From Object Fields to Local Variables: a Practical Approach to Field-Sensitive Analysis Elvira Albert (1) , Puri Arenas (1) , Samir Genaim (1) , an Puebla (2) and Diana Ram´ ırez (2) Germ´ (1) Complutense University of Madrid (2) Technical University of Madrid 17th International Static Analysis Symposium Perpignan, France Elvira Albert, UCM From Object Fields to Local Variables 1/21
From Object Fields to Local Variables: a Practical Approach to Field-Sensitive Analysis Elvira Albert (1) , Puri Arenas (1) , Samir Genaim (1) , an Puebla (2) and Diana Ram´ ırez (2) Germ´ (1) Complutense University of Madrid (2) Technical University of Madrid 17th International Static Analysis Symposium Perpignan, France Elvira Albert, UCM From Object Fields to Local Variables 1/21
Field-sensitive vs. Field-Insensitive Analysis Static analysis of object fields (numeric or references) classified: field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise ! Elvira Albert, UCM From Object Fields to Local Variables 2/21
Field-sensitive vs. Field-Insensitive Analysis Static analysis of object fields (numeric or references) classified: field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise ! Heuristics exist which differ in how the value of fields is modeled field-based analysis : modeling all instances of a field in a single abstraction. Efficient but imprecise . Elvira Albert, UCM From Object Fields to Local Variables 2/21
Field-sensitive vs. Field-Insensitive Analysis Static analysis of object fields (numeric or references) classified: field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise ! Heuristics exist which differ in how the value of fields is modeled field-based analysis : modeling all instances of a field in a single abstraction. Efficient but imprecise . Challenge: develop techniques that have good balance between: accuracy of analysis. computational cost. Elvira Albert, UCM From Object Fields to Local Variables 2/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . How the size of the data involved in loop guards changes when the loop goes through its iterations . Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . How the size of the data involved in loop guards changes when the loop goes through its iterations . Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . How the size of the data involved in loop guards changes when the loop goes through its iterations . Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i < n ) { i++;o.m(); } n-i is a ranking function Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . How the size of the data involved in loop guards changes when the loop goes through its iterations . Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i < n ) { i++;o.m(); } n-i is a ranking function while (i < f.n ) { i++;o.m(); } f.n-i ranking function? Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-Sensitive Termination Analysis Automated techniques for proving termination are typically based on analyses which track size information . How the size of the data involved in loop guards changes when the loop goes through its iterations . Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i < n ) { i++;o.m(); } n-i is a ranking function while (i < f.n ) { i++;o.m(); } f.n-i ranking function? Data stored in the heap is rather difficult to reason about statically because it is: shared (i.e., aliases are allowed). mutable (i.e., can be modified multiple times). Elvira Albert, UCM From Object Fields to Local Variables 3/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < f.n ) { i = i++; o.m() ; } ; Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < f.n ) { i = i++; o.m() ; } ; 1. Partition the program in fragments (scopes). Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < f.n ) { i = i++; o.m() ; } ; 1. Partition the program in fragments (scopes). 2. Model only those fields which behave as local variables . Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < f.n ) { i = i++; o.m() ; } ; 1. Partition the program in fragments (scopes). 2. Model only those fields which behave as local variables . 3. Transform the code to replace local fields by variables. Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < v ) { f.n i = i++; v = o.m(v) ; } ; 1. Partition the program in fragments (scopes). 2. Model only those fields which behave as local variables . 3. Transform the code to replace local fields by variables. Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : while (i < v ) { f.n i = i++; v = o.m(v) ; } ; 1. Partition the program in fragments (scopes). 2. Model only those fields which behave as local variables . 3. Transform the code to replace local fields by variables. 4. Infer information on the fields through ghost variables . Elvira Albert, UCM From Object Fields to Local Variables 4/21
Field-sensitive by field-insensitive analysis Overview of our approach : v = f.n; while (i < v ) { f.n i = i++; v = o.m(v) ; } ; f.n = v ; 1. Partition the program in fragments (scopes). 2. Model only those fields which behave as local variables . 3. Transform the code to replace local fields by variables. 4. Infer information on the fields through ghost variables . Elvira Albert, UCM From Object Fields to Local Variables 4/21
Step 1: Proving Locality of Object Fields Elvira Albert, UCM From Object Fields to Local Variables 5/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i]; Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i]; Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i]; Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; } Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; } Elvira Albert, UCM From Object Fields to Local Variables 6/21
Locality Conditions for Scopes Sufficient Conditions 1. Memory location where the field is stored does not change . 2. All accesses done through the same reference ( not aliases ). example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; } Elvira Albert, UCM From Object Fields to Local Variables 6/21
Recommend
More recommend
