From Object Fields to Local Variables: a Practical Approach to - - PowerPoint PPT Presentation

▶
from object fields to local variables a practical
SMART_READER_LITE
LIVE PREVIEW

From Object Fields to Local Variables: a Practical Approach to - - PowerPoint PPT Presentation

Jun 26, 2023 484 likes •1.28k views

From Object Fields to Local Variables: a Practical Approach to Field-Sensitive Analysis Elvira Albert (1) , Puri Arenas (1) , Samir Genaim (1) , an Puebla (2) and Diana Ram rez (2) Germ (1) Complutense University of Madrid (2) Technical

slide-1
SLIDE 1

From Object Fields to Local Variables: a Practical Approach to Field-Sensitive Analysis

Elvira Albert(1) , Puri Arenas(1), Samir Genaim(1), Germ´ an Puebla(2) and Diana Ram´ ırez(2)

(1) Complutense University of Madrid (2) Technical University of Madrid

17th International Static Analysis Symposium Perpignan, France

Elvira Albert, UCM From Object Fields to Local Variables 1/21

slide-2
SLIDE 2

From Object Fields to Local Variables: a Practical Approach to Field-Sensitive Analysis

Elvira Albert(1) , Puri Arenas(1), Samir Genaim(1), Germ´ an Puebla(2) and Diana Ram´ ırez(2)

(1) Complutense University of Madrid (2) Technical University of Madrid

17th International Static Analysis Symposium Perpignan, France

Elvira Albert, UCM From Object Fields to Local Variables 1/21

slide-3
SLIDE 3

Field-sensitive vs. Field-Insensitive Analysis

Static analysis of object fields (numeric or references) classified:

field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise !

Elvira Albert, UCM From Object Fields to Local Variables 2/21

slide-4
SLIDE 4

Field-sensitive vs. Field-Insensitive Analysis

Static analysis of object fields (numeric or references) classified:

field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise !

Heuristics exist which differ in how the value of fields is modeled

field-based analysis: modeling all instances of a field in a single abstraction. Efficient but imprecise.

Elvira Albert, UCM From Object Fields to Local Variables 2/21

slide-5
SLIDE 5

Field-sensitive vs. Field-Insensitive Analysis

Static analysis of object fields (numeric or references) classified:

field-sensitive - approximate them precise but .... inefficient ! field-insensitive - ignore them efficient but .... imprecise !

Heuristics exist which differ in how the value of fields is modeled

field-based analysis: modeling all instances of a field in a single abstraction. Efficient but imprecise.

Challenge:

develop techniques that have good balance between: accuracy of analysis. computational cost.

Elvira Albert, UCM From Object Fields to Local Variables 2/21

slide-6
SLIDE 6

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information.

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-7
SLIDE 7

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information. How the size of the data involved in loop guards changes when the loop goes through its iterations.

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-8
SLIDE 8

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information. How the size of the data involved in loop guards changes when the loop goes through its iterations. Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain).

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-9
SLIDE 9

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information. How the size of the data involved in loop guards changes when the loop goes through its iterations. Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i< n ) {i++;o.m();} n-i is a ranking function

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-10
SLIDE 10

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information. How the size of the data involved in loop guards changes when the loop goes through its iterations. Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i< n ) {i++;o.m();} n-i is a ranking function while (i< f.n ) {i++;o.m();} f.n-i ranking function?

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-11
SLIDE 11

Field-Sensitive Termination Analysis

Automated techniques for proving termination are typically based on analyses which track size information. How the size of the data involved in loop guards changes when the loop goes through its iterations. Determine (the existence of) a ranking function for the loop (function which strictly decreases on a well-founded domain). while (i< n ) {i++;o.m();} n-i is a ranking function while (i< f.n ) {i++;o.m();} f.n-i ranking function? Data stored in the heap is rather difficult to reason about statically because it is:

shared (i.e., aliases are allowed). mutable (i.e., can be modified multiple times).

Elvira Albert, UCM From Object Fields to Local Variables 3/21

slide-12
SLIDE 12

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < f.n ) { i = i++;

  • .m();

};

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-13
SLIDE 13

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < f.n ) { i = i++;

  • .m();

};

  • 1. Partition the program in fragments (scopes).

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-14
SLIDE 14

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < f.n ) { i = i++;

  • .m();

};

  • 1. Partition the program in fragments (scopes).
  • 2. Model only those fields which behave as local variables.

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-15
SLIDE 15

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < f.n ) { i = i++;

  • .m();

};

  • 1. Partition the program in fragments (scopes).
  • 2. Model only those fields which behave as local variables.
  • 3. Transform the code to replace local fields by variables.

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-16
SLIDE 16

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < v ) { f.n i = i++; v = o.m(v); };

  • 1. Partition the program in fragments (scopes).
  • 2. Model only those fields which behave as local variables.
  • 3. Transform the code to replace local fields by variables.

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-17
SLIDE 17

Field-sensitive by field-insensitive analysis

Overview of our approach:

while (i < v ) { f.n i = i++; v = o.m(v); };

  • 1. Partition the program in fragments (scopes).
  • 2. Model only those fields which behave as local variables.
  • 3. Transform the code to replace local fields by variables.
  • 4. Infer information on the fields through ghost variables.

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-18
SLIDE 18

Field-sensitive by field-insensitive analysis

Overview of our approach:

v = f.n; while (i < v ) { f.n i = i++; v = o.m(v); }; f.n = v ;

  • 1. Partition the program in fragments (scopes).
  • 2. Model only those fields which behave as local variables.
  • 3. Transform the code to replace local fields by variables.
  • 4. Infer information on the fields through ghost variables.

Elvira Albert, UCM From Object Fields to Local Variables 4/21

slide-19
SLIDE 19

Step 1: Proving Locality of Object Fields

Elvira Albert, UCM From Object Fields to Local Variables 5/21

slide-20
SLIDE 20

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-21
SLIDE 21

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i];

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-22
SLIDE 22

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i];

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-23
SLIDE 23

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 1 if (k > 0) x = z; else x = y; x.f=10; for(; i < x.f ; i++) b[i]=x.b[i];

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-24
SLIDE 24

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-25
SLIDE 25

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-26
SLIDE 26

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 2 while (x != null) { for (; x.c < n; x.c ++) value[ x.c ]++; x = x.next; }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-27
SLIDE 27

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 3 while (x.size > 0) { x.size++; y.size - - }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-28
SLIDE 28

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 3 while (x.size > 0) { x.size++; y.size - - }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-29
SLIDE 29

Locality Conditions for Scopes Sufficient Conditions

  • 1. Memory location where the field is stored does not change.
  • 2. All accesses done through the same reference (not aliases).

example 3 while (x.size > 0) { x.size++; y.size - - }

Elvira Albert, UCM From Object Fields to Local Variables 6/21

slide-30
SLIDE 30

Proving Memory Location Constant Reference Constancy Analysis

Associate an access path to constant reference variables.

Elvira Albert, UCM From Object Fields to Local Variables 7/21

slide-31
SLIDE 31

Proving Memory Location Constant Reference Constancy Analysis

Associate an access path to constant reference variables. Given an entry p(l1, . . . , ln), an access path ℓ for a variable y at program point P is a syntactic construction:

ℓany. Variable y might point to any heap location at P. li.f1. . .fh. Variable y always refers to the same heap location represented by li.f1. . .fh whenever P is reached.

Elvira Albert, UCM From Object Fields to Local Variables 7/21

slide-32
SLIDE 32

Proving Memory Location Constant Reference Constancy Analysis

Associate an access path to constant reference variables. Given an entry p(l1, . . . , ln), an access path ℓ for a variable y at program point P is a syntactic construction:

ℓany. Variable y might point to any heap location at P. li.f1. . .fh. Variable y always refers to the same heap location represented by li.f1. . .fh whenever P is reached.

Elvira Albert, UCM From Object Fields to Local Variables 7/21

slide-33
SLIDE 33

Field Sensitive Analysis on Example 1 Compositional Analysis

The analysis is applied compositionally on scopes (SCCs). The global access path is ⊤. The local access path (loop) is constant. S1 =              if (k > 0) x = z; else x =y; x.f=10; for(; i < x.f; i++) b[i]=x.b[i];

  • S2

Elvira Albert, UCM From Object Fields to Local Variables 8/21

slide-34
SLIDE 34

Field Sensitive Analysis on Example 1 Compositional Analysis

The analysis is applied compositionally on scopes (SCCs). The global access path is ⊤. The local access path (loop) is constant. S1 =              if (k > 0) x = z; else x =y; x.f=10; for(; i < x.f; i++) b[i]=x.b[i];

  • S2

⇒ A( S1 , f ) = ⊤ A( S2 , f ) = l1.f

Elvira Albert, UCM From Object Fields to Local Variables 8/21

slide-35
SLIDE 35

Field Sensitive Analysis on Example 1 Compositional Analysis

The analysis is applied compositionally on scopes (SCCs). The global access path is ⊤. The local access path (loop) is constant. S1 =              if (k > 0) x = z; else x =y; x.f=10; for(; i < x.f; i++) b[i]=x.b[i];

  • S2

⇒ A( S1 , f ) = ⊤ A( S2 , f ) = l1.f

Elvira Albert, UCM From Object Fields to Local Variables 8/21

slide-36
SLIDE 36

Field Sensitive Analysis on Example 2 Local Field in Nested Loop

Applying the analysis on nested loops. The global access path (outer loop) is ⊤. The local access path (inner loop) is constant.

S1 =          while (x != null) { S2 for (; x.c < n; x.c++) value[x.c]++; x = x.next; }

Elvira Albert, UCM From Object Fields to Local Variables 9/21

slide-37
SLIDE 37

Field Sensitive Analysis on Example 2 Local Field in Nested Loop

Applying the analysis on nested loops. The global access path (outer loop) is ⊤. The local access path (inner loop) is constant.

S1 =          while (x != null) { S2 for (; x.c < n; x.c++) value[x.c]++; x = x.next; } ⇒ A( S1 , c) = ⊤ A( S2 , c) = l1.c

Elvira Albert, UCM From Object Fields to Local Variables 9/21

slide-38
SLIDE 38

Field Sensitive Analysis on Example 2 Local Field in Nested Loop

Applying the analysis on nested loops. The global access path (outer loop) is ⊤. The local access path (inner loop) is constant.

S1 =          while (x != null) { S2 for (; x.c < n; x.c++) value[x.c]++; x = x.next; } ⇒ A( S1 , c) = ⊤ A( S2 , c) = l1.c

Elvira Albert, UCM From Object Fields to Local Variables 9/21

slide-39
SLIDE 39

Field Sensitive Analysis on Example 3 Non-Local Field

References to the field are constant (Cond 1 met). Multiple references to the field (Cond 2 fails).

Elvira Albert, UCM From Object Fields to Local Variables 10/21

slide-40
SLIDE 40

Field Sensitive Analysis on Example 3 Non-Local Field

References to the field are constant (Cond 1 met). Multiple references to the field (Cond 2 fails). S =        while (x.size > 0) { x.size++; y.size - - } ⇒ A( S , size) = {l1.size, l2.size}

Elvira Albert, UCM From Object Fields to Local Variables 10/21

slide-41
SLIDE 41

Field Sensitive Analysis on Example 3 Non-Local Field

References to the field are constant (Cond 1 met). Multiple references to the field (Cond 2 fails). S =        while (x.size > 0) { x.size++; y.size - - } ⇒ A( S , size) = {l1.size, l2.size}

Elvira Albert, UCM From Object Fields to Local Variables 10/21

slide-42
SLIDE 42

Improved Heuristics (Numeric Fields) Type-Based Heuristics

By looking at the types of fields we can improve heuristics. Numeric fields: allow accesses through more than one path as long as single write access. Distinguish read R(S, f ) and write accesses W (S, f ).

Elvira Albert, UCM From Object Fields to Local Variables 11/21

slide-43
SLIDE 43

Improved Heuristics (Numeric Fields) Type-Based Heuristics

By looking at the types of fields we can improve heuristics. Numeric fields: allow accesses through more than one path as long as single write access. Distinguish read R(S, f ) and write accesses W (S, f ). while ( x.f.size > 0) { i = i + y.size ; x.f.size = x.f.size - 1 }

Elvira Albert, UCM From Object Fields to Local Variables 11/21

slide-44
SLIDE 44

Improved Heuristics (Numeric Fields) Type-Based Heuristics

By looking at the types of fields we can improve heuristics. Numeric fields: allow accesses through more than one path as long as single write access. Distinguish read R(S, f ) and write accesses W (S, f ). while ( x.f.size > 0) { i = i + y.size ; x.f.size = x.f.size - 1 } ⇒ R(S, size) = { l1.f .size , l2.size } W (S, size) = { l1.f .size }

Elvira Albert, UCM From Object Fields to Local Variables 11/21

slide-45
SLIDE 45

Improved Heuristics (Numeric Fields) Type-Based Heuristics

By looking at the types of fields we can improve heuristics. Numeric fields: allow accesses through more than one path as long as single write access. Distinguish read R(S, f ) and write accesses W (S, f ). while ( x.f.size > 0) { i = i + y.size ; x.f.size = x.f.size - 1 } ⇒ R(S, size) = { l1.f .size , l2.size } W (S, size) = { l1.f .size }

Elvira Albert, UCM From Object Fields to Local Variables 11/21

slide-46
SLIDE 46

Improved Heuristics (Numeric Fields) Type-Based Heuristics

By looking at the types of fields we can improve heuristics. Numeric fields: allow accesses through more than one path as long as single write access. Distinguish read R(S, f ) and write accesses W (S, f ). while ( v > 0) { i = i + y.size ; v = v - 1 }

Elvira Albert, UCM From Object Fields to Local Variables 11/21

slide-47
SLIDE 47

Improved Heuristics (Reference Fields) Track References used to Traverse Data Structures

Reference fields: many reference fields, track only those used to traverse data structures! Check that field signature are both in the read and write sets.

Elvira Albert, UCM From Object Fields to Local Variables 12/21

slide-48
SLIDE 48

Improved Heuristics (Reference Fields) Track References used to Traverse Data Structures

Reference fields: many reference fields, track only those used to traverse data structures! Check that field signature are both in the read and write sets.

boolean hasNext() { return ( this.state != null); } void next() { this.state = this.state.rest ; } while (x.hasNext()) x.next(); ⇒ R(S, rest) = l1.state.rest W (S, rest) = ∅ R(S, state) = l1.state W (S, state) = l1.state

Elvira Albert, UCM From Object Fields to Local Variables 12/21

slide-49
SLIDE 49

Improved Heuristics (Reference Fields) Track References used to Traverse Data Structures

Reference fields: many reference fields, track only those used to traverse data structures! Check that field signature are both in the read and write sets.

boolean hasNext() { return ( this.state != null); } void next() { this.state = this.state.rest ; } while (x.hasNext()) x.next(); ⇒ R(S, rest) = l1.state.rest W (S, rest) = ∅ R(S, state) = l1.state W (S, state) = l1.state

Elvira Albert, UCM From Object Fields to Local Variables 12/21

slide-50
SLIDE 50

Improved Heuristics (Reference Fields) Track References used to Traverse Data Structures

Reference fields: many reference fields, track only those used to traverse data structures! Check that field signature are both in the read and write sets.

boolean hasNext() { return ( this.state != null); } void next() { this.state = this.state.rest ; } while (x.hasNext()) x.next(); ⇒ R(S, rest) = l1.state.rest W (S, rest) = ∅ R(S, state) = l1.state W (S, state) = l1.state

Elvira Albert, UCM From Object Fields to Local Variables 12/21

slide-51
SLIDE 51

Improved Heuristics (Reference Fields) Track References used to Traverse Data Structures

Reference fields: many reference fields, track only those used to traverse data structures! Check that field signature are both in the read and write sets.

boolean hasNext() { return ( this.state != null); } void next() { this.state = this.state.rest ; } while (x.hasNext()) x.next(); ⇒ R(S, rest) = l1.state.rest W (S, rest) = ∅ R(S, state) = l1.state W (S, state) = l1.state

Elvira Albert, UCM From Object Fields to Local Variables 12/21

slide-52
SLIDE 52

Step 2: Transform Local Fields to Variables

Elvira Albert, UCM From Object Fields to Local Variables 13/21

slide-53
SLIDE 53

(MonoVariant) Transformation Multiple Local Fields

Transform fields that were proven local into local variables. Since multiple fields, the transformation has to be done on an intermediate representation. s0.size:=s1

Elvira Albert, UCM From Object Fields to Local Variables 14/21

slide-54
SLIDE 54

(MonoVariant) Transformation Multiple Local Fields

Transform fields that were proven local into local variables. Since multiple fields, the transformation has to be done on an intermediate representation. void setSize( int n ){ setSize( this, n, ) ← } this.size = n; } s1:=n } s0.size:=s1 int getSize(){ getSize( this, r ) ← return this.size; }

Elvira Albert, UCM From Object Fields to Local Variables 14/21

slide-55
SLIDE 55

(MonoVariant) Transformation Multiple Local Fields

Transform fields that were proven local into local variables. Since multiple fields, the transformation has to be done on an intermediate representation. void setSize( int n ){ setSize( this, n, ) ← } this.size = n; s0:=this , } s1:=n } s1:=n , s0.size:=s1 s0.size:=s1 . int getSize(){ getSize( this, r ) ← return this.size; }

Elvira Albert, UCM From Object Fields to Local Variables 14/21

slide-56
SLIDE 56

(MonoVariant) Transformation Multiple Local Fields

Transform fields that were proven local into local variables. Since multiple fields, the transformation has to be done on an intermediate representation. void setSize( int n ){ setSize( this, n, ) ← } this.size = n; s0:=this , } s1:=n } s1:=n , s0.size:=s1 s0.size:=s1 . int getSize(){ getSize( this, r ) ← return this.size; s0:=this, } s0:=s0.size, r:=s0.

Elvira Albert, UCM From Object Fields to Local Variables 14/21

slide-57
SLIDE 57

(MonoVariant) Transformation Loops and Conditions

Guarded rules capture conditional statements. Loops are transformed into recursion.

while ( x.f.getSize() > 0) { i += y.getSize(); x.f.setSize(x.f.getSize()-1); }

Elvira Albert, UCM From Object Fields to Local Variables 15/21

slide-58
SLIDE 58

(MonoVariant) Transformation Loops and Conditions

Guarded rules capture conditional statements. Loops are transformed into recursion.

while ( x.f.getSize() > 0) { i += y.getSize(); x.f.setSize(x.f.getSize()-1); } ⇓ while(x, y, i, r) ← s0:=x, s0:=s0.f , getSize(s0, s0) , whilec(x, y, i, s0, r) .

Elvira Albert, UCM From Object Fields to Local Variables 15/21

slide-59
SLIDE 59

(MonoVariant) Transformation Loops and Conditions

Guarded rules capture conditional statements. Loops are transformed into recursion.

while ( x.f.getSize() > 0) { i += y.getSize(); x.f.setSize(x.f.getSize()-1); } ⇓ while(x, y, i, r) ← s0:=x, s0:=s0.f , getSize(s0, s0) , whilec(x, y, i, s0, r) . ⇒ whilec(x, y, i, s0, r) ← s0 ≤ 0 , s0:=i, r:=s0. whilec(x, y, i, s0, r) ← s0 > 0 , s0:=i, s1:=y , .... while(x, y, i, r) .

Elvira Albert, UCM From Object Fields to Local Variables 15/21

slide-60
SLIDE 60

(MonoVariant) Transformation Loops and Conditions

Guarded rules capture conditional statements. Loops are transformed into recursion.

while ( x.f.getSize() > 0) { i += y.getSize(); x.f.setSize(x.f.getSize()-1); } ⇓ while(x, y, i, r) ← s0:=x, s0:=s0.f , getSize(s0, s0) , whilec(x, y, i, s0, r) . ⇒ whilec(x, y, i, s0, r) ← s0 ≤ 0, s0:=i, r:=s0. whilec(x, y, i, s0, r) ← s0 > 0 , s0:=i, s1:=y , .... while(x, y, i, r) .

Elvira Albert, UCM From Object Fields to Local Variables 15/21

slide-61
SLIDE 61

Step 1: Add Arguments to Rules Transform the Head of all Rules

The transformation is applied on scopes for each local field. Unique variable names to the field signatures transformed. setSize(this, n, ) ← v1 s0:=this, s1:=n, s0.size:=s1. getSize(this, r) v1 ← s0:=this, s0:=s0.size, r:=s0.

Elvira Albert, UCM From Object Fields to Local Variables 16/21

slide-62
SLIDE 62

Step 1: Add Arguments to Rules Transform the Head of all Rules

The transformation is applied on scopes for each local field. Unique variable names to the field signatures transformed. setSize(this, n, ) ← v1 s0:=this, s1:=n, s0.size:=s1. ⇒ setSize(this, n, v1 ) s0:=this, s1:=n, s0.size:=s1 getSize(this, r) v1 ← s0:=this, s0:=s0.size, r:=s0.

Elvira Albert, UCM From Object Fields to Local Variables 16/21

slide-63
SLIDE 63

Step 1: Add Arguments to Rules Transform the Head of all Rules

The transformation is applied on scopes for each local field. Unique variable names to the field signatures transformed. setSize(this, n, ) ← v1 s0:=this, s1:=n, s0.size:=s1. ⇒ setSize(this, n, v1 ) s0:=this, s1:=n, s0.size:=s1 getSize(this, r) v1 ← s0:=this, s0:=s0.size, r:=s0. ⇒ getSize(this, v1 ,r) s0:=this, s0:=s0.size, r:=s0

Elvira Albert, UCM From Object Fields to Local Variables 16/21

slide-64
SLIDE 64

Step 2: Replace Object Fields by Variables For each Field Access Instruction

If the field is local, replace the field access by local variable. setSize(this, n, v1 ) ← s0 :=this, s1 :=n, s0.size :=s1. getSize(this, v1 , r) ← s0:=this, s0:= s0.size , r:=s0.

Elvira Albert, UCM From Object Fields to Local Variables 17/21

slide-65
SLIDE 65

Step 2: Replace Object Fields by Variables For each Field Access Instruction

If the field is local, replace the field access by local variable. setSize(this, n, v1 ) ← s0 :=this, s1 :=n, s0.size :=s1. ⇒ setSize(this, n, v1 ) s0 :=this, s1 :=n, v1 :=s1 getSize(this, v1 , r) ← s0:=this, s0:= s0.size , r:=s0.

Elvira Albert, UCM From Object Fields to Local Variables 17/21

slide-66
SLIDE 66

Step 2: Replace Object Fields by Variables For each Field Access Instruction

If the field is local, replace the field access by local variable. setSize(this, n, v1 ) ← s0 :=this, s1 :=n, s0.size :=s1. ⇒ setSize(this, n, v1 ) s0 :=this, s1 :=n, v1 :=s1 getSize(this, v1 , r) ← s0:=this, s0:= s0.size , r:=s0. ⇒ getSize(this, v1 ,r) s0:=this, s0:= v1 , r:=s0

Elvira Albert, UCM From Object Fields to Local Variables 17/21

slide-67
SLIDE 67

Step 3: Calls to Methods For each Call to Method

Add arguments which are local within such scope/method. Proper renaming operation.

whilec(x, y, i, s0, v1 , r, v1 ) ← s0 > 0, s0:=i, s1:=y , ... getSize(s1, s1), v1 s2 :=1, s1 :=s1 s2, setSize(s0, s1, ), v1 while(x, y, i, v1 , r, v1 ).

Elvira Albert, UCM From Object Fields to Local Variables 18/21

slide-68
SLIDE 68

Step 3: Calls to Methods For each Call to Method

Add arguments which are local within such scope/method. Proper renaming operation.

whilec(x, y, i, s0, v1 , r, v1 ) ← s0 > 0, s0:=i, s1:=y , ... getSize(s1, s1), v1 s2 :=1, s1 :=s1 s2, setSize(s0, s1, ), v1 while(x, y, i, v1 , r, v1 ). whilec(x, y, i, s0, v1 , r, v1 ) ← s0 > 0, s0:=i, s1:=y , ... getSize(s1, v1 , s1 ), s2 :=1, s1 :=s1 s2, setSize(s0, s1, v1 ), while(x, y, i, v1 , r, v1 ).

Elvira Albert, UCM From Object Fields to Local Variables 18/21

slide-69
SLIDE 69

Polyvariant Transformation

  • Reference constancy analysis is context-sensitive.
  • Generate multiple versions of code (unique identifiers).
  • Minimization phase to reduce number of versions.

void m(O x, O y) { x.f −− y.f −− } while (x.f > 0) { m(x,x) ; v = m1(v); } while (x.f > 0) { m(x,y) ; m2(x,y) }

Elvira Albert, UCM From Object Fields to Local Variables 19/21

slide-70
SLIDE 70

Polyvariant Transformation

  • Reference constancy analysis is context-sensitive.
  • Generate multiple versions of code (unique identifiers).
  • Minimization phase to reduce number of versions.

void m(O x, O y) { x.f −− y.f −− } while (x.f > 0) { m(x,x) ; v = m1(v); } while (x.f > 0) { m(x,y) ; m2(x,y) } ⇒ int m1(int v) { v −−; v −−; return v; } void m2(O x, O y) { x.f −−; y.f −−; }

Elvira Albert, UCM From Object Fields to Local Variables 19/21

slide-71
SLIDE 71

Polyvariant Transformation

  • Reference constancy analysis is context-sensitive.
  • Generate multiple versions of code (unique identifiers).
  • Minimization phase to reduce number of versions.

void m(O x, O y) { x.f −− y.f −− } while (v > 0) { v = m1(v) ; m(x,x) } while (x.f > 0) { m2(x,y) ; m(x,y) } ⇒ int m1(int v) { v −−; v −−; return v; } void m2(O x, O y) { x.f −−; y.f −−; }

Elvira Albert, UCM From Object Fields to Local Variables 19/21

slide-72
SLIDE 72

Implementation in COSTA

Can be tried out at http://costa.ls.fi.upm.es/costa Bench. Loops Insens Mono Poly Omono Opoly bh 21 16 16 21 1.25 1.50 em3d 13 1 3 13 1.24 1.55 health 11 6 6 11 1.65 2.00 java.util 26 3 24 24 1.62 1.72 java.lang 14 5 13 13 1.38 1.52 java.beans 3 3 3 1.09 1.15 java.math 12 3 11 11 1.05 1.12 java.awt 102 25 100 100 1.21 1.55 java.io 4 2 4 4 2.16 3.47

Elvira Albert, UCM From Object Fields to Local Variables 20/21

slide-73
SLIDE 73

Conclusions

Field sensitiveness considered main challenge in static analyses of OO languages.

Elvira Albert, UCM From Object Fields to Local Variables 21/21

slide-74
SLIDE 74

Conclusions

Field sensitiveness considered main challenge in static analyses of OO languages. Practical approach to field-sensitive analysis which handles all object fields (numeric and references) in a uniform way.

Elvira Albert, UCM From Object Fields to Local Variables 21/21

slide-75
SLIDE 75

Conclusions

Field sensitiveness considered main challenge in static analyses of OO languages. Practical approach to field-sensitive analysis which handles all object fields (numeric and references) in a uniform way. Partition the program into fragments and convert object fields into local variables whenever such conversion is sound.

Elvira Albert, UCM From Object Fields to Local Variables 21/21

slide-76
SLIDE 76

Conclusions

Field sensitiveness considered main challenge in static analyses of OO languages. Practical approach to field-sensitive analysis which handles all object fields (numeric and references) in a uniform way. Partition the program into fragments and convert object fields into local variables whenever such conversion is sound. Context-sensitive analysis able to determine that an object field can be safely replaced by a local variable only for a specific context.

Elvira Albert, UCM From Object Fields to Local Variables 21/21

slide-77
SLIDE 77

Conclusions

Field sensitiveness considered main challenge in static analyses of OO languages. Practical approach to field-sensitive analysis which handles all object fields (numeric and references) in a uniform way. Partition the program into fragments and convert object fields into local variables whenever such conversion is sound. Context-sensitive analysis able to determine that an object field can be safely replaced by a local variable only for a specific context. Combined with a polyvariant transformation achieves a very good balance between accuracy and efficiency.

Elvira Albert, UCM From Object Fields to Local Variables 21/21