Context-sensitive.pptVIP

Join Algorithms for the Theory of Uninterpreted Functions Sumit Gulwani Ashish Tiwari George Necula UC-Berkeley SRI UC-Berkeley Definition: Join in theory T E = JoinT(E1,E2) iff E1 )T E and E2 )T E If (E1 )T g) and (E2 )T g), then E )T g E1, E2, E: conjunction of ground facts in theory T g: ground fact in theory T E is the strongest conjunction of ground facts that is implied by both E1 and E2 in theory T Example of Joins LE: Linear Arithmetic with Equality JoinLE(x=1 ? y=4, x=3 ? y=2) = x+y=5 LI: Linear Arithmetic with Inequalities JoinLI(x=1 ? y=4, x=3 ? y=2) = x+y=5 ? 1·x·3 UF: Uninterpreted Functions JoinUF(x=a ? y=F(a), x=b ? y=F(b)) = y=F(x) Motivation: Program Analysis using Abstract Interpretation Join for Uninterpreted Functions is not easy Join(F(a)=a ? F(b)=b ? G(a)=G(b), a=b) = GFi(a)=GFi(b) The result of join is not finitely representable using standard data-structures like EDAGs Relatively Complete Join: Definition Recall, Join(E1,E2): strongest conjunction of ground facts g s.t. E1 )T g and E2 )T g RCJoin(E1,E2,K): strongest conjunction of ground facts g s.t. E1 )T g and E2 )T g and Terms(g) 2 K Example E1: F(a)=a ? F(b)=b ? G(a)=G(b) E2: a=b K: { GF(a),GF(b) } RCJoin(E1,E2,K): GF(a) = GF(b) Relatively Complete Join: Algorithm RCJoin(E1,E2,K): Let D1=EDAG(E1) and D2=EDAG(E2) Extend D1 and D2 to represent K Congruence close D1 and D2 Let D=product construction of D1 and D2 Output D Step 1: Constructing EDAGs E1: F(a)=a ? F(b)=b ? G(a)=G(b) E2: a=b K: { GF(a),GF(b) } Step 2: Extending EDAGs E1: F(a)=a ? F(b)=b ? G(a)=G(b) E2: a=b K: { GF(a),GF(b) } Step 3: Congruence Closure E1: F(a)=a ? F(b)=b ? G(a)=G(b) E2: a=b K: { GF(a),GF(b) } Step 4: Product Construction (Intuition) E1: F(a)=a ? F(b)=b ? G(a)=G(b) E2: a=b K: { GF(a),GF(b) } Step 4: Product Construction (Algorithm) E1: F(a)=a ? F(b)=b ? G(a)=G(b)