Extensible Shape Analysis by Designing with the User in Mind Bor-Yuh Evan Chang, Xavier Rival, and George Necula University of California, Berkeley OSQ Retreat May 16, 2008 Motivation Analyses find many kinds of bugs For example, Reading
"Extensible Shape Analysis by Designing with the" is the property of its rightful owner. Permission is granted to
download and print the materials on this website for personal, non-commercial use only, and to display it
on your personal computer provided you do not modify the materials and that you retain all copyright
notices contained in the materials. By downloading content from our website, you accept the terms of this
agreement.
Presentation Transcript
01
Extensible Shape Analysis by Designing with the User in Mind Bor-Yuh Evan Chang, Xavier Rival, and George Necula
University of California, Berkeley
OSQ Retreat
May 16, 2008<br>
02
Motivation Analyses find many kinds of bugs
For example,
Reading from a closed file:
Reacquiring a locked lock:
But often struggle when objects are put into data structures Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Shape Analysis is Data Structure Analysis<br>
03
… code …
// x now points to an unlocked lock in a linked list
acquire(x);
… code … ideal analysis state analysis state What’s hard about data structures? Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind or or or … For decidability, must abstract (e.g., merge objects) Abstraction too coarse or not precise enough (e.g., lost x is always unlocked) mislabels good code as buggy <br>
04
To address the precision challenge Traditional program analysis mentality: “ Why can’t developers write more specifications for our analysis? Then, we could verify so much more.”
“ Since developers won’t write specifications, we will use default abstractions (perhaps coarse) that work hopefully most of the time.” Our approach: “ Can we design program analyses around the user? Developers write testing code. Can we adapt the analysis to use those as specifications?” Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
05
Overview of contributions Precise inference of data structure properties
Able to check, for instance, the locking example
Targeted to software developers
Uses data structure checking code for guidance
Turns testing code into a specification for static analysis
Efficient
Builds abstraction out of developer-supplied checking code Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
06
Shape analysis by example: Removing duplicates // l is a sorted doubly-linked list
for each node cur in list l {
remove cur if duplicate;
}
assert l is sorted, doubly-linked with no duplicates; Example/Testing Code Review/Static Analysis program-specific intermediate state more complicated Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
07
Shape analysis is not yet practical Choosing the heap abstraction difficult for precision Parametric in high-level, developer-oriented predicates
+ Extensible
+ Targeted to developers Built-in high-level predicates
- Hard to extend
+ No additional user effort (if precise enough) Parametric in low-level, analyzer-oriented predicates
+ Very general and expressive
- Hard for non-expert 89 Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Space Invader [Distefano et al.] TVLA
[Sagiv et al.]<br>
08
Key insight for being developer-friendly and efficient Utilize “run-time checking code” as specification for static analysis. assert(sorted_dll(l,…));
for each node cur in list l {
remove cur if duplicate;
}
assert(sorted_dll_nodup(l,…)); Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Contribution: Automatically generalize checkers for complicated intermediate states Contribution:
Build the abstraction for analysis out of developer-specified checking code p specifies where prev should point<br>
09
Our framework is … Extensible and targeted for developers
Parametric in developer-supplied checkers
Precise yet compact abstraction for efficiency
Data structure-specific based on properties of interest to the developer An automated shape analysis with a precise memory abstraction based around invariant checkers. Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
10
Splitting of summaries (materialization)
To reflect updates precisely (strong updates)
And summarizing for termination (widening) Shape analysis is an abstract interpretation on memory descriptions with … Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
11
Outline shape analyzer abstract interpretation splitting and
interpreting update summarizing Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Learn information about the checker to use it as an abstraction 1 2<br>
12
Overview: Split summaries to interpret updates precisely Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Want abstract update to be “exact”, that is, to update one “concrete memory cell”. The example at a high-level: iterate using cur changing the doubly-linked list from purple to red. Challenge:
How does the analysis “split” summaries and know where to “split”?<br>
13
Split summaries by unfolding induction Ç dll(h, p) =
if (h = null) then
true
else
h!prev = p and dll(h!next, h) Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Analysis doesn’t forget the empty case “dll segment l to cur” “dll segment l to cur” “dll segment l to cur” Technical Details:
What about unfolding segments?
How are segments unfolded?
(Key: Segments are also inductively defined)
[POPL’08]
How does the analysis know to do unfolding?<br>
14
Outline shape analyzer abstract interpretation splitting and
interpreting update summarizing type
“pre-analysis”
on checker
definitions Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Contribution: Turns testing code into specification for static analysis 1 2 How do we decide where to unfold? Derives additional information to guide unfolding<br>
15
Types for deciding where to unfold Instance dll(h, p) =
if (h = null) then
true
else
h!prev = p and dll(h!next, h) h : {nexth0i, prevh0i }
p : {nexth-1i, prevh-1i } If it exists, where is:
cur!next ?
p!next ? Checker Definition 0 -1 Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Summary 0 Checker “Run” (call tree/derivation) Says:
For h!next/h!prev, unfold from h
For p!next/p!prev, unfold before h<br>
16
Types make the analysis robust with respect to how checkers are written Instance dll(h, p) =
if (h = null) then
true
else
h!prev = p and dll(h!next, h) h : {nexth0i, prevh0i }
p : {nexth-1i, prevh-1i } Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Checker “Run” Instance dll0(h) =
if (h!next = null) then
true
else
h!next!prev = h and dll0(h!next) Alternative doubly-linked list checker h : {nexth0i, prevh-1i } cur!prev ? -1 Checker “Run” Doubly-linked list checker (as before) Different types for different unfolding<br>
17
Summary of checker parameter types Tell where to unfold for which fields
Make analysis robust with respect to how checkers are written
Learn where in summaries unfolding won’t help Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind Can be inferred automatically with a fixed-point computation on the checker definitions<br>
18
Results: Performance Times negligible for data structure operations (often in sec or 1/10 sec) Expressiveness: Different data structures Verified shape invariant as given by the checker is preserved across the operation. Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind TVLA: 850 ms TVLA: 290 ms<br>
19
Conclusion Key Insight: Checkers as specifications
Developer View: Global, Expressed in a familiar style
Analysis View: Capture developer intent, Not arbitrary inductive definitions
Constructing the program analysis
Intermediate states: Generalized segment predicates
Splitting: Checker parameter types with levels h : {nexth0i, prevh0i} p : {nexth-1i, prevh-1i} Bor-Yuh Evan Chang - Extensible Shape Analysis by Designing with the User in Mind<br>
