1. Join Algorithms for the Theory of Uninterpreted Functions Sumit Gulwani Ashish Tiwari George Necula UC-Berkeley SRI UC-Berkeley

2. 1 Definition: Join in theory T E = Join T (E 1,E 2 ) iff 1.E 1 ) T E and E 2 ) T E 2.If (E 1 ) T g) and (E 2 ) T g), then E ) T g E 1, E 2, E: conjunction of ground facts in theory T g: ground fact in theory T E is the strongest conjunction of ground facts that is implied by both E 1 and E 2 in theory T

3. 2 Example of Joins LE: Linear Arithmetic with Equality Join LE (x=1 Æ y=4, x=3 Æ y=2) = x+y=5 LI: Linear Arithmetic with Inequalities Join LI (x=1 Æ y=4, x=3 Æ y=2) = x+y=5 Æ 1 · x · 3 UF: Uninterpreted Functions Join UF (x=a Æ y=F(a), x=b Æ y=F(b)) = y=F(x)

4. 3 Motivation: Program Analysis using Abstract Interpretation x := a; y := F(a); x := b; y := F(x); u := F(x); v := y; assert (u=v); assert (v=F(a)); u := F(a); v := F(a); True False Disadvantages of using decision procedure: Exponential # of paths Loop invariants required Cannot discover invariants Abstract Interpretation avoids these problems Join Algorithm required to merge facts at join points True * *

5. 4 Join for Uninterpreted Functions is not easy Join(F(a)=a Æ F(b)=b Æ G(a)=G(b), a=b) = GF i (a)=GF i (b) The result of join is not finitely representable using standard data-structures like EDAGs

6. 5 Relatively Complete Join: Definition Recall, Join(E 1,E 2 ): strongest conjunction of ground facts g s.t. E 1 ) T g and E 2 ) T g RCJoin(E 1,E 2,K): strongest conjunction of ground facts g s.t. E 1 ) T g and E 2 ) T g and Terms(g) 2 K Example E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } RCJoin(E 1,E 2,K): GF(a) = GF(b)

7. 6 Relatively Complete Join: Algorithm RCJoin(E 1,E 2,K): 1.Let D 1 =EDAG(E 1 ) and D 2 =EDAG(E 2 ) 2.Extend D 1 and D 2 to represent K 3.Congruence close D 1 and D 2 4.Let D=product construction of D 1 and D 2 Output D

8. 7 Step 1: Constructing EDAGs F a GG b F Nodes represent terms Dotted edges represent equalities E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) ab

9. 8 Step 2: Extending EDAGs F a GG b F ab F GG F Add extra nodes to EDAGs s.t. terms in K are represented E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 )

10. 9 Step 3: Congruence Closure F a GG b F ab F GG F F(n) = F(m) if n=m E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 )

11. 10 Step 4: Product Construction (Intuition) F a GG b F ab F GG F 3030 4 1 3 2 65 2020 1010 4040 5050 6060 E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) C1: {a, Fa, F 2 (a), …} C4: {b, Fb, F 2 (b), …} C6: {G(a), GF(a), … G(b), GF(b), …} C1 0 : {a, b} C2 0 : {F(a), F(b)} C3 0 : {GF(a), GF(b)} C6 Å C3 0 : { GF(a), GF(b)}

12. 11 Step 4: Product Construction (Algorithm) F a GG b F ab F GG F 3030 4 1 3 2 65 2020 1010 4040 5050 6060 [n,m] 2 D if n:v Æ m:v, or n:F(n 1 ) Æ m:F(m 1 ) Æ [n 1,m 1 ] 2 D [n 1,m 1 ] = [n 2,m 2 ] if n 1 =n 2 and m 1 =m 2 ab F GG F [1,1 0 ] [2,2 0 ] [3,3 0 ] [6,6 0 ] [5,5 0 ] [4,4 0 ] E 1 : F(a)=a Æ F(b)=b Æ G(a)=G(b) E 2 : a=b K: { GF(a),GF(b) } D 1 = EDAG(E 1 )D 2 = EDAG(E 2 ) D

13. 12 Future Work: Join Algorithm for other theories For example, theory of commutative functions (CF) –Useful in modeling floating point operations –More challenging than uninterpreted functions (UF) E 1 : x=a Æ y=b E 2 : x=b Æ y=a Join UF (E 1,E 2 ) = true Join CF (E 1,E 2 ) = F(C[a],C[b]) = F(C[b], C[a])

14. 13 Future Work: Combining Join Algorithms For example, theory of linear arithmetic and uninterpreted functions (LA+UF) E 1 : x=a Æ y=b E 2 : x=b Æ y=a Join UF (E 1,E 2 ) = true Join LA (E 1,E 2 ) = x+y=a+b Join LA+UF (E 1,E 2 ) = F(x+c)+F(y+c) = F(a+c)+F(b+c) Æ.….

15. 14 Future Work: Context-sensitive Join Algorithms Join(E 1,E 2 ) Æ E = Join(E 1 Æ E, E 2 Æ E) Useful in interprocedural analysis This is a representation issue. –Representing result of join using conjunction of ground facts is not context-sensitive. E 1 : x=a Æ y=F(a) E 2 : x=b Æ y=F(b) Join UF (E 1,E 2 ) Æ a=b = y=F(x) Æ a=b Join UF (E 1 Æ a=b,E 2 Æ a=b) = y=F(x) Æ x=a=b

16. 15 Conclusion Join Algorithms are useful in program analysis. They are generalization of decision procedure. Join T (E, g) = g iff E ) T g E: conjunction of ground facts in theory T g: ground fact in theory T We showed a relatively complete join algorithm for uninterpreted functions. Join algorithms open up several interesting problems.