1. Demand-driven Alias Analysis Implementation Based on Open64 Xiaomi An annyur@gmail.com

2. Outline Demand-driven alias analysis CFL-Reachability based demand-driven alias analysis (DDA) One-level flow demand-driven alias analysis (Olf DDA)

3. Why Demand driven? Potential of faster analysis speed Less memory requirement Flexible framework to rebuild the lost info Potentially support more aggressive analysis

4. Previous work on demand driven alias analysis Heintze and Tardieu, Demand-Driven Pointer Analysis, PLDI 2001 Sridharan and Bodik, Refinement-based context- sensitive points-to analysis for Java, PLDI 2006 Xin Zheng and Radu Rugina, Demand-Driven Alias Analysis for C, POPL 2008  Work for C  Answer alias queries without constructing points-to sets

5. Graph representation of program (PEG)  Pointer dereference edges ( D )  Assignment edges ( A )  Corresponding edges in the opposite direction ( ) Memory alias and value alias:  two l-value expressions are memory aliases, if they might denote the same memory location.  two expressions are value aliases, if they might evaluate to the same value. Alias analysis via CFL-Reachability (1) —Program Representation

6. Alias analysis via CFL-Reachability (2) — Hierarchical State Machine: Machine M: Machine V: Correspond to Andersen’s inclusion algorithm.

7. Alias analysis via CFL-Reachability (3) — Example Program: s = &t; r = &z; y = &r; s = r; x = *y; … = *x; *s = …; Program expression graphAnalysis for query MayAlias(*x, *s)

8. Precision Evaluation (1) — Features of the demand-driven alias analysis (DDA) Set-inclusion based Field-sensitive Flow-insensitive Separate value flows for globals May-alias

9. case (1)case (2)case (3) int foo () { int **p, **q; int *s1, *s2, *s3; p = &s1; p = &s2; q = &s3; q = p; *p = (int*) malloc(100); *q = (int*) malloc(100); return *s1 + *s2 + *s3; } int a[100] ， b[100]; void foo() { int i; int *p, *q; p = &a[0]; q = &b[10]; for (i=0;i<100;i++) { *p = *q; p++; q++; } typedef struct { unsigned int bits_left; unsigned int buffer_size; } bitfile; typedef struct { char is_leaf; char data[4]; } hcb_bin_quad; hcb_bin_quad hcb[10]; void foo (bitfile *ld, int cb, int n, int b){ for (int i=0; i<n; i++) { ld->bits_left += hcb[i].data[b]; } Precision Evaluation (2) — Typical test cases

10. Test caseMemory operationDDAACAC + FFA + FSA DDA+ FFA + FSA Case (1)1.s1 2.s2 3.s3 4.*p 5.*q 6.*s3 7.*s1 8.*s2 4~{1,2} 5~{1,2,3,4} 7~{6} 8~{6,7} 4~{1,2,3} 5~{1,2,3,4} 7~{6} 8~{6,7} 4~{2} 5~{2} 7~{6} 8~{6,7} 4~{2} 5~{2} 7~{6} 8~{6,7} Case (2)1.global_obj 2.*p 3.*q 2~{1} 3~{1} 2~{1} 3~{1,2} 2~{1, } 3~{1,2} 2~{1} 3~{1} Case (3)1.global_obj 2.ld->bits_left 3.hcb[i].data[b] 2~{1} 3~{1} 2~{1} 3~{1,2} 2~{1} 3~{1,2} 2~{1} 3~{1} Precision Evaluation (3) — Alias analysis results

11. Precision Evaluation (4) — Analysis and Conclusions Result Analysis  For case (1) DDA is better than AC due to set-inclusion DDA is worse than FSA due to flow-insensitive and MAY-alias info  For case (2) DDA is better than AC due to separate value flows for globals DDA is better than FSA due to complete value flow tracking  For case (3) DDA is better than AC due to field sensitivity, DDA is better than FFA due to its keeping track of high level type info Conclusions  Proper combination of good features leads to good precision.  DDA can replace AC without loss of precision.

12. Scalability Evaluation (1) — PEG features and alias queries classification Test case Summary of PEGsQuery count By cache By analysis count node countA-edge countQuick analysis DDA analysis totalMaxtotalmax Swim3911195682082308175%18%7% Mgrid71213210192476241061%36%3% Equake189928017613629866845%52%3% Art17499516431221757327%65%8% Open64, as an optimizing compiler, has large number of alias queries. Quick disambiguation and caching are necessary. Good alias analysis precision is necessary.

13. Scalabitlity Evaluation (2) — Results and Conclusion CFL-Reachability based alias analysis implementation doesn’t have good scalability.

14. To avoid redundant graph traverse To simplify the program expression graph To get some of the scalability from union-based algorithm while keeping most of the precision from inclusion-based algorithm One-level flow demand driven analysis(1) — Motivation

15. One-level flow demand-driven analysis (2) — One-level flow hierarchical state machine Machine M: Machine V: Correspond to Das’s algorithm which lie between Andersen and Steengaard.

16. One-level inclusion-based, upper-level unification-based Value flow factorization Online incremental PEG simplification One-level flow demand-driven analysis (3) — New features

17. One-level flow demand-driven analysis (4) — Example int foo () { int **p, **q; int *s1, *s2, *s3; p = &s1; p = &s2; q = &s3; q = p; *p = (int*) malloc(100); *q = (int*) malloc(100); return *s1 + *s2 + *s3; }

18. Scalability Evaluation (1) — Percentage of analysis finished

19. Scalability Evaluation (2) — Percentage of “ not aliased ” results

20. Conclusion and Future work Conclusion  Demand driven alias analysis can be used in product compiler and give precise alias results.  One-level flow DDA can improve the scalability and give much more precise results for a reasonable compile time. Future work  To extend demand driven analysis to inter-procedural analysis.  To exploit more methods to further improve scalability.

21. Thank You!