Using ZBDDs in Points-to Analysis

1
Using ZBDDs in Points-to Analysis
Stephen Curial Jose Nelson
Amaral Department of Computing Science
University of Alberta

• Ondrej Lhotak
• D. R. Cheriton School of Computer Science,
  University of Waterloo

2
Introduction

• Points-to analysis is important
• Many compiler transformations require this
  information
• Precise analysis of large programs often
  infeasible due to space requirements
• Binary Decision Diagrams (BDDs)
• Compact representation of relations
• Zerro-suppressed BDDs (ZBDDs)
• Successfully used in other domains
• Circuit design, model checking, verification
• Havent been used to represent relations
• Need to develop relational product operation

3
Background - What Are Binary Decision Diagrams
(BDDs)
F(x1 x2 x3)
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
Legend
x1

• Non-terminal Node
• BDD Variable

x1
x2
x2

• 0 / false / lo -edge

x3
x3
x3
x3

• 1 / true / hi -edge

1

• Terminal Node

1
0
OBDD
4
BDDs are Canonical

• 2 reduction rules
• When two BDD nodes p and q are identical, edges
  leading to q are changed to lead to p, and q is
  eliminated from the BDD.
• A BDD node p whose one-edge and zero-edge both
  lead to the same node q is eliminated from the
  BDD and the edges leading to p are redirected to
  q.

5
Background - What Are Binary Decision Diagrams
(BDDs)
F(x1 x2 x3)
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x1
x1
x2
x2
x2
x2
x3
x3
x3
x3
x3
x3
1
0
1
0
ROBDD
OBDD
6
Using ROBDDs to represent points-to relations

• We compute the may point-to relation
• PT (a,L1) (a,L2) (b,L1) (b,L2) (c,L1)
  (c,L2) (c,L3)

L1 a new O() L2 b new O() L3 c new
O() a b b a c b
Code v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Code v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
Pointer Code
a 00
b 01
c 10
Object Code
L1 00
L2 01
L3 10
After Berndl-Lhotak et al., PLDI03
7
Using ROBDDs to represent points-to relations
Code v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Code v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
v1
v2
v2
v3
v3
v3
v3
v4
v4
v4
v4
v4
v4
v4
v4
Pointer Code
a 00
b 01
c 10
Object Code
L1 00
L2 01
L3 10
1
0
After Berndl-Lhotak et al., PLDI03
8
Using ROBDDs to represent points-to relations
Code v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Code v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
v1
v2
v2
v3
v3
v3
v3
v4
v4
v4
v4
v4
v4
v4
v4
Notice that many elements in the domain are
un-assigned. - Potentially wasting space
Pointer Code
a 00
b 01
c 10
Object Code
L1 00
L2 01
L3 10
1
0
After Berndl-Lhotak et al., PLDI03
9
Why do we have dont care values?

• To represent relations efficiently with BDDs a
  binary encoding is used.
• 2n encodings
• but domain may be smaller then 2n
• E.g. A domain with 3 elements needs to be encoded
  using 2 bits.

10
One-of-N encoding

• One-of-N encoding can eliminate unused bit
  patterns.
• n elements uses n bits

a 000001
b 000010
c 000100
d 001000
e 010000
f 100000
Example of a One-of-N encoding
11
ZBDDs are Efficient with a One-of-N Encoding

• A ZBDD is efficient if
• There are few vectors in the on-set.
• The elements in the on-set have very few 1s.
• For every 1 in an encoding that is part of the
  onset, there will be a path to the 1 terminal.

12
What is a ZBDD

• 2nd reduction rule changed
• When two BDD nodes p and q are identical, edges
  leading to q are changed to lead to p, and q is
  eliminated from the BDD.
• A BDD node, p, whose one-edge leads to the zero
  terminal node and whose zero-edge leads to a
  node, q, is removed from the BDD and the edges
  leading to p are redirected to q.

Minato94
13
OBDD vs. ROBDD vs. ZBDD
F(x1 x2 x3)
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x1
x1
x2
x2
x2
x2
x3
x3
x3
x3
x3
x3
1
0
1
0
OBDD
ROBDD
14
OBDD vs. ROBDD vs. ZBDD
x1
x1
F(x1 x2 x3)
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x2
x2
x2
x3
x3
x3
1
1
0
0
ZBDD (Binary Encoding)
ROBDD
If a variable in the ZBDD is true and it not
tested, it is mapped to 0. E.g. input 110
15
Using ZBDDs for Points-to Analysis

• Points-to analysis algorithm needs relational
  product to calculate the points-to set due to
  propagation.
• Initial Points-to relation (V x W) Edge Set
  (i.e. assignments) (V x H)
• RELPROD(Init, Edge, V)
• REPLACE(W to V)
• UNION(POINTS-TO, PT from PROPAGATION)

16
BDD Relational Product Example
X p new O() Y q new O() q p

• Pt ltp,Xgt, ltq,Ygt
• Edge ltq,pgt

We want to propagate the points-to set along the
edges.
Relational Product will join ltp,Xgt with ltq,pgt to
give ltp, q, Xgt then existential quantification
will remove p to yield ltq,Xgt
17
ZBDD Relational Product Example
X p new O() Y q new O() q p

• Pt Xp, Yq
• Edge pq
• ZBDD Mul gives Xpq', Yqpq'
• To adapt the ZBDD multiplication algorithm we
  need to
• Remove tuples that have multiple elements of the
  same attribute
• Add existential quantification
• Need to throw out Yqpq' because it has both p and
  q in the same attribute.
• Keep Xpq', but we want to quantify the p out of
  it, to get Xq'

18
Experimental Setup

• Used 3 points-to analysis frameworks
• bddbddb Whaley and Lam PLDI 2004
• soot / spark Brendl et al. PLDI 2003
• Paddle Lhotak and Hendren CC 2006
• Used 10 Java benchmarks
• 3 from Decapo
• antlr, bloat, chart
• 4 from SPEC JVM 98
• jack, javac, jess, raytrace
• 3 other Object Oriented
• polyglot, sablecc, soot

19
ZBDD Experiments
bddbddb - Context Insensitive
20
ZBDD Experiments
Brendel et al. - Context Insensitive
21
ZBDD Experiments
Paddle - Context Sensitive
22
ZBDD Experiments

• Impact of ZBDDs depends on the relation
• Increase size greater than 2 times.
• Only relations in the context-insensitive
  analysis grew.
• Reduce size more than 8 times.
• Depends on the density of the relation.

23
When to use ZBDDs

• Density metric
• Number of tuples in the relation divided by the
  number of possible tuples in the full domain.
• Simple test if current analysis doesnt use BDDs.

24
When to use ZBDDs
bddbddb - Context Insensitive
25
When to use ZBDDs
Brendel et al. - Context Insensitive
26
When to use ZBDDs
Paddle - Context Sensitive
27
Density Metric

• Density
• Less than 3 x 10-3
• ZBDD lt BDD
• Close to 3 x 10-3
• ZBDD BDD
• Greater than 3 x 10-3
• ZBDD gt BDD

28
Conclusion

• ZBDD based points-to analysis
• Represent relations
• Relational product algorithm
• Implementation of ZBDD based points-to analysis
• Reduced size for some context insensitive
  relations
• Reduced the size for all context sensitive
  relations
• Relational density metric
• Predict ZBDD vs. BDD

29
ZBDD Relational Product

• The relational product algorithm for BDDs is an
  existential quantification of a conjunction.
• ?x.(fg) (fg)0/x (fg)1/x)
• Multiplication for ZBDDs is analogous to
  conjunction in BDDs
• Multiplication algorithm existed
• Develop algorithm that combines existential
  quantification with multiplication.
• Performs early quantification like the BDD
  version.

30
ZBDD Relational Product

• To use ZBDDs in points-to analysis needed to
  create a Relational Product Operator.
• In relational calculus, essentially a natural
  join followed by project.
• Given two functions f(x, ) and g(x, ...), does a
  value of x exist that makes the conjunction of f
  and g true?
• ?x.(fg) (fg)0/x (fg)1/x)

31
ZBDD Relational Product

• ZBDD ZRelProd(ZBDD p, ZBDD q, Set pd)
• 1 if p.top lt q.top
• 2 then return ZRelProd(q, p, pd)
• 3 if q 0
• 4 then return 0
• 5 if q 1
• 6 then return Subset0(p, pd)
• 7 x ? p.top
• 8 (p0, p1) ? factors of p by x
• 9 if x ? pd
• 10 then
• 11 (q0, q1) ? factors of q by x
• 12 return union(ZRelProd(p1, q1, pd),
  ZRelProd(p0, q0, pd))
• 13 else
• 14 return node(x, ZRelProd(p1, q, pd),
  ZRelProd(p0, q, pd))

32
ZBDD Relational Product

• The relational product algorithm for BDDs is an
  existential quantification of a conjunction.
• ?x.(fg) (fg)0/x (fg)1/x)
• Multiplication for ZBDDs is analogous to
  conjunction in BDDs
• Multiplication algorithm existed
• Develop algorithm that combines existential
  quantification with multiplication.
• Performs early quantification like the BDD
  version.