scaling java points-to analysis using...
TRANSCRIPT
![Page 1: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/1.jpg)
Scaling Java Points-ToAnalysis Using SPARK
(Soot Pointer Analysis Research Kit)
Ondrej Lhotak and Laurie HendrenSable Research Group
McGill UniversityApril 8th, 2003
– p. 1/53
![Page 2: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/2.jpg)
Problems
Implementing a points-to analysis to handlethe details of Java
is a lot of work.is difficult to do correctly.
Research done on disparate implementationsis often incomparable.
– p. 2/53
![Page 3: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/3.jpg)
Objectives
Develop a flexible, efficient framework forexperimenting with variations in Javapoints-to analyses
Demonstrate its usefulness with an empiricalcomparison of precision and efficiency ofsome of these variations
– p. 3/53
![Page 4: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/4.jpg)
Outline
Spark overview
Empirical study
Overall performance
Uses of Spark
Conclusion
– p. 4/53
![Page 5: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/5.jpg)
Spark overview
Part of Soot bytecode transformation andannotation framework [CC 00] [CC 01]
Initial representation is Soot’s JimpleTyped [SAS 00]
Three-address (only simple operations)
Spark internal representation is PointerAssignment Graph (PAG)
Nodes for variables, allocation sites, fieldreferencesEdges representing subset constraints
– p. 5/53
![Page 6: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/6.jpg)
Spark overview
Spark proceeds in three steps:
JimpleConstruct
PAG
Simplify
PAG
Propagate
Points-to Sets
Analysis variations expressed by buildingdifferent PAGs for the same code
This talk concentrates on flow-insensitive,subset-based variations
– p. 6/53
![Page 7: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/7.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 7/53
![Page 8: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/8.jpg)
Declared types: ignore
HierarchyA
B C
A x, z;B y;x = new A();y = new B();y = (B) x;z = y;
x : A
A
y : B
A B
z : A
A B
– p. 8/53
![Page 9: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/9.jpg)
Declared types: ignore
HierarchyA
B C
A x, z;B y;x = new A();y = new B();y = (B) x;z = y;
x : AA
y : B
A
B
z : A
A B
– p. 8/53
![Page 10: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/10.jpg)
Declared types: ignore
HierarchyA
B C
A x, z;B y;x = new A();y = new B();y = (B) x;z = y;
x : AA
y : BA B
z : AA B
– p. 8/53
![Page 11: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/11.jpg)
Declared types: enforce after analysis[OOPSLA 00] [Rountev,Milanova,Ryder 01]
HierarchyA
B C
A x, z;B y;x = new A();y = new B();y = (B) x;z = y;
x : AA
y : BA B
z : AA B
– p. 9/53
![Page 12: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/12.jpg)
Declared types: enforce during analysis
HierarchyA
B C
A x, z;B y;x = new A();y = new B();y = (B) x;z = y;
x : AA
y : BA B
z : AA B
– p. 10/53
![Page 13: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/13.jpg)
Enforcing declared types
ignoring types produces many large sets(> 1000 elements) of spurious points-torelationships
in practice, enforcing types after analysisalmost as precise as during analysis
enforcing types during analysis preventsblowup during the analysis
ignore slow less preciseafter analysis slow more precise
during analysis fast more precise
– p. 11/53
![Page 14: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/14.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 12/53
![Page 15: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/15.jpg)
Field representation
Field references can be represented indifferent ways:
field-sensitive distinguishes fields ofdifferent objectsfield-based ignores the base object,grouping all objects having the fieldtogether
– p. 13/53
![Page 16: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/16.jpg)
Field-sensitive representation
A x, y, z;B u, v, w;
l1: x = new A();y = x;
l2: z = new A();u = new B();x.f = u;v = y.f;w = z.f;
xA1
yA1
zA2
uB
A1.fB
vB
A2.f w
– p. 14/53
![Page 17: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/17.jpg)
Field-based representation
A x, y, z;B u, v, w;
l1: x = new A();y = x;
l2: z = new A();u = new B();x.f = u;v = y.f;w = z.f;
xA1
yA1
zA2
uB
A.fB
vB
wB
– p. 15/53
![Page 18: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/18.jpg)
Field representation
Field-sensitive requires iterating
Field-based less precise, but possible in asingle iteration
Clever propagation algorithm can makespeed difference very small
field-based very fast less precisefield-sensitive almost as fast more precise
– p. 16/53
![Page 19: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/19.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 17/53
![Page 20: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/20.jpg)
Call graph construction
An approximation of the call graph is requiredfor points-to analysis
It can be builtahead-of-time using an analysis such asClass Hierarchy Analysison-the-fly during the analysis as actualtypes of receivers are computed
– p. 18/53
![Page 21: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/21.jpg)
Call graph construction: CHA
HierarchyA
B C
class B{ foo() { . . . } }class C{ foo() { . . . } }A x = new B();A y = x.foo();
xB
B.foo()
this
return
y
C.foo()
this
return
– p. 19/53
![Page 22: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/22.jpg)
Call graph construction: on-the-fly
HierarchyA
B C
class B{ foo() { . . . } }class C{ foo() { . . . } }A x = new B();A y = x.foo();
xB
B.foo()
this
return
y
C.foo()
this
return
– p. 20/53
![Page 23: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/23.jpg)
Call graph construction: on-the-fly
HierarchyA
B C
class B{ foo() { . . . } }class C{ foo() { . . . } }A x = new B();A y = x.foo();
xB
B.foo()
this
return
y
C.foo()
this
return
– p. 21/53
![Page 24: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/24.jpg)
Call graph construction
Building call graph on-the-fly requires addingedges during propagation
requires more iterationreduces simplification opportunities beforepropagation
CHA call graph includes more spurious,unreachable methods than on-the-fly
CHA fast less preciseon-the-fly slow more precise
– p. 22/53
![Page 25: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/25.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 23/53
![Page 26: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/26.jpg)
Pointer assignment graph simplification
Groups of nodes can be merged[Rountev,Chandra 00]
strongly-connected componentssingle-entry subgraphs
a
bc d
e
f
a
bcde
f
a
b
c d
e f g
h i
a
bcdefg
h i
– p. 24/53
![Page 27: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/27.jpg)
Pointer assignment graph simplification
Groups of nodes can be merged[Rountev,Chandra 00]
strongly-connected componentssingle-entry subgraphs
a
bc d
e
f
a
bcde
f
a
b
c d
e f g
h i
a
bcdefg
h i
– p. 24/53
![Page 28: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/28.jpg)
Pointer assignment graph simplification
Groups of nodes can be merged[Rountev,Chandra 00]
strongly-connected componentssingle-entry subgraphs
a
bc d
e
f
a
bcde
f
a
b
c d
e f g
h i
a
bcdefg
h i
– p. 24/53
![Page 29: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/29.jpg)
Pointer assignment graph simplification
Groups of nodes can be merged[Rountev,Chandra 00]
strongly-connected componentssingle-entry subgraphs
a
bc d
e
f
a
bcde
f
a
b
c d
e f g
h i
a
bcdefg
h i
– p. 24/53
![Page 30: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/30.jpg)
Pointer assignment graph simplification
Factors limiting simplification opportunitiesEnforcing declared types changespoints-to setsOn-the-fly call graph eliminates edgesfrom initial pointer assignment graph
– p. 25/53
![Page 31: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/31.jpg)
Pointer assignment graph simplification
– p. 26/53
![Page 32: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/32.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 27/53
![Page 33: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/33.jpg)
Set implementation
hash Using java.util.HashSet
array Sorted array, binary searcha b d
bit Bit vectora b c d e f g h i j . . . x y z
1 1 0 1 0 0 0 0 0 0 . . . 0 0 0
hybridArray for small setsBit vector for large sets
– p. 28/53
![Page 34: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/34.jpg)
Set implementation
hash slow largearray slow small
bit fast largehybrid fast small
In the above table,slow is up to 100 times slower than fastlarge is up to 3 times larger than small
Set implementation is very important
– p. 29/53
![Page 35: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/35.jpg)
Empirical study
Factors affecting precisionEnforcing declared typesField reference representationCall graph construction
Factors affecting only efficiencyPointer assignment graph simplificationSet implementationPropagation algorithms
– p. 30/53
![Page 36: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/36.jpg)
Propagation algorithms: iterative
repeatfor each edge e
propagate along e;end for
until no change
Slightly more complicated to handlefield referenceson-the-fly call graph
– p. 31/53
![Page 37: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/37.jpg)
Propagation algorithms: worklist
while worklist not empty doremove node n from worklist;for each edge e starting at n
propagate along e;add all affected nodes to worklist;
end forend while
With field references, difficult to determineaffected nodes
Very costly to determine all affected nodesdue to of aliasing
– p. 32/53
![Page 38: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/38.jpg)
Propagation algorithms: worklist
while worklist not empty doremove node n from worklist;for each edge e starting at n
propagate along e;add all affected nodes to worklist;
end forend while
With field references, difficult to determineaffected nodes
Very costly to determine all affected nodesdue to of aliasing
– p. 32/53
![Page 39: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/39.jpg)
Propagation algorithms: worklist
repeatwhile worklist not empty do
remove node n from worklist;for each edge e starting at n
propagate along e;add most affected nodes to worklist;
end forend whilepropagate along all field reference edges;
until no change
Solution: find most affected nodes, and addouter loop to handle missed nodes
– p. 33/53
![Page 40: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/40.jpg)
Propagation algorithms: incremental worklist
xA B C D y
– p. 34/53
![Page 41: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/41.jpg)
Propagation algorithms: incremental worklist
xA B C D
yA B C D
1st iteration: propagate { A , B , C , D }
– p. 35/53
![Page 42: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/42.jpg)
Propagation algorithms: incremental worklist
xA B C D E
yA B C D
1st iteration: propagate { A , B , C , D }
add E to x
– p. 36/53
![Page 43: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/43.jpg)
Propagation algorithms: incremental worklist
xA B C D E
yA B C D E
1st iteration: propagate { A , B , C , D }
add E to x
2nd iteration: propagate { A , B , C , D , E }
– p. 37/53
![Page 44: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/44.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold new
A B C D
yold new
– p. 38/53
![Page 45: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/45.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold new
A B C D
yold new
A B C D
1st iteration: propagate { A , B , C , D }
– p. 39/53
![Page 46: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/46.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold newA B C D
yold newA B C D
1st iteration: propagate { A , B , C , D }
flush new to old
– p. 40/53
![Page 47: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/47.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold newA B C D E
yold newA B C D
1st iteration: propagate { A , B , C , D }
flush new to old
add E to x
– p. 41/53
![Page 48: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/48.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold newA B C D E
yold newA B C D E
1st iteration: propagate { A , B , C , D }
flush new to old
add E to x
2nd iteration: propagate { E }
– p. 42/53
![Page 49: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/49.jpg)
Propagation algorithms: incremental worklist
Idea: split sets into new and old part
xold newA B C D E
yold newA B C D E
1st iteration: propagate { A , B , C , D }
flush new to old
add E to x
2nd iteration: propagate { E }
flush new to old
– p. 43/53
![Page 50: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/50.jpg)
Propagation algorithms
When to use worklist?Always, about twice as fast as iterative
When to use incremental worklist?Always, except with CHA call graphfield-based analysis, in which there is notenough iteration
– p. 44/53
![Page 51: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/51.jpg)
Summary of findings
Declared types should be enforced duringpropagation for a scalable analysis
Hybrid set implementation much faster thanothers, up to 2 orders of magnitude, withreasonable memory consumption
Field-based can be done in one iteration, butfield-sensitive with worklist algorithm isalmost as fast and slightly more precise
Tradeoff: On-the-fly call graph slower butmore precise than ahead-of-time CHA callgraph
– p. 45/53
![Page 52: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/52.jpg)
Outline
Spark overview
Empirical study
Overall performance
Uses of Spark
Conclusion
– p. 46/53
![Page 53: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/53.jpg)
Related studies
Rountev, Milanova, Ryder [OOPSLA 01]
360 MHz SPARC, solver written in MLversion 1.1.8 library (150 KLOC)
Whaley, Lam [SAS 02]
2 GHz Pentium, solver written in Javaversion 1.3.1 library (500 KLOC)optimistic call graph (potentially unsafe)
(Spark) Lhoták, Hendren [CC 03]
1.67 GHz Athlon, solver written in Javaversion 1.3.1 library (500 KLOC)
Common metric: number of methods analyzed
– p. 47/53
![Page 54: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/54.jpg)
Overall performance: time
– p. 48/53
![Page 55: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/55.jpg)
Overall performance: space
– p. 49/53
![Page 56: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/56.jpg)
Outline
Spark overview
Empirical study
Overall performance
Uses of Spark
Conclusion
– p. 50/53
![Page 57: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/57.jpg)
Uses of Spark
Use points-to and side-effect information inSoot analyses
Encode in attributesfor use in JITsfor use in program understanding
Experiment with points-to algorithmsusing Spark command-line switchesby implementing new algorithms withinSpark
– p. 51/53
![Page 58: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/58.jpg)
Conclusions
Spark is a flexible and efficient framework forexperimenting with variations in Javapoints-to analyses
We have demonstrated its usefulness in anempirical study of some of these variations
Ongoing work
BDD-based solvers [PLDI 03]
Object-sensitivity [Milanova,Rountev,Ryder 02]
On-the-fly cycle detection [Heintze,Tardieu 01]
Shared bit-vector [Heintze,Tardieu 01]
– p. 52/53
![Page 59: Scaling Java Points-To Analysis Using SPARKmaveric0.uwaterloo.ca/~olhotak/pubs/sable-paper-2003-1... · 2003. 4. 18. · – p. 1/53. Problems Implementing a points-to analysis to](https://reader033.vdocuments.us/reader033/viewer/2022051805/5ff4e4e3e77ca9629d635a6a/html5/thumbnails/59.jpg)
Obtaining Spark
Spark is part of Soot since version 1.2.4
Soot is available under the LGPLhttp://www.sable.mcgill.ca/soot
Future plans for SootMajor update (version 2.0) in June 2003Tutorial at PLDI
– p. 53/53