Reference Analyses. VTA - Variable Type Analysis
|
|
- Archibald Newton
- 6 years ago
- Views:
Transcription
1 Reference Analyses Variable Type Analysis for Java Related points-to analyses for C Steengaard Andersen Field-sensitive points-to for Java Object-sensitive points-to for Java Other analysis approaches 1 VTA - Variable Type Analysis Analysis included in the McGill SOOT system How works? follows type propagation from a new site through plausible chains of assignments to reference variables Builds a type propagation graph, using a CHA call graph Nodes are reference vars/fields/parameters Edges represent reference to reference assignments Initializes types for some reference nodes with type from an associated object creation site Propagates types along directed edges Effectively, this is a points-to analyses using inclusion relations and abstract objects with fields, that traces flow through reference assignments 2 1
2 cf. V.Sundaresan, et. al, Practical Virtual Method Call Resolution for Java, OOPSLA 00 VTA Uses a separate representative program-wide for each named reference Propagates one abstract object per class to represent all created objects of that class Is a flow-insensitive, context-insensitive analysis //B extends A A a1, a2, a3; B b3; a2 = new A(); a1 = a2; a3 = a1; a3 = b3; b3 = (B)a3; a1 a2 a3 {A} b3 Initial graph and types cf. Sundaresan et. al 3 VTA Example //B extends A A a1, a2, a3; B b3; a2 = new A(); a1 = a2; a3 = a1; a3 = b3; b3 = (B)a3; {A} a1 a2 a3 {A} {A} b3 scc collapsed Empirical results report 30% CHA call graph edges removed in most cases by VTA 4 2
3 Points-to Analyses for C Popular flow- and context-insensitive formulations of points-to analysis Scalable Good enough for ensuring safety of some optimizations Good for program understanding applications Not great for applications needing precise def-use information (e.g., program slicing, testing) General approach is unification or inclusion constraints Newer versions kept track of individual struct fields as pointer targets Extended to points-to analyses for OOPL reference variables 5 Points-to Analyses for C Steensgaard s algorithm (POPL 96) Uses unification constraints so that for pointer assignments, p = q, algorithm makes Pts-to(p)=Pts-to(q) This union operation is done recursively for multiple-level pointers Reduces the size of the points-to graph (in terms of both nodes and edges) Almost linear solution time in terms of program size, O(n) Uses fast union-find algorithm Imprecision stems from merging points-to sets One points-to set per pointer variable over entire program 6 3
4 cf M Shapiro and S. Horwitz, Fast and Accurate Flow-insensitive Points-to Analysis POPL a b c d Steensgaard - Example e 1 2 a b c d 3 e 1.a = &b 2.b = &c 3.d = &e 4.a = &d Points-to sets found 1 a b 2 c 4 d e 3 a b,d c,e 7 Steensgaard Solution Procedure - At a glance Find all pointer assignments in program Form set of points-to graph nodes from pointer variables/fields and variables (in the heap or whose address has been taken) Examine each statement, in arbitrary order, and construct points-to edges Merge nodes (and edges) where indicated by unification constraints After linear pass over these assignments, points-to graph is complete 8 4
5 Points-to Analysis for C Andersen s analysis Uses inclusion constraints so that for pointer assignments, p = q, algorithm makes Pts-to(q) Õ Pts-to(p) Points-to graph is larger than Steensgaard s and more precise Cubic complexity in program size, O(n 3 ) One points-to set per pointer variable over entire program 9 Andersen - Example 7 1.a = &b 2.b = &c 3.d = &e 4.a = &d 5.d = &f 6.g = d 7.g = *a 1 2 a b c 4 g d 3 e 6 6 Steensgaard solution 5 f a 1 b 2 c 3 d e
6 Andersen s Solution Procedure - At a glance Find all pointer assignments in program Form set of points-to graph nodes from pointer variables/fields and variables on the heap or whose address is taken Examine each statement, in arbitrary order, and construct points-to edges Need to create more edges when see p = q type assignments so that all outgoing points-to edges from q are copied to be outgoing from p (i.e. processing inclusion constraints) If new outgoing edges are added to q during the algorithm, they must be also copied to p Work results in O(n 3 ) worst case cost 11 Points-to Analysis for Java Which objects may reference variable x point to? Builds a points-to graph to encapsulate points-to relations between objects and between references and objects x o 1 f y o
7 Field-sensitive Points-to Analysis Based on Andersen s points-to analysis Define and solve a system of annotated setinclusion constraints Handles virtual calls by simulation of run-time method lookup Models the fields of objects Extended BANE (UC Berkeley) constraint solver Analyzes only possibly executed code Ignores unreachable code from libraries Rountev, A. Milnova, B. Ryder, Points-to Analysis for Java Using Annotated Constraints OOPSLA Points-to Analysis in Action class A { void m(x p) {..} } class B extends A { X f; void m(x q) { this.f=q; } } B b = new B(); X x = new X(); A a = b; a.m(x); A.m() not analyzed because it s unreachable. a b o 1 this B.m f x o 2 q 14 7
8 Annotated Constraints Form: L Õ a R L and R denote set expressions Annotation a: additional information (e.g., object fields) Kinds of set expressions L and R Set variables: represent points-to sets ref terms: represent objects Other kinds of expressions 15 Set variables and ref terms Set variables represent points-to sets For each reference variable p: V P For each object o: V o Object o is denoted by term ref(o,v o ) p o o f 1 o 2 ref(o,v o ) Õ V P ref(o 2,V o2 ) Õ f V o
9 Example: Accessing Fields p = new A(); q = new B(); p.f = q; ref(o 1,V O1 ) Õ V p ref(o 2,V O2 ) Õ V q V p Õ proj(ref,w) p o 1 V q Õ f W q o 2 f Constraint generation 17 Example: Solving Constraints ref(o 1,V O1 ) Õ V p ref(o 2,V O2 ) Õ V q V p Õ proj(ref,w) V q Õ f W Constraint resolution W Õ V O1 o 1.f points to o 2 V q Õ f V O 1 ref(o 2,V O2 ) Õ f V O1 18 9
10 Example: Virtual Calls p.m(x); V P Õ m lam(v x ) receiver object o ref(o,v O ) Õ V P Actual method called, A.m(z) V x Õ V z ref(o,v O ) Õ V this(a.m) 19 Experiments 23 Java programs: user classes Added the necessary library classes Machine: 360 MHz, 512Mb SUN Ultra-60 Cost measured in time and memory Precision (wrt usage in client analyses and tranformations) Object read-write information Call graph construction Synchronization removal and stack allocation 20 10
11 Analysis Time Seconds proxy compress db jb echo raytrace mtrt jtar jlex javacup rabbit jack jflex jess mpegaudio jjtree sablecc javac creature mindterm soot muffin javacc 21 Resolution of Virtual Call Sites % Resolved Call Sites proxy db echo mtrt jlex Points-to rabbit jflex RTA mpegaudio sablecc creature soot javacc 22 11
12 Thread-local new sites 70% 60% % Thread-local Sites 50% 40% 30% 20% 10% 0% 23 Imprecision of Context-insensitive Analysis Does not distinguish contexts for instance methods and constructors States of distinct objects are merged Common OOPL features and idioms result in imprecision Encapsulation Inheritance Containers, maps and iterators 24 12
13 Example: Imprecision class Y extends X { } class A { X f; void m(x q) { this.f=q ; } } A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; a this A.m o 1 o 2 aa o 3 f o 4 f f f q 25 Context Sensitivity Keeping calling contexts distinct during the analysis Classically two approaches (Sharir, Pneuli 1981) Call string - distinguish analysis result by (truncated) call stack on which it is obtained e.g., k-cfa Functional - distinguish analysis result by (partial) program state at call e.g., receiver identity, argument types 26 13
14 Object-sensitive Points-to Analysis Object sensitivity Form of functional context sensitivity for flow-insensitive points-to analysis of OO languages Object-sensitive Andersen s analysis Object sensitivity also applicable to other analyses Parameterization framework Cost vs. precision tradeoff Empirical evaluation Vs. field-sensitive analysis A. Milnova, A. Rountev, B. G. Ryder, Practical Points-to Analyses for Java, ISSTA Object-sensitive Analysis Instance methods and constructors analyzed for different contexts Receiver objects used as calling context Multiple copies of reference variables this.f=q o 1 this o 1 A.m.f=q o
15 Example: Object-sensitive Analysis o1 class A { X f; void m(x q) { this o1 o3 o1 A.m this.f=q o3; } } A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; a o this 1 A.m o 1 f o 2 aa o 3 o 4 o qa.m 1 o 3 this A.m o 3 qa.m f 29 Implementation Implemented one instance of parameterization framework this, formals and return variables (effectively) replicated Optimized constraint-based analysis using previous technique Comparison with field-sensitive analysis 30 15
16 Empirical Results 23 Java programs: user classes Added the necessary library classes Machine: 360 MHz, 512Mb, SUN Ultra-60 Object-sensitive vs. field-sensitive points-to Found comparable cost with better precision Modification side-effect analysis Virtual call resolution Analysis Time 200 Seconds javacc muffin soot mindterm creature sablecc jjtree mpegaudio jess jflex jack rabbit javacup jlex jtar mtrt raytrace echo jb db compress Object Sensitive OOPSLA'
17 Side-effect Analysis: Modified Objects Per Statement 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% OBJECT SENSITIVE OOPSLA jb jess sablecc raytrace Average One Two or three Four to nine More than nine 33 Improvement in Resolved Calls Percent Avg javacc muffin soot mindterm creature javac sablecc jjtree mpegaudio jess jflex jack rabbit javacup jlex jtar mtrt raytrace echo jb db compress proxy 34 17
18 Recent Context-insensitive Points-to Analyses Liang et. al, Paste 01 Empirical comparison of flow- and contextinsensitive analyses Steensgaard- and Andersen-based analyses for Java Static call graph (CHA, RTA) with on-the-fly Experiments with instance fields and abstract class fields Found Andersen (inclusion) analyses significantly more precise than Steensgaard (unification) Whaley and Lam, SAS More Reference Analyses Context-sensitive reference analyses Palsberg and Schwartzbach OOPSLA 91 Oxhoj, Palsberg, Schwartzbach ECOOP 92 Plevyak and Chien OOPSLA 94 Agesen ECOOP 95 Chatterjee, Ryder, Landi POPL 99 Ruf PLDI 00 Grove and Chambers TOPLAS 01 Most judged too expensive 36 18
19 Algorithm Construct Choices Representations Static call graph versus on-the-fly construction Abstract object or object instantiations Fields or no fields Abstract reference (by class), or reference representatives per method, or references program-wide by name Directionality Unification Inclusion constraints Accounting for flow Flow sensitivity Context sensitivity 37 Examples Representations Static call graph VTA versus on-the-fly construction RTA Abstract object XTA or object instantiations field-sensitive Fields or no fields Abstract reference (by class) RTA, or reference representatives per method XTA, or references program-wide by name VTA, fieldsensitive Directionality Unification, Hendren 00, Liang-Paste01 Inclusion constraints, field-sensitive, object-sensitive Accounting for flow Flow sensitivity, Chatterjee POPL99 Context sensitivity, object-sensitive 38 19
Points-to Analysis for Java Using Annotated Constraints*
Points-to Analysis for Java Using Annotated Constraints* Dr. Barbara G. Ryder Rutgers University http://www.cs.rutgers.edu/~ryder http://prolangs.rutgers.edu/ *Joint research with Atanas Rountev and Ana
More informationAnalysis of Object-oriented Programming Languages
Analysis of Object-oriented Programming Languages Dr. Barbara G. Ryder Rutgers University http://www.cs.rutgers.edu/~ryder http://prolangs.rutgers.edu/ OOAnalysis, Dagstuhl 2/03, BG Ryder 1 Outline Why
More informationOOPLs - call graph construction. Example executed calls
OOPLs - call graph construction Compile-time analysis of reference variables and fields Problem: how to resolve virtual function calls? Need to determine to which objects (or types of objects) a reference
More informationDimensions of Precision in Reference Analysis of Object-oriented Programming Languages. Outline
Dimensions of Precision in Reference Analysis of Object-oriented Programming Languages Dr. Barbara G. Ryder Rutgers University http://www.cs.rutgers.edu/~ryder http://prolangs.rutgers.edu/ Research supported,
More informationExtra notes on Field- sensitive points- to analysis with inclusion constraints Sept 9, 2015
Extra notes on Field- sensitive points- to analysis with inclusion constraints Sept 9, 2015 Week 3 CS6304 The Rountev et al. paper at OOPSLA 2000 extended Andersen s points- to analysis for C programs
More informationAdvanced Program Analyses for Object-oriented Systems
Advanced Program Analyses for Object-oriented Systems Dr. Barbara G. Ryder Rutgers University http://www.cs.rutgers.edu/~ryder http://prolangs.rutgers.edu/ July 2007 ACACES-3 July 2007 BG Ryder 1 Lecture
More informationOOPLs - call graph construction Compile-time analysis of reference variables and fields. Example
OOPLs - call graph construction Compile-time analysis of reference variables and fields Determines to which objects (or types of objects) a reference variable may refer during execution Primarily hierarchy-based
More informationContext-sensitive points-to analysis: is it worth it?
McGill University School of Computer Science Sable Research Group Context-sensitive points-to analysis: is it worth it? Sable Technical Report No. 2005-2 Ondřej Lhoták Laurie Hendren October 21, 2005 w
More informationScaling Java Points-to Analysis Using Spark
Scaling Java Points-to Analysis Using Spark Ondřej Lhoták and Laurie Hendren Sable Research Group, McGill University, Montreal, Canada {olhotak,hendren}@sable.mcgill.ca Abstract. Most points-to analysis
More informationContext-sensitive points-to analysis: is it worth it?
Context-sensitive points-to analysis: is it worth it? Ondřej Lhoták 1,2 and Laurie Hendren 2 olhotak@uwaterloo.ca hendren@sable.mcgill.ca 1 School of Computer Science, University of Waterloo, Waterloo,
More informationDimensions of Precision in Reference Analysis of Object-Oriented Programming Languages
Dimensions of Precision in Reference Analysis of Object-Oriented Programming Languages Barbara G. Ryder Division of Computer and Information Sciences Rutgers University New Brunswick, New Jersey 08903
More informationAnnotated Inclusion Constraints for Precise Flow Analysis
Annotated Inclusion Constraints for Precise Flow Analysis Ana Milanova Department of Computer Science Rensselaer Polytechnic Institute milanova@cs.rpi.edu Barbara G. Ryder Department of Computer Science
More informationLecture Notes: Pointer Analysis
Lecture Notes: Pointer Analysis 15-819O: Program Analysis Jonathan Aldrich jonathan.aldrich@cs.cmu.edu Lecture 9 1 Motivation for Pointer Analysis In programs with pointers, program analysis can become
More informationScaling Java Points-To Analysis using Spark
McGill University School of Computer Science Sable Research Group Scaling Java Points-To Analysis using Spark Sable Technical Report No. 2002-9 Ondřej Lhoták and Laurie Hendren October 24, 2002 w w w.
More informationBuilding a Whole-Program Type Analysis in Eclipse
Building a Whole-Program Type Analysis in Eclipse Mariana Sharp Jason Sawin Atanas Rountev ABSTRACT Eclipse has the potential to become a widely-used platform for implementation and dissemination of various
More informationLecture Notes: Pointer Analysis
Lecture Notes: Pointer Analysis 17-355/17-665/17-819: Program Analysis (Spring 2019) Jonathan Aldrich aldrich@cs.cmu.edu 1 Motivation for Pointer Analysis In the spirit of extending our understanding of
More informationThread-Sensitive Points-to Analysis for Multithreaded Java Programs
Thread-Sensitive Points-to Analysis for Multithreaded Java Programs Byeong-Mo Chang 1 and Jong-Deok Choi 2 1 Dept. of Computer Science, Sookmyung Women s University, Seoul 140-742, Korea chang@sookmyung.ac.kr
More informationAlias Analysis. Last time Interprocedural analysis. Today Intro to alias analysis (pointer analysis) CS553 Lecture Alias Analysis I 1
Alias Analysis Last time Interprocedural analysis Today Intro to alias analysis (pointer analysis) CS553 Lecture Alias Analysis I 1 Aliasing What is aliasing? When two expressions denote the same mutable
More informationCO444H. Ben Livshits. Datalog Pointer analysis
CO444H Ben Livshits Datalog Pointer analysis 1 Call Graphs Class analysis: Given a reference variable x, what are the classes of the objects that x refers to at runtime? We saw CHA and RTA Deal with polymorphic/virtual
More informationEvaluating a Demand Driven Technique for Call Graph Construction
Evaluating a Demand Driven Technique for Call Graph Construction Gagan Agrawal 1,JinqianLi 2, and Qi Su 2 1 Department of Computer and Information Sciences, Ohio State University Columbus, OH 43210 agrawal@cis.ohio-state.edu
More informationInterprocedural Analysis with Data-Dependent Calls. Circularity dilemma. A solution: optimistic iterative analysis. Example
Interprocedural Analysis with Data-Dependent Calls Circularity dilemma In languages with function pointers, first-class functions, or dynamically dispatched messages, callee(s) at call site depend on data
More informationContext-Sensitive Pointer Analysis. Recall Context Sensitivity. Partial Transfer Functions [Wilson et. al. 95] Emami 1994
Context-Sensitive Pointer Analysis Last time Flow-insensitive pointer analysis Today Context-sensitive pointer analysis Emami invocation graphs Partial Transfer Functions The big picture Recall Context
More informationLecture 20 Pointer Analysis
Lecture 20 Pointer Analysis Basics Design Options Pointer Analysis Algorithms Pointer Analysis Using BDDs Probabilistic Pointer Analysis (Slide content courtesy of Greg Steffan, U. of Toronto) 15-745:
More informationLecture 14 Pointer Analysis
Lecture 14 Pointer Analysis Basics Design Options Pointer Analysis Algorithms Pointer Analysis Using BDDs Probabilistic Pointer Analysis [ALSU 12.4, 12.6-12.7] Phillip B. Gibbons 15-745: Pointer Analysis
More informationConstructing Accurate Application Call Graphs For Java To Model Library Callbacks
Constructing Accurate Application Call Graphs For Java To Model Library Callbacks Weilei Zhang, Barbara G Ryder Department of Computer Science Rutgers University Piscataway, NJ 08854 {weileiz,ryder@cs.rutgers.edu
More informationLecture 27. Pros and Cons of Pointers. Basics Design Options Pointer Analysis Algorithms Pointer Analysis Using BDDs Probabilistic Pointer Analysis
Pros and Cons of Pointers Lecture 27 Pointer Analysis Basics Design Options Pointer Analysis Algorithms Pointer Analysis Using BDDs Probabilistic Pointer Analysis Many procedural languages have pointers
More informationStatic Program Analysis Part 8 control flow analysis
Static Program Analysis Part 8 control flow analysis http://cs.au.dk/~amoeller/spa/ Anders Møller & Michael I. Schwartzbach Computer Science, Aarhus University Agenda Control flow analysis for the -calculus
More informationCloning-Based Context-Sensitive Pointer Alias Analysis using BDDs
More Pointer Analysis Last time Flow-Insensitive Pointer Analysis Inclusion-based analysis (Andersen) Today Class projects Context-Sensitive analysis March 3, 2014 Flow-Insensitive Pointer Analysis 1 John
More informationMaking Context-sensitive Points-to Analysis with Heap Cloning Practical For The Real World
Making Context-sensitive Points-to Analysis with Heap Cloning Practical For The Real World Chris Lattner Apple Andrew Lenharth UIUC Vikram Adve UIUC What is Heap Cloning? Distinguish objects by acyclic
More informationStatic Program Analysis Part 9 pointer analysis. Anders Møller & Michael I. Schwartzbach Computer Science, Aarhus University
Static Program Analysis Part 9 pointer analysis Anders Møller & Michael I. Schwartzbach Computer Science, Aarhus University Agenda Introduction to points-to analysis Andersen s analysis Steensgaards s
More informationAverroes: Letting go of the library!
Workshop on WALA - PLDI 15 June 13th, 2015 public class HelloWorld { public static void main(string[] args) { System.out.println("Hello, World!"); 2 public class HelloWorld { public static void main(string[]
More informationInterprocedural Analysis with Data-Dependent Calls. Circularity dilemma. A solution: optimistic iterative analysis. Example
Interprocedural Analysis with Data-Dependent Calls Circularity dilemma In languages with function pointers, first-class functions, or dynamically dispatched messages, callee(s) at call site depend on data
More informationCS711 Advanced Programming Languages Pointer Analysis Overview and Flow-Sensitive Analysis
CS711 Advanced Programming Languages Pointer Analysis Overview and Flow-Sensitive Analysis Radu Rugina 8 Sep 2005 Pointer Analysis Informally: determine where pointers (or references) in the program may
More informationLecture 16 Pointer Analysis
Pros and Cons of Pointers Lecture 16 Pointer Analysis Basics Design Options Pointer Analysis Algorithms Pointer Analysis Using BDDs Probabilistic Pointer Analysis Many procedural languages have pointers
More informationClass Analysis for Testing of Polymorphism in Java Software
Class Analysis for Testing of Polymorphism in Java Software Atanas Rountev Ana Milanova Barbara G. Ryder Rutgers University, New Brunswick, NJ 08903, USA {rountev,milanova,ryder@cs.rutgers.edu Abstract
More informationAdvanced Compiler Construction
CS 526 Advanced Compiler Construction http://misailo.cs.illinois.edu/courses/cs526 INTERPROCEDURAL ANALYSIS The slides adapted from Vikram Adve So Far Control Flow Analysis Data Flow Analysis Dependence
More informationPointer Analysis in the Presence of Dynamic Class Loading
Pointer Analysis in the Presence of Dynamic Class Loading Martin Hirzel 1, Amer Diwan 1, and Michael Hind 2 1 University of Colorado, Boulder, CO 80309, USA {hirzel,diwan}@cs.colorado.edu 2 IBM Watson
More informationRefinement-Based Context-Sensitive Points-To Analysis for Java
Refinement-Based Context-Sensitive Points-To Analysis for Java Manu Sridharan, Rastislav Bodík UC Berkeley PLDI 2006 1 What Does Refinement Buy You? Increased scalability: enable new clients Memory: orders
More informationPoints-to Analysis using BDDs
Points-to Analysis using BDDs Marc Berndl, Ondřej Lhoták, Feng Qian, Laurie Hendren and Navindra Umanee Sable Research Group, School of Computer Science McGill University Montreal, Quebec, CANADA H3A 2A7
More informationLimits of Parallel Marking Garbage Collection....how parallel can a GC become?
Limits of Parallel Marking Garbage Collection...how parallel can a GC become? Dr. Fridtjof Siebert CTO, aicas ISMM 2008, Tucson, 7. June 2008 Introduction Parallel Hardware is becoming the norm even for
More informationParameterized Object Sensitivity for Points-to Analysis for Java
Parameterized Object Sensitivity for Points-to Analysis for Java Ana Milanova Dept. Computer Science Rensselaer Polytechnic Institute milanova@cs.rpi.edu Atanas Rountev Dept. Computer Science and Engineering
More informationParameterized Object Sensitivity for Points-to Analysis for Java. Authors: Ana Milanova, Atanas Rountev, Barbara G. Ryder Presenter: Zheng Song
Parameterized Object Sensitivity for Points-to Analysis for Java Authors: Ana Milanova, Atanas Rountev, Barbara G. Ryder Presenter: Zheng Song Outlines Introduction Existing Method and its limitation Object
More informationPointer Analysis in the Presence of Dynamic Class Loading
Pointer Analysis in the Presence of Dynamic Class Loading Martin Hirzel University of Colorado Boulder, CO 80309 hirzel@cs.colorado.edu Amer Diwan University of Colorado Boulder, CO 80309 diwan@cs.colorado.edu
More informationarxiv: v1 [cs.pl] 23 Apr 2013
Interprocedural Data Flow Analysis in Soot using Value Contexts Rohan Padhye Indian Institute of Technology Bombay rohanpadhye@iitb.ac.in Uday P. Khedker Indian Institute of Technology Bombay uday@cse.iitb.ac.in
More informationEscape Analysis. Applications to ML and Java TM
Escape Analysis. Applications to ML and Java TM Bruno Blanchet INRIA Rocquencourt Bruno.Blanchet@inria.fr December 2000 Overview 1. Introduction: escape analysis and applications. 2. Escape analysis 2.a
More informationAdvanced Program Analyses for Object-oriented Systems
Advanced Program Analyses for Object-oriented Systems Dr Barbara G Ryder Rutgers University http://wwwcsrutgersedu/~ryder http://prolangsrutgersedu/ July 2007 PROLANGS Languages/Compilers and Software
More informationInterprocedural Data Flow Analysis in Soot using Value Contexts
Interprocedural Data Flow Analysis in Soot using Value Contexts Rohan Padhye Indian Institute of Technology Bombay rohanpadhye@iitb.ac.in Uday P. Khedker Indian Institute of Technology Bombay uday@cse.iitb.ac.in
More informationPoints-to Analysis of RMI-based Java Programs
Computing For Nation Development, February 25 26, 2010 Bharati Vidyapeeth s Institute of Computer Applications and Management, New Delhi Points-to Analysis of RMI-based Java Programs Yogesh Pingle M.E.(Comp.),
More informationAlias Analysis & Points-to Analysis. Hwansoo Han
Alias Analysis & Points-to Analysis Hwansoo Han May vs. Must Information May information The information is true on some path through a CFG Must information The information is true on all paths through
More informationDemand-Driven Points-To Analysis For Java
Demand-Driven Points-To Analysis For Java Manu Sridharan, Ras Bodik Lexin Shan Denis Gopan UC Berkeley Microsoft UW Madison OOPSLA 2005 1 Who needs better pointer analysis? IDEs: for refactoring, program
More informationClass Hierarchy Complementation: Soundly Completing a Partial Type Graph
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph George Balatsouras Yannis Smaragdakis University of Athens OOPSLA 2013 Motivation: Static Analysis Static Analysis using the Doop
More informationPoints-to Analysis. Xiaokang Qiu Purdue University. November 16, ECE 468 Adapted from Kulkarni 2012
Points-to Analysis Xiaokang Qiu Purdue University ECE 468 Adapted from Kulkarni 2012 November 16, 2016 Simple example x := 5 ptr := @x *ptr := 9 y := x program S1 S2 S3 S4 dependences What are the dependences
More informationEffec%ve Sta%c Deadlock Detec%on
Effec%ve Sta%c Deadlock Detec%on Mayur Naik, Chang- Seo Park, Koushik Sen and David Gay ICSE 09 Presented by Alex Kogan 27.04.2014 Outline IntroducKon Suggested SoluKon EvaluaKon Related work Conclusions
More informationSABLEJIT: A Retargetable Just-In-Time Compiler for a Portable Virtual Machine p. 1
SABLEJIT: A Retargetable Just-In-Time Compiler for a Portable Virtual Machine David Bélanger dbelan2@cs.mcgill.ca Sable Research Group McGill University Montreal, QC January 28, 2004 SABLEJIT: A Retargetable
More informationBottom-up Context-Sensitive Pointer Analysis for Java
Bottom-up Context-Sensitive Pointer Analysis for Java Yu Feng, Xinyu Wang, Isil Dillig and Thomas Dillig UT Austin 1 What is this talk about? Pointer analysis Given a program variable v, what are the heap
More informationOOPSLA 2004, Vancouver
Alan Donovan, Adam Kieżun Matthew Tschantz, Michael Ernst MIT Computer Science & AI Lab OOPSLA 2004, Vancouver Introduction: generic types in Java.5 The problem: inferring type arguments Our approach Allocation
More informationDemand-Driven Context-Sensitive Alias Analysis for Java
Demand-Driven Context-Sensitive Alias Analysis for Java Dacong Yan Guoqing Xu Atanas Rountev Ohio State University {yan,xug,rountev}@cse.ohio-state.edu ABSTRACT Software tools for program understanding,
More informationPrecise Identification of Side-effect-free Methods in Java
Precise Identification of Side-effect-free Methods in Java Atanas Rountev Department of Computer Science and Engineering Ohio State University rountev@cis.ohio-state.edu Abstract Knowing which methods
More informationField Flow Sensitive Pointer and Escape Analysis for Java using Heap Array SSA
Field Flow Sensitive Pointer and Escape Analysis for Java using Heap Array SSA Prakash Prabhu and Priti Shankar Department of Computer Science and Automation, Indian Institute of Science, Bangalore 560012,
More informationThe Segregated Binary Trees: Decoupling Memory Manager
The Segregated Binary Trees: Decoupling Memory Manager Mehran Rezaei Dept. of Electrical and Computer Engineering University of Alabama in Huntsville Ron K. Cytron Department of Computer Science Washington
More informationJOVE. An Optimizing Compiler for Java. Allen Wirfs-Brock Instantiations Inc.
An Optimizing Compiler for Java Allen Wirfs-Brock Instantiations Inc. Object-Orient Languages Provide a Breakthrough in Programmer Productivity Reusable software components Higher level abstractions Yield
More informationPractical Virtual Method Call Resolution for Java
Practical Virtual Method Call Resolution for Java Sable TR 1999-2 10/4/99 1 Introduction Objective To determine at compile time a call graph with as few nodes and edges as possible Background.Soot Framework
More informationEfficient Field-Sensitive Pointer Analysis for C
Efficient Field-Sensitive Pointer Analysis for C David J. Pearce Department of Computing, Imperial College, London, SW7 2BZ, UK djp1@doc.ic.ac.uk Paul H. J. Kelly Department of Computing, Imperial College,
More informationPointer Analysis in the Presence of Dynamic Class Loading
Pointer Analysis in the Presence of Dynamic Class Loading Martin Hirzel, Amer Diwan University of Colorado at Boulder Michael Hind IBM T.J. Watson Research Center 1 Pointer analysis motivation Code a =
More informationA Study of Type Analysis for Speculative Method Inlining in a JIT Environment
A Study of Type Analysis for Speculative Method Inlining in a JIT Environment Feng Qian and Laurie Hendren {fqian, hendren}@sable.mcgill.ca School of Computer Science, McGill University Abstract. Method
More informationR O O T S Interprocedural Analysis
R O O T S Interprocedural Analysis Aleksandra Biresev s6albire@cs.uni-bonn.de Interprocedural Analysis An interprocedural analysis operates across an entire program, flowing information from call sites
More informationProgram Static Analysis. Overview
Program Static Analysis Overview Program static analysis Abstract interpretation Data flow analysis Intra-procedural Inter-procedural 2 1 What is static analysis? The analysis to understand computer software
More informationPartitioned Memory Models for Program Analysis
Partitioned Memory Models for Program Analysis Wei Wang 1 Clark Barrett 2 Thomas Wies 3 1 Google 2 Stanford University 3 New York University January 13, 2017 Wei Wang Partitioned Memory Models January
More informationRemoving Unnecessary Synchronization in Java
Removing Unnecessary Synchronization in Java Jeff Bogda and Urs Hölzle Department of Computer Science University of California Santa Barbara, CA 93106 {bogda,urs@cs.ucsb.edu Abstract Java programs perform
More informationLecture 2: Control Flow Analysis
COM S/CPRE 513 x: Foundations and Applications of Program Analysis Spring 2018 Instructor: Wei Le Lecture 2: Control Flow Analysis 2.1 What is Control Flow Analysis Given program source code, control flow
More informationFree-Me: A Static Analysis for Automatic Individual Object Reclamation
Free-Me: A Static Analysis for Automatic Individual Object Reclamation Samuel Z. Guyer, Kathryn McKinley, Daniel Frampton Presented by: Jason VanFickell Thanks to Dimitris Prountzos for slides adapted
More informationCalvin Lin The University of Texas at Austin
Interprocedural Analysis Last time Introduction to alias analysis Today Interprocedural analysis March 4, 2015 Interprocedural Analysis 1 Motivation Procedural abstraction Cornerstone of programming Introduces
More informationRefinement-Based Context-Sensitive Points-To Analysis for Java
Refinement-Based Context-Sensitive Points-To Analysis for Java Manu Sridharan University of California, Berkeley manu_s@cs.berkeley.edu Rastislav Bodík University of California, Berkeley bodik@cs.berkeley.edu
More informationTowards Dynamic Interprocedural Analysis in JVMs
Towards Dynamic Interprocedural Analysis in JVMs Feng Qian Laurie Hendren School of Computer Science, McGill University 3480 University Street, Montreal, Quebec Canada H3A 2A7 {fqian,hendren}@cs.mcgill.ca
More informationInterprocedural Analysis. Motivation. Interprocedural Analysis. Function Calls and Pointers
Interprocedural Analysis Motivation Last time Introduction to alias analysis Today Interprocedural analysis Procedural abstraction Cornerstone of programming Introduces barriers to analysis Example x =
More informationAlias Analysis. Advanced Topics. What is pointer analysis? Last Time
Advanced Topics Last Time Experimental Methodology Today What s a managed language? Alias Analysis - dealing with pointers Focus on statically typed managed languages Method invocation resolution Alias
More informationIdentifying Parallelism in Construction Operations of Cyclic Pointer-Linked Data Structures 1
Identifying Parallelism in Construction Operations of Cyclic Pointer-Linked Data Structures 1 Yuan-Shin Hwang Department of Computer Science National Taiwan Ocean University Keelung 20224 Taiwan shin@cs.ntou.edu.tw
More informationOn the Structure of Sharing in Open Concurrent Java Programs
On the Structure of Sharing in Open Concurrent Java Programs Yin Liu Department of Computer Science Rensselaer Polytechnic Institute liuy@csrpiedu Ana Milanova Department of Computer Science Rensselaer
More informationJava without the Coffee Breaks: A Nonintrusive Multiprocessor Garbage Collector
Java without the Coffee Breaks: A Nonintrusive Multiprocessor Garbage Collector David F. Bacon IBM T.J. Watson Research Center Joint work with C.R. Attanasio, Han Lee, V.T. Rajan, and Steve Smith ACM Conference
More informationSoot A Java Bytecode Optimization Framework. Sable Research Group School of Computer Science McGill University
Soot A Java Bytecode Optimization Framework Sable Research Group School of Computer Science McGill University Goal Provide a Java framework for optimizing and annotating bytecode provide a set of API s
More informationScalable Flow-Sensitive Pointer Analysis for Java with Strong Updates
Scalable Flow-Sensitive Pointer Analysis for Java with Strong Updates Arnab De and Deepak D Souza Department of Computer Science and Automation, Indian Institute of Science, Bangalore, India {arnabde,deepakd}@csa.iisc.ernet.in
More informationEffective Static Race Detection for Java. Part I. Chord. Chord. Chord. Chord - Overview. Problems addressed
Eective Static Race Detection or Java Mayer Naik, Alex Aiken, John Whaley Part I Introduction to Chord and Preliminaries presented by Matt McGill Chord Chord Chord is a static (data) race detection tool
More informationEstimating the Impact of Scalable Pointer Analysis on Optimization
Estimating the Impact of Scalable Pointer Analysis on Optimization Manuvir Das 1, Ben Liblit 2,ManuelFähndrich 1,andJakobRehof 1 1 Microsoft Research {manuvir,maf,rehof}@microsoft.com 2 EECS Department,
More informationA Context-Sensitive Memory Model for Verification of C/C++ Programs
A Context-Sensitive Memory Model for Verification of C/C++ Programs Arie Gurfinkel and Jorge A. Navas University of Waterloo and SRI International SAS 17, August 30th, 2017 Gurfinkel and Navas (UWaterloo/SRI)
More informationInvestigating Java Type Analyses for the Receiver-Classes Testing Criterion
Investigating Java Type Analyses for the Receiver-Classes Testing Criterion Pierre-Luc Brunelle Computer Eng. Dept. École Polytechnique Montréal, PQ, Canada Ettore Merlo Computer Eng. Dept. École Polytechnique
More informationChapter 5: Procedural abstraction. Function procedures. Function procedures. Proper procedures and function procedures
Chapter 5: Procedural abstraction Proper procedures and function procedures Abstraction in programming enables distinction: What a program unit does How a program unit works This enables separation of
More informationApproximation of the Worst-Case Execution Time Using Structural Analysis. Matteo Corti and Thomas Gross Zürich
Approximation of the Worst-Case Execution Time Using Structural Analysis Matteo Corti and Thomas Gross Zürich Goal Worst-case execution time estimation of softreal time Java applications. We focus on semantic
More informationLecture 9 Dynamic Compilation
Lecture 9 Dynamic Compilation I. Motivation & Background II. Overview III. Compilation Policy IV. Partial Method Compilation V. Partial Dead Code Elimination VI. Escape Analysis VII. Results Partial Method
More informationField Analysis. Last time Exploit encapsulation to improve memory system performance
Field Analysis Last time Exploit encapsulation to improve memory system performance This time Exploit encapsulation to simplify analysis Two uses of field analysis Escape analysis Object inlining April
More informationShort Notes of CS201
#includes: Short Notes of CS201 The #include directive instructs the preprocessor to read and include a file into a source code file. The file name is typically enclosed with < and > if the file is a system
More informationSimple example. Analysis of programs with pointers. Program model. Points-to relation
Simple eample Analsis of programs with pointers := 5 ptr := & *ptr := 9 := program S1 S2 S3 S4 What are the defs and uses of in this program? Problem: just looking at variable names will not give ou the
More informationSwift: A Register-based JIT Compiler for Embedded JVMs
Swift: A Register-based JIT Compiler for Embedded JVMs Yuan Zhang, Min Yang, Bo Zhou, Zhemin Yang, Weihua Zhang, Binyu Zang Fudan University Eighth Conference on Virtual Execution Environment (VEE 2012)
More informationStatic Inference of Universe Types
Static Inference of Universe Types Ana Milanova Rensselaer Polytechnic Institute milanova@cs.rpi.edu Abstract The Universe type system is an ownership type system which enforces the owners-as-modifiers
More informationCS201 - Introduction to Programming Glossary By
CS201 - Introduction to Programming Glossary By #include : The #include directive instructs the preprocessor to read and include a file into a source code file. The file name is typically enclosed with
More informationAn Efficient Memory Management Technique That Improves Localities
An Efficient Memory Management Technique That Improves Localities Krishna Kavi Mehran Rezaei Dept. of Electrical and Computer Engineering University of Alabama in Huntsville Ron K. Cytron Department of
More informationPointer Analysis in the Presence of Dynamic Class Loading. Hind Presented by Brian Russell
Pointer Analysis in the Presence of Dynamic Class Loading Martin Hirzel, Amer Diwan and Michael Hind Presented by Brian Russell Claim: First nontrivial pointer analysis dealing with all Java language features
More informationAssumption Hierarchy for a CHA Call Graph Construction Algorithm
Assumption Hierarchy for a CHA Call Graph Construction Algorithm Jason Sawin Mathematics and Computer Science University of Puget Sound Atanas Rountev Computer Science and Engineering The Ohio State University
More informationProgramming Languages Third Edition. Chapter 10 Control II Procedures and Environments
Programming Languages Third Edition Chapter 10 Control II Procedures and Environments Objectives Understand the nature of procedure definition and activation Understand procedure semantics Learn parameter-passing
More informationConstructing Control Flow Graph for Java by Decoupling Exception Flow from Normal Flow
Constructing Control Flow Graph for Java by Decoupling Exception Flow from Normal Flow Jang-Wu Jo 1 and Byeong-Mo Chang 2 1 Department of Computer Engineering Pusan University of Foreign Studies Pusan
More informationCSE 501 Midterm Exam: Sketch of Some Plausible Solutions Winter 1997
1) [10 pts] On homework 1, I asked about dead assignment elimination and gave the following sample solution: 8. Give an algorithm for dead assignment elimination that exploits def/use chains to work faster
More information