an overview on static program analysis mooly sagiv
TRANSCRIPT
![Page 1: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/1.jpg)
Static Analysis
Automatic derivation of static properties which hold on every execution leading to a programlocation
![Page 2: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/2.jpg)
Example Static Analysis Problem
Find variables with constant value at a given program location
Example program int p(int x){
return x *x ;
void main()}{
int z;
if (getc())z = p(6) + 8;
else z = p(-7) -5;printf (z);
} 44
![Page 3: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/3.jpg)
Recursive Programint xvoid p(a) {
read (c);if c > 0 {
a = a -2; p(a); a = a + 2; }
x = -2 * a + 5;print (x);
}void main {
p(7);print(x);
}
![Page 4: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/4.jpg)
Iterative Approximation
z =3
while (x>0)
if (x=1)
y =7 y =z+4
assert y==7
[x?, y?, z?]
[x?, y?, z 3]
[x?, y?, z3]
[x?, y?, z3][x1, y?, z3]
[x1, y7, z3] [x?, y7, z3]
[x?, y?, z3]
![Page 5: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/5.jpg)
List reverse(Element head){
List rev, n;rev = NULL;
while (head != NULL) {n = head next;
head next = rev; head = n;
rev = head;
}return rev;
}
Memory Leakage
potential leakage of address pointed to by head
![Page 6: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/6.jpg)
Memory LeakageElement reverse(Element head) {
Element rev, n;rev = NULL;
while (head != NULL) {n = head next;
head next = rev;
rev = head;
head = n;
}return rev; }
No memory leaks
![Page 7: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/7.jpg)
A Simple Example
void foo(char *s )
{
while ( *s != ‘ ‘ )
s++;
*s = 0;
}
Potential buffer overrun:offset(s) alloc(base(s))
![Page 8: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/8.jpg)
A Simple Example
void foo(char *s) @require string(s)
{
while ( *s != ‘ ‘&& *s != 0)
s++;
*s = 0;
}
No buffer overruns
![Page 9: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/9.jpg)
Example Static Analysis Problem
Find variables which are live at a given program location
Used before set on some execution paths from the current program point
![Page 10: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/10.jpg)
A Simple Example/* c */
L0: a := 0
/* ac */
L1: b := a + 1
/* bc */
c := c + b
/* bc */
a := b * 2
/* ac */
if c < N goto L1
/* c */
return c
a b
c
![Page 11: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/11.jpg)
Compiler Scheme
String Scanner
Parser
Semantic Analysis
Code Generator
Static analysis
Transformations
Tokens
AST
AST
LIR
source-program
tokens
AST
IR
IR +information
![Page 12: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/12.jpg)
Other Example Program Analyses
Reaching definitions Expressions that are ``available'' Dead code Pointer variables never point into the same location Points in the program in which it is safe to free an object An invocation of virtual method whose address is unique Statements that can be executed in parallel An access to a variable which must be in cache Integer intervals
![Page 13: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/13.jpg)
The Need for Static Analysis Compilers
– Advanced computer architectures
– High level programming languages (functional, OO, dynamic)
Software Productivity Tools– Compile time debugging
» Stronger type Checking for C
» Array bound violations
» Identify dangling pointers
» Generate test cases
» Generate certification proofs
Program Understanding
![Page 14: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/14.jpg)
Challenges in Static Analysis
Non-trivial Correctness Precision Efficiency of the analysis Scaling
![Page 15: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/15.jpg)
C Compilers
The language was designed to reduce the need for optimizations and static analysis
The programmer has control over performance (order of evaluation, storage, registers)
C compilers nowadays spend most of the compilation time in static analysis
Sometimes C compilers have to work harder!
![Page 16: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/16.jpg)
Software Quality Tools
Detecting hazards (lint)– Uninitialized variables
a = malloc() ;b = a; cfree (a);c = malloc ();if (b == c) printf(“unexpected equality”);
References outside array bounds Memory leaks (occurs even in Java!)
![Page 17: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/17.jpg)
Foundation of Static Analysis
Static analysis can be viewed as interpreting the program over an “abstract domain”
Execute the program over larger set of execution paths
Guarantee sound results– Every identified constant is indeed a constant
– But not every constant is identified as such
![Page 18: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/18.jpg)
Example Abstract Interpretation Casting Out Nines
Check soundness of arithmetic using 9 values0, 1, 2, 3, 4, 5, 6, 7, 8
Whenever an intermediate result exceeds 8, replace by the sum of its digits (recursively)
Report an error if the values do not match Example query “123 * 457 + 76543 = 132654$?”
– Left 123*457 + 76543= 6 * 7 + 7 =6 + 7 = 4
– Right 3
– Report an error
Soundness(10a + b) mod 9 = (a + b) mod 9(a+b) mod 9 = (a mod 9) + (b mod 9)(a*b) mod 9 = (a mod 9) * (b mod 9)
![Page 19: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/19.jpg)
Even/Odd Abstract Interpretation
Determine if an integer variable is even or odd at a given program point
![Page 20: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/20.jpg)
Example Program
while (x !=1) do {
if (x %2) == 0 { x := x / 2; }
else { x := x * 3 + 1;
assert (x %2 ==0); } }
{0, 1, 2, … }
{0, 2, 3, … }
{0, 2, 4, …}
{3, 5, 7, …}
{0, 1, 2, … }
{10, 16, 22, …}
{1 }
![Page 21: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/21.jpg)
Example Program
while (x !=1) do {
if (x %2) == 0 { x := x / 2; }
else { x := x * 3 + 1;
assert (x %2 ==0); } }
?
?
E
O
?
E
O
![Page 22: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/22.jpg)
Abstract
Abstract Interpretation
Concrete
Sets of storesDescriptors ofsets of stores
![Page 23: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/23.jpg)
Odd/Even Abstract Interpretation
{-2, 1, 5}
{0,2}
{2}{0}
E O
?
All concrete states
{x: x Even}
![Page 24: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/24.jpg)
Odd/Even Abstract Interpretation
{-2, 1, 5}
{0,2}
{2}{0}
E O
?
All concrete states
{x: x Even}
![Page 25: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/25.jpg)
Odd/Even Abstract Interpretation
{-2, 1, 5}
{0,2}
{2}{0}
E O
?
All concrete states
{x: x Even}
![Page 26: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/26.jpg)
Example Program
while (x !=1) do {
if (x %2) == 0 { x := x / 2; }
else { x := x * 3 + 1;
assert (x %2 ==0); } }
O E
![Page 27: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/27.jpg)
(Best) Abstract Transformer
Concrete Representati
on
Concrete Representati
on
Concretization Abstraction
Operational Semantics
St
Abstract Representati
on
Abstract Representati
onAbstract Semantics
St
![Page 28: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/28.jpg)
Concrete and Abstract Interpretation+ 0 1 2 3 …0 0 1 2 3 …1 1 2 3 4 …2 2 3 4 5 …3 3 4 5 6 …
* 0 1 2 3 …0 0 0 0 0 …1 0 1 2 3 …2 0 2 4 6 …3 0 3 6 9 …
+’ ? O E? ? ? ?O ? E OE ? O E
*’ ? O E? ? ? EO ? O EE E E E
![Page 29: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/29.jpg)
Example Program
[x !=1]1
[x := x /2]3
[exit]5
[x %2=0]2
[x := x * 3 +1]4
x1 = x’3 x’4 x'1 = x1
x2 = x’1 x‘2 = x2
x3 = x’2 Ex'3 =
x4 = x’2 O
x‘4 = x4 *# O +# O
x5 = x’1 O
x‘5 = x5
FT
T F
![Page 30: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/30.jpg)
Runtime vs. Static Testing
Runtime Abstract
Effectiveness Missed Errors False alarms
Locate rare errors
Cost Proportional to program’s execution
Proportional to program’s size
![Page 31: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/31.jpg)
Abstract (Conservative) interpretation
abstract representation
Set of states
concretization
Abstractsemantics
statement s abstract representation
abstraction
Operational semantics
statement sSet of states
![Page 32: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/32.jpg)
Example rule of signs
Safely identify the sign of variables at every program location
Abstract representation {P, N, ?} Abstract (conservative) semantics of *
P N
?
![Page 33: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/33.jpg)
Abstract (conservative) interpretation
<N, N>
{…,<-88, -2>,…}
concretization
Abstractsemantics
x := x*#y<P, N>
abstraction
Operational semantics
x := x*y {…, <176, -2>…}
![Page 34: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/34.jpg)
Example rule of signs (cont) Safely identify the sign of variables at every
program location Abstract representation {P, N, ?} (C) = if all elements in C are positive
then return P else if all elements in C are negative then return N else return ?
(a) = if (a==P) then return{0, 1, 2, … } else if (a==N)
return {-1, -2, -3, …, } else return Z
![Page 35: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/35.jpg)
Example Constant Propagation
Abstract representation set of integer values and and extra value “?” denoting variables not known to be constants
Conservative interpretation of +
![Page 36: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/36.jpg)
Example Constant Propagation(Cont)
Conservative interpretation of *
![Page 37: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/37.jpg)
Example Program{<0, 0, 0>, <0, 1, 0>, … , <1, 0, 0>, <1, 1, 0>, …}
x = 5;
{<5, 0, 0>, <0, 1, 0>, … }
y = 7;
{<5, 7, 0>, <5, 7, 1>, …}
if (getc())
y = x + 2;
{<5, 7, 0>, <5, 7, 1>, …} z = x +y ;
{<5, 7, 12>}
![Page 38: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/38.jpg)
Example Program<?, ?, ?>
x = 5;
<5, ?, ?>
y = 7;
<5, 7, ?>
if (getc())
y = x + 2;
<5, 7, ?> z = x +y ;<5, 7, 12>
![Page 39: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/39.jpg)
Example Program (2)
{<0, 0, 0>, <0, 1, 0>, … , <1, 0, 0>, <1, 1, 0>, …}
if (getc()) x= 3 ; y = 2; {<3, 2, 0>, <3, 2, 1>, …}
else
x =2; y = 3;
{<2, 3, 0>, <2, 3, 1>, …}
z = x +y;
{<3, 2, 5>, <2, 3, 5>}
![Page 40: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/40.jpg)
Undecidability Issues
It is undecidable if a program point is reachablein some execution
Some static analysis problems are undecidable even if the program conditions are ignored
It may be undecidable to compute the best transformers
Computing the least abstract value may be undecidable
![Page 41: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/41.jpg)
The Constant Propagation Example
while (getc()) { if (getc()) x1 = x1 + 1;
if (getc()) x2 = x2 + 1; ... if (getc()) xn = xn + 1; }y = truncate (1/ (1 + p2(x1, x2, ..., xn))/* Is y=0 here? */
![Page 42: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/42.jpg)
Coping with undecidabilty
Loop free programs Simple static properties Interactive solutions Conservative estimations
– Every enabled transformation cannot change the meaning of the code but some transformations are no enabled
– Non optimal code
– Every potential error is caught but some “false alarms” may be issued
![Page 43: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/43.jpg)
Analogies with Numerical Analysis
Approximate the exact semantics More precision can be obtained at greater computational costs
![Page 44: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/44.jpg)
Violation of soundness
Loop invariant code motion Dead code elimination Overflow
((x+y)+z) != (x + (y+z)) Quality checking tools may decide to ignore
certain kinds of errors
![Page 45: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/45.jpg)
Abstract interpretation cannot be always homomorphic (rules of signs)
<N, P>
<-8, 7>
abstraction
<N, P>
abstraction
Operational semantics
x := x+y <-1, 7>
Abstractsemantics
x := x+#y<? P>
![Page 46: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/46.jpg)
Local Soundness of Abstract Interpretation
abstraction abstraction
Operational semantics
statement
Abstractsemantics
statement#
![Page 47: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/47.jpg)
Optimality Criteria
Precise (with respect to a subset of the programs) Precise under the assumption that all paths are
executable (statically exact) Relatively optimal with respect to the chosen
abstract domain Good enough
![Page 48: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/48.jpg)
Relation to Program Verification
Fully automatic
Applicable to a programming language
Can be very imprecise May yield false alarms
Requires specification and loop invariants
Program specific
Relative complete Provide counter examples Provide useful documentation Can be mechanized using
theorem provers
Program Analysis Program Verification
![Page 49: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/49.jpg)
Origins of Abstract Interpretation [Naur 1965] The Gier Algol compiler
“A process which combines the operators and operands of the source text in the manner in which an actual evaluation would have to do it, but which operates on descriptions of the operands, not their value”
[Reynolds 1969] Interesting analysis which includes infinite domains (context free grammars)
[Syntzoff 1972] Well foudedness of programs and termination [Cousot and Cousot 1976,77,79,…] The foundation [Graham and Wegman, 1975: Kamm and Ullman, Kildall 1977]
Algorithmic foundations [Tarjan 1981] Reductions to semi-ring problems [Sharir and Pnueli 1981] Foundation of the interprocedural case [Allen, Kennedy, Cock, Jones, Muchnick and Schwartz]
![Page 50: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/50.jpg)
Complementary Approaches
Better programming language design Type checking Just in time and dynamic compilation Profiling Sophisticated hardware Runtime tests Concolic testing
![Page 51: An Overview on Static Program Analysis Mooly Sagiv](https://reader034.vdocument.in/reader034/viewer/2022051315/56649dc55503460f94ab865b/html5/thumbnails/51.jpg)
Summary
Understanding concretization is essential– For dataflow analysis
– For type inference/checking
– For logicians
Abstract interpretation is not limited to a particular style of programming