1. Static Analysis of Software Product Lines Jan Midtgaard Andrzej Wąsowski Claus Brabrand Paulo Borba Mira MeziniEric Bodden Márcio RibeiroTársis Tolêdo [ DFA-4-SPL ] ( AOSD 2012 ) [ SPL LIFT ] ( PLDI 2013 ) [ Var-Abs-Int ] (in progress..)

2. [ 2 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Introduction: Software Product Lines (SPL) Dataflow Analysis (DFA) DFA-4-SPL: A0 (brute force) (feature in-sensitive) A1 (consecutive) A2 (simultaneous) A3 (shared simultaneous) SPL LIFT (graph encoding) Evaluation and Results Sketch of Work in Progress: "Var-Abs-Int" (feature sensitive)

3. [ 3 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Introduction Traditional Software Development: One program = One product Product Line: A ”family” of products (of N ”similar” products): customize SPL: (Family of Programs)

4. [ 4 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Software Product Line SPL: Feature Model: (e.g.: ψ FM ≡ VIDEO  COLOR ) Family of Programs: COLOR VIDEO COLOR  VIDEO VIDEO Ø { Video } { Color, Video } Configurations: Ø, {Color}, {Video}, {Color,Video} VALID { Color } customize 2F2F Set of Features: F = { COLOR, VIDEO } 2F2F

5. [ 5 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Software Product Line SPLs based on Conditional Compilation: #ifdef (  )... #endif Logo logo;... logo.use(); #ifdef (VIDEO) logo = new Logo(); #endif Example (SPL fragment) *** null-pointer exception! in configurations: {Ø, {COLOR}}  : f  F |  | 

6. [ 6 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting result 0100101 1110110 1010011 1110111 0100101 1110110 1010011 1110111 Analysis of SPLs The Compilation Process:...and for Software Product Lines: 0100101 1110110 1010011 1110111 result compile run ERROR! generate 0100101 1110110 1010011 1110111 result run ERROR! ANALYZE! Feature-sensitive data-flow analysis ! run compile ANALYZE! ERROR! 2F2F

7. [ 7 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Dataflow Analysis Dataflow Analysis: 1) Control-flow graph 2) Lattice (finite height) 3) Transfer functions (monotone) L Example: "sign-of-x analysis"

8. [ 8 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Analyzing a Program 1) Program 2) Build CFG 3) Make Equations 4) Solve equations: fixed-point computation (iteration) 5) SOLUTION (least fixed point): Annotated with program points

9. [ 9 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Introduction: Software Product Lines (SPL) Dataflow Analysis (DFA) DFA-4-SPL: A0 (brute force) (feature in-sensitive) A1 (consecutive) A2 (simultaneous) A3 (shared simultaneous) SPL LIFT (graph encoding) Evaluation and Results Sketch of Work in Progress: "Var-Abs-Int" (feature sensitive)

10. Dataflow Analysis for Software Product Lines DFA-4-SPL Claus Brabrand IT University of Copenhagen Universidade Federal de Pernambuco [ brabrand@itu.dk ] Márcio Ribeiro Universidade Federal de Alagoas Universidade Federal de Pernambuco [ mmr3@cin.ufpe.br ] Paulo Borba Universidade Federal de Pernambuco [ phmb@cin.ufpe.br ] Társis Toledo Universidade Federal de Pernambuco [ twt@cin.ufpe.br ] AOSD 2012 and TAOSD 2013 "Intraprocedural Dataflow Analysis for Software Product Lines"

11. [ 11 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting A0 A0 (brute force): void m() { int x=0; ifdef(A) x++; ifdef(B) x--; } c = {A}:c = {B}:c = {A,B}: int x = 0; x++; x--;int x = 0; x++; x--;int x = 0; x++; x--; 0 _ | + 0 _ | - 0 _ | 0/+ + ψ FM = A ∨ B L feature in-sensitive! N = O (2 F ) compilations!

12. [ 12 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting int x = 0; x++; x--; A: B: int x = 0; x++; x--; A: B: int x = 0; x++; x--; A: B: A1 A1 (consecutive): void m() { int x=0; ifdef(A) x++; ifdef(B) x--; } c = {A}: 0 _ | + ✗ ✓ ✓ ψ FM = A ∨ B L c = {B}:c = {A,B}: 0 _ | - 0 _ | 0/+ + ✗ ✓✓ ✓ ✓ ✓ + 0 feature sensitive! N = O (2 F ) fixp iterations!

13. [ 13 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting x++; + ({A} =, {B} =, {A,B} = ) A2 A2 (simultaneous): void m() { int x=0; ifdef(A) x++; ifdef(B) x--; } ∀ c ∈ {{A},{B},{A,B}}: int x = 0;x--; 0 _ | 0 _ | - 0 _ | 0/+ + A: B: ✓ ({A} =, {B} =, {A,B} = ) ✓✓ ✓✓ ✓✓ ✗ ✗ ψ FM = A ∨ B L 0 + feature sensitive! LL ×× {A} {B} {A,B} L =

14. [ 14 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting x--; + x++; 0 ( [[ψ ∧ ¬A ]] =, [[ψ ∧ A ]] =, [[ψ ∧ ¬A ]] =, [[ψ ∧ A ]] = ) ( [[ψ ]] =, [[ψ ]] = ) A3 A3 (shared sim.): void m() { int x=0; ifdef(A) x++; ifdef(B) x--; } ψ FM = A ∨ B: int x = 0; A: B: _ | ( [[ψ]] = ) 0 (A ∨ B) ∧ ¬A ∧ ¬B ≡ false can use BDD representation ! (compact+efficient) - 0/+ i.e., invalid given wrt. the feature model, ψ ! ψ FM = A ∨ B 0 ∧ ¬A ∧A∧A + ∧ ¬B ∧B∧B ∧B∧B feature sensitive! LLL ×× {A} {B} {A,B} L =

15. Statically Analyzing Software Product Lines in Minutes instead of Years SPL LIFT PLDI 2013 Eric Bodden Technische Universität Darmstadt [ bodden@acm.org ] Társis Tolêdo Universidade Federal de Pernambuco [ twt@cin.ufpe.br ] Márcio Ribeiro Universidade Federal de Alagoas [ mmr3@cin.ufpe.br ] Mira Mezini Technische Universität Darmstadt [ mira.mezini@cased.de] Claus Brabrand IT University of Copenhagen [ brabrand@itu.dk ] Paulo Borba Universidade Federal de Pernambuco [ phmb@cin.ufpe.br ] "Statically Analyzing Software Product Lines in Minutes instead of Years"

16. [ 16 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting true [ (A ∧ B) ∧ ¬A] ∨ [ true ∧ A] = A true A∧BA∧B true ∧ ¬A = ¬A true SPL LIFT IFDS:A0: λS. (S – {x}) ∪ {y} {x} {y} SPL LIFT (IFDS ➞ IDE):A2: ( {A} = {x}, {B} = {x}, {A,B} = {x,y} ) 0 x y 0 x y 0 x y 0 x y λS. (S – {x}) ∪ {y} A:A: #ifdef (A) ( {A} = {y}, {B} = {x}, {A,B} = {y} ) A ¬A LIFT: ■Reps ■Horwitz ■Sagiv fixed-point iteration graph reachability ➔ ¬AA {x} {y} Ø {x,y}

17. [ 17 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Introduction: Software Product Lines (SPL) Dataflow Analysis (DFA) DFA-4-SPL: A0 (brute force) (feature in-sensitive) A1 (consecutive) A2 (simultaneous) A3 (shared simultaneous) SPL LIFT (graph encoding) Evaluation and Results Sketch of Work in Progress: "Var-Abs-Int" (feature sensitive)

18. [ 18 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results Results for SPL LIFT (interprocedural analysis): In fact, analyzing all valid configs is only slightly slower than analyzing one config ! Minutes instead of Years ! :-) Reaching DefinitionsPossible TypesUninitialized Variables SPL benchmark # valid configs A1SPL LIFT A1SPL LIFT A1SPL LIFT Lampiro43m30s42s13s4s3m09s1m25s MM 082624m29s59s2m06s3s27m39s2m13s GPL1,872days8m48s9h03m39s42sdays7m09s Berkeley DB unknown years12m04syears24syears10m18s

19. [ 19 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Introduction: Software Product Lines (SPL) Dataflow Analysis (DFA) DFA-4-SPL: A0 (brute force) (feature in-sensitive) A1 (consecutive) A2 (simultaneous) A3 (shared simultaneous) SPL LIFT (graph encoding) Evaluation and Results Sketch of Work in Progress: "Var-Abs-Int" (feature sensitive)

20. Systematic Derivation of Static Analyses for Software Product Lines Var-Abs-Int Jan Midtgaard Aarhus University [ jmi@cs.au.dk ] Claus Brabrand IT University of Copenhagen [ brabrand@itu.dk ] Andrzej Wąsowski IT University of Copenhagen [ wasowski@itu.dk ] I n p r o g r e s s... "Systematic Derivation of Static Analyses for Software Product Lines"

21. [ 21 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Lifted Var-Abs-Int "Systematic Derivation of Analyses for SPLs":... Lifted SPL

22. Questions ? Thx

23. [ 23 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Abstract Software Product Lines (SPLs) developed using annotative approaches such as conditional compilation come with an inherent risk of constructing erroneous products. For this reason, it is essential to be able to analyze such SPLs. However, as dataflow analysis techniques are not able to deal with SPLs, developers must generate and analyze all valid products individually, which is expensive for non-trivial SPLs. We demonstrate how to take any standard dataflow analysis and automatically turn it into a feature-sensitive dataflow analysis in several qualitatively different ways. All analyses are capable of analyzing all valid products of an SPL without having to generate all of them explicitly.

24. [ 24 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Example SPL config = {G} (¬F ∧ G ∧ ¬H) customize (instantiate) (preprocess) Software Product Line: Conventional Program:

25. [ 25 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Exploded Super Graph...for Program:

26. [ 26 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Lifted Exploded Super Graph...for SPL:

27. [ 27 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting independent options... > Earth's Population (2 33 ) [ C. Kästner ] 33

28. [ 28 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting > Atoms in Universe (2 320 ) [ C. Kästner ] independent options... 320

29. [ 29 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting [ C. Kästner ] 10 000 configurable options...

30. [ 30 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Specification: A1, A2, A3, A4 A1 A2 A3 A4

31. [ 31 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting A1, A2, A3, and A4 A1 A2 A3 A4

32. [ 32 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Intraprocedural Evaluation Four (qualitatively different) SPL benchmarks: Implementation: A1, A2, A3, A4 in SOOT + CIDE Evaluation: total time, analysis time, memory usage

33. [ 33 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Evaluation Five (qualitatively different) SPL benchmarks:

34. [ 34 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results (intra) In practice: 4x (Reaching Definitions) (Total time, incl. compile) 7x 3x 1x ( no re-compile !) Feature sensitive (A1, A2, and A3) all faster than A0

35. [ 35 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Overview A0 (brute force) A1 (consecutive) A2 (simultaneous) A3 (shared) A* (combo) FASTER (intra-procedural) no re-compile! caching! sharing! combo! AOSD 2012 TAOSD 2013

36. [ 36 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Beyond the Sum of all Methods For a method with K valid configurations, which of analyses A1 vs A2 vs A3 is fastest? Statistically significant differences between A1, A2, and A3 for all N, except between A2 and A3 for N=4 (underlined above). K #

37. [ 37 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Combo Analysis Strategy: A * Intraprocedurally combined analysis strategy, A*: A* consistently fastest ( combo !)

38. [ 38 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Overview (cont'd) A0 (brute force) A1 (consecutive) A2 (simultaneous) A3 (shared) A* (combo) SPL LIFT FASTER (intra-procedural) PLDI 2013 IFDS (graph repr) A3+BDD (esp. inter- procedural) no re-compile! caching! sharing! combo! graph encoding! repr! AOSD 2012 TAOSD 2013

39. [ 39 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results (total time) In theory: In practice: 6x 8x 14x 3x 5x 3x 1x 2x 2½x 2x A2 (3x), A3 (4x), A4 (5x) Feature sensitive (avg. gain factor): (Reaching Definitions) 2F2F 2F2F 2F2F

40. [ 40 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results (analysis time) In theory: In practice: T IME ( A 4 ) : Depends on degree of sharing in SPL ! ( caching !) (Reaching Definitions) A3 (1.5x) faster On average (A2 vs A3): A2 A3 vs 2F2F

41. [ 41 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results (memory usage) In theory: In practice: (Reaching Definitions) 6.3 : 1 Average 2F2F A2 A3 vs S PACE ( A 4 ) : Depends on degree of sharing in SPL !

42. [ 42 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Related Work (DFA) Path-sensitive DFA: Idea of “conditionally executed statements” Compute different analysis info along different paths (~ A2, A3, A4) to improve precision or to optimize “hot paths” Predicated DFA: Guard lattice values by propositional logic predicates (~ A4), yielding “optimistic dataflow values” that are kept distinct during analysis (~ A3 and A4) “Constant Propagation with Conditional Branches” ( Wegman and Zadeck ) TOPLAS 1991 “Predicated Array Data-Flow Analysis for Run-time Parallelization” ( Moon, Hall, and Murphy ) ICS 1998 Our work: Automatically lift any DFA to SPLs (with ψ FM ) ⇒ feature-sensitive analysis for analyzing entire program family

43. [ 43 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Related Work (Lifting for SPLs) Model Checking: Type Checking: Parsing: Testing: Model Checking Lots of Systems: Efficient Verification of Temporal Properties in Software Product Lines” ( Classen, Heymans, Schobbens, Legay, and Raskin ) ICSE 2010 Model checks all SPLs at the same time (3.5x faster) than one by one! (similar goal, diff techniques) Type checking ↔ DFA (similar goal, diff techniques) Our: auto lift any DFA (uninit vars, null pointers,...) “Type Safety for Feature-Oriented Product Lines” ( Apel, Kastner, Grösslinger, and Lengauer ) ASE 2010 “Type-Checking Software Product Lines - A Formal Approach” ( Kastner and Apel ) ASE 2008 “Variability-Aware Parsing in the Presence of Lexical Macros & C.C.” ( Kastner, Giarrusso, Rendel, Erdweg, Ostermann, and Berger ) OOPSLA 2011 “Reducing Combinatorics in Testing Product Lines” ( Hwan, Kim, Batory, and Khurshid ) AOSD 2011 Select relevant feature combinations for a given test case Uses (hardwired) DFA (w/o FM) to compute reachability (similar techniques, diff goal): Split and merging parsing (~A4) and also uses instrumentation

44. [ 44 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Emerging Interfaces

45. [ 45 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Emerging Interfaces "A Tool for Improving Maintainability of Preprocessor-based Product Lines" ( Márcio Ribeiro, Társis Tolêdo, Paulo Borba, Claus Brabrand ) *** Best Tool Award *** CBSoft 2011:

46. [ 46 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Results (analysis time) In theory: In practice: T IME ( A 4 ) : Depends on degree of sharing in SPL ! Nx1 ≠ 1xN ?! ( caching !) (Reaching Definitions) A3 (1.5x) faster On average (A2 vs A3): A2 A3 vs 2F2F 2F2F

47. [ 47 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting A2 vs A3 (caching) Cache misses in A2 vs A3: Normal cache: As expected, A2 incurs more cache misses ( ⇒ slower!) Full/no cache*: As hypothesized, this indeed affects A2 more than A3 i.e., A3 has better cache properties than A2 *) we flush the L2 cache, by traversing an 8MB “bogus array” to invalidate cache! A2 A3 vs

48. [ 48 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting IFDEF normalization Refactor "undisciplined" (lexical) ifdefs into "disciplined" (syntactic) ifdefs: Normalize "ifdef"s (by transformation):

49. [ 49 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Example Bug from Lampiro Lampiro SPL (IM client for XMPP protocol): *** uninitialized variable "logo" (if feature " GLIDER " is defined) Similar problems with: undeclared variables, unused variables, null pointers,...

50. [ 50 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting BDD (Binary Decision Diagram) Compact and efficient representation for boolean functions (aka., set of set of names) FAST: negation, conjunction, disjunction, equality !  =  F(A,B,C) =F(A,B,C) = A  (B  C)   A C minimized BDD B    A BB CCCC BDD

51. [ 51 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Formula ~ Set of Configurations Definitions (given F, set of feature names): f  F feature name c  2 F configuration ( set of feature names ) c  F X  2 2 set of config's ( set of set of feature names ) X  2 F Example ifdef s: F [[ B  A ]] [[ A  (B  C) ]] F = {A,B} F = {A,B,C} = { {A}, {B}, {A,B} } = { {A,B}, {A,C}, {A,B,C} }

52. [ 52 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Feature Model (Example) Feature Model: Feature set: Formula: Set of configurations:  FM  Car  Engine  (1.0  1.4)  Air  1.4 { { Car, Engine, 1.0 }, { Car, Engine, 1.4 }, { Car, Engine, 1.4, Air } } F = {Car, Engine, 1.0, 1.4, Air} Note: | [[  FM ]] | = 3 < 32 = |2 F | [[ ]] = Engine 1.0 Air 1.4

53. [ 53 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Conditional Compilation The ' ifdef ' construction: Syntactic variant of lexical #ifdef Propositional Logic: where f  F (finite set of feature names) Example: STM : 'ifdef' '('  ')' STM  : f  F |  |  status.print("you die"); ifdef (DeluxeVersion && ColorDisplay) { player.redraw(Color.red); Audio.play("crash.wav"); } lives = lives - 1; A ifdef (A) {... }

54. [ 54 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Lexical #ifdef  Syntactic ifdef Simple transformation: We do not handle non-syntactic '#ifdef's: Fair assumption (also in CIDE) Nested ifdef's also give rise to a conj. of formulas

55. [ 55 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting CASE 1: "COPY" A4: Lazy Splitting (using BDDs) CASE 2: "APPLY"CASE 3: "SPLIT"  : S [  = l,... ] l ' = f S ( l )      : S [  = l,... ] [  = l ',... ] l ' = f S ( l )  : S [  = l,... ] [  = l,  = l',...] l ' = f S ( l )   = Ø  =  Ø    

56. [ 56 ] "Static Analysis of Software Product Lines" Aug 9, 2013 MT Lab Meeting Var-Abs-Int