Refining%20Abstract%20Locations

1
Refining Abstract Locations

• Tachio Terauchi
• Jeff Foster
• Alex Aiken

2
Using types to reason about state
... spin_lock(f-gtlock) ... spin_unlock(f-gtlock)
...
f-gtlock unlocked spinlock_t f-gtlock locked
spinlock_t f-gtlock unlocked spinlock_t
3
Handling aliases
spin_lock(f-gtlock) spin_unlock(x) spin_unlock(f-
gtlock)

• Solution
• Abstract locations set of concrete locations
• May alias analysis
• Map states (types) to abstract locations.

4
Typing Judgement

• Abstract location
• r
• Type
• t int ... ref(r)
• Store
• C C, r a t
• C1 G e t C2
• In environment G, e has type t and evaluating e
  changes the store from C1 to C2.

C1 G e ref(r) C2 C1 G spin_lock(e)
void C2 r a locked spinlock_t
5
Problem aliases

• Ideally
• Single abstract location single concrete
  location
• Reality
• Single abstract location many concrete locations

typedef struct Foo spinlock_t lock
struct Foo next foo
void bar(foo f) spin_lock(f-gtlock) ...
spin_unlock(f-gtnext-gtlock) ...
spin_unlock(f-gtlock)
6
Problem aliases (continued)
typedef struct Foo spinlock_t lock
struct Foo next foo void bar(foo f)
spin_lock(f-gtlock) ... ... spin_unlock(f-gtlock)

7
Ideas

• Obtain finer abstract locations with better alias
  analysis.
• Subset-based alias analysis, one-level-flow alias
  analysis, cfl-reachability-based alias analysis,
  etc.
• Work in progress
• But none of these will work on the list example.
• More expensive analysis?
• This work construct and study language features
  to allow programmers locally refine abstract
  locations.

8
The list example
typedef struct Foo spinlock_t lock
struct Foo next foo void bar(foo f)
spin_lock(f-gtlock) ... ... spin_unlock(f-gtlock)

9
restrict

• restrict x e1 in e2
• e1 evaluates to a reference cell of the type
  ref(r).
• x has the type ref(r).
• r must not be accessed in e2.
• r must not be accessed outside of e2.
• Before and after the evaluation of e2, the state
  of r is equal to the state of r.
• Intuition separates the world of r from the
  world of r.

10
What can one do with restrict?

• Locally associate an abstract location with a
  single concrete location.

void bar(spinlock_t restrict lock)
spin_lock(lock) ... spin_unlock(lock)
... bar(f-gtlock) ...
11
What can one do with restrict? (2)

• Prevent local aliases from affecting the outside
  world.

void bar(spinlock_t restrict lock) /
builds a local linked list of locks containing
lock / ... spinlock_t newlock
new_lock(a fresh lock)) ... bar(newlock)
spin_lock(newlock) ...
12
Using restrict in existing programs

• Inferring restrict
• Extending restrict

13
Inferring restrict

• How often do programmers unknowingly declare
  restrict reference cells?
• Algorithm
• Given a program annotated with standard reference
  cell types (e.g. ref int),
• For each occurrence of let xref t e1 in e2,
  check if it satisfies all of the restrict
  constraints.
• If so, replace it with restrict xref t e1 in
  e2.

14
Experience with inferring restrict

• C programs
• Steensgaards alias analysis
• Pointer declarations in function parameters.
• Library functions
• Assume all abstract locations reachable from
  arguments and returns are accessed.
• Mixed initial results
• 16 out of 60 in flex
• 40 out of 510 in sendmail
• 7 out of 387 in li

15
Limitation of restrict

• restrict needs a variable referring to the target
  location.
• restrict x e1 in e2

16
The list example
typedef struct Foo spinlock_t lock
struct Foo next foo void bar(foo f)
spin_lock(f-gtlock) ... ... spin_unlock(f-gtlock)

17
Limitation of restrict

• restrict needs a variable referring to the target
  location.
• What to do when we want to restrict an
  arbitrary expression?
• ... spin_lock(f-gtlock) ...
• ... spin_lock(xyz((abc3)-gtd)) ...

18
Extending restrict

• restrict!! e1 in e2
• Outside of e2, e1 evaluates to a reference cell
  of the type ref(r).
• Within e2, e1 has the type ref(r).
• r must not be accessed in e2.
• r must not be accessed outside of e2.
• Before and after the evaluation of e2, the state
  of r is equal to the state of r.
• e1 is referentially transparent in e2.

19
Example
typedef struct Foo spinlock_t lock
struct Foo next foo
void bar(foo f) restrict!! f-gtlock in
spin_lock(f-gtlock) ... ... spin_unlock(f-gtlock
)
20
Further work

• More ways to locally refine abstract locations
• Relationship with other work on reasoning about
  states
• Alias analysis, Existential Types, Dataflow
  analysis, model checking, Linear types, Monads