Termination Proofs from Tests Aditya Nori Rahul Sharma

Termination Proofs from Tests Aditya Nori Rahul Sharma MSR India Stanford University

Goal � Prove termination of a program � Program terminates if all loops terminate � Hard problem, undecidable in general � Need to exploit all available information

Tests � Previous techniques are static Tests are a neglected source of information � Tests have previously been used Safety properties, empirical complexity, … � This work, use tests for termination proofs

Example: GCD gcd(int x, int y) assume(x>0 && y>0); while( x!=y ) do if( y > x ) y = y–x; if( x > y) x = x-y; od return x; x=1, y=1 x=2, y=1

Infer-and-Validate Approach … while … … … while … print x print y x=1, y=3 Data ML … while … … assert …

Infer-and-Validate Approach … while … … … while … print x print y x=1, y=3 Data ML … while … … assert …

Instrument the Program gcd(int x, int y) assume(x>0 && y>0); a : = x; b : = y; c : = 0; while( x!=y ) do c : = c + 1; if( y > x ) y : = y–x; if( x > y) x : = x-y; od print ( a, b, c ); � New variables to capture initial values � Introduce a loop counter � Print values of input variables and counter

Infer-and-Validate Approach … while … … … while … print x print y x=1, y=3 Data ML … while … … assert …

Generating Data gcd(int x, int y) assume(x>0 && y>0); a : = x; b : = y; c : = 0; while( x!=y ) do c : = c + 1; if( y > x ) y : = y–x; if( x > y) x : = x-y; od print( a, b, c) �

Infer-and-Validate Approach … while … … … while … print x print y x=1, y=3 Data ML … while … … assert …

Regression �

Quadratic Program (QP) �

Naïve Regression

Quadratic Program

Infer-and-Validate Approach … while … … … while … print x print y x=1, y=3 Data ML … while … … assert …

Verification Burden assume(x>0 && y>0); � a : = x; b : = y; c : = 0; while( x!=y ) do c : = c + 1; if( y > x ) y : = y–x; if( x > y) x : = x-y; assert(c <= a+b-2); od

Regression for Invariant assume(x>0 && y>0); � a : = x; b : = y; c : = 0; while( x!=y ) do print(c, a, b, x, y); c : = c + 1; if( y > x ) y : = y–x; if( x > y) x : = x-y; assert(c <= a+b-2); od

Free Invariant assume(x>0 && y>0); � a: =x; b: =y; c : = 0; free_inv(c<=a+b-x-y); while( x!=y ) do c : = c + 1; if( y > x ) y : = y – x; if( x > y) x : = x-y; assert(c <= a+b-2 ); od

Validate �

Non-linear Example u : = x; v : = y; w : = z; while ( x >= y ) do if ( z > 0 ) z : = z-1; x : = x+z; else y : = y+1; od �

Assertion Checker � Requirements from assertion checker: Handle non-linear arithmetic Consume free invariants Produce tests as counter-examples � Micro-benchmarks: Use SGHAN’ 13 Handles non-linear arithmetic, no counter-examples � Windows Device Drivers: Use Yogi (FSE’ 06) Cannot handle non-linear, produce counter-examples

Micro-benchmarks

Experiments with WDK

Related Work � Regression: Goldsmith et al. ‘ 07 , Huang et al. ’ 10, … � Mining specifications from tests: Dallmeier et al. `12, … � Termination: Cousot `05, Res. Ana, Lee et al. ’ 12, … � Bounds analysis: SPEED, WCET, Gulavani et al. `08, … � Invariant inference: Daikon, Inv. Gen, Nguyen et al. `12, …

Conclusion � Use tests for termination proofs � Infer bounds and invariants using QP � Use off-the-shelf assertion checkers to validate � Future work: disjunctions, non-termination

Disjunctions Example � a = i ; b = j ; while(i<M || j<N) i = i+1; j = j+1;