Dynamic Program Analysis with Partial Execution and Summary

1
Dynamic Program Analysis with Partial Execution
and Summary

• Thomas Huining Feng
• http//www.eecs.berkeley.edu/tfeng/
• CHESS, UC Berkeley
• May 8, 2007
• CS 294-5 Class Project

2
Motivating Example 1
public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op1) System.out.println("Operation
1") if (op2) System.out.println("Oper
ation 2") if (op3) System.out.println
("Operation 3") _at_Failure("failure") int
fail

• JCute finds 2416 paths.
• Overall failure constraint is failure (after
  simplification).
• Can we reduce the number of paths?

if (failure) System.out.println(FAILURE) re
turn else return
3
Motivating Example 2
public class B void f(int i, int j) for
(int k 0 k lt i k) if (i j)
_at_Failure(true) int fail

• JCute never halts.
• An unbounded number of paths exist, because i is
  arbitrary.
• Can we handle this problem? Yes.
• Can we handle this problem within 10 runs? Yes.

Raise a failing signal when i j. Equivalent
to _at_Failure(i j) int fail
4
Overview

• Examples exhibit 2 problems
• Exponential paths to explore.
• Unbounded paths to explore before a loop
  constraint is found.
• Assumption
• Free of side effect, deterministic Java programs.
• To solve problem 1
• For a program with n n1 n2 nk
  sequential tests
• split the program into k trunks
• reduce the complexity to 2n1 2n2 2nk
  (best case)
• Let n1 n2 nk 1 to achieve linear
  growth.
• To solve problem 2
• Partially execute the loop.
• Compute a fixpoint of constraints.

5
Solving Problem 1

• Examples exhibit 2 problems
• Exponential paths to explore.
• Unbounded paths to explore before a loop
  constraint is found.
• Assumption
• Free of side effect, deterministic Java programs.
• To solve problem 1
• For a program with n n1 n2 nk
  sequential tests
• split the program into k trunks
• reduce the complexity to 2n1 2n2 2nk
  (best case)
• Let n1 n2 nk 1 to achieve linear
  growth.
• To solve problem 2
• Partially execute the loop.
• Compute a fixpoint of constraints.

6
Partition the Program
public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op1) System.out.println("Operation
1") if (op2) System.out.println("Oper
ation 2") if (op3) System.out.println
("Operation 3") _at_Failure("failure") int
fail

• 1st execution the last test of the program. 2
  branches 4 paths.
• Constraint op3 failure !op3 failure
• ?failure

public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op3) System.out.println("Operation
3") _at_Failure("failure") int fail
Seg. 3
Seg. 2
Seg. 1
7
Rewrite the Program
public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op1) System.out.println("Operation
1") if (op2) System.out.println("Oper
ation 2") if (op3) System.out.println
("Operation 3") _at_Failure("failure") int
fail
public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op1) System.out.println("Operation
1") if (op2) System.out.println("Oper
ation 2") _at_Failure("failure") int
fail
8
Segment the Program Again
public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op1) System.out.println("Operation
1") if (op2) System.out.println("Oper
ation 2") _at_Failure("failure") int
fail

• 2nd execution the last test of the program. 2
  branches 4 paths.
• Constraint op2 failure !op2 failure
• ?failure

public class A void f(boolean op1, boolean
op2, boolean op3, boolean failure) if
(op2) System.out.println("Operation
3") _at_Failure("failure") int fail
Seg. 3
Seg. 2
9
Assessment

• Repeat this process until head of the program is
  reached.
• A big gain?

10
Assessment
11
Solving Problem 2

• Examples exhibit 2 problems
• Exponential paths to explore.
• Unbounded paths to explore before a loop
  constraint is found.
• Assumption
• Free of side effect, deterministic Java programs.
• To solve problem 1
• For a program with n n1 n2 nk
  sequential tests
• split the program into k trunks
• reduce the complexity to 2n1 2n2 2nk
  (best case)
• Let n1 n2 nk 1 to achieve linear
  growth.
• To solve problem 2
• Partially execute the loop.
• Compute a fixpoint of constraints.

12
Bounded Loop Execution

• First, identify the loop.

13
Bounded Loop Execution
public class B void f(int i, int j) int
k k 0 l1 if (k lt i) if (i j)
_at_Failure(true) int fail k
goto l1

• Assume that the loop exits in n 3 iterations.
• Partition the program into 4 segments.

Seg. 4
Seg. 3
Seg. 2
Seg. 1
14
Bounded Loop Execution

• Run the tree from the tail.
• Repeat computing the failure constraint.
• Test for fixpoint.
• Reduce the loop into a simple branch.

Test 3 C3
Test 2 C2
Test 1 C1
15
Bounded Loop Execution

• 1st execution 3 paths.
• Constraint k lt i-1 i j

16
Bounded Loop Execution

• Analyze 1 more iteration.
• Re-execute 4 paths.
• Constraint k lt i-1 i j (fixpoint)

public class B void f(int i, int j) int k
JCute.input.Integer() if (k lt i) if (i
j) _at_Failure(true) int
fail k if (k lt i) if (i
j) _at_Failure(true) int
fail k
public class B void f(int i, int j) int k
JCute.input.Integer() if (k lt i) if (i
j) _at_Failure(true) int
fail k _at_Failure(k lt i-1 i
j) int fail
public class B void f(int i, int j) int
k k 0 l1 if (k lt i) if (i j)
_at_Failure(true) int fail k
goto l1
17
Bounded Loop Execution

• Substitute the whole loop with the fixpoint
  constraint.
• Execute the program 3 paths.
• Constraint i gt 1 i j
• Total of paths 3 4 3 10

18
Demo Eclipse Plugin
19
Conclusion Advantage and Drawback

• Advantages
• Greatly reduce the number of paths in some cases.
• Derive constraints for unbounded loops.
• Limitations
• Need transformation and compilation every time
  you want to simplify the program with the newly
  derived constraints.
• Advantage 1 is lost if constraints are not
  (cannot be) simplified.

void f(boolean op1, boolean op2, boolean op3,
boolean failure) if (op1) System.out.printl
n("Operation 1") if (op2) System.out.prin
tln("Operation 2") if (op3)
System.out.println("Operation
3") _at_Failure("failure) int fail
op1 op2 op3 failure op1 op2
!op3 failure ... (16 paths)
op2 op3 failure op2 !op3 failure
!op2 op3 failure !op2 !op3
failure (8 paths)
op3 failure !op3 failure (4 paths)