Pointer Analysis for Multithreaded Programs

1
Pointer Analysis for Multithreaded Programs

• Radu Rugina and Martin Rinard
• M I T Laboratory for Computer Science

2
Outline

• Example
• Review of Pointer Analysis for Sequential
  Programs
• Pointer Analysis for Multithreaded Programs
• Experimental Results
• Conclusions

R. Rugina, M. Rinard
PLDI 99
3
Example

• two concurrent threads
• two questions
• Q1 what location is written by p1 ?
• Q2 what location is written by p2 ?
• OR
• Q1 p?? in left thread
• Q2 p?? after both threads completed

R. Rugina, M. Rinard
PLDI 99
4
Two Possible Executions
R. Rugina, M. Rinard
PLDI 99
5
Analysis Result

• Result a points-to graph at each program point

R. Rugina, M. Rinard
PLDI 99
6
Analysis of Multithreaded Programs

• Problem
• analyze interactions between concurrent threads
• Straightforward solution
• analyze all possible interleavings and merge
  results
• fails because of exponential complexity
• for n threads with s1 , ... , sn statements
• Number of interleavings

s1 ... sn
(
(s1 ... sn) !
)

s1 , ... , sn
s1 ! ... sn !
R. Rugina, M. Rinard
PLDI 99
7
Our Approach

• We introduce interference information
• interference points-to edges created by the
• other concurrent threads
• models the effect of all possible
  interleavings
• Efficiency polynomial complexity in program
  size
• Derive dataflow equations
• recursive equations
• fixed-point algorithms to solve the equations
• theoretically less precise than all
  interleavings
• in practice no loss of precision

R. Rugina, M. Rinard
PLDI 99
8
Algorithm Overview

• intra-procedural
• flow-sensitive (dataflow analysis)
• handles unstructured flow of control
• defines dataflow equations for
• pointer assignments
• parallel constructs
• inter-procedural
• context-sensitive
• handles recursive functions

R. Rugina, M. Rinard
PLDI 99
9
Review of Pointer Analysis for Sequential
Programs
10
Points-to Graphs

• Points-to graphs EGH94
• nodes program variables
• edges points-to relationships
• Example

R. Rugina, M. Rinard
PLDI 99
11
Basic Pointer Assignments

• Four types of pointer assignments
• x y ( address-of assign )
• x y ( copy assign )
• x y ( load assign )
• x y ( store assign )
• More complex assignments
• transformed into a sequence of basic statements

tmp t z tmp
z t
R. Rugina, M. Rinard
PLDI 99
12
Generated Edges

z
z
x
x
y
y
t
address-of x y
copy x y
z
x
w
x
z
y
t
u
y
t
load x y
store x y
R. Rugina, M. Rinard
PLDI 99
13
Strong vs. Weak Updates

• strong updates
• kill existing points-to relationships
• result in more precise analysis results
• weak updates
• leave existing points-to edges in place
• reasons for weak updates
• control flow uncertainty
• arrays of pointers
• heap-allocated pointers

q
y
x
p
r
z
if (cond) p q else p
r p x
vi x
p malloc( sizeof(int) ) p x
R. Rugina, M. Rinard
PLDI 99
14
Dataflow Information

• copy x y
• gen (x, t) (y, t) ? C
• kill (x, z) (x, z) ? C
• strong not (array_elem(x) ? heap(x))

• address-of x y
• gen (x, y)
• kill (x, z) (x, z) ? C
• strong not (array_elem(x) ? heap(x))

• load x y
• gen (x, u) (y, t) ? C ? (t, u) ? C
• kill (x, z) (x, z) ? C
• strong not (array_elem(x) ? heap(x))

store x y gen (z, t) (x, z) ? C ? (y,
t) ? C kill (z, w) (x, z) ? C ? (z, w)
? C strong z (x, z) ? C v ?
not (array_elem(v) ? heap(v))
R. Rugina, M. Rinard
PLDI 99
15
Dataflow Analysis

• the dataflow information is ltC, I, Egt ? P3
• C the current points-to relationships
• I the interference information from other
  threads
• E edges created by the current thread
• as a set of edges, P3 is a lattice
• partial order relation set inclusion
• merge operator set union
• ltC1,I1,E1gt ? ltC2,I2,E2gt ltC1UC2 , I1UI2,
  E1UE2gt

R. Rugina, M. Rinard
PLDI 99
16
Abstract Interpretation

• P set of points-to graphs,
• Stat set of program statements
• abstract semantics is defined by a functional
• Stat ? (P3 ? P3)

R. Rugina, M. Rinard
PLDI 99
17
Parallel par Statements

• syntax
• par t1, ..., tn
• concurrent execution
• interleaving semantics
• may be nested
• interference
• is the union of points-to edges created by all
  other concurrent threads
• may be different for different concurrent threads

R. Rugina, M. Rinard
PLDI 99
18
Analysis of Individual Threads

• Interference information
• I global interference - generated by
  enclosing pars
• Li local interference - generated by current
  par
• E points-to edges created by the current
  thread
• Analysis result for thread ti

lt Ci , Ii , Ei gt ti lt Ci ,
Ii , ? gt Ii I ? Li Ci C ? Li
R. Rugina, M. Rinard
PLDI 99
19
Parend Analysis

• Analysis result

lt C, I , E gt par lt
C, I , E gt lt Ci , Ii , Ei gt
ti lt Ci , Ii , ? gt I I E E ?
(? Ei) C ? Ci
R. Rugina, M. Rinard
PLDI 99
20
Analysis of Entire par Construct

• Recursive dataflow equations

Ci C ? Li Ii I ?
Li lt Ci , Ii , Ei gt ti lt Ci , Ii , ?
gt (thread rule) E E ? (? Ei) C ?
Ci lt C, I , E gt par lt C, I , E
gt ( par rule )
information flowing INTO par construct
information flowing OUT of par construct
R. Rugina, M. Rinard
PLDI 99
21
Example Analysis
R. Rugina, M. Rinard
PLDI 99
22
Inter-Procedural Analysis

• Context-sensitive
• procedures re-analyzed at each call site
• Ghost variables
• replace variables not in the scope of the
  procedure
• distinguish locals in different activations of
  recursive functions
• Sequential Partial Transfer Functions
• (Seq-PTFs) WL95
• associate a points-to output
• graph to an input context
• can be reused when there is a match
• for the input context

R. Rugina, M. Rinard
PLDI 99
23
Multithreaded Extensions

• Multithreaded Input Context
• input points-to information
• interference information
• Multithreaded PTF
• associates output points-to graph
• created edges to an input context
• Mapping and unmapping
• map the interference information I
• unmap created points-to edges E

R. Rugina, M. Rinard
PLDI 99
24
Other Parallel Constructs

• Parallel for loops
• generate a symmetric dataflow equation

t1 lt C U E1, I U E1 , ? gt lt
C1 , I U E1 , E1 gt
for(i0 iltn i) spawn thread(i) sync

• Conditional Thread Creation
• merge analysis result with initial points-to graph

if (c1) spawn thread1() if (c2) spawn
thread2() sync
C ? (Ci U Ci )
R. Rugina, M. Rinard
PLDI 99
25
Advanced Features

• Recursive procedures
• result in recursive dataflow equations
• fixed-point algorithm to solve recursion
• Function pointers
• result in a dynamic call-graph
• handled using the computed pointer information
• methodology analyze all possible callees and
  merge results
• Thread-private global variables
• at parbegin nodes save their values in the
  parent thread and make them point to unknown in
  the child threads
• at parend nodes restore saved values in the
  parent thread

R. Rugina, M. Rinard
PLDI 99
26
Algorithm Evaluation

• Soundness
• the multithreaded algorithm conservatively
  approximates all possible interleavings of
  concurrent threads statements
• Termination of fixed-point algorithms
• follows from the monotonicity of the abstract
  semantics functional
• Complexity of fixed-point algorithms
• worst-case size of points-to graphs O(n2), where
  n Stat
• n program points imply worst-case O(n3)
  iterations
• worst-case polynomial complexity O(n4)
• Precision of analysis
• if the concurrent threads do not
  (pointer-)interfere then this
• algorithm gives the same result as the ideal
  algorithm

R. Rugina, M. Rinard
PLDI 99
27
Experimental Results

• Implementation
• SUIF infrastructure Cilk benchmarks
• Benchmark characteristics

R. Rugina, M. Rinard
PLDI 99
28
Precision Measurements

• Pointer values at load/store
• usually unique target
• 83 of the loads
• 88 of the stores
• few potentially uninitialized pointers
• very few pointers with more than
• two targets
• Comparison
• Multithreaded, Interleaved, Sequential
• MT Interleaved Seq
• results Multithreaded Sequential
• conclusion Multithreaded Interleaved

?
?
R. Rugina, M. Rinard
PLDI 99
29
Applications

• Current Uses
• MIT RAW project
• memory disambiguation for static promotion (ISCA
  99)
• C-to-silicon compiler generating small memories
  (FCCM 99)
• automatic parallelization of divide-and-conquer
  algorithms (PPoPP 99)
• Future Uses
• data race detection in multithreaded programs
• static elimination of array bounds checks

R. Rugina, M. Rinard
PLDI 99
30
Future

• Multithreaded programs
• are becoming very common
• are hard to debug
• are hard to analyze
• The current algorithm
• gives precise MT pointer information
• may be used as a foundation for other MT analyses
• gives a framework for other MT analyses

R. Rugina, M. Rinard
PLDI 99
31
Additional Slides
32
Challenging Benchmark Set

• Applications Heavily Optimized By Hand
• Pousse - timed competition, won ICFP 98 contest
• Pointer Arithmetic
• Casts
• Divide and Conquer Algorithms
• Recursion
• Pointers Into Heap-Allocated Arrays
• Pointer-Based Data Structures (octrees, hash
  tables, ...)
• Recursive Linked Data Structures Allocated On
  Stack

R. Rugina, M. Rinard
PLDI 99
33
Related Work

• Pointer analysis
• existing pointer analyses are focused to
  sequential programs
• LR92, LRZ93, CBC93, EGH94, Ruf95,
  WL95, And94, Ste96, SH97
• flow-sensitive vs. flow-insensitive analysis
• context-sensitive vs. context-insensitive
  analysis
• Multithreaded program analysis
• relatively unexplored field
• flow-sensitive analysis
• dataflow framework for bitvector problems KSV96
• does not apply to pointer analysis
• flow-insensitive analysis
• trivially model the interleaving semantics of
  concurrent threads
• locality analysis ZH97 ( uses type-inference
  techniques)

R. Rugina, M. Rinard
PLDI 99