Region-BasedModel Abstraction课程.pptVIP

Region-BasedModel Abstraction Jeremy Condit Jim Larus Sriram Rajamani Jakob Rehof Model Checking for C# Want to check properties of a C# program e.g., conformance checking for web services The model checking approach: Produce a simplified version of program with respect to the property Check all possible executions of this model Our Abstraction Technique We abstract a program by throwing away irrelevant code Relevant data is identified by a third party Programmer annotations Program analysis Counterexample-driven refinement Relevant statements and expressions are those that deal with relevant data Easy, right? Two Problems Problem 1: Aliasing Statements that affect aliasing can be relevant Why Regions? Two phase alias analysis Static: Identify scope of alias sets Dynamic: Populate alias sets with objects Beneficial for model checker Avoid loss of precision when generating models Produce more precise alias information by exploiting the power of the model checker Solves aliasing and indirection problems Allows fine-grained tuning of trade-off between precision and performance Our Abstraction Based on RegJava Region type system for a Java-like language Includes proof of soundness Given a statement or expression p, we define ?p? to be its abstraction Distinguish three cases: 1. Relevant data 2. References to relevant data 3. All others Example: Expressions Example: Statements Soundness Theorem Theorem: For any execution of the original RegJava program, there is a corresponding execution of the model Proof Sketch: Since we replace occurrences of variables and fields with a choice over the corresponding region, any possible value in the original program will be considered by the model Context-Sensitivity Region type systems make our approach context-sensitive Context-Sensitivity, Part 2 But we still have problems now and then: Context-Sensitivity, Part 3 We can create an even more dynamic model Capturing Correlations Need to represent important correlations in the model