Towards eliminating runtime array bound checks in the Java Virtual Machine Hongwei Songtao

Friday, June 19, Outline Runtime array bounds checking in JVMRuntime array bounds checking in JVM –required by security policy of JVM –incurs performance overhead Problems with current approaches based on flow analysisProblems with current approaches based on flow analysis Our solutionOur solution –a type system for a JVML-like language Current work and conclusionCurrent work and conclusion

Friday, June 19, Security Concern with JVM

Friday, June 19, Array Bound Checks in JVM The security policy of JVMThe security policy of JVM –prevents out-of-bounds array access JVM implementationsJVM implementations –verifiers are unable to guarantee safety statically –interpreters have to check array bounds Runtime checks incur overheadRuntime checks incur overhead

Friday, June 19, Array Bound Checks in JVM (cont.) Overhead incurred by runtime checksOverhead incurred by runtime checks –overshadowed by the overhead of interpretation –significant in such applications as 3-D graphics When seeking high performance, this overhead cannot be neglectedWhen seeking high performance, this overhead cannot be neglected

Friday, June 19, Flow Analysis On Mobile Code is used to draw conclusionis used to draw conclusion –that index variable will not exceed the bounds of array can be applied, but where?can be applied, but where? –at the receiver side? Time is wasted –at the code source? why should I trust your result?

Friday, June 19, Our Approach Program invariantsProgram invariants –acquired at code source –translated into dependent type annotations Dependent type annotationsDependent type annotations –packed into.class file –transferred to the receiver

Friday, June 19, Our Approach (cont.) A JVM that supports our approachA JVM that supports our approach –type checks bytecode program –with the help of the type annotation A well-typed programA well-typed program –is guaranteed never to make out-of-bounds array accesses

Friday, June 19, Illustration of Our Method.class file +annotations

Friday, June 19, Type System is built on the given propertiesis built on the given properties –given properties are at basic block entries –properties are expressed in dependent type terms will generate constraints ( predicates) over integer domainwill generate constraints ( predicates) over integer domain –integer programming algorithm is adopted

Friday, June 19, Basic Blocks Given properties instruction Basic block 1 Basic block 2 instruction

Friday, June 19, Inside Basic Blocks iaload Properties Given properties iload 2 aload 1

Friday, June 19, Inside Basic Blocks iaload Properties …… Safe/unsafe iload 2 aload 1

Friday, June 19, Leaving Basic Blocks instruction Basic block 1 Given Properties Preserved/not jeq loop instruction

Friday, June 19, Type Checking

Friday, June 19, Type Checking

Friday, June 19, Type Checking

Friday, June 19, Constraints “Implies” relation“Implies” relation –is reduced to predicates over integer domain:Constraints Satisfaction of constraintsSatisfaction of constraints –equivalent to integer programming problem Integer programming algorithmsInteger programming algorithms –Simplex, Branch and Bound, etc. –evidence to suggest efficiency

Friday, June 19, Conclusion. Our method... Can deal with hard problems such as binary searchCan deal with hard problems such as binary search Gives high confidence at the receiver sideGives high confidence at the receiver side Is compatible with byte-code formatIs compatible with byte-code format Is expected to be relatively lightweightIs expected to be relatively lightweight