COMS W4117
Compilers and Translators:
Software Verification Tools
Lecture 10: Pushdown Systems and Temporal Safety
October 4, 2007

Lecture Outline

1. Review
2. Program dependency graphs
3. Context-free language reachability
4. Pushdown systems
5. Reachability in a pushdown system
6. Reading

1. Review

1. Temporal safety and liveness properties
2. Control-flow graphs as finite automata
3. Non-safety properties as finite automata
4. Checking safety properties

2. Program Dependency Graphs

• Consider the following function:

foo() {
   if (p1) {
      Acq;
      Rel;
      foo();
   } else if (p2) {
      Acq;
      foo();
      Rel;
   } else {
      S;
   }
}
    

• Program dependency graph is the flow graph plus a call edge from each call site to the entry of the called function and a return edge from the function exit to the point following call site.
• However, these call and return edges can lead to spurious paths. Therefore, we label the call and return edges by labeled brackets.
• Dyck languages
• The grammar D
   S → [₁ S ]₁ S | [₂ S ]₂ S | ε
generates strings of matching balanced parentheses.
• We can now restrict ourselves to all paths p in the flow graph from ENTRY to any block such that the Dyck labels on the path are a prefix of a sentence in L(D).

3. Context-free Language Reachability

• The context-free language reachability problem is the following: Given a labeled directed graph (N, E) and a context-free language L, is there a labeled path in the graph from node u to node v that spells out a sentence in L.
• Yannakakis [1990] gives an O(|N|³) algorithm to solve this problem.
• Yannakakis also showed that if L is regular, then there is an O(|N| + |E|) algorithm.

4. Pushdown Systems

• A pushdown system consists of:
1. G, a finite set of global states
2. L, a finite set of local/stack symbols
3. (g₀, w₀), an initial configuration where w₀ is in L*
4. A transition relation, →, on (G × L) × (G × L*)
5. Σ, a finite set of input symbols
6. Lbl, a function that maps G × L into Σ ∪ {ε}
• There are three types of transitions mapping configurations to configurations:
1. Next maps (g, s) → (h, t). Here the global state goes from g to h and the symbol s on top of the stack is replaced by t.
2. Call maps (g, s) → (h, uv). Here the global state goes from g to h and the symbol s on top of the stack is replaced by v and then u is pushed on top of v.
3. Return maps (g, s) → (h, ε). Here the global state goes from g to h and the symbol s on top of the stack is popped.
• Example of a boolean program

bool g = T;
main() {
  L0: flip();
  L1: flip();
  L2: assert(g);
}

flip() {
  L3: g = !g;
  L4: ;
}
    

• Transition rules
(T, L0) → (T, L3 L1)
(F, L0) → (F, L3 L1)
(T, L1) → (T, L3 L2)
(F, L1) → (F, L3 L2)
(T, L3) → (F, L4)
(F, L3) → (T, L4)
(T, L4) → (T, ε)
(F, L4) → (F, ε)
• Show that the program goes from configuration (T, L0) to (T, L2)

5. Reachability in a Pushdown System

• Reachability problem: Given a PDS = (G, L, (g₀, w₀), → Σ Lbl) and a g in G, does there exist a stack s in L* such that the PDS in a sequence of zero or more transitions can go from configuration (g₀, w₀) to configuration (g, s).

6. Reading

• Much of this lecture is based on lecture4 in Tom Ball CSE599L: On the Design and Implementation of Static Analysis Tools, Pushdown Systems and Temporal Safety
• M. Yannakakis, Graph-theoretic methods in database theory. PODS 1990, pp. 230-242.