Sireum/Topi LDPpeople.cis.ksu.edu/~belt/reports/ldp-fse09-FINAL.pdf · 2009. 9. 15. · Sireum/Topi...

Sireum/Topi LDPA Lightweight Semi-decision Procedure for

Optimizing Symbolic Execution-based Analyses

Jason Belt and RobbyKansas State University

Xianghua DengPennsylvania State University - Harrisburg

Support

US National Science Foundation (NSF)Air Force Office of Scientific Research (AFOSR)Rockwell Collins

Tuesday, September 15

Software Verification

VerificationEngine

SoftwareArtifacts Report


• has gained renewed interest in recent years

• in contrast to testing, it can reason about unknown values

Symbolic Execution

SymExeEngine



Symbolic Execution

SymExeEngine


DecisionProcedures


Kiasan

Kiasan.java(+ JML)

SMT Solver(CVC3/Yices)


Kiasan

Kiasan.java(+ JML)


• a symbolic virtual machine for Java

• checks

• uncaught exceptions, assertions and contracts

• generates

• counter examples, test cases, coverage information, etc.


Kiasan

Kiasan.java(+ JML)



SMT Solvers

• made significant impact on software verification (not only for SymExe)

• ... but difficult to leverage application-specific knowledge for optimizations

• well-defined API

• ... but designed as a black-box



Observations

• ... in some cases, the SMT solver used may take up to 50% - 80% of Kiasan’s overall execution time

• for scalar constraints

• can this be improved?

• creating application-specific SMT solver requires significant investments

Kiasan

SMT Solver


The LDP ApproachSymExeEngine

DecisionProcedures

LDP

• LDP sits in the middle of SymExe and DP

• decides some constraints quickly

• delegate to DP for other constraints

• ... and learn DP answers for future decisions


LDP: Design Goals

• quick decisions

• guideline: linear time and space complexity

• ... implies incompleteness

• sound

• allowed to delegate to DP

• i.e., LDP is a semi-decision procedure


SymExe [King:ACM76]

void foo(int x, int y,int z) { z = x + y; if (z > 0){ z++; } }


x ! !, y ! ", z ! #, $ = { } void foo(int x, int y,int z) { z = x + y; if (z > 0){ z++; } }

SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { }

x ! !, y ! ", z ! #, $ = {# = ! + " }

z = x + y;


SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { }

x ! !, y ! ", z ! #, $ = {# = ! + " }

x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

z > 0


SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { }

x ! !, y ! ", z ! #, $ = {# = ! + " }

x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

z++;


SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { }

x ! !, y ! ", z ! #, $ = {# = ! + " }

x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

!(z > 0)


SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { }

x ! !, y ! ", z ! #, $ = {# = ! + " }

x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

skip


SymExe [King:ACM76]


x ! !, y ! ", z ! #, $ = { } void foo(int x, int y,int z) { z = x + y; if (z > 0){ z++; } } x ! !, y ! ", z ! #, $ = {# = ! + " }

x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

…symbolic execution characterizes (theoretically) infinite number of real executions!

SymExe [King:ACM76]


Test Case Generation


x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x=-1, y=2, z=2

x=-1, y=2, z=2

Solving the constraintof each path’s Φ to generate a test case

... the explored computation tree can be directly leveraged for test case generation!Tuesday, September 15


x ! !, y ! ", z ! #, $ = {# = ! + ", # > 0 }

x ! !, y ! ", z ! #’, $ = {# = ! + ", # > 0, #’ = # + 1 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x ! !, y ! ", z ! #, $ = {# = ! + ", # % 0 }

x=-1, y=0, z=-1

x=-1, y=0, z=-1

Solving the constraintof each path’s Φ to generate a test case

Test Case Generation

... the explored computation tree can be directly leveraged for test case generation!Tuesday, September 15

Kiasan: ObservationsForms of constraints in PC (due to bytecode)

• Symbol/Constant Constraints

• Symbol/Symbol Constraints

• Symbol/Binary Expression Constraint

α �� c where �� ∈ {<,≤,=, �=,≥, >}c �� α where �� ∈ {<,≤,=, �=,≥, >}

αi �� αj where �� ∈ {<,≤,=, �=,≥, >}

αi = c � αj where � ∈ {+,−, ∗, /}, orαi = αj � c where � ∈ {+,−, ∗, /}, orαk = αi � αj where � ∈ {+,−, ∗, /}.


Kiasan: ObservationsForms of constraints in PC (due to bytecode)

• Symbol/Constant Constraints

• Symbol/Symbol Constraints

• Symbol/Binary Expression Constraint

α �� c where �� ∈ {<,≤,=, �=,≥, >}c �� α where �� ∈ {<,≤,=, �=,≥, >}

αi �� αj where �� ∈ {<,≤,=, �=,≥, >}

αi = c � αj where � ∈ {+,−, ∗, /}, orαi = αj � c where � ∈ {+,−, ∗, /}, orαk = αi � αj where � ∈ {+,−, ∗, /}.

... PC will only contain conjunctionsTuesday, September 15

LDP: API

• LDP maintains information in tables, etc.

• initially empty

• query: lookup tables to see whether stored information is enough to decide validity of the branch condition

• if not, delegate to DP

• update: when delegation happens, update tables with answer from DP

T F


LDP: Query Results

T F


LDP: Query Results

T F

valid


LDP: Query Results

T F

valid

T F

unsat


LDP: Query Results

T F

valid

T F

unsat

T F

both sat


LDP: Query Results

T F

valid

T F

unsat

T F

both sat unknown

T F

delegate


LDP: Update

• does not need to update for valid and unsat results

• LDP already has the necessary information to make a precise decision

T F

valid

T F

unsatPC

PC

PC

PC


LDP: Update

• When the decision is delegated to DP

• T: update LDP tables to include the fact that the branching condition holds

• F: update LDP tables to include the fact that the branching condition does not hold

unknown

T FPC + ¬bcPC + bc

PC


LDP: Update

• Similar to unknown

• T: update LDP tables to include the fact that the branching condition holds

• F: update LDP tables to include the fact that the branching condition does not hold

T F

both sat

PC + ¬bcPC + bc

PC


Model-Based Engineering

^{ LT -> // query^[ (EQ, ^{ CLT->UNSAT, CEQ->UNSAT, CGT->VALID }),

(GE, ^{ CLT->UNSAT, CEQ->UNSAT, CGT->LE }), ...],... };

^{ LT -> // update^[ ..., (CGT, ^{ CLT -> ^[ store(LT) ],

CGE -> ^[ drop(GT), store(GE) ]},(CLE, ^{ CLT -> ^[ drop(LE), store(LT) ],

CGE -> ^[ compare(EQ) ?^[ drop(LE), store(EQ) ] :^[ store(GE) ] ] }, ...],

... };

Pilar Model







... };


Java Code View







... };


Latex View


Symbol/Constant Query Rulesα < c ?

C Test Result Value Example #

C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15

• stored as mappings from symbols to constants


constraint from SymExe e.g. x < 3



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15





C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15

Symbol/Constant map notation



comparator indicates type of comparison the map is storing

Symbol/Constant Query Rules• stored as mappings from

symbols to constants

α < c ?


C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


comparison of passed in constant with the

mapped value



α < c ?


C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


LDP’s return value



α < c ?


C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15



symbols to constants• search is performed in a

predefined order

α < c ?


C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15



symbols to constants• search is performed in a

predefined order•BOTH SAT returned when no

mapping is found and the symbol is not associated with another symbol, UNKNOWN otherwise.

α < c ?


C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query• Example query• Example queryx < 5 with PC = {0 ≤ x ≤ 3}



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query

C= does not contain a mapping for x

• Example query• Example queryx < 5 with PC = {0 ≤ x ≤ 3}



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query

found

x < 5 with PC = {0 ≤ x ≤ 3}

x ≥ 0



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query

5 > 0, indicates LDP needs to check if an upper bound exists

x < 5 with PC = {0 ≤ x ≤ 3}

C≤?



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query

found

x < 5 with PC = {0 ≤ x ≤ 3}

x ≤ 3



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


• Example query

5 > 3 so LDP returns VALID

x < 5 with PC = {0 ≤ x ≤ 3}



C=

c < C(α) UNSAT

✲d��

c< ❝

1

c = C(α) UNSAT

✲d��

c, d< ❝

2

c > C(α) VALID

✲d��

c< ❝

3

C≥

c < C(α) UNSAT

✲d� >

c< ❝

4

c = C(α) UNSAT

✲d� >

c, d< ❝

5

c > C(α) C≤?

✲d� >

c< ❝

6

C>

c < C(α) UNSAT

✲d❝ >

c< ❝

7

c = C(α) UNSAT

✲d❝ >

c, d< ❝

8

c > C(α) C≤?

✲d❝ >

c< ❝

9

C≤

c < C(α) UNKNOWN

✲d

< �c

< ❝10

c = C(α) UNKNOWN

✲d

< �c, d

< ❝11

c > C(α) VALID

✲d

< �c

< ❝12

C<

c < C(α) UNKNOWN

✲d

< ❝c

< ❝13

c = C(α) VALID

✲d

< ❝c, d

< ❝14

c > C(α) VALID

✲d

< ❝c

< ❝15


Symbol/Constant Update Rules

α < c !C Update Rules #

C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2

C>F) α ≥ c→ C>[α �→ ⊥], C≥[α �→ c] 3T) α < c→ C<[α �→ c] 4

C≤F) α ≥ c→

if c = C≤(α)then C=[α �→ c]else C>[α �→ ⊥], C≥[α �→ c]

5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6

C<F) α ≥ c→ C>[α �→ ⊥], C≥[α �→ c] 7T) α < c→ C<[α �→ c] 8

• for UNKNOWN decisions, LDP returns an explanation of how the decision was made




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6



constraint to add to PC




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6



mapping used to make the decision




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6



update rule for the original constraint




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6



update rule for the negated constraint




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6


• e.g. update context with and PC = {0 ≤ x ≤ 3}x < 3




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6


• e.g. update context with and

Original Constraint: x < 3 Mapping used:

LDP’s Return Value

PC = {0 ≤ x ≤ 3}x < 3

C≤




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}x < 3

C≤


Mapping used to make decision




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}x < 3

C≤

LDP’s Return Valueoriginal constraintchosen by SymExe




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}x < 3

C≤

Yields...

PC � = {0 ≤ x < 3}





C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}

C≤

x ≥ 3

LDP’s Return Valuenegated constraintchosen by SymExe




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}

C≤

Yields...

x ≥ 3


PC � = {x == 3}




C≥F) α ≥ c→ C≥[α �→ c] 1T) α < c→ C<[α �→ c] 2


C≤F) α ≥ c→


5

T) α < c→ C≤[α �→ ⊥], C<[α �→ c] 6




PC = {0 ≤ x ≤ 3}

C≤

Yields...

x ≥ 3


... LDP was able to infer x is a constant

PC � = {x == 3}


Other Techniques and Optimizations

• constant propagation

• when a symbol is known to be equal to a constant, concrete executions take place

• symbol representatives

• expression caching

• non-strict inequalities on integers

• customized union-find algorithms, etc.


Experimental Results

0

0.2

0.4

0.6

0.8

Without LDP With LDP

0.51

0.78

Array.partition

seco

nds

0

2.75

5.50

8.25

11.00


2.07

10.86

Sort.insertionSort

seco

nds

0

15

30

45

60


5.86

51.34

Sort.selectionSort

seco

nds

0

2,000

4,000

6,000

8,000

Without LDP With LDP428.20

7,008.26

DisjSets.Find

seco

nds

1.5x 5.2x

8.8x 16.4x~2 hours

~7 minutes


Experimental Results

0

30

60

90

120


85.24111.58

AvlTree.find

seco

nds

0

27.5

55.0

82.5

110.0


78.44102.84

AvlTree.put

seco

nds

0

55

110

165

220


170.39217.90

TreeMap.find

seco

nds

0

150

300

450

600


460.51570.27

TreeMap.put

seco

nds

1.3x 1.3x

1.3x 1.2x


Array Accesses void foo(int[] a) {

...for (int i = 0; i < a.length; i++) {

...

...}...

}



// for (int i = 0; i < a.length; i++) {

...

...}...

}

PC = {α ≥ 0}

arrays must have positive length




...

...}//

}

PC = {α ≥ 0}

exploring false branch during 1st iteration

PC = {α ≥ 0 && 0 ≥ α} ≡{ α == 0}




//...

}...

}

PC = {α ≥ 0}

exploring true branch during 1st iteration

PC = {α ≥ 0, i == 0, 0 < α} ≡{ α ≥ 1, i == 0}




//...

}//

}

PC = {α ≥ 0}

exploring false branch during 2nd iteration

PC = {α ≥ 1, 1 ≥ α} ≡{ α == 1}

PC = {α ≥ 0, i == 0, 0 < α} ≡{ α ≥ 1, i == 0}




//...

}//

}

PC = {α ≥ 0}

PC = {α ≥ 1, 1 ≥ α} ≡{ α == 1}

PC = {α ≥ 0, i == 0, 0 < α} ≡{ α ≥ 1, i == 0}

Observation #1LDP infers the length of the array is always concrete once the loop exits




//...

}//

}

PC = {α ≥ 0}

PC = {α ≥ 1, 1 ≥ α} ≡{ α == 1}

Observation #2if foo is an array sorting algorithm, LDP will cache the sorted elements

PC = {α ≥ 0, i == 0, 0 < α} ≡{ α ≥ 1, i == 0}


Classes of Behaviors Benefited by using LDP• array accesses

• iteration over array indices

• bound checking

• ...

• in general, scalar comparisons

• contract checking

• “redundancy” of code and specificationTuesday, September 15

Related Work• Many SymExe work uses some expression

caching and decision procedure by simple constraint pattern matching

• lack of systematic investigation on these simple optimizations and their impacts

• Interval Analysis

• LDP also reasons about disequalities

• Term rewriting

• Constant Propagation

• Cone of influence, etc.Tuesday, September 15

Conclusion

• LDP is a fast lightweight inference/caching semi-decision procedure for scalar constraints

• has been shown to provide significant performance increases for certain classes of programs

• yields negligible overhead on classes of programs it isn’t designed to benefit


Future Work• integration with Microsoft’s Z3 solver

• expand experiments

• extend LDP’s inference capability

• performing symbolic arithmetic operations

• addition of non-linear inference techniques (e.g. transitive closure of comparison operators)

• Mechanically proving LDP’s algorithmTuesday, September 15

Questions ?


Sireum/Topi LDPpeople.cis.ksu.edu/~belt/reports/ldp-fse09-FINAL.pdf · 2009. 9. 15. · Sireum/Topi...

Documents

Transcript of Sireum/Topi LDPpeople.cis.ksu.edu/~belt/reports/ldp-fse09-FINAL.pdf · 2009. 9. 15. · Sireum/Topi...