Pointer Analysis. What is Points-to Analysis? Outline. What is Points-to Analysis? What is Points-to Analysis? What is Pointer Analysis? Rupesh Nasre.

Transcription

1 Pointer Anlysis Wht is? Ruesh Nsre. CS6843 Anlysis IIT Mdrs Jn 2014 = &x; = ; if ( == *) { } else { } oints to x 4 Outline Wht is? Introduction Pointer nlysis s DFA rolem Design decisions nlysis, Steensgrd's nlysis Pointer nlysis s grh rolem Otimiztions Pointer nlysis s grh rewrite rules Alictions Prlleliztion Constrint sed Reliction sed 2 = &x; = ; if ( == *) { } else { } oints to x nd re lises 5 Wht is Pointer Anlysis? Wht is? = &x; = ; if ( == *) { } else { } = &x; = ; if ( == *) { } else { } oints to x nd re lises Is this condition lwys stisfied? 3 6

2 Wht is? Plcement of = &x; = ; oints to x nd re lises Lock synchronizer Prllelizing comiler Memory lek detector if ( == *) { Is this condition lwys stisfied? Dt flow nlyzer String vulnerility finder } else { } Pointer Anlysis is is mechnism to stticlly find out run-time vlues of ointer. Better comile time time Affine exression nlyzer slicer Tye nlyzer 7 10 Why? Plcement of for Prlleliztion fun() fun() for Otimiztion Imroved runtime Lock synchronizer Prllelizing comiler Memory lek detector = + 2; = + 2; Clients of Dt flow nlyzer String vulnerility finder for Bug-Finding for Understnding Better comile time time Affine exression nlyzer Tye nlyzer... slicer 8 11 Plcement of Plcement of Prllelizing comiler Imroved runtime Prllelizing comiler Lock synchronizer Memory lek detector Lock synchronizer Memory lek detector Dt flow nlyzer String vulnerility finder Dt flow nlyzer Secure code code String vulnerility finder Better comile time time Affine exression nlyzer Tye nlyzer Affine exression nlyzer Tye nlyzer slicer slicer 9 12

3 Plcement of Imroved runtime Prllelizing comiler A C rogrm cn e normlized to contin only four tyes of ointer-mniulting sttements or constrints. Lock synchronizer Memory lek detector Dt flow nlyzer Better comile time time Affine exression nlyzer Secure code code String vulnerility finder Tye nlyzer Points-to constrints = & ddress-of = coy = * lod * = store slicer Better deugging A C rogrm cn e normlized to contin only four tyes of ointer-mniulting sttements or constrints. A C rogrm cn e normlized to contin only four tyes of ointer-mniulting sttements or constrints. Points-to constrints Points-to constrints = & ddress-of = coy = * lod * = store = & ddress-of = coy = * lod * = store A C rogrm cn e normlized to contin only four tyes of ointer-mniulting sttements or constrints. A C rogrm cn e normlized to contin only four tyes of ointer-mniulting sttements or constrints. Points-to constrints Points-to constrints = & ddress-of = coy = * lod * = store = & ddress-of = coy = * lod * = store 15 18

4 Definitions Cyclic Deendence Points-to nlysis comutes oints-to informtion for ech ointer. Alis nlysis comutes lising informtion for ll ointers. Alising informtion cn e comuted using oints-to informtion, ut not vice vers. Clients often uery for lising informtion, ut storing it is exensive O(n 2 ), hence frmeworks store ointsto informtion. If x, x is often clled ointee of. Points-to informtion {y, {y, z} z} c c {z} {z} Alising informtion c -- Yes No Yes c Cll grh function ointers Otimiztion oints-to informtion 22 Nomenclrure Pointer nlysis: Amiguous usge in literture. We will use it to refer to oth oints-to nlysis nd lis nlysis. In the context of Jv-like lnguges, it is clled reference nlysis. Also clled s he nlysis. 20 As DFA = &x: &x: gen{ gen{ x} x} = : : gen{ x} x} if if { { x} x} = *: *: gen{ gen{ x} x} if if { { x} x} * * = : : gen{ x} x} if if { { nd nd x} x} kill{ kill{ x} x} if if { { nd nd x} x} In(B) In(B) = U Out(P) Out(P) where where P Pred(B) Out(B) = Gen(B) U (In(B) (In(B) Kill(B)) = = &z = &y = & = if c gen(b0) = {} kill(b0) = {tsto(), tsto()} gen(b1) = {x if x, z} kill(b1) = {tsto(), tsto()} gen(b2) = {x,mn if m nd kill(b2) = {tsto(tsto()), tsto()} n nd m } gen(b3) = { } kill(b3) = { } in1 out1 in2 out2 in3 out3 * = = &x B0 {} { } {} {, {x,z}} {} {, {x,z}} B1 {} {z} out1(b0) {, {x,z}, {x,z}} out2(b0) {, {x,z}, {x,z}} B2 {} {x} out1(b0) {, {x,z}, {x,z}} out2(b0) {, {x,z}, {x,z}} B3 {} {} out1(b1) U out1(b2) {, {x,z}, {x,z}} out2(b1) U out2(b2) 23 {, {x,z}, {x,z}} B1 B3 B0 B2 Algeric Proerties Design Decisions Alising reltion is reflexive, symmetric, ut not trnsitive. Points-to reltion is neither reflexive, nor symmetric, not even trnsitive. The oints-to reltion induces restricted DAG for strictly tyed lnguges. Anlysis dimensions He modeling Set imlementtion Cll grh, function ointers Arry indices Memory Time Holy gril Precision loss 21 24

5 Anlysis Dimensions Context-sensitivity An nlysis's recision nd efficiency is guided y vrious design decisions. Flow-sensitivity Context-sensitivity min() {{ L0: L0: fun(&x); L1: L1: fun(&y); }} fun(int *) *){{ = ; ; }} Inter-rocedurl intr-rocedurl Context-sensitive solution: oints to x long L0, oints to y long L1 Context-insensitive solution: 's oints-to set is {x, y} in the rogrm 's oints-to set is {ll ddress-tken vriles} Pth-sensitivity Field-sensitivity Flow-sensitivity Pth-sensitivity L0: L0: L1: L1: = &y; &y; L2: L2: Flow-sensitive solution: t L1 oints to x, t L2 oints to y Flow-insensitive solution: in the rogrm 's oints-to set is {x, y} Flow-insensitive nlyses ignore the control-flow in the rogrm. if if ( ( == == 0) 0) = &x; &x; else else = &y; &y; Pth-sensitive solution: oints-to x when is 0, oints-to y when is not 0 Pth-insensitive solution: 's oints-to set is {x, y} in the rogrm B2 B2 B1 B1 B4 B4 B3 B3 B1 B1 B3 B3 B2 B2 B4 B4 B1 B1 B2 B2 B3 B3 B4 B4 PP 26 if if (c1) (c1) while while (c2) (c2){{ if if (c3) (c3) else for for (; (; c4; c4; )) }} else else c1 nd c2 nd c3, c1 nd c2 nd!c3 nd c4, c1 nd c2 nd!c3 nd!c4, c1 nd!c2,!c Context-sensitivity Field-sensitivity min() {{ L0: L0: fun(&x); L1: L1: fun(&y); }} fun(int *) *){{ = ; ; }} Context-sensitive solution: oints to x long L0, oints to y long L1 Context-insensitive solution: 's oints-to set is {x, y} in the rogrm struct T s; s; s. s. s. s. = &y; &y; Field-sensitive solution: s. oints-to x, s. oints-to y Field-insensitive solution: s's oints-to set is {x, y} f min g g g g... f Exonentil Numer of contexts Exonentil time reuirement Along min-f1-g1, Along min-f1-g2, Along min-f2-g1, Along min-f2-g2,... Exonentil storge reuirement 27 Aggregtes re collsed into single vrile. e.g., rrys, structures, unions. This reduces the numer of vriles trcked during the nlysis nd reduces recision. 30

6 Anlysis Inclusion-sed / suset-sed / constrint-sed nlysis Flow-insensitive nlysis For sttement =, crete constrint tsto() tsto() where is of the form *,, nd is of the form *,, &. Solving these inclusion constrints results into the oints-to solution. 31 Anlysis: Clsswork Constrints * * = c; c; = &y; &y; = *; *; = &; &; * * = c; c; c c = ; ; c c = &z; &z; tsto(*) tsto(c) tsto() tsto() tsto(*) tsto() tsto() {x} {x} tsto(*) tsto(c) tsto(c) tsto() tsto(c) {z} {z} fixed-oint Pointers Itertion 0 Itertion 1 Itertion 2 Itertion 3 { } {x} {, x, z} { } {y} {, x, y, z} c { } {, z} {, z} { } x { } y { } z 34 Anlysis: Exmle Anlysis: Otimiztions = &x; = &y; = &; c = ; * = c; Constrints tsto() {x} tsto() {y} tsto() {} tsto(c) tsto() tsto(*) tsto(c) fixed-oint Pointers Itertion 0 Itertion 1 Itertion 2 { } {x, y} { } {y} c { } {y} { } {} x { } y { } Imrecision 32 Avoid dulictes Reorder constrints Process ddress-of constrints once Difference rogtion 35 Anlysis: Modified Exmle Anlysis: Comlexity = &y; &y; = &; &; * * = c; c; c = ; ; Constrints tsto() {x} {x} tsto() Order Order does does not not mtter mtter tsto() for for correctness, tsto(*) tsto(c) ut ut it it does does mtter mtter tsto(c) tsto() for for efficiency. efficiency. fixed-oint Pointers Itertion 0 Itertion 1 Itertion 2 Itertion 3 { } {x} {x, y} { } {y} c { } {y} { } {} x { } y { } 33 Totl informtion comuted (storge) = O(n ) From ech ointer To ech other ointer Progte O(n) informtion O(n) times From ech ointer To ech other ointer Progte O(n) informtion O(n⁴) O(n³) Oen: Cn Cn you you reduce the the g g etween storge nd nd time time comlexities? Nive Difference Progtion 36

7 Steensgrd's Anlysis Unifiction-sed Almost liner time O(n α(n)) More imrecise For sttement =, merge the oints-to sets of nd. In suset terms, tsto() tsto() nd tsto() tsto() with single reresenttive element. 37 Steensgrd's Hierrchy Wht is its structure? How mny incoming edges to ech node? How mny outgoing edges from ech node? Cn there e cycles? Wht hens to = &? Wht is the recision difference etween nd Steensgrd's nlyses? If for ech P = Q, we dd Q = P nd solve using nlysis, would it e euivlent to Steensgrd's nlysis? 40 Steensgrd's Anlysis: Exmle Unifying Model Two = &x; = &y; = &; c = ; * = c; {x, y} {y} c {y} {} Steensgrd's {x, y} {x, y} c {x, y} {} Steensgrd's hierrchy is chrcterized y single outgoing edge. oints-to grh cn hve ritrry numer of outgoing edges (mximum n). Pointers Itertion 0 Itertion 1 {*} {*, *, *c, x, y} {*} {*, *, *c, x, y} Only Only one one itertion itertion Numer of edges in etween the two rovide recision-sclility trde-off. c {*c} {*, *, *c, x, y} {*} {*, } x {*x} y {*y} Steensgrd's Hierrchy Unifying Model Two Steensgrd's Steensgrd's = &y; &y; = &; &; c = ; ; * * = c; c; c c c = &y; &y; = &; &; c = ; ; * * = c; c; c c c * *, x *x *, x *x *, y *y, * *, x *, y *y, * *, x *, *c, y *y, * *, *, *c, x, y xx yy, * *, *, *c, x, y *x *x =&x =&y =& c= *=c *x, *y 39 *x, *y 42

8 Unifying Model Two Unifying Model Two = &y; &y; = &; &; c c = ; ; * * = c; c; c c Steensgrd's c = &y; &y; = &; &; c c = ; ; * * = c; c; = &z; &z; c c Steensgrd's c In etween c c x y x, y xx yy zz x, y, z x, y zz 43 Wht if x nd z re merged? 46 Unifying Model Two Unifying Model One = &y; &y; = &; &; c c = ; ; * * = c; c; c c x y Steensgrd's c x, y Steensgrd's unifiction cn e viewed s eulity of oints-to sets. Thus, if = merges their oints-to sets nd = c merges their oints-to sets, then nd c ecome lises! Rememer: lising is not trnsitive. So, unifiction dds trnsitivity to the lising reltion Unifying Model Two Unifying Model One Steensgrd's = &y; &y; = &; &; c c = ; ; * * = c; c; = &z; &z; c c c A B C Steensgrd's A, B, C Alising is non-trnsitive Alising ecomes trnsitive x y zz x, y, z 45 48

9 Bck to Steensgrd's Alising reltion is trnsitive. We know tht it is lso reflexive nd symmetric. This mens lising ecomes n euivlence reltion. Steensgrd's unifiction rtitions ointers into euivlent sets. Extr All redecessors of node form rtition. The euivlence sets re {}, {,, c}, {x, y, z}. x, y, z Bck to Steensgrd's Alising reltion is trnsitive. We know tht it is lso reflexive nd symmetric. This mens lising ecomes n euivlence reltion. Steensgrd's unifiction rtitions ointers into euivlent sets. Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed All redecessors of node form rtition. The euivlence sets re {, }, {, }, {c}, {x, y}, {z}. Two dereferences Aritrry dereference Fixed dereference Aritrry dereference x, y zz 50 Undecidle NP-Hrd 53 Relizle Fcts Sttements oints-to = &c &c {, {, c} c} = & & {, {,,, c} c} c c = & & c {} {} = d {, {,,, c} c} = d = Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed A relizility seuence is seuence of sttements such tht given oints-to fct is stisfied. The relizility seuence for c is =&c, =. The relizility seuence for is c=&, =&, *=c. Clsswork: Wht is the relizility seuence for d? nd c re relizle individully, ut not simultneously. Two dereferences Aritrry dereference Fixed dereference Aritrry dereference 51 Undecidle NP-Hrd 54

10 Comlexity of Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Undecidle NP-Hrd 55 Undecidle NP-Hrd 58 Comlexity of Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Undecidle NP-Hrd 56 Undecidle NP-Hrd 59 Comlexity of Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Flow-sensitive Flow-insensitive Strongly tyed Wekly tyed Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Two dereferences Aritrry dereference Fixed dereference Aritrry dereference Undecidle NP-Hrd 57 Undecidle NP-Hrd 60

11 Precision Relted Work Precision Context-Sensitive Flow-Sensitive Lndi, Ryder 92 Choi et l. 93 Emmi et l. 94 Res et l. 95 Hind et l. 99 Khlon 08 Flow-insensitive Ling, Hrrold 99 Whley, Lm 04 Zhu, Clmn 04 Lttner et l. 07 Surveys Hind, Pioli 00 Qing, Wu 06 Context-Insensitive Zheng 98 Hrdekof, Lin 09 Andersen 94 Steensgrd 96 Shiro, Horwitz 97 Fhndrich et l. 98 Ds 00 Rountev, Chndr 00 Berndl et l. 03 Hrdekof, Lin 07 Pereir, Berlin 09 Mendez-Lojo 10 61