Pointer Analysis. CSE 501 Spring 15

Transcription

1 Pointer Anlysis CSE 501 Sring 15

2 Course Outline St8c nlysis Dtflow nd strct interret8on Alic8ons We re here Beyond generl- urose lnguges Progrm Verific8on Dynmic nlysis New comilers

3 Tody Intro to ointer nlysis Wht s the ig del? Different sects of the rolem Two solu8ons Andersen- style Steensgrd- style

4 Pointer Anlysis

5 Wht s the rolem? int * = mlloc( ) int * = = ; = &2; * = ; foo()

6 Uses Alis nlysis: For every ir of ointers in the rogrm, determine if they cn ever oint to the sme memory loc8on Comiler o8miz8on * = + ; x = + ; + is not redundnt if * lises or Sme for constnt rog8on, ded code elimin8on, etc

7 Uses Progrm rlleliz8on Conver8ng seuen8l code into rllel imlement8ons utom8clly She nlysis Find roer8es of dt structures in the he Detec8ng memory rolems Leks, *NULL, security holes

8 Why is it hrd? Comlexity: huge in oth sce nd 8me How mny ointers re there in rogrm? Anlyze every rogrm oint Need to consider ll ths to ech rogrm oint Whole / rt of the rogrm? Issues with externl lirries The rolem is undecidle [Lndi 92, Rmlingm 94]

9 Designing ointer nlysis Must vs my Model rogrms nd he Model ggregtes Anlysis sensi8vi8es

10 Reresen8ng oints- to inform8on Vrile irs tht refer to the sme memory loc8on <*, >, <*c, >, <*, *c> * nd lis, sme with *c nd Points- to irs: < à >, <c à > oints to, nd c oints to (hence * nd *c re lis) Alis sets: {*,, *c} They ll oint to the sme memory loc8on Convert from one to nother? Wht re the trdeoffs?

11 Modeling the he Lum everything into one By lloc8on site Ech cll to new / mlloc is node Doesn t differen8te etween mul8le ojects llocted y the sme site Secilized dt structures M of memory ddress to oject

12 Modeling Aggregtes Arrys Ech element is treted s individul loc8on En8re rry s single loc8on First / lst element dis8nct from others Clsses / Structures Ech field is treted s individul loc8on Lum ll fields together

13 Sensi8vity Flow sensi8ve x = y z = x z = x x = y 1- Context sensi8ve x = foo(y) z = foo() foo (x) { return x; } Pth sensi8ve if (c) x = z else x = y Field sensi8ve o.f = x o.f = y if (c) x = y else x = z o.f = x o.g = y

14 Pointer- induced Alising: A Prolem Clssific8on [Lndi nd Ryder, POPL 90] Intrrocedurl Intrrocedurl Interrocedurl Interrocedurl Alis Mechnism My Alis Must Alis My Alis Must Alis Reference Formls, Polynomil[l, 5] Polynomil [l, 5] No Pointers, No Structures Single level ointers, Polynomil Polynomil Polynomil Polynomil No Reference Formls, No Structures Single level ointers, Polynomil Polynomil Reference Formls, No Pointer Reference Formls, No Structures Multile level ointers, Af~-hrd Comlement ALP-hrd Comlement No Reference Formls, is AfP-hrd No Structures is hfp-hrd Single level ointers, hfp-hrd Comlement Pointer Reference Formls, No Structures is N?-hrd Single level ointers, Af P-hrd[14] Comlement NP-hrd[14] Comlement Structures, is Af-hrd is hf-hrd No Reference Formls Tle 1: Alis rolem decomosition nd clssifiction

15 A Pointer Lnguge (Assume x nd y re ointers) y = &x y oints to x y = x If x oints to z then y oints to z *y = x If y oints to z nd z is ointer, nd if x oints to w then z now oints to w y = *x If x oints to z nd z is ointer, nd if z oints to w then y not oints to w

16 A Pointer Lnguge oints- to(x): set of vriles tht ointer vrile x my oint to Exmle: oints- to(x) = {y, z} x cn oint to either y or z

17 Andersen s- style Pointer Anlysis Flow, context insensi8ve, inclusion- sed lgorithm Sttement Constrint Mening y = &x y {x} x oints- to(y) y = x y x oints- to(y) oints- to(x) y = *x y *x v oints- to(x). oints- to(y) oints- to(x) *y = x *y x v oints- to(y). oints- to(v) oints- to(x)

18 An Exmle = &; = ; = &; r = ; Solving the eu8ons: Exmle from Prof. Stehen Chong {} {} r Points- to {, } {, } r {, } {} {}

19 Another Exmle = &; = &; * = ; r = &c; s = ; t = *; *s = r; {} * r {c} s t * *s r Points- to {} {} r {c} s {} t {, c} {, c} {} c {}

20 Precision = &; = &; * = ; r = &c; s = ; t = *; *s = r; s s t r r r c c c Points- to {} {} r {c} s {} t {, c} {, c} {} c {}

21 Precision = &; = &; * = ; r = &c; s = ; t = *; *s = r; s s t r r r c c c Points- to {} {} r {c} s {} t {, c} {, c} {} c {}

22 Precision = &; = &; * = ; r = &c; s = ; t = *; *s = r; s s t r r r c c c Points- to {} {} r {c} s {} t {, c} {, c} {} c {}

23 Andersen s Grh Closure One node for ech memory loc8on i.e., elements in ny oints- to set Ech node contins oints- to set Solve eu8ons y comu8ng trnsi8ve closure of grh, nd dd edges ccording to constrints

24 Andersen s Grh Closure Sttement Constrint Mening Grh Oer5on y = &x y {x} x oints- to(y) Nothing y = x y x oints- to(y) oints- to(x) y = *x y *x v oints- to(x). oints- to(y) oints- to(x) *y = x *y x v oints- to(y). oints- to(v) oints- to(x) Add edge from x to y Nothing Nothing

25 Sme Exmle, s Grh = &; = &; * = ; r = &c; s = ; t = *; *s = r; {} * r {c} s t * *s r {} r {c} s {} {} t {} c y = x y x oints- to(y) oints- to(x) Add edge from x to y

26 Sme Exmle, s Grh = &; = &; * = ; r = &c; s = ; t = *; *s = r; {} * r {c} s t * *s r {} r {c} s {} {,c} t {,c} {} c y = x y x oints- to(y) oints- to(x) Add edge from x to y

27 Worklist Algorithm // Init grh nd oints-to sets using se constrints W = { nodes with non-emty oints-to sets } while W is not emty { } v = choose from W for ech constrint v x dd edge x à v, nd dd x to W if edge is new for ech oints-to(v) do { } for ech constrint *v dd edge à, nd dd to W if edge is new for ech constrint *v dd edge à, nd dd to W if edge is new for ech edge v à do { } oints-to() = oints-to() U oints-to(v), nd dd to W if oints-to() chnged

28 Worklist Algorithm Comlexity is O(n 3 ), where n = numer of nodes in grh In rc8ce, imrove y elimin8ng cycles Detect strongly connected comonents in oints- to grh nd collse to single node How to detect cycles? Some reduc8on cn e done st8clly, some on- the- fly s new edges dded See The Ant nd the Grsshoer: Fst nd Accurte Pointer Anlysis for Millions of Lines of Code, Hrdekof nd Lin, PLDI 2007

29 Steensgrd- style Anlysis Similr to Andersen, excet tht ech node cn only oint to one other node in oints- to grh

30 Steensgrd- style Anlysis Flow, context insensi8ve, unific8on- sed lgorithm Sttement Constrint Mening y = &x y {x} x oints- to(y) y = x y = x oints- to(y) = oints- to(x) y = *x y = *x v oints- to(x). oints- to(y) = oints- to(x) *y = x *y = x v oints- to(y). oints- to(v) = oints- to(x)

31 Steensgrd- style Anlysis Flow, context insensi8ve, unific8on- sed lgorithm Sttement Constrint Mening y = &x y {x} x oints- to(y) y = x y = x oints- to(y) = oints- to(x) y = *x y = *x v oints- to(x). oints- to(y) = oints- to(x) *y = x *y = x v oints- to(y). oints- to(v) = oints- to(x)

32 Steensgrd- style Anlysis Imlic8ons for using eulity constrints Ech sttement is rocessed exctly once Only one iter8on of the worklist lgorithm Union- find / disjoint set dt structure Worst cse comlexity: O(n) (lmost), where n = numer of nodes in grh Less recise thn Andersen s

33 Exmle x z y w v x = *y Sttement Constrint Mening x = *y x = *y v oints- to(y). oints- to(x) = oints- to(y)

34 Exmle x z y w v x = *y Sttement Constrint Mening x = *y x = *y v oints- to(y). oints- to(x) = oints- to(y)

35 Exmle x z y w v x = *y Sttement Constrint Mening x = *y x = *y v oints- to(y). oints- to(x) = oints- to(y)

36 Exmle x z y w v Precision? x = *y Sttement Constrint Mening x = *y x = *y v oints- to(y). oints- to(x) = oints- to(y)