Taming Pointers A Symbolic Approach Jianwen Zhu - - PowerPoint PPT Presentation

▶
taming pointers
SMART_READER_LITE
LIVE PREVIEW

Taming Pointers A Symbolic Approach Jianwen Zhu - - PowerPoint PPT Presentation

Apr 15, 2023 413 likes •1.43k views

Taming Pointers A Symbolic Approach Jianwen Zhu jzhu@eecg.toronto.edu Electrical and Computer Engineering University of Toronto 04 p.1/33 J. Zhu c Outline An Old Problem A New Strategy Taming Context Sensitivity Result and

slide-1
SLIDE 1

Taming Pointers

A Symbolic Approach

Jianwen Zhu

jzhu@eecg.toronto.edu

Electrical and Computer Engineering University of Toronto

  • J. Zhu c

’04 – p.1/33

slide-2
SLIDE 2

Outline

An Old Problem A New Strategy Taming Context Sensitivity Result and Conclusion

  • J. Zhu c

’04 – p.2/33

slide-3
SLIDE 3

What is Pointer Analysis

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

  • J. Zhu c

’04 – p.3/33

slide-4
SLIDE 4

What is Pointer Analysis

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Program variables

Named: globals/locals Anonymous: return/malloc

return h2 g a p t q

  • J. Zhu c

’04 – p.3/33

slide-5
SLIDE 5

What is Pointer Analysis

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Program variables

Named: globals/locals Anonymous: return/malloc

return h2 g a p t q

Program state: Point-to graph

  • J. Zhu c

’04 – p.3/33

slide-6
SLIDE 6

Why Do We Care: Silicon Compiler

  • J. Zhu c

’04 – p.4/33

slide-7
SLIDE 7

Why Do We Care: Silicon Compiler

  • J. Zhu c

’04 – p.4/33

slide-8
SLIDE 8

Why Do We Care: Silicon Compiler

Fine-grained parallelism

Feed values to functional units Dependency test

Coarse-grained parallelism

Feed data structures to processors/cores Disjoint data structure partition

  • J. Zhu c

’04 – p.4/33

slide-9
SLIDE 9

Why Do We Care

Fine-grained parallelism

Feed values to functional units Dependency test

Coarse-grained parallelism

Feed data structures to processors Disjoint data structure partition

  • J. Zhu c

’04 – p.5/33

slide-10
SLIDE 10

Precision Landscape

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Flow and Context Insensitive Analysis FICS Analysis FSCS Analysis

  • J. Zhu c

’04 – p.6/33

slide-11
SLIDE 11

Precision Landscape

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Flow and Context Insensitive Analysis FICS Analysis FSCS Analysis

return a h1 h2 g p q t

  • J. Zhu c

’04 – p.6/33

slide-12
SLIDE 12

Precision Landscape

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Flow and Context Insensitive Analysis FICS Analysis FSCS Analysis

return a h2 g p h1 q t

  • J. Zhu c

’04 – p.6/33

slide-13
SLIDE 13

Precision Landscape

char *g, a, h1, h2; 1 void main() { 2 char *p, *q; 3 S0: alloc( &p, &h1 ); 4 S1: p = getg( &q ); 5 S2: g = &a; 6 } 7 8 char* getg( char** r ) { 9 char **t; 10 S0: t = &g; 11 if( g == NULL ) 12 S1: alloc( t, &h2 ); 13 S2: *r = *t; 14 S3: return *r; 15 } 16 17 void alloc( char** f, char* h ) { 18 S0: *f = h; 19 } 20

Flow and Context Insensitive Analysis FICS Analysis FSCS Analysis

return h2 g a p t q

  • J. Zhu c

’04 – p.6/33

slide-14
SLIDE 14

Why Pointer Analysis is Hard

Flow-sensitive analysis

Theory: Chakaravarthy POPL ’03 Practice: program state at every program point!

Single procedure analysis W.T. dynamic mem W.O. dynamic mem W.T. types W.O. types Levels ≥ 2 Levels < 2 PSPACE-Complete PSPACE-Complete Undecidable in P

Context-sensitive analysis

Evil of path

  • J. Zhu c

’04 – p.7/33

slide-15
SLIDE 15

Why Pointer Analysis is Hard

Flow-sensitive analysis

Theory: Chakaravarthy POPL ’03 Practice: program state at every program point!

Single procedure analysis W.T. dynamic mem W.O. dynamic mem W.T. types W.O. types Levels ≥ 2 Levels < 2 PSPACE-Complete PSPACE-Complete Undecidable in P

Context-sensitive analysis

Evil of path

main getg alloc

  • J. Zhu c

’04 – p.7/33

slide-16
SLIDE 16

Why Pointer Analysis is Hard

Flow-sensitive analysis

Theory: Chakaravarthy POPL ’03 Practice: program state at every program point!

Single procedure analysis W.T. dynamic mem W.O. dynamic mem W.T. types W.O. types Levels ≥ 2 Levels < 2 PSPACE-Complete PSPACE-Complete Undecidable in P

Context-sensitive analysis

Evil of path

main_1 getg_1 S1 alloc_1 S0 alloc_2 S1

  • J. Zhu c

’04 – p.7/33

slide-17
SLIDE 17

Why Pointer Analysis is Hard

Flow-sensitive analysis

Theory: Chakaravarthy POPL ’03 Practice: program state at every program point!

Single procedure analysis W.T. dynamic mem W.O. dynamic mem W.T. types W.O. types Levels ≥ 2 Levels < 2 PSPACE-Complete PSPACE-Complete Undecidable in P

Context-sensitive analysis

Evil of path

104 105 106 107 108 109 1010 1011 1012 1013 1014 1015

  • J. Zhu c

’04 – p.7/33

slide-18
SLIDE 18

Outline

An Old Problem A New Strategy Taming Context Sensitivity Result and Conclusion

  • J. Zhu c

’04 – p.8/33

slide-19
SLIDE 19

Representing Set

Discrete set isomorphic to integer set Given a finite discrete domain D

Sufficient to consider D = [0, n − 1]

Consider a set S in domain D: S ⊆ D Characteristic function λS : D → {0, 1} λS(i) =

  • 0, if i /

∈ S 1, if i ∈ S

  • J. Zhu c

’04 – p.9/33

slide-20
SLIDE 20

Binary Decision Diagram (BDD)

x2 x1 x0 λS 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 D = [0, 7] S = {3, 5, 7} λS = x2x1x0 + x2x1x0 + x2x1x0

  • J. Zhu c

’04 – p.10/33

slide-21
SLIDE 21

Binary Decision Diagram (BDD)

x2 x1 x0 λS 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 D = [0, 7] S = {3, 5, 7} λS = x2x1x0 + x2x1x0 + x2x1x0 x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.10/33

slide-22
SLIDE 22

Binary Decision Diagram (BDD)

x2 x1 x0 λS 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 D = [0, 7] S = {3, 5, 7} λS = x2x1x0 + x2x1x0 + x2x1x0 x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.10/33

slide-23
SLIDE 23

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.11/33

slide-24
SLIDE 24

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.11/33

slide-25
SLIDE 25

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.11/33

slide-26
SLIDE 26

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.11/33

slide-27
SLIDE 27

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1

  • J. Zhu c

’04 – p.11/33

slide-28
SLIDE 28

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1 Counterintuitive implications

  • J. Zhu c

’04 – p.11/33

slide-29
SLIDE 29

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1 Counterintuitive implications

Paths are evil!

  • J. Zhu c

’04 – p.11/33

slide-30
SLIDE 30

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1 Counterintuitive implications

Paths are evil! Size of a set ∝ number of its elements!

  • J. Zhu c

’04 – p.11/33

slide-31
SLIDE 31

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1 Counterintuitive implications

Paths are evil! Size of a set ∝ number of its elements!

  • J. Zhu c

’04 – p.11/33

slide-32
SLIDE 32

Reduced Ordered BDD (ROBDD)

Reduction rules (Bryant’86)

var in fixed order f.then = g.then, f.else = g.else f.then = f.else

x2 1 1 1 1 x1 1 1 1 1 x0 1 1 1 1 λS 1 1 1 Counterintuitive implications

Paths are evil! Size of a set ∝ number of its elements!

  • J. Zhu c

’04 – p.11/33

slide-33
SLIDE 33

Representing Relation

Relation R ⊆ A × B

Nothing but a set! Characteristic function λR : A × B → {0, 1}

λR(i, j) =

✂✁ ✄

0, if i, j / ∈ R 1, if i, j ∈ R

Consider graph V, E

Let V 0, V 1 be two Boolean spaces for V Let V 0

i , V 1 j be the ith, jth

minterms of V 0, V 1 Product term V 0

i V 1 j

represents an edge

  • J. Zhu c

’04 – p.12/33

slide-34
SLIDE 34

Representing Relation

Relation R ⊆ A × B

Nothing but a set! Characteristic function λR : A × B → {0, 1}

λR(i, j) =

✂✁ ✄

0, if i, j / ∈ R 1, if i, j ∈ R

1 2 3 4 5 6 7

Consider graph V, E

Let V 0, V 1 be two Boolean spaces for V Let V 0

i , V 1 j be the ith, jth

minterms of V 0, V 1 Product term V 0

i V 1 j

represents an edge

  • J. Zhu c

’04 – p.12/33

slide-35
SLIDE 35

Representing Relation

Relation R ⊆ A × B

Nothing but a set! Characteristic function λR : A × B → {0, 1}

λR(i, j) =

✂✁ ✄

0, if i, j / ∈ R 1, if i, j ∈ R

1 2 3 4 5 6 7

Consider graph V, E

Let V 0, V 1 be two Boolean spaces for V Let V 0

i , V 1 j be the ith, jth

minterms of V 0, V 1 Product term V 0

i V 1 j

represents an edge

λE = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

  • J. Zhu c

’04 – p.12/33

slide-36
SLIDE 36

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

Exercise: Finding successors

  • J. Zhu c

’04 – p.13/33

slide-37
SLIDE 37

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

Exercise: Finding successors

  • J. Zhu c

’04 – p.13/33

slide-38
SLIDE 38

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

Exercise: Finding successors

1 2 3 4 5 6 7

  • J. Zhu c

’04 – p.13/33

slide-39
SLIDE 39

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

1 2 3 4 5 6 7

Exercise: Finding successors

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1

  • J. Zhu c

’04 – p.13/33

slide-40
SLIDE 40

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

1 2 3 4 5 6 7

Exercise: Finding successors

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1

Step 1: s∧r = V 0

1 V 1 4

  • J. Zhu c

’04 – p.13/33

slide-41
SLIDE 41

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

1 2 3 4 5 6 7

Exercise: Finding successors

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1

Step 1: s∧r = V 0

1 V 1 4

Step 2: ∃V 0.s ∧ r = V 1

4

  • J. Zhu c

’04 – p.13/33

slide-42
SLIDE 42

Symbolic Computation

First order logic in BDD

Negation: ¬f Conjunction: f ∧ g Disjunction: f ∨ g Existential abstraction: ∃Di.f Substitution: f|Di→Dj Polynomial to BDD size

1 2 3 4 5 6 7

Exercise: Finding successors

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1

Step 1: s∧r = V 0

1 V 1 4

Step 2: ∃V 0.s ∧ r = V 1

4

Step 3: [∃V 0.s ∧ r]|V 1→V 0 = V 0

4

  • J. Zhu c

’04 – p.13/33

slide-43
SLIDE 43

Image Computation

s can be just a set Image (output) of a set (input) under a function

1 2 3 4 5 6 7

Exercise again

  • J. Zhu c

’04 – p.14/33

slide-44
SLIDE 44

Image Computation

s can be just a set Image (output) of a set (input) under a function

1 2 3 4 5 6 7

Exercise again

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1 + V 0 2 + V 0 3

  • J. Zhu c

’04 – p.14/33

slide-45
SLIDE 45

Image Computation

s can be just a set Image (output) of a set (input) under a function

1 2 3 4 5 6 7 1 2 3 4 5 6 7

Exercise again

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1 + V 0 2 + V 0 3

Step 1: s ∧ r = V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

Step 2: ∃V 0.s ∧ r = V 1

4 + V 1 5 + V 1 6

Step 3: [∃V 0.s ∧ r]|V 1→V 0 = V 0

4 + V 0 5 + V 0 6

  • J. Zhu c

’04 – p.14/33

slide-46
SLIDE 46

Image Computation

s can be just a set Image (output) of a set (input) under a function

1 2 3 4 5 6 7 1 2 3 4 5 6 7

Does not have to be slower! Exercise again

Given r = V 0

0 V 1 1 + V 0 0 V 1 2 + V 0 0 V 1 3

+ V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

+ V 0

4 V 1 7 + V 0 5 V 1 7 + V 0 6 V 1 7

s = V 0

1 + V 0 2 + V 0 3

Step 1: s ∧ r = V 0

1 V 1 4 + V 0 2 V 1 5 + V 0 3 V 1 6

Step 2: ∃V 0.s ∧ r = V 1

4 + V 1 5 + V 1 6

Step 3: [∃V 0.s ∧ r]|V 1→V 0 = V 0

4 + V 0 5 + V 0 6

  • J. Zhu c

’04 – p.14/33

slide-47
SLIDE 47

Graph Reachability

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

Key for success of model checking Algorithm

reachable( s : V 0, g : V 0 × V 1 ) 1 : V 0 { 2 var image, reached : V 0; 3 image = s; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached ; 11 } 12

  • J. Zhu c

’04 – p.15/33

slide-48
SLIDE 48

Graph Reachability

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

Key for success of model checking Algorithm

reachable( s : V 0, g : V 0 × V 1 ) 1 : V 0 { 2 var image, reached : V 0; 3 image = s; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached ; 11 } 12

  • J. Zhu c

’04 – p.15/33

slide-49
SLIDE 49

Graph Reachability

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

Key for success of model checking Algorithm

reachable( s : V 0, g : V 0 × V 1 ) 1 : V 0 { 2 var image, reached : V 0; 3 image = s; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached ; 11 } 12

  • J. Zhu c

’04 – p.15/33

slide-50
SLIDE 50

Graph Reachability

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

Key for success of model checking Algorithm

reachable( s : V 0, g : V 0 × V 1 ) 1 : V 0 { 2 var image, reached : V 0; 3 image = s; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached ; 11 } 12

  • J. Zhu c

’04 – p.15/33

slide-51
SLIDE 51

Superposed Computation

Divide-and-Conquer paradigm

task → many problem instances

Parallel computing

One processor per instance Exponential many instances?

  • J. Zhu c

’04 – p.16/33

slide-52
SLIDE 52

Superposed Computation

Divide-and-Conquer paradigm

task → many problem instances

Parallel computing

One processor per instance Exponential many instances?

Quantum computing

light Quantum computer light

  • J. Zhu c

’04 – p.16/33

slide-53
SLIDE 53

Superposed Computation

Divide-and-Conquer paradigm

task → many problem instances

Parallel computing

One processor per instance Exponential many instances?

Quantum computing

light Quantum computer light

Superposed computing

  • J. Zhu c

’04 – p.16/33

slide-54
SLIDE 54

Superposed Computation

Divide-and-Conquer paradigm

task → many problem instances

Parallel computing

One processor per instance Exponential many instances?

Quantum computing

light Quantum computer light

Superposed computing

set Relation r : V0 * V1 set

  • J. Zhu c

’04 – p.16/33

slide-55
SLIDE 55

Superposed Computation

Divide-and-Conquer paradigm

task → many problem instances

Parallel computing

One processor per instance Exponential many instances?

Quantum computing

light Quantum computer light

Superposed computing

input superposition Superposed Symbolic Computer

  • utput

superposition

Introduce domain of problem instances I Graph superposition: I × V 0 × V 1 Input superposition: I × V 0 Superposed image computation

s : I × V 0, r : I × V 0 × V 1 s ∧ r : I × V 0 × V 1 ∃V 0.s ∧ r : I × V 1 [∃V 0.s ∧ r]|V 1→V 0 : I × V 0

  • J. Zhu c

’04 – p.16/33

slide-56
SLIDE 56

Transitive Closure

Reachability problem for each node Algorithm

closure( g : V 0 × V 1 ) 1 : V 0 × V 1{ 2 var image, reached : V 2 × V 0; 3 image = V 2 == V 0; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached|V 2→V 0,V 1→V 1 ; 11 } 12

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

  • J. Zhu c

’04 – p.17/33

slide-57
SLIDE 57

Transitive Closure

Reachability problem for each node Algorithm

closure( g : V 0 × V 1 ) 1 : V 0 × V 1{ 2 var image, reached : V 2 × V 0; 3 image = V 2 == V 0; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached|V 2→V 0,V 1→V 1 ; 11 } 12

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

  • J. Zhu c

’04 – p.17/33

slide-58
SLIDE 58

Transitive Closure

Reachability problem for each node Algorithm

closure( g : V 0 × V 1 ) 1 : V 0 × V 1{ 2 var image, reached : V 2 × V 0; 3 image = V 2 == V 0; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached|V 2→V 0,V 1→V 1 ; 11 } 12

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

  • J. Zhu c

’04 – p.17/33

slide-59
SLIDE 59

Transitive Closure

Reachability problem for each node Algorithm

closure( g : V 0 × V 1 ) 1 : V 0 × V 1{ 2 var image, reached : V 2 × V 0; 3 image = V 2 == V 0; 4 reached = 0; 5 while( image = 0 ) { 6 image = [∃V 0.image ∧ g]|V 1→V 0 ; 7 reached = reached ∨ image; 8 image = image ∧ ¬reached; 9 } 10 return reached|V 2→V 0,V 1→V 1 ; 11 } 12

image

1 2 3 4 5 6 7

reached

1 2 3 4 5 6 7

  • J. Zhu c

’04 – p.17/33

slide-60
SLIDE 60

Outline

An Old Problem A New Strategy

  • J. Zhu c

’04 – p.18/33

slide-61
SLIDE 61

Outline

An Old Problem A New Strategy

Any structured information (set, graph, relation) maybe be captured compactly by Boolean functions.

  • J. Zhu c

’04 – p.18/33

slide-62
SLIDE 62

Outline

An Old Problem A New Strategy

Any structured information (set, graph, relation) maybe be captured compactly by Boolean functions. Different problem instances can be superposed and solved collectively by first order logic operators, which may lead to exponential reduction of runtime.

  • J. Zhu c

’04 – p.18/33

slide-63
SLIDE 63

Outline

An Old Problem A New Strategy

Any structured information (set, graph, relation) maybe be captured compactly by Boolean functions. Different problem instances can be superposed and solved collectively by first order logic operators, which may lead to exponential reduction of runtime.

Taming Context Sensitivity Result and Conclusion

  • J. Zhu c

’04 – p.18/33

slide-64
SLIDE 64

Symbolic Framework (FICS)

Given

call : (M0 × S0 × C0) × (M1 × C1) tr : M0 × (B2 × P 0) × (B3 × P 1) path : P 0 × F 0 × P 1 inmap : M0 × S0 × (B2 × P 0) × (B3 × P 1)

  • utmap

: M0 × S0 × (B2 × P 0) × (B3 × P 1)

  • J. Zhu c

’04 – p.19/33

slide-65
SLIDE 65

Symbolic Framework (FICS)

Given

call : (M0 × S0 × C0) × (M1 × C1) tr : M0 × (B2 × P 0) × (B3 × P 1) path : P 0 × F 0 × P 1 inmap : M0 × S0 × (B2 × P 0) × (B3 × P 1)

  • utmap

: M0 × S0 × (B2 × P 0) × (B3 × P 1)

Find

s : B0 × F 0 × B1 q : M0 × C0 × (B2 × P 0) × B0

  • J. Zhu c

’04 – p.19/33

slide-66
SLIDE 66

Symbolic Framework (FICS)

Given

call : (M0 × S0 × C0) × (M1 × C1) tr : M0 × (B2 × P 0) × (B3 × P 1) path : P 0 × F 0 × P 1 inmap : M0 × S0 × (B2 × P 0) × (B3 × P 1)

  • utmap

: M0 × S0 × (B2 × P 0) × (B3 × P 1)

Find

s : B0 × F 0 × B1 q : M0 × C0 × (B2 × P 0) × B0

By Recurrence equations

s =

apply(tr, q)

q =

bind(query(s, path), inmap, outmap, call)

  • J. Zhu c

’04 – p.19/33

slide-67
SLIDE 67

Symbolic Invocation Graph (SIG)

A B C D E

  • J. Zhu c

’04 – p.20/33

slide-68
SLIDE 68

Symbolic Invocation Graph (SIG)

A B C D E A0 C0 B0 D0 E0 C1 D1 E1

  • J. Zhu c

’04 – p.20/33

slide-69
SLIDE 69

Symbolic Invocation Graph (SIG)

A B C D E A0 C0 B0 D0 E0 C1 D1 E1 A B C D E

C0 0 C1 C0 0 C1 C0 0 C1 1 C0 0 C1 0 + C0 1 C1 1 C0 0 C1 0 + C0 1 C1 1

  • J. Zhu c

’04 – p.20/33

slide-70
SLIDE 70

Symbolic Invocation Graph (SIG)

A B C D E A0 C0 B0 D0 E0 C1 D1 E1 A B C D E

0, 0 0, 0 0, 1 0, 0, 1, 1 0, 0, 1, 1

  • J. Zhu c

’04 – p.20/33

slide-71
SLIDE 71

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(0) C(0) D(0) E(0)

  • J. Zhu c

’04 – p.21/33

slide-72
SLIDE 72

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(1) C(0) D(0) E(0)

0, 0

  • J. Zhu c

’04 – p.21/33

slide-73
SLIDE 73

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(1) C(1) D(0) E(0)

0, 0 0, 0

  • J. Zhu c

’04 – p.21/33

slide-74
SLIDE 74

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(1) C(2) D(0) E(0)

0, 0 0, 0 0, 1

  • J. Zhu c

’04 – p.21/33

slide-75
SLIDE 75

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(1) C(2) D(2) E(0)

0, 0 0, 0 0, 1 0, 0, 1, 1

  • J. Zhu c

’04 – p.21/33

slide-76
SLIDE 76

SIG Construction

Step 1: Acyclic graph reduction

Presence of recursion Identify Strongly connected components (SCCs) Merge SCCs

Step 2: Acyclic graph expansion

Top-down topological traversal Annotate each call graph edge

A(1) B(1) C(2) D(2) E(2)

0, 0 0, 0 0, 1 0, 0, 1, 1 0, 0, 1, 1

  • J. Zhu c

’04 – p.21/33

slide-77
SLIDE 77

SIG Edge Construction

Contexts for each procedure numbered continuously SIG edges for each CG edge

0, offset, 1, offset + 1, ... count − 1, offset + count − 1 Explicit construction is expensive

caller callee (offset) ... caller (count)

  • J. Zhu c

’04 – p.22/33

slide-78
SLIDE 78

SIG Edge Construction

{x, y} satisfy two conditions

y = x + offset x < count

  • J. Zhu c

’04 – p.23/33

slide-79
SLIDE 79

SIG Edge Construction

{x, y} satisfy two conditions

y = x + offset x < count

Built by constructing circuits

  • J. Zhu c

’04 – p.23/33

slide-80
SLIDE 80

SIG Edge Construction

{x, y} satisfy two conditions

y = x + offset x < count

Built by constructing circuits

Adder

x0 y0 z0 x1 y1 z1 x2 y2 z2 x3 y3 z3

  • J. Zhu c

’04 – p.23/33

slide-81
SLIDE 81

SIG Edge Construction

{x, y} satisfy two conditions

y = x + offset x < count

Built by constructing circuits

Adder Comparator

x0 y0 z0 x1 y1 z1 x2 y2 z2 x3 y3 z3 x0 y0 x1 y1 x2 y2 x3 y3

  • J. Zhu c

’04 – p.23/33

slide-82
SLIDE 82

Insight in Complexity

Algorithm polynomial to BDD size

BDD size in general is exponential

Question Can we bound BDD size of SIG? Berman [TCAD’01]

Establish relation between circuit complexity and BDD complexity BDD size ∝ 2circuit cutwidthm m is number of BDD variables

  • J. Zhu c

’04 – p.24/33

slide-83
SLIDE 83

Insight in Complexity

Algorithm polynomial to BDD size

BDD size in general is exponential

Question Can we bound BDD size of SIG? Berman [TCAD’01]

Establish relation between circuit complexity and BDD complexity BDD size ∝ 2circuit cutwidthm m is number of BDD variables

  • J. Zhu c

’04 – p.24/33

slide-84
SLIDE 84

Insight in Complexity

x0 y0 z0 x1 y1 z1 x2 y2 z2 x3 y3 z3 x0 y0 x1 y1 x2 y2 x3 y3

  • J. Zhu c

’04 – p.25/33

slide-85
SLIDE 85

Insight in Complexity

x0 y0 z0 x1 y1 z1 x2 y2 z2 x3 y3 z3 x0 y0 x1 y1 x2 y2 x3 y3

Cutwidth is constant BDD size of adder, comparator linear! SIG construction polynomial

  • J. Zhu c

’04 – p.25/33

slide-86
SLIDE 86

Outline

An Old Problem A New Strategy Taming Context Sensitivity

  • J. Zhu c

’04 – p.26/33

slide-87
SLIDE 87

Outline

An Old Problem A New Strategy Taming Context Sensitivity

Evil of paths (IG) overcome by bless of paths (BDD)

  • J. Zhu c

’04 – p.26/33

slide-88
SLIDE 88

Outline

An Old Problem A New Strategy Taming Context Sensitivity

Evil of paths (IG) overcome by bless of paths (BDD) Circuit inspired solution for combinatorial problems

  • J. Zhu c

’04 – p.26/33

slide-89
SLIDE 89

Outline

An Old Problem A New Strategy Taming Context Sensitivity

Evil of paths (IG) overcome by bless of paths (BDD) Circuit inspired solution for combinatorial problems

Result and Conclusion

  • J. Zhu c

’04 – p.26/33

slide-90
SLIDE 90

Experiment Setup

Sun Blade 150, 550MHz CPU, 128MB RAM Benchmarks prolangs: pointer analysis community MediaBench: embedded systems community SPEC2K: computer architecture community

prolangs MediaBench SPEC2000 name #lines #contexts #blocks name #lines #contexts #blocks name #lines #contexts #blocks 315 1411 49 136 gsm 5473 267 1124 vortex 67211 9.217*1010 18433 TWMC 24032 6522 4613 pegwit 5503 1968 1121 bzip2 4665 495 995 simulator 3558 8953 1316 pgp 28065 199551 5265 vpr 16984 179905 4318 larn 9933 1750823 6180 mpeg2dec 9823 44979 2748 crafty 19478 317378 5282 moria 25002 318675286 9446 mpeg2enc 7605 1955 2997 twolf 19756 5538 4231

  • J. Zhu c

’04 – p.27/33

slide-91
SLIDE 91

Experiment Goal

Goal: evaluate scalability Comparative study FICS: flow-insensitive, context-sensitive analysis FSCI: flow-sensitive, context-insensitive analysis FSCS: flow-sensitive, context-sensitive analysis FSCS*: flow-sensitive, context-sensitive, field-sensitive analysis

  • J. Zhu c

’04 – p.28/33

slide-92
SLIDE 92

Experimental Result: prolangs

Flow Solver Total Benchmarks Time Time Time (s) (s) (s) prolangs 315 CS 0.01 0.01 FS 0.01 0.01 FSCS 0.04 0.01 0.05 FSCS∗ 0.04 0.01 0.05 T-W-MC CS 3.72 3.72 FS 4.43 0.59 5.02 FSCS 8.71 1.76 10.47 FSCS∗ 8.86 1.68 10.54 larn CS 0.83 0.83 FS 0.67 0.19 0.86 FSCS 21.83 1.64 23.47 FSCS∗ 21.94 1.68 23.62 moria CS 1.47 1.47 FS 2.24 0.47 2.71 FSCS 40.60 4.4 45.00 FSCS∗ 40.87 4.47 45.34 simulator CS 0.10 0.10 FS 0.06 0.04 0.1 FSCS 0.76 0.10 0.86 FSCS∗ 0.79 0.14 0.93

  • J. Zhu c

’04 – p.29/33

slide-93
SLIDE 93

Experimental Result: MediaBench

Flow Solver Total Benchmarks Time Time Time (s) (s) (s) MediaBench gsm CS 0.05 0.05 FS 0.19 0.05 0.24 FSCS 0.55 0.1 0.65 FSCS∗ 0.59 0.08 0.67 mpeg2dec CS 0.20 0.20 FS 0.29 0.23 0.52 FSCS 3.15 0.54 3.69 FSCS∗ 3.23 0.48 2.19 mpeg2enc CS 0.19 0.19 FS 0.95 0.14 1.09 FSCS 1.44 0.27 1.71 FSCS∗ 1.52 0.23 1.75 pegwit CS 0.12 0.12 FS 0.09 0.09 0.18 FSCS 0.97 0.26 1.23 FSCS∗ 0.96 0.25 1.21 pgp CS 1.05 1.05 FS 2.32 0.73 3.05 FSCS 26.28 6.03 32.31 FSCS∗ 26.19 5.90 32.09

  • J. Zhu c

’04 – p.30/33

slide-94
SLIDE 94

Experimental Result: SPEC2K

Flow Solver Total Benchmarks Time Time Time (s) (s) (s) SPEC2000 255.vortex CS 4.32 4.32 FS 10.53 1.31 11.84 FSCS 135.59 7.49 143.08 FSCS∗ 136.68 7.71 144.39 186.crafty CS 0.53 0.53 FS 3.1 0.44 3.54 FSCS 12.12 2.06 14.18 FSCS∗ 12.17 2.09 14.26 256.bzip2 CS 0.02 0.02 FS 0.06 0.02 0.08 FSCS 0.3 0.06 0.36 FSCS∗ 0.32 0.06 0.38 300.twolf CS 0.09 0.09 FS 5.25 0.09 5.34 FSCS 9.19 0.26 9.45 FSCS∗ 9.21 0.20 9.41 175.vpr CS 0.23 0.23 FS 1.37 0.1 1.47 FSCS 5.96 0.4 6.36 FSCS∗ 5.84 0.34 6.18

  • J. Zhu c

’04 – p.31/33

slide-95
SLIDE 95

Experimental Result: Precision

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 % difference − Pointer Cardinality l a r n m

  • r

i a s i m u l a t

  • r

g s m m p e g 2 d e c m p e g 2 e n c p e g w i t p g p b z i p 2 c r a f t y t w

  • l

f v

  • r

t e x v p r CI CS

  • J. Zhu c

’04 – p.32/33

slide-96
SLIDE 96

Conclusion

Extends success of formal verification to general combinatorial problems Promotes a new way of thinking Leads to new milestones in solving the pointer analysis problem Lessons learned

Elegance at the expense of efficiency

  • J. Zhu c

’04 – p.33/33

slide-97
SLIDE 97

Conclusion

Extends success of formal verification to general combinatorial problems Promotes a new way of thinking Leads to new milestones in solving the pointer analysis problem Lessons learned

Elegance at the expense of efficiency

  • J. Zhu c

’04 – p.33/33

slide-98
SLIDE 98

Conclusion

Extends success of formal verification to general combinatorial problems Promotes a new way of thinking Leads to new milestones in solving the pointer analysis problem Lessons learned

Elegance at the expense of efficiency BDD is a panacea

  • J. Zhu c

’04 – p.33/33

slide-99
SLIDE 99

Conclusion

Extends success of formal verification to general combinatorial problems Promotes a new way of thinking Leads to new milestones in solving the pointer analysis problem Lessons learned

Elegance at the expense of efficiency BDD is a panacea

  • J. Zhu c

’04 – p.33/33

slide-100
SLIDE 100

Further Readings

References

[Zhu(2002)] Jianwen Zhu. Symbolic pointer analysis. In Proceedings of the International Conference on Computer-Aided Design (ICCAD), San Jose, November 2002. [Berndl et al.(2003)Berndl, Lhoták, Qian, Hendren, and Umanee] Marc Berndl, Ondˇ rej Lhoták, Feng Qian, Laurie Hendren, and Navindra Umanee. Point-to analysis using BDD. In Proceedings of the ACM SIGPLAN Conference

  • n Programming Language Design and Implementation (PLDI), San Diego, June 2003.

[Zhu and Calman(2004)] Jianwen Zhu and Silvian Calman. Symbolic pointer analysis revisited. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), June 2004. [Lhoták and Hendren(2004)] Ondˇ rej Lhoták and Laurie Hendren. Jedd: A BDD-based relational extension of Java. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), June 2004. [Whaley and Lam(2004)] John Whaley and Monica Lam. Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), June 2004.

  • J. Zhu c

’04 – p.34/33