[PPT] - PA PACE Programming Languages, Architecture and Compilers PowerPoint Presentation

SLIDE 1

Compare Less, Defer More

Scaling Value-Contexts Based Whole-Program Heap Analyses Manas Thakur and V Krishna Nandivada CC 2019

PA PACE

Programming Languages, Architecture and Compilers Education Laboratory

SLIDE 2

Heap analysis

Any analysis that statically approximates information about

the runtime heap of a program.

Usually involves points-to information: which variables may

point to which heap locations.

Examples: (Thread-)escape analysis, shape analysis,

interprocedural control-flow analysis.

1/24

SLIDE 3

Context-sensitivity

Analyze a method in each different context from which it is called.

Call-string based
Object-sensitive
Type-sensitive

2/24

SLIDE 4

Context-sensitivity

Analyze a method in each different context from which it is called.

Call-string based
Object-sensitive
Type-sensitive

Compared to context-insensitive analyses:

Usually more precise

2/24

SLIDE 5

Context-sensitivity

Analyze a method in each different context from which it is called.

Call-string based
Object-sensitive
Type-sensitive

Compared to context-insensitive analyses:

Usually more precise
Usually unscalable

2/24

SLIDE 6

Call-string based context-sensitivity

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

3/24

SLIDE 7

Call-string based context-sensitivity

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

2 contexts for bar
foo 5
foo 6

3/24

SLIDE 8

Call-string based context-sensitivity

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

2 contexts for bar
foo 5
foo 6
4 contexts for fb
foo 5+bar 11
foo 5+bar 12
foo 6+bar 11
foo 6+bar 12

3/24

SLIDE 9

Call-string based context-sensitivity

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

2 contexts for bar
foo 5
foo 6
4 contexts for fb
foo 5+bar 11
foo 5+bar 12
foo 6+bar 11
foo 6+bar 12
In case of recursion?

3/24

SLIDE 10

Value-contexts1

Contexts defined in terms of data-flow values at call-sites.

1Uday P. Khedker and Bageshri Karkare. Efficiency, Precision, Simplicity, and

Generality in Interprocedural Data Flow Analysis: Resurrecting the Classical Call Strings Method. CC 2008. 4/24

SLIDE 11

Value-contexts1

Contexts defined in terms of data-flow values at call-sites.
If the lattice of data-flow values is finite, termination is

guaranteed.

Restrict the unbounded length of call-strings without

sacrificing precision.

1Uday P. Khedker and Bageshri Karkare. Efficiency, Precision, Simplicity, and

Generality in Interprocedural Data Flow Analysis: Resurrecting the Classical Call Strings Method. CC 2008. 4/24

SLIDE 12

Value-contexts: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. A a,b,c,d;... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

Points-to graph

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

Om...

f2 f2

(Line 5)

5/24

SLIDE 13

Value-contexts: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. A a,b,c,d;... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

Points-to graph

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

Om...

f2 f2

(Line 5)

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

O9

f2 f2 f2 f2

Om...

(Line 6)

5/24

SLIDE 14

Value-contexts: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. A a,b,c,d;... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

Points-to graph

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

Om...

f2 f2

(Line 5)

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

O9

f2 f2 f2 f2

Om...

(Line 6)

Value-context

Oa Oi Oj Oc Ol

p this f1 f1 f1 f1 Om...

(Line 5)

5/24

SLIDE 15

Value-contexts: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. A a,b,c,d;... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

Points-to graph

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

Om...

f2 f2

(Line 5)

Oa Oi Ok Oj Oc Ol

a c f1 f1 f1 f1

Ob

b f1 d

O9

f2 f2 f2 f2

Om...

(Line 6)

Value-context

Oa Oi Oj Oc Ol

p this f1 f1 f1 f1 Om...

(Line 5)

Ok

f1

Ob

p this f2 f2

Ol

f1

Om...

(Line 6)

5/24

SLIDE 16

Value-contexts in practice: Escape analysis

We tried using value-contexts to perform whole-program

escape analysis for widely used Java benchmarks.

6/24

SLIDE 17

Value-contexts in practice: Escape analysis

We tried using value-contexts to perform whole-program

escape analysis for widely used Java benchmarks.

For moldyn (the smallest benchmark):
Analysis did not terminate in 3 hours!
Memory consumed at that time: 373 GB!

6/24

SLIDE 18

Problems with value-contexts

SLIDE 19

Problem 1: Too much comparison

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){...} 15.}

Oa Oi Oj Oc Ol

p this f1 f1 f1 f1 Om...

Ok

f1

Ob

p this f2 f2

Ol

f1

Om...

Graph isomorphism is costly (NP).

7/24

SLIDE 20

Insight 1: Relevance

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

The points-to graph reachable only till

p.f1 is relevant for bar (rest is not accessed).

8/24

SLIDE 21

Insight 1: Relevance

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

The points-to graph reachable only till

p.f1 is relevant for bar (rest is not accessed).

Proposal:

Identify and use relevant value-contexts.

8/24

SLIDE 22

Insight 1: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

The points-to graph reachable only

from p.f1 is relevant for bar.

Proposal:

Identify and use relevant value-contexts. Line 5:

Oa Oi Oj Oc Ol

p this f1 f1 f1 f1 Om...

Oa Oi Oj

p f1 f1

Value-context Relevant value-context

9/24

SLIDE 23

Insight 1: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

The points-to graph reachable only

from p.f1 is relevant for bar.

Proposal:

Identify and use relevant value-contexts. Line 6:

Ok

f1

Ob

p this f2 f2

Ol

f1

Om... Ob Ok Ol

p f1 f1

Value-context Relevant value-context

10/24

SLIDE 24

Insight 1: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

The points-to graph reachable only

from p.f1 is relevant for bar.

Proposal:

Identify and use relevant value-contexts. Line 6:

Ok

f1

Ob

p this f2 f2

Ol

f1

Om... Ob Ok Ol

p f1 f1

Value-context Relevant value-context Result: Graphs to be stored/compared significantly smaller.

10/24

SLIDE 25

Problem 2: Too many contexts

Analyzing a method and maintaining summaries in each

context consumes time and memory.

11/24

SLIDE 26

Problem 2: Too many contexts

Analyzing a method and maintaining summaries in each

context consumes time and memory.

The lattice of points-to graphs is large.

11/24

SLIDE 27

Problem 2: Too many contexts

Analyzing a method and maintaining summaries in each

context consumes time and memory.

The lattice of points-to graphs is large.
More contexts also imply comparison with more values at

call-sites.

11/24

SLIDE 28

Insight 2a: Level-summarization

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For a given analysis, even if the relevant

value-context changes, the analysis-result may not be affected.

12/24

SLIDE 29

Insight 2a: Level-summarization

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For a given analysis, even if the relevant

value-context changes, the analysis-result may not be affected.

For bar, O9 escapes only if the object(s)

pointed-to by p or p.f1 escape.

12/24

SLIDE 30

Insight 2a: Level-summarization

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For a given analysis, even if the relevant

value-context changes, the analysis-result may not be affected.

For bar, O9 escapes only if the object(s)

pointed-to by p or p.f1 escape.

Proposal: Compare only the

level-summarized relevant value (LSRV-) contexts.

12/24

SLIDE 31

Insight 2a: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Proposal: Use LSRV-contexts.

13/24

SLIDE 32

Insight 2a: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Proposal: Use LSRV-contexts. Line 5:

Oa Oi Oj

p f1 f1 f1 p D (level 1) D (level 2)

Relevant value-context LSRV-context

13/24

SLIDE 33

Insight 2a: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Proposal: Use LSRV-contexts. Line 5:

Oa Oi Oj

p f1 f1 f1 p D (level 1) D (level 2)

Relevant value-context LSRV-context Line 6:

Ob Ok Ol

p f1 f1 f1 p D (level 1) D (level 2)

Relevant value-context LSRV-context

13/24

SLIDE 34

Insight 2a: Example

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Proposal: Use LSRV-contexts. Line 5:

Oa Oi Oj

p f1 f1 f1 p D (level 1) D (level 2)

Relevant value-context LSRV-context Line 6:

Ob Ok Ol

p f1 f1 f1 p D (level 1) D (level 2)

Relevant value-context LSRV-context Result: bar analyzed only once!

13/24

SLIDE 35

Insight 2b: Caller-ignorable

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Method fb is caller-ignorable.
Caller doesn’t need fb’s analysis.
fb can be analyzed separately.

14/24

SLIDE 36

Insight 2b: Caller-ignorable

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Method fb is caller-ignorable.
Caller doesn’t need fb’s analysis.
fb can be analyzed separately.
Proposal:

Defer the analysis of caller-ignorable methods, and analyze them context-sensitively in a post-pass.

14/24

SLIDE 37

Insight 2b: Caller-ignorable

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

Method fb is caller-ignorable.
Caller doesn’t need fb’s analysis.
fb can be analyzed separately.
Proposal:

Defer the analysis of caller-ignorable methods, and analyze them context-sensitively in a post-pass.

Result:

Time and memory saved during the costly whole-program analysis.

14/24

SLIDE 38

Proposed approach

Pre- analysis Java program Main- analysis Post- analysis Deferred methods +Partial results Access depths Final results 15/24

SLIDE 39

Proposed approach

Pre- analysis Java program Main- analysis Post- analysis Deferred methods +Partial results Access depths Final results

1. Pre-analysis
Flow-insensitive, interprocedural – fast.
For each method, compute the access-depth for each parameter.

15/24

SLIDE 40

Proposed approach

Pre- analysis Java program Main- analysis Post- analysis Deferred methods +Partial results Access depths Final results

1. Pre-analysis
Flow-insensitive, interprocedural – fast.
For each method, compute the access-depth for each parameter.
2. Main-analysis
Context- and flow-sensitive.
Compare only LSRV-contexts and defer caller-ignorable methods.

15/24

SLIDE 41

Proposed approach

Pre- analysis Java program Main- analysis Post- analysis Deferred methods +Partial results Access depths Final results

1. Pre-analysis
Flow-insensitive, interprocedural – fast.
For each method, compute the access-depth for each parameter.
2. Main-analysis
Context- and flow-sensitive.
Compare only LSRV-contexts and defer caller-ignorable methods.
3. Post-analysis
Analyze deferred methods context-sensitively.

15/24

SLIDE 42

Proposed approach

Pre- analysis Java program Main- analysis Post- analysis Deferred methods +Partial results Access depths Final results

1. Pre-analysis
Flow-insensitive, interprocedural – fast.
For each method, compute the access-depth for each parameter.
2. Main-analysis
Context- and flow-sensitive.
Compare only LSRV-contexts and defer caller-ignorable methods.
3. Post-analysis
Analyze deferred methods context-sensitively.

Detailed algorithms in the paper.

15/24

SLIDE 43

Instantiations

1. Escape analysis
Dataflow values: {DoesNotEscape (D), Escapes (E)}.
Meet: D ⊓ D = D, D ⊓ E = E ⊓ D = E ⊓ D = E.
2. Control-flow analysis
Find the types that can flow into each variable.
Applications: call-graph construction, typecast checks, etc.
Dataflow values: Set of all classes in the program.
Meet: Union.

16/24

SLIDE 44

Evaluation

SLIDE 45

Experimental setup

Implementation: Soot optimization framework
Runtime: OpenJDK HotSpot JVM v8
System: 2.3 GHz AMD with 64 cores and 512 GB RAM
Benchmarks: DaCapo 9.12 and JGF

17/24

SLIDE 46

Versions compared

B: Base
Escape analysis2
Control-flow analysis3

2(Value-contexts implementation of) John Whaley and Martin Rinard.

Compositional Pointer and Escape Analysis for Java Programs. OOPSLA 1999.

3Rohan Padhye and Uday P. Khedker. Interprocedural Data Flow Analysis in Soot

Using Value Contexts. SOAP 2013. 18/24

SLIDE 47

Versions compared

B: Base
Escape analysis2
Control-flow analysis3
OM: Only Main (i.e., no trimming of value-contexts)

2(Value-contexts implementation of) John Whaley and Martin Rinard.

Compositional Pointer and Escape Analysis for Java Programs. OOPSLA 1999.

3Rohan Padhye and Uday P. Khedker. Interprocedural Data Flow Analysis in Soot

Using Value Contexts. SOAP 2013. 18/24

SLIDE 48

Versions compared

B: Base
Escape analysis2
Control-flow analysis3
OM: Only Main (i.e., no trimming of value-contexts)
PM: Pre and Main (i.e., no deferring of methods)

2(Value-contexts implementation of) John Whaley and Martin Rinard.

Compositional Pointer and Escape Analysis for Java Programs. OOPSLA 1999.

3Rohan Padhye and Uday P. Khedker. Interprocedural Data Flow Analysis in Soot

Using Value Contexts. SOAP 2013. 18/24

SLIDE 49

Versions compared

B: Base
Escape analysis2
Control-flow analysis3
OM: Only Main (i.e., no trimming of value-contexts)
PM: Pre and Main (i.e., no deferring of methods)
PMP: Pre, Main and Post (i.e., the full proposed version)

2(Value-contexts implementation of) John Whaley and Martin Rinard.

Compositional Pointer and Escape Analysis for Java Programs. OOPSLA 1999.

3Rohan Padhye and Uday P. Khedker. Interprocedural Data Flow Analysis in Soot

Using Value Contexts. SOAP 2013. 18/24

SLIDE 50

Analysis time: Escape analysis

603 3485 204 343 178 183 531 183 1479 267 225 1722 2275 70 87 55 57 157 54 486 192 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Be OMe PMe PMPe

Be: Base
OMe: Only Main
PMe: Pre and Main
PMPe: Pre, Main

and Post

Be and OMe do not terminate for any benchmark.

19/24

SLIDE 51

Analysis time: Escape analysis

603 3485 204 343 178 183 531 183 1479 267 225 1722 2275 70 87 55 57 157 54 486 192 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Be OMe PMe PMPe

Be: Base
OMe: Only Main
PMe: Pre and Main
PMPe: Pre, Main

and Post

Be and OMe do not terminate for any benchmark.
PMe scales better, but still does not terminate for eclipse.

19/24

SLIDE 52

Analysis time: Escape analysis

603 3485 204 343 178 183 531 183 1479 267 225 1722 2275 70 87 55 57 157 54 486 192 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Be OMe PMe PMPe

Be: Base
OMe: Only Main
PMe: Pre and Main
PMPe: Pre, Main

and Post

Be and OMe do not terminate for any benchmark.
PMe scales better, but still does not terminate for eclipse.
With just ∼2 seconds for the pre and post analyses, PMPe scales for all

benchmarks (average ∼28% over PMe).

19/24

SLIDE 53

Analysis time: Control-flow analysis

71 1033 1312 60 58 55 61 130 62 692 151 55 946 988 46 57 53 53 108 53 684 131 1322 1175 1215 929 925 5769 940 1364 231 213 591 222 238 2036 211 351 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Bc OMc PMc PMPc

Bc: Base
OMc: Only Main
PMc: Pre and Main
PMPc: Pre, Main

and Post

Bc and OMc do not terminate for three large benchmarks.

20/24

SLIDE 54

Analysis time: Control-flow analysis

71 1033 1312 60 58 55 61 130 62 692 151 55 946 988 46 57 53 53 108 53 684 131 1322 1175 1215 929 925 5769 940 1364 231 213 591 222 238 2036 211 351 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Bc OMc PMc PMPc

Bc: Base
OMc: Only Main
PMc: Pre and Main
PMPc: Pre, Main

and Post

Bc and OMc do not terminate for three large benchmarks.
PMc scales over all benchmarks.

20/24

SLIDE 55

Analysis time: Control-flow analysis

71 1033 1312 60 58 55 61 130 62 692 151 55 946 988 46 57 53 53 108 53 684 131 1322 1175 1215 929 925 5769 940 1364 231 213 591 222 238 2036 211 351 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Bc OMc PMc PMPc

Bc: Base
OMc: Only Main
PMc: Pre and Main
PMPc: Pre, Main

and Post

Bc and OMc do not terminate for three large benchmarks.
PMc scales over all benchmarks.
PMPc improves over Bc by ∼90%, and over PMc by ∼14% (average).

20/24

SLIDE 56

Analysis time: Control-flow analysis

71 1033 1312 60 58 55 61 130 62 692 151 55 946 988 46 57 53 53 108 53 684 131 1322 1175 1215 929 925 5769 940 1364 231 213 591 222 238 2036 211 351 1 10 100 1000 10000 a v r

r

a b a t i k e c l i p s e l u i n d e x l u s e a r c h m

l

d y n m

n

t e c a r l

p

m d r a y t r a c e r s u n f l

w

g e

m

e a n Time (seconds) Bc OMc PMc PMPc

Bc: Base
OMc: Only Main
PMc: Pre and Main
PMPc: Pre, Main

and Post

Bc and OMc do not terminate for three large benchmarks.
PMc scales over all benchmarks.
PMPc improves over Bc by ∼90%, and over PMc by ∼14% (average).

Otherwise unanalyzable benchmarks in less than 40 minutes.

20/24

SLIDE 57

Peak memory consumption

Bench- Memory (GB) mark Be PMPe Bc PMPc avrora

21

54 11 batik

45
64

eclipse

57
49

luindex

6

58 11 lusearch

10

54 11 pmd

11 127

13 sunflow

21
53

moldyn

6

29 11 montecarlo

6

29 9 raytracer

6

29 10 geomean

13

47 18

21/24

SLIDE 58

Peak memory consumption

Bench- Memory (GB) mark Be PMPe Bc PMPc avrora

21

54 11 batik

45
64

eclipse

57
49

luindex

6

58 11 lusearch

10

54 11 pmd

11 127

13 sunflow

21
53

moldyn

6

29 11 montecarlo

6

29 9 raytracer

6

29 10 geomean

13

47 18

Earlier, systems with very large

memories (∼512GB) were not enough.

Now, a 32-64 GB machine should

be sufficient.

21/24

SLIDE 59

Number of contexts

Bench- Average #contexts mark Be PMPe Bc PMPc avrora

1.4

9.5 1.2 batik

1.4
1.3

eclipse

1.9
1.4

luindex

1.3 10.6

1.2 lusearch

1.3 10.5

1.2 pmd

1.3 11.9

1.2 sunflow

1.3
1.2

moldyn

1.3

9.5 1.3 montecarlo

1.3

9.4 1.2 raytracer

1.3

9.4 1.2 geomean

1.4 10.1

1.2

22/24

SLIDE 60

Number of contexts

Bench- Average #contexts mark Be PMPe Bc PMPc avrora

1.4

9.5 1.2 batik

1.4
1.3

eclipse

1.9
1.4

luindex

1.3 10.6

1.2 lusearch

1.3 10.5

1.2 pmd

1.3 11.9

1.2 sunflow

1.3
1.2

moldyn

1.3

9.5 1.3 montecarlo

1.3

9.4 1.2 raytracer

1.3

9.4 1.2 geomean

1.4 10.1

1.2

1 10 100 1000 10000 #Contexts Methods

pmd-Bc

1 10 100 #Contexts Methods

pmd-PMPc

22/24

SLIDE 61

Number of contexts

Bench- Average #contexts mark Be PMPe Bc PMPc avrora

1.4

9.5 1.2 batik

1.4
1.3

eclipse

1.9
1.4

luindex

1.3 10.6

1.2 lusearch

1.3 10.5

1.2 pmd

1.3 11.9

1.2 sunflow

1.3
1.2

moldyn

1.3

9.5 1.3 montecarlo

1.3

9.4 1.2 raytracer

1.3

9.4 1.2 geomean

1.4 10.1

1.2

1 10 100 1000 10000 #Contexts Methods

pmd-Bc

1 10 100 #Contexts Methods

pmd-PMPc

Significant reduction in #contexts

22/24

SLIDE 62

Number of contexts

Bench- Average #contexts mark Be PMPe Bc PMPc avrora

1.4

9.5 1.2 batik

1.4
1.3

eclipse

1.9
1.4

luindex

1.3 10.6

1.2 lusearch

1.3 10.5

1.2 pmd

1.3 11.9

1.2 sunflow

1.3
1.2

moldyn

1.3

9.5 1.3 montecarlo

1.3

9.4 1.2 raytracer

1.3

9.4 1.2 geomean

1.4 10.1

1.2

1 10 100 1000 10000 #Contexts Methods

pmd-Bc

1 10 100 #Contexts Methods

pmd-PMPc

Significant reduction in #contexts ⇒ Significant reduction in resources spent

22/24

SLIDE 63

Number of contexts

Bench- Average #contexts mark Be PMPe Bc PMPc avrora

1.4

9.5 1.2 batik

1.4
1.3

eclipse

1.9
1.4

luindex

1.3 10.6

1.2 lusearch

1.3 10.5

1.2 pmd

1.3 11.9

1.2 sunflow

1.3
1.2

moldyn

1.3

9.5 1.3 montecarlo

1.3

9.4 1.2 raytracer

1.3

9.4 1.2 geomean

1.4 10.1

1.2

1 10 100 1000 10000 #Contexts Methods

pmd-Bc

1 10 100 #Contexts Methods

pmd-PMPc

Significant reduction in #contexts ⇒ Significant reduction in resources spent ⇒ Scalability.

22/24

SLIDE 64

Comparison with 2obj1h

23/24

SLIDE 65

Comparison with 2obj1h (lower the better)

1659 1530 1549 1505 1505 1951 1505 1594 1588 1462 1460 1487 1485 2126 1488 1572 500 1000 1500 2000 2500 avrora luindex lusearch moldyn montecarlo pmd raytracer geomean #polyCall 2obj1h PMPc 66551 62393 64427 58135 58381 74858 58297 63053 64314 59721 61006 58447 58582 77314 58509 62267 10000 20000 30000 40000 50000 60000 70000 80000 90000 avrora luindex lusearch moldyn montecarlo pmd raytracer geomean #callEdge 2obj1h PMPc

Precision: comparable.

23/24

SLIDE 66

Comparison with 2obj1h (lower the better)

1659 1530 1549 1505 1505 1951 1505 1594 1588 1462 1460 1487 1485 2126 1488 1572 500 1000 1500 2000 2500 avrora luindex lusearch moldyn montecarlo pmd raytracer geomean #polyCall 2obj1h PMPc 66551 62393 64427 58135 58381 74858 58297 63053 64314 59721 61006 58447 58582 77314 58509 62267 10000 20000 30000 40000 50000 60000 70000 80000 90000 avrora luindex lusearch moldyn montecarlo pmd raytracer geomean #callEdge 2obj1h PMPc

Precision: comparable.
Scalability:
2obj1h did not terminate for batik, eclipse and sunflow.
For the rest: LSRV-contexts (PMPc) took 89.2% lesser time

and 59.4% lesser memory.

23/24

SLIDE 67

Conclusion and Future work

Conclusion:

LSRV-contexts scale whole-program context-sensitive analyses without

losing precision.

Identifying relevance of value-contexts is a novel and effective idea.
Evaluation on two non-trivial analyses demonstrates the generality.

24/24

SLIDE 68

Conclusion and Future work

Conclusion:

LSRV-contexts scale whole-program context-sensitive analyses without

losing precision.

Identifying relevance of value-contexts is a novel and effective idea.
Evaluation on two non-trivial analyses demonstrates the generality.

Future work:

Study the cases where the precisions of object-sensitive and call-string based

approaches differ.

Add heap-cloning to value-contexts using the scalable approaches proposed

as part of LSRV-contexts.

24/24

SLIDE 69

Conclusion and Future work

Conclusion:

LSRV-contexts scale whole-program context-sensitive analyses without

losing precision.

Identifying relevance of value-contexts is a novel and effective idea.
Evaluation on two non-trivial analyses demonstrates the generality.

Future work:

Study the cases where the precisions of object-sensitive and call-string based

approaches differ.

Add heap-cloning to value-contexts using the scalable approaches proposed

as part of LSRV-contexts.

Thank you.

24/24

SLIDE 70

Example: Access-depths

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For bar: {this, 0, p, 2}

SLIDE 71

Example: Access-depths

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For bar: {this, 0, p, 2}

⇒ Relevant points-to (sub)graph: ptsto(p), ptsto(p.f1)

SLIDE 72

Example: Access-depths

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For bar: {this, 0, p, 2}

⇒ Relevant points-to (sub)graph: ptsto(p), ptsto(p.f1)

For fb: {this, 0}

SLIDE 73

Example: Access-depths

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For bar: {this, 0, p, 2}

⇒ Relevant points-to (sub)graph: ptsto(p), ptsto(p.f1)

For fb: {this, 0}

⇒ fb is caller-ignorable

SLIDE 74

Example: Access-depths

1. class A {

2. A f1,f2; 3. void foo(){ 4. ... 5. c.bar(a); 6. d.bar(b); 7. } 8. void bar(A p){ 9. A x = new A(); 10. p.f1.f2 = x; 11. p.fb(); 12. p.fb(); 13. } 14. void fb(){ 15. /*Doesn’t access 16. caller’s heap*/ 17. } 18.}

For bar: {this, 0, p, 2}

⇒ Relevant points-to (sub)graph: ptsto(p), ptsto(p.f1)

For fb: {this, 0}

⇒ fb is caller-ignorable

Detailed algorithms for pre, main, and

post analyses in the paper.

SLIDE 75

Static characteristics of benchmarks

Bench- Application #Referred mark #classes size (MB) JDK classes avrora 527 2.7 1588 batik 1038 6.0 3700 eclipse 1608 14.0 2589 luindex 199 1.3 1485 lusearch 198 1.3 1481 pmd 697 4.1 1607 sunflow 225 1.7 3509 moldyn 13 0.15 1555 montecarlo 19 0.67 1555 raytracer 19 0.21 1555

SLIDE 76

Static characteristics of benchmarks

Bench- Application #Referred mark #classes size (MB) JDK classes avrora 527 2.7 1588 batik 1038 6.0 3700 eclipse 1608 14.0 2589 luindex 199 1.3 1485 lusearch 198 1.3 1481 pmd 697 4.1 1607 sunflow 225 1.7 3509 moldyn 13 0.15 1555 montecarlo 19 0.67 1555 raytracer 19 0.21 1555

Sizes range from 150 KB (small programs) to 14 MB (large applications).

SLIDE 77

Analysis time: Pre and Post

Analysis time Bench- (seconds) mark Pre Poste Postc avrora 1.0 0.4 0.5 batik 2.2 1.8 2.4 eclipse 2.7 6.0 6.1 luindex 1.1 0.4 0.7 lusearch 1.0 0.5 0.9 pmd 1.3 0.4 0.7 sunflow 2.1 1.6 2.2 moldyn 0.9 0.4 0.6 montecarlo 0.9 0.4 0.3 raytracer 0.9 0.4 0.3 geomean 1.3 0.7 0.9

Pre-analysis common for both

the instantiations.

SLIDE 78

Analysis time: Pre and Post

Analysis time Bench- (seconds) mark Pre Poste Postc avrora 1.0 0.4 0.5 batik 2.2 1.8 2.4 eclipse 2.7 6.0 6.1 luindex 1.1 0.4 0.7 lusearch 1.0 0.5 0.9 pmd 1.3 0.4 0.7 sunflow 2.1 1.6 2.2 moldyn 0.9 0.4 0.6 montecarlo 0.9 0.4 0.3 raytracer 0.9 0.4 0.3 geomean 1.3 0.7 0.9

Pre-analysis common for both

the instantiations.

The time required for both the

pre and the post analyses is negligible (∼2 seconds).