A Scalable Segmented Decision Tree Abstract Domain

ions. Starting from a single initial segment with uninitialized content, segments are split and filled by assignments to arrays elements and joined when merging control flows. A widening may be necessary to merge segments so as to avoid the degenerescence to the case of one element per segment. The bounds of the segments are specified by a set of side-effect free expressions which all have the same concrete value (maybe unknown in the abstract). Segments can be empty thus allowing an array segmentation to encode a disjunction of cases in a way that avoids the explosion of cases. Example 4. The segmentation {0}>{1}0{i}?>{n} of an array A states that 0 < 1 6 i < n, that the values of the array elements A[0], A[i], A[i+1], . . . , A[n-1] are all unknown, while the values of A[1], A[2], . . . , A[i-1], if any, are all initialized to zero. It is possible that i = 1 in which case the segment A[1], . . . , A[i-1] is empty, and i < n so that the segment A[i], . . . , A[n-1] cannot be empty (it contains at least one element). The segmentation {0}>{1}0{i}>{n} is similar but for the fact that i > 1 so that the segment A[1], . . . , A[i-1] cannot be empty. So {0}>{1}0{i}?>{n} is a compact encoding of the disjunctive information ({0}>{1,i}>{n}) ∨ ({0}> {1}0{i}>{n}) distinguishing the first case i = 1 from the second i > 1. Similarly {0}>{1}0{i}?>{n}? is the disjunction ({0}>{1,i,n}) ∨ ({0}> {1,i}>{n}) ∨ ({0}>{1}0{i,n}) ∨ ({0}>{1}0{i}>{n}). Of course, expressivity is limited since it is not possible to express that either i = 1 or i = n but not both (although this might be separately expressible by the abstraction of the simple variables i and n). u t Note that there are no holes in the segmentation since any such hole is just a segment which content is unknown. An enriched semantics of arrays is used viewing an array value as the pair of an index and the value of the corresponding array element. In this way the uniform abstraction used in a segment can relate array values within each segment to their index included between the segment bounds. The array segmentation is implemented as a functor which means that the abstract domains representing sets of expressions and array index-elements abstractions should be passed as parameters to the functor to create a particular instance. The advantage of this approach is that the abstract domain parameters can be changed without having to rewrite the static analyzer. Moreover the static analyzer can optionally perform a reduced product [6] between an instance of the array segmentation functor and the abstract domains that are used for variables appearing in the expressions of the segment bounds. It follows that the array segmentation takes into account both the operations on arrays (array element access and assignment) and operations on variables related to array indexes. 7 Segmented Decision Trees Segmented decision trees are decision trees where the choices are made on the values of variables according to ranges specified by a symbolic segmentation. Example 5. The segmented decision tree (where false < true for booleans) Y ! [-",0] Y ! [-10,1] Y ! [0,0] Y ! [-1,10] Y ! [0,+"] B1: ! true ! X: ! I ! X: ! J ! M ! 0 < I = K ! N 1 < J = K+1 < M ! N can be written in the parenthesized form JB1 : JX {0 < I = K 6 N} : LY ∈ [−∞, 0] M I LY ∈ [−10, 1] M K true JX {1 < J = K + 1 < M 6 N} : LY ∈ [−1, 10] M J LY ∈ [0, 0] M M LY ∈ [0,+∞] M K K This segmented decision tree encodes the fact that if B1 is false (i.e. B1 < true) then if X < I then Y is non-positive while if X > I then −10 6 Y 6 1. Similarly, if B1 is true (i.e. B1 > true) then either X < J and −1 6 Y 6 10, or J 6 X < M and Y is null, or X > M and Y is non-negative. So the leaf nodes specify abstract properties of Y while the decision nodes on B1 and X specifying conditions for these properties to hold. Attached to each decision node, is a side relation on expressions that holds in the concrete under the condition that this node is reached. For example (B1 ∧ 1 < J = K + 1 < M 6 N) ∨ (¬B1 ∧ 0 < I = K 6 N). These expressions are usually in a restricted normal form. In this example the normal form of expressions is an integer constant, a variable, or a variable plus an integer constant and the side relations are those expressible with the octagon abstract domain [20]. The segment bounds are any representative of the equivalent class of expressions which have equal concrete values (so that we could have chosen K for I and K + 1 for J). The abstract domain of side relations is assumed to be expressive enough to maintain such equality information between expressions in normal form (i.e. I = K and J = K + 1). u t As for boolean decision trees, an ordering is imposed on all decision variables. That allows binary operations on decisions trees to operate on the same variable . But unlike binary decision trees, the number of choices for a given variable is not bounded a priori and the choices may be on different criteria (the bounds in the symbolic segmentations) at each node, even if they have the same decision variables. As for simple array segmentation, the ordering of the bounds of each segment describes an order on expressions. That means that segments could describe 5 In addition it may allow to eliminate the nodes with only one child, an optimization we will not apply in this paper. two kinds of informations: a serie of tests deciding what choice to make and a pre-order on some expressions. Unlike for array segmentation, that information would now be relative to the choices above a node in a tree. So we decided to separate the two notions, such that at each node, we have a decision variable, a pre-order and a segmentation that respects the pre-order (instead of prescribing it) and leads to subtrees. A direct consequence is that segments will be much more simple, as that removes the necessity of a ? tag for emptyness or of the lowest and highest bounds of the segmentation. Also, it allows the use of single expressions as bounds instead of sets of expressions. Separating the pre-order information from the decision process allows us to use much more precise domains for the pre-order and leads to more precise unifications of segmentations. But storing a pre-order on all possible expressions that can be used at a given node in the tree might lead to very expensive representations. So we chose instead to rely on reduction with other abstract domains for pre-order information valid at every node in the tree and store at each node the ordering information that we can add to what holds for its father. In that way, if the abstraction of an instruction implies an ordering that is not relevant to the tree, it will not increase the complexity of the tree, but further operations might still use that information from reduction with the other abstract domains. In the drawings and examples, we will represent that information as a set of inequations between expressions, but in practice, depending on the canonical expressions we use, we can implement it in a more efficient way, using for example small octagons if the canonical expressions are of the form ±X+ c with X a variable and c a constant. Also, in order to simplify the presentation, in the schemata, we put all global pre-order information at the root . Definition 1. A segmented decision tree t ∈ T((D, <D),E, Dc, D`) over decision variables in the totally ordered set (D, <D), canonical expressions in E, ordering abstract domain Dc (with concretization γc) and leaf abstract domain D` (with concretization γ`) is either L p M with p an element of D` or J x {C} : t0b1t1 . . . bntn K such that x is the smallest variable in D, each bi (1 6 i 6 n) is an element of E, C is an element of Dc and each ti ∈ T((D\{x}, <D), E, Dc, D`) (0 6 i 6 n). u t To define the concretization of a segmented decision tree, we will write ρ for concrete environments assigning concrete values ρ(x) to variables x and JeKρ for the concrete value of the expression e in the concrete environment ρ. The concretization of a segmented decision tree reduced to a leave is