Static Program Analysis

Transcription

1 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks Thomas Noll Software Modeling and Verification Grou RWTH Aachen University htts://moves.rwth-aachen.de/teaching/ws-1617/sa/

2 Reca: Pointer Analysis The Shae Analysis Aroach Goal: determine the ossible shaes of a dynamically allocated data structure at given rogram oint Interesting information: data tyes (to avoid tye errors, such as dereferencingnil) aliasing (different ointer variables having same value) sharing (different hea ointers referencing same location) reachability of nodes (garbage collection) disjointness of hea regions (arallelisability) shaes (lists, trees, absence of cycles,...) Concrete questions: Doesx.next oint to a shared element? Does a variableoint to an allocated element every timeis dereferenced? Does a variable oint to an acyclic list? Does a variable oint to a doubly-linked list? Can a loo or rocedure cause a memory leak? Here: basic outline; details in [Nielson/Nielson/Hankin 2005, Sct. 2.6] 3 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

3 Reca: Pointer Analysis Extending the Syntax Syntactic categories: Category Domain Meta variable Arithmetic exressions AEx a Boolean exressions BEx b Selector names Sel sel Pointer exressions PEx Commands (statements) Cmd c Context-free grammar: a::= z x a 1 +a 2... nil AEx b ::= t a 1 =a 2 b 1 b 2... is-nil() BEx ::= x x.sel c ::=[ski] l [ := a] l c 1 ;c 2 if[b] l then c 1 else c 2 end while[b] l do c end [malloc ] l Cmd 4 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

4 Reca: Pointer Analysis Shae Grahs I Aroach: reresentation of (infinitely many) concrete hea states by (finitely many) abstract shae grahs abstract nodes X = sets of variables interretation: x X iff x oints to concrete node reresented by X reresents all concrete nodes that are not directly addressed by ointer variables x, y X (with x y) indicate aliasing (as x and y oint to the same concrete node) if x.sel and y refer to the same hea address and if X, Y are abstract nodes with x X and y Y, this yields abstract edge X sel = Y (similarly for X = or Y = ) transfer functions transform (sets of) shae grahs 5 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

5 Reca: Pointer Analysis Shae Grahs II Definition (Shae grah) A shae grah consists of a set Abs 2 Var of abstract locations and an abstract hea = Abs Sel Abs notation: X sel = Y for(x, sel, Y) = G = (Abs,= ) with the following roerties: Disjointness: X, Y Abs = X = Y or X Y = (a variable can refer to at most one hea location) Determinacy: X and X = sel Y and X sel = Z = Y = Z (target location is unique if source node is unique) SG denotes the set of all shae grahs. 6 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

6 Reca: Pointer Analysis From Hea Configurations to Shae Grahs Definition Given a hea configuration H = (Nod, Sel, Var,σ, ), the corresonding shae grah G = (Abs, = ) is defined by Abs := {σ 1 (n) n Nod} = {{x Var σ(x) = n} n Nod} For all X, Y Abs and sel Sel: X = sel Y n X, n y Nod : σ 1 (n X ) = X,σ 1 sel (n Y ) = Y, n X n Y Remark: yields Galois connection between sets of hea configurations and sets of shae grahs, both ordered by 7 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

7 Reca: Pointer Analysis Shae Grahs and Concrete Hea Proerties Examle Let G = (Abs,= ) be a shae grah. Then the following concrete hea roerties can be exressed as conditions on G: x nil X Abs : x X x = y nil (aliasing) Z Abs : x,y Z x.sel1 = y.sel2 nil (sharing) = X, Y, Z Abs : x X,y Y, X = sel1 Z = sel2 Y ( = only valid if Z ) 8 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

8 Shae Analysis The Goal Shae Analysis The goal of Shae Analysis is to determine, for each rogram oint, a set of shae grahs that together reresent all concrete hea configurations which can occur during rogram execution at that oint. Forward analysis Domain: (D, ) := (2 SG, ) (Var, Sel finite = SG finite = 2 SG finite = ACC) Extremal value: ι := {shae grahs for ossible initial values of Var} Examle 21.1 (List reversal; cf. Examle 20.5) Variables: Var = {x,y,z} Assumtion: x oints to any (finite, non-cyclic) list, y = z = nil next ι = }{{} (, ), {x}, {x} = next, {x} = next }{{}}{{}}{{} emty 1 elem. 2 elem. 3 elem. 10 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

9 Shae Analysis The Transfer Functions Transform each single shae grah into a set of shae grahs: for each l Lab, n ϕ l : 2 SG 2 SG : {G 1,...,G n }) Definition 21.2 (Transfer functions for shae analysis) ϕ l (G) SG is determined by B l (where G = (Abs,= )): [ski] l : ϕ l (G) := {G} [b] l : ϕ l (G) := {G} [ := a] l : case-by-case analysis w.r.t. and a [Nielson/Nielson/Hankin 2005, Sct ]: 12 cases on 11. may involve (high degree of) non-determinism see examle on following slide i=1 ϕ l (G i ) [malloc x] l : ϕ l (G) := {(Abs {{x}},= )} with Abs := {X \{x} X Abs} X, Y Abs, sel Sel : X \{x} = sel Y \{x} iff X = sel Y [malloc x.sel] l : equivalent to [malloc t] l 1 ;[x.sel := t]l 2 ;[t := nil]l 3 (with fresh t Var and l 1, l 2, l 3 Lab) Fixoint solution yields SG l SG for each l Lab 11 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

10 Shae Analysis An Examle Examle 21.3 (Transfer function for ointer assignment) sel1 sel sel2 {y} {z} (justification: on the board) (a) sel1 sel sel2 {y} {x} {z} ϕ x := y.sel (b) sel1 sel sel2 {y} {x} {z} sel1 (c) sel1 sel sel2 {y} {x} {z} sel1 (d) sel2 (e) sel2 sel1 sel1 sel sel {y} {x} {z} {y} {x} {z} 12 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

11 Shae Analysis Soundness of Abstraction Theorem 21.4 (Safety of aroximation) Let H be a hea configuration with corresonding shae grah G (according to Definition 20.7), and let l Lab. If B l mas H to hea configuration H, then there exists a shae grah G ϕ l (G) that corresonds to H. Proof. omitted 13 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

12 Shae Analysis Alication to List Reversal Examle 21.5 (List reversal; cf. Examle 20.5) Shae analysis of list reversal rogram yields final result (, ) }{{} emty Interretation: + Result again a finite list, {y} }{{} 1 elem., {y} next = }{{} 2 elem. but otentially cyclic (may be a lasso, but not a ring) also reversal roerty not guaranteed result could be in wrong order or have more/less entries next, {y} = next }{{} 3 elem. 14 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

13 Further Toic in Program Analysis Dedicated Algorithms for Pointer Analysis nil Pointer Analysis: checks whether dereferencing oerations ossibly involve nil ointers with shae analysis: x = nil ossible for x Var at l Lab if there exists G = (Abs,= ) SG l such that x / X Abs X Points-To Analysis: yields function t that for each x Var returns set t(x) Nod of ossible ointer targets x and y may be aliases if t(x) t(y) with shae analysis: there exists G = (Abs,= ) SG l and Z Abs such that x, y Z Usually faster and sometimes more recise than shae analysis, but less general (only shallow roerties) Fastest algorithms are flow-insensitive (oints-to edges only added but never removed) 16 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

14 Further Toic in Program Analysis Grah Grammar Aroaches to Pointer Analysis E.g., J. Heinen, C. Jansen, J.-P. Katoen, T. Noll: Verifying Pointer Programs using Grah Grammars. Science of Comuter Programming 97, , 2015 Idea: secify data structures by grah roduction rules Concretisation by forward alication Abstraction by backward alication All ointer oerations remain concrete Avoids involved definition of transfer functions Examle 21.6 (Doubly-linked lists) L n n n L L n n L1 1 L of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

15 Further Toic in Program Analysis Abstract Execution Using Grah Grammars n L 1 2 n 1 L Examle 21.7 (tm := os.next;) os tm os tm os tm concr. n n L 1 2 abstr. 2 L 1 n L 1 2 n L 1 2 concr. n os n tm abstr. 2 L 1 os n tm Princile Concretise whenever necessary; abstract whenever ossible. 18 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

16 Further Toic in Program Analysis Correctness of Dataflow Analyses So far: semantics and dataflow analysis of rograms considered indeendently (formal soundness roofs only for abstract interretation; cf. Lecture 12/13) Of course both are (and should be) related! To this aim: comare results of concrete semantics (Definition 11.9) with outcome of analysis See [Nielson/Nielson/Hankin 2005, Sct. 2.2] for details Examle 21.8 (Correctness of Constant Proagation) Let c Cmd, l Lab c, x Var, and z Z such that CP l (x) = z. Then for allσ 0,σ Σ such that init(c),σ 0 l,σ,σ(x) = z. 19 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

17 Final Remarks Written Exam Dates: Tue 21 Feb, 15:00 17:00, AH 2/3 Thu 23 Mar, 10:00 12:00, AH 2 Q&A session on Wed 08 Feb (12:00, AH 3) lease submit questions beforehand to Christina Jansen or Christoh Matheja 21 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks

18 Final Remarks Forthcoming Course in SS 2017 Comiler Construction [Noll; V3 Ü2] 1. Lexical analysis of rograms (Scanner) 2. Syntactic analysis of rograms (Parser) 3. Semantic analysis of rograms 4. Code generation 5. Tools for comiler construction 22 of 22 Static Program Analysis Lecture 21: Shae Analysis & Final Remarks