Abstract Interpretation over Non-lattice Abstract Domains

Abstract

Abstract. The classical theoretical framework for static analysis of programs is abstract interpretation. Much of the power and elegance of that framework rests on the assumption that an abstract domain is a lattice. Nonetheless, and for good reason, the literature on program analysis provides many examples of non-lattice domains, including non-convex numeric domains. The lack of domain structure, however, has negative consequences, both for the precision of program analysis and for the termination of standard Kleene iteration. In this paper we explore these consequences and present general remedies.

ICE: A Robust Framework for Learning Invariants

“…Abstract interpretation has been used for generating invariants over mostly convex domains [2,33], some nonconvex domains [34,35] and more recently even over non-lattice abstract domains [36]. Template based approaches to synthesizing invariants using constraint solvers have been explored in a white-box setting in [28][29][30][31], and we adapt these techniques in Section 4 for developing an ICE-learning algorithm for numerical invariants.…”

Interval Analysis and Machine Arithmetic

“…It is undesirable to widen at every iteration, since it gives away precision too eagerly. However, as observed by Gange et al [2013a], the common practise of widening every n > 1 iteration is unsafe for nonlattice domains such as w-intervals, because it is possible that such a sequence will not terminate. Our implementation performs normal Kleene iteration for the first five steps; if that does not find a fixed point, we begin widening at every step.…”

“…They do not say how to resolve ties when their "union" operation faces a choice, and they repeatedly refer to the "CLP lattice." However, the CLP domain cannot have lattice structure, as it reduces to the wrapped interval domain when the stride is set to 1 [Gange et al 2013a]. Thus an analysis with CLPs faces the termination problems discussed in Section 5, unless some remedial action is taken.…”

“…Our implementation performs normal Kleene iteration for the first five steps; if that does not find a fixed point, we begin widening at every step. Gange et al [2013a] discuss several alternative strategies.…”

“…The necessary specialized algorithms are worthwhile, because it is not uncommon to use repeated joins in program analysis, for example, when analyzing a basic block with more than two predecessor blocks. Using repeated binary joins in such cases will sometimes give weaker results than the generalized approximate least upper bound or greatest lower bound operation [Gange et al 2013a]. Figure 5 presents an algorithm for computing S. Intuitively, the algorithm returns the complement of the largest uncovered gap among intervals from S. It identifies this gap by passing through S once, picking intervals lexicographically by their left bounds.…”