Points-to Analysis for Java Using Annotated Constraints*

Transcription

1 Points-to Analysis for Java Using Annotated Constraints* Dr. Barbara G. Ryder Rutgers University *Joint research with Atanas Rountev and Ana Milanova, supported by NSF-CCR Java Poi nts-to, 12/02, BGR 1

2 Outline PROLANGS research projects Points-to analysis for Java Initial constraint-based implementation, OOPSLA 01 Empirical results Object-sensitive analysis, ISSTA 02 Empirical results Related work Summary Java Poi nts-to, 12/02, BGR 2

3 PROLANGS Research projects at boundary of Programming Languages/Compilers and Software Engineering Algorithm design and prototyping Mature research projects Pointer analysis of C programs Side-effect analysis of C systems Semantic software change analysis Studies of Java exception usages PROLANGS Analysis Framework (PAF), version 1.1 released June 1999 Java Poi nts-to, 12/02, BGR 3

4 Ongoing Research Object-oriented systems (C++/Java) Analysis Points-to, side-effect analyses POPL 99, OOPSLA 01, ISSTA 02, ICSM 02 Change impact analysis (with Frank Tip, IBM) PASTE 01 Optimization Profiling framework for feedback-directed optimization PLDI 01 Experience with feedback-directed optimization OOPSLA 02 Static/dynamic analyses of application resource usage (with Rich Martin and Thu Nguyen, Rutgers) Analysis of program fragments FSE 99, CC 01, ICSE 03 Java Poi nts-to, 12/02, BGR 4

5 Points-to Analysis for Java Which objects may reference variable x point to? Builds a points-to graph x = new A(); y = new B(); x.f = y; x o 1 f y o 2 Java Poi nts-to, 12/02, BGR 5

6 Uses of Points-to Information in Compilers Object read-write information Side-effect analysis, dependence analysis Call graph construction Devirtualization & inlining Synchronization removal Stack-based object allocation Java Poi nts-to, 12/02, BGR 6

7 Uses of Points-to Information in Software Engineering Tools Object read-write information Semantic browers Program slicers Debuggers Change impact analysis tools Testing Object relationships (Object relation diagrams) Program-based coverage metrics Java Poi nts-to, 12/02, BGR 7

8 Contributions Points-to Analyses for Java using annotated constraints Initial analysis based on Andersen s analysis for C, OOPSLA 01 Annotations embody OO notions needed Maintained efficient constraint-based implementation Empirical evaluation of cost and precision Java Poi nts-to, 12/02, BGR 8

9 Contributions Object-sensitive analysis, ISSTA 02 Adding context sensitivity Parameterization framework Empirical evaluation demonstrates more precision for same cost Java Poi nts-to, 12/02, BGR 9

10 Points-to Analysis, OOPSLA 01 Handles virtual calls Simulates the run-time method lookup Models the fields of objects Analyzes executable code Ignores unreachable code from libraries Java Poi nts-to, 12/02, BGR 10

11 Points-to Analysis in Action A.m() not analyzed because it s unreachable. class A { void m(x p) {..} } a class B extends A { X f; void m(x q) { this.f=q; } } B b = new B(); X x = new X(); A a = b; a.m(x); b o 1 this B.m f x o 2 q Java Poi nts-to, 12/02, BGR 11

12 Efficient Implementation Constraint-based approach Extends previous work for C pointer analysis using BANE (UC Berkeley) Extended constraint system and resolution rules Define and solve a system of annotated set-inclusion constraints to obtain pointsto sets Java Poi nts-to, 12/02, BGR 12

13 Annotated Constraints Form: L a R L and R denote set expressions Annotation a: additional information (e.g., object fields) Kinds of set expressions L and R Set variables: represent points-to sets ref terms: represent objects Other kinds of expressions Java Poi nts-to, 12/02, BGR 13

14 Set variables and ref terms Set variables represent points-to sets For each reference variable p: V P For each object o: V o Object o is denoted by term ref(o,v o ) p o ref(o,v o ) V P o f 1 o 2 ref(o 2,V o2 ) f V o 1 Java Poi nts-to, 12/02, BGR 14

15 Example: Accessing Fields p = new A(); q = new B(); p.f = q; p o 1 ref(o 1,V O1 ) V p ref(o 2,V O2 ) V q V p proj(ref,w) V q f W q o 2 f Constraint generation Java Poi nts-to, 12/02, BGR 15

16 Example: Solving Constraints ref(o 1,V O1 ) V p Constraint resolution ref(o 2,V O2 ) V q V p proj(ref,w) V q f W W V O1 o 1.f points to o 2 V q f V O 1 ref(o 2,V O2 ) f V O1 Java Poi nts-to, 12/02, BGR 16

17 Example: Virtual Calls p.m(x); V P m lam(v x ) receiver object o ref(o,v O ) V P Actual method called, A.m V x V z ref(o,v O ) V this(a.m) Java Poi nts-to, 12/02, BGR 17

18 Experiments 23 Java programs: user classes Added the necessary library classes Machine: 360 MHz, 512Mb SUN Ultra-60 Cost measured in time and memory Precision (wrt usage in client analyses and tranformations) Object read-write information Call graph construction Synchronization removal and stack allocation Java Poi nts-to, 12/02, BGR 18

19 Analysis Time Seconds proxy compress db jb echo raytrace mtrt jtar jlex javacup rabbit jack jflex jess mpegaudio jjtree sablecc javac creature mindterm soot muffin javacc Java Poi nts-to, 12/02, BGR 19

20 Resolution of Virtual Call Sites % Resolved Call Sites proxy db echo mtrt jlex Points-to rabbit jflex RTA mpegaudio sablecc creature soot javacc Java Poi nts-to, 12/02, BGR 20

21 Thread-local new sites 70% 60% % Thread-local Sites 50% 40% 30% 20% 10% 0% Java Poi nts-to, 12/02, BGR 21

22 Practical Points-to Analyses for Java, ISSTA 02 Existing analyses were flow- and contextinsensitive extensions of C analyses Context insensitivity inherently compromises precision for object-oriented languages Goal: Introduce context sensitivity and remain practical Java Poi nts-to, 12/02, BGR 22

23 Example: Imprecision class Y extends X { } class A { X f; void m(x q) { this.f=q ; } } A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; a this A.m o 1 o 2 aa o 3 f o 4 f f f q Java Poi nts-to, 12/02, BGR 23

24 Imprecision of Context-insensitive Analysis Does not distinguish contexts for instance methods and constructors States of distinct objects are merged Common OO features and idioms Encapsulation Inheritance Containers, maps and iterators Java Poi nts-to, 12/02, BGR 24

25 Object sensitivity Object-sensitive Points-to Analysis Form of context sensitivity for flow-insensitive points-to analysis of OO languages Object-sensitive Andersen s analysis Object sensitivity applicable to other analyses Parameterization framework Cost vs. precision tradeoff Empirical evaluation Vs. context-insensitive OOPSLA 01 analysis Java Poi nts-to, 12/02, BGR 25

26 Details Instance methods and constructors analyzed for different contexts Receiver objects used as contexts Multiple copies of reference variables this.f=q o 1 this o 1 A.m.f=q o 1 Java Poi nts-to, 12/02, BGR 26

27 Example: Object-sensitive Analysis o1 class A { X f; void m(x q) { this o1 o3 o1 A.m this.f=q o3; } } A a = new A() ; a.m(new X()) ; A aa = new A() ; aa.m(new Y()) ; Java Poi nts-to, 12/02, BGR 27 a o this 1 A.m o 1 f o 2 aa o 3 o 4 o q 1 A.m o 3 this A.m o 3 q A.m f

28 Implementation Implemented one instance of parameterization framework this, formals and return variables (effectively) replicated Optimized constraint-based analysis using previous technique Comparison with OOPSLA 01 analysis Java Poi nts-to, 12/02, BGR 28

29 Empirical Results 23 Java programs: user classes Added the necessary library classes Machine: 360 MHz, 512Mb, SUN Ultra-60 Object Sensitive vs. OOPSLA 01 points-to Found comparable cost with better precision Modification side-effect analysis Virtual call resolution Java Poi nts-to, 12/02, BGR 29

30 250 Analysis Time 200 Seconds javacc muffin soot mindterm creature sablecc jjtree mpegaudio jess jflex jack rabbit javacup jlex jtar mtrt raytrace echo jb db compress Object Sensitive OOPSLA'01 Java Poi nts-to, 12/02, BGR 30

31 Side-effect Analysis: Modified Objects Per Statement 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% OBJECT SENSITIVE OOPSLA jb jess sablecc raytrace Average One Two or three Four to nine More than nine Java Poi nts-to, 12/02, BGR 31

32 Improvement in Resolved Calls Percent Avg javacc muffin soot mindterm creature javac sablecc jjtree mpegaudio jess jflex jack rabbit javacup jlex jtar mtrt raytrace echo jb db compress proxy Java Poi nts-to, 12/02, BGR 32

33 Related Work Context-sensitive points-to analysis for OO languages Grove et al. OOPSLA 97, Chatterjee et al. POPL 99, Ruf PLDI 00, Grove-Chambers TOPLAS 01 Context-insensitive points-to analysis for OO languages Liang et al. PASTE 01 0Context-sensitive class analysis Oxhoj et al. ECOOP 92, Agesen SAS 94, Plevyak-Chien OOPSLA 94, Agesen ECOOP 95, Grove et al. OOPSLA 97, Grove-Chambers TOPLAS 01 Java Poi nts-to, 12/02, BGR 33

34 Summary Defined two new points-to analyses for references in OOPLs using annotated constraints Context-insensitive analysis (OOPSLA 01) Based on Andersen s points-to for C Practical cost and good precision wrt client analyses and transformations Java Poi nts-to, 12/02, BGR 34

35 Summary Object-sensitive (context-sensitive) points-to analysis - New kind of context sensitivity for flowinsensitive analysis Parameterization framework allows tunable algorithm choice Practical cost, comparable to OOPSLA 01 analysis Better precision than OOPSLA 01 analysis Java Poi nts-to, 12/02, BGR 35

36 Java Poi nts-to, 12/02, BGR 36

37 Number of new X() whose objects are accessed by p.f 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% proxy db echo mtrt jlex One Two or three More than three javacc rabbit Java Poi nts-to, 12/02, BGR 37 jflex mpegaudio sablecc creature soot

38 Parameterization Goal: tunable analysis Multiple copies for a subset of variables For the other variables a single copy Result: reduces points-to graph size and analysis cost At the expense of precision loss Java Poi nts-to, 12/02, BGR 38