Widening Polyhedra with Landmarks

Abstract

Abstract. The abstract domain of polyhedra is sufficiently expressive to be deployed in verification. One consequence of the richness of this domain is that long, possibly infinite, sequences of polyhedra can arise in the analysis of loops. Widening and narrowing have been proposed to infer a single polyhedron that summarises such a sequence of polyhedra. Motivated by precision losses encountered in verification, we explain how the classic widening/narrowing approach can be refined by an improved extrapolation strategy. The insight is to record inequalities that are thus far found to be unsatisfiable in the analysis of a loop. These so-called landmarks hint at the amount of widening necessary to reach stability. This extrapolation strategy, which refines widening with thresholds, can infer post-fixpoints that are precise enough not to require narrowing. Unlike previous techniques, our approach interacts well with other domains, is fully automatic, conceptually simple and precise on complex loops.

Abstract acceleration in linear relation analysis

“…A similar idea is developed in [54], which proposes to compute a set of inequalities that are not satisfied while staying in the loop. Unlike the limited widening, this set of constraints is computed dynamically: the computation of the invariant associated to one control point depends on the incoming transitions, and each of these transitions can have a empty contribution.…”

Widening as Abstract Domain

“…This pre-analysis uses the polyhedron abstract domain [9] and requires a way to extract individual inequalities from it. Rather than extracting thresholds, widening with landmarks [17] measures the distance of the current state space to the loop condition and extrapolates the state space accordingly. Both approaches require special domain functions, e.g.…”

“…Commonly, this is implemented by modifying the xpoint algorithm to perform upward and downward iterations while a pre-analysis determines necessary widening points. Firstly, downward iterations can be problematic since a widened state can induce a precision loss in other domains that cannot be reverted with the narrowed numeric state [17]. Secondly, determining a minimal set of widening points requires non-trivial algorithms for irreducible control ow graphs (CFGs) [6].…”

“…Worse, these algorithms cannot be applied in the context of analyzing machine code, as the CFG is re-constructed on-the-y while computing the xpoint [3]. Moreover, narrowing alone is often not enough to obtain precise xpoints which has been illustrated in many papers that present improved widenings/narrowings [10,11,12,15,17]. All of these approaches require disruptive changes to the xpoint engine, for instance, tracking several abstract states [10,12], temporarily disabling parts of the CFG [11], performing a preanalysis with di erent semantics [13,15], collecting \landmarks" [17] or referring to user-supplied thresholds [5].…”

“…Moreover, narrowing alone is often not enough to obtain precise xpoints which has been illustrated in many papers that present improved widenings/narrowings [10,11,12,15,17]. All of these approaches require disruptive changes to the xpoint engine, for instance, tracking several abstract states [10,12], temporarily disabling parts of the CFG [11], performing a preanalysis with di erent semantics [13,15], collecting \landmarks" [17] or referring to user-supplied thresholds [5]. This paper shows that widening and its various re nements can be implemented without modifying an existing xpoint engine, thereby making numeric domains available to analyses that are oblivious to the 1 challenges of widening [1].…”