Complex, concurrent software. Precision (no false positives) Find real bugs in real executions

Transcription

1 Harry Xu May 2012

2 Complex, concurrent software Precision (no false positives) Find real bugs in real executions

3 Need to modify JVM (e.g., object layout, GC, or ISA-level code) Need to demonstrate realism (usually performance)

4 Otherwise use RoadRunner, BCEL, Pin, LLVM,

5 Keeping track of stuff as the program executes? Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC

6 Keeping track of stuff as the program executes? JVM written in Java?! Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC Uninterruptible code

7 Jikes RVM { Guide Research Archive Research mailing list

8 Jikes RVM { Guide Research Archive Research mailing list

9 Jikes RVM source code Boot image writer Dynamic compilers

10 Jikes RVM source code Boot image writer Run with another JVM Dynamic compilers

11 Jikes RVM source code Boot image writer Run with another JVM Dynamic compilers Boot image (native code + initial heap space)

12 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase BaseAdaptive FullAdaptive FastAdaptive Dynamic compilers Boot image (native code + initial heap space)

13 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase (prototype) BaseAdaptive (prototype-opt) FullAdaptive (development) FastAdaptive (production) Dynamic compilers Boot image (native code + initial heap space)

14 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase BaseAdaptive FullAdaptive FastAdaptive Testing Dynamic compilers Boot image (native code + initial heap space)

15 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase BaseAdaptive FullAdaptive FastAdaptive Faster builds Dynamic compilers Boot image (native code + initial heap space)

16 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase BaseAdaptive FullAdaptive FastAdaptive Faster runs Dynamic compilers Boot image (native code + initial heap space)

17 Jikes RVM source code Boot image writer Run with another JVM Build configurations: BaseBase BaseAdaptive FullAdaptive FastAdaptive Performance Dynamic compilers Boot image (native code + initial heap space)

18 Jikes RVM source code Boot image writer Run with another JVM Dynamic compilers Boot image (native code + initial heap space)

19 Jikes RVM source code Boot image writer Run with another JVM Edit with Eclipse (see Guide) Dynamic compilers Boot image (native code + initial heap space)

20 Keeping track of stuff as the program executes? Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC

21 Bytecode Baseline compiler Native code

22 Bytecode Baseline compiler Native code Each bytecode several x86 instructions (BaselineCompilerImpl.java)

23 Bytecode Baseline compiler Native code Each bytecode several x86 instructions (BaselineCompilerImpl.java)

24

25 Bytecode Baseline compiler Native code Profiling Adaptive optimization system

26 Bytecode Baseline compiler Native code Profiling Optimizing compiler (Faster) native code Adaptive optimization system

27 Bytecode Baseline compiler Native code Profiling Optimizing compiler (Faster) native code Adaptive optimization system

28 Bytecode Optimizing compiler (Faster) native code

29 Bytecode HIR Resembles bytecode Resembles typical compiler IR (3-address code) LIR (Faster) native code Resembles assembly code MIR

30 Bytecode HIR Opt levels: 0, 1, 2 LIR (Faster) native code MIR (Even faster) native code

31 Bytecode HIR Add instrumentation at reads, writes, allocation, synchronization ExpandRuntimeServices.java LIR (Faster) native code MIR

32

33

34

35 Keeping track of stuff as the program executes? Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC

36 header field0 field1 field2 Low address High address

37 Object reference type info block locking & GC field0 field1 field2

38 Object reference type info block locking & GC field0 field1 field2 Object reference type info block locking & GC Array length elem0 elem1

39 Object reference type info block locking & GC field0 field1 field2 Steal bits

40 Object reference misc type info block locking & GC field0 field1 field2 MiscHeader.java

41 Object reference counter type info block locking & GC field0 field1 field2

42 Object reference counter type info block locking & GC field0 field1 field2 Magic! Compiles down to three x86 instructions

43 Object reference counter type info block locking & GC field0 field1 field2 2 Gotcha: can t actually use LSB of leftmost word

44 Object reference counter type info block locking & GC field0 field1 field2 2 What s the problem with this code?

45 Object reference counter type info block locking & GC field0 field1 field2 2

46 Object reference not used type info block locking & GC field0 field1 field2

47 Object reference not used type info block locking & GC field0 field1 field2 Compiles down to three x86 instructions

48 Object reference misc type info block locking & GC field0 field1 field2

49 Object reference misc type info block locking & GC field0 field1 field2 What if GC moves object? What if GC collects object?

50 Keeping track of stuff as the program executes? Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC

51 Object reference type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f)

52 Object reference type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f)

53 Object reference type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f)

54 Object reference misc type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f) obj.misc = markandpossiblycopy(obj.f) worklist.push(obj.misc)

55 Object reference misc type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f) obj.misc = markandpossiblycopy(obj.f) worklist.push(obj.misc)

56 Object reference misc type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f) obj.misc = markandpossiblycopy(obj.f) worklist.push(obj.misc) TraceLocal.scanObject()

57 Object reference type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f)

58 Object reference type info block locking & GC field0 field1 field2 // Initially worklist populated with roots while worklist has elements Object obj = worklist.pop() foreach reference field obj.f obj.f = markandpossiblycopy(obj.f) worklist.push(obj.f) TraceLocal.processNode()

59 Keeping track of stuff as the program executes? Change application behavior (add instrumentation) Store per-object/per-field metadata Piggyback on GC Uninterruptible code

60 Normal application code can be interrupted Allocation GC Synchronization & yield points join a GC Some VM code shouldn t be interrupted Heap etc. in inconsistent state Most instrumentation can t be interrupted Reads & writes aren t GC-safe points

61 @Uninterruptible static void mymethod(object o) { } // No allocation or synchronization // No calls to interruptible methods

62 @Uninterruptible static void mymethod(object o) { currentthread.defergc = true; Metadata m = new Metadata(); currentthread.defergc = false; } setmischeader(o, offset, m);

63 Need to modify JVM internals Need to demonstrate realism Guide Overview of other tasks & components Jikes RVM Research Archive Dynamic analysis examples Research mailing list Help (especially for novices)

64 Object layout Extra bits or words in header Stealing bits from references Discuss magic here Adding instrumentation Baseline & optimizing compilers Allocation sites; reads & writes Inlining instrumentation Garbage collection Piggybacking on GC New spaces Low-level stuff Uninterruptible code Walking the stack Concurrency Atomic stores Thread-local data