Program Analysis Based on Interval Linear Template Constraints
Jia-Hong JIANG,Bang-Hu YIN,Li-Qian CHEN
DOI: https://doi.org/10.11897/SP.J.1016.2018.00545
2018-01-01
Chinese Journal of Computers
Abstract:The problem of automatically inferring numerical invariants in a program has received wide attention in the analysis and verification of programs.Abstract interpretation is a general theory to soundly approximate program semantics.It provides a general framework to analyze value ranges of program variables,guaranteeing the soundness of the analysis.Abstract domain is key to the framework of abstract interpretation,which achieves a trade-off between efficiency and precision,and especially various numerical abstract domains have been proposed under this framework.In particular,the expressiveness of the template constraint matrix domain (TCM) subsumes most weakly relational abstract domains that are commonly used in practical program analysis,for example,interval abstract domain (a ≤x ≤b),octagon abstract domain (± x ± y ≤c),etc.During the analysis and verification of real-life systems,due to uncertainty,the application data in the model or program may not be known exactly,which is then often provided or modelled in terms of intervals.Moreover,in practice,floating-point arithmetic and non-linear expressions are often abstracted into linear expressions with interval coefficients.In other words,interval coefficients appear naturally during program analysis in practice.Hence,abstract domains that can infer interval linear relationships among variables are desired.This paper extends classical template constraint matrix domain which is based on linear template constraints,to support interval linear template constraints,and proposes a new numerical domain-interval template constraint matrix domain (itvTCM),which could infer interval linear inequality relations among variables in the program in the form of "∑ [ak,bk]xk ≤c"(where the interval coefficient [ak,bk] is determined before analysis).itvTCM makes use of "weak solution" as the semantics of the solution of interval linear constraints,which could represent certain non-convex (even non-connected) properties,and thus it is more expressive than TCM.Each itvTCM element could be considered as a disjunction of multiple TCMs but without using any explicit disjunctive operations.From the geometric point of view,each itvTCM element maps each orthant to a convex polyhedron (maybe an empty polyhedron).This paper provides domain representation and domain operations (such as join,meet,widening,etc.) of itvTCM,and most domain operations of itvTCM are implemented based on interval linear programming.Theoretically,the complexity of some domain operations of itvTCM is at worst exponential of that of the corresponding domain operations in classic TCM.However,in practice,we could alleviate this problem through restricting the number of interval coefficients.In this paper,we also discuss how to generate templates for itvTCM.Finally,we have implemented itvTCM in the numerical abstract domain library APRON,and conducted experiments.The preliminary experimental results show that itvTCM is useful to capture disjunctive behaviors of a program.