Transcript Catching Bugs in the Web of Program Invariants

Catching Bugs in the Web of Program Invariants
Proseminar „Programmanalyse”, Prof. Dr. Heike Wehrheim
Universität Paderborn, WS 2011/2012
Anton Tonkushin
Static debugging
Identifying problems at compile- or runtime
•
•
•
•
•
Array indexing outside of its proper bounds
Division by zero
Referencing of null pointers
Jumping to non-function pointers
etc
Solution: Magic Tool
• Assisting the programmer in verifying the preconditions of
program operations
• Immediate errors’ signaling
Programmanalyse, WS 2011/2012, Anton Tonkushin
2
MrSpidey
Introduction & Goals
• Interactive, static debugger for Scheme
• Understanding complex programs
• Debugging complex programs
Main functions:
• Describes the set of possible values for each program variable
and expression (value set invariant)
• Identifies possibly unsafe program operations that may cause
run-time errors
• Provides a supporting graphical explanation for these
invariants
Programmanalyse, WS 2011/2012, Anton Tonkushin
3
Set-based analysis in MrSpidey
Introduction:
• Program variables and expressions are viewed as sets of
values
• Possibly infinite sets of values represented finitely using
abstract values
• Each abstract value corresponds to a particular constructor
expression in the analyzed program
4
Programmanalyse, WS 2011/2012, Anton Tonkushin
Sample source language Λ
Introduction:
P
∈
M, N ∈
Program
Λ
::=
::=
V
∈
Value
::=
c
n
x
l
∈
∈
∈
∈
Const
Num
Vars
Label
=
=
=
(define x M) ...
Vl
Ι (M M)l
Ι (cons M M)l
Ι (car M)l
Ι (cdr M)l
cΙx
Ι (λx.M)l
Ι (cons V V)
Num ∪ {nil, ...}
{0, 1, 2, ...}
{x, y, z, ...}
Programmanalyse, WS 2011/2012, Anton Tonkushin
5
Abstract values & abstract store
Abstract values
• Sets of values infinite → abstract values
• Correspond to a particular construction expression
• Represent set of run-time values
𝑙
𝑙
• AbsValueP = { 𝐜𝐨𝐧𝐬 𝑙1 𝑙2 Ι (𝐜𝐨𝐧𝐬 𝑀11 𝑀22 ) ∈ P}
∪ { λ𝑥. 𝑀 Ι (λ𝑥. 𝑀) ∈ P}
∪ {c Ι c ∈ P}
Abstract store
•
•
•
•
Result of the set-based analysis
Finite table
Maps variables and labels to sets of abstract values
S ∈ AbsStore = (Vars ∪ Label) → P(AbsValueP)
Programmanalyse, WS 2011/2012, Anton Tonkushin
6
Two stage algorithm of MrSpidey
• Deriving constraints in a syntax-directed manner from the
program text
• Determining the minimal (i.e., most accurate) abstract store
satisfying these constraints
Example
(define sum
(λtree.
( if (number? tree)
tree
𝑙2
(+ (sum 𝐜𝐚𝐫 𝑡𝑟𝑒𝑒 𝑙1 )
(sum 𝐜𝐝𝐫 𝑡𝑟𝑒𝑒 )))))
(sum 𝐜𝐨𝐧𝐬 𝐜𝐨𝐧𝐬
nil𝑙3
𝑙5
𝑙
4
1
Programmanalyse, WS 2011/2012, Anton Tonkushin
2𝑙6
𝑙7
7
)
A sample analysis: deriving constraints
λ𝑡𝑟𝑒𝑒. …
∈ 𝑆 𝑠𝑢𝑚
1
𝑆 𝑡𝑟𝑒𝑒 \ 𝑁𝑢𝑚 ⊆ 𝑆 𝑙1
2
𝐜𝐨𝐧𝐬 𝐿𝑥 𝐿𝑦 ∈𝑆 𝑙1
𝑆 𝐿𝑥
⊆𝑆
𝑙2
3
(sum 𝐜𝐨𝐧𝐬 𝐜𝐨𝐧𝐬 nil𝑙3 1𝑙4
λ𝑥.𝑁 ∈𝑆 𝑠𝑢𝑚
𝑆 𝑙2 ⊆ 𝑆 𝑥
4
nil ∈ 𝑆 𝑙3
5
1 ∈ 𝑆 𝑙4
6
(𝐜𝐨𝐧𝐬 𝑙3 𝑙4 ) ∈ 𝑆 𝑙5
2 ∈ 𝑆 𝑙6
(𝐜𝐨𝐧𝐬 𝑙5 𝑙6 ) ∈ 𝑆 𝑙7
λ𝑥.𝑁 ∈𝑆 𝑠𝑢𝑚
𝑆 𝑙7 ⊆ 𝑆 𝑥
(define sum
(λtree.
( if (number? tree)
tree
𝑙2
(+ (sum 𝐜𝐚𝐫 𝑡𝑟𝑒𝑒 𝑙1 )
(sum 𝐜𝐝𝐫 𝑡𝑟𝑒𝑒 )))))
𝑙5
2𝑙6
𝑙7
)
7
8
9
10
Programmanalyse, WS 2011/2012, Anton Tonkushin
8
A sample analysis: solving constraints
From (1),(10):
𝑆 𝑙7 ⊆𝑆 𝑡𝑟𝑒𝑒
11
From (9),(11):
𝐜𝐨𝐧𝐬 𝑙5 𝑙6 ∈ 𝑆 𝑡𝑟𝑒𝑒
12
From (2),(12):
𝐜𝐨𝐧𝐬 𝑙5 𝑙6 ∈ 𝑆 𝑙1
13
From (3),(13):
From (7),(14):
From (1),(4):
𝑆 𝑙5 ⊆𝑆 𝑙2
𝐜𝐨𝐧𝐬 𝑙3 𝑙4 ∈ 𝑆 𝑙2
𝑆 𝑙2 ⊆𝑆 𝑡𝑟𝑒𝑒
14
15
16
From (15),(16):
𝐜𝐨𝐧𝐬 𝑙3 𝑙4 ∈ 𝑆 𝑡𝑟𝑒𝑒
17
From (2),(17):
𝐜𝐨𝐧𝐬 𝑙3 𝑙4 ∈ 𝑆 𝑙1
18
From (3),(18):
𝑆 𝑙3 ⊆𝑆 𝑙2
19
From (5),(19):
nil ∈ 𝑆 𝑙2
20
From (16),(20):
nil ∈ 𝑆 𝑡𝑟𝑒𝑒
21
From (2),(21):
𝐧𝐢𝐥 ∈ 𝑺 𝒍𝟏
22
Programmanalyse, WS 2011/2012, Anton Tonkushin
9
Value Flow & Value Flow Browser
• Construction of a value flow graph from the subset relations
• Each edge in this graph -> arrow overlaid on the program text
10
Programmanalyse, WS 2011/2012, Anton Tonkushin
Questions?
11