Proving Java Termination: Reducing the Ugly to the Bad · 2015. 4. 16. · Terminator{(Cook,...

Proving Java Termination: Reducing the Ugly to theBad

Marc Brockschmidt

LuFG Informatik 2, RWTH Aachen University, Germany

September 2012

Automated Termination Analysis

Imperative Programs:

Synthesis of Linear Ranking Functions(Colon & Sipma, ’01), (Podelski & Rybalchenko, ’04), . . .

Termination Analysis for C (via Transition Invariants)Terminator – (Cook, Podelski, Rybalchenko et al., since ’05)

CProver – (Kroening, Sharygina, Tsitovich, Wintersteiger, since ’10)

Declarative Programs:

Logic Programming (since the 70s)

Term Rewriting (since the 70s)

Transformation of Imperative to Declarative Programs:

Termination Analysis for C (via Polynomial Orders)KITTeL – (Falke, Kapur, Sinz, since ’11)

Termination Analysis for Java (via Path Length, CLP backend)Julia – (Spoto, Mesnard, Payet, since ’08)

COSTA – (Albert, Arenas, Codish, Genaim, Puebla, Zanardini, since ’08)

Rewriting-backed approach: Idea

Programming languages hard y Simpler representation needed

Symbolic Evaluation Graphs: Simpler, contain all information

Term Rewrite Systems (TRSs) generated from Symbolic Evaluation

Prove TRS termination using existing provers

Haskell

Prolog

SymbolicEvaluation

Haskell

Prolog

SymbolicEvaluation

Haskell

Prolog

SymbolicEvaluation

Haskell

Prolog

SymbolicEvaluation

Termination

Haskell

Prolog

SymbolicEvaluation

Termination

Complexity

Haskell

Prolog

SymbolicEvaluation

Termination

Complexity

Non-Termination

Bug Detection

Rewriting-backed approach: Advantages

Handling of user-defined acyclic data structures:public class List {

int value;

List next;

int value;

List next;

}Other techniques:Fixed abstraction to number

List [2, 4, 6] abstracted tolength 3

Our technique:Abstraction to terms

List [2, 4, 6] becomesList(2, List(4, List(6, null) ) )

TRS techniques search for suitable orders automatically

⇒ Complex orders for user-defined data structures possible

int value;

List next;

int value;

List next;

length: the example

class L {L p, n;

static int length(L x) {int r = 1;

while (x != null) {x = x.n;

}return r; }}

length: the example

class L {L p, n;

}return r; }}

null null

length: the example

class L {L p, n;

}return r; }}

null null

length: the example

class L {L p, n;

}return r; }}

null null

length: the example

class L {L p, n;

}return r; }}

null null

length: the example

class L {L p, n;

}return r; }}

null null

length: the example

class L {L p, n;

}return r; }}

00: iconst 1 #load 1

01: istore 1 #store to r

02: aload 0 #load x

03: ifnull 17 #jump if x null

06: aload 0 #load x

07: getfield n #get n from x

10: astore 0 #store to x

11: iinc 1, 1 #increment r

14: goto 2

17: iload 1 #load r

18: ireturn #return r

Abstract Java virtual machine states

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

00 | x :o1 | εo1:L(?) o1{p,n}Stack frame:

Next program instruction

Local variables

Operand stack

Heap information:

o1 is L object or null

Known L object: o2 : L(n=o3)

Unknown integer: i1 : ZHeap predicates:

Two references may be equal: o1 =? o2

Two references may share: o1%$o2Reference might have cyclescontaining all fields F : o1F

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

Unknown integer: i1 : Z

Heap predicates:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

Unknown integer: i1 : Z

Heap predicates:

Only explicit sharing

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

Two references may share: o1%$o2

Reference might have cyclescontaining all fields F : o1F

class L {L p, n;

}return r; }}

02: aload 0 #load x

06: aload 0 #load x

14: goto 2

17: iload 1 #load r

Local variables

Operand stack

Heap information:

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

State A:

x some list, might contain cycles using p and n

State B:

Initialized variable r to 1

C , D, E :

x (o1) null? We do not know!

⇒ Refinement

In D: o1 is null (y program ends)In E : o1 replaced by o2, which exists and has fields:

Field values can share (y add %$)Field values can be cyclic again (y add )

int length(L x) {int r = 1;

while (x != null) {x = x.n; r++; }

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

State A:

State B:

C , D, E :

⇒ Refinement

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

State A:

State B:

⇒ Refinement

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

03 |x :null, r : 1 |null D

03 |x :o2, r : 1 |o2o2:L(p=o3, n=o4)o3:L(?) o4:L(?)o2%$o3 o2%$o4 o3%$o4o2, o3, o4{p,n}

State A:

State B:

States C , D, E :

⇒ Refinement

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

State F :

Stored x.n to x (allowing for GC)

G , B ′:

Incremented r, back to position 02 (as B)

⇒ Generalization: “Merge” states B, G

States C ′,G ′:

Repetition of C ,G

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

02 |x :o4, r : 2 |εo4:L(?) o4{p,n}

State F :

States C ′,G ′:

Repetition of C ,G

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

02 |x :o4, r : 2 |εo4:L(?) o4{p,n}

G02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

State F :

States G , B ′:

States C ′,G ′:

Repetition of C ,G

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

02 |x :o4, r : 2 |εo4:L(?) o4{p,n}

G02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

State F :

States G , B ′:

States C ′,G ′:

Repetition of C ,G

return r; }

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

02 |x :o4, r : 2 |εo4:L(?) o4{p,n}

G02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

State F :

States G , B ′:

States C ′,G ′:

Repetition of C ,G

return r; }

Transforming values to terms

03 |x :o2, r :1 |o2o2:L(p=o3, n=o4)o3:L(?) o4:L(?)o2%$o3 o2%$o4 o3%$o4o2, o3, o4{p,n}

Known integers transformed to themselves

Unknown values transformed to variables

Data structures transformed to nested constructor terms:Class Cl with n fields y symbol Cl of arity n

o2︷︸︸︷

o4), 1,

o2︷︸︸︷L(

) → fF (o4

o2︷︸︸︷

o2︷︸︸︷L(

) → fF (o4

o2︷︸︸︷

o3, o4

o2︷︸︸︷L(

) → fF (o4

o2︷︸︸︷L(o3, o4)

o2︷︸︸︷L(

) → fF (o4

Transforming states to terms

State s transformed to term with symbol fs

All local variables, stack entrys as arguments

Evaluation edges: Encode states, put in →Problem: Terms cannot represent cycles y free var on rhs

Solution: Only encode non-cyclic parts!

Refinement edges: Encode target state twice, relabel

Instantiation edges: Encode source state twice, relabel

o2︷︸︸︷L(o3, o4), 1,

o2︷︸︸︷L(o3, o4))

→ fF (o4

Transforming edges to rules

E 11 |x :o4, r :1 |εo4:L(?) o4{p,n}

o2︷︸︸︷L(o3, o4), 1,

o2︷︸︸︷L(o3, o4))

→ fF (o4

E 11 |x :o4, r :1 |εo4:L(?) o4{p,n}

Evaluation edges: Encode states, put in →

Problem: Terms cannot represent cycles y free var on rhs

o2︷︸︸︷L(o3, o4), 1,

o2︷︸︸︷L(o3, o4)) → fF (o4

E 11 |x :o4, r :1 |εo4:L(?) o4{p,n}

o2︷︸︸︷L(o3, o4), 1,

o2︷︸︸︷L(o3, o4)) → fF (o4

′, 1)

E 11 |x :o4, r :1 |εo4:L(?) o4{p,n}

o2︷︸︸︷L(

o4), 1,

o2︷︸︸︷L(

o4)) → fF (o4

03 |x :o1, r :1 |o1o1:L(?) o1{p,n}

fC (L(o4), 1, L(o4)) → fE (L(o4), 1, L(o4))

02 |x :o4, r :2 |εo4:L(?) o4{p,n}

G 02 |x :o ′1, r : i1 |εo ′1:L(?) o ′1{p,n} i1: [>0]

fG (o4, 2) → fB′(o4, 2)

The example TRS

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

00 |x :o1 |εo1:L(?) o1{p,n}

02 |x :o1, r : 1 |εo1:L(?) o1{p,n}

03 |x :o1, r : 1 |o1o1:L(?) o1{p,n}

E 11 |x :o4, r : 1 |εo4:L(?) o4{p,n}

02 |x :o4, r : 2 |εo4:L(?) o4{p,n}

G02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

1 Only consider SCCs!

2 Transform all edges as before, simplify:

fB′(L(o ′4), i1) → fB′(o ′4, i1 + 1)

o ′4 + 1 > o ′4

3 Termination trivially proven with

JfB′K(x1, x2) = x1 JLK(x1) = x1 + 1

The example TRS

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

fB′(L(o ′4), i1) → fB′(o ′4, i1 + 1)

o ′4 + 1 > o ′4

JfB′K(x1, x2) = x1 JLK(x1) = x1 + 1

The example TRS

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

fB′(L(o ′4), i1) → fB′(o ′4, i1 + 1)

o ′4 + 1 > o ′4

JfB′K(x1, x2) = x1 JLK(x1) = x1 + 1

The example TRS

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

fB′(L(o ′4), i1) → fB′(o ′4, i1 + 1)

o ′4 + 1 > o ′4

JfB′K(x1, x2) = x1 JLK(x1) = x1 + 1

The example TRS

00: iconst 1

01: istore 1

02: aload 0

03: ifnull 17

06: aload 0

07: getfield n

10: astore 0

11: iinc 1, 1

14: goto 2

17: iload 1

18: ireturn

02 |x :o′1, r : i1 |εo′1:L(?) o′1{p,n} i1: [>0]

03 |x :o′1, r : i1 |o′1

o′1:L(?) o′1{p,n} i1: [>0]C ′02 |x :o′4, r : i2 |o

o′4:L(?) o′4{p,n} i2: [>1]

i2= i1 + 1

fB′(L(o ′4), i1) → fB′(o ′4, i1 + 1)

o ′4 + 1 > o ′4

JfB′K(x1, x2) = x1 JLK(x1) = x1 + 1

AProVE features for Java

Implementation for full Java without reflection and multithreading

Correctness proof w.r.t. JINJA [VITA’10]

Built-in, implicit analyses for nullness, aliasing, sharing, cyclicity

Termination analysis for algorithms

on integers [RTA’10]on acyclic user-defined data structures (trees, DAGs, . . . ) [RTA’10]using recursion [RTA’11]on cyclic data [CAV’12]

by detecting (and ignoring) irrelevant cyclicityby automatically finding and counting markers

Non-termination analysis [FoVeOOS’11]

on integers [RTA’10]on acyclic user-defined data structures (trees, DAGs, . . . ) [RTA’10]

using recursion [RTA’11]on cyclic data [CAV’12]

on integers [RTA’10]on acyclic user-defined data structures (trees, DAGs, . . . ) [RTA’10]using recursion [RTA’11]

on cyclic data [CAV’12]

Plans for AProVE

Integrate existing shape analyses

Modularize analysis: pre-compute information for common libraries

Handle bounded integers properly

Extend to C with pointer arithmetic

Asymptotic runtime complexity analysis (via TRS)

Provide to developers as Eclipse plugin

Plans for AProVE

Proving Java Termination: Reducing the Ugly to the Bad

Evaluated on collection of 387 programs (including the TerminationProblem Data Base):

Yes No Fail Run (s)

AProVE 276 88 22 8.4Julia 191 22 174 4.7COSTA 160 0 227 11.0

Won Termination Competition 2012

Symbolic Evaluation Graphs facilitate and simplify complex analyses

Yes No Fail Run (s)

Proving Java Termination: Reducing the Ugly to the Bad · 2015. 4. 16. · Terminator{(Cook,...

Documents

Transcript of Proving Java Termination: Reducing the Ugly to the Bad · 2015. 4. 16. · Terminator{(Cook,...