![Page 1: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/1.jpg)
Parameterized Object Sensitivityfor
Points-to Analysis for Java
Presented By: -Anand Bahety
Dan Bucatanschi
![Page 2: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/2.jpg)
Presentation Roadmap
• Introduction • Terms and Definitions• Application of previous techniques to OOP• Imprecision analyzed• Object Sensitive analysis and its advantages• Parameterized Object Sensitivity
![Page 3: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/3.jpg)
Introduction
• Points-to Analysis: - Method in Java to determine the set of objects pointed to by a reference variable or a reference object field
• Goal• Advantages
![Page 4: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/4.jpg)
Terms and Definitions
• Side-effect analysis• Def-use analysis• Flow sensitive & flow insensitive• Context sensitive & context insensitive• Object sensitivity
![Page 5: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/5.jpg)
Sample points-to graph
![Page 6: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/6.jpg)
Object Oriented Programing
• Encapsulation• Inheritance• Collection (Containers)…
Lets try to analyze these features using flow insensitive and context insensitive analysis
![Page 7: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/7.jpg)
Semantics
• R – set of all reference variables• O – set of all objects created at object
allocation sites• F – contains all instance fields in program class• Edge (r,oi) Є R x O• (<oi,f>, oj) Є (O x F) x O• Transfer functions
![Page 8: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/8.jpg)
Encapsulation
x1 O1 O2 x2
y1 O3
y2 O4
f
x
this
f
f
f
![Page 9: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/9.jpg)
Inheritance
y O1 O2 z
b O3
B.xb
A.xa
this
f
f
f
O4 c
C.xc
f
![Page 10: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/10.jpg)
Imprecision
• Encapsulation• Inheritance
– Both of these are strong concepts of OOP– But not captured properly with old techniques– Solution is Object sensitivity
![Page 11: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/11.jpg)
Object Sensitivity
• Revised semantics– O` - set of all object names– R` - set of replicas of reference variable– Relation α(C,m)– Set of new transfer functions
![Page 12: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/12.jpg)
Context sensitivity included
• B.thiso3,B.xbo3, A.xao3
C.thiso4,C.xco4,A.xao4
y O1 O2 z
b O3 O4 c
B.xb
A.xa
this
C.xc
f
f
f
f
Older representation
![Page 13: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/13.jpg)
Advantages
• Models OOP features• Distinguishes between different receiver
objects • Static methods and variables can be handled
with insensitivity • Can be parameterized
![Page 14: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/14.jpg)
Parameterized Object Sensitivity
• Two dimensions– Degree of precision in
naming scheme
o21 , o31
– Set R* of reference variables for which multiple points-to sets should be maintained
![Page 15: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/15.jpg)
Implementation and Performance
• Techniques for implementation and optimization
• Side-effect analysis (MOD)• Def-Use analysis• Empirical Results• Conclusions• Future Work
![Page 16: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/16.jpg)
Techniques for Implementation
• Typical implementation of flow- and context-insensitive analysis (Andersen’s technique):– Statement processing routine: processes different
kinds of program statements– Virtual dispatch routine: models the semantics of
virtual calls
![Page 17: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/17.jpg)
Techniques for Implementation
• Implementation of parameterized object-sensitive analysis:– Implement function map(v, c)– Process each statement once for every possible
context– Augment the virtual dispatch routine to map the
return variable and the formal parameters of the invoked method to the corresponding context.
![Page 18: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/18.jpg)
Techniques for Optimization
• The points-to set of a replica thiso = {o}.• Suppose statement s contains only
nonreplicated variables (i.e. the variables are not in the R* set), then analyze s only once for one “default” context.
• Similarly, if l ∈ R* but r ∉ R*, and l is assigned only at statements of the form:– l = r– l = r.f
![Page 19: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/19.jpg)
Techniques for Optimization
• Suppose l ∈ R* and p ∉ R*.• Consider the assignments: l.f=p, p=l, p=l.f, and p.f=l.
• We can add a nonreplicated variable l’ and a new (context-dependent) statement l’=l.
• Then the points-to set of l’ is the union of the the points-to sets of all context copies of l.
• So the statements can be analyzed context-independently.
![Page 20: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/20.jpg)
Side-effect Analysis (MOD)
• Goal:– For each statement s and context c of the method
enclosing s, compute set Mod(s, c) of objects that could be modified by executing s when in c.
– Also, MMod(m, c) is the set of objects that could be modified by each contextual version of a method m.
• The previous optimizations can be applied.
![Page 21: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/21.jpg)
Side-effect Analysis (MOD)
Instance field assignments
Virtual method calls
Static method calls
Typo: should be c
![Page 22: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/22.jpg)
Def-Use Analysis
• Goal: compute def-use associations between pairs of statements.
• A def-use association for a memory location l is a pair of statements (m, n) such that m assigns a value to l and subsequently n uses that value.
![Page 23: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/23.jpg)
Standard Def-Use Analysis
• For procedural languages, well known methods for computing intraprocedural associations and interprocedural associations.
• We need a pointer analysis to disambiguate indirect definitions and uses.
• Reaching definitions (RD) analysis needed to determine the sets of definitions that may reach a program statement (because of use of pointers), in order to identify def-use pairs.
![Page 24: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/24.jpg)
Object Sensitivity in Def-Use Analysis
• Points-to analysis must be used in order to determine which objects may be accessed by expressions of the form p.f.
• ∀ oi ∈Pt(p), memory location oi.f is added to the DEF or USE set for the corresponding statement.
• MDEF(m) contains definitions created in method m and in all direct and indirect callees of m.
![Page 25: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/25.jpg)
Standard Def-Use Analysis
DEF set;Direct and indirect DEF set
Reaching Definitions set broken down by type of node (statement)
DEF-USE pairs
![Page 26: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/26.jpg)
Implementations
• Parameterized object-sensitive points-to analysis (context depth = 1):– ObjSens1: keeps context-sensitive information for
implicit parameters this and formal parameters of instance methods and constructors.
– ObjSens2: the same as ObjSens1, but it also keeps track of return variables.
![Page 27: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/27.jpg)
Implementations
• Context-sensitive analysis based on the call string approach to context sensitivity, for a call string k = 1 (CallSite).
• Distinguishes context per call site.• To allow for comparison, the context
replication is performed for this, formal parameters and return variables in instance methods and constructors.
![Page 28: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/28.jpg)
Implementations
• The 3 context-sensitive analyses were built on top of an existing implementation of Andersen’s context-insensitive points-to analysis (And).
• The analyses are using the optimization techniques we discussed.
• The Soot framework was used to process Java bytecode and to build a typed intermediate representation.
![Page 29: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/29.jpg)
Characteristics of Programs
![Page 30: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/30.jpg)
Analysis Cost
![Page 31: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/31.jpg)
Discussion
• Time and memory cost is comparable to Andersen’s analysis.
• Amount of work is similar: And has to consider all possible objects for a statement s. Even though context-sensitive analyses do more work to keep track of different contexts, they eventually end up doing less work per statement s.
• For the majority of programs, adding the return values to R* does not increase cost.
![Page 32: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/32.jpg)
Discussion
• Call string context-sensitive analysis (CallSite) achieves practical cost.
• CallSite has poor running time for larger programs, probably because it is less precise than ObjSens2.
![Page 33: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/33.jpg)
MOD Analysis Implementation
• Measurements of ObjSens2, CallSite, and And.• Percentages are with respect to the number
of statements that modify at least one object.• Each column shows the percentage of the
total number of statements that modify the respective number of objects.
• More precise analyses produce a smaller percentage number.
![Page 34: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/34.jpg)
MOD Analysis Precision
![Page 35: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/35.jpg)
Conclusions
• Presented a framework for parameterized object-sensitive points-to analysis, and side-effect and def-use analyses based on it.
• Object-sensitive analysis achieves significantly better precision than context-insensitive analysis, while remaining efficient and practical.
![Page 36: Parameterized Object Sensitivity for Points-to Analysis for Java](https://reader034.vdocuments.us/reader034/viewer/2022051623/56815b61550346895dc94876/html5/thumbnails/36.jpg)
Future Work
• Investigate other instantiations of the framework: more precise naming of sub-objects of composite objects.
• Investigate applications of points-to, side-effect, and def-use analyses in the context of software productivity tools.