Compiler Ggcc

Download Compiler Ggcc

Post on 11-May-2015

711 views

Category:

Technology

0 download

Embed Size (px)

DESCRIPTION

The presentation will start by summarizing some results of the Eureka/ITEA project GGCC (Global GNU Compiler Collection) where Julio collaborated in the design of an open platform for coding rule validation.Then, the presentation continues on ellaboration on the different connections between formal techniques, in a broad sense, and open source software development. Finally, I will discuss how these examples lead naturally to the emergent concept of semantic forge.

TRANSCRIPT

<ul><li>1.The Eureka/ITEA Global GCC ProjectJulio Mari o n(joint work with Guillem Marpons and others)Babel Research Group Universidad Politcnica de Madrid eFOSSA09, Grenoble Mari o et al. (UPM) nGlobal GCC FOSSA, November 2009 1 / 30 </li></ul><p>2. Overview 1 Project Overview2 Coding Rule Validation Structural Rule Validation Domain-specic language: CRISP3 The need for static analysis4 Lessons learned5 The way ahead Mari o et al. (UPM) nGlobal GCC FOSSA, November 2009 2 / 30 3. Context The Global GCC Project (20062008) ITEA-labeled consortium of industrial / research partners Industrial: Mandriva, Bertin, Telefonica I+D, small/medium-sized companies Research labs: INRIA, CEA-LIST, UPMGoal: make the GNU Compiler Collection (GCC) more attractive tothe (european) software industry by transferring academic resultsin three areas: Project-wide static analysis Global optimization Minimise programming hazards by means of coding rulesGlobal GCC knowledge base: integrates heterogeneous informationprovided by the different components of GGCC http://www.ggcc.info Mari o et al. (UPM)n Global GCC FOSSA, November 2009 3 / 30 4. Coding RulesDenition Coding Rules constrain admissible constructs of a language to help produce more reliable and maintainable code.Standard coding rule sets do exist, e.g.: High-Integrity C++ (HICPP): general C++ applications MISRA-C (C language): automotive industry / embedded systemsMany organisations need to write their own rule setsor adapt existing ones. Mari o et al. (UPM) n Global GCC FOSSA, November 2009 4 / 30 5. Coding Rules Some Actual ExamplesDo not call the malloc() function(MISRA-C 20.4) Do not use the inline keyword for member functions (HICPP 3.1.7) Expressions that are effectively Boolean should not be(MISRA-C 12.6) used as operands to operators other than (&amp;&amp;, || and !)If a virtual function in a base class is not overridden in(HICPP 3.3.6) any derived class, then make it non virtualAll automatic variables shall have been assigned a value (MISRA-C 9.1) before being usedBehaviour should be implemented by only one member(HICPP 3.1.9) function in a classMari o et al. (UPM)n Global GCC FOSSA, November 2009 5 / 30 6. Coding Rules Some Actual ExamplesDo not call the malloc() function(MISRA-C 20.4) Do not use the inline keyword for member functions (HICPP 3.1.7) Expressions that are effectively Boolean should not be(MISRA-C 12.6) used as operands to operators other than (&amp;&amp;, || and !)If a virtual function in a base class is not overridden in(HICPP 3.3.6) any derived class, then make it non virtualAll automatic variables shall have been assigned a value (MISRA-C 9.1) before being usedBehaviour should be implemented by only one member(HICPP 3.1.9) function in a classMari o et al. (UPM)n Global GCC FOSSA, November 2009 5 / 30 7. Coding Rules Some Actual ExamplesDo not call the malloc() function(MISRA-C 20.4) Do not use the inline keyword for member functions (HICPP 3.1.7) Expressions that are effectively Boolean should not be(MISRA-C 12.6) used as operands to operators other than (&amp;&amp;, || and !)If a virtual function in a base class is not overridden in(HICPP 3.3.6) any derived class, then make it non virtualAll automatic variables shall have been assigned a value (MISRA-C 9.1) before being usedBehaviour should be implemented by only one member(HICPP 3.1.9) function in a classMari o et al. (UPM)n Global GCC FOSSA, November 2009 5 / 30 8. Coding Rules Some Actual ExamplesDo not call the malloc() function(MISRA-C 20.4) Do not use the inline keyword for member functions (HICPP 3.1.7) Expressions that are effectively Boolean should not be(MISRA-C 12.6) used as operands to operators other than (&amp;&amp;, || and !)If a virtual function in a base class is not overridden in(HICPP 3.3.6) any derived class, then make it non virtualAll automatic variables shall have been assigned a value (MISRA-C 9.1) before being usedBehaviour should be implemented by only one member(HICPP 3.1.9) function in a classMari o et al. (UPM)n Global GCC FOSSA, November 2009 5 / 30 9. Coding Rules Some Actual ExamplesDo not call the malloc() function(MISRA-C 20.4) Do not use the inline keyword for member functions (HICPP 3.1.7) Expressions that are effectively Boolean should not be(MISRA-C 12.6) used as operands to operators other than (&amp;&amp;, || and !)If a virtual function in a base class is not overridden in(HICPP 3.3.6) any derived class, then make it non virtualAll automatic variables shall have been assigned a value (MISRA-C 9.1) before being usedBehaviour should be implemented by only one member(HICPP 3.1.9) function in a classMari o et al. (UPM)n Global GCC FOSSA, November 2009 5 / 30 10. Rule Conformance CheckingProblems with Current Approaches Rules are specied in natural language:AmbiguityAutomatic checking hindered Closed tools Lack of extensibility Proposed Solution Dene a logic based language that allows for precisely specifying rule sets such as MISRA-C or HICPP Use logic programming to get an automatic rule conformance checking procedure Integrate information provided by different program analysesMari o et al. (UPM) n Global GCCFOSSA, November 2009 6 / 30 11. Rule Conformance CheckingProblems with Current Approaches Rules are specied in natural language:AmbiguityAutomatic checking hindered Closed tools Lack of extensibility Proposed Solution Dene a logic based language that allows for precisely specifying rule sets such as MISRA-C or HICPP Use logic programming to get an automatic rule conformance checking procedure Integrate information provided by different program analysesMari o et al. (UPM) n Global GCCFOSSA, November 2009 6 / 30 12. Other ToolsProprietary tools: Compilers: IAR Systems (C) QA: Parasoft, Klocwork, Coverity, Semmle Code (Java)Free software: Checkstyle (Java) Gendarme (ECMA CIL, Mono and .Net)Drawbacks: Lack of appropriate extensibility mechanisms Ambiguity in natural language Interoperability is difcult Mari o et al. (UPM) nGlobal GCCFOSSA, November 2009 7 / 30 13. Motivation: C++ Strange Behavior class A{public :A :: A () { A (); func (); virtual void func ();}};class B : public AB * d = new B ();{ // A :: func or B :: func ? B () : A () {} virtual void func ();};Mari o et al. (UPM)nGlobal GCC FOSSA, November 2009 8 / 30 14. Motivation: C++ Strange Behavior class A{public : A :: A () { A ();func (); virtual void func (); }};class B : public A B * d = new B ();{// A :: func or B :: func ? B () : A () {} virtual void func ();};Coding Rule: Do not invoke virtual methods of the declared class in a constructor or destructor. Mari o et al. (UPM)n Global GCC FOSSA, November 2009 8 / 30 15. C++ strange behavior (2) class Base {}; class Derived : public Base { public :~ Derived () {} };void foo () {Derived * d = new Derived ;delete d ; // c o r r e c t l y calls derived d e s t r u c t o r }void boo () {Derived * d = new Derived ;Base * b = d ;delete b ; // problem ! does not call derived d e s t r u c t o r ! } Mari o et al. (UPM) n Global GCCFOSSA, November 2009 9 / 30 16. C++ strange behavior (2) class Base {}; class Derived : public Base { public :~ Derived () {} };void foo () {Derived * d = new Derived ;delete d ; // c o r r e c t l y calls derived d e s t r u c t o r }void boo () {Derived * d = new Derived ;Base * b = d ;delete b ; // problem ! does not call derived d e s t r u c t o r ! }Rule HICPP 3.3.2 Write a virtual destructor for base classes.Mari o et al. (UPM) n Global GCCFOSSA, November 2009 9 / 30 17. Example Rule Formalisation Rule HICPP 3.3.15 Ensure base classes common to more than one derived class are virtualviolate hicpp 3,3,15(a, b, c, d) b=c direct base of (a, b) direct base of (a, c) base of (b, d) base of (c, d) virtual base of (a, c)Rules are specied in an enriched LP-language with: disequality, quantiers, constructive negation and sorts. Mari o et al. (UPM) nGlobal GCCFOSSA, November 2009 10 / 30 18. Example Extraction of Program Information and Search of ViolationsRule HICPP 3.3.15 in Prologv i o l a t e _ h i c p p _ 3 _ 3 _ 1 5 (A ,B ,C , D ) : -class ( B ) , class ( C ) ,B = C ,class ( D ) , class ( A ) ,direc t_base_ of (A , B ) ,direc t_base_ of (A , C ) ,base_of (B , D ) ,base_of (C , D ) ,+ vi rt u al _b as e _o f (A , C ). class(:: Animal ).class(:: WingedAnimal ). class(:: Mammal ).class(:: Bat ). direct base of (:: Animal , :: Mammal ). direct base of (:: Animal , :: WingedAnimal ). direct base of (:: Mammal , :: Bat ). direct base of (:: WingedAnimal , :: Bat ). virtual base of (:: Animal , :: Mammal ). Mari o et al. (UPM) nGlobal GCCFOSSA, November 200911 / 30 19. Proposed Approach1Formalize rules in a logic-based specication language that is executable: CRISP2Use GCC ?? for gathering necessary program informationMari o et al. (UPM)nGlobal GCCFOSSA, November 2009 12 / 30 20. Our Rule Checking Procedure Coding rulesC++ project (in English)source lesCoding rulesformalized1 Coding rule(s) written once in CRISPC++in the logic-based formalism Coding ruleg++2 Extract program informationcompiler (project build)(+ analysis information if Coding rules Project factsavailable) using GCC, andcompiledstore itin Prolog into Prolog3 Search (using a Prolog Ciao Prologengine) for a counterexampleengineRule viola-tions reportMari o et al. (UPM) n Global GCC FOSSA, November 2009 13 / 30 21. Our Rule Checking Procedure Coding rulesC++ project (in English)source lesCoding rulesformalized1 Coding rule(s) written once in CRISPC++in the logic-based formalism Coding ruleg++2 Extract program informationcompiler (project build)(+ analysis information if Coding rules Project factsavailable) using GCC, andcompiledstore itin Prolog into Prolog3 Search (using a Prolog Ciao Prologengine) for a counterexampleengineRule viola-tions reportMari o et al. (UPM) n Global GCC FOSSA, November 2009 13 / 30 22. Our Rule Checking Procedure Coding rulesC++ project (in English)source lesCoding rulesformalized1 Coding rule(s) written once in CRISPC++in the logic-based formalism Coding ruleg++2 Extract program informationcompiler (project build)(+ analysis information if Coding rules Project factsavailable) using GCC, andcompiledstore itin Prolog into Prolog3 Search (using a Prolog Ciao Prologengine) for a counterexampleengineRule viola-tions reportMari o et al. (UPM) n Global GCC FOSSA, November 2009 13 / 30 23. Our Rule Checking Procedure Coding rulesC++ project (in English)source lesCoding rulesformalized1 Coding rule(s) written once in CRISPC++in the logic-based formalism Coding ruleg++2 Extract program informationcompiler (project build)(+ analysis information if Coding rules Project factsavailable) using GCC, andcompiledstore itin Prolog into Prolog3 Search (using a Prolog Ciao Prologengine) for a counterexampleengineRule viola-tions reportMari o et al. (UPM) n Global GCC FOSSA, November 2009 13 / 30 24. CRISP Building Blocks 1: SortsVariable, DataMember, LocalVariable Function, MemberFunction, Constructor Type, PointerType, Record Scope, Namespace, Record, CompoundStatement Operator ArgumentTypeInFunctionType ClassMember Thing Mari o et al. (UPM) nGlobal GCC FOSSA, November 2009 14 / 30 25. CRISP Building Blocks 2: (Binary) Relations Function callsFunction Record hasImmediateBase Record Variable hasTypeNonFunctionType Function hasTypeFunctionType ThingisDefinedInScope ScopeisNestedIn Scope Record hasMemberMemberFunction Record hasMemberDataMember Record hasBaseRecord Record isPrivateBaseOfRecord Record isVirtualBaseOfRecord PointerTypehasPointedType Type FunctionType hasReturnTypeType Record hasFriendRecord Record hasFriendMemberFunction ClassMemberhasVisibilityVisibility Mari o et al. (UPM) nGlobal GCCFOSSA, November 2009 15 / 30 26. Example of Rule Formalization Rule HICPP 3.3.13:Do not invoke virtual methods of the declared classin a constructor or destructor. Mari o et al. (UPM) n Global GCCFOSSA, November 2009 16 / 30 27. Example of Rule Formalization Rule HICPP 3.3.13:Do not invoke virtual methods of the declared classin a constructor or destructor.ruleHICPP 3.3.13 violated by Caller : MemberFunction; Callee : VirtualFunction whenexists R : Record such that ( R hasMember Caller and R hasMember Callee and ( Caller is Constructor or Caller is Destructor ) and Caller calls+ Callee ) .Mari o et al. (UPM) nGlobal GCC FOSSA, November 2009 16 / 30 28. Formalization of Rule HICPP 3.3.2Rule HICPP 3.3.13:Write a virtual destructor for base classes.ruleHICPP 3.3.2 violated by C : Record whenexists C such that C hasBase C and not exist VD : Destructor such that ( VD isDefinedIn C and VD is VirtualFunction ) . Mari o et al. (UPM) n Global GCCFOSSA, November 2009 17 / 30 29. Auxiliary Sorts and Relations relation F : Function overloads F : Function when exists S : Scope ; N : String such that(F isDefinedIn Sand F isDefinedIn Sand F hasUnqualifiedName Nand F hasUnqualifiedName Nand F = F) . sort M : ClassMember is PrivateClassMember when exists V : Visibility such that(M hasVisibility V and V is private) . Mari o et al. (UPM)nGlobal GCCFOSSA, November 2009 18 / 30 30. Experimental Results P ROJECT KL OC L OAD T IME# V IOLATIONS (C HECKING T IME ) 3.3.13.3.23.3.113.3.15Bacula20 0.24 0 (0.0) 3 (0.0)0 (0.0) 0 (0.0)CLAM46 1.62 1 (0.0) 15 (0.5) 115 (0.1) 0 (0.2)Firebird 439 2.6116 (0.0) 60 (1.0) 115 (0.2) 0 (0.3)IT++39 0.42 0 (0.0) 6 (0.0) 12 (0.0) 0 (0.0)OGRE 209 3.05 0 (0.0) 15 (0.9)79 (0.2) 0 (0.3)Orca89 1.17 1 (0.0) 12 (0.4) 0 (0.1) 0 (0.2)Qt 59510.4215 (0.0) 75 (10.5) 1155 (1.3) 4 (1.2) All times expressed in seconds.Mari o et al. (UPM)n Global GCC FOSSA, November 2009 19 / 30 31. Work in Progress1 Implement / Enrich the CRISP Language2 Implement more rules with information given by other tools3 Open our abstract representation of programs to external toolsMari o et al. (UPM)nGlobal GCCFOSSA, November 2009 20 / 30 32. Implement / enrich the CRISP language Quantication and true negation needed Both performed over certain domains (sorts) Innite domains may appear with templates / generics We have an implementation of constructive intensional negationGoals automatically reorderedExtend CRISP to other languages: Java, Ada, C, Fortran, . . .Mari o et al. (UPM)nGlobal GCC FOSSA, November 2009 21 / 30 33. Integration of Information from External AnalyzersCoding rulesC++ project(in English)source les Coding rules formalizedin CRISPC++ Coding rule g++ compiler(project build) Coding rules Project facts compiledin Prologinto Prolog Ciao Prolog engineRule viola- tions reportMari o et al. (UPM) nGlobal GCC FOSSA, November 2009 22 / 30 34. Integration of Information from External AnalyzersCoding rules C++ project(in English) source les Coding rulesExternal formalizedAnalyzerin CRISPC++ Coding ruleg++ compiler (project build)Translation Knowledge Base about the compiled program Ciao PrologengineRule viola- tions reportMari o et al. (UPM) n Global GCC FOSSA, November 2009 22 / 30 35. Example of New Relation that Needs Specic Analysis relationF : MemberFunction maySelfCall G : MemberFunction when(exists C : Record ; R : Pr...</p>