ABCD: Eliminating Array-Bounds Checks on Demand Rastislav Bodík Rajiv Gupta Vivek Sarkar U of Wisconsin U of Arizona IBM TJ Watson recent experiments by Denis Gopan, U of Wisconsin

2 Motivation: type safety Pro: type-safe programs don’t “crash” Con: some violations checked at run time Direct cost: executing the checks checks are frequent, expensive Indirect cost: preventing optimization checks block code motion of side-effect instructions Our goal: safety without performance penalty How? remove redundant checks

3 Talk outline Why remove bounds checks? safety without performance penalty The need for dynamic optimization existing optimizers not suitable an ideal dynamic optimizer ABCD Experiments Summary

4 When to optimize the checks?

5

6 Existing check optimizers Emphasis: precision all checks removed = statically type-safe theorem prover: [Necula, Lee], [Xu, Miller, Reps] range propagation: [Harrison, Patterson] types: [Xi, Phenning] Properties too heavy-weight limited notion of control flow: how to add profile feedback?

7 An ideal dynamic optimizer? A balance between power and economy powerful just enough  only common cases minimize analysis work  efficient IR reduce analysis overhead  reuse the IR Scalable optimize only hot checks  profile-directed  demand-driven not fully inter-procedural  use “local” info + insert (cold) checks

8 Why optimize on demand?  optimize only the few hot checks number of static checks % of dynamic checks

9 Talk outline Motivation An ideal dynamic optimizer ABCD “tutorial” 1. Simple... standard SSA 2. Full... extended SSA 3. PRE... profile-directed 4. Poor... when do we fail? ( future work) Experiments Summary

10 Keep in mind array access A[i] requires two checks: lower-bounds check: 0  i è upper-bounds check: i < A.length these two checks are analyzed separately

11 1. Simple ABCD i  A.length while ( ) --i..A[i].. Simple ABCD = SSA + shortest path

12 1. Simple ABCD 1.build SSA connect SSA definitions with edges 2.label edges with constraints weight(x  y) = c  y  x – c 3.analyze A[i k ]: input: a bounds check i k < A.length algorithm: find shortest path p from A.length to i k output: check is redundant if |p| > 0

13 Simple ABCD A.length i2i2 i0i0 i 1 :=ø(i 0,i 2 ) i 0  A.length – 0 i 2  i 1 – 1 i 1  i 0 – 0 i 1  ø(i 0,i 2 ) i 2  i 1 –1.. A[i 2 ].. i 0  A.length |A.length  i 2 | = 1  i 2  A.length – 1

14 2. Full ABCD for (i=0; i < A.length; i++)..A[i].. Real ABCD = SSA ++ + “shortest” path

15 2. Full ABCD 1.build extended SSA 2.label edges with constraints 3.analyze A[i k ]: input: a bounds check i k < A.length algorithm: find optimal hyper-path p from A.length to i k output: check is redundant if |p| > 0

16 Full ABCD for (i=0; i < A.length; i++).. A[i 2 ].. A.length i2i2 i0i0 i 1 :=ø(i 0,i 2 ) 0 0 –1 0 shortest path length = –  SSA misses constraints from conditionals 0 – 

17 Extending the SSA form 0 i2i2 i0i0 i 1  ø(i 0,i 3 ) 0 0 –1 0 0 i3i3 i 1  ø(i 0,i 3 ).. A[i 2 ].. i 3  i 2 +1 i 0  0 exit T F i 1  A.length–1 A.length 1 i 4  (i 1 ) i 2  (i 1 )

18 3. ABCD with PRE f(int A[], int n) { for (i=0; i < n; i++)..A[i].. } if (n <= A.length) unoptimized loop false ABCD with PRE = Full ABCD + profile feedback

19 3. ABCD with PRE 1.build extended SSA 2.label edges with constraints 3.analyze A[i k ]: algorithm: i) find paths with “bad” length ii) fix their length by inserting run-time checks Issues: What check to insert? Where to insert the check? When is insertion profitable?

20 ABCD with PRE 0 i2i2 i0i0 i 1  ø(i 0,i 3 ) 0 0 –1 0 0 i3i3 1 nA.length f(int A[], int n) { for (i=0; i<n; i++).. A[i].. } 0 if (n <= A.length – 0) DONE! constraint edges can be added by inserting run-time checks

21 4. Poor ABCD f(int A[], int n, i, j) { for ( ; i < n; i++, j++).. A[j].. } if ( n <= A.length–(j-i)) unoptimized loop When does ABCD fail?

22 Poor ABCD i2i2 i0i0 i1i1 0 –1 0 0 i3i3 1 n A.length j2j2 j0j0 j1j1 0 –1 0 0 j3j3 0 for (i=j=0 ; i<n; i++,j++) {.. A[j].. } c = j 2 -i 2 if (n <= A.length-( j 2 -i 2 )) c = j 0 -i 0 if (n <= A.length-( j 0 -i 0 ))

23 How powerful is ABCD? % of all checks removed (dynamic count) SPECjvm Symantec Misc. Java

24 Lower-bounds checks “JIT” ABCD ABCDE examined AVG % of all checks removed (dynamic count)

25 Upper-bounds checks “JIT” ABCD ABCDE examined AVG % of all checks removed (dynamic count)

26 Performance Speedup about 5% not many optimizations implemented Analysis time 4 ms / check = visit about 10 SSA nodes 20 static checks to get 80% coverage  80ms to analyze a (large) benchmark !

27 Summary of ABCD local constraints constraint format useful statements global constraint system extended SSA inequality graph solving the constraint system traversing the graph partially redundant checks

28 Summary optimize only hot statements demand-driven reduce analysis work sparse IR profile-driven powerful just enough tuned simplicity minimize IR overhead via IR reuse use SSA not interprocedural PRE