Effective Static Race Detection for Java. Part I. Chord. Chord. Chord. Chord - Overview. Problems addressed

Transcription

1 Eective Static Race Detection or Java Mayer Naik, Alex Aiken, John Whaley Part I Introduction to Chord and Preliminaries presented by Matt McGill Chord Chord Chord is a static (data) race detection tool or Java Problems addressed Open Programs Precision - minimizing alse positives Scalability - handling large programs Synchronization Idioms Counterexamples - making debugging less painul Chord Chord - Overview Input - OriginalPairs Synchronization Idioms supported lexically-scoped lock-based synchronization ork/join synchronization relying partially on user-supplied annotations wait/notiy synchronization reduces to lock-based synchronization in Java

2 Input - OriginalPairs Chord - Overview What are alias analysis/call-graph construction? Preliminaries: Data Flow Analyses Call-graph construction Alias analysis For each method, which other methods call it? Doesn t sound so bad? Undecidable. For each abstract memory location, determine the set o L-value expressions that alias it at each program point. Also undecidable. We calculate approximations Preliminaries: Data Flow Analyses Call-graph construction Alias analysis For each method, which other methods may call it? For each abstract memory location, determine the set o L-value expressions that may alias it at each program point. There are many techniques or solving these problems with varying degrees o precision Intraprocedural Analyses Intraprocedural analyses examine individual procedures using control low graphs (CFG) List map(f, List lst) { List nlst = new ArrayList(); or (int i=0; i<lst.size(); i++) { Object arg = lst.get(i); Object result =.apply(arg); nlst.add(result); return nlst; alse Entry List nlst=new ArrayList(); or (int i=0; i<lst.size(); Object arg = lst.get(i); Object result=.apply(arg); nlst.add(result); i++; true return nlst; Exit Intraprocedural Analysis Interprocedural Analyses Data low analysis represents the low o data between program points as a system o equations Provided the equations meet certain criteria, the equations can be solved using an iterative method For call-graph construction/alias analysis to be remotely useul, we must identiy and utilize relationships among procedures alse Entry List nlst=new ArrayList(); or (int i=0; i<lst.size(); true Object obj = lst.get(i); Object nobj=.apply(obj); nlst.add(nobj); i++; return nlst; Exit Interprocedural analysis techniques can be categorized according to: low sensitivity - does the analysis make use o control low within procedures? context sensitivity - does the analysis compute dierent results or methods based on context inormation (typically call sites)?

3 Chord Object Sensitivity Chord is low-insensitive Chord is context-sensitive Not in the traditional way! Chord instead uses k-object sensitivity, a relatively recent notion o context tailored to the needs objectoriented programs class X {... class Y { X ; void set(x x) { 1: this. = x; public static void 2: X x1 = new X(); //s1 3: X x2 = new X(); //s2 4: Y y1 = new Y(); //s3 5: Y y2 = new Y(); //s4 6: y1.set(x1); 7: y2.set(x2); Flow-insensitive, contextinsensitive alias analysis might iner: x1 x x2 y1 y2 this o1 o3 o2 o4 Object Sensitivity Object Sensitivity For an allocation site si in a method m, an object name oij is created or every allocation site sj that creates an object that m could be called on. Each object name is equated with a context. Each method m is analyzed separately or each context in which it could be called. class W {... class X {... class Y { void oo(x x) { 1: W w = new W(); //s5 2: w.bar(x); public static void 3: X x1 = new X(); //s1 4: X x2 = new X(); //s2 5: Y y1 = new Y(); //s3 6: Y y2 = new Y(); //s4 7: y1.oo(x1); 8: y2.oo(x2); Object names are used as contexts in which to analyze methods o1! o2! Contexts bar contexts o3! o4! o53 o54 oo contexts k-object Sensitivity We just described k-object sensitivity or k=1 For higher k, increase the maximum length o the allocation-site chain (i.e. the number o subscripts on your object names, or the number o levels o indirection you re ollowing) Common OO design patterns such as Visitor harm precision or k=1 Authors ound k=3 to be suitable balance or detecting data races with useul precision Eicient k-object Sensitivity Publicly available k-object sensitivity tools ran out o memory or k=1 Authors expressed k-object sensitive alias analysis (and other analyses, and race detection algorithm) in Datalog, a logic programming language similar to Prolog Used Datalog implementation bddbddb based on Binary Decision Diagrams to achieve scalability

4 Overview Input - OriginalPairs Part II Four Stages o the Race Detection Algorithm Closing Open Programs Closing Open Programs 1. Declare a local variable o each type allowed as argument or return value o any method in the interaces to be checked 2. Assign an object to each reerence variable 3. Invoke each method in external interace on each legal combination o local reerence variables Problems with closing open programs: missing callees missing callers The method described is unsound (but in practice that s OK!) Question: how does this aect useulness the authors stated goal o adding low sensitivity at a later point? public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); + (new A()).wr(1); Running Example i (*) a=new A(); public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); + (new A()).wr(1); OriginalPairs Intuitively, we start with every pair o memory accesses to the same ield/array element that aren t immediately ruled out by Java s typing rules

5 OriginalPairs i (*) a=new A(); public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); + (new A()).wr(1); Prune all pairs o memory accesses (e1, e2) that cannot take place in dierent threads We ll cover this stage in detail, look at examples or the others OriginalPairs=((r,w),(w,w),(r,w ),(w, w ),(w, w )) We start with: a unction rom call sites (and accesses) to containing methods A unction rom call sites and contexts to pairs o callee methods and contexts A set o call sites that spawn threads Next we deine thread insensitive and sensitive relations rom call sites/contexts to methods/ contexts directly... And do something similar to transitive closure to obtain relations rom call sites/contexts to methods/contexts indirectly: Next, compute the roots, thread-spawning call sites reachable rom main: Finally, retain pairs only i each access is reachable, without switching threads, rom a root:

6 i (*) a=new A(); //ca! public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); =((r,w),(w,w),(r,w ),(w, w ),(w, w )) Why? = ((r,ca!,w,ca!), (r,ca!,w,cba) (w,ca!,w,ca!) (w,ca!,w,cba) (w,cba,w,ca!)(w,cba,w,cba)) AliasingPairs Intuitively: remove all pairs that alias analysis shows cannot access the same abstract object as is commonly done, all reerences to static ield reerences are treated as i perormed on a single dummy object individual elements in arrays are merged AliasingPairs i (*) a=new A(); //ca! public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); AliasingPairs=((r,w),(w,w)) AliasingPairs = ((r,ca!,w,ca!), (r,ca!,w,cba) (w,ca!,w,ca!) (w,ca!,w,cba) (w,cba,w,ca!)(w,cba,w,cba)) EscapingPairs Intuitively: prune pairs that do not access thread-shared data Implemented in 3(!!) lines o Datalog EscapingPairs i (*) a=new A(); //ca! public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); EscapingPairs=((r,w),(w,w)) EscapingPairs = ((r,ca!,w,ca!),(w,ca!,w,ca!),(w,cba,w,cba)) UnlockedPairs Intuitively: prune pairs o accesses that are always protected by a common lock Can be thought o as a static approximation o the Lockset technique To do this soundly requires a must-alias analysis, but they substitute their may-alias analysis Authors reported that no alse negatives resulted rom this simpliication during their testing

7 UnlockedPairs=((r,w),(w,w)) UnlockedPairs = ((r,ca!,w,ca!),(w,ca!,w,ca!)) UnlockedPairs i (*) a=new A(); //ca! public A() { this.=0; //w private int rd() { return this.; //r return x; public int get() { return this.rd(); Reporting Races Paths through context-sensitive call graph are used to provide a stack trace or each potential data race Races are classiied by ield and by (abstract) object Identiication o the allocation site or objects involved in races should aid debugging Sources o Unsoundness Part III Evaluation may-analysis instead o must-analysis in ourth stage method o closing open programs does not model all possibilities potential races in constructors/initializers are ignored no attempt to deal with relection or dynamic class loading Perormance runtime was typically around one minute Apache Derby (~640KLOC) took 26 minutes memory consumption was unreported; test machine had 4GB was Derby pushing the complexity limits o the BDD solver, or did that analysis suer rom disk paging perormance hits? Observations Number o reported problems was very reasonable given program sizes escape analysis had negligible impact in about hal o the analyses the ability to check parts o programs at an arbitrary level o granularity makes Chord a very scalable tool