pointer and escape analysis for (multithreaded) programs martin rinard mit laboratory for computer...

Pointer and Escape Analysis for (Multithreaded) Programs

Martin RinardMIT Laboratory for Computer Science

Traditional Escape Analysis• Procedures• Dynamically allocated objects• Does an object escape the allocating

procedure?• Is the lifetime of object contained in

lifetime of procedure?• If so, can stack allocate object

• Sequential programs

Modern Escape Analysis• Region of Program

• Procedure• Thread• Group of Threads• Multiple-Entry Component

• Dynamically allocated objects• Is object “captured” within region?

Uses of Escape Information• Negative Interaction Information• Past: Traditional Compiler Optimizations

• Stack Allocation• Synchronization Elimination• Variety of Dynamic Check Eliminations

Foundation for Interaction Analyses

• Systems built from groups of reconfigurable components

• Important to understand interactions• Safety of composition• Transform to enhance fast reconfiguration,

fault-tolerance, predictability, performance• Escape analysis focuses interaction analyses

• Eliminates host of potential interactions• Cuts away large parts of program• Enables use of more powerful interaction

analyses

Importance of Interaction Analysis

• Need a global information about properties of potential component compositions• Interaction patterns• Inter-component dependences• Theme: see across component boundaries

• Payoff• Information about behavior of potential

composed systems• Customized implementations• Functionality-improving transformations

• Reduce vulnerability to failures• Improve adaptation response times

Key Requirements• Rapid reconfiguration, adaptability,

customization• Huge range of potential customized

combinations• Envisioned large-scale transformations

impractical to perform manually• Need to automate interaction analysis and

subsequent transformations• Distributed systems inherently concurrent

• Analyze multithreaded programs• Characterize and exploit interactions between

threads

Outline• Combined Pointer and Escape Analysis

• Sequential Programs• Multithreaded Programs

• Implementation in Flex Compiler• Experimental Results

Points-to Escape Graph in Example

vector elementData [ ]

this

enum

e

dotted = outsidesolid = inside

void computeMax() { int max = 0;Enumeration enum = database.elements();while (enum.hasMoreElements()) { Employee e = enum.nextElement();if (max < e.salary()) { max = e.salary(); highestPaid = e; }}

}

database highestPaid

Definitions: node types

• NI = inside nodes• represent objects created within the

computation of the method• one inside node for each object creation

site; represents all objects created at site• NO = outside nodes

• represent objects created outside of the computation of the method

Definitions: outside node typesNP = parameter nodes

represent objects passed as incoming parameters

NL = load nodesone load node for each load statement in methodrepresents objects loaded from an escaped node

NCL = class nodesnode from which static variables are accessed

Points-to Escape Graph in Example

vector elementData [ ]

this

enum

e

dotted = outsidesolid = inside

void computeMax() { int max = 0;Enumeration enum = database.elements();while (enum.hasMoreElements()) { Employee e = enum.nextElement();if (max < e.salary()) { max = e.salary(); highestPaid = e; }}

}

database highestPaid

Points-to Escape Graph in Example

red = escapedwhite = captured

void computeMax() { int max = 0;Enumeration enum = database.elements();while (enum.hasMoreElements()) { Employee e = enum.nextElement();if (max < e.salary()) { max = e.salary(); highestPaid = e; }}

} dotted = outsidesolid = insidevector elementData [ ]

this

enum

e

database highestPaid

Escaped nodes• Escaped nodes

• parameter nodes• class nodes• thread nodes• nodes in return set• nodes reachable from other escaped

nodes• captured is the opposite of escaped

Dataflow Analysis• Computes a points-to escape graph for

each program point• Points-to escape graph is a triple

<I,O,e>• I - set of inside edges• O - set of outside edges• e - escape function

Dataflow Analysis• Initial state:

I : formals point to parameter nodes,

classes point to class nodesO: Ø

• Transfer functions:I´ = (I – KillI ) U GenI

O´ = O U GenO

• Confluence operator is U

Intraprocedural Analysis• Must define transfer functions for:

• copy statement l = v• load statement l1 = l2.f• store statement l1.f = l2

• return statement return l• object creation site l = new cl• method invocation l = l0.op(l1…lk)

copy statement l = vKillI = edges(I, l)GenI = {l} × succ(I, v)I´ = (I – KillI ) GenI

l

v

Existing edges

copy statement l = vKillI = edges(I, l)GenI = {l} × succ(I, v)I´ = (I – KillI ) GenI

Generated edges

l

v

load statement l1 = l2.fSE = {n2 succ(I, l2) . escaped(n2)}SI = {succ(I, n2,.f) . n2 succ(I, l2)}case 1: l2 does not point to an escaped node (SE = Ø)

KillI = edges(I, l1)GenI = {l1} × SI

l1

l2

Existing edges

f

load statement l1 = l2.fSE = {n2 succ(I, l2) . escaped(n2)}SI = {succ(I, n2,.f) . n2 succ(I, l2)}case 1: l2 does not point to an escaped node (SE = Ø)

KillI = edges(I, l1)GenI = {l1} × SI

Generated edges

l1

l2

f

load statement l1 = l2.fcase 2: l2 does point to an escaped node (SE Ø)

KillI = edges(I, l1)GenI = {l1} × (SI {n})GenO = (SE × {f}) × {n}

l1

l2

Existing edges

load statement l1 = l2.fcase 2: l2 does point to an escaped node (SE Ø)

KillI = edges(I, l1)GenI = {l1} × (SI {n})GenO = (SE × {f}) × {n}

Generated edges

l1

l2

f

store statement l1.f = l2

GenI = (succ(I, l1) × {f}) × succ(I, l2)I´ = I GenI

l2

Existing edges

l1

store statement l1.f = l2

GenI = (succ(I, l1) × {f}) × succ(I, l2)I´ = I GenI

Generated edges

l2

l1f

object creation site l = new clKillI = edges(I, l)GenI = {<l, n>}

l

Existing edges

object creation site l = new clKillI = edges(I, l)GenI = {<l, n>}

Generated edges

l

Method call• Transfer function for method call:

• Take points-to escape graph before the call site

• Retrieve the points-to escape graph from analysis of callee

• Map callee graph into caller graph• Result is the points-to escape graph

after the call site

Interprocedural Mapping• Set up a mapping between caller and

callee• outside nodes in the callee may refer

to any number of inside nodes in the caller

• add all reachable inside edges from callee’s graph into caller’s graph

• outside edges from a node in the callee need to be added to the mapped caller node if it escapes

Interprocedural Mapping Examplevoid printStatistics() {

BufferedReader r = new BufferedReader(new InputStreamReader(System.in));

EmployeeDatabase e = new EmployeeDatabase(r);e.computeMax();System.out.println(“max salary = “ + e.highestPaid);

}

Interprocedural Mapping Example

egraph before call site

elementData [ ]database

void printStatistics() {BufferedReader r = new BufferedReader(

new InputStreamReader(System.in));EmployeeDatabase e = new EmployeeDatabase(r);e.computeMax();System.out.println(“max salary = “ + e.highestPaid);

}

Interprocedural Mapping Example

callee graph

graph before call site

Enum object is not present because it was captured in the callee.

elementData [ ]this database

e elementData [ ]database

void printStatistics() {BufferedReader r = new BufferedReader(

new InputStreamReader(System.in));EmployeeDatabase e = new EmployeeDatabase(r);e.computeMax();System.out.println(“max salary = “ + e.highestPaid);

}

highestPaid

Step 1: Map formals to actuals

graph before call site

e elementData [ ]database

void printStatistics() {BufferedReader r = new BufferedReader(

new InputStreamReader(System.in));EmployeeDatabase e = new EmployeeDatabase(r);e.computeMax();System.out.println(“max salary = “ + e.highestPaid);

}

callee graph

elementData [ ]this database

highestPaid

Step 2: Match edges to extend mapping

graph before call site

e elementData [ ]database

void printStatistics() {BufferedReader r = new BufferedReader(

new InputStreamReader(System.in));EmployeeDatabase e = new EmployeeDatabase(r);e.computeMax();System.out.println(“max salary = “ + e.highestPaid);

}

callee graph

elementData [ ]this database

highestPaid

graph before call site

e elementData [ ]database

callee graph

elementData [ ]this database

highestPaid

Step 3: Map nodes and edges to construct new graph

graph after

call sitee elementData [ ]database

highestPaid

Key Feature• Even if an object escapes one method• Often possible to recapture object in

caller methods• Common in practice

• Iterators• Objects that hold multiple return

values

Life is not so Simple• Dependences between phases• Mapping best framed as constraint

satisfaction problem• Solved using constraint satisfaction

Algorithm Features• Compositional

• Analyze each method once• Obtain parameterized result• Reuse result at different call sites• Independent preanalysis of libraries

• Partial• Can analyze method without analyzing

methods it invokes• Useful if not all code available in

analyzable form

Incrementalized Analysis• Compositional + Partial Enables

Incrementalization• Choose object to attempt to capture• Analyze method containing allocation site• Track where object escapes

• Specific call sites• Caller

• Incrementally analyze only those parts• Usual Result

• Significant reduction in analysis time• Almost all benefit of full analysis

Key Limitation (so far)• No analysis of interactions between

threads• Objects that escape from allocating

thread are NEVER recaptured• Solution: extend algorithm to analyze

interactions between threads• Challenge: avoid analyzing all

interleavings of statements from parallel threads

Interactions Between Threadsba dcHeap

Interactions Between Threadsba dcHeap

White Thread Yellow Thread

Interactions Between Threadsba dcHeap

White Thread

a.f = b;

Yellow Thread

Interactions Between Threadsba dcHeap

White Thread

a.f = b;t = a.f;

Yellow Threadt

Interactions Between Threadsba dcHeap

White Thread

a.f = b;t = a.f;t.f = c;

Yellow Threadt

Interactions Between Threadsba dcHeap

White Thread

a.f = b;

p = b.f;

t = a.f;t.f = c;

Yellow Threadp

Interactions Between Threadsba dcHeap

White Thread

a.f = b;

p = b.f;p.f = d;

t = a.f;t.f = c;

Yellow Threadp

Interactions Between Threadsba dcHeap

White Thread

a.f = b;

p = b.f;p.f = d;

t = a.f;t.f = c;

Yellow Thread

Important Properties• Result Depends on Specific Interleaving

• Analyze all Interleavings?• Iterate Across Threads to Fixed Point?

Important Properties• Result Depends on Specific Interleaving

• Analyze all Interleavings?• Iterate Across Threads to Fixed Point?

• Analyze Each Thread Once • Parameterized Analysis Result• Characterizes All Potential Interactions

• Combine Analysis Results From Different Threads to Compute Actual Interactions

• Compositional Analysis

Our Approach• Build Points-To Escape Graph• Result Characterizes Potential

Interactions• Inside Edges - Represent References Created

By Currently Analyzed Thread • Outside Edges - Represent References

Created By Parallel Threads• Inside Nodes - Represent Objects Created By

Current Analyzed Thread• Outside Nodes - Represent Objects Accessed

Via Outside Edges

Analysis of Each Thread

t = a.f;t.f = c;

Yellow Thread

Analysis Resultfor Yellow Thread

Analysis Resultfor White Thread

White Thread

a.f = b;

p = b.f;p.f = d;

ba

Analysis of Each Thread

t = a.f;t.f = c;

Yellow Thread

Analysis Resultfor Yellow Thread

Analysis Resultfor White Thread

White Thread

a.f = b;

p = b.f;p.f = d;

ba 1 Outside Edge

Analysis of Each Thread

t = a.f;t.f = c;

Yellow Thread

Analysis Resultfor Yellow Thread

Analysis Resultfor White Thread

White Thread

a.f = b;

p = b.f;p.f = d;

ba d1

Analysis of Each Thread

t = a.f;t.f = c;

Yellow Thread

2a

Analysis Resultfor Yellow Thread

Analysis Resultfor White Thread

White Thread

a.f = b;

p = b.f;p.f = d;

ba d1

Analysis of Each Thread

t = a.f;t.f = c;

Yellow Thread

2a c

Analysis Resultfor Yellow Thread

Analysis Resultfor White Thread

White Thread

a.f = b;

p = b.f;p.f = d;

ba d1

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Analysis Results From Threads

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

Analysis Results From Threads

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

Analysis Results From Threads

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

Analysis Results From Threads

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

CombinedResultAnalysis Results From Threads

ba

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

CombinedResultAnalysis Results From Threads

ba c

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

CombinedResultAnalysis Results From Threads

ba dc

Combining Analysis Results• Match Corresponding Edges• Map Outside Nodes to Nodes that They

Represent During the Analysis• Use Mapping to Combine Graphs

2a c

ba d1

Mapping

CombinedResultAnalysis Results From Threads

ba dc

2

1

Recapturing Nodes• If a, b, c, and d may be recaptured after

analyzing interactions between threads• Have complete points-to information for

recaptured nodesCombined

Result AfterInterthread Analysis

ba dc

2

1

Combined ResultAfter

Recapturing Nodes

ba dc

Common Usage PatternCurrent Thread

Creates and Initializes Objects (Synchronization)

Passes Objects As Parameters to New Thread

Never Accesses Objects Again

New Thread Starts Running

Accesses Objects (Synchronization)

Key Enhancement• Instrument Analysis to Record

• Actions on Nodes• synchronization operations• reads and writes

• Ordering Between Actions and Thread Starts• Use Ordering to Rule Out Potential

Interactions• Synchronizations from different threads

temporally separated by thread creation events

Server Benchmark Characteristics

IR Size

(instrs)

Number of

Methods

PreAnalysis

Time (secs)

echo 4,639 131 28

time 4,573 136 29

http 10,643 292 103

phone 9,547 267 75

IntraThreadAnalysis

Time (secs)

InterThreadAnalysis

Time (secs)

74

70

199

191

73

74

269

256

Percentage of Eliminated Synchronization Operations

0

20

40

60

80

100

http phone time echo mtrt

InterproceduralOnlyInterthread

Complications• Using Connectivity Information to Define

Concepts of Escaped and Captured Nodes• Recapturing Nodes After Combining Results • Treating Escaped and Captured Nodes

Differently During Analysis and Combination• Escaped Nodes Can Have Outside Edges• Captured Nodes Have No Outside Edges

• Recursively Generated Threads• Accurate Call Graph• Modeling Caller/Callee Interaction

Application to Real-Time Java• Real-Time Java has Scoped Memory (regions)• Motivation

• Keep Java’s safe memory model (no explicit deallocation)

• Obtain predictable allocation times (no garbage collection)

• Solution:• Preallocate a subregion of memory • Task allocates its objects in predictable

time from that region • Region deallocated as a unit when done

Scoped Memory Model• Scoped Memory is a separate object• Can run a computation in a Scoped

Memory (restore old memory when finished)

• Get a tree of nested computations, each with its Scoped Memory

• Interaction with Threading• New thread can use same scoped

memory as parent thread• Or can use new scoped memory

Nested Scoped Memories

ScopedMemoryObject

Referencing Constraints

ScopedMemoryObjectReferencing

Down ScopesIs NOT OK

ReferencingUp Scopes

Is OK

Preventing Downward References

• Reference Checks Done Dynamically• At every write of a reference into an

object field or array element• Check that written object is allocated

in a scope below that of referred object• If not, throw an exception

• Drawbacks• Dynamic checking overhead• Errors when program runs

Escape Analysis• Escape analysis provides information about how

lifetimes of objects relate to computation• Use escape analysis to automatically insert

scoped memories• Use escape analysis results to check programs

with explicit scoped memories • Check that NO object escapes computation that

executes in Scoped Memory• If no object escapes, then program will never

violate referencing constraints• Eliminate dynamic checks• Eliminate potential source of errors

• Analyzing interactions between threads may be crucial (depending on usage patterns)

Implementation Status• FLEX compiler infrastructure

• Full Java compiler• Lots of utilities and packages• Support for deep program analyses and

transformations• Implemented Scoped Memory checks• Implemented combined points-to escape analysis• Used analysis results to eliminate scoped

memory checks• Benchmarks

• Matrix Multiply (with Integers)• Linked List Sum (with Integers)

Results

Checks No Checks

Matrix Multiply 35.6 31.7

LinkedList Sum 4.00 3.05

• Verified that programs do not violate ScopedMemory constraints

• Execution Times (seconds)

Conclusion• Combined Points-to and Escape Analysis• Compositional, Partial, Incrementalized• Implemented Transformations

Stack Allocation, Private Heap Allocation, Synchronization Elimination, Scoped Memory Check Elimination

• Foundation for Interaction Analysis•Information about system behavior•Customized implementations•Functionality-improving transformations•Optimized adaptation handling