Finding Optimum Abstractions in Parametric Dataflow Analysis Xin Zhang Georgia Tech Mayur Naik Georgia Tech Hongseok Yang University of Oxford

A Key Challenge for Static Analysis Precision Scalability

Our setting Query q Program p Static Analysis S p ` qp 0 q Abstraction a assert(x != null)

p a1 S q1 p ` q1 ? q2 S p ` q2 ? a2 Our setting

q2 p S p ` q2 ? S q1 p ` q1 ? Our setting

q2 p S p ` q2 ? S q1 p ` q1 ? Example 1: Predicate Abstraction Predicates to use in predicate abstraction Predicates to use as abstraction predicates

q2 p S p ` q2 ? S q1 p ` q1 ? Example 2: Cloning­ ‐ based Pointer Analysis Predicates to use in predicate abstraction K value to use for each call and each allocation site

Problem Statement An efficient algorithm with: INPUTS: – program p and property q – abstractions A = { a 1, …, a n } – boolean function S(p, q, a) OUTPUT: – Proof: a 2 A: S(p, q, a) = true 8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a – a 2 A: S(p, q, a) = true Optimum Abstraction q p S p ` q ? a

Problem Statement An efficient algorithm with: INPUTS: – program p and property q – abstractions A = { a 1, …, a n } – boolean function S(p, q, a) OUTPUT: – Proof: a 2 A: S(p, q, a) = true 8 a’ 2 A: (a’ · a Æ S(p, q, a’) = true) ) a’ = a – a 2 A: S(p, q, a) = true Optimum Abstraction S(p, q, a) !S(p, q, a) 1111 most expensive 0000 least expensive 0110 optimum A

Example: Typestate Analysis x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); opened closed error open() close() open() Type-state set ts

Example: Typestate Analysis x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); Must-alias accesspath set ms Strong update Weak update Failed

Example: Typestate Analysis x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); QueryAbstraction assert1 assert2none QueryAbstractionOur Goal assert1 assert2noneimpossibility

x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); Example: Typestate Analysis QueryAbstraction assert1 assert2 Naïve approach: calculating weakest precondition (WP) {} Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Naïve approach: calculating weakest precondition (WP) {} Failed Exponential Blowup! unreachable x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened);

Example: Typestate Analysis Too large? Let’s ignore part of it!

Example: Typestate Analysis Unreachable

Example: Typestate Analysis Intersect with the forward state

Example: Typestate Analysis Keep as many disjuncts as possible Intersect with forward state

x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis x = new File; ↓ y = x; ↓ z = x; ↓ x.open(); ↓ y.close(); ↓ assert1(x, closed); Our approach: WP + Underapproximation Proof! QueryAbstraction assert1 assert2

Example: Typestate Analysis x = new File; y = x; z = x; x.open(); y.close(); assert1(x, closed); assert2(x, opened); QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed

Example: Typestate Analysis QueryAbstraction assert1 assert2 Our approach: WP + Underapproximation Failed Impossibility! In paper: a general framework for parametric dataflow analysis

Experiment Implementation in Chord for Java programs 2 Client Analyses: Typestate and Thread-Escape Both fully context- and flow-sensitive analyses Only scale with sparse parameters 7 Java Benchmarks

Benchmarks namebytecode(KB)KLOClog|A| thread-escapetypestate tsp ,175 elevator ,180 hedc ,4007,326 weblech ,9937,663 antlr ,5637,748 avrora ,79710,151 lusearch ,5087,395

Precision: Thread-Escape Analysis (Total # Queries) Resolved: ~90% Previous: ~40% [POPL12]

Precision: Typestate Analysis (Total # Queries)

Scalability: Number of iterations

Scalability: Running time

Size of optimal abstractions

Related work Modern pointer analysis Demand-driven, query-driven, … Heintze & Tardieu ’01, Guyer & Lin ’03, Sridharan & Bodik ’06,... CEGAR model checkers: SLAM, BLAST, YOGI, … Work on concrete counterexamples Can disprove queries 1.No optimality guarantee – can over-refine and hurt scalability. 2.No impossibility - can cause divergence.

Thank you!