Taming Pointers A Symbolic Approach Jianwen Zhu - PowerPoint PPT Presentation

Taming Pointers A Symbolic Approach Jianwen Zhu jzhu@eecg.toronto.edu Electrical and Computer Engineering University of Toronto � ’04 – p.1/33 J. Zhu c

Outline An Old Problem A New Strategy Taming Context Sensitivity Result and Conclusion � ’04 – p.2/33 J. Zhu c

What is Pointer Analysis char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 � ’04 – p.3/33 J. Zhu c

What is Pointer Analysis Program variables char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 Named: globals/locals S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 Anonymous: return/malloc S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 t g a S3: return *r; 15 } 16 17 return void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 p h2 q � ’04 – p.3/33 J. Zhu c

What is Pointer Analysis Program variables char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 Named: globals/locals S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 Anonymous: return/malloc S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 Program state: Point-to graph if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 t g a S3: return *r; 15 } 16 17 return void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 p h2 q � ’04 – p.3/33 J. Zhu c

Why Do We Care: Silicon Compiler � ’04 – p.4/33 J. Zhu c

Why Do We Care: Silicon Compiler � ’04 – p.4/33 J. Zhu c

Why Do We Care: Silicon Compiler Fine-grained parallelism Coarse-grained parallelism Feed values to functional Feed data structures to units processors/cores Dependency test Disjoint data structure partition � ’04 – p.4/33 J. Zhu c

Why Do We Care Fine-grained parallelism Coarse-grained parallelism Feed values to functional Feed data structures to units processors Dependency test Disjoint data structure partition � ’04 – p.5/33 J. Zhu c

Precision Landscape Flow and Context char *g, a, h1, h2; 1 void main() { 2 Insensitive Analysis char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 FICS Analysis S2: g = &a; 6 } 7 FSCS Analysis 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 � ’04 – p.6/33 J. Zhu c

Precision Landscape Flow and Context char *g, a, h1, h2; 1 void main() { 2 Insensitive Analysis char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 FICS Analysis S2: g = &a; 6 } 7 FSCS Analysis 8 char* getg( char** r ) { 9 p char **t; 10 S0: t = &g; 11 a if( g == NULL ) 12 q S1: alloc( t, &h2 ); 13 h1 S2: *r = *t; 14 return S3: return *r; 15 } 16 h2 17 t g void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 � ’04 – p.6/33 J. Zhu c

Precision Landscape Flow and Context char *g, a, h1, h2; 1 void main() { 2 Insensitive Analysis char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 FICS Analysis S2: g = &a; 6 } 7 FSCS Analysis 8 char* getg( char** r ) { 9 return char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 t g h2 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 q a S3: return *r; 15 } 16 17 p h1 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 � ’04 – p.6/33 J. Zhu c

Precision Landscape Flow and Context char *g, a, h1, h2; 1 void main() { 2 Insensitive Analysis char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 FICS Analysis S2: g = &a; 6 } 7 FSCS Analysis 8 char* getg( char** r ) { 9 t g a char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 return S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 p h2 S3: return *r; 15 } 16 17 q void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20 � ’04 – p.6/33 J. Zhu c

Why Pointer Analysis is Hard Flow-sensitive analysis Context-sensitive analysis Theory: Chakaravarthy Evil of path POPL ’03 Practice: program state at every program point! Single procedure analysis W.T. dynamic mem W.O. dynamic mem Undecidable W.O. types W.T. types PSPACE-Complete Levels ≥ 2 Levels < 2 PSPACE-Complete in P � ’04 – p.7/33 J. Zhu c

Why Pointer Analysis is Hard Flow-sensitive analysis Context-sensitive analysis Theory: Chakaravarthy Evil of path POPL ’03 getg Practice: program state at main alloc every program point! Single procedure analysis W.T. dynamic mem W.O. dynamic mem Undecidable W.O. types W.T. types PSPACE-Complete Levels ≥ 2 Levels < 2 PSPACE-Complete in P � ’04 – p.7/33 J. Zhu c

Why Pointer Analysis is Hard Flow-sensitive analysis Context-sensitive analysis Theory: Chakaravarthy Evil of path POPL ’03 S1 S1 getg_1 alloc_2 Practice: program state at S0 main_1 every program point! alloc_1 Single procedure analysis W.T. dynamic mem W.O. dynamic mem Undecidable W.O. types W.T. types PSPACE-Complete Levels ≥ 2 Levels < 2 PSPACE-Complete in P � ’04 – p.7/33 J. Zhu c

Why Pointer Analysis is Hard Flow-sensitive analysis Context-sensitive analysis Theory: Chakaravarthy Evil of path POPL ’03 Practice: program state at every program point! 10 15 10 14 10 13 Single procedure analysis 10 12 10 11 10 10 W.T. dynamic mem W.O. dynamic mem Undecidable 10 9 10 8 W.O. types 10 7 W.T. types PSPACE-Complete 10 6 10 5 Levels ≥ 2 Levels < 2 PSPACE-Complete in P 10 4 � ’04 – p.7/33 J. Zhu c

Outline An Old Problem A New Strategy Taming Context Sensitivity Result and Conclusion � ’04 – p.8/33 J. Zhu c

Representing Set Discrete set isomorphic to integer set Given a finite discrete domain D Sufficient to consider D = [0 , n − 1] Consider a set S in domain D : S ⊆ D Characteristic function λ S : D �→ { 0 , 1 } � 0 , if i / ∈ S λ S ( i ) = 1 , if i ∈ S � ’04 – p.9/33 J. Zhu c

Binary Decision Diagram (BDD) D = [0 , 7] x 2 x 1 x 0 λ S S = { 3 , 5 , 7 } 0 0 0 0 λ S = x 2 x 1 x 0 + x 2 x 1 x 0 + x 2 x 1 x 0 0 0 1 0 0 1 0 0 0 1 1 1 1 0 0 0 1 0 1 1 1 1 0 0 1 1 1 1 � ’04 – p.10/33 J. Zhu c

Binary Decision Diagram (BDD) D = [0 , 7] x 2 x 1 x 0 λ S S = { 3 , 5 , 7 } 0 0 0 0 λ S = x 2 x 1 x 0 + x 2 x 1 x 0 + x 2 x 1 x 0 0 0 1 0 0 1 0 0 x 2 0 0 0 0 1 1 1 1 0 1 1 1 x 1 0 0 1 1 0 0 1 1 1 0 0 0 0 1 0 1 0 1 0 1 x 0 1 0 1 1 1 1 0 0 0 0 0 1 0 1 0 1 λ S 1 1 1 1 � ’04 – p.10/33 J. Zhu c

Binary Decision Diagram (BDD) D = [0 , 7] x 2 x 1 x 0 λ S S = { 3 , 5 , 7 } 0 0 0 0 λ S = x 2 x 1 x 0 + x 2 x 1 x 0 + x 2 x 1 x 0 0 0 1 0 0 1 0 0 x 2 0 0 0 0 1 1 1 1 0 1 1 1 x 1 0 0 1 1 0 0 1 1 1 0 0 0 0 1 0 1 0 1 0 1 x 0 1 0 1 1 1 1 0 0 0 0 0 1 0 1 0 1 λ S 1 1 1 1 � ’04 – p.10/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 λ S 0 0 0 1 0 1 0 1 � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 f.then = f.else � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 f.then = f.else � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 f.then = f.else Counterintuitive implications � ’04 – p.11/33 J. Zhu c

Reduced Ordered BDD (ROBDD) Reduction rules 0 0 0 0 1 1 1 1 x 2 (Bryant’86) 0 0 1 1 0 0 1 1 x 1 var in fixed order 0 1 0 1 0 1 0 1 x 0 f.then = g.then, f.else = g.else λ S 0 0 0 1 0 1 0 1 f.then = f.else Counterintuitive implications Paths are evil! � ’04 – p.11/33 J. Zhu c