Pointer Analysis. What is Points-to Analysis? Outline. What is Points-to Analysis? What is Points-to Analysis? What is Pointer Analysis? Rupesh Nasre.

Transcription

1 Pointer Analysis What is? Ruesh Nasre. CS6843 Analysis IIT Madras Jan 2016 = a; if ( == *) { } else { } a oints to x 4 Outline What is? Introduction Pointer analysis as a DFA rolem Design decisions analysis, Steensgrd's analysis Pointer analysis as a grah rolem Otimizations Pointer analysis as grah rewrite rules Alications Parallelization Constraint ased Relication ased 2 = a; if ( == *) { } else { } a oints to x a and are aliases 5 What is Pointer Analysis? What is? = a; if ( == *) { } else { } = a; if ( == *) { } else { } a oints to x a and are aliases Is this condition always satisfied? 3 6

2 What is? Placement of = a; a oints to x a and are aliases Lock synchronizer Parallelizing comiler Memory leak detector if ( == *) { Is this condition always satisfied? Data flow analyzer String vulneraility finder } else { } Pointer Analysis is is a mechanism to statically find out run-time values of a ointer. Better comile time time Affine exression analyzer slicer Tye analyzer 7 10 Why? Placement of for Parallelization fun() fun(q) for Otimization Imroved runtime Lock synchronizer Parallelizing comiler Memory leak detector a = + 2; = q + 2; Clients of Data flow analyzer String vulneraility finder for Bug-Finding for Understanding Better comile time time Affine exression analyzer Tye analyzer... slicer 8 11 Placement of Placement of Parallelizing comiler Imroved runtime Parallelizing comiler Lock synchronizer Memory leak detector Lock synchronizer Memory leak detector Data flow analyzer String vulneraility finder Data flow analyzer Secure code code String vulneraility finder Better comile time time Affine exression analyzer Tye analyzer Affine exression analyzer Tye analyzer slicer slicer 9 12

3 Placement of Imroved runtime Parallelizing comiler A C rogram can e normalized to contain only four tyes of ointer-maniulating statements or constraints. Lock synchronizer Memory leak detector Data flow analyzer Better comile time time Affine exression analyzer Secure code code String vulneraility finder Tye analyzer Points-to constraints = &q address-of q = q coy = *q load * = q store q slicer Better deugging A C rogram can e normalized to contain only four tyes of ointer-maniulating statements or constraints. A C rogram can e normalized to contain only four tyes of ointer-maniulating statements or constraints. Points-to constraints Points-to constraints = &q address-of = q coy = *q load * = q store q = &q address-of = q coy = *q load * = q store q A C rogram can e normalized to contain only four tyes of ointer-maniulating statements or constraints. A C rogram can e normalized to contain only four tyes of ointer-maniulating statements or constraints. Points-to constraints Points-to constraints q = &q address-of q = q coy = *q load * = q store q = &q address-of = q coy = *q load * = q store q 15 18

4 Definitions Cyclic Deendence Points-to analysis comutes oints-to information for each ointer. Alias analysis comutes aliasing information for all ointers. Aliasing information can e comuted using oints-to information, ut not vice versa. Clients often query for aliasing information, ut storing it is exensive O(n 2 ), hence frameworks store ointsto information. If a x, x is often called a ointee of a. Points-to information a {y, {y, z} z} c c {z} {z} Aliasing information a c a -- Yes No Yes c Call grah function ointers Otimization oints-to information 22 Nomenclarure Pointer analysis: Amiguous usage in literature. We will use it to refer to oth oints-to analysis and alias analysis. In the context of Java-like languages, it is called reference analysis. Also called as hea analysis. 20 As a DFA a = &x: &x: gen{a gen{a x} x} a = : : gen{a x} x} if if { { x} x} a = *: *: gen{a gen{a x} x} if if { { x} x} * * = a: a: gen{ x} x} if if { { and and a x} x} kill{ kill{ x} x} if if { { and and x} x} In(B) In(B) = U Out(P) Out(P) where where P Pred(B) Out(B) = Gen(B) U (In(B) (In(B) Kill(B)) a = = &z = &y = &a = a if c gen(b0) = {a, x if ax} kill(b0) = {tsto(), tsto()} gen(b1) = {ax if x, z} kill(b1) = {tsto(a), tsto()} gen(b2) = {ax,mn if m and kill(b2) = {tsto(tsto()), tsto(a)} n and m a} gen(b3) = { } kill(b3) = { } in1 out1 in2 out2 in3 out3 * = a = &x B0 {} { a} {} {a, {x,z {} {a, {x,z B1 {} {z} out1(b0) {a,a {x,z}, {z out2(b0) {a,a {x,z}, {z B2 {} {ax} out1(b0) {a,a {x}, {x,z out2(b0) {a,a {x}, {x,z B3 {} {} out1(b1) U out1(b2) {a,a {x,z}, {x,z out2(b1) U out2(b2) {a,a {x,z}, 23 {x,z B1 B3 B0 B2 Algeraic Proerties Aliasing relation is reflexive, symmetric, ut not transitive. Points-to relation is neither reflexive, nor symmetric, not even transitive. The oints-to relation induces a restricted DAG for strictly tyed languages. As a DFA: Notes Gen and Kill are dynamic (not fixed efore analysis). Gen/Kill and Points-to Information are cyclically deendent. Single coy of a variale leads to imrecision. e.g., a's oints-to set doesn't reach B0 in any execution, ut the analysis treats it otherwise

5 Design Decisions Context-sensitivity Analysis dimensions Hea modeling Set imlementation Call grah, function ointers Time Holy grail main() main() {{ L0: L0: fun(&x); L1: L1: fun(&y); fun(int *a) *a){{ = a; a; Context-sensitive solution: oints to x along L0, oints to y along L1 Context-insensitive solution: 's oints-to set is {x, y} in the rogram Array indices Memory Precision loss f main g g g g f Exonential Numer of contexts Along main-f1-g1, Along main-f1-g2, Along main-f2-g1, Along main-f2-g2, Exonential time requirement Exonential storage requirement 28 Analysis Dimensions Context-sensitivity An analysis's recision and efficiency is guided y various design decisions. Flow-sensitivity Context-sensitivity main() {{ L0: L0: fun(&x); L1: L1: fun(&y); fun(int *a) *a){{ = a; a; Inter-rocedural intra-rocedural Context-sensitive solution: oints to x along L0, oints to y along L1 Context-insensitive solution: 's oints-to set is {x, y} in the rogram 's oints-to set is {all address-taken variales} Path-sensitivity Field-sensitivity Flow-sensitivity Path-sensitivity L0: L0: L1: L1: a = &y; &y; L2: L2: Flow-sensitive solution: at L1 a oints to x, at L2 a oints to y Flow-insensitive solution: in the rogram a's oints-to set is {x, y} Flow-insensitive analyses ignore the control-flow in the rogram. if if (a (a == == 0) 0) = &x; &x; else else = &y; &y; Path-sensitive solution: oints-to x when a is 0, oints-to y when a is not 0 Path-insensitive solution: 's oints-to set is {x, y} in the rogram B2 B2 B1 B1 B4 B4 B3 B3 B1 B1 B3 B3 B2 B2 B4 B4 B1 B1 B2 B2 B3 B3 B4 B4 PP 27 if if (c1) (c1) while while (c2) (c2){{ if if (c3) (c3) else else for for (; (; c4; c4; )) else c1 and c2 and c3, c1 and c2 and!c3 and c4, c1 and c2 and!c3 and!c4, c1 and!c2,!c

6 Field-sensitivity Analysis: Modified Examle struct struct T s; s; s.a s. s. s. = &y; &y; Field-sensitive solution: s.a oints-to x, s. oints-to y Field-insensitive solution: s's oints-to set is {x, y} = &y; &y; = &a; &a; * * = c; c; c c = ; ; Constraints tsto(a) {x} {x} tsto() tsto() tsto(*) tsto(c) tsto(c) tsto() Order Order does does not not matter matter for for correctness, ut ut it it does does matter matter for for efficiency. efficiency. Aggregates are collased into a single variale. e.g., arrays, structures, unions. This reduces the numer of variales tracked during the analysis and reduces recision. fixed-oint Pointers Iteration 0 Iteration 1 Iteration 2 Iteration 3 a { } {x} {x, y} { } {y} c { } {y} { } {a} x { } 31 y { } 34 Analysis Inclusion-ased / suset-ased / constraint-ased analysis Flow-insensitive analysis For a statement = q, create a constraint tsto() tsto(q) where is of the form *a, a, and q is of the form *a, a, &a. Solving these inclusion constraints results into the oints-to solution. 32 Analysis: Classwork Constraints * * = c; c; = &y; &y; = *; *; = &a; &a; * * = c; c; c c = ; ; c c = &z; &z; tsto(*) tsto(c) tsto() tsto() tsto(*) tsto() tsto(a) {x} {x} tsto(*) tsto(c) tsto(c) tsto() tsto(c) {z} {z} fixed-oint Pointers Iteration 0 Iteration 1 Iteration 2 Iteration 3 a { } {x} {a, x, z} { } {y} {a, x, y, z} c { } {a, z} {a, z} { } x { } y { } z 35 Analysis: Examle Analysis: Otimizations = &y; = &a; c = ; * = c; Constraints tsto(a) {x} tsto() {y} tsto() {a} tsto(c) tsto() tsto(*) tsto(c) Avoid dulicates Reorder constraints Process address-of constraints once Difference roagation fixed-oint Pointers Iteration 0 Iteration 1 Iteration 2 a { } {x, y} { } {y} Imrecision c { } {y} { } {a} x { } y { } 33 36

7 Analysis: Comlexity Steensgrd's Hierarchy Total information comuted (storage) = O(n 2 ) From each ointer To each other ointer Proagate O(n) information O(n) times From each ointer To each other ointer Proagate O(n) information O(n⁴) O(n³) Oen: Can Can you you reduce the the ga ga etween storage and and time time comlexities? Naive Difference Proagation 37 *a *a, x *x = &y; &y; = &a; &a; c c = ; ; * * = c; c; a *a, x *x a c c *, y *y a, * *a, x *, y *y Steensgrd's a c *a, x *x *x a=&x =&y =&a c= *=c a, * *, *c, y *y a, * *a, *, *c, x, y *x, *y 40 Steensgrd's Analysis Unification-ased Almost linear time O(n α(n)) More imrecise For a statement = q, merge the oints-to sets of and q. In suset terms, tsto() tsto(q) and tsto(q) tsto() with a single reresentative element. 38 Classwork Steensgrd's * * = c; c; a {a, {a, x, x, z} z} = &y; &y; {a, {a, x, x, y, y, z} z} = *; *; c c {a, {a, z} z} = &a; &a; * * = c; c; c = ; ; c c = &z; &z; 41 Steensgrd's Analysis: Examle Steensgrd's Hierarchy = &y; = &a; c = ; * = c; a {x, y} {y} c {y} {a} Steensgrd's a {x, y} {x, y} c {x, y} {a} What is its structure? How many incoming edges to each node? How many outgoing edges from each node? Can there e cycles? Pointers Iteration 0 Iteration 1 a {*a} {*a, *, *c, x, y} {*} {*a, *, *c, x, y} c {*c} {*a, *, *c, x, y} {*} {*, a} x {*x} y {*y} Only Only one one iteration iteration 39 What haens to = &? What is the recision difference etween and Steensgrd's analyses? If for each P = Q, we add Q = P and solve using analysis, would it e equivalent to Steensgrd's analysis? 42

8 Unifying Model Two Unifying Model Two Steensgrd's hierarchy is characterized y a single outgoing edge. oints-to grah can have aritrary numer of outgoing edges (maximum n). = &y; &y; = &a; &a; c c = ; ; * * = c; c; a c c Steensgrd's a c Numer of edges in etween the two rovide recision-scalaility trade-off. a xx yy x, y Unifying Model Two Unifying Model Two Steensgrd's Steensgrd's = &y; &y; = &a; &a; c c = ; ; * * = c; c; a c c a c = &y; &y; = &a; &a; c c = ; ; * * = c; c; a = &z; &z; a c a c a, * a x y *a, *, *c, x, y xx yy zz x, y, z *x, *y Unifying Model Two Unifying Model Two Steensgrd's Steensgrd's In etween = &y; &y; = &a; &a; c c = ; ; * * = c; c; a c c a c = &y; &y; = &a; &a; c = ; ; * * = c; c; a = &z; &z; a c c a c a c c a a x y x, y xx yy zz x, y, z x, y zz 45 What if x and z are merged? 48

9 Unifying Model One Steensgrd's unification can e viewed as equality of oints-to sets. Thus, if a = merges their oints-to sets and = c merges their oints-to sets, then a and c ecome aliases! Rememer: aliasing is not transitive. So, unification adds transitivity to the aliasing relation. Back to Steensgrd's Aliasing relation is transitive. We know that it is also reflexive and symmetric. This means aliasing ecomes an equivalence relation. Steensgrd's unification artitions ointers into equivalent sets. qq All redecessors of a node form a artition. The equivalence sets are {, q}, {a, }, {c}, {x, y}, {z}. 49 x, y zz 52 Unifying Model One Realizale Facts A B C Steensgrd's A, B, C Statements oints-to a = &c &c a {, {, c} c} = &a &a {a, {a,,, c} c} c = & & c {} {} = a d {a, {a,,, c} c} = d = a Aliasing is non-transitive Aliasing ecomes transitive A realizaility sequence is a sequence of statements such that a given oints-to fact is satisfied. 50 The realizaility sequence for c is a=&c, =a. The realizaility sequence for a is c=&, =&a, *=c. Classwork: What is the realizaility sequence for d a? Classwork: What is the realizaility sequence for d c? a and c are realizale individually, ut not simultaneously. 53 Back to Steensgrd's Aliasing relation is transitive. We know that it is also reflexive and symmetric. This means aliasing ecomes an equivalence relation. Steensgrd's unification artitions ointers into equivalent sets. x, y, z All redecessors of a node form a artition. The equivalence sets are {}, {a,, c}, {x, y, z}. 51 int int *fun(int *a, *a, int int *) *){{ int int *c; *c; if if (*a (*a == == *) *){{ c c = ; ; else else {{ c c = a; a; return c; c; int int *g; *g; void void main() {{ int int *x, *x,*y, *y,*z, *z,**w; **w; int int m = 0, 0, n = 1; 1; char char *str; *str; x = &m; &m; y = &n; &n; str str = (char *)malloc(30); w = (int (int*)&str; if if (m (m < n) n) {{ strcy(str, m m is is smaller\n ); z = fun(y, x); x); else else {{ rintf( m is is >= >= n\n ); w = &x; &x; *w *w = fun(x, y); y); How do we take care of malloc? How do we take care of tye-casts? Find the set of normalized statements for intra-rocedural ointer analysis. Perform intra-rocedural analysis. How do we take care of strcy and rintf? How aout the gloal g? Perform inter-rocedural contextinsensitive analysis. Perform Steensgrd's analysis. 54

10 Extra Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Two dereferences Aritrary dereference Fixed dereference Aritrary dereference 55 Undecidale NP-Hard 58 Comlexity of Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Undecidale NP-Hard 56 Undecidale NP-Hard 59 Comlexity of Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Undecidale NP-Hard 57 Undecidale NP-Hard 60

11 Comlexity of Related Work Precision Context-Sensitive Context-Insensitive Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Flow-Sensitive Landi, Ryder 92 Choi et al. 93 Emami et al. 94 Res et al. 95 Hind et al. 99 Kahlon 08 Zheng 98 Hardekof, Lin 09 Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Undecidale NP-Hard 61 Precision Flow-insensitive Liang, Harrold 99 Whaley, Lam 04 Zhu, Calman 04 Lattner et al. 07 Surveys Hind, Pioli 00 Qiang, Wu 06 Andersen 94 Steensgrd 96 Shairo, Horwitz 97 Fahndrich et al. 98 Das 00 Rountev, Chandra 00 Berndl et al. 03 Hardekof, Lin 07 Pereira, Berlin 09 Mendez-Lojo Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Undecidale NP-Hard 62 Comlexity of Flow-sensitive Flow-insensitive Strongly tyed Weakly tyed Two dereferences Aritrary dereference Fixed dereference Aritrary dereference Undecidale NP-Hard 63