Improving Flow Analyses via CFA Abstract Garbage Collection and - PowerPoint PPT Presentation

Improving Flow Analyses via Γ CFA Abstract Garbage Collection and Counting Matthew Might ∗ Olin Shivers † ∗ Georgia Institute of Technology † Northeastern University ICFP 2006 1

The Big Idea The Process 1. Add garbage collection to a concrete semantics. 2

The Big Idea The Process 1. Add garbage collection to a concrete semantics. 2. Create an abstract interpretation of these semantics. 3

The Big Idea The Process 1. Add garbage collection to a concrete semantics. 2. Create an abstract interpretation of these semantics. The Payoff The abstract GC improves both speed and precision. 4

The Problem: Imprecision in Abstract Interpretation x y {x,y,z} z {w} w Concrete Space Abstract Space Abstract Interpretation Larger space mapped to smaller space: Overlap leads to imprecision. 5

An Example: Analyzing Integer Arithmetic Goal Given an arithmetic expression, safely approximate its sign. 6

An Example: Analyzing Integer Arithmetic Goal Given an arithmetic expression, safely approximate its sign. Example ◮ 4 + 3 could be positive. ◮ 4 - 10 could be negative. ◮ 4 + (3 - 10) could be positive or negative. (Imprecision allowed.) 7

An Example: Analyzing Integer Arithmetic Abstracting the Integers Integers abstract to a singleton set of their sign. Example ◮ | 4 | = { positive } ◮ | 0 | = { zero } ◮ |− 3 | = { negative } 8

An Example: Analyzing Integer Arithmetic Abstracting Addition Addition abstracts “naturally” to sets of signs. Example ◮ { positive } ⊕ { positive } = { positive } ◮ { positive , negative } ⊕ { zero } = { positive , negative } ◮ { positive } ⊕ { negative } = { negative , zero , positive } 9

An Example: Analyzing Integer Arithmetic Example − 4 + 4 Analyze: 10

An Example: Analyzing Integer Arithmetic Example − 4 + 4 Analyze: ⇒ |− 4 | ⊕ | 4 | 11

An Example: Analyzing Integer Arithmetic Example − 4 + 4 Analyze: ⇒ |− 4 | ⊕ | 4 | ⇒ { negative } ⊕ { positive } 12

An Example: Analyzing Integer Arithmetic Example − 4 + 4 Analyze: ⇒ |− 4 | ⊕ | 4 | ⇒ { negative } ⊕ { positive } ⇒ { negative , zero , positive } Imprecision! { zero } is the tightest, safest answer. 13

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... id �→ x �→ (id 3) �→ y �→ (id 4) �→ 14

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) x �→ (id 3) �→ y �→ (id 4) �→ 15

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) 2. Then, 3 flows to x . x �→ 3 (id 3) �→ y �→ (id 4) �→ 16

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) 2. Then, 3 flows to x . x �→ 3 3. Then, 3 flows to y , (id 3) . (id 3) �→ 3 y �→ 3 (id 4) �→ 17

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) 2. Then, 3 flows to x . x �→ 3 , 4 3. Then, 3 flows to y , (id 3) . (id 3) �→ 3 y �→ 3 4. Then, 4 flows to x . (id 4) �→ 18

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) 2. Then, 3 flows to x . x �→ 3 , 4 3. Then, 3 flows to y , (id 3) . (id 3) �→ 3 y �→ 3 4. Then, 4 flows to x . (id 4) �→ 3 , 4 5. Then, 3 or 4 could flow to (id 4) !? Problem Flow analyses overlap different bindings to the same variable. 19

0CFA & Precision Flow analysis question: What “values” could flow to each expression? (let* ((id ( λ (x) x)) (y (id 3))) (id 4)) 0CFA thinks... 1. ( λ (x) x) flows to id . id �→ ( λ (x) x) 2. Then, 3 flows to x . x �→ 3 , 4 3. Then, 3 flows to y , (id 3) . (id 3) �→ 3 y �→ 3 4. Then, 4 flows to x . (id 4) �→ 3 , 4 5. Then, 3 or 4 could flow to (id 4) !? Solution Garbage collect dead bindings mid-analysis. 20

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 21

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Address 22

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Object Address 23

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Object Address GC Root 24

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Object Address GC Root Address 25

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Object Address GC Root Address Object 26

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 Object Address GC Root GC Root Address Object 27

� � � Example: Abstract Garbage Collection 3-address concrete heap. 2-address abstract counterpart. concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 28

� � � Example: Abstract Garbage Collection Next: Allocate object o 2 to address a 3 . Shift root to a 3 . concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 � ˆ a 3 a 3 29

� � � � � Example: Abstract Garbage Collection Next: Allocate object o 3 to address a 2 . Point o 2 to a 2 . concrete abstract ���� ���� ���� ���� o 1 a 1 | o 1 | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ˆ a 2 a 1 , 2 ���� ���� � ���� ���� o 2 a 3 | o 2 | ˆ a 3 30