Pointer Analysis for Multithreaded Programs Radu Rugina and Martin Rinard M I T Laboratory for Computer Science

Outline Example Review of Pointer Analysis for Sequential Programs Pointer Analysis for Multithreaded Programs Experimental Results Conclusions PLDI 99 R. Rugina, M. Rinard

Example two concurrent threads two questions: Q1 : what location is written by *p=1 ? Q2: what location is written by *p=2 ? OR : Q1: p  ? in left thread Q2: p  ? after both threads completed PLDI 99 R. Rugina, M. Rinard

Two Possible Executions PLDI 99 R. Rugina, M. Rinard

Analysis Result PLDI 99 R. Rugina, M. Rinard Result = a points-to graph at each program point

= Analysis of Multithreaded Programs Problem: –analyze interactions between concurrent threads Straightforward solution: –analyze all possible interleavings and merge results –fails because of exponential complexity –for n threads with s 1,..., s n statements : Number of interleavings = s s n s 1,..., s n s 1 !... s n ! (s s n ) ! ( ) PLDI 99 R. Rugina, M. Rinard

Our Approach We introduce interference information : –interference = points-to edges created by the other concurrent threads –models the effect of “all possible interleavings” Efficiency: polynomial complexity in program size Derive dataflow equations : –recursive equations –fixed-point algorithms to solve the equations –theoretically less precise than “all interleavings” –in practice : no loss of precision PLDI 99 R. Rugina, M. Rinard

Algorithm Overview intra-procedural: –flow-sensitive (dataflow analysis) –handles unstructured flow of control –defines dataflow equations for: pointer assignments parallel constructs inter-procedural : –context-sensitive –handles recursive functions PLDI 99 R. Rugina, M. Rinard

Review of Pointer Analysis for Sequential Programs

Points-to Graphs Points-to graphs [EGH94] –nodes = program variables –edges = points-to relationships Example : PLDI 99 R. Rugina, M. Rinard

Basic Pointer Assignments Four types of pointer assignments: x = &y ( address-of assign ) x = y ( copy assign ) x = *y ( load assign ) *x = y ( store assign ) More complex assignments: –transformed into a sequence of basic statements tmp = &t; *z = tmp; tmp = &t; *z = tmp; *z = &t; PLDI 99 R. Rugina, M. Rinard

Generated Edges y tu z load: x = *y yt w store: *x = y x y z address-of: x = &y yt z copy: x = y x z xx PLDI 99 R. Rugina, M. Rinard

Strong vs. Weak Updates strong updates : –kill existing points-to relationships –result in more precise analysis results weak updates : –leave existing points-to edges in place –reasons for weak updates: control flow uncertainty: arrays of pointers : heap-allocated pointers : if (cond) p = &q; else p = &r; *p = &x; v[i] = &x; p = malloc( sizeof(int*) ) *p = &x; p q r y z x PLDI 99 R. Rugina, M. Rinard

Dataflow Information PLDI 99 R. Rugina, M. Rinard address-of: x = &y gen = { (x, y) } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) copy: x = y gen = { (x, t) | (y, t)  C } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) load: x = *y gen = { (x, u) | (y, t)  C  (t, u)  C } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) store: *x = y gen = { (z, t) | (x, z)  C  (y, t)  C } kill = { (z, w) | (x, z)  C  (z, w)  C } strong = { z | (x, z)  C } = {v}  not (array_elem(v)  heap(v))

–the dataflow information is :  P 3 C = the current points-to relationships I = the interference information from other threads E = edges created by the current thread –as a set of edges, P 3 is a lattice: partial order relation = set inclusion merge operator = set union  = Dataflow Analysis PLDI 99 R. Rugina, M. Rinard

P = set of points-to graphs, Stat = set of program statements abstract semantics is defined by a functional : : Stat  (P 3  P 3 ) Abstract Interpretation PLDI 99 R. Rugina, M. Rinard

Parallel par Statements syntax : par { {t 1 },..., {t n } } –concurrent execution –interleaving semantics –may be nested interference : –is the union of points-to edges created by all other concurrent threads –may be different for different concurrent threads PLDI 99 R. Rugina, M. Rinard

Interference information : –I = “global” interference - generated by enclosing par ’s –L i =“local” interference - generated by current par –E = points-to edges created by the current thread Analysis result for thread t i : Analysis of Individual Threads = t i I i = I  L i C i = C  L i = t i I i = I  L i C i = C  L i PLDI 99 R. Rugina, M. Rinard

Analysis result : Parend Analysis = par = t i I’ = I E’ = E  (  E i ) C’ =  C i ’ = par = t i I’ = I E’ = E  (  E i ) C’ =  C i ’ PLDI 99 R. Rugina, M. Rinard

Recursive dataflow equations : Analysis of Entire par Construct C i = C  L i I i = I  L i = t i (thread rule) E’ = E  (  E i ) C’ =  C i ’ = par ( par rule ) C i = C  L i I i = I  L i = t i (thread rule) E’ = E  (  E i ) C’ =  C i ’ = par ( par rule ) information flowing INTO par construct information flowing OUT of par construct PLDI 99 R. Rugina, M. Rinard

Example Analysis PLDI 99 R. Rugina, M. Rinard

Inter-Procedural Analysis Context-sensitive : –procedures re-analyzed at each call site Ghost variables: –replace variables not in the scope of the procedure –distinguish locals in different activations of recursive functions Sequential Partial Transfer Functions (Seq-PTFs) [WL95] –associate a points-to output graph to an input context –can be reused when there is a match for the input context PLDI 99 R. Rugina, M. Rinard

Multithreaded Extensions Multithreaded Input Context = input points-to information + interference information Multithreaded PTF = = associates output points-to graph + created edges to an input context Mapping and unmapping : –map the interference information I –unmap created points-to edges E PLDI 99 R. Rugina, M. Rinard

Other Parallel Constructs Parallel for loops –generate a symmetric dataflow equation: t 1 = t 1 = C’ =  ( C i ’ U C i ) for(i=0; i<n; i++) spawn thread(i); sync; for(i=0; i<n; i++) spawn thread(i); sync; if (c1) spawn thread1(); if (c2) spawn thread2(); sync; if (c1) spawn thread1(); if (c2) spawn thread2(); sync; Conditional Thread Creation –merge analysis result with initial points- to graph PLDI 99 R. Rugina, M. Rinard

Advanced Features Recursive procedures: –result in recursive dataflow equations –fixed-point algorithm to solve recursion Function pointers: –result in a dynamic call-graph –handled using the computed pointer information –methodology: analyze all possible callees and merge results Thread-private global variables: – at parbegin nodes: save their values in the parent thread and make them point to unknown in the child threads –at parend nodes: restore saved values in the parent thread PLDI 99 R. Rugina, M. Rinard

Algorithm Evaluation Soundness : –the multithreaded algorithm conservatively approximates all possible interleavings of concurrent threads’ statements Termination of fixed-point algorithms: –follows from the monotonicity of the abstract semantics functional Complexity of fixed-point algorithms: –worst-case size of points-to graphs: O(n 2 ), where n = | Stat | –n program points imply worst-case O(n 3 ) iterations –worst-case polynomial complexity: O(n 4 ) Precision of analysis: – if the concurrent threads do not (pointer-)interfere then this algorithm gives the same result as the “ideal algorithm ” PLDI 99 R. Rugina, M. Rinard

Experimental Results Implementation : –SUIF infrastructure; Cilk benchmarks Benchmark characteristics : PLDI 99 R. Rugina, M. Rinard

Precision Measurements Pointer values at load/store : –usually unique target: 83 % of the loads 88 % of the stores –few potentially uninitialized pointers –very few pointers with more than two targets Comparison : –Multithreaded, Interleaved, Sequential: MT Interleaved Seq –results: Multithreaded = Sequential –conclusion: Multithreaded = Interleaved   PLDI 99 R. Rugina, M. Rinard

Applications Current Uses: –MIT RAW project memory disambiguation for static promotion (ISCA 99) C-to-silicon compiler generating small memories (FCCM 99) –automatic parallelization of divide-and- conquer algorithms (PPoPP 99) Future Uses: –data race detection in multithreaded programs –static elimination of array bounds checks PLDI 99 R. Rugina, M. Rinard

Future Multithreaded programs: –are becoming very common –are hard to debug –are hard to analyze The current algorithm: –gives precise MT pointer information –may be used as a foundation for other MT analyses –gives a framework for other MT analyses PLDI 99 R. Rugina, M. Rinard

Additional Slides

Applications Heavily Optimized By Hand –Pousse - timed competition, won ICFP ‘98 contest Pointer Arithmetic Casts Divide and Conquer Algorithms –Recursion –Pointers Into Heap-Allocated Arrays –Pointer-Based Data Structures (octrees, hash tables,...) –Recursive Linked Data Structures Allocated On Stack Challenging Benchmark Set PLDI 99 R. Rugina, M. Rinard

Related Work Pointer analysis –existing pointer analyses are focused to sequential programs [LR92], [LRZ93], [CBC93], [EGH94], [Ruf95], [WL95], [And94], [Ste96], [SH97] –flow-sensitive vs. flow-insensitive analysis –context-sensitive vs. context-insensitive analysis Multithreaded program analysis: –relatively unexplored field –flow-sensitive analysis : dataflow framework for bitvector problems [KSV96] does not apply to pointer analysis –flow-insensitive analysis: trivially model the interleaving semantics of concurrent threads locality analysis [ZH97] ( uses type-inference techniques) PLDI 99 R. Rugina, M. Rinard