role analysis viktor kuncak patrick lam martin rinard mit lcs

Role Analysis

Viktor Kuncak

Patrick Lam

Martin Rinard

MIT LCS

Process Scheduler Example

Running Process

Suspended Process

Running Process List

nextRP

RPnext

next next

prev prev

Running Process

Suspended Process

nextRP

RPnext

next next

prev prev

left right

Suspended Process Tree

Suspended Process

Running Process

nextRP

next next

prevprev

left right

Suspended Process

Running Process

Remarks

• Desirable to capture distinction between suspended and running processes

• Standard types unsuitable– Type is fixed for lifetime of object– Scheduler suspends and resumes processes

• Concept of a role– Statically verifiable property of an object– Capture current conceptual purpose of object– Role changes as object's purpose changes

Develop a static type system in which each object is assigned a role

Program actions can change object roles

Challenges

Aliasing

Ensure that role changes performed using one alias are correctly reflected in roles

of other aliases

Procedures

Compositional interprocedural role system

Basic Approach

• Develop a role system in which role of each object depends on its heap aliases– Role provides aliasing information– Enables checker to ensure that role

changes are compatible with all aliases

• Role reflects object’s participation in different data structures

• Role changes as object moves between data structures

Role Definition for Running Processes

Running Process

role RP { Sequence of heap referencing constraints}

Slot Constraints

Running Process

role RP { slots RP.next,

RP.prev; ...}

Slot constraints identifythe complete set of heapaliases of the object

Slot Constraints

Running Process

RPnext

RP.prev; ...}

Slot constraints identifythe complete set of heapaliases of the object

Field Constraints

Running Process

RPnext

RP.prev; fields next : RP, prev : RP; ...}

Field constraints identifyroles of objects to which

fields refer

Field Constraints

Running Process

RPnext

RP.prev; fields next : RP, prev : RP; ...}

nextprev

Field constraints identifyroles of objects to which

fields refer

Identity Constraints

Running Process

RPnext

RP.prev; fields next : RP, prev : RP; identities next.prev, prev.next;}

nextprev

Identities identify cycles of length two.

Identity Constraints

Running Process

RPnext

Identities identify cycles of length two.

nextRP

RPnext

next next

prev prev

Role Definition for Running Processes

Roles as Constraints

• Each constraint C(o) is a predicate on objects

• Role is a logical conjunction of its defining constraints

• Constraints can be recursive!

Semantics of Role Constraints

• Constraint is interpreted in the context of a role assignment (mapping from objects to role names)

• Heap is role consistent iff there exists a role assignment in which every object satisfies its role

Roles for Suspended Processes

left right

Suspended Process

role R {

}role SP {

left right

Suspended Process

role R {

}role SP {

slots R.left

left right

Suspended Process

role R {

}role SP {

slots R.left R.right

left right

Suspended Process

role R {

}role SP {

slots R.left R.right SP.left

Rleft right

left right

Suspended Process

role R {

}role SP {

slots R.left R.right SP.left SP.right

Rleft right

left right

Suspended Process

role R {

}role SP {

slots R.left | R.right | SP.left| SP.right;

Rleft right

left right

Suspended Process

role R {

}role SP { fields left : SP right: SP slots R.left | R.right | SP.left| SP.right;

Rleft right

left right

Suspended Process

role R {

}role SP { fields left : SP|null, right: SP|null; slots R.left | R.right | SP.left| SP.right;

Rleft right

left right

Suspended Process

role R { fields left : SP|null, right: SP|null;}role SP { fields left : SP|null, right: SP|null; slots R.left | R.right | SP.left| SP.right;

left right

Suspended Process

role R { fields left : SP|null, right: SP|null;}role SP { fields left : SP|null, right: SP|null; slots R.left | R.right | SP.left| SP.right; acyclic left, right;} No cyclic paths of the form (left+right)*

left right

Suspended Process

role R { fields left : SP|null, right: SP|null;}role SP { fields left : SP|null, right: SP|null; slots R.left | R.right | SP.left| SP.right; acyclic left, right;}

Programming with Roles

Role Changes

• To suspend a process– Remove from running process list– Insert into suspended process tree

RPnext

nextRP prev

left right

Role Changes

RPnext

prevprev

left right

nextnext

Role Changes

RP RPnext

prevprev

left right

nextnext

role I { }

Isolated object:

Role Changes

RPnext

prevprev

left right

Removing a Process from List

remove(p : RP) { pp = p.prev; pn = p.next; pp.next = pn; pn.prev = pp; p.next = null; p.prev = null; pp = null; pn = null; setRole(p : I);}

RPnext

nextRP prev

RPnext

nextRP prev

pnnext

RPnext

prevprev

RP prev

prev next

RPnext

prevprev

prev nextnext

RPnext

prevprev

prev nextnext

remove(p : RP) { pp = p.prev; pn = p.next; pp.next = pn; pn.prev = pp; p.next = null; p.prev = null; pp = null; pn = null; setRole(p : I);}Programming model expects programmer

to indicate role changes

RPnext

prevprev

prev nextnext

remove(p : RP) { pp = p.prev; pn = p.next; pp.next = pn; pn.prev = pp; p.next = null; p.prev = null; pp = null; pn = null; setRole(p : I);}Programming model expects programmer

to indicate role changes

Programming Model Based On Instrumented Semantics

• Role Assignment Part of Program State– Each object has a nominal role– setRole(p : R) updates role assignment

• Programmer responsibilities– Specify intended role assignment– Write role-consistent program

• Static role checking ensures– Programs are role-consistent– No dynamic overhead incurred

RPnext

prevprev

RP prev

prev next

Temporary Role Violations

Data structure updates often

temporarily violate nominal roles of updated objects

RPnext

prevprev

RP prev

prev next

What do nominal roles mean during

these updates?

RPnext

prevprev

RP prev

prev next

Observation:

Objects with temporarily violated roles are referenced by local variables.

onstage objects = objects referenced by local variables.

onstage objects

offstage objectsRP

RPnext

prevprev

RP prev

prev next

Onstage and Offstage Objects

Onstage objects may have their

roles temporarily violated.

onstage objects

offstage objectsRP

RPnext

prevprev

RP prev

prev next

Roles of offstage objects must be

correct assuming the nominal roles of

onstage objects.

onstage objects

offstage objectsRP

RPnext

prevprev

RP prev

prev next

Role Checking

Each procedure has an interface

• Precondition• Property of heap at start of procedure• Specifies initial dataflow fact for analysis

• Abstraction of actions of procedure– Read Effects (accessed region of heap)– Write Effects

• Changes to heap references • Nominal role changes

Procedure Interfaces

Two Aspects of Role Checking

• Verifying interface conformance– Assume precondition– Analyze procedure– Verify that procedure respects effects

• Using interfaces at call sites to separate analysis of caller and callee

• Each procedure analyzed exactly once

Role Consistency Across Procedure Calls

When analyzing a procedure:

Assume that accessed objects have consistent roles.

Region R accessed by

foo(p) reads R { ...

At Call Site:

Use read effects of the procedure to verify that region accessed by the procedure has consistent roles

(even for onstage objects)

foo(p);

When analyzing the procedure:

Verify that only objects declared in callee’s read effects are accessed.

Assume that accessed objects have correct roles.

After Call Site:

The role checking assumes that region accessed in the procedure is left in a role consistent state.

foo(p);

After analyzing the procedure:

Verify that objects in accessed region are left in role consistent state (implicit postcondition)

Verifying Interface Conformance

Analysis Abstraction

Concrete Heap

(objects and references)

Analysis Representation:Role Graph

(nodes and edges)

Role Graph

Concrete Heap Role Graph

Onstage node(represents a

single onstage object)

Role Graph

Summary Offstage Node (represents any

number of objects)

Abstraction Relation

Each onstage object represented by an

onstage node

Concrete Heap Analysis Representation:Role GraphOffstage objects are

represented by offstage nodes

The function is• a graph homomorphism• isomorphism between onstage objects and nodes• role preserving: role(h(o)) = role(o)

Initial roles: p : RP

remove(p) {pp=p.prev; pn=p.next;pp.next=pn; pn.prev=pp;p.next=null; p.prev=null;pp=null; pn=null;setRole(p : I);

Interface for remove

Initial Role Graph

Initial roles: p : RPRead effects: p, RP

Initial Role Graph

Initial roles: p : RPRead effects: p, RPMust write effects: p.next = null, p.prev = null

Initial Role Graph

Initial roles: p : RPRead effects: p, RPMust write effects: p.next = null, p.prev = nullMay write effects:

RP.next = RP, RP.prev = RP

Initial Role Graph

Must role changes: p : I

Initial Role Graph

Verifying Interface for remove

Load statement

• expansion

Load statement

• expansion

• read effect check succeeds: RP in read effects

Load statement

• expansion

Load statement

• expansion

Store statement

• strong update

Store statement

• strong update

• verify write effect succeeds: RP.next = RP

Store statement

• strong update

• verify write effect succeeds: RP.prev = RP

Store statement

• strong update

• verify write effect succeeds: p.next=null

Store statement

• strong update

• verify write effect succeeds: p.prev=null

Local variable assignment

• remove local variable

• remove local variable (node goes offstage)

• check role is correct

RP RPpn

• merge node into offstage

setRole

• change the nominal role

setRole

• change the nominal role

• check that the role change is in the interface

Postcondition check:

• all accessed nodes have referencing relationships consistent with their roles

• even onstage nodes

Details of Analysis

• Dataflow fact is set of role graphs

• Merge is union of role graph sets

• Predicative analysis - filters out graphs that do not satisfy the test in conditional

• Builds on ideas from shape analysis– Expansion and contraction– May reachability (from onstage nodes)

prevents excessive merging of nodes

Using Interfaces at Call Sites

Example: remove procedure call . . .

remove(p);

. . .RP

Role graph before the call:

Read effects: p, RPMust write effects: p.next = null, p.prev = nullMay write effects:

remove interface:

Context Matching . . .

remove(p);

. . .RP

remove interface:

Role Check in Accessed Region . . .

remove(p);

. . .RP

remove interface:

Applying Must Write Effects . . .

remove(p);

. . .RP

remove interface:

Applying Must Write Effects . . .

remove(p);

. . .RP

remove interface:

Applying May Write Effects . . .

remove(p);

. . .RP

remove interface:

Applying Must Role Change . . .

remove(p);

. . .I

remove interface:

Enforcing Role Constraints . . .

remove(p);

remove interface:

Enforcing Role Constraints . . .

remove(p);

remove interface:

Merge . . .

remove(p);

remove interface:

Role graph after the call:

Key Ideas in Analysis

• Role of object characterizes its aliases– Enables analysis to find aliases– Verify new role consistent with all aliases

• Precise effects in procedure interfaces– Full precision for parameters

(or even fixed region surrounding parameters)

– Role consistency/may effects for rest of heap

Multiple Simultaneous Roles

Running Processes Suspended Processes

High Priority Process List

Low Priority Process List

proc proc proc proc

Complete Slot Constraints

• This slot constraint specifies ALL aliases

• Aliases from high or low priority process lists violate role

Partial Slot Constraints

• This slot constraint specifies aliases from next, prev, right, and left fields ONLY

• Aliases from high or low priority process lists can be used in new role definitions for high and low priority processes

role RP { next, prev, right, left: slots RP.next, RP.prev; fields next : RP, prev : RP; identities next.prev, prev.next;}

role RP { next, prev, right, left : slots RP.next,

role HighPriority { proc : slots HPL.proc;}

role LowPriority { proc : slots LPL.proc;}

Can have a running high priority process, a running low priority process, etc.

Benefits of Roles• Data structure consistency properties• Object usage constraints

– Procedures specify roles of parameters– Object's interface changes as its role

changes

• Roles crystallize useful perspective– Provide useful information to maintainers– Basis for exploration of the behavior of

program via dynamic role discovery – Help programmers conceptualize

relationships between objects

Related Work

Typestate

• Strom, Yemini ’86: Typestate– object initialization, no aliasing

• DeLine, Fähndrich ’01: High-Level Protocols– linear types for heap references

• Xu, Miller, Reps ’00: Typestate for machine code

Dynamically Changing Classes• Chambers ‘93: Predicate Classes

• Ghelli, Palmerini ‘99: Fibonacci

• Drossopoulou et al. ’01: Fickle

Alias Control in OOP• Hogg ’91: Islands• Almeida ’97: Balloon Types• Clarke, Potter, Noble ’98: Ownership Types• Banerjee, Naumann ’02: Confinement• Boyapati, Rinard ’01: Unique References• Boyland: Alias Burying

Specifying/Verifying Heap Invariants

• Smith, Walker, Morrisett ’00: Alias Types• Møller, Schwartzbach ’01: PALE• Fradet, Metayer ’97: Shape Types• Larus, Hilfinger ’88: Conflicts in structure accesses• Chase, Wegman, Zadeck ’90: SSG• Hendren ’90: Interference analysis• Hendren, Hummel, Nicolau ’94: APM / ADDS• Sagiv, Reps, Wilhelm ’99: TVLA• Rinetzky, Sagiv ’01: Noncompositional

interprocedural analysis

Conclusion

• Statically checked role system– Role changes reflect changes in purpose of

object in computation– Full support for role changes and aliasing

• Key aspects of design– Role characterizes aliases– Procedure abstraction choices

• Multiple simultaneous roles

role analysis viktor kuncak patrick lam martin rinard mit lcs

slots rp

rp identities

prev fields

role namesheap

role assignment mapping

role consistent iff

objects participation

data structuresrole

Documents

synthesis using variable elimination viktor kuncak epf...

lcs - highpack

customspatnazone.bih.nic.incustomspatnazone.bih.nic.in/docs/rti270217.pdfjogbani...

lecture 1: introduction - 6.035 / fall...

intermediate lcs

kv k4 76,5 x 59,4 - abdsb.bayern.de · hsp vhsp vhsp vhsp...

lcs objectives

beginner lcs

teknik lcs

undergraduate student handbook 2010-2011€¦ · all lcs...

thermaltake level 10 gt lcs tower lcs installation guide -...

lcs pmarket

lcs infomercial

indonesia lcs

lcs presentation

advanced lcs

lecture 1:...

rinard orchid green house marketing plan

analisa lcs

lcs constructors, inc. lcs today · lcs today spring 2016...