Analysis of Object-oriented Programming Languages

Transcription

1 Analysis of Object-oriented Programming Languages Dr. Barbara G. Ryder Rutgers University OOAnalysis, Dagstuhl 2/03, BG Ryder 1

2 Outline Why do analysis of OOPLs? Dimensions of analysis : cost and precision Examples of analyses Hierarchy-based: CHA, RTA Incorporating flow: XTA, VTA, FieldSens Context-sensitive: Object-sensitive OOAnalysis, Dagstuhl 2/03, BG Ryder 2

3 Object-oriented PL s Construct possible calling structure of program Dynamic dispatch of methods based on runtime type of receiver Understand possible dataflow in program Indirect side effects through reference variables and fields OOAnalysis, Dagstuhl 2/03, BG Ryder 3

4 Uses of Analysis Information in Compilers Object read-write information (flow) Side-effect analysis, dependence analysis Call graph construction (hierarchy) Devirtualization & inlining Synchronization removal (flow) Stack-based object allocation (flow) OOAnalysis, Dagstuhl 2/03, BG Ryder 4

5 Uses of Analysis Information in Software Engineering Tools Object read-write information (flow) Semantic browers Program slicers Debuggers Change impact analysis tools (hierarchy, flow) Testing (flow) Object relationships (Object relation diagrams) Program-based coverage metrics OOAnalysis, Dagstuhl 2/03, BG Ryder 5

6 Dimensions of Reference Analysis Many reference analyses developed over past 10+ years Different algorithm and program representation choices affect precision and cost Need to pose this as a compile-time program analysis with representations for reference variables/fields, objects, classes and program Object representation Can use an abstract object (with or without fields) to represent all objects of a class Can use object instantiations, grouped by some mechanism (e.g., creation sites) OOAnalysis, Dagstuhl 2/03, BG Ryder 6

7 Dimensions of Reference Analysis Reference representation Can use an abstract reference for all references of a particular type Can use reference names with program-wide solutions Can use references representations with per method solutions The analysis can incorporate information about flow of control in the program or ignore it Flow sensitivity (accounts for statement order) Context sensitivity (separates calling contexts) OOAnalysis, Dagstuhl 2/03, BG Ryder 7

8 Dimensions of Reference Analysis Program representation used for analysis can incorporate reachability of methods as part of the analysis or assume all methods are reachable Techniques can be differentiated by their solution formulation and directionality used e.g., for assignments p = q, interpreted as Pts-to(q) Õ Pts-to(p) vs. Pts-to(q) = Pts-to(p) OOAnalysis, Dagstuhl 2/03, BG Ryder 8

9 Hierarchy-based CHA, RTA Incorporating flow Example Analyses XTA, VTA, FieldSens Incorporating calling context Object-sensitive OOAnalysis, Dagstuhl 2/03, BG Ryder 9

10 Class Hierarchy Analysis (CHA) Idea: look at class hierarchy to determine what classes of object can be pointed to by a reference declared to be of class A, in Java this is the subtree in inheritance hierarchy rooted at A, cone (A) to find out what methods may be called at a virtual call site Makes assumption that whole program is available Ignores flow of control Uses 1 abstract object per class J. Dean, D. Grove, C. Chambers, Optimization of OO Programs Using Static Class Hierarchy, ECOOP 95 OOAnalysis, Dagstuhl 2/03, BG Ryder 10

11 Example public class A { public void main(){ A a; D d = new D(); E e = new E(); if ( ) a = d; else a = e; a.f(); public class B extends A { public void foo(){ G g = new G(); //no other object creation sites //or calls A B f() G f() f() D C f() E OOAnalysis, Dagstuhl 2/03, BG Ryder 11

12 B f() G f() A f() D C cone( C ) f() E Example public class A { public void main(){ A a; D d = new D(); E e = new E(); if ( ) a = d; else a = e; a.f(); public class B extends A { public void foo(){ G g = new G(); //no other object creation sites //or calls In CHA solution, a refers to A,B,C,G,D,E objects, d refers to D objects, e refers to E objects, g refers to G objects OOAnalysis, Dagstuhl 2/03, BG Ryder 12

13 CHA call graph Example main A.f() B.f() C.f() G.f() A f() f() B f() G C D f() E public class A { public void main(){ A a; D d = new D(); E e = new E(); if ( ) a = d; else a = e; a.f(); public class B extends A { public void foo(){ G g = new G(); //no other object creation sites //or calls OOAnalysis, Dagstuhl 2/03, BG Ryder 13

14 Call Optimizations Can devirtualize call if receiver s types all resolve to the same method Also can use runtime checks of actual receiver type (through reflection) to cascade through a small number of choices for direct calls, given predictions due to static or dynamic analysis if (s.class == Rectangle) {a= s.rectangle.area() else if (s.class == Circle){a = s.circle.area() else a = s.area();//plain dynamic dispatch OOAnalysis, Dagstuhl 2/03, BG Ryder 14

15 Rapid Type Analysis (RTA) Improves upon CHA Constructs call graph on-the-fly, interleaved with the analysis Only expands a call if has seen an instantiated object of the appropriate type Ignores classes which have not been instantiated as possible receiver types Makes assumption that whole program is available Uses 1 abstract object per class D. Bacon and P. Sweeney, Fast Static Analysis of C++ Virtual Function Calls, OOPSLA 96 OOAnalysis, Dagstuhl 2/03, BG Ryder 15

16 Example public class A { public void main(){ A a; D d = new D(); E e = new E(); if ( ) a = d; else a = e; a.f(); public class B extends A { public void foo(){ G g = new G(); //no other object creation //sites or calls RTA call graph main A.f() B.f() C.f() G.f() B f() G f() A f() C f() D How is this accomplished? RTA starts in main; Keeps track of instantiated classes (D,E). Knows potential targets of a.f(): {A.f(),B.f(),C.f(),G.f(). Expands a.f() into C.f() only. Waits to see object creations of classes A,B,G before expanding others. because execution never reaches B.foo(), algm never sees G instantiated. OOAnalysis, Dagstuhl 2/03, BG Ryder 16 E

17 RTA Findings RTA is better than CHA on virtual function resolution Inference is that call graphs constructed have same node set but not same edge set! Comparison CHA used reachability Claim both algorithms cost about the same because the dominant cost is traversing the methods and identifying call sites Claim that RTA is good enough for call graph construction so that more precise analyses are not necessary for this task OOAnalysis, Dagstuhl 2/03, BG Ryder 17

18 How to improve precision? How to achieve more precision in analysis for slightly increased cost? Incorporate flow in and out of methods Refine abstract object representing a class to include its fields Incorporate locality of reference usage in program into analysis rather than 1 solution per abstract reference variable over the entire program Always use reachability criteria in constructing call graph OOAnalysis, Dagstuhl 2/03, BG Ryder 18

19 Improved on RTA XTA Analysis Track classes propagated into and out of method calls through parameter passing Objects have one representative object per class, with distinct fields Reference variables and fields are solved for grouped by method (not one programwide solution per abstract reference) Tip and Palsberg, Scalable Propagation-based Call Graph Construction Algorithms, OOPSLA 00 OOAnalysis, Dagstuhl 2/03, BG Ryder 19

20 XTA Analysis Do a reachability propagation of classes through an on-the-fly constructed call graph At any point in the algorithm there is a set of reachable methods R, starting from main() Associate a set of classes that reach method M, S M (all references of a class have one abstract representative per method) Use abstract objects with fields to represent all instances of a class Algorithm is iterative and must continue until hits a fixed point. OOAnalysis, Dagstuhl 2/03, BG Ryder 20

21 XTA Analysis Q: How to expand virtual e.m() in reachable method M? Expand virtual call only by appropriate C Œ S M where C Œ cone(declaredtype(e)) to call M Make M reachable Add cone(paramtype(m ))«S M to S M (adds possible actual param types for M from M, to set of classes that reach M ) Add cone(returntype(m )) «S M to S M Add C to S M For each object created in M (new A()), if M is reachable, then A Œ S M For each field read =*.f in M, if M is reachable, then S f Õ S M For each field write *.f = in M, if M is reachable, then cone(declaredtype(f)) «S M Õ S f OOAnalysis, Dagstuhl 2/03, BG Ryder 21

22 {A,B static void main(){ B b1 = new B(); A a1 = new A(); f(b1); g(b1); {A,B static void f(a a2){ a2.foo(); {B,C static void g(b b2){ B b3 = b2; b3 = new C(); b3.foo(); Example of XTA class A { foo(){.. class B extends A{ foo() { class C extends B{ foo() { class D extends B{ cf Frank Tip, OOPSLA 00 foo(){ OOAnalysis, Dagstuhl 2/03, BG Ryder 22

23 Comparison with CHA static void main(){ B b1 = new B(); A a1 = new A(); f(b1); g(b1); static void f(a a2){ a2.foo(); static void g(b b2){ B b3 = b2; b3 = new C(); b3.foo(); class A { cf Frank Tip, OOPSLA 00 foo(){.. class B extends A{ foo() { class C extends B{ foo() { class D extends B{ foo(){ OOAnalysis, Dagstuhl 2/03, BG Ryder 23

24 Comparison with RTA cf Frank Tip, OOPSLA 00 static void main(){ B b1 = new B(); A a1 = new A(); f(b1); g(b1); static void f(a a2){ a2.foo(); static void g(b b2){ B b3 = b2; b3 = new C(); b3.foo(); class A { foo(){.. class B extends A{ foo() { class C extends B{ foo() { class D extends B{ foo(){ OOAnalysis, Dagstuhl 2/03, BG Ryder 24

25 Actual Solution static void main(){ B b1 = new B(); A a1 = new A(); f(b1); g(b1); static void f(a a2){ a2.foo(); static void g(b b2){ B b3 = b2; b3 = new C(); b3.foo(); class A { cf Frank Tip, OOPSLA 00 foo(){.. class B extends A{ foo() { class C extends B{ foo() { class D extends B{ foo(){ OOAnalysis, Dagstuhl 2/03, BG Ryder 25

26 XTA Findings The reachable methods set (i.e., call graph nodes) is somewhat reduced over that of RTA The number of edges in the call graph is significantly reduced by XTA over RTA (.3%-29% fewer, 7% on average) Data in paper gives comparison restricted to those calls that RTA found to be polymorphic and found could often devirtualize them OOAnalysis, Dagstuhl 2/03, BG Ryder 26

27 VTA - Variable Type Analysis How works? follows type propagation from an object creation site through plausible chains of assignments to reference variables Builds a type propagation graph, using a CHA call graph Nodes are reference variables/fields/parameters Edges represent reference to reference assignments Initializes types for some reference nodes from an associated object creation site Propagates types along directed edges cf. V.Sundaresan, et. al, Practical Virtual Method Call Resolution for Java, OOPSLA 00 OOAnalysis, Dagstuhl 2/03, BG Ryder 27

28 VTA Example static void main(){ B b1 = new B(); A a1 = new A(); f(b1); g(b1); static void f(a a2){ a2.foo(); static void g(b b2){ B b3 = b2; b3 = new C(); b3.foo(); class A { foo(){.. class B extends A{ foo() { class C extends B{ foo() { class D extends B{ foo(){ {B {B {C a1 b1 a2 b2 b3 {A {B {B {B,C OOAnalysis, Dagstuhl 2/03, BG Ryder 28

29 Points-to Analyses for C Popular flow- and context-insensitive formulations of points-to analysis Scalable Good enough for ensuring safety of some optimizations Good for program understanding applications Not great for applications needing precise def-use information (e.g., program slicing, testing) General approach is unification or inclusion constraints Newer versions kept track of individual struct fields as pointer targets Extended to points-to analyses for OOPL reference variables OOAnalysis, Dagstuhl 2/03, BG Ryder 29

30 Points-to Analyses for C Steensgaard s algorithm (POPL 96) Uses unification constraints so that for pointer assignments, p = q, algorithm makes Pts-to(p)=Pts-to(q) This union operation is done recursively for multiple-level pointers Reduces the size of the points-to graph (in terms of both nodes and edges) Almost linear solution time in terms of program size, O(n) using fast union-find algorithm Imprecision stems from merging points-to sets One points-to set per pointer variable over entire program OOAnalysis, Dagstuhl 2/03, BG Ryder 30

31 cf M Shapiro and S. Horwitz, Fast and Accurate Flow-insensitive Points-to Analysis POPL 97 Steensgaard - Example a b c a b c d e 4 d 3 e 1.a = &b 2.b = &c 3.d = &e 4.a = &d Points-to sets found 1 a b 2 c 4 d e a b,d c,e 4 OOAnalysis, Dagstuhl 2/03, BG Ryder 31

32 Steensgaard Solution Procedure - At a glance Find all pointer assignments in program Form set of points-to graph nodes from pointer variables/fields and variables (in the heap or whose address has been taken) Examine each statement, in arbitrary order, and construct points-to edges Merge nodes (and edges) where indicated by unification constraints After linear pass over these assignments, points-to graph is complete OOAnalysis, Dagstuhl 2/03, BG Ryder 32

33 Points-to Analysis for C Andersen s analysis (Thesis 1994) Uses inclusion constraints so that for pointer assignments, p = q, algorithm makes Pts-to(q) Õ Pts-to(p) Points-to graph is larger than Steensgaard s and more precise Cubic worst case complexity in program size, O(n 3 ) One points-to set per pointer variable over entire program OOAnalysis, Dagstuhl 2/03, BG Ryder 33

34 Andersen - Example 1.a = &b 2.b = &c 3.d = &e 4.a = &d 5.d = &f 6.g = d 7.g = *a a 1 2 b c 4 g 3 d e 5 f 6 Steensgaard solution 7 a 1 2 b c 4 d e 6 4 OOAnalysis, Dagstuhl 2/03, BG Ryder 34

35 Andersen s Solution Procedure - At a glance Find all pointer assignments in program Form set of points-to graph nodes from pointer variables/fields and variables on the heap or whose address is taken Examine each statement, in arbitrary order, and construct points-to edges Need to create more edges when see p = q type assignments so that all outgoing points-to edges from q are copied to be outgoing from p (i.e. processing inclusion constraints) If new outgoing edges are added to q during the algorithm, they must be also copied to p Work results in O(n 3 ) worst case cost OOAnalysis, Dagstuhl 2/03, BG Ryder 35

36 FieldSens Points-to Analysis Based on Andersen s points-to analysis Define and solve a system of annotated setinclusion constraints Handles virtual calls by simulation of run-time method lookup Models the fields of objects Extended BANE (UC Berkeley) constraint solver Analyzes only possibly executed code Ignores unreachable code from libraries Rountev, A. Milnova, B. Ryder, Points-to Analysis for Java Using Annotated Constraints OOPSLA 01 OOAnalysis, Dagstuhl 2/03, BG Ryder 36

37 Example of Points-to Analysis class A { void m(x p) {.. class B extends A { X f; void m(x q) { this.f=q; B b = new B(); X x = new X(); A a = b; a.m(x); A.m() not analyzed because it s unreachable. a b o 1 this B.m f x o 2 q OOAnalysis, Dagstuhl 2/03, BG Ryder 37

38 Annotated Constraints Form: L Õ a R L and R denote set expressions Annotation a: additional information (e.g., object fields) Kinds of set expressions L and R Set variables: represent points-to sets ref terms: represent objects Other kinds of expressions OOAnalysis, Dagstuhl 2/03, BG Ryder 38

39 Set variables and ref terms Set variables represent points-to sets For each reference variable p: V P For each object o: V o Object o is denoted by term ref(o,v o ) p o ref(o,v o ) Õ V P o f 1 o 2 ref(o 2,V o2 ) Õ f V o 1 OOAnalysis, Dagstuhl 2/03, BG Ryder 39

40 Example: Accessing Fields p = new A(); q = new B(); p.f = q; p o 1 ref(o 1,V O1 ) Õ V p ref(o 2,V O2 ) Õ V q V p Õ proj(ref,w) V q Õ f W q o 2 f Constraint generation OOAnalysis, Dagstuhl 2/03, BG Ryder 40

41 Example: Solving Constraints ref(o 1,V O1 ) Õ V p ref(o 2,V O2 ) Õ V q V p Õ proj(ref,w) Constraint resolution V q Õ f W W Õ V O1 o 1.f points to o 2 V q Õ f V O 1 ref(o 2,V O2 ) Õ f V O 1 OOAnalysis, Dagstuhl 2/03, BG Ryder 41

42 Example: Virtual Calls p.m(x); V P Õ m lam(v x ) receiver object o ref(o,v O ) Õ V P Actual method called, A.m V x Õ V z ref(o,v O ) Õ V this(a.m) OOAnalysis, Dagstuhl 2/03, BG Ryder 42

43 FieldSens Findings Empirical testing found Significant precision gains over RTA at call sites found to be polymorphic by CHA Could use points-to info in client analysis Object read-write information Synchronization removal (thread-local) Stack allocation (method-local) OOAnalysis, Dagstuhl 2/03, BG Ryder 43

44 Imprecision of Context Insensitivity class Y extends X { class A { X f; void m(x q) { this.f=q ; A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; a this A.m o 1 o 2 aa o 3 f o 4 f f f q OOAnalysis, Dagstuhl 2/03, BG Ryder 44

45 Object-sensitive Analysis Form of functional context sensitivity for flow-insensitive analysis of OO languages Formulate an object-sensitive Andersen s (points-to) analysis Analysis of instance methods and constructors distinguished for different contexts Receiver objects used to distinguish calling contexts Empirical evaluation vs. context-insensitive FieldSens analysis this, formals and return variables (effectively) replicated OOAnalysis, Dagstuhl 2/03, BG Ryder 45

46 Example: Object-sensitive Analysis o1 class A { X f; void m(x q) { this o1 o3 o1 A.m this.f=q o3; A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; OOAnalysis, Dagstuhl 2/03, BG Ryder 46 a o this 1 A.m o 1 f o 2 aa o 3 o 4 o q 1 A.m o 3 this A.m o 3 q A.m f

47 ObjSens Findings Precision gains for problems such as def-uses for object fields and side effect analysis (per statement) for practically no additional cost Clients Program test coverage metrics Program slicing Program understanding tools A. Milanova, A. Rountev, and B. Ryder. Parameterized object-sensitivity for points-to and side-effect analyses for Java. In International Symposium on Software Testing and Analysis, pages 1 11, OOAnalysis, Dagstuhl 2/03, BG Ryder 47

48 Context Sensitivity Distinguishes calling contexts Classically, has two forms (Sharir&Pneuli, 1983) Call string - keep (possibly truncated) call stack at call site associated with df solution Functional - keep (some) program state at call site associated with df solution OOAnalysis, Dagstuhl 2/03, BG Ryder 48

49 Incomparable Approaches to //in class R, w.subclasses Y,Z public R m(x x) { return x; R r = new R();//O 0 Y y = new Y();//O 1 Z z = new Z();//O 2 C1: y = r.m(y); C2: z = r.m(z); //ObjSens will report both y,z can point-to {O 1 O 2 because both calls C1,C2 have same receiver object; Call stack will separate effects of the two calls Context Sensitivity //in class R, w subclasses Y,Z public R m(x x) {return x; If (..) {r = new R();//O 1 y = new Y();//O 2 else {r = new R();//O 3 y = new Z();//O 4 C1: z = r.m(y); //call stack will combine effects of the two calls; ObjSens will differentiate the two dynamic calls by receiver objects O 1 O 3 OOAnalysis, Dagstuhl 2/03, BG Ryder 49

50 Recent Context-insensitive Points-to Analyses Liang et. al, Paste 01 Empirical comparison of flow- and context-insensitive analyses Steensgaard- and Andersen-based analyses for Java Static call graph (CHA, RTA) with on-the-fly Experiments with instance fields and abstract class fields Found Andersen (inclusion) analyses significantly more precise than Steensgaard (unification) Whaley and Lam, SAS 02 OOAnalysis, Dagstuhl 2/03, BG Ryder 50

51 More Reference Analyses Context-sensitive reference analyses Palsberg and Schwartzbach OOPSLA 91 Oxhoj, Palsberg, Schwartzbach ECOOP 92 Plevyak and Chien OOPSLA 94 Agesen ECOOP 95 Chatterjee, Ryder, Landi POPL 99 Ruf PLDI 00 Grove and Chambers TOPLAS 01 Most judged too expensive to scale in practice OOAnalysis, Dagstuhl 2/03, BG Ryder 51

52 Summary Have given overview of many reference analyses for OOPLs Many dimensions of design differences possible Key question: For a particular problem, how to select the analysis with appropriate precision and cost? OOAnalysis, Dagstuhl 2/03, BG Ryder 52

53 References O. Agesen. The cartesian product algorithm: Simple and precise type inference of parametric polymorphism. In European Conference on Object Oriented Programming, pages 2 26, 1995 L. O. Andersen. Program analysis and specialization for the C programming language. PhD thesis, DIKU, University of Copenhagen, Also available as DIKU report 94/19. D. Bacon and P. Sweeney, Fast Static Analysis of C++ Virtual Function Calls, OOPSLA 96 R. Chatterjee. Modular Data-flow Analysis of Statically Typed Objectoriented Programming Languages. PhD thesis, Department of Computer Science, Rutgers University, October R. Chatterjee, B. G. Ryder, and W. Landi. Relevant context inference. In Symposium onprinciples of Programming Languages, pages , J. Dean, D. Grove, C. Chambers, Optimization of OO Programs Using Static Class Hierarchy, ECOOP 95 OOAnalysis, Dagstuhl 2/03, BG Ryder 53

54 References David Grove and Craig Chambers. A framework for call graph construction algorithms. ACM Transactions on Programming Languages and Systems (TOPLAS), 23(6), Donglin Liang, Maikel Pennings, and Mary Jean Harrold. Evaluating the precision of static reference analysis using profiling. In Proceedings of the international symposium on Software testing and analysis, pages ACM Press, 2002 A. Milanova, A. Rountev, and B. Ryder. Parameterized object-sensitivity for points-to and side-effect analyses for Java. In International Symposium on Software Testing and Analysis, pages 1 11, N. Oxhoj, J. Palsberg, and M. Schwartzbach. Making type inference practical. In European Conference on Object-Oriented Programming, pages , J. Palsberg and M. Schwartzbach. Object-oriented type inference. In Conference on Object-Oriented Programming Systems, Languages, and Applications, pages , OOAnalysis, Dagstuhl 2/03, BG Ryder 54

55 References J. Plevyak and A. Chien. Precise concrete type inference for object oriented languages. In Proceeding of Conference on Object-Oriented Programming Systems, Languages and Applications.(OOPSLA 94), pages , October Rountev, A. Milnova, B. Ryder, Points-to Analysis for Java Using Annotated Constraints, OOPSLA 01 E. Ruf. Context-insensitive alias analysis reconsidered. In Proceedings of the SIGPLAN 95 Conference on Programming Language Design and Implementation, pages 13 22, June1995. Bjarne Steensgaard. Points-to analysis in almost linear time. In Conference Record of the Twenty-third Annual ACM SIGACT/SIGPLAN Symposium on Principles of Programming Languages, pages 32 41, V.Sundaresan, et. al, Practical Virtual Method Call Resolution for Java, OOPSLA 00 Tip and Palsberg, Scalable Propagation-based Call Graph Construction Algorithms, OOPSLA 00 J. Whaley and M. Lam. An efficient inclusion-based points-to analysis for strictly-typed languages. In Static Analysis Symposium, OOAnalysis, Dagstuhl 2/03, BG Ryder 55