Download presentation

Presentation is loading. Please wait.

Published byFaith Douglas Modified over 3 years ago

1
Join Algorithms for the Theory of Uninterpreted Functions Sumit Gulwani Ashish Tiwari George Necula UC-Berkeley SRI UC-Berkeley

2
1 Definition: Join in theory T E = Join T (E 1,E 2 ) iff 1.E 1 ) T E and E 2 ) T E 2.If (E 1 ) T g) and (E 2 ) T g), then E ) T g E 1, E 2, E: conjunction of ground facts in theory T g: ground fact in theory T E is the strongest conjunction of ground facts that is implied by both E 1 and E 2 in theory T

3
2 Example of Joins LE: Linear Arithmetic with Equality Join LE (x=1 Æ y=4, x=3 Æ y=2) = x+y=5 LI: Linear Arithmetic with Inequalities Join LI (x=1 Æ y=4, x=3 Æ y=2) = x+y=5 Æ 1 · x · 3 UF: Uninterpreted Functions Join UF (x=a Æ y=F(a), x=b Æ y=F(b)) = y=F(x)

4
3 Motivation: Program Analysis using Abstract Interpretation x := a; y := F(a); x := b; y := F(x); u := F(x); v := y; assert (u=v); assert (v=F(a)); u := F(a); v := F(a); True False Disadvantages of using decision procedure: Exponential # of paths Loop invariants required Cannot discover invariants Abstract Interpretation avoids these problems Join Algorithm required to merge facts at join points True * *

5
4 Join for Uninterpreted Functions is not easy Join(F(a)=a Æ F(b)=b Æ G(a)=G(b), a=b) = GF i (a)=GF i (b) The result of join is not finitely representable using standard data-structures like EDAGs

6
5 Relatively Complete Join: Definition Recall, Join(E 1,E 2 ): strongest conjunction of ground facts g s.t. E 1 ) T g and E 2 ) T g RCJoin(E 1,E 2,K): strongest conjunction of ground facts g s.t. E 1 ) T g and E 2 ) T g and Terms(g) 2 K Example E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } RCJoin(E 1,E 2,K): GF(a) = GF(b)

7
6 Relatively Complete Join: Algorithm RCJoin(E 1,E 2,K): 1.Let D 1 =EDAG(E 1 ) and D 2 =EDAG(E 2 ) 2.Extend D 1 and D 2 to represent K 3.Congruence close D 1 and D 2 4.Let D=product construction of D 1 and D 2 Output D

8
7 Step 1: Constructing EDAGs F a GG b F Nodes represent terms Dotted edges represent equalities E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) ab

9
8 Step 2: Extending EDAGs F a GG b F ab F GG F Add extra nodes to EDAGs s.t. terms in K are represented E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 )

10
9 Step 3: Congruence Closure F a GG b F ab F GG F F(n) = F(m) if n=m E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 )

11
10 Step 4: Product Construction (Intuition) F a GG b F ab F GG F 3030 4 1 3 2 65 2020 1010 4040 5050 6060 E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) C1: {a, Fa, F 2 (a), …} C4: {b, Fb, F 2 (b), …} C6: {G(a), GF(a), … G(b), GF(b), …} C1 0 : {a, b} C2 0 : {F(a), F(b)} C3 0 : {GF(a), GF(b)} C6 Å C3 0 : { GF(a), GF(b)}

12
11 Step 4: Product Construction (Algorithm) F a GG b F ab F GG F 3030 4 1 3 2 65 2020 1010 4040 5050 6060 [n,m] 2 D if n:v Æ m:v, or n:F(n 1 ) Æ m:F(m 1 ) Æ [n 1,m 1 ] 2 D [n 1,m 1 ] = [n 2,m 2 ] if n 1 =n 2 and m 1 =m 2 ab F GG F [1,1 0 ] [2,2 0 ] [3,3 0 ] [6,6 0 ] [5,5 0 ] [4,4 0 ] E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) D

13
12 Future Work: Join Algorithm for other theories For example, theory of commutative functions (CF) –Useful in modeling floating point operations –More challenging than uninterpreted functions (UF) E 1 : x=a Æ y=b E 2 : x=b Æ y=a Join UF (E 1,E 2 ) = true Join CF (E 1,E 2 ) = F(C[a],C[b]) = F(C[b], C[a])

14
13 Future Work: Combining Join Algorithms For example, theory of linear arithmetic and uninterpreted functions (LA+UF) E 1 : x=a Æ y=b E 2 : x=b Æ y=a Join UF (E 1,E 2 ) = true Join LA (E 1,E 2 ) = x+y=a+b Join LA+UF (E 1,E 2 ) = F(x+c)+F(y+c) = F(a+c)+F(b+c) Æ.….

15
14 Future Work: Context-sensitive Join Algorithms Join(E 1,E 2 ) Æ E = Join(E 1 Æ E, E 2 Æ E) Useful in interprocedural analysis This is a representation issue. –Representing result of join using conjunction of ground facts is not context-sensitive. E 1 : x=a Æ y=F(a) E 2 : x=b Æ y=F(b) Join UF (E 1,E 2 ) Æ a=b = y=F(x) Æ a=b Join UF (E 1 Æ a=b,E 2 Æ a=b) = y=F(x) Æ x=a=b

16
15 Conclusion Join Algorithms are useful in program analysis. They are generalization of decision procedure. Join T (E, g) = g iff E ) T g E: conjunction of ground facts in theory T g: ground fact in theory T We showed a relatively complete join algorithm for uninterpreted functions. Join algorithms open up several interesting problems.

Similar presentations

OK

Combining Abstract Interpreters Sumit Gulwani Microsoft Research Redmond, Group Ashish Tiwari SRI RADRAD.

Combining Abstract Interpreters Sumit Gulwani Microsoft Research Redmond, Group Ashish Tiwari SRI RADRAD.

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google