The Set Constraint/CFL Reachability Connection in Practice

Transcription

1 The Set Contraint/CFL Reachability Connection in Practice John Kodumal EECS Department Univerity of California, Berkeley Alex Aiken Computer Science Department Stanford Univerity ABSTRACT Many program analye can be reduced to graph reachability problem involving a limited form of context-free language reachability called Dyck-CFL reachability. We how a new reduction from Dyck-CFL reachability to et contraint that can be ued in practice to olve thee problem. Our reduction i much impler than the general reduction from context-free language reachability to et contraint. We have implemented our reduction on top of a et contraint toolkit and teted it performance on a ubtantial polymorphic flow analyi application. Categorie and Subject Decriptor D.2.4 [Software Engineering]: Software/Program Verification; F.3.2 [Logic and Meaning of Program]: Semantic of Programming Language General Term Algorithm, Deign, Experimentation, Language, Theory Keyword Set contraint, context-free language reachability, flow analyi, type qualifier 1. INTRODUCTION Many program analye have been formulated and implemented uing et contraint. Set contraint-baed analye have been hown to cale to large program on application uch a point-to analyi, hape analyi, and receiver cla prediction, though calability require highly optimized implementation [4, 8, 19, 21]. Recently, a number of program analye have been formulated a context-free language (CFL) reachability problem. Thee include application uch a type-baed polymorphic flow analyi, field-enitive point-to analyi, and interprocedural dataflow analyi [15, 17, 18]. Getting CFL-baed Permiion to make digital or hard copie of all or part of thi work for peronal or claroom ue i granted without fee provided that copie are not made or ditributed for profit or commercial advantage and that copie bear thi notice and the full citation on the firt page. To copy otherwie, to republih, to pot on erver or to reditribute to lit, require prior pecific permiion and/or a fee. PLDI 04, June 9 11, 2004, Wahington, DC, USA. Copyright 2004 ACM /04/ $5.00. implementation to cale ha proved a tricky a implementing et contraint, leading to new algorithm and optimization technique. Set contraint and CFL reachability were hown to be cloely related in work by Melki and Rep [13]. While their reult i ueful for undertanding the conceptual imilarity between the two problem, it doe not erve a an implementation trategy; a with many reduction, the cot of encoding one problem in the other formalim prove to be prohibitive in practice. Furthermore, the Melki-Rep reduction doe not how how to relate the tate-of-the-art algorithm for et contraint to the tate-of-the-art algorithm for CFL reachability. Optimization in one formalim are not preerved acro the reduction to the other formalim. Demand-driven algorithm for CFL reachability do not automatically lead to demand algorithm for et contraint (except by applying the reduction firt). Our inight i baed on the obervation that almot all of the application of CFL reachability in program analyi are baed on Dyck language, which contain tring of matched parenthee. For Dyck language, we how an alternative reduction from CFL reachability to et contraint that addree the iue mentioned above. The principal contribution of thi work are a follow: We give a novel contruction for converting a Dyck- CFL reachability problem into a et contraint problem. The contruction i impler than the more general reduction decribed in [13]. In fact, the contraint graph produced by our contruction are nearly iomorphic to the original CFL graph. We how that on real polymorphic flow analyi problem, our implementation of Dyck-CFL reachability baed on et contraint remain competitive with a highly tuned CFL reachability engine. Thi i omewhat urpriing ince that implementation contain optimization that exploit the pecific tructure of the CFL graph that arie in flow analyi. Thee reult have everal conequence: Our reult how that it i poible to ue an off-thehelf et contraint olver to olve Dyck-CFL reachability problem without uffering the penaltie we normally expect when uing a reduction. Furthermore, reaonable performance can be expected without having to tune the olver for each pecific application.

2 G {B u, u, C u, v } add A u, v for each production of the form A B C G {B u, v } add A u, v for each production of the form A B G add A u, u for each production of the form A ɛ Figure 1: Cloure rule for CFL reachability We believe that our reduction bridge the gap between the variou algorithm for Dyck-CFL reachability [10] and the algorithm for olving et contraint. In light of our reduction, it eem that the ditinction between thee problem i illuory: the manner in which a problem i pecified (a Dyck-CFL reachability v. et contraint) i orthogonal to other algorithmic iue (e.g. whether the olver i online v. offline, demand-driven v. exhautive). Thi ha ome important conequence for intance, we plan in the future to invetigate an algorithm for incremental et contraint. Uing our reduction, uch an algorithm could be ued immediately to olve Dyck-CFL reachability problem incrementally. Furthermore, our reduction how how technique ued to olve et contraint (inductive form and cycle elimination [4]) can be applied to Dyck-CFL reachability problem. The remainder of thi paper i tructured a follow. In Section 2 we briefly introduce CFL reachability and et contraint. In Section 3 we review the reduction from CFL reachability to et contraint. Section 4 preent our pecialized reduction from Dyck-CFL reachability to et contraint. In Section 5 we ue polymorphic flow analyi a a cae tudy for our reduction. Section 6 cover related work, and Section 7 conclude. 2. PRELIMINARIES We review baic material on CFL reachability and et contraint. Reader familiar with CFL reachability may wih to kip Section 2.1, which i tandard. Section 2.2 i baed on the framework of [21], which ue ome nontandard notation. 2.1 CFL and Dyck-CFL Reachability In thi ubection we define CFL reachability and Dyck- CFL reachability and decribe an approach to olving thee problem. Let CF G = (T, N, P, S) be a context free grammar with terminal T, nonterminal N, production P and tart ymbol S. Let G be a directed graph with edge labeled by element of T. The notation A u, v denote an edge in G from node u to node v labeled with ymbol A. Each path in G define a word over T by concatenating, in order, the label of the edge in the path. A path in G i an S-path if it word i in the language of CF G. The all-pair CFL reachability problem determine the pair of vertice (u, v) where there exit an S-path from u to v in G. Now let O = {( 1,..., ( n} and C = {) 1,..., ) n} be two dijoint et of terminal (interpreted a opening and cloing ymbol, repectively). The ubcript are the terminal indice. The Dyck language over O C {} i generated by a context free grammar with production of the following x 1 x 2 ( 1 ( 2 S z 1 ) 1 y 1 y 2 S ) 2 z 2 Figure 2: Example Dyck-CFL reachability problem form: S S S ( 1 S ) 1 ( n S ) n ɛ (where i a ditinguihed terminal not in O or C). The all-pair Dyck-CFL reachability problem i the retriction of the all-pair CFL reachability problem to Dyck language. Figure 1 how the cloure rule for the CFL and Dyck- CFL reachability algorithm. The rule aume that the CFL grammar ha been normalized uch that no right-hand ide of any production contain more than two ymbol 1. A naive CFL reachability algorithm might apply the rule a follow: whenever the CFL graph matche the form on the left-hand ide of the rule, add the edge indicated by the right-hand ide of the rule; iterate thi proce until no rule induce a new edge addition. The application of thee rule produce a graph cloure(g) that contain all poible edge labeled by nonterminal in the grammar. To check whether there i an S-path from node u to v in G, we imply check for the exitence of an edge S u, v in cloure(g). In general, the all-pair CFL-reachability problem can be olved in time O( T N 3 n 3 ) for a graph with n node. Figure 2 how an example of a Dyck-CFL reachability problem. The dahed line how the edge added by the computation of cloure(g). The edge how that there are S-path between node x 1 and z 1, and x 2 and z 2. Self-loop S-path derived from the production S ɛ are not hown. 2.2 Set Contraint In thi ubection, we review the et contraint framework introduced in [21]. We define a language of et contraint (eentially a ubet of the full language defined in [1, 6]) and dicu inductive form, a graph-baed repreentation of et contraint A Language of Set Contraint A contraint ytem i a finite collection of et contraint. A et contraint i a relation of the form L R, where L and R are et expreion. Set expreion conit of et 1 For intance, by converting the grammar to Chomky normal form.

3 C {X X } C C {c(e 1,..., e a(c) ) c(e 1,..., e a(c))} C S i {ei e i} C {c(e 1,..., e a(c) ) proj(c, i, e)} C {e i e} C {d(e 1,..., e a(d) ) proj(c, i, e)} C if c d C {c(...) d(...)} no olution if c d Figure 3: Reolution rule for et contraint variable X, Y,..., term contructed from n-ary contructor c, d,... 2, and projection pattern: L, R e ::= X c(e 1,..., e a(c) ) proj(c, i, e) Each contructor c ha an arity a(c). Given a contraint of the form c(e 1,..., e a(c) ) proj(c, i, e), the projection pattern proj(c, i, e) ha the effect of electing e i, the ith component of the term on the left-hand ide, and adding the contraint e i e. Projection pattern are cloely related to the more tandard projection notation c i (e). We can expre c i (e) uing the following equivalence: c i (e) V where V i freh and e proj(c, i, V) The equivalence preerve leat olution under a compatibility retriction: the variable V ued to repreent c i (e) can only occur on the left-hand ide of any other incluion contraint. We ue the proj notation becaue it implifie the preentation of the contraint re-write rule and elucidate the connection between Dyck-CFL reachability and et contraint. However, we alo ue c i (e) wherever that notation i more natural. Our ue of c i (e) alway adhere to the compatibility retriction; therefore in thi work it i alway afe to replace that notation with the equivalent uing proj Contraint Graph Algorithm for olving et contraint operate by applying a et of reolution rule to the contraint ytem until no rule apply; thi i the olved form. The olved form make the proce of reading off a particular olution (or all olution) imple. For our language of et contraint, we apply the reolution rule in Figure 3 a left-to-right re-write rule to reduce the contraint ytem to olved form. Algorithmically, a ytem of et contraint C can be repreented a a directed graph G(C) where the node of the graph are et expreion and the edge denote atomic contraint. A contraint i atomic if either the left-hand ide or the right-hand ide i a et variable. Computing the olved form involve cloing G(C) under the reolution rule, which are decription of how to add new edge to the graph. In general, a ytem of et contraint C with v variable can be reduced to olved form in time O(v 2 C ). Inductive form i a particular graph repreentation that exploit the fact that variable-variable contraint X Y can be repreented a either a ucceor edge (Y ucc(x )) or a predeceor edge (X pred(y)). The choice i made 2 We aume throughout that contructor are non-trict. baed on a fixed total order o (generated randomly) on the variable. For a contraint X Y, the edge i tored a a ucceor edge on X if o(x ) > o(y), otherwie, it i tored a a predeceor edge on Y. Contraint of the form c(...) X are alway tored a predeceor edge on X, and contraint of the form X proj(c, i, e) are alway tored a ucceor edge on X. Given thee repreentation, the tranitive cloure rule for inductive form i a follow: L pred(x ) R ucc(x ) L R Thi rule, in conjunction with the reolution rule in Figure 3, produce a olved graph in inductive form. The advantage of inductive form i that many fewer tranitive edge are added in comparion to other graph repreentation [4]. Inductive form doe not explicitly compute the leat olution, but the leat olution i eaily calculated by doing backward-reachability on the contraint graph: S LS(Y) = {c(...) c(...) pred(y)} LS(X ) X pred(y ) Solution of Contraint Sytem We interpret et contraint under the term-et model [6]. In thi model, the olution to a ytem of et contraint map each et variable to a (poibly infinite) et of ground term uch that all incluion relation are atified. It turn out that each et variable decribe a regular tree language and the olved form of the contraint graph can be viewed a a collection of regular tree grammar. Each atomic contraint c(...) X in the olved form of the contraint ytem can be interpreted a a production in a tree grammar by treating it a a production X c(...). For example, conider the olved contraint ytem con(zero, X ) X nil X where zero and nil are nullary contructor, and con i a binary contructor. We ee that X decribe the et of all lit where every element i zero. The leat olution for X can be viewed a a tree language L(X ) whoe grammar i X con(zero, X) X nil 3. THE MELSKI-REPS REDUCTION In thi ection we review the reduction from CFL reachability to et contraint [12, 13]. Reader familiar with thi reduction may wih to kip thi ection. Again, we aume that the CFL grammar i normalized o that the right-hand ide of every production contain at mot two ymbol.

4 The contruction encode each node u in the initial CFL graph G with one et variable U, one nullary contructor n u and the contraint n u U In encoding the graph, the goal i to repreent an edge A u, v in the cloed graph by the preence of a term c A(V), where c A i a unary contructor correponding to ymbol A, in the leat olution of U. Accordingly, an initial edge of the form a u, v in G i captured by a contraint c a(v) U Thi complete the repreentation of the initial graph. The next tep of the reduction i to encode the production of the CFL grammar. Since edge are encoded a contructed term, the notion of following an edge i captured by projection. The left-hand ide of each production tell u which edge we hould add if we follow edge labeled by the righthand ide. For intance, a binary production of the form A B C ay that we hould add an A edge from node u to any node reached by following a B edge from u and then following a C edge. The et contraint that encode thi rule i For example, the CFL graph c A(c 1 C (c 1 B (U))) U u B u C v and the production A B C reult in a ytem of et contraint containing the following incluion relation: n u U c C(V) U c B(U ) U c A(c 1 C (c 1 B (U))) U Thee contraint imply the deired relationhip c A(n v) U, which repreent the edge A u, v. Note thee contraint only encode each production locally: imilar contraint mut be generated for every node in the graph. Beide binary production, production of the form A B and A ɛ may occur in the grammar. Production of the firt form are encoded locally for each node u by the contraint c A(c 1 B (U)) U repreenting the fact that any B edge from node u i alo an A edge. Finally, production of the form A ɛ are encoded locally for each node u by the contraint c A(U) U Correctne of the reduction i proved by howing there i an S-path from node u to node v in cloure(g) if and only if c S(n v) U i in the leat olution of the contructed ytem of contraint. 4. A SPECIALIZED DYCK REDUCTION Thi ection preent our reduction, which i pecialized to Dyck-CFL reachability problem. We firt explain the intuition behind our approach. We then decribe the pecific of the encoding, ketch a proof of correctne, and provide a complexity argument. Finally, we provide experimental O 1(X 1) proj(o 1, 1, Z 1) Y 1 Y 2 O 2(X 2) proj(o 2, 1, Z 2) Figure 4: The contraint graph correponding to the Dyck-CFL graph from Figure 2 uing the reduction from Section 4 reult uggeting that the pecialized reduction i more efficient in practice than the Melki-Rep reduction applied to Dyck-CFL grammar. The idea behind our reduction i that the et contraint cloure rule can encode Dyck language production. The intuition i traightforward: the rule S S S correpond to the tranitive cloure rule, and the rule S ( i S ) i correpond to matching contructed term with projection pattern. By encoding the original Dyck-CFL graph a a ytem of et contraint in a way that exploit thi correpondence, we can avoid encoding the production of the grammar at each node. Thi lead to a more natural and compact encoding of the input graph, and better performance in application where the number of parenthei kind (hence, the number of production) i not a contant. The firt tep of the encoding i unchanged. We repreent each node u with a variable U and a nullary contructor n u. We connect thee with contraint of the form n u U Edge are encoded o that ubet relationhip U V between variable in the contraint ytem repreent dicovered S u, v edge in the input graph. Since we are only conidering Dyck language, there are only three kind of labeled edge to conider: 1. For each u, v edge in the input graph, we add the contraint U V (where U and V are the variable correponding to node u and v). 2. For each ( i u, v edge in the input graph, we create a unary contructor O i and add the contraint O i(u) V. 3. For each ) i u, v edge in the input graph, we add the contraint U proj(o i, 1, V). Notice that there appear to be a light aymmetry in the reduction: edge labeled with ( i ymbol are encoded uing contructed term, while edge labeled with ) i ymbol are encoded uing projection. Naively, one might attempt to devie a ymmetric reduction by encoding an edge ) i u, v with a contraint U O i(v), making a correpondence between the production S ( i S ) i and the econd rule (not the third) in Figure 3. However, thi approach would yield an inconitent ytem of et contraint for any intereting graph. For example, the graph in Figure 2 would reult in a contraint ytem containing the contraint O 1(X 1) Y 1 Y 2 O 2(Z 2), which

5 Contraint New Contraint Production Edge New Edge X Y Y Z X Z S S S S x, y S y, z S x, z O i(x ) Y Y Z O i(x ) Z L i L i S L i x, y S y, z L i x, z X Y Y proj(o i, 1, Z) X proj(o i, 1, Z) R i S R i S x, y R i y, z R i x, z O i(x ) Y Y proj(o i, 1, Z) O i(x ) proj(o i, 1, Z) X Z S L i R i L i x, y R i y, z S x, z Table 1: Contraint added to C and the correponding edge in cloure(g) are clearly inconitent. We avoid thi problem by uing projection pattern to repreent ) i edge. Thu, the graph in Figure 2 reult in a contraint ytem containing O 1(X 1) Y 1 Y 2 proj(o 2, 1, Z 2), which i conitent. Thi contruction only introduce one contraint per node and one contraint per edge of the original CFL graph. In contrat, the reduction decribed in Section 3 introduce O(k) contraint per node (where k i the number of parenthei kind in the Dyck grammar) to encode the grammar production locally, in addition to the cot of encoding the graph edge. To olve the all-pair Dyck-CFL reachability problem, we apply the rewrite rule in Section 2.2 to the reulting contraint ytem. A we will how, there i an S-path from node u to v in the initial graph if and only if n u V in the leat olution of the contructed contraint ytem. Figure 4 how the contraint graph correponding to the Dyck-CFL reachability problem hown in Figure 2 uing thi reduction. The nullary contructor are omitted for clarity. 4.1 Correctne We ketch a proof of correctne for the pecialized reduction. The reduction i correct if the olution to the contructed et contraint problem give a olution to the original Dyck-CFL reachability problem. Theorem 1. Let G be an intance of the Dyck-CFL reachability problem, and C be the collection of et contraint contructed a above to repreent G. Then there i an edge S u, v in cloure(g) if and only if n u V i preent in LS(C). The theorem follow immediately from the following lemma: Lemma 1. Given C and G a in Theorem 1, let C denote the conjunction of C with the ytem of contraint introduced by applying the reolution rule hown in Figure 3 along with the tranitive cloure rule e X X e e e. Then there i an edge S u, v in cloure(g) if and only if U V i preent in C. Proof. We apply the et contraint reolution rule in lock-tep with the CFL cloure rule, and how that for every S-edge added to cloure(g), there i a correponding variable-variable contraint that can be added to C. Thi approach require u to normalize the Dyck-CFL grammar in a very pecific way: S S S S L i R i L i ( i L i L i S R i ) i R i S R i S S ɛ It i eay to ee that the above grammar derive the ame et of tring a the original Dyck-CFL grammar. The intuition here i that normalizing the Dyck-CFL grammar thi way caue the CFL cloure rule to add edge in exactly the ame way a the et contraint reolution rule. We now formalize thi intuition. Conider the following order for adding edge to cloure(g) and contraint to C : 1. Add all edge implied by the production S, S ɛ, R i ) i, and L i ( i. Note that there are only finitely many edge that can be added, and that they are all added in thi tep. 2. Add all edge implied by the production S S S, S L i R i, L i L i S, and R i S R i, and add the correponding contraint to C according to Table 1. In the firt tep, notice that the added S edge correpond to variable-variable edge that already exit in the initial ytem of contraint C (refer to the firt rule of the reduction in Section 4). In the econd tep, notice that for every S edge added to cloure(g), there are correponding contraint that mut exit in C that lead to the appropriate variable-variable contraint. Lemma 2. Given C and G a in Theorem 1, let C denote the conjunction of C with the ytem of contraint introduced by applying the reolution rule hown in Figure 3 along with the tranitive cloure rule e X X e e e. Then the contraint n u V implie the exitence of a contraint U V in C. Proof. Clearly, the rule in Figure 3 cannot add a contraint of the form n u V, o uch a contraint i either preent initially in C or it wa added to C by tranitive cloure. In the former cae, U = V and the lemma hold trivially. In the latter cae, we can how (by induction on the number of application of the tranitive cloure rule) that there are variable X 1,..., X n with n u U X 1... X n V preent in C. Then by the tranitive cloure rule, U V mut be preent in C. We now prove Theorem 1 uing the two lemma. To how that S u, v cloure(g) implie n u V i preent in C, we note that Lemma 1 guarantee the exitence of a contraint U V in C. Our contruction guarantee an initial contraint n u U, o by the tranitive cloure rule, n u V exit in C. To how that a contraint n u V in C implie S u, v cloure(g), we appeal to Lemma 2, which guarantee the exitence of a contraint U V in C. Appealing once again to Lemma 1, we have that S u, v cloure(g).

6 4.2 Complexity We firt dicu the running time to olve the all-pair Dyck-CFL reachability problem uing the generic CFL reachability algorithm outlined in Section 2.1. In general, the generic algorithm ha complexity O( T N 3 n 3 ). Applying thi reult directly to an intance of the Dyck-CFL problem with k parenthei kind and n graph node yield an O(k 3 n 3 ) running time. However, we can harpen thi reult by pecializing the complexity argument to the Dyck-CFL grammar. The running time of the generic CFL reachability algorithm i dominated by the firt rule in Figure 1. In thi tep, each edge in the graph might pair with each of it neighboring edge. In other word, for a given node j, each of j incoming edge might pair with each of j outgoing edge. Each node in the graph might have O(kn) edge labeled with ( i or ) i (there are k different kind, and n potential target node), a well a O(n) edge labeled with S. For node j, each of the O(kn) incoming edge may pair with O(n) outgoing edge, by a ingle production. Similarly, each of the O(n) incoming S edge can match with O(n) outgoing edge by the ingle S S S production. Thu, the work for each node j i bounded by O(kn 2 ). Since there are n node in the graph, the total work i O(kn 3 ). An analogou argument hold for our reduction. For the fragment of et contraint ued in thi paper, a contraint ytem C can be olved in time O(v 2 C ) where v i the number of variable in C and C i the number of contraint in C. Given an intance of the Dyck-CFL problem with k parenthei kind and n node, our reduction yield a contraint ytem with O(n) variable and O(kn 2 ) contraint, yielding an O(kn 4 ) running time. Again, a more precie running time can be achieved by noting that for a given variable node i in the contraint graph, the rule in Figure 3 can apply only O(kn 2 ) time to pair of i upper and lower bound. In an n node graph, then, the total work i O(kn 3 ). 4.3 Empirical Comparion We have implemented both the Melki-Rep reduction and our reduction in order to compare the two approache. Both implementation ued the banhee toolkit a the underlying et contraint olver [11]. Our implementation of the Melki- Rep reduction ue the following normalized form of the Dyck-CFL grammar: S S S S L i ) i L i ( i S S S ɛ We ran both implementation on randomly generated graph. To tet correctne, we checked that both implementation gave conitent anwer to random reachability querie. We found that our implementation of the Melki- Rep reduction did not cale to large graph, even when the number of parenthei kind wa kept mall. For example, on a 500 node graph with 7500 edge and 20 parenthei kind, the Melki-Rep implementation computed the graph cloure in 45 econd, while our reduction completed in le than 1 econd. Thi prevented u from teting the Melki- Rep approach on real application: we tried the implementation on the benchmark in our cae tudy (ee Section 5) but found that none finihed within 10 minute. 5. CASE STUDY: POLYMORPHIC FLOW ANALYSIS Flow analyi tatically etimate creation, ue, and flow of value in a program [14]. Problem uch a computing may-alia relationhip, determining receiver cla information, and reolving control flow in the preence of indirect function call can be olved uing flow analyi. A with mot tatic analye, flow analyi can be made more precie by treating function polymorphically. Polymorphic flow analyi eliminate puriou flow path that arie from conflating all call ite of a function. Recent work ha etablihed a connection between typebaed polymorphic flow analyi and CFL reachability [15]. A an alternative to contraint copying, ytem of intantiation contraint are reduced to a CFL graph. The flow relation i decribed by a Dyck-CFL grammar, hence, the problem of finding the flow of value in the input program reduce to an all-pair Dyck-CFL reachability problem. In thi ection, we apply our technique to the problem of polymorphic flow analyi. For concretene, we conider the pecific problem of polymorphic tainting analyi [20]. In tainting analyi, we are intereted in checking whether any value poibly under adverarial control can flow to function that expect truted data. A a trivial example, conider the following code: int main(void) { char *buf; buf = read from network(); exec(buf); } The call exec(buf) i probably not afe, ince the buffer may come from a maliciou or untruted ource. The particular tainting analyi we ue employ type qualifier to olve thi problem [5]. Briefly, we can detect error like the example hown above by introducing two type qualifier tainted and untainted. Data that may come from an untruted ource i given the type qualifier tainted, and data that mut be truted i given the type qualifier untainted. A type error i produced whenever a tainted value flow to a place that mut be untainted. Figure 5 illutrate the connection between polymorphic tainting analyi and CFL reachability with another mall program. There are two call to the identity function id. At the firt call ite, id i paed tainted data. At the econd call ite, id i paed untainted data. The variable z2 i required to be untainted. Monomorphic flow analyi would conflate the two call ite, leading to a puriou error (namely, that tainted data from variable x1 reache the untainted variable z2). Polymorphic flow analyi can ditinguih thee two call ite, eliminating the puriou error. The flow graph in Figure 5 how the connection to Dyck-CFL reachability: each function call ite i labeled with a ditinct index. The flow from an actual parameter to a formal at call ite i i denoted by an edge labeled ( i. The flow correponding to the return value of the function i denoted by an edge labeled ) i. Intraprocedural aignment i denoted by edge. In thi example, the puriou flow path between x 1 and z 2 correpond to a path whoe word i ( 1 ) 2, which i not in the Dyck language. In the remainder of thi ection, we dicu how to extend

7 int id(int y1) { int y2 = y1; return y2; } int main(void) { tainted int x1; int z1,x2; untainted int z2; z1 = id(x1); // call ite 1 z2 = id(x2); // call ite 2 } tainted x 1 z 1 ( 1 ) 1 y 1 y 2 ( ) 2 2 x 2 z 2 untainted Figure 5: Example C program and the correponding Dyck-CFL reachability problem our technique to olve polymorphic flow analyi problem. We alo dicu ome optimization that improve the performance of our reduction on polymorphic flow graph. We conclude with an experimental aement of our approach on a et of C benchmark. 5.1 Extenion It turn out that imple Dyck-CFL reachability in t quite ufficient for mot polymorphic flow analyi application. In thi ection, we dicu two additional apect of the problem that required u to extend our technique PN Reachability The firt problem i that Dyck-CFL reachability fail to capture many of the valid flow path. Beide the matched reachability path repreented by Dyck language, certain kind of partially matched reachability alo repreent valid flow. For example, in the graph hown in Figure 5, there hould be a valid flow path from the tainted qualifier to the node y 2, ince it i poible for y2 to contain a tainted integer at runtime. However, there i no S path between tainted and y 2. Thi iue alo arie in other application uch a interprocedural dataflow analyi. The conceptual olution to thi problem i to add production to the Dyck grammar that admit thee additional partially matched path. For our application, it turn out that we hould admit all path generated by the following grammar (ee [15]): Start P N P S P ) i P ɛ N S N ( i N ɛ S ( i S ) i S S ɛ Intuitively, thi grammar accept any ubtring of a tring in a Dyck language: P path correpond to prefixe of Dyck tring, and N path correpond to uffixe of Dyck tring. Since our reduction (unlike the Melki-Rep reduction) i pecialized to Dyck language, it i not immediately obviou that we can modify our approach to accept exactly the tring in the above language. Fortunately, it turn out that we can handle thee additional flow path without fundamentally changing our reduction. We eparate the problem into three ubproblem. Firt, we tackle the problem of admitting N path (open-paren uffixe) within our reduction. Second, we tackle the problem of admitting P path (cloeparen prefixe) within our reduction. Finally, we combine the two olution and handle the above language in it full generality. We firt conider the problem of finding N path in the ytem of contraint produced by our reduction. Suppoe we ak whether there i an N path between node u and v. To anwer thi query, we firt recall that the leat olution of a et variable i a regular tree language. Let L(V) denote the language correponding to the leat olution of V. Now conider the following tree language LN u: N n u O i(n) We claim (without proof) that there i an N path in the cloed graph between node u and v if and only if the interection of LN u and L(V) i non-empty. To ee why, recall that edge of the form ( i u, v are repreented by contraint O i(u) V in our reduction while edge of the form S u, v are repreented by contraint U V. Then an N path between node u and v i indicated by the preence of a term of the form O i(... O j(n u)) in the leat olution of V. The language LN u generate exactly the term of thi form, o if L(V) LN u i non-empty, there i at leat one uch term in the leat olution of V, hence, there i an N path from u to v. A a imple example, conider the following CFL graph: u ( i x y ( j v and uppoe we ak whether there i an N path from node u to node v. Our reduction yield a contraint ytem which include the following contraint: n u U O i(u) X X Y O j(y) V Note that L(V) contain the term O j(o i(n u)), which i alo an element of LN u, indicating that there i an N path from u to v. We now conider the problem of finding P path in the ytem of contraint produced by our reduction. The technique i eentially the ame a with finding N path. There

8 i one wrinkle, however: the ) i edge that form P path are repreented a projection in the contraint ytem. There i no term repreentation of a ) i edge a there i with a ( i edge. The olution i traightforward: we imply add a term repreentation for thee edge. We modify the reduction o that for each edge of the form ) i u, v, we alo add the contraint p(u) V (where p i a new unary contructor) to the ytem. Note that there i only one p contructor ued for all indexed ) i ymbol. Thi i becaue the indice of the ) i ymbol are irrelevant to the P path. Now, to check for P path between node u and v, we imply check the non-emptine of the interection of L(V) with the following language LP u: P n u p(p ) Finally, to check for P N path from u to v, we combine the above two olution, and check the non-emptine of L(V) LP N u, where LP N u i defined a follow: N P O i(n) P n u p(p ) Note that thi language conit of term of the form O i(... O j(p(... p(n u)))) which preciely characterize the P N path. In practice, we do not actually build a tree automata recognizing the language LP N u to compute the interection. Intead, to check for a P N path from node u to node v, we travere the term in the leat olution of V, earching for n u. We prune the earch when the expanded term i no longer in the language LP N u or when a cycle i found. Since our implementation applie the rule in Figure 3 online, thi divide our algorithm into two phae: an exhautive phae where all S path are dicovered, and a demand-driven phae where P N path are dicovered a reachability querie are aked 3. The approach outlined in thi ection can be generalized. The idea apply to any regular language reachability problem compoed with a Dyck language reachability problem. In general, let G be an intance of the Dyck-language reachability problem with alphabet O C, and R be a regular language with alphabet A ɛ. Alphabet A need not be dijoint from O C, but the ymbol and S in the Dyck language mut be interpreted a ɛ in the regular language. The all-pair compoed reachability problem over D and G determine the et of vertice (u, v) uch that there i a path in the language R from u to v in cloure(g). Viewing the P N grammar in thi etting, the P production correpond to the regular language ) i, the N production correpond to the regular language ( i, and the regular language R i ) i ( i. The approach outlined previouly olve the all-pair compoed reachability problem: the contraint olver eliminate the Dyck language problem, leaving a regular language reachability problem that can be olved on demand by exploring the leat olution of the contraint a decribed above. 3 A completely demand-driven algorithm could be implemented uing the approach of [7]. x 1 z 1 ( 1 ) 1 y 1 y k 1 y k x n ( n ) n z n Figure 6: The ummary edge optimization Global Node Another problem we face i that global variable in language uch a C mut be treated pecially to dicover all the valid flow path. The problem i that aignment to global variable can flow to any context, ince global torage can be acceed at any program point. Conceptually, node correponding to global variable hould have elf-loop labeled ) i for every index i that may appear elewhere in the graph. Thi olution eentially treat global monomorphically (ee [3] for a more complete dicuion). While thi olution i imple and eay to implement, in practice it i too expenive to repreent thee edge explicitly. With an explicit repreentation, each global variable upper bound may be proportional to the ize of the input program. Explicitly contructing thi lit i prohibitively expenive: with an explicit repreentation of elf-edge, our implementation did not finih after 10 minute on even the mallet benchmark. We olved thi problem by adding a new feature to the contraint olver. The added feature ha a imple interpretation, and may prove ueful in other context. We introduce contructor group, which are imply uer-pecified et of contructor. The element of a contructor group mut all have the ame arity. Once a contructor group g i defined, a pecial kind of projection pattern called a group projection pattern can be created. A group projection pattern gproj(g, i, e) ha eentially the ame emantic a a projection pattern, except that intead of pecifying a ingle contructor, an entire group i pecified. The new rule for handling group projection are a follow: C {c(e 1,..., e a(c) ) gproj(g, i, e)} C {e i e} if c g C {c(e 1,..., e a(c) ) gproj(g, i, e)} C if c / g Contructor group provide u with a way to conciely repreent collection of imilar projection pattern. To handle global node, we add each O i contructor to a new group g O. For each global node u, we add the contraint U gproj(g O, 1, U) which imulate the addition of elf loop ) i for each index i in the graph. 5.2 Optimization In thi ubection, we dicu ome optimization for polymorphic flow analyi application Summary Edge The CFL graph that arie in thi application have a particular tructure that can be exploited to eliminate redun-

9 O 1(X 1) proj(o 1, 1, Z 1) Y 1 Y k 1 Y k O n(x n) proj(o n, 1, Z n) (a) proj(o, 1, Z 1) O(X 1,..., X n) Y 1 Y k 1 Y k proj(o, n, Z n) (b) Figure 7: Edge added by the et contraint olver for the graph in Figure 6 uing (a) the tandard reduction and (b) the reduction with the clutering optimization dant work during the computation of the graph cloure. An exemplar of thi tructure i hown in Figure 6. There are two important feature of thi graph that we exploit. Firt, there i a long chain of node y 2,..., y k 1, none of which contain edge other than -edge. Second, the node y 1 and y k have a large number of predeceor ( i edge and ucceor ) i edge, repectively. Thi ituation arie frequently in polymorphic flow analyi application: the x i node repreent the inflow of actual argument to the formal argument y 1 at call ite, and the z i node repreent the outflow of return value back to call ite from the returned value y k. The trick i to dicover all the S x i, z i path with a little redundant work a poible. To find thee edge, the generic CFL algorithm dicued in Section 2.1 would add a total of nk new edge from each of the x i to each of the y j. Conceptually, thi correpond to analyzing the function body once per tatic call ite. One way to avoid thi redundant work i to contruct a o-called ummary edge after analyzing the chain of y node once [10]. Thi optimization work a follow: the firt path explored from an x i node trigger a new earch forward from node y 1. Analyzing the chain of y node caue k 1 edge addition from y 1 to each of the remaining y i. When the edge S y 1, y k i finally dicovered, it i marked a a ummary edge, and y 1 i marked a having a ummary edge. When earching forward for new path from the other x i node, the ummary edge S y 1, y k i ued, avoiding repeated analyi of the y chain. In total, the ummary edge approach add a total of n + k 1 new edge to dicover the S x i, z i edge. Conceptually, the ummary edge approach correpond to analyzing a function body once, and copying the ummarized flow to each call ite. The dahed edge in Figure 6 how the edge added by a cloure algorithm with the ummary edge optimization. Our reduction a decribed may perform the ame work a the naive CFL cloure algorithm on thi example. Figure 7(a) how the wort-cae edge addition performed on thi example in inductive form. In inductive form, the number of edge addition depend on the ordering of the Y i variable. In the wort cae, the variable ordering might caue inductive form to repreent all variable-variable edge a a ucceor edge (i.e. if o(y i) > o(y i+1) for every i in the chain). On the other hand, if the ordering i uch that ome of the variable-variable edge are repreented a predeceor edge, inductive form can reduce the number of edge addition. Under the bet variable ordering, inductive form add the ame number of edge a the ummary edge optimization. It i alo poible to modify the reduction o that the number of edge addition i minimized regardle of the variable ordering. The key i to cluter the variable correponding to the x i node into a ingle n-ary contructed term intead of n unary contructed term. The indice can be encoded by the poition within the contructed term: for intance, the ith ubterm repreent the ource end of an edge labeled ( i. Our repreentation of ) i edge i modified a well, o that, e.g., the contraint U proj(o, i, V) repreent an edge ) i u, v. Figure 7(b) how the effect of the clutering optimization on the ame example graph. The net effect of thi optimization i the ame a with ummary edge: the edge S x i, z i are dicovered with the addition of at mot n + k 1 edge intead of nk edge. With ome work, thi reduction can be extended to handle PN-reachability and global node, though we omit the detail here Cycle Elimination One advantage of our reduction i that it preerve the tructure of the input graph in a way that the Melki-Rep reduction doe not. The contraint graph produced by our reduction are iomorphic (modulo the repreentation of edge) to the original CFL graph. In fact, the connection i o cloe that cycle elimination, one of the key optimization ued in et contraint algorithm, i revealed to have an interpretation in the Dyck-CFL reachability problem. Cycle elimination exploit the fact that variable involved in cyclic contraint (contraint of the form X 1 X 2 X 3... X n X 1) are equal in all olution, and thu can be collaped into a ingle variable. By revering our reduction,

10 we ee that cyclic contraint correpond to cycle of the form: x 1 x 2... x n x 1 in the Dyck-CFL graph. The correponding et variable are equivalent in all olution; the CFL notion i that any node reaching one of the x i node reache every x i node becaue we can alway concatenate additional terminal onto any word in the language and till derive a valid S-path. Hence, all the x i in the CFL graph can be collaped and treated a a ingle node. Note that the Melki-Rep reduction doe not preerve uch cycle: their reduction applied to CFL graph hown above produce contraint of the form (X i) X i 1 which do not expoe a cyclic contraint for cycle elimination to implify. We validate thee obervation experimentally in Section 5.3 by howing the effect of partial online cycle elimination [4] on our implementation. 5.3 Experimental Reult In thi ection we compare an implementation of the reduction in Section 4 to a hand-written Dyck-CFL reachability implementation by Robert Johnon, which i baed on an algorithm decribed in [10]. Johnon implementation i cutomized to the polymorphic qualifier inference problem, and contain optimization (including ummary edge) that exploit the particular tructure of the graph that arie in thi application. Our implementation ue the banhee analyi toolkit a the underlying et contraint olver [11]. We implemented the extenion for PN-reachability and global node a decribed in Section 5.1. In addition, all of the optimization decribed in Section 5.2 are part of our implementation: we upport clutering, and the banhee toolkit ue inductive form and enable cycle elimination by default. We ued the C benchmark program hown in Table 2 for our experiment. For each benchmark, the table lit the number of line of code in the original ource, the number of pre-proceed line of code, the number of ditinct node in the CFL graph, the number of edge in the CFL graph, and the number of ditinct indice (recall that thi number correpond to the number of function call ite). All experiment were performed on a dual-proceor 550 MHz Pentium III with 2GB of memory running RedHat We ran CQual to generate a Dyck-CFL graph, and computed the cloure of that graph uing Johnon Dyck-CFL reachability implementation and our own. We alo ran our implementation with the clutering optimization enabled. Table 2 how the analyi time (in econd) for each experiment. The analyi time alo include the time for CQual to pare the code and build the initial graph. Column 7 how the time required for our implementation without cycle elimination. Column 8 how time for the ame implementation with partial online cycle elimination enabled. Column 9 how time with cycle elimination and the clutering optimization. Finally, column 10 how the time for Johnon implementation, which act a the gold tandard. Figure 8 plot the analyi time for our implementation, normalized to Johnon implementation. The reult how that our implementation exhibit the ame caling behavior 4 Though only one proceor wa actually ued. Analyi Time (Johnon = 1.0) Reult for the tainted/untainted experi- Figure 8: ment Ratio (no cycle-elim/cycle-elim) Preproceed LOC +cycle elim +clutering Preproceed LOC Figure 9: Speedup due to cycle elimination a Johnon. In all the benchmark except one, the analyi time for our implementation remain within a factor of two of Johnon implementation. Becaue pare time i a contant for all the implementation, factoring it out doe have an affect on thee ratio; however, we found that pare time account for a mall fraction of the total analyi time. The clutering optimization improved a few benchmark ignificantly, but did not eem to improve calability overall. Figure 9 compare the performance of our implementation (no clutering) with and without cycle elimination. We found that our benchmark ran up to 40 time fater with cycle elimination enabled. Thee reult ugget that online cycle elimination could be incorporated into the tandard algorithm for Dyck-CFL reachability, an idea that ha been implicitly uggeted before [8]. 6. RELATED WORK We view our work a a practical follow-up to Melki and Rep work, which how that et contraint and CFL reachability are interconvertible [12, 13]. Our approach expand on the connection between Dyck-CFL reachability and et contraint, and illutrate the practical conequence of that connection. Many reearcher have formulated program analye a CFL reachability problem. The author firt became aware of the connection from work by Rep et al., who formulated

11 Benchmark LOC Preproc Node Edge Indice banhee() + cycle elim() + cluter() johnon() identd mingetty bftpd woman-3.0a patch m muh-2.05d diffutil uucp mar nwe imapd-4.7c ipopd-4.7c endmail proftpd-1.20pre backup-cffixed apache cfengine Table 2: Benchmark data for all experiment interprocedural dataflow analyi a a Dyck-CFL graph, and introduced an algorithm to anwer the all-pair reachability problem for thee graph [18]. Follow-up work introduced a demand-driven algorithm for olving thi problem [10]. Many implementation of Dyck-CFL reachability are baed on thi algorithm. Rehof et al. how how to ue CFL reachability a an implementation technique for polymorphic flow analyi [15]. CFL reachability i ued a an alternative to repeated copying and implification of ytem of intantiation contraint. The firt application of Rehof et al. work wa to polymorphic point-to analyi [3]. Other application of Dyck-CFL reachability include field-enitive point-to analyi, hape analyi [16], interprocedural licing [9], and debugging ytem of unification contraint [2]. 7. CONCLUSION We have hown a reduction from Dyck-CFL reachability to et contraint, and hown that our technique can be applied in practice to the CFL reachability problem that arie in program analye. Acknowledgment We would like to thank Robert Johnon for providing u with hi implementation of CFL reachability, and David Melki, Tom Rep, and the anonymou reviewer for their helpful comment and uggetion. 8. REFERENCES [1] A. Aiken and E. L. Wimmer. Solving Sytem of Set Contraint. In Proceeding, Seventh Annual IEEE Sympoium on Logic in Computer Science, page , Santa Cruz, California, June [2] V. Choppella and C. T. Hayne. Source-tracking Unification. In F. Baader, editor, Automated Deduction - CADE-19, 19th International Conference on Automated Deduction Miami Beach, FL, USA, July 28 - Augut 2, 2003, Proceeding, volume 2741 of Lecture Note in Computer Science, page Springer, [3] M. Da, B. Liblit, M. Fähndrich, and J. Rehof. Etimating the Impact of Scalable Pointer Analyi on Optimization. In SAS 01: The 8th International Static Analyi Sympoium, Lecture Note in Computer Science, Pari, France, July Springer-Verlag. [4] M. Fähndrich, J. S. Foter, Z. Su, and A. Aiken. Partial Online Cycle Elimination in Incluion Contraint Graph. In Proceeding of the 1998 ACM SIGPLAN Conference on Programming Language Deign and Implementation, page 85 96, Montreal, Canada, June [5] J. S. Foter, M. Fähndrich, and A. Aiken. A Theory of Type Qualifier. In Proceeding of the 1999 ACM SIGPLAN Conference on Programming Language Deign and Implementation, page , Atlanta, Georgia, May [6] N. Heintze. Set Baed Program Analyi. PhD diertation, Carnegie Mellon Univerity, Department of Computer Science, Oct [7] N. Heintze and O. Tardieu. Demand-driven Pointer Analyi. In SIGPLAN Conference on Programming Language Deign and Implementation, page 24 34, [8] N. Heintze and O. Tardieu. Ultra-fat Aliaing Analyi Uing CLA: A Million Line of C Code in a Second. In SIGPLAN Conference on Programming Language Deign and Implementation, page , [9] S. Horwitz, T. Rep, and D. Binkley. Interprocedural Slicing Uing Dependence Graph. ACM Tranaction on Programming Language and Sytem, 12(1):26 60, [10] S. Horwitz, T. Rep, and M. Sagiv. Demand Interprocedural Dataflow Analyi. In Proceeding of the 3rd ACM SIGSOFT Sympoium on Foundation of Software Engineering, page ACM Pre, [11] J. Kodumal. BANSHEE: A Toolkit for Building