Java Alias Analysis for Online Environments Manu Sridharan 2004 OSQ Retreat Joint work with Rastislav Bodik, Denis Gopan, Jong-Deok Choi

2 Motivation: Online Environments No suitable alias analysis for “online environments” JIT: compilation and optimization of modern languages ›Currently use type system for coarse alias info ›Whole-program Andersen too slow (~45s) IDE: program understanding, powerful refactorings ›Andersen too inaccurate (need context-sensitivity) ›Up to 20 minutes for full context-sensitive analysis Desired analysis properties similar! ›Interactive response time demand analysis, approximate wisely within time budget ›Additional context-sensitivity when necessary depth 3 for distinguishing ArrayList objects

3 Alias Analysis as CFL-Reachability (Melski, Reps) x := new Obj(); // o 1 y := new Obj(); // o 2 z := new Obj(); // o 3 x.f = y; y.f = z; w = y; v = w.f; x o2o2 o1o1 o3o3 y z new pf[f] w v assign gf[f] pointsTo :- new | contains pointsTo contains :- assign | gf[f] share pf[f] share :- pointsTo pointsTo_bar

4 Java Alias Analysis is Balanced Parens Match getfields with putfields to track flow through heap ›Does not hold for C (address-of operator) Match edges summarize flow through fields, make traversal regular Makes efficient dynamic programming algorithm for Dyck languages applicable x o2o2 o1o1 o3o3 y z new pf[f] w v assign gf[f] pointsTo :- new | contains pointsTo contains :- assign | gf[f] share pf[f] match

5 Match-based algorithms MATCH all : add only valid match edges bottom-up ›Adaptation of Reps et. al. POPL95 algorithm ›Alternative to constraint-based propagation algorithms may be faster with finer-grained abstract locations MATCH k : validate match edges selectively ›Experimentally, most match edges valid ›Focus effort on those likely to be invalid (arrays) MATCH 0 : add matches exhaustively, simple traversal ›Can restrict amount of traversal based on budget / payoff ›Restricted MATCH 0 fast without sacrificing accuracy less than 2 ms / query resolves 90% of virtual calls resolved with field-sensitivity ›Suitable for JIT compiler

6 Refactoring and context-sensitivity class Car { int horsePower; Engine engine; Car(int hp) { horsePower = hp; } int getHP() { return horsePower; } void setEngine(Engine e) { engine = e; } Engine getEngine() { return engine; } } class Engine {} class Car { Engine engine; Car() {} Engine getEngine() { return engine; } void setEngine(Engine e) { engine = e; } } class Engine { int horsePower; Engine(int hp) { horsePower = hp; } int getHP() { return horsePower; } } Precondition: engine is dynamically one-to-one ›statically one-to-one + simple flow-sensitivity Context-sensitive alias analysis necessary ›Distinguish calls to setEngine() ›Track Car objects if placed in container

7 Summaries through CFL paths class ListElem { int val; ListElem next; ListElem(int v, ListElem n) { val = v; next = n; } ListElem add(int v) { ListElem m = this; while (m != null) { if (m.val == v) return this; m = m.next; } return new ListElem(v, this); // o 1 } } this m o1o1 ret assign new assign gf[next] our summary Previous summary approach includes entire graph for add ›based on heap reachability (Whaley/Rinard OOPSLA99) Our approach only retains CFL paths from entry to exit ›In above example, exclude m and its edges

8 Java Alias Analysis is Balanced Parens: So What? Motivation: online environments ›JIT: performance improvement ›IDE: program understanding, powerful refactorings Desired analysis properties ›“Interactive” response time for small number of queries ›Added sensitivity (field, context) when necessary Progress ›Studied CFL reachability formulation Insight: unlike C, Java alias analysis is “balanced parens” ›JIT: simple, fast, and accurate algorithm less than 2 ms / query, 90% of field-sensitive accuracy ›IDE: context-sensitivity through small summaries Idea: retain only CFL paths