Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson Amaral Department of Computing Science University of Alberta Ondrej Lhotak D. R. Cheriton School of Computer Science, University of Waterloo

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Introduction  Points-to analysis is important –Many compiler transformations require this information –Precise analysis of large programs often infeasible due to space requirements  Binary Decision Diagrams (BDDs) –Compact representation of relations  Zerro-suppressed BDDs (ZBDDs) –Successfully used in other domains Circuit design, model checking, verification –Haven’t been used to represent relations Need to develop relational product operation

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Background - What Are Binary Decision Diagrams (BDDs) F(x 1 x 2 x 3 )= x1x1 x2x2 x2x2 x3x3 x3x3 x3x3 x3x3 10 OBDD x1x1 1 Non-terminal Node BDD Variable 0 / false / lo -edge 1 / true / hi -edge Terminal Node Legend

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 BDDs are Canonical  2 reduction rules: 1.When two BDD nodes p and q are identical, edges leading to q are changed to lead to p, and q is eliminated from the BDD. 2.A BDD node p whose one-edge and zero-edge both lead to the same node q is eliminated from the BDD and the edges leading to p are redirected to q.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Background - What Are Binary Decision Diagrams (BDDs) F(x 1 x 2 x 3 )= x1x1 x2x2 x2x2 x3x3 x3x3 x3x3 x3x3 10 OBDD ROBDD x1x1 x2x2 x2x2 x3x3 x3x3 1 0

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Using ROBDDs to represent points-to relations We compute the may point-to relation: PT = {(a,L 1 ); (a,L 2 ); (b,L 1 ); (b,L 2 ); (c,L 1 ); (c,L 2 ); (c,L 3 )} We compute the may point-to relation: PT = {(a,L 1 ); (a,L 2 ); (b,L 1 ); (b,L 2 ); (c,L 1 ); (c,L 2 ); (c,L 3 )} Code v 1 v 2 v 3 v 4 fTfT x x PointerCode a00 b01 c10 Code v 1 v 2 v 3 v 4 fTfT x 1100x 1101x 1110x 1111x L 1 : a = new O(); L 2 : b = new O(); L 3 : c = new O(); a = b; b = a; c = b; ObjectCode L1L1 00 L2L2 01 L3L3 10 After Berndl-Lhotak et al., PLDI03

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Using ROBDDs to represent points-to relations Code v 1 v 2 v 3 v 4 fTfT x x PointerCode a00 b01 c10 Code v 1 v 2 v 3 v 4 fTfT x 1100x 1101x 1110x 1111x ObjectCode L1L1 00 L2L2 01 L3L3 10 v1v1 v2v2 v2v2 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v3v3 v3v3 v3v3 v3v3 10 After Berndl-Lhotak et al., PLDI03

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Using ROBDDs to represent points-to relations Code v 1 v 2 v 3 v 4 fTfT x x PointerCode a00 b01 c10 Code v 1 v 2 v 3 v 4 fTfT x 1100x 1101x 1110x 1111x ObjectCode L1L1 00 L2L2 01 L3L3 10 v1v1 v2v2 v2v2 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v4v4 v3v3 v3v3 v3v3 v3v3 10 After Berndl-Lhotak et al., PLDI03 Notice that many elements in the domain are un-assigned. - Potentially wasting space

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Why do we have don’t care values?  To represent relations efficiently with BDDs a binary encoding is used. –2 n encodings but domain may be smaller then 2 n E.g. A domain with 3 elements needs to be encoded using 2 bits.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 One-of-N encoding  One-of-N encoding can eliminate unused bit patterns. –n elements uses n bits a b c d e f Example of a One-of-N encoding:

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDDs are Efficient with a One-of-N Encoding A ZBDD is efficient if: There are few vectors in the on-set. The elements in the on-set have very few 1’s. For every 1 in an encoding that is part of the onset, there will be a path to the 1 terminal.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 What is a ZBDD  2 nd reduction rule changed: 1.When two BDD nodes p and q are identical, edges leading to q are changed to lead to p, and q is eliminated from the BDD. 2.A BDD node, p, whose one-edge leads to the zero terminal node and whose zero-edge leads to a node, q, is removed from the BDD and the edges leading to p are redirected to q. [Minato94]

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 OBDD vs. ROBDD vs. ZBDD F(x 1 x 2 x 3 )= x1x1 x2x2 x2x2 x3x3 x3x3 x3x3 x3x3 10 OBDD ROBDD x1x1 x2x2 x2x2 x3x3 x3x3 1 0

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 OBDD vs. ROBDD vs. ZBDD ROBDD x1x1 x2x2 x2x2 x3x3 x3x3 1 0 ZBDD (Binary Encoding) x1x1 x2x2 x3x3 1 0 F(x 1 x 2 x 3 )= If a variable in the ZBDD is true and it not tested, it is mapped to 0. E.g. input 110

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Using ZBDDs for Points-to Analysis  Points-to analysis algorithm needs relational product to calculate the points-to set due to propagation. –Initial Points-to relation (V x W) & Edge Set (i.e. assignments) (V x H) –RELPROD(Init, Edge, V) –REPLACE(W to V) –UNION(POINTS-TO, PT from PROPAGATION)

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 BDD Relational Product Example  Pt = {, }  Edge = { } X: p = new O(); Y: q = new O(); q = p; We want to propagate the points-to set along the edges. Relational Product will join with to give Relational Product will join with to give then existential quantification will remove p to yield then existential quantification will remove p to yield

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Relational Product Example  Pt = { Xp, Yq}  Edge = { pq’ }  ZBDD Mul gives: { Xpq', Yqpq' } To adapt the ZBDD multiplication algorithm we need to: Remove tuples that have multiple elements of the same attribute Remove tuples that have multiple elements of the same attribute Add existential quantification Add existential quantification  Need to throw out Yqpq' because it has both p and q in the same attribute.  Keep Xpq', but we want to quantify the p out of it, to get Xq' X: p = new O(); Y: q = new O(); q = p;

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Experimental Setup  Used 3 points-to analysis frameworks –bddbddb [Whaley and Lam PLDI 2004] –soot / spark [Brendl et al. PLDI 2003] –Paddle [Lhotak and Hendren CC 2006]  Used 10 Java benchmarks: –3 from Decapo antlr, bloat, chart –4 from SPEC JVM 98 jack, javac, jess, raytrace –3 other Object Oriented polyglot, sablecc, soot

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Experiments bddbddb - Context Insensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Experiments Brendel et al. - Context Insensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Experiments Paddle - Context Sensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Experiments  Impact of ZBDDs depends on the relation: –Increase size greater than 2 times. Only relations in the context-insensitive analysis grew. –Reduce size more than 8 times. –Depends on the density of the relation.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 When to use ZBDDs  Density metric –Number of tuples in the relation divided by the number of possible tuples in the full domain. –Simple test if current analysis doesn’t use BDDs.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 When to use ZBDDs bddbddb - Context Insensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 When to use ZBDDs Brendel et al. - Context Insensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 When to use ZBDDs Paddle - Context Sensitive

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Density Metric –Density Less than 3 x –|ZBDD| < |BDD| Close to 3 x –|ZBDD| ~= |BDD| Greater than 3 x –|ZBDD| > |BDD|

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 Conclusion  ZBDD based points-to analysis –Represent relations –Relational product algorithm  Implementation of ZBDD based points-to analysis –Reduced size for some context insensitive relations –Reduced the size for all context sensitive relations  Relational density metric –Predict ZBDD vs. BDD

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Relational Product  The relational product algorithm for BDDs is an existential quantification of a conjunction. –  x.(fg) = (fg)[0/x] + (fg)[1/x])  Multiplication for ZBDDs is analogous to conjunction in BDDs –Multiplication algorithm existed –Develop algorithm that combines existential quantification with multiplication. Performs early quantification like the BDD version.

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Relational Product  To use ZBDDs in points-to analysis needed to create a Relational Product Operator. –In relational calculus, essentially a natural join followed by project.  Given two functions f(x, …) and g(x,...), does a value of x exist that makes the conjunction of f and g true?  x.(fg) = (fg)[0/x] + (fg)[1/x])

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Relational Product ZBDD ZRelProd(ZBDD p, ZBDD q, Set pd) 1 if p.top < q.top 2 then return ZRelProd(q, p, pd) 3 if q = 0 4 then return 0 5 if q = 1 6 then return Subset0(p, pd) 7 x ← p.top 8 (p0, p1) ← factors of p by x 9 if x ∈ pd 10 then 11 (q0, q1) ← factors of q by x 12 return union(ZRelProd(p1, q1, pd), ZRelProd(p0, q0, pd)) 13 else 14 return node(x, ZRelProd(p1, q, pd), ZRelProd(p0, q, pd))

Using ZBDDs in Points-to Analysis LCPC October 12, 2007 ZBDD Relational Product  The relational product algorithm for BDDs is an existential quantification of a conjunction. –  x.(fg) = (fg)[0/x] + (fg)[1/x])  Multiplication for ZBDDs is analogous to conjunction in BDDs –Multiplication algorithm existed –Develop algorithm that combines existential quantification with multiplication. Performs early quantification like the BDD version.