1. Relational Inductive Shape Analysis Bor-Yuh Evan Chang University of California, Berkeley Xavier Rival INRIA POPL 2008

2. 2 Example: Removing duplicates cur = l ! next; while (cur != null) { cur = remove_if_dup(cur); cur = cur ! next; } Concrete Example Invariant/Abstraction “sorted dl set” l “sorted dl list” l program-specific predicate l 2244 l 244 cur l 24 “sorted dl list ( v ·² )” l “sorted dl set segment ( ²· v )” cur intermediate state more complicated Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

3. 3 Utilize “dynamic checking code” as specification for static analysis Checking code Checking code expresses a precise invariant of interest (but only at “steady states”) sorteddll(l, prev, min) = if (l = null) then true else l ! prev = prev and min · l ! val and sorteddll(l ! next,l,l ! val) assert(sorteddll(l,null,0)); cur = l; while (cur != null) { cur = remove_if_dup(cur); cur = cur ! next; } assert(sorteddlset(l,null,0)); ll cur l automatically generalize for intermediate states Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

4. 4 Our framework is … Compact abstraction –Data structure-specific based on properties of interest to the developer Extensible –Parametric in developer-supplied checkers shape analysis invariant checkers An automated shape analysis with a precise memory abstraction based around invariant checkers. shape analyzer sorteddll(l, prev, min) = if (l = null) then true else l ! prev = prev and min · l ! val and sorteddll(l ! next,l,l ! val) checkers Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

5. 5 Challenges cur = l ! next; while (cur != null) { cur = remove_if_dup(cur); cur = cur ! next; } “sorted dl list ( v ·² )” l “sorted dl set segment ( ²· v )” cur if (cur ! prev ! val == cur ! val) { cur = cur ! prev;remove_after(cur); } “sorted dl list ( w ·² )” l “sorted dl set segment ( ²· u )” cur vw u < v = wu < v = w “split” segments (back pointers) “split” segments (back pointers) 1 1 numerical constraints (linking shape and data) (see paper) numerical constraints (linking shape and data) (see paper) 2 2 Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

6. 6 Materialization Materialization (partial concretization) To perform strong updates widening And widening for termination Shape analysis is an abstract interpretation on memory states with … cur l l l l l l Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

7. 7 Outline shape analyzer abstract interpretation materialization and update widening type “pre-analysis” sorteddll(l, prev, min) = if (l = null) then true else l ! prev = prev and min · l ! val and sorteddll(l ! next,l,l ! val) checkers 2 2 1 1 see paper Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

8. 8 Abstract memory using inductive predicates cur = l ! next; while (cur != null) { if (cur ! prev ! val == cur ! val) { cur = cur ! prev; remove_after(cur); } cur = cur ! next; } := 9 ´. ¼ dll( ½ ) Ç ¼  null emp ¼  null ¼ next dll( ¼ ) ´ ½ prev dll(l, prev) = if (l = null) then true else l ! prev = prev and dll(l ! next,l) values (e.g., address) values (e.g., address) points-to (memory cell) points-to (memory cell) l ® dll( ± ) dll(null)dll( ¯ ) cur ° ¯ prev next ± prev " segment checker (inductive pred) Edges represent disjoint memory regions Edges represent disjoint memory regions update: cur ! next = cur ! next ! next One traversal parameter with fields traversal parameter One traversal parameter with fields Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

9. 9 Materialize by unfolding inductive definition cur = l ! next; while (cur != null) { if (cur ! prev ! val == cur ! val) { cur = cur ! prev; remove_after(cur); } cur = cur ! next; } := 9 ´. ¼ dll( ½ ) Ç ¼  null emp ¼  null ¼ next dll( ¼ ) ´ ½ prev l ® dll(null)dll( ° ) cur ± materialize: cur ! prev l ® dll(null)dll( ° ) Need fields from ° l ® dll(null)dll( ° ) cur ± Ç Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis Need to unfold “backward”

10. 10 Segments as partial checkers ®.dll(null) ¯.dll( ® ) °.dll( ¯ ) ±.dll( ° ) null.dll( ± ) Checker “Run” Instance Summary c0(¯,°0)c0(¯,°0) c( ®, ° ) …… ……… ®¯ c( ° )c0(°0)c0(°0) i i i i = 0 ii 00 c = c 0 ® = ¯ ° = ° 0 ® = ° ¯ = null null next ° ± prev null Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

11. 11 To unfold backward, split the segment and then unfold forward cur = l ! next; while (cur != null) { if (cur ! prev ! val == cur ! val) { cur = cur ! prev; remove_after(cur); } cur = cur ! next; } := 9 ´. ¼ dll( ½ ) Ç ¼  null emp ¼  null ¼ next dll( ¼ ) ´ ½ prev materialize: cur ! prev ! next l ® dll(null)dll( ° ) cur ° ± prev dll( ± ) next " dll( ± ) next " dll( ± ) next " Ç l, cur ° ± prev ® = ± ° = null ° 0 dll( ¯ ) 1 = unfold Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

12. 12 Outline shape analyzer abstract interpretation materialization and update widening type pre-analysis sorteddll(l, prev, min) = if (l = null) then true else l ! prev = prev and min · l ! val and sorteddll(l ! next,l,l ! val) checkers 2 2 1 1 Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

13. 13 Types for deciding where to unfold ® dll(null) dll( ¯ ) ° ®.dll(null) ¯.dll( ® ) °.dll( ¯ ) ±.dll( ° ) null.dll( ± ) Checker “Run” Instance Summary If it exists, where is: ° ! next ? ¯ ! next ? If it exists, where is: ° ! next ? ¯ ! next ? := 9 ´. ¼ dll( ½ ) Ç ¼  null emp ¼  null ¼ next dll( ¼ ) ´ ½ prev Checker Definition Types help the analysis decide where to unfold Types can be inferred automatically (see paper) Types help the analysis decide where to unfold Types can be inferred automatically (see paper) Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

14. 14 Summary: Given checkers, everything is automatic shape analyzer abstract interpretation materialization and update widening type pre-analysis sorteddll(l, prev, min) = if (l = null) then true else l ! prev = prev and min · l ! val and sorteddll(l ! next,l,l ! val) checkers Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

15. 15 Experiments Benchmark Max. Num. Graphs at a Program Point Max. Num Iterations at a Program Point ms Analysis Time (ms) doubly-linked list reverse131.4 doubly-linked list copy235.3 doubly-linked list insert243.8 doubly-linked list remove546.5 doubly-linked list remove and back546.8 search tree with parent insert558.3 search tree with parent insert and back 5547.0 Verified shape invariant as given by a checker is preserved across the operation. Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

16. 16 Conclusion Inductive checkers can form the basis of an effective memory abstraction and analysis –Easily extensible on a per-program basis To enable materialization anywhere –Segments defined as partial checker runs –Type pre-analysis on checker definitions to decide where to unfold robustly Numerical reasoning via coordination with a base domain (see paper) Bor-Yuh Evan Chang and Xavier Rival - Relational Inductive Shape Analysis

17. What can inductive shape analysis do for you?