Java Alias Analysis for Online Environments

1
Java Alias Analysis for Online Environments

• Manu Sridharan
• 2004 OSQ Retreat
• Joint work with Rastislav Bodik, Denis Gopan,
  Jong-Deok Choi

2
Motivation Online Environments

• No suitable alias analysis for online
  environments
• JIT compilation and optimization of modern
  languages
• Currently use type system for coarse alias info
• Whole-program Andersen too slow (45s)
• IDE program understanding, powerful refactorings
• Andersen too inaccurate (need context-sensitivity)
  
• Up to 20 minutes for full context-sensitive
  analysis
• Desired analysis properties similar!
• Interactive response time
• demand analysis, approximate wisely within time
  budget
• Additional context-sensitivity when necessary
• depth 3 for distinguishing ArrayList objects

3
Alias Analysis as CFL-Reachability (Melski, Reps)
x new Obj() // o1 y new Obj() // o2 z
new Obj() // o3 x.f y y.f z w y v
w.f
new
x
o1
w
assign
pff
new
o2
y
gff
pff
v
new
o3
z
pointsTo - new contains
pointsTo contains - assign gff
share pff share - pointsTo pointsTo_bar
4
Java Alias Analysis is Balanced Parens

• Match getfields with putfields to track flow
  through heap
• Does not hold for C (address-of operator)
• Match edges summarize flow through fields, make
  traversal regular
• Makes efficient dynamic programming algorithm for
  Dyck languages applicable

new
x
o1
w
assign
pff
new
o2
y
gff
pff
v
new
o3
z
pointsTo - new contains
pointsTo contains - assign gff
share pff
match
5
Match-based algorithms

• MATCHall add only valid match edges bottom-up
• Adaptation of Reps et. al. POPL95 algorithm
• Alternative to constraint-based propagation
  algorithms
• may be faster with finer-grained abstract
  locations
• MATCHk validate match edges selectively
• Experimentally, most match edges valid
• Focus effort on those likely to be invalid
  (arrays)
• MATCH0 add matches exhaustively, simple
  traversal
• Can restrict amount of traversal based on budget
  / payoff
• Restricted MATCH0 fast without sacrificing
  accuracy
• less than 2 ms / query
• resolves 90 of virtual calls resolved with
  field-sensitivity
• Suitable for JIT compiler

6
Refactoring and context-sensitivity
class Car Engine engine Car() Engine
getEngine() return engine void
setEngine(Engine e) engine e class
Engine int horsePower Engine(int hp)
horsePower hp int getHP() return
horsePower
class Car int horsePower Engine engine
Car(int hp) horsePower hp int
getHP() return horsePower void
setEngine(Engine e) engine e Engine
getEngine() return engine class Engine

• Precondition engine is dynamically one-to-one
• statically one-to-one simple flow-sensitivity
• Context-sensitive alias analysis necessary
• Distinguish calls to setEngine()
• Track Car objects if placed in container

7
Summaries through CFL paths
class ListElem int val ListElem next
ListElem(int v, ListElem n) val v next
n ListElem add(int v) ListElem m
this while (m ! null) if (m.val
v) return this m m.next
return new ListElem(v, this) // o1
this
assign
assign
m
ret
new
gfnext
o1
our summary

• Previous summary approach includes entire graph
  for add
• based on heap reachability (Whaley/Rinard
  OOPSLA99)
• Our approach only retains CFL paths from entry to
  exit
• In above example, exclude m and its edges

8
Java Alias Analysis is Balanced Parens So What?

• Motivation online environments
• JIT performance improvement
• IDE program understanding, powerful refactorings
• Desired analysis properties
• Interactive response time for small number of
  queries
• Added sensitivity (field, context) when necessary
• Progress
• Studied CFL reachability formulation
• Insight unlike C, Java alias analysis is
  balanced parens
• JIT simple, fast, and accurate algorithm
• less than 2 ms / query, 90 of field-sensitive
  accuracy
• IDE context-sensitivity through small summaries
• Idea retain only CFL paths