Introduction to Shape and Pointer Analysis

Transcription

1 Introduction to Shape and Pointer Analsis CS 502 Lecture 11 10/30/08 Some slides adapted from Nielson, Nielson, Hankin Principles of Program Analsis

2 Analsis of the Heap Thus far, we have focussed on control and dataflow properties of programs: dataflow analsis approimates, constructs, or derives program properties based on a program s control and dataflow. What about the heap? How do we approimate properties of heapallocated data structures? Points-to analsis: Useful for detecting sharing and aliasing 2

3 Shape Analsis Obtain a finite representation of the shape of the program heap at different program points. Consider a language with pointers and references. Utilit: Aliasing and sharing. Can be used for more efficient code generation. Inlining, constant-folding, method dispatch, etc. Identif possible null-pointer dereferences. Program verification: reverse transforms a non-cclic list to a non-cclic list. 3

4 Pointer Analsis Goal: what objects can a pointer point-to? Staticall undecidable in general. What are good approimations? Can be used to infer aliases: if a points to b, and b points to c, then: {<*a,b>, <*b,c>} ==> {<**a,c>} and thus **a and *b are aliases Fundamentall an interprocedural analsis: A pointer variable can be supplied as arguments or returned as a result from a procedure. Flow-insensitive vs. flow-sensitive contet-sensitivit? shape analsis? field sensitivit? 4

5 Strategies Eample: p = malloc(); q = malloc() fp = &p; fp = &q;... = *fp; Flow-insensitive, equalit-based: fp p q heap1 heap2 5

6 Equalit-based Analses Eample: First three statements are eas: = &a; = &a; = &b; p = &; p = &; p = &; = &b; a a add edge p a b p = &; b collapse and p a b p a b Last statement takes more effort to process: collapse a and b p a b 6

7 Tpe-based Formulation Running eample: Assign each variable a tpe (:t1,:t2,a:t3,b:t4,p:t5) Construct initial constraints: = &a; = &b; p = &; p = &; = &a; t1 = ref(t3) = &b; t2 = ref(t4) p = &; t5 = ref(t1) p = &; t5 = ref(t2) 7

8 Tpe-based formulation(cont) Solve and unif the constraints: t4 = ref(t1) = ref(t2) Merge t1 and t2 into t1: : t1, : t1, a: t3, b:t4, p: t5 t1 = ref(t3), t1 = ref(t4), t5 = ref(t1) Repeat the process: t1 = ref(t3) = ref(t4) Merge: t1 = ref(t3), t5 = ref(t1) 8

9 Strategies Eample: p = malloc(); q = malloc(); fp = &p; fp = &q;... = *fp; Flow-insensitive, subset-based: p heap1 fp q heap2 9

10 Subset-based (inclusion) Eample: q = &; q = &; q q 1 q = &; q = &; p = q; q = &; Third statement. See all the things q points to, and m 1 2 p = q; q 1 2 Dotted line indicates that the points-to set for q must be a subset of the points-to set for p. 3 3 p 10

11 Subset-based (inclusion) q = &; p q 4 Subset constraint (dotted line) indicates that an edge must be established between p and as well. q = &; 1 3 What is the running-time compleit of these two analses? q p 11

12 Shape Analsis Snta Eample a ::= p n a 1 op a a 2 nil p ::=.sel b ::= true false not b b 1 op b b 2 a 1 op r a 2 op p p S ::= [p:=a] l [skip] l S 1 ; S 2 if [b] l then S 1 else S 2 while [b] l do S [malloc p] l [:=nil] 1 ; while [not is-nil()] 2 do ([:=] 3 ; [:=] 4 ; [:=.] 5 ; [.:=] 6 ); [:=nil] 7 12

13 Reversal (heap structure at different iterations of the loop) 0: ξ 1 ξ 2 ξ 3 ξ 4 ξ 5 1: ξ 2 ξ 1 ξ 3 ξ 4 ξ 5 2: ξ 3 ξ 2 ξ 4 ξ 1 ξ 5 3: ξ 4 ξ 3 ξ 5 ξ 2 ξ 1 4: ξ 5 ξ 4 ξ 3 ξ 2 ξ 1 5: ξ 5 ξ 4 ξ 3 ξ 2 ξ 1 13

14 Analsis To anale data structures of this form, develop an approimation to the actual runtime structure of the heap. Approach: First, develop a semantics that describes changes to the heap as the program eecutes. Second, develop a conservative approimation to this semantics. The approimate state of the heap at different program points is the result of the analsis. 14

15 Semantics A configurations consists of a state σ State = Var (Z + Loc + { }) mapping variables to values, locations (in the heap) or the nil-value a heap H Heap = (Loc Sel) fin (Z + Loc + { }) mapping pairs of locations and selectors to values, locations in the heap or the nil-value 15

16 Defining Pointers is defined b : PEp (State Heap) fin (Z + { } + Loc) [[]](σ, H) = σ() [[.sel]](σ, H) = H(σ(), sel) if σ() Loc and H is defined on (σ(), sel) undefined otherwise Arithmetic and boolean epressions A : AEp (State Heap) fin (Z + Loc + { }) B : BEp (State Heap) fin T 16

17 Assignment and Selection Clauses for assignments: [:=a] l, σ, H σ[ A[[a]](σ, H)], H if A[[a]](σ, H) is defined [.sel:=a] l, σ, H σ, H[(σ(), sel) A[[a]](σ, H)] if σ() Loc and A[[a]](σ, H) is defined Clauses for malloc: [malloc ] l, σ, H σ[ ξ], H where ξ does not occur in σ or H [malloc (.sel)] l, σ, H σ, H[(σ(), sel) ξ] where ξ does not occur in σ or H and σ() Loc 17

18 Shape Graphs The analsis will operate on shape graphs (S, H, is) consisting of an abstract state, S, an abstract heap, H, and sharing information, is, for the abstract locations. The nodes of the shape graphs are abstract locations: ALoc = {n X X Var } Note: there will onl be finitel man abstract locations 18

19 PPA Section 2.6 c F.Nielson & H.Riis Nielson & C.Hankin (Ma 2005) 117 Eample Eample In the semantics: In the semantics: 3 ξ 4 ξ 2 ξ 3 In the analsis: n {} n {} n {} Eample 2 In the analsis: ξ 1 ξ 4 ξ 1 5 n n {} n n {} n {} 5 Abstract Locations The abstract location n X represents the location σ() if X The abstract location n is called the abstract summar location: n represents all the locations that cannot be reached directl from the state without consulting the heap Invariant 1 If two abstract locations n X and n Y occur in the same shape graph then either X = Y or X Y = 19

20 Abstract States and Heaps S AState = P(Var ALoc) abstract states H AHeap = P(ALoc Sel ALoc) abstract heap n {} n {} n n {} Invariant 2 If is mapped to n X b the abstract state S then X Invariant 3 Whenever (n V, sel, n W ) and (n V, sel, n W ) are in the abstract heap H then either V = or W = W 20

21 List Reversal (after successive iterations) 0: n {} n 1: n {} n {} n 2: n {} n {} n n {} 3: n {} n {} n n {} 4: n {} n {} n n {} 5: n {} n n {} 21

22 Sharing ξ 4 ξ ξ 4 3 ξ 5 Give rise to the same shape graph: n {} n {} n is: the abstract locations that might be shared due to pointers in the heap: n X is included in is if it might represents a location that is the target of more than one pointer in the heap 22

23 Eamples ξ 4 ξ 5 n {} n {} n 1 2 ξ 4 3 ξ 5 n {} n {} n ξ ξ 5 n {} n {} n 23

24 Sharing Invariants The implicit sharing information of the abstract heap must be consistent with the eplicit sharing information: n {} n {} n Invariant 4 If n X is then either (n, sel, n X ) is in the abstract heap for some sel, or there are two distinct triples (n V, sel 1, n X ) and (n W, sel 2, n X ) in the abstract heap Invariant 5 Whenever there are two distinct triples (n V, sel 1, n X ) and (n W, sel 2, n X ) in the abstract heap and X then n X is 24