Xisa: Extensible Inductive Shape Analysis

Transcription

1 Xisa: Extensibe Inductive Shape Anaysis Bor-Yuh Evan Chang U of Coorado, Bouder Xavier Riva INRIA/ENS Paris George C. Necua U of Caifornia, Berkeey Additiona Contributors: Vincent Laviron, James Hoey, Danie Stuzman Carnegie Meon University March 16, 2011

2 The promise of program anaysis: Eiminate entire casses of bugs For exampe, Reading from a cosed fie: Reacquiring a ocked ock: read( ); acquire( ); How? Systematicay examine the program Simuate running program on a inputs Automated code review 2

3 Program anaysis by exampe: Checking for doube acquires Simuate running program on a inputs code // x now points to an unocked ock acquire(x); anaysis state code x acquire(x); code 3

4 Program anaysis by exampe: Checking for doube acquires Simuate running program on a inputs code // x now points to an unocked ock in a inked ist idea anaysis state or or or x acquire(x); code x x 4

5 Must abstract code Abstraction too coarse or not precise enough (e.g., ost x is aways unocked) // x now points to an unocked ock in a inked ist idea anaysis state or or or anaysis state x acquire(x); code x misabes good code as buggy x For decidabiity, must abstract mode a inputs (e.g., merge objects) x 5

6 To address the precision chaenge Traditiona program anaysis mentaity: Why can t deveopers write more specifications for our anaysis? Then, we coud verify so much more. Since deveopers won t write specifications, we wi use defaut abstractions (perhaps coarse) that work hopefuy most of the time. Cooperative approach: Can we design program anayses around the user? Deveopers write testing code. Can we adapt the anaysis to use those as specifications? 6

7 Summary of overview Chaenge in anaysis: Finding a good abstraction precise enough but not more than necessary Powerfu, generic abstractions expensive, hard to use and understand Buit-in, defaut abstractions often not precise enough (e.g., data structures) Cooperative approach: Must invove the user in abstraction without expecting the user to be a program anaysis expert 7

8 Overview of contributions Extensibe Inductive Shape Anaysis (Xisa) Precise inference of data structure properties Abe to check, for instance, the ocking exampe Targeted to software deveopers Uses data structure checking code for guidance Turns testing code into a specification for static anaysis Efficient Buids abstraction out of deveoper-suppied checking code 8

9 End-user approach Extensibe Inductive Shape Anaysis Precise inference of data structure properties

10 Shape anaysis is a fundamenta anaysis Precise heap abstraction needed to anayze Traditiona anguages (C, Java) Web scripting anguages Improves verifiers that try to Eiminate resource usage bugs (ocks, fie handes) Eiminate memory errors (eaks, danging pointers) Eiminate conrency errors (data races) Vaidate deveoper assertions Enabes program transformations Compie-time garbage coection Data structure refactorings 10

11 Shape anaysis by exampe: Removing dupicates Exampe/Testing Code Review/Static Anaysis sorted d ist // is a sorted douby-inked ist for each node in ist { } remove if dupicate; assert is sorted, douby-inked with no dupicates; 2 4 program-specific intermediate state more compicated segment with no dupicates no dupicates sorted d ist 11

12 Shape anaysis is not yet practica Choosing the heap abstraction difficut for precision Some representative approaches: 89 TVLA [Sagiv et a.] Space Invader [Distefano et a.] Parametric in ow-eve, anayzer-oriented predicates + Very genera and expressive - Harder for non-expert Buit-in high-eve predicates - Harder to extend + No additiona user effort (if precise enough) Cooperative approach: Xisa Parametric in high-eve, deveoper-oriented predicates + Extensibe + Targeted at deveopers 12

13 Our approach: Executabe specifications Utiize run-time checking code as specification for static anaysis. h.d(p) := if h = (h nu = nu) Æ emp then Ç 9n. true h nu Æ ese h prev p h!prev h next = n p and h!next.d(h) n.d(h) checker p specifies where prev shoud point Contribution: Buid assert(.sorted_d( )); the abstraction for anaysis out of deveoper-specified for each node in ist { checking remove code if dupicate; Contribution: Generaize checkers for compicated intermediate states } assert(.sorted_d_nodup( )); 13

14 Xisa is An automated shape anaysis with a precise memory abstraction based around invariant checkers. h.d(p) = if (h = nu) then true ese h!prev = prev and h!next.d(h) checkers Xisa Extensibe and targeted for deveopers Parametric in deveoper-suppied checkers viewed as inductive definitions in separation ogic Precise yet compact abstraction for efficiency Data structure-specific based on properties of interest to the deveoper 14

15 Shape anaysis is an abstract interpretation on abstract memory descriptions with Spitting of summaries (materiaization) To refect updates precisey And summarizing for termination (widening) 15

16 Must materiaize summaries to interpret updates precisey Want abstract update to be exact, that is, to update one concrete memory ce. The exampe at a high-eve: iterate using changing the douby-inked ist from purpe to red. How does the anaysis spit summaries and know where to spit? spit at update purpe to red 16

17 Roadmap: Components of Xisa Learn information about checkers to use them effectivey h.d(p) = if (h = nu) then true ese h!prev = prev and h!next.d(h) checkers checker anaysis ( pre-program anaysis ) Defining a program anaysis: program anaysis 1. The abstraction (e.g., separation ogic formuas with inductive definitions) and operations on the abstraction (e.g., checker unfoding, update) anaysis 2. How to effectivey appy the operations (harder!) spitting and interpreting update abstract interpretation Xisa shape anayzer summarizing Chaenge: Checkers are incompete specs 17

18 Memory abstraction as separating shape graphs Memory partitioned into regions Graph abstraction nu address/vaue prev next data ± Region summarization segment summary d(nu) d( ) prev 4 next ± memory ce nu d( ) inductive predicate (checker) Segment generaization of a checker (.d(nu) up to.d( )) 18

19 Unfod inductive definitions to spit summaries Definition yieds graph unfoding rues h.d(p) := h = nu Æ emp Ç 9n. h nu Æ h prev p h next n n.d(h) unfod = nu d( ) Ç prev next d( ) To materiaize!next!next d(nu) d( ) next prev ± unfod here d( ) 19

20 Aso need a backwards unfoding d(nu) d( ) prev next d( ) Technica Detais: How does the anaysis do this unfoding? backwards unfoding for!prev!next Why is this unfoding aowed? ± = Æ = nu next d( ) prev d(nu) d(") next " prev Ç prev next ± ± d( )!prev!next =!next; for each node in ist { remove if dupicate; } assert is sorted, doubyinked with no dupicates; (Key: Segments are aso inductivey defined) [POPL 08] How does the anaysis know to do this unfoding? 20

21 Roadmap: Components of Xisa Derives additiona information to guide unfoding h.d(p) = if (h = nu) then true ese h!prev = prev and h!next.d(h) checkers Contribution: Turns testing code into specification for static anaysis checker anaysis ( pre-program anaysis ) checker anaysis program anaysis How do we decide where to unfod? spitting and interpreting update abstract interpretation Xisa shape anayzer summarizing 21

22 Leve types for deciding where to unfod Summary Instance nu prev d(nu) d( ) next prev next prev.d(nu).d( ).d( ) ±.d( ) nu.d(±) d( ) next ± prev Checker Run (ca tree/derivation) Says: next nu For h!next/h!prev, unfod from h For p!next/p!prev, unfod before h If it exists, where is:!next?!next? Checker Definition h:{nexth i, prevh i } p:{nexth i,prevh i } h.d(p) = if (h = nu) then true ese h!prev = p and h!next.d(h) 22

23 Leve types make the anaysis robust with respect to how checkers are written Douby-inked ist checker (as before) h:{nexth i, prevh i } p:{nexth i,prevh i } Summary h.d(p) = if (h = nu) then d( ) d( ) d( ) true Instance ese next next nu h!prev = p and prev prev h!next.d(h) Aternative douby-inked ist checker h:{nexth i, prevh i } h.d Summary 0 () =!prev? if (h!next = nu) then Instance d 0 d 0 d 0 next next nu prev Different types for different unfoding true ese h!next!prev = h and h!next.d 0 () 23

24 Summary of checker parameter types Te where to unfod for which fieds Make anaysis robust with respect to how checkers are written Learn where in summaries unfoding won t hep Can be inferred automaticay with a fixedpoint computation on the checker definitions 24

25 Summary of interpreting updates Spitting of summaries needed for precision Unfoding checkers is a natura way to do spitting When checker traversa matches code traversa Checker parameter type anaysis Usefu for guiding unfoding in difficut cases, for exampe, back pointer traversas 25

26 Roadmap: Components of Xisa checker anaysis ( pre-program anaysis ) program anaysis h.d(p) = if (h = nu) then true ese h!prev = prev and h!next.d(h) checkers checker anaysis spitting and interpreting update summarizing abstract interpretation Xisa shape anayzer 26

27 Summarize by foding into inductive predicates ast = ; =!next; whie (!= nu) { //, ast if ( ) ast = ; =! next; } Previous approaches guess where to fod for each graph. Contribution: Determine where by comparing graphs across history, ast next next ast ist next ist next next next ast ist summarize next ast ist ist Chaenge: Precision (e.g., ast, separated by at east one step) ist 27

28 Use iteration history with a widening operator Match regions ist ist ist next next ist Appy oca weakening rues on each region ist ist next ist Widened resut ist ist 28

29 Given checkers, everything is automatic checker anaysis ( pre-program anaysis ) program anaysis h.d(p) = if (h = nu) then true ese h!prev = prev and h!next.d(h) checkers checker anaysis spitting and interpreting update summarizing abstract interpretation Xisa shape anayzer 29

30 Resuts: Performance Expressiveness: Different data structures Benchmark Max. Num. Graphs at a Program Pt Anaysis Time (ms) singy-inked ist reverse 1 TVLA: 290 ms 1.0 douby-inked ist reverse Space Invader douby-inked ist copy ony anayzes 2 ists 5.4 douby-inked ist remove (buit-in) douby-inked ist remove and back search tree with parent insert 3 TVLA: 850 ms 16.6 search tree with parent insertand back two-eve skip ist rebaance Linux scu driver (894 oc) (char arrays ignored, functions inined) Verified shape invariant as given by the checker is preserved across the operation. Times negigibe for data structure operations (often in sec or 1 / 10 sec)

31 Demo: Douby-inked ist reversa Body of oop over the eements: Swaps the next and prev fieds of r. Ongoing Undergraduate Project: Better memory visuaization + Ecipse integration + User study Aready reversed segment Node whose next and prev fieds were swapped Not yet reversed ist 31

32 Summary of Xisa: Extensibe Inductive Shape Anaysis Key Insight: Checkers as specifications Deveoper View: Anaysis View: Constructing the program anaysis Goba, Expressed in a famiiar stye Capture deveoper intent, Not arbitrary inductive definitions Intermediate states: Generaized segment predicates c( ) c 0 ( 0 ) Spitting: Checker parameter types with eves h : {nexth i, prevh i} p : {nexth i, prevh i} Summarizing: History-guided approach with widening op ist next ist ist ist ist 32

33 Subsequent Work C-Leve Memory Abstraction [ESOP 10] Separating shape graphs support mixing higheve (e.g., record fieds) and ow-eve (e.g., union fieds) memory abstractions Very Context-Sensitive Interprocedura Anaysis [POPL 11] Whoe program, state-based interprocedura anaysis using Xisa Make ca stack expicit and summarize using shape invariants 33

34 Future work: Expoiting common specification framework Scenario: Code instrumented with ots of checker cas (perhaps automaticay with object invariants) assert( mychecker(x) ); // operation on x assert( mychecker(x) ); Can we prove parts staticay? Static Anaysis View: Hybrid checking Testing View: Exampe: Insert in a sorted ist Very sow to execute Hard to prove staticay (in genera) Incrementaize invariant checking u v w Preservation of sortedness shown staticay Emit run-time check for new eement: u v w 34

35 Concusion Extensibe Inductive Shape Anaysis precision demanding program anaysis improved by nove user interaction Deveoper: Gets resuts corresponding to intuition Anaysis: Focused on what s important to the deveoper Practica precise toos for better software with a cooperative approach! 35

36 What can inductive shape anaysis do for you?