1. Dynamic Program Analysis with Partial Execution and Summary Thomas Huining Feng http://www.eecs.berkeley.edu/~tfeng/ CHESS, UC Berkeley May 8, 2007 CS 294-5 Class Project

2. Motivating Example 1 JCute finds 2 4 =16 paths. Overall failure constraint is [failure] (after simplification). Can we reduce the number of paths? public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } if (op3) { System.out.println("Operation 3"); } @Failure("failure") int fail; } op1 op2 op3 fail Parameters are generated by JCute. 2 if (failure) { System.out.println(“FAILURE”); return; } else { return; }

3. Motivating Example 2 JCute never halts. – An unbounded number of paths exist, because i is arbitrary. Can we handle this problem? Yes. Can we handle this problem within 10 runs? Yes. public class B { void f(int i, int j) { for (int k = 0; k < i; k++) { if (i == j) { @Failure(“true”) int fail; } Raise a failing signal when [i == j]. Equivalent to: @Failure(“i == j”) int fail; 3

4. Overview Examples exhibit 2 problems: 1)Exponential paths to explore. 2)Unbounded paths to explore before a loop constraint is found. Assumption: Free of side effect, deterministic Java programs.  To solve problem 1: – For a program with n = n 1 + n 2 + … + n k sequential tests o split the program into k trunks o reduce the complexity to 2 n 1 + 2 n 2 + … + 2 n k (best case) – Let n 1 = n 2 = … = n k = 1 to achieve linear growth.  To solve problem 2: – Partially execute the loop. – Compute a fixpoint of constraints. 4

5. Solving Problem 1 Examples exhibit 2 problems: 1)Exponential paths to explore. 2)Unbounded paths to explore before a loop constraint is found. Assumption: Free of side effect, deterministic Java programs.  To solve problem 1: – For a program with n = n 1 + n 2 + … + n k sequential tests o split the program into k trunks o reduce the complexity to 2 n 1 + 2 n 2 + … + 2 n k (best case) – Let n 1 = n 2 = … = n k = 1 to achieve linear growth.  To solve problem 2: – Partially execute the loop. – Compute a fixpoint of constraints. 5

6. Partition the Program 1 st execution: the last test of the program. 2 branches; 4 paths. Constraint: [op3 && failure || !op3 && failure] ⇔ [failure] public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } if (op3) { System.out.println("Operation 3"); } @Failure("failure") int fail; } public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op3) { System.out.println("Operation 3"); } @Failure("failure") int fail; } Seg. 3 Seg. 2 Seg. 1 6

7. Rewrite the Program public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } if (op3) { System.out.println("Operation 3"); } @Failure("failure") int fail; } public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } @Failure("failure") int fail; } Rewrite 7

8. Segment the Program Again 2 nd execution: the last test of the program. 2 branches; 4 paths. Constraint: [op2 && failure || !op2 && failure] ⇔ [failure] public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } @Failure("failure") int fail; } public class A { void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op2) { System.out.println("Operation 3"); } @Failure("failure") int fail; } Seg. 3 Seg. 2 8

9. Assessment Repeat this process until head of the program is reached. A big gain? 9 op1 op2 op3 fail op3 fail op2 fail op1 fail Total # of paths: 4 + 4 + 4 = 12Total # of paths: 2 4 = 16

10. Assessment 10 Total # of paths: 8*2 + 8*2 = 32 Total # of paths: 8 * 8 * 2 = 128

11. Solving Problem 2 Examples exhibit 2 problems: 1)Exponential paths to explore. 2)Unbounded paths to explore before a loop constraint is found. Assumption: Free of side effect, deterministic Java programs.  To solve problem 1: – For a program with n = n 1 + n 2 + … + n k sequential tests o split the program into k trunks o reduce the complexity to 2 n 1 + 2 n 2 + … + 2 n k (best case) – Let n 1 = n 2 = … = n k = 1 to achieve linear growth.  To solve problem 2: – Partially execute the loop. – Compute a fixpoint of constraints. 11

12. Bounded Loop Execution First, identify the loop. 12 public class B { void f(int i, int j) { for (int k = 0; k < i; k++) { if (i == j) { @Failure(“true”) int fail; } public class B { void f(int i, int j) { int k; k = 0; l1: if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; goto l1; }

13. Bounded Loop Execution Assume that the loop exits in n = 3 iterations. Partition the program into 4 segments. 13 public class B { void f(int i, int j) { int k; k = 0; l1: if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; goto l1; } k<i i==j k<i i==j k<i i==j … k<i … NY NY i==j k<i i==j k<i i==j NY NY Seg. 1 Seg. 2 Seg. 3 Seg. 4

14. Run the tree from the tail. Repeat computing the failure constraint. Test for fixpoint. Reduce the loop into a simple branch. Bounded Loop Execution 14 k<i i==j k<i i==j k<i i==j NY NY Test 1: C1 k<i i==j k<i i==j C1 NY NY Test 2: C2 Test 3: C3 k<i i==j C2 NY NY C3 NY

15. Bounded Loop Execution 1 st execution: 3 paths. Constraint: [k <= i-1 && i == j] 15 public class B { void f(int i, int j) { int k; k = 0; l1: if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; goto l1; } Seg public class B { void f(int i, int j) { int k = JCute.input.Integer(); if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; }

16. Bounded Loop Execution Analyze 1 more iteration. Re-execute: 4 paths. Constraint: [k <= i-1 && i == j] (fixpoint) 16 public class B { void f(int i, int j) { int k; k = 0; l1: if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; goto l1; } Seg public class B { void f(int i, int j) { int k = JCute.input.Integer(); if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; } public class B { void f(int i, int j) { int k = JCute.input.Integer(); if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; @Failure(“k <= i-1 && i == j”) int fail; }

17. Bounded Loop Execution Substitute the whole loop with the fixpoint constraint. Execute the program: 3 paths. Constraint: [i >= 1 && i == j] Total # of paths: 3 + 4 + 3 = 10 17 public class B { void f(int i, int j) { int k; k = 0; l1: if (k < i) { if (i == j) { @Failure(“true”) int fail; } k++; goto l1; } Seg public class B { void f(int i, int j) { int k; k = 0; @Failure(“k <= i-1 && i == j”) int fail; }

18. Demo: Eclipse Plugin 18

19. Conclusion: Advantage and Drawback Advantages: 1)Greatly reduce the number of paths in some cases. 2)Derive constraints for unbounded loops. Limitations 1)Need transformation and compilation every time you want to simplify the program with the newly derived constraints. 2)Advantage 1 is lost if constraints are not (cannot be) simplified. 19 void f(boolean op1, boolean op2, boolean op3, boolean failure) { if (op1) { System.out.println("Operation 1"); } if (op2) { System.out.println("Operation 2"); } if (op3) { System.out.println("Operation 3"); } @Failure("failure“) int fail; } [op3 && failure || !op3 && failure] (4 paths) [op2 && op3 && failure || op2 && !op3 && failure || !op2 && op3 && failure || !op2 && !op3 && failure] (8 paths) [op1 && op2 && op3 && failure || op1 && op2 && !op3 && failure ||...] (16 paths)