Program Analysis Using Random Interpretation Techniques for Soundness and Efficiency

Program Analysis using Random Interpretation Sumit Gulwani UC-Berkeley March 2005

Program Analysis ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Design choices in Program Analysis ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Random Interpretation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Example 1 a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert(c+d = 0); assert(c = a+i) c := 2a + b; d := b – 2i; True False False True * *

Example 1: Random Testing a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert(c+d = 0); assert(c = a+i) c := 2a + b; d := b – 2i; True False False True * * ,[object Object],[object Object],[object Object]

Example 1: Abstract Interpretation a+b=i a+b=i, c=-d a=i-2, b=2 a+b=i c=2a+b, d=b-2i a+b=i c=b-a, d=i-2b a=0, b=i a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert(c+d = 0); assert(c = a+i) c := 2a + b; d := b – 2i; True False False True * * ,[object Object],[object Object]

Example 1: Random Interpretation a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert(c+d = 0); assert(c = a+i) c := 2a + b; d := b – 2i; True False False True * * ,[object Object],[object Object],[object Object],[object Object]

Outline ,[object Object],[object Object],[object Object],[object Object],[object Object]

Linear relationships in programs with linear assignments ,[object Object],[object Object],[object Object],[object Object],[object Object]

Basic idea in random interpretation ,[object Object],[object Object],[object Object],[object Object],[object Object]

Idea #1: The Affine Join operation ,[object Object],[object Object],[object Object],[object Object],w = 7 a = 2 b = 3 a = 4 b = 1 a =  7 (2,4) = -10 b =  7 (3,1) = 15

Idea #1: The Affine Join operation ,[object Object],[object Object],[object Object],[object Object],[object Object],w = 5 w = 7 a =  5 (2,4) = -6 b =  5 (3,1) = 11 a = 2 b = 3 a = 4 b = 1 a =  7 (2,4) = -10 b =  7 (3,1) = 15

Geometric Interpretation of Affine Join a b a + b = 5 b = 2 (a = 2, b = 3) (a = 4, b = 1) : State before the join : State after the join satisfies all the affine relationships that are satisfied by both (e.g. a + b = 5) Given any relationship that is not satisfied by any of (e.g. b=2), also does not satisfy it with high probability

i=3, a=0, b=3 i=3 a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert (c+d = 0); assert (c = a+i) i=3, a=-4, b=7 i=3, a=-4, b=7 c=23, d=-23 c := 2a + b; d := b – 2i; i=3, a=1, b=2 i=3, a=-4, b=7 c=-1, d=1 i=3, a=-4, b=7 c=11, d=-11 False False w 1 = 5 w 2 = 2 True True * * Example 1 ,[object Object],[object Object],[object Object]

Example 2 ,[object Object],a := x + y b := a b := 2x assert (b = 2x) True False x = y ?

Idea #2: The Adjust Operation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Geometric Interpretation of Adjust ,[object Object],[object Object],[object Object],Algorithm to obtain S’ = Adjust(S, e=0) S 4 S 2 S 3 S 1 S’ 3 S’ 1 S’ 2 Hyperplane e = 0

Correctness of Random Interpreter R ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Proof Methodology ,[object Object],[object Object],[object Object]

Problem: Global value numbering a := 5; x := a*b; y := 5*b; z := b*a; a := 5; x := F(a,b); y := F(5,b); z := F(b,a); ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Abstraction

assert(x = y); assert(z = F(y)); * x =  (a,b) y =  (a,b) z =  (F(a),F(b)) F(y) = F(  (a,b)) ,[object Object],[object Object],[object Object],[object Object],x := a; y := a; z := F(a); x := b; y := b; z := F(b); Example True False

How to “execute” uninterpreted functions ? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Random Linear Interpretation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Encodings e = r 1 ( r 1 a+ r 2 b) + r 2 ( r 1 c+ r 2 d) = r 1 2 (a)+ r 1 r 2 (b)+ r 2 r 1 (c)+ r 2 2 (d) e’ = r 1 2 (a)+ r 1 r 2 (c)+ r 2 r 1 (b)+ r 2 2 (d) F F F a b c d e = F F F a c b d e’ =

Example a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert (c + d = 0); assert (c = a + i) c := 2a + b; d := b – 2i; True False False ,[object Object],[object Object],True * *

i=2 a=0, b=i a := 0; b := i; a := i-2; b := 2; c := b – a; d := i – 2b; assert (c+d = 0); assert (c = a+i) a=8-4i, b=5i-8 a=8-4i, b=5i-8 c=21i-40, d=40-21i c := 2a + b; d := b – 2i; a=i-2, b=2 a=8-4i, b=5i-8 c=8-3i, d=3i-8 a=8-4i, b=5i-8 c=9i-16, d=16-9i False False w 1 = 5 w 2 = 2 Idea #1: Keep input variables symbolic ,[object Object],[object Object],a=0, b=2 c=2, d=-2 True True * *

Experiments ,[object Object],[object Object],Randomized Deterministic

Experimental measure of error ,[object Object],[object Object],[object Object],S N The experimental results are better than what is predicted by theory. 0 0 0 6 0 0 0 5 0 0 0.2 4 0 3.2 64.3 3 95.5 95.5 95.5 2 2 31 2 16 2 10

Other applications of random interpretation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object],Affine Join, Adjust Linear Arithmetic Vectors Uninterpreted Fns. Symbolic i/p variables Interproc. Analysis Key Idea

Program Analysis Using Random Interpretation Techniques for Soundness and Efficiency

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Viewers also liked

Viewers also liked (13)

Similar to Program Analysis Using Random Interpretation Techniques for Soundness and Efficiency

Similar to Program Analysis Using Random Interpretation Techniques for Soundness and Efficiency (20)

Recently uploaded

Recently uploaded (20)

Program Analysis Using Random Interpretation Techniques for Soundness and Efficiency