breadcrumbs: efficient context sensitivity for dynamic bug detection analyses
DESCRIPTION
Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses. We don't make a lot of the bug detectors you use. We make a lot of the bug detectors you use better. Graham Z. Baker Tufts / MIT Lincoln Laboratory. Michael D. Bond University of Texas at Austin. Samuel Z. Guyer - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/1.jpg)
Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses
Michael D. Bond
University of Texas at Austin
Graham Z. BakerTufts / MIT Lincoln Laboratory
We don't make a lot of the bug detectors you use. We make a lot of the bug detectors you use better.
Samuel Z. GuyerTufts University
![Page 2: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/2.jpg)
Example: Dynamic data race detector
Thread A Thread B
write x
unlock mlock m
write x
read x
![Page 3: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/3.jpg)
Example: dynamic data race detector
Thread A Thread B
write x
unlock mlock m
write x
read xrace!
![Page 4: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/4.jpg)
Example: dynamic data race detector
Thread A Thread B
write x
unlock mlock m
write x
read xrace!
T@AT@A
T’@BT’@B
T’’@AT’’@A
![Page 5: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/5.jpg)
Example: dynamic data race detector
Thread A Thread B
write x
unlock mlock m
write x
read xrace!
How is this race reported?
T@AT@A
T’@BT’@B
T’’@AT’’@A
![Page 6: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/6.jpg)
Reporting a race
Thread A Thread B
write x
unlock mlock m
write x
read x
T@AT@A
T’@BT’@B
T’’@AT’’@A
loc1loc1
loc2loc2
loc3loc3
race!
![Page 7: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/7.jpg)
Reporting a race
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426
AbstractDataTreeNode.storeStrings():536
![Page 8: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/8.jpg)
Reporting a race
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426
AbstractDataTreeNode.storeStrings():536
Problem : not much information
![Page 9: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/9.jpg)
Full stack traces
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426AbstractDataTreeNode.childAtOrNull():212DeltaDataTree.lookup():666 ElementTree.includes():528 Workspace.getResourceInfo():1135Resource.getResourceInfo():973Project.hasNature():479 JavaProject.hasJavaNature():224JavaProject.computeExpandedClasspath():430JavaProject.getExpandedClasspath():1444... EclipseStarter.run():376...
AbstractDataTreeNode.storeStrings():536DataTreeNode.storeStrings():343AbstractDataTreeNode.storeStrings():541DataTreeNode.storeStrings():343...ElementTree.shareStrings():706SaveManager.shareStrings():1154...StringPoolJob.shareStrings():124...Worker.run():76...
![Page 10: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/10.jpg)
Context sensitivity
Big impact on static analysis Better information Better precision
Critical in modern software: Intensive code reuse (e.g., frameworks) Many small methods Highly dynamic behavior
What about dynamic analysis?
![Page 11: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/11.jpg)
How hard is this?
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426AbstractDataTreeNode.childAtOrNull():212DeltaDataTree.lookup():666 ElementTree.includes():528 Workspace.getResourceInfo():1135Resource.getResourceInfo():973Project.hasNature():479 JavaProject.hasJavaNature():224JavaProject.computeExpandedClasspath():430JavaProject.getExpandedClasspath():1444... EclipseStarter.run():376...
AbstractDataTreeNode.storeStrings():536DataTreeNode.storeStrings():343AbstractDataTreeNode.storeStrings():541DataTreeNode.storeStrings():343...ElementTree.shareStrings():706SaveManager.shareStrings():1154...StringPoolJob.shareStrings():124...Worker.run():76...
![Page 12: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/12.jpg)
How hard is this?
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426AbstractDataTreeNode.childAtOrNull():212DeltaDataTree.lookup():666 ElementTree.includes():528 Workspace.getResourceInfo():1135Resource.getResourceInfo():973Project.hasNature():479 JavaProject.hasJavaNature():224JavaProject.computeExpandedClasspath():430JavaProject.getExpandedClasspath():1444... EclipseStarter.run():376...
AbstractDataTreeNode.storeStrings():536DataTreeNode.storeStrings():343AbstractDataTreeNode.storeStrings():541DataTreeNode.storeStrings():343...ElementTree.shareStrings():706SaveManager.shareStrings():1154...StringPoolJob.shareStrings():124...Worker.run():76...EAS
YEAS
Y
Race discovered here
Race discovered here
![Page 13: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/13.jpg)
How hard is this?
Thread A Thread B
write x
read xrace!
T’@BT’@B
T’’@AT’’@A
write x
unlock mlock m
T@AT@A loc1loc1
loc2loc2
loc3loc3
AbstractDataTreeNode.indexOfChild():426AbstractDataTreeNode.childAtOrNull():212DeltaDataTree.lookup():666 ElementTree.includes():528 Workspace.getResourceInfo():1135Resource.getResourceInfo():973Project.hasNature():479 JavaProject.hasJavaNature():224JavaProject.computeExpandedClasspath():430JavaProject.getExpandedClasspath():1444... EclipseStarter.run():376...
AbstractDataTreeNode.storeStrings():536DataTreeNode.storeStrings():343AbstractDataTreeNode.storeStrings():541DataTreeNode.storeStrings():343...ElementTree.shareStrings():706SaveManager.shareStrings():1154...StringPoolJob.shareStrings():124...Worker.run():76...EAS
YEAS
Y
HARD
HARD
Previously recorded
information
Previously recorded
information
![Page 14: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/14.jpg)
Challenge
Many events might need context information e.g., race detector: every read and write (!)
Existing approaches Walk the stack: up to 100X slowdown Build calling context tree: 2-3X, plus space
Context
Context
Context
Context
Context
Context
Context
Context
Context
Context
Context
BUG
BUG
![Page 15: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/15.jpg)
Goal
Compact representation of calling contexts
Fast correct execution
Print out stack trace when bug detected
Efficient context sensitivity for dynamic bug detectors
![Page 16: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/16.jpg)
Starting point
Represent a calling context in 1 word ⎯PCC value
Computed online, low overhead ⎯<5%
BUT, no way to decode a PCC value
Probabilistic Calling ContextBond and McKinley OOPSLA 07
✓
✓
✘
![Page 17: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/17.jpg)
With PCC: analysis is context sensitive
Thread A Thread B
write x
unlock mlock m
write x
read xrace!
T@AT@A
T’@BT’@B
T’’@AT’’@A
pcc1pcc1
pcc2pcc2
pcc3pcc3
0xFE9A651B
0x59C2DF08
![Page 18: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/18.jpg)
How PCC works
Caller
Callee
m()
k()
k(); k();
j();j(); h();h();
current PCCcurrent PCC
callsite IDcallsite ID
p’ = f (p, c) p’ = f (p, c)
new PCCnew PCC
= (3p + c) mod 232
…
… …
At each call site…
![Page 19: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/19.jpg)
At each call site…Caller
Callee
m()
k()
k(); k();
j();j(); h();h();
current PCCcurrent PCC
callsiteIDcallsiteID
p’ = f (p, c) p’ = f (p, c)
new PCCnew PCC
= (3p + c) mod 232
…
… …
How PCC works
![Page 20: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/20.jpg)
Breadcrumbs
Problem: decode PCC value
Find a sequence of callsite IDs such that
p = f(…f( f( f(0, c0), c1), c2)…, cn)
i.e., invert the hash function
![Page 21: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/21.jpg)
Breadcrumbs
Problem: decode PCC value p
Find a sequence of callsite IDs such that
p = f(…f( f( f(0, c0), c1), c2)…, cn)
i.e., invert the hash function
Key: f is invertible Given p’ and c
unique p such that p’ = f(p, c) “Peel off” callsites until we reach 0 (main)
3 and 232 relatively
prime
3 and 232 relatively
prime
![Page 22: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/22.jpg)
Decode stack trace bottom-up
PCC value = 0x5A93CF09
![Page 23: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/23.jpg)
Decode stack trace bottom-up
PCC value = 0x5A93CF09
PCC value = 0x089C3A02
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
![Page 24: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/24.jpg)
Decode stack trace bottom-up
PCC value = 0x5A93CF09
PCC value = 0x0
PCC value = 0x089C3A02
PCC value = 0x59C2DF08
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
![Page 25: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/25.jpg)
Decode stack trace bottom-up
PCC value = 0x5A93CF09
…
PCC value = 0x0
PCC value = 0x089C3A02
PCC value = 0x59C2DF08
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
…
![Page 26: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/26.jpg)
Problem: blind search of call graph
…
…
PCC value = 0x0
…
…
…
…
PCC value = 0x5A93CF09
Need moreinformation
![Page 27: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/27.jpg)
Idea: record per-callsite PCC values
…
…
…
…
…
…
0x089C3A02
![Page 28: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/28.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
![Page 29: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/29.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 30: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/30.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
✓✘
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 31: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/31.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
0x59C2DF08
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 32: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/32.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
✓ ✘0x59C2DF08
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 33: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/33.jpg)
Very easy search
…
…
…
…
…
…
PCC value = 0x5A93CF09
PCC value = 0x0
0x59C2DF08
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
…
![Page 34: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/34.jpg)
antlrcharteclip
se fophsql
dbjythonluind
expmdxala
n jbb
geomean
0 20
40
60
80
100
120
140
160
% overhead
With per-callsite setsJikesRVMDaCapo benchmarks
# set ops
528m201m857m21m158
m3,624m217
m270m738m137m
PCC only
![Page 35: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/35.jpg)
Observation
…
…
…
…
…
…
![Page 36: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/36.jpg)
Idea: stop tracking hot call sites
…
…
…
…
…
![Page 37: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/37.jpg)
antlrcharteclip
se fophsql
dbjythonluind
expmdxala
n jbb
geomean
0 20
40
60
80
100
120
140
160
% overhead
t = 100,000
t = 100
t = 10,000
No threshold
t = 1,000
PCC only
Is it enough information?
Tunable “hotnes
s” threshol
d
![Page 38: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/38.jpg)
Decoding: hybrid search
…
…
…
…
…
…
PCC value = 0x5A93CF09
![Page 39: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/39.jpg)
Decoding: hybrid search
…
…
…
…
…
…
PCC value = 0x5A93CF09
✓
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 40: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/40.jpg)
Decoding: hybrid search
…
…
…
…
…
…
PCC value = 0x5A93CF09
0x59C2DF08
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 41: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/41.jpg)
Heuristic search (see paper)
…
…
…
…
…
…
PCC value = 0x5A93CF09
0x59C2DF08
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, d():9)
f-1(0x5A93CF09, g():2)f-1(0x5A93CF09, g():2)
0x089C3A02
![Page 42: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/42.jpg)
antlrcharteclip
se fophsql
dbjythonluind
expmdxala
n jbb
0 20
40
60
80
100
120
140
160
% overhead
100%
100%
100%
100%
100%
47% 47% 47% 82% 95%
100%
100%
100%
100%
100%
89% 95% 95% 97% 97%
Race detectionresults
(go to Pacer talk tomorrow!)
t = 100,000
t = 100
t = 10,000
No threshold
t = 1,000
geomean
![Page 43: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/43.jpg)
Summary
Make any dynamic bug detector context sensitive
More in the paper: Description of search algorithm What kinds of bug detectors will benefit Results for two real bug detectors
(both quantitative and qualitative)
Available as patch to JikesRVM
![Page 44: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/44.jpg)
Related work
Reconstruct contexts from PC and SP [Mytkowicz et al. 2009] [Inoue and Nakatani 2009]
Very low overhead, but little entropy in these values
Path profiling approach [Sumner et al. 2010]
Uses multiple integers to represent calling context exactly
Both require offline training, pre-computed infoChallenge for complex, highly dynamic software
![Page 45: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/45.jpg)
Thank You
Questions?
![Page 46: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/46.jpg)
Goals
Represent calling context compactlyEasily take place of static program locations
Fast correct executionFor deployed or field-testing environment
Decode back into stack trace when neededCould expensive, but cost paid offline
![Page 47: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/47.jpg)
Calling context representation
Calling context stored in 1 word ⎯ PCC valueEssentially a hash of sequence of call site IDs
Computed online, low overhead <5%PCC values computed incrementally, at each call site
BUT, no way to decode a PCC valueCan distinguish, but not identify calling contexts
✓
✓
✘
Started with Probabilistic Calling Context Bond and McKinley OOPSLA 07
![Page 48: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/48.jpg)
Summary
Make any dynamic bug detector context sensitive
Tunable overhead/precision tradeoffSweet spot:
10% to 20% overhead at threshold 1,000 to 10,000
Challenges Long sequences of hot callsites Deep recursion
Available as patch to JikesRVM
![Page 49: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/49.jpg)
antlr
chart
eclipse
fop
hsqldb
jython
luindex
pmd
xalan
jbb
geomean
0 20 40 60 80 100 120 140 160
% overhead
Tradeoff: cost vs
decoding
t = 100,000
t = 100
t = 10,000
No threshold
t = 1,000
PCC only
![Page 50: Breadcrumbs: Efficient Context Sensitivity for Dynamic Bug Detection Analyses](https://reader036.vdocuments.us/reader036/viewer/2022062305/56815989550346895dc6cb17/html5/thumbnails/50.jpg)
100%
100%
100%
100%
100%
antlrcharteclip
se fophsql
dbjythonluind
expmdxala
n jbb
geomean
0 20
40
60
80
100
120
140
160
% overhead
47% 47% 47% 82% 95%
100%
100%
100%
100%
100%
89% 95% 95% 97% 97%