Shape Analysis with Structural Invariant Checkers

Transcription

1 Shape Anaysis with Structura Invariant Checkers Bor-Yuh Evan Chang Xavier Riva George C. Necua University of Caifornia, Berkeey SAS 2007

2 Exampe: Typestate with shape anaysis Concrete Exampe Abstraction = ; program-specific predicate whie (!= nu) { assert( is red); heap abstraction fow-sensitive make_purpe(); make_purpe( ) coud be } = ; ock( ) free( ) open( ) red ist purpe ist segment red ist Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 2

3 Shape anaysis is not yet practica Usabiity: Choosing the heap abstraction difficut red ist Space Invader [Distefano et a.] Buit-in high-eve predicates - Hard to extend + No additiona user effort red ist red(n) n reach() TVLA [Sagiv et a.] Parametric in ow-eve, anayzer-oriented predicates + Very genera and expressive - Hard for non-expert deveoper red ist Our Proposa Parametric in high-eve, deveoper-oriented predicates + Extensibe + Easier for deveopers Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 3

4 Shape anaysis is not yet practica Scaabiity: Finding right eve of abstraction difficut Over-reiance on disjunction for precision purpe ist segment red ist deveoper shape anayzer emp,, Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 4

5 Hypothesis The deveoper can describe the memory in a compact manner at an abstraction eve sufficient for the properties of interest (at east informay). Good abstraction is program-specific purpe ist segment red ist abstraction ideas deveoper? shape anayzer Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 5

6 Observation Checking code expresses a shape invariant and an intended usage pattern. boo redist(list* ) { if ( == nu) return true; ese return coor == red && redist( ); } Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 6

7 Proposa An automated shape anaysis with a memory abstraction based on invariant checkers. deveoper Extensibe Abstraction based on the deveoper-suppied checkers Targeted for Usabiity Code-ike goba specification, oca invariant inference Targeted for Scaabiity Based on the hypothesis boo redist(list* ) { if ( == nu) return true; ese return coor == red && redist( ); } checkers shape anayzer Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 7

8 Outine Memory abstraction Restrictions on checkers Chaenge: Intermediate invariants Anaysis agorithm Strong updates Chaenge: Ensuring termination Experimenta resuts Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 8

9 Abstract memory using checkers Graphs f β vaues (address or nu) points-to reation (memory ce) c c β checker run partia run Exampe Disjointy, = β, γ = β, and β is a ist. γ β ist disjoint memory regions Some number of points-to edges that satisfies checker c Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 9

10 Checkers as inductive definitions boo ist(list* ) { if ( == nu) return true; ese return ist( ); } ist emp := β. = nu β ist nu ist() ist( ) Disjointness Checker run can dereference any object fied ony once emp ( = nu) nu nu Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 10

11 What can a checker do? In this tak, a checker boo skip1(skip* ) { if ( == nu) return true; ese { } is a pure, resive function dereferences any object fied ony once during a run ony one argument Traversa can be dereferenced (traversa arg) argument Ony fieds Skip* s = skip; from traversa return skip0(,s) argument && skip1(s); } skip1 emp skip := β,γ. = nu β skip0(γ) γ skip1 nu Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 11

12 back to the abstract domain boo redist(list* ) { if ( == nu) return true; ese return coor == red && redist( ); } checkers shape anayzer

13 Chaenge: Intermediate invariants assert(redist()); = ; whie (!= nu) { redist purpeist redist make_purpe(); = ; } assert(purpeist()); Prefix Segment Described by? purpeist Suffix Described by checkers Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 13

14 Prefix segments as partia checker runs Abstraction purpeist c β Checker Run purpeist() c() purpeist( ) c( ) c( ) purpeist() c( ) c(β) c( ) c( ) Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 14

15 Outine Memory abstraction Restrictions on checkers Chaenge: Intermediate invariants Anaysis agorithm Strong updates Chaenge: Ensuring termination Experimenta resuts Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 15

16 Fow function: Unfod and update edges x = x ; x ist Unfod inductive definition materiaize: x, x x x ist Strong updates using disjointness of regions x update: x = x ist Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 16

17 Chaenge: Termination and precision ast = ; Observation = ; whie Previous ( iterates!= nu) { are // ess, unfoded ast if ( ) ast = ; = ; } ist, ast ast ist Fod into checker edges ist ast widen (canonicaize, bur) But where and how much? ist ist ist ast Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 17

18 History-guided foding Match edges to identify where to fod Appy oca foding rues, ast ist ast = ; = ; whie (!= nu) { if ( ) ast = ; = ; }, ast v ast ast ist ist? ast Yes? ist ast ist Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 18

19 Summary: Enabing checker-based shape anaysis Buit-in disjointness of memory regions As in separation ogic Checkers read any object fied ony once in a run Generaized segment abstraction Based on partia checker runs c Generaized foding into inductive predicates Based on iteration history (i.e., a widening operator) β, ist ist ist ist Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 19

20 Outine Memory abstraction Restrictions on checkers Chaenge: Intermediate invariants Anaysis agorithm Strong updates Chaenge: Ensuring termination Experimenta resuts Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 20

21 Experimenta resuts Benchmark Lines of Code Anaysis Time Max. Num. Graphs at a Program Point Max. Num Iterations at a Program Point ist reverse s 1 03 ist remove eement s 4 06 ist insertion sort s 4 07 search tree find s 2 04 skip ist rebaance s 6 07 scu driver s 4 16 Verified structura invariants as given by checkers are preserved across data structure manipuation Limitations (in scu driver) Arrays not handed (rewrote as inked ist), char arrays ignored Promising as far as number of disjuncts Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 21

22 Concusion Invariant checkers can form the basis of a memory abstraction that Is easiy extensibe on a per-program basis Expresses deveoper intent Critica for usabiity Prerequisite for scaabiity Start with usabiity Work towards expressivity Chang, Riva, Necua - Shape Anaysis with Structura Invariant Checkers 22

23 What can checker-based shape anaysis do for you?