec.next=this;
call java.lang.Object. init () : void
}
}
public class MWexample { load 0 Element
load 1 Object
public static void main ( String [] args ){ putfield Element.value : Object
catch
Element top = new Element ( new Integer (0)); throw java.lang.Throwable
for ( int i =1; i <=3; i ++)
load 0 Element
top = new Element ( new Integer ( i ) , top ); load 2 Element
putfield Element.prec : Element
}
}
load 2 Element
load 0 Element
putfield Element.next : Element
return void


Abstract Constraint Graph

Constraint Based Static Analysis
From the Control Flow Graph we build the Abstract Constraint Graph
3
node 2

n
io
Nodes represent bytecode

pt

ex

ce

it
ex
11
node 3
instructions. load 0 Element
3
node 4
Arcs represent the abstract #15 load 1 Object
3
node 5
semantics. 14
putfield Element.value : Object
6
node 6

Each node is decorated with an node 14
catch
load 0 Element
3
node 7
abstract set I . 14 load 2 Element
3
node 8

Each arc is decorated with a putfield Element.prec : Element
6
node 9
propagation rule. 14
load 2 Element
3
node 10
Propagation Rules i load 0 Element
3
node 11
defined for each type of arc, putfield Element.next : Element
6

depending on its sources; node 12
return void

state how the information in
each node is propagated.


Propagation Rules

Propagation Rules

3
node 2

n
io
pt

ex

ce

it
Their definitions can became

ex
11
node 3
load 0 Element
complex whenever they exploit node 4
3

#15 load 1 Object
other static analyses. node 5
3

putfield Element.value : Object

The unreachability and 14
node 6
6

node 14 load 0 Element
non-cyclicity information is catch
node 7
3

propagated along the arcs of the 14 load 2 Element

node 8
3

ACG until reaching a fix-point. putfield Element.prec : Element
6
node 9

It exists since they are all 14
load 2 Element

node 10
3

monotonic functions. load 0 Element
3
node 11
putfield Element.next : Element
The fix-point is the maximal 6
node 12
solution of the ACG with respect return void

to the partial order ⊇.


Example: putﬁeld κ.f : t

ins : Σ → Σ

It changes the paths between locations!
How to correctly propagate the information w.r.t this instruction?
KEY IDEA: exploit the result of the possible reachability analysis.

x, y ∈ MRτ =⇒ x y


Example: putfield κ.f : t (cont.)

e.g., field-sensitive unreachability
for each d F w such that d sj−2 ∨ sj−1 w , F does not change
after the putfield node.
for each a F x such that a, sj−2 , sj−1 , x ∈ MRτ , F probably
changes:
for sure, after the putfield, F does not contain the field f!

Conclusions

Conclusions

1 Build an under-approximated analysis to state two ﬁeld-sensitive
properties.


Conclusions

Conclusions

properties.
2 Exploit the abstract interpretation framework to prove its correctness.


Conclusions

Conclusions

properties.
each propagation rule Π i correctly approximates the set of states
obtained by the correspondent instruction ins i execution:
for each I ∈ A, ins (γ (I )) ⊆ γ (Π (I ))


Conclusions

Conclusions

properties.
the analysis correctly approximates the semantics of the program with
respect to the two properties deﬁned:
let ⇒∗ ins σ be an execution and Iins the approx information,
σ ∈ γ(Iins )


Conclusions

Conclusions

properties.
the analysis correctly approximates the semantics of the program with
respect to the two properties deﬁned:
let ⇒∗ ins σ be an execution and Iins the approx information,
σ ∈ γ(Iins )

Future works: implementing this analysis in Julia Tool to improve
the precision of its termination checker.


Conclusions

Thank You

Thank You!


Bytecode'13 presentation

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (20)

Featured

Featured (20)

Bytecode'13 presentation