PA PACE Programming Languages, Architecture and Compilers - PowerPoint PPT Presentation

Compare Less, Defer More Scaling Value-Contexts Based Whole-Program Heap Analyses Manas Thakur and V Krishna Nandivada CC 2019 PA PACE Programming Languages, Architecture and Compilers Education Laboratory

Heap analysis • Any analysis that statically approximates information about the runtime heap of a program. • Usually involves points-to information: which variables may point to which heap locations. • Examples: (Thread-)escape analysis, shape analysis, interprocedural control-flow analysis. 1/24

Context-sensitivity Analyze a method in each different context from which it is called. • Call-string based • Object-sensitive • Type-sensitive 2/24

Context-sensitivity Analyze a method in each different context from which it is called. • Call-string based • Object-sensitive • Type-sensitive Compared to context- insensitive analyses: • Usually more precise 2/24

Context-sensitivity Analyze a method in each different context from which it is called. • Call-string based • Object-sensitive • Type-sensitive Compared to context- insensitive analyses: • Usually more precise • Usually unscalable 2/24

Call-string based context-sensitivity 1. class A { 2. A f1,f2; void foo() { 3. 4. ... 5. c.bar(a); 6. d.bar(b); 7. } void bar(A p) { 8. 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); } 13. 14. void fb() { ... } 15. } 3/24

Call-string based context-sensitivity 1. class A { 2. A f1,f2; • 2 contexts for bar void foo() { 3. 4. ... • foo 5 5. c.bar(a); • foo 6 6. d.bar(b); 7. } void bar(A p) { 8. 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); } 13. 14. void fb() { ... } 15. } 3/24

Call-string based context-sensitivity 1. class A { 2. A f1,f2; • 2 contexts for bar void foo() { 3. 4. ... • foo 5 5. c.bar(a); • foo 6 6. d.bar(b); 7. } • 4 contexts for fb void bar(A p) { 8. • foo 5+bar 11 9. A x = new A(); • foo 5+bar 12 10. p.f1.f2 = x; • foo 6+bar 11 11. p.fb(); • foo 6+bar 12 12. p.fb(); } 13. 14. void fb() { ... } 15. } 3/24

Call-string based context-sensitivity 1. class A { 2. A f1,f2; • 2 contexts for bar void foo() { 3. 4. ... • foo 5 5. c.bar(a); • foo 6 6. d.bar(b); 7. } • 4 contexts for fb void bar(A p) { 8. • foo 5+bar 11 9. A x = new A(); • foo 5+bar 12 10. p.f1.f2 = x; • foo 6+bar 11 11. p.fb(); • foo 6+bar 12 12. p.fb(); } 13. 14. void fb() { ... } • In case of recursion? 15. } 3/24

Value-contexts 1 • Contexts defined in terms of data-flow values at call-sites. 1 Uday P. Khedker and Bageshri Karkare. Efficiency, Precision, Simplicity, and Generality in Interprocedural Data Flow Analysis: Resurrecting the Classical Call Strings Method. CC 2008 . 4/24

Value-contexts 1 • Contexts defined in terms of data-flow values at call-sites. • If the lattice of data-flow values is finite, termination is guaranteed. • Restrict the unbounded length of call-strings without sacrificing precision. 1 Uday P. Khedker and Bageshri Karkare. Efficiency, Precision, Simplicity, and Generality in Interprocedural Data Flow Analysis: Resurrecting the Classical Call Strings Method. CC 2008 . 4/24

Value-contexts: Example Points-to graph 1. class A { 2. A f1,f2; O i f1 3. void foo() { a O a f1 O j 4. A a,b,c,d;... f1 b O b O k f2 5. c.bar(a); O m ... f1 6. d.bar(b); c O c O l f2 f1 } 7. d 8. void bar(A p) { (Line 5) 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb() { ... } 15. } 5/24

Value-contexts: Example Points-to graph 1. class A { 2. A f1,f2; O i f1 3. void foo() { a O a f1 O j 4. A a,b,c,d;... f1 b O b O k f2 5. c.bar(a); O m ... f1 6. d.bar(b); c O c O l f2 f1 } 7. d 8. void bar(A p) { (Line 5) 9. A x = new A(); O i f2 10. p.f1.f2 = x; f1 O 9 a O a 11. p.fb(); f1 O j f2 12. p.fb(); f1 b O b O k f2 13. } O m ... f1 c O c O l f2 14. void fb() { ... } f1 d 15. } (Line 6) 5/24

Value-contexts: Example Points-to graph 1. class A { 2. A f1,f2; Value-context O i f1 3. void foo() { a O a f1 O j 4. A a,b,c,d;... O i f1 f1 p O a b O b O k f2 5. c.bar(a); f1 O j O m ... f1 6. d.bar(b); c O c O l f2 f1 this O c O l f1 O m ... } f1 7. d 8. void bar(A p) { (Line 5) (Line 5) 9. A x = new A(); O i f2 10. p.f1.f2 = x; f1 O 9 a O a 11. p.fb(); f1 O j f2 12. p.fb(); f1 b O b O k f2 13. } O m ... f1 c O c O l f2 14. void fb() { ... } f1 d 15. } (Line 6) 5/24

Value-contexts: Example Points-to graph 1. class A { 2. A f1,f2; Value-context O i f1 3. void foo() { a O a f1 O j 4. A a,b,c,d;... O i f1 f1 p O a b O b O k f2 5. c.bar(a); f1 O j O m ... f1 6. d.bar(b); c O c O l f2 f1 this O c O l f1 O m ... } f1 7. d 8. void bar(A p) { (Line 5) (Line 5) 9. A x = new A(); O i f2 10. p.f1.f2 = x; f1 O 9 a O a 11. p.fb(); f1 O j f2 f1 p O b O k f2 12. p.fb(); f1 b O b O k O m ... f2 f1 13. } O m ... f1 O l f2 this c O c O l f2 14. void fb() { ... } f1 (Line 6) d 15. } (Line 6) 5/24

Value-contexts in practice: Escape analysis • We tried using value-contexts to perform whole-program escape analysis for widely used Java benchmarks. 6/24

Value-contexts in practice: Escape analysis • We tried using value-contexts to perform whole-program escape analysis for widely used Java benchmarks. • For moldyn (the smallest benchmark): • Analysis did not terminate in 3 hours! • Memory consumed at that time: 373 GB! 6/24

Problems with value-contexts

Problem 1: Too much comparison 1. class A { 2. A f1,f2; void foo() { 3. 4. ... 5. c.bar(a); O i f1 p O a 6. d.bar(b); f1 f1 O j p O b O k f2 O m ... 7. } f1 f2 this O c O l f1 O m ... O l void bar(A p) { 8. f1 this 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); Graph isomorphism is costly (NP). 12. p.fb(); } 13. 14. void fb() { ... } 15. } 7/24

Insight 1: Relevance 1. class A { 2. A f1,f2; void foo() { 3. 4. ... 5. c.bar(a); 6. d.bar(b); • The points-to graph reachable only till } 7. p.f1 is relevant for bar (rest is not void bar(A p) { 8. accessed ). 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); } 13. 14. void fb() { 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18. } 8/24

Insight 1: Relevance 1. class A { 2. A f1,f2; void foo() { 3. 4. ... 5. c.bar(a); 6. d.bar(b); • The points-to graph reachable only till } 7. p.f1 is relevant for bar (rest is not void bar(A p) { 8. accessed ). 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); • Proposal: } 13. Identify and use relevant value-contexts. 14. void fb() { 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18. } 8/24

Insight 1: Example 1. class A { 2. A f1,f2; void foo() { 3. • The points-to graph reachable only 4. ... from p.f1 is relevant for bar . 5. c.bar(a); 6. d.bar(b); • Proposal: } 7. Identify and use relevant value-contexts. void bar(A p) { 8. 9. A x = new A(); Line 5: 10. p.f1.f2 = x; 11. p.fb(); O i f1 p O a 12. p.fb(); f1 O j O i f1 } 13. p O a this O c O l f1 O m ... f1 O j 14. void fb() { f1 15. /*Doesn’t access 16. caller’s heap*/ Value-context Relevant value-context 17. } 18. } 9/24

Insight 1: Example 1. class A { 2. A f1,f2; • The points-to graph reachable only void foo() { 3. from p.f1 is relevant for bar . 4. ... 5. c.bar(a); • Proposal: 6. d.bar(b); Identify and use relevant value-contexts. } 7. void bar(A p) { Line 6: 8. 9. A x = new A(); f1 p O b O k O k 10. p.f1.f2 = x; f2 f1 O m ... f1 p O b 11. p.fb(); O l f2 f1 O l this 12. p.fb(); } 13. Value-context Relevant value-context 14. void fb() { 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18. } 10/24

Insight 1: Example 1. class A { 2. A f1,f2; • The points-to graph reachable only void foo() { 3. from p.f1 is relevant for bar . 4. ... 5. c.bar(a); • Proposal: 6. d.bar(b); Identify and use relevant value-contexts. } 7. void bar(A p) { Line 6: 8. 9. A x = new A(); f1 p O b O k O k 10. p.f1.f2 = x; f2 f1 O m ... f1 p O b 11. p.fb(); O l f2 f1 O l this 12. p.fb(); } 13. Value-context Relevant value-context 14. void fb() { 15. /*Doesn’t access Result: 16. caller’s heap*/ Graphs to be stored/compared significantly 17. } smaller. 18. } 10/24

Problem 2: Too many contexts • Analyzing a method and maintaining summaries in each context consumes time and memory. 11/24

Problem 2: Too many contexts • Analyzing a method and maintaining summaries in each context consumes time and memory. • The lattice of points-to graphs is large. 11/24

Problem 2: Too many contexts • Analyzing a method and maintaining summaries in each context consumes time and memory. • The lattice of points-to graphs is large. • More contexts also imply comparison with more values at call-sites. 11/24

Insight 2a: Level-summarization 1. class A { 2. A f1,f2; void foo() { 3. 4. ... 5. c.bar(a); • For a given analysis, even if the relevant 6. d.bar(b); value-context changes, the } 7. analysis-result may not be affected. void bar(A p) { 8. 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); } 13. 14. void fb() { 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18. } 12/24