abstract-domain-explorer

Abstract Domain Explorer

Overview

This skill applies abstract interpretation to statically analyze programs using various abstract domains. It infers invariants, value ranges, and relationships between variables without executing the code. Different domains offer different trade-offs between precision and efficiency.

Analysis Workflow

Follow these steps to analyze programs with abstract domains:

1. Select Appropriate Domain(s)

Choose based on analysis goals:

Interval Domain:

• Use for: Range analysis, bounds checking, array indexing
• Precision: Low to medium
• Cost: Very efficient
• Example: Determine if x ∈ [0, 100]

Sign Domain:

• Use for: Sign analysis, division by zero detection
• Precision: Low
• Cost: Very efficient
• Example: Determine if x is positive, negative, or zero

Congruence Domain:

• Use for: Modular arithmetic, alignment analysis
• Precision: Medium (for specific patterns)
• Cost: Efficient
• Example: Determine if x ≡ 0 (mod 4)

Octagon Domain:

• Use for: Relational analysis, loop invariants with simple relationships
• Precision: Medium to high
• Cost: Moderate (O(n³) operations)
• Example: Infer x ≤ y + 5, x + y ≤ 10

Polyhedra Domain:

• Use for: Complex linear relationships, precise invariants
• Precision: High
• Cost: Expensive (exponential worst-case)
• Example: Infer 2x + 3y ≤ z + 10

Reduced Product:

• Use for: Combining strengths of multiple domains
• Precision: Higher than individual domains
• Cost: Sum of component costs
• Example: Intervals × Congruence for precise range with modular constraints

2. Initialize Abstract State

Set initial values for program entry:

• Constants: Exact values (e.g., x = 5 → x ∈ [5, 5])
• Inputs: Top element (e.g., user input → x ∈ [-∞, +∞])
• Uninitialized: Bottom element (unreachable)

Example:

int x = 0;        // x ∈ [0, 0]
int y = input();  // y ∈ [-∞, +∞]

3. Apply Transfer Functions

For each statement, compute abstract semantics: