Purity Analysis : Abstract Interpretation Formulation Ravichandhran Madhavan, G. Ramalingam, Kapil Vaswani Microsoft Research, India

Purity Analysis [Salcianu & Rinard VMCAI ‘05, Whaley & Rinard OOPSLA ‘99] A (side) effect analysis for the heap A foundational analysis with several applications Pointer analysis Escape analysis Checking correctness of speculative parallelism [Prabhu et al., PLDI’10] Lightweight bug finding tools Heavyweight software model checking and verification tools (like SLAM)

Our Contributions An Abstract Interpretation formalization A simpler explanation of the analysis A simpler and more standard correctness proof Helps extend and modify algorithm … for Scalability Precision Functionality and verify correctness of extensions/modifications A step towards formalizing similar modular heap analyses like Lattner et al. [PLDI ‘07], Buss et al. [SAC ’08] 3 new optimizations with empirical evaluations

Modular Heap Effect Analysis

Problem and Challenges Heap Effect Analysis: Determine effect of a procedure call on heap (global program state) Modularity: Compute a context-independent summary for each procedure Challenge: Procedure behavior and effect depend on aliasing in input heap Very few modular analyses can handle aliasing in input heap. WSR analysis is one of them.

Challenging Example 1.P(x,y) { 2. t = new () 3. x.next = t 4. t.next = y 5. retval = y.next 6.} o1o1 o2o2 o3o3 xy next n2n2 o1o1 o2o2 o3o3 xytretval next u1u1 u2u2 xy n2n2 u1u1 u2u2 xy t retval next

Two possible Approaches 1.Compute different summaries for different aliasing configurations. Pros: Better precision Cons: Possible explosion in the number of summaries 2.Compute a single summary – approach taken by WSR.

Two approaches - Example o1o1 o2o2 o3o3 xy next n2n2 o1o1 o2o2 o3o3 xytretval next u1u1 u2u2 xy n2n2 p1p1 p2p2 n5n5 xy t retval next WSR summary n2n2 u1u1 u2u2 xy t retval next

Computing WSR Summaries

Overview 1.P(x,y) { 2. t = new () 3. x.next = t 4. t.next = y 5. retval = y.next 6.} n2n2 p1p1 p2p2 n5n5 xy t retval next (Transformer Graph) Place holders (External node) Read edge (External edge) Write edge (Internal edge) Local allocs (Internal node)

Formalizing WSR analysis Like shape analyses, WSR analysis computes a graph at every program point. But the graphs are abstractions of state transformers rather than states.

Abstract Interpretation Formulation

Concrete Domain

Concrete Semantics P() { … u: … } Parametric collecting semantics In the style of Sharir and Pnueli’s functional approach.

Abstract Domains

Concretization Modified portion Transformer graph Concrete stateConcrete state(s) Transformed portion Mapping Phase (Identifies modified portion) Transformation Phase

Mapping Phase Illustration n2n2 p1p1 p2p2 n5n5 xy tretval next u1u1 u2u2 xy Concrete state Transformer graph

Transformation Phase Illustration n2n2 p1p1 p2p2 n5n5 xy tretval next u1u1 u2u2 xy

Transformation Phase Illustration n2n2 p1p1 p2p2 n5n5 xy tretval next u1u1 u2u2 xy n2n2 retval

Transformation Phase Illustration Abstract shape graph representing a set of concrete states u1u1 u2u2 xy next n2n2 retval

Abstract Vs Concrete Summary u1u1 u2u2 xy next u1u1 u2u2 xy Concrete summary u1u1 u2u2 xy next n2n2 retval n2n2 u1u1 u2u2 xy t next

Correctness and Termination

Partial order and join

Abstract Semantics Computes a transformer graph at every program point. Uses a set of equations having the same structure as the concrete semantics. Uses the abstract transformers for statements and procedure calls. Handles procedure calls using the summary of the called function.

Correctness and Termination

Optimizations

Need for optimizations BenchmarkLines of Code WSR analysis Time(s)Memory (MB) Dynamic data display25K SharpMap26KTime out- PDFsharp96K Dotspatial (12 DLLS) 200KTime out-

Node Merging Optimization 1.P(x) { 2. If(*) 3. t = new …; 4. t = new …; 5. x.f = t; 6. t.g = new …; 7.} Same concrete image n3n3 p1p1 n6n6 x t f g n3n3 p1p1 n6n6 x t f n4n4 f g g

Correctness of node merging

Termination with node merging Node merging doesn’t preserve containment ordering. Termination is guaranteed only if merged nodes do not reappear in subsequent steps.

Termination with node merging [Cont.] Solution : Track (transformer graph, equivalence relation) pairs. The equivalence relation records nodes merged in the previous steps. Whenever a new node is created replace it with the representative of its equivalence class.

Identifying nodes to merge Arbitrarily merging nodes will reduce precision. Our Heuristics: n2n2 n1n1 n3n3 f f n2n2 n1n1 f n2n2 n1n1 n3n3 f f n2n2 n1n1 f Results in no loss of precision in our benchmarks when used in a purity analysis

Evaluation of Node merging BenchmarkLines of Code With Node merging Time (s)Memory (MB) Dynamic data display25K58427 SharpMap26K PDFsharp96K Dotspatial (12 DLLS) 200K963568

Optimization 2 : Summary merging Applies to virtual method calls. … With optimization

Optimization 3: Safe node elimination Removes unnecessary external nodes. Eg: Set::Contains is pure but its WSR summary has many external edges/nodes. Does not affect precision.

Empirical evaluation BenchmarkLines of Code WSR analysisWith all opts Time(s)Memory (MB) Time (s)Memory (MB) Dynamic data display 25K SharpMap26K PDFsharp96K Dotspatial (12 DLLS) 200K

Conclusion WSR analysis is a widely used modular heap analysis. Formalized WSR analysis as an Abstract Interpretation. Mentioned as an open problem by Salcianu. Proposed 3 Optimizations to WSR analysis. Proved them correct using the AI formulation. They make the analysis to scale to large programs.