Software Analysis (POPA Sec , 2.5.4, 2.5.6)

Transcription

1 Software Analysis (POPA Sec , 2.5.4, 2.5.6) Klaus Ostermann Based on slides by Jurriaan Hage

2 Towards embellished monotone frameworks From monotone framework to embellished monotone framework. We proceed by example. Define a monotone framework for Detection Of Signs Analysis. Specify the form of transfer functions for calls, entries, exits and returns. Change it to include context so that data flows along balanced paths, by lifting the original transfer functions so that they include context, and making sure that procedure call and return imply a context change. Context can be anything, but we restrict ourselves later so that context helps us finitely approximate the balanced paths of VP.

3 Detection of Sign Analysis example Let (L, F, F, E, ι, λl.f l ) be an instance of a monotone framework for Detection of Sign Analysis (Exercise 2.15) Detection of Signs gives for each program point what signs each variable may have at that program point. In this case the complete lattice L consists of sets of functions More precisely: elements of P(Var S) with S = {, 0, +} Each function describes a set of executions leading to a certain program point. Example: {g, h} L with g(x) = g(y) = +, and h(x) = + and h(y) = In other words, there are executions where x and y are both positive and there are executions where x is positive and y is negative.

4 Detection of Sign Analysis example Let Var = {x, y}, g(x) = g(y) = +, and h(x) = + and h(y) =. Consider [x := x+y] l. The effect of the assignment on g results in g which maps x and y to + (so g = g ) on h is to map y to, but x to, 0 or + The effect on h is modelled by functions h, h 0 and h + : all map y to and h i (x) = i. The set {g, h} is thus mapped to {g, h, h 0, h + }.

5 Relational or independent Recall: the set {g, h} was mapped to {g, h, h 0, h + }. Relational vs. the independent attributes of Exercise 2.14: merge the functions to a set of signs for each variable: x has signs {0,, +} and y has {+, } If all we know is that x has signs {0,, +} and y has {+, }, then the combinations [x, y +] and [x 0, y +] are also possible. The independent attribute analysis is weaker, since it stores less detail, but is also less resource consuming.

6 Detection of Sign Analysis continued A s : AExp (Var S) P(S) gives all possible signs of an expression, when given a sign for each variable. A s Jx+yK[x +, y +] = {+} A s Jx+yK[x +, y ] = {0, +, } Transfer function for [x := a] l maps sets of functions to sets of functions: f l (Y ) = {φ l (σ) σ Y } where Y L and φ l (σ) = {σ[x s] s A s JaK(σ)} Functions may split up : φ l ([x +, y ]) = {[x, y ], [x 0, y ], [x +, y ]}. Finally f l (Y ) collects all possible resulting mappings together: {[x +, y +], [x, y ], [x 0, y ], [x +, y ]}

7 Adding context to the lattice Add context to get an embellished monotone framework ( L, F, F, E, ι, λl. f l ) We may have a different analysis result for each different context value. Mathematically: instead of the complete lattice L we shall deal with L: functions from contexts to the lattice L = P(Var S). Omit context by taking a one element set. By Total Function Space construction (page 398) L is a complete lattice. In the book they use P( (Var S)) = P(Var S). We don t.

8 Adding context is not a (very) big deal L can also be used directly as L in a monotone framework but transfer functions for call/return may now be binary and embellished monotone frameworks do form a good abstraction for building interprocedural analyses. Lots can be reused directly from the monotone framework instance. Storing analysis results for each program point is similar to adding context. The context is then the position in the program. And distinguishing the ith iteration from the (i+1)st in a while loop.

9 Lifting the transfer functions Recall: a transfer function f l maps values in L to L Lift the transfer function for assignment in sign detection to L = L We obtain after lifting f l : ( L) ( L) Essentially, we apply the old transfer function pointwise In other words, independently for each value in. Example: f l ([δ 1 {g}, δ 2 {h, g}]) = [δ 1 f l ({g}), δ 2 f l ({g, h})] = [δ 1 {g}, δ 2 {h 0, h, h +, g}]. In general, the context selects the analysis value to be transferred: f l ( l)(δ) = f l ( l(δ)) (or alternatively f l ( l) = λδ f l ( l(δ)) = f l l)

10 Data flow in the new set-up Information flows along dataflow graph edges, similar to earlier: A ctx (l) = {A efct (l ) (l, l) F (l ; l) F } ι l E For procedure entry labels, we take the join over all A efct that call the procedure. We can distinguish between calls by using context (see later). A efct (l) = f l (A ctx (l)) (except for labels of procedure calls/return) The transfers for procedure execution are handled differently: we do nothing at procedure entry we do nothing at procedure exit everything special is done during procedure call and return The main difference is that in the case of procedure return (forward analysis) we can use information from before the call and information from the call itself.

11 Form of transfer functions for procedure call Assume we have (l c, l n, l x, l r ) inter-flow(s ) Then A efct (l c ) = f l 1 c (A ctx (l c )) transfers information into the procedure. The entry label joins the values for each different call Because values for different calls may be associated with different context values, these need not interfere. Recall that our lattice is L = L and the functions f l 1 thus have type ( L) ( L) All the lifted transfer functions do not change context, but the transfer functions for call and return do (examples follow). The call transfer changes context to reflect the fact that a call was made from l.

12 Form of transfer functions for procedure return Procedure return is a bit more complicated: A efct (l r ) = f l 2 c,l r (A ctx (l c ), A ctx (l r )) Transfers information from inside the procedure to just after the call, but also includes information from before the call. Advantage: information that holds for the calling scope only, does not need to ride along during analysis of the function call. Of course, f l 2 c,l r can always choose to ignore one of its arguments. The transfer function for return undoes the context change made at the call transfer. Mimicks valid paths if we choose context to be an (abstraction of) the call stack For a backward analysis, the transfer functions change arity: the one for call is binary, the one for return, unary.

13 What about procedure entry and exit? Transfer functions for l n and l x are the identity in the book, but need not be. Things done uniformly for each call to a function could be moved to procedure entry. And similar for return and exit The context value (Analysis ctx ) for entry joins the values over all incoming calls. These different incoming values can be kept apart if we make sure they arise for different context values. Example: choose context to be the set of program (call) labels. Analysis values are functions from call label to L.

14 Call strings as context Take = [Lab ]. Call string: list of return addresses as they occur on the call stack. For fibonacci: Λ, [4], [6], [9], [4, 4],..., [9, 9], [4, 4, 4],... Some of these may never occur; generate only when needed. Procedure call labels are added to the front (stack like). For (l c, l n, l x, l r ) we define f 1 l c ( l)(l c :δ) = f 1 l c ( l(δ)) and f 1 lc ( l)(λ) = The context value selects the input to pass into the ordinary transfer function. Justification: related values belong to the same execution. The balanced executions paths (of VP) are thus simulated by performing data flow only between corresponding call strings

15 Call strings example snapshot pointwise join [ ] [1] [4] [1, 1] [4, 1] A ctx (3) f1 1 (ι) f 4 (V )... proc p(..,..) is 3 A ctx (4) [call p(..,..)] 4.. A efct (4) end 8 [call p(..,..)] 1.. V f 4 (V )... A ctx (1) ι... f1 1 (ι)... A efct (1)

16 Call strings as context, return Similarly, for procedure return: f l 2 c,l r ( l, l )(δ) = fl 2 c,l r ( l(δ), l (l c :δ)) We use two values: from before the call, which is under the same context as the return, from inside the procedure, which is under the extended call string.

17 Detection of Signs: procedure calls Assume [call p(a,x)] lc l r and proc p(val x, res y) is ln S end lx The effect of a call is to do two assignments x := a and y :=? so the transfer function (without context) mimicks those For σ = [x +, z ] and a = -x we ought to obtain φ lc (σ) = {[x, y, z ], [x, y 0, z ], [x, y +, z ]} f lc (Z) = {φ lc (σ) σ Z} and φ lc (σ) = {σ[x s][y s ] s A s J-xK(σ) s {0, +, }} Alternative: set y to 0 so that s = 0

18 Detection of Signs: adding context Given is the function Z = [Λ σ 1, δ 2 σ 2,...] from L = L We want to obtain [Λ, [l c ] f 1 l c (σ 1 ), (l c :δ 2 ) f 1 l c (σ 2 ),...] So f 1 l c (Z) is such that for all δ f 1 l c (Z)(δ ) = { if δ = Λ fl 1 c (Z(δ)) if δ = l c :δ Warning: in the book they give the same general formula, but the example of Detection of Signs (2.38) uses different, less functional, notation.

19 Call strings of bounded size L might have ACC, but L might not Call strings can be arbitrarily long for recursive programs Enforce termination by restricting to call strings of length k Every program point may have an analysis result for each of the possible call strings of length k If k = 2 and we call from 4 either with context [4, 9], [4, 4] or [4], then the context in the call will be [4, 4]. To stay sound we must join the transferred analysis results. Here we might lose precision. In a formula f 1 l c (Z)([4, 4]) = f 1 l c (Z([4, 9])) f 1 l c (Z([4, 4])) f 1 l c (Z([4])) We can choose the level of detail (value of k) with a known price to pay. Take k = 0 to omit context: then equals {Λ}

20 k = 2 bounded call strings, snapshot pointwise join [ ] [1] [4] [1, 1] [4, 1] [1, 4] [4, 4] A ctx (3) f1 1 (ι) Y proc p(..,..) is 3 A ctx (4) V X... W... [call p(..,..)] 4.. A efct (4) Y end 8 Y = f 4 (V ) f 4 (X ) f 4 (W ) [call p(..,..)] 1.. f 1 1 (ι) A efct (1)

21 Separate the context from the transfer Context is never used to compute the transfer, it only tells you which part of the value to use (and update). For different analyses you can use the same kind of context and context change In an implementation: decouple cross-over from transfer The former selects which values influence a given value. The latter says how.

22 Flow-sensitive versus flow-insensitive Flow-sensitive vs. flow-insensitive: does the result of the analysis depend on the order of statements? Again a matter of cost vs. precision. Flow-insensitive analysis: determine for each procedure p, what is the set of global variables which may directly or indirectly be assigned during execution of p. In a flow-sensitive analysis, program points are a form of context. In this book, this form of context is hard-coded into the framework.

23 Final remarks about procedures Context can be anything you want. Context change is restricted to call and return (but need not be). Use context only when more precision is needed. Use the amount of context to obtain a balance between cost and precision. Restrict context to finite sets of values: call strings of length k. The general model allows simpler versions forgetting information from before the call, or ignoring context altogether. Detection of Signs Analysis shows how a monotone framework for While can be adapted to deal with procedures.