Systematic abstraction of abstract machines

Abstract

We describe a derivational approach to abstract interpretation that yields novel and transparently sound static analyses when applied to well-established abstract machines for higherorder and imperative programming languages. To demonstrate the technique and support our claim, we transform the CEK machine of Felleisen and Friedman (Proc. of the 14th ACM SIGACT-SIGPLAN Symp. Prin. Program. Langs, 1987, pp. 314-325), a lazy variant of Krivine's machine (Higher-Order Symb. Comput. Vol 20, 2007, pp. 199-207), and the stackinspecting CM machine of Clements and Felleisen (ACM Trans. Program. Lang. Syst. Vol 26, 2004Vol 26, , pp. 1029Vol 26, -1052 into abstract interpretations of themselves. The resulting analyses bound temporal ordering of program events; predict return-flow and stack-inspection behavior; and approximate the flow and evaluation of by-need parameters. For all of these machines, we find that a series of well-known concrete machine refactorings, plus a technique of store-allocated continuations, leads to machines that abstract into static analyses simply by bounding their stores. These machines are parameterized by allocation functions that tune performance and precision and substantially expand the space of analyses that this framework can represent. We demonstrate that the technique scales up uniformly to allow static analysis of realistic language features, including tail calls, conditionals, mutation, exceptions, first-class continuations, and even garbage collection. In order to close the gap between formalism and implementation, we provide translations of the mathematics as running Haskell code for the initial development of our method.

Optimizing abstract abstract machines

“…At each step during the initial presentation and development, we evaluate the implementation on a benchmark from Vardoulakis and Shivers [29] that tests distributivity of multiplication over addition on Church numerals. For the step-by-step development, this benchmark is particularly informative:…”

“…Vardoulakis and Shivers evaluate their CFA2 analyzer [29] against a variant of 0-CFA defined in their framework and the example we draw on is the largest benchmark Vardoulakis and Shivers consider. More work would be required to scale the analyzer to the set of features required by our benchmarks.…”

“…church: tests distributivity of multiplication over addition for Church numerals (introduced by [29]). …”

Abstracting abstract control

“…Luckily, there is an alternative to the CFG approach to analysis construction that is based instead on abstract machines, which are one step away from interpreters; they are interderivable in several instances [10]. This alternative, called abstracting abstract machines (AAM) [38], is a simple idea that is generally applicable to even the most dynamic of languages, e.g., JavaScript [21]. A downside is that all effective instantiations of AAM are finite state approximations.…”

Optimizing abstract abstract machines

“…Past approaches to designing program analyses have often featured abstractions that are far removed from the original language semantics, requiring ingenuity in their construction and effort in their verification. The abstracting abstract machines (AAM) approach [30,32] to deriving program analyses provides an alternative: a systematic way of transforming a programming language semantics in the form of an abstract machine into a family of abstract interpreters. It thus reduces the burden of constructing and verifying the soundness of an abstract interpreter.…”