1. Hastings Purify: Fast Detection of Memory Leaks and Access Errors

2. Overview Introduction Introduction Memory Access Errors and Detection Memory Access Errors and Detection Object Code Insertion Object Code Insertion Memory Leaks and Detection Memory Leaks and Detection Previous Work Previous Work Malloc Debug Malloc Debug Mprof Mprof Measurements Measurements Link/ Purify and Link Link/ Purify and Link Conclusion Conclusion

3. Introduction A single memory access error can crash a program A single memory access error can crash a program Almost impossible to find all errors Almost impossible to find all errors Errors not always found in testing Errors not always found in testing When a problem is scene very hard to track down When a problem is scene very hard to track down

4. Introduction Memory leak is when memory is no longer used by a program but is not freed Memory leak is when memory is no longer used by a program but is not freed Can cause a system to run out of paged memory Can cause a system to run out of paged memory Very hard to fix when found Very hard to fix when found Purify is a tool that can help find and fix these types of errors Purify is a tool that can help find and fix these types of errors

5. Memory Access Errors Some errors can be found statically, some at run-time, and others by the programmer Some errors can be found statically, some at run-time, and others by the programmer Purify finds these errors at run-time Purify finds these errors at run-time Purify finds the errors where they occur Purify finds the errors where they occur Still need to have testing but makes testing more effective Still need to have testing but makes testing more effective

6. Detecting Memory Access Errors Purify tracks every memory access Purify tracks every memory access When an error occurs a message is printed When an error occurs a message is printed Purify puts a function call before each load and store Purify puts a function call before each load and store Function calls maintain a bit table that keeps track each memory byte Function calls maintain a bit table that keeps track each memory byte Has 3 possible states Has 3 possible states Uses 2 bits to represent this Uses 2 bits to represent this

7. Detecting Memory Access Errors Unallocated (unwriteable and unreadable) Allocated and unititialized (writeable, but unreadable) Allocated and initialized (readable and writeable) allocated deallocate initialize deallocate

8. Detecting Memory Access Errors An error is generated when memory is not in the correct state An error is generated when memory is not in the correct state Uses a “red-zone” on arrays Uses a “red-zone” on arrays Memory has to “age” before reused Memory has to “age” before reused Byte-level state codes find more errors than using less Byte-level state codes find more errors than using less Another option is to store the state information directly Another option is to store the state information directly

9. Object Code Insertion Purify uses object code insertion for checking logic Purify uses object code insertion for checking logic Insertions can be done before or after linking Insertions can be done before or after linking Purify reads object files and then adds error checking instructions Purify reads object files and then adds error checking instructions

10. Object Code Insertion Compiling Purifying Linking cc C++ Purifyld Ul.c Class.c Ul.c Class.o Lib c.a Ul.c Class.o Libc.a a.out

11. Object Code Insertion Advantages of object code insertion Advantages of object code insertion Setup performance Setup performance Convenience Convenience Multi-language support Multi-language support Completeness Completeness Disadvantage Disadvantage It is instruction-set dependent and somewhat operating system dependent It is instruction-set dependent and somewhat operating system dependent

12. Memory Leaks Harder to detect than memory access errors Harder to detect than memory access errors One symptom is that the address of a process goes up One symptom is that the address of a process goes up Problems with this Problems with this Does not rule out if enough heap memory is allocated Does not rule out if enough heap memory is allocated Very time consuming Very time consuming

13. Memory Leaks Two ways to find memory leaks without Prufiy Two ways to find memory leaks without Prufiy Shrink the test code bit by bit until the address space stays constant Shrink the test code bit by bit until the address space stays constant Modify Malloc and free to record arguments Modify Malloc and free to record arguments Since it is so hard to find memory leaks sometimes they are tolerated Since it is so hard to find memory leaks sometimes they are tolerated

14. Detecting Memory Leaks A memory leak is when allocated memory is no longer used A memory leak is when allocated memory is no longer used One way of detecting memory leaks is with a garbage collector One way of detecting memory leaks is with a garbage collector Garbage detector Garbage detector Garbage reclaimer Garbage reclaimer Purify uses a callable garbage collector Purify uses a callable garbage collector The algorithm used is close to the conventional mark and sweep The algorithm used is close to the conventional mark and sweep

15. Detecting Memory Leaks Purify uses the garbage collect at development Purify uses the garbage collect at development It seperates heap chunks into 3 groups It seperates heap chunks into 3 groups Almost certainly garbage Almost certainly garbage Potentially garbage Potentially garbage Probably not garbage Probably not garbage

16. Previous Work In C code there is a problem managing the memory In C code there is a problem managing the memory Has been several attempts to solve this problem Has been several attempts to solve this problem According to the paper there have been no solutions that addressed memory leaks and memory access errors According to the paper there have been no solutions that addressed memory leaks and memory access errors

17. Malloc Debug Is the most used tool for finding memory access errors Is the most used tool for finding memory access errors Have several levels for error checking and memory marking Have several levels for error checking and memory marking Useful for finding errors because of writing past the end of an array or heap Useful for finding errors because of writing past the end of an array or heap Only find the error after the fact Only find the error after the fact Doesn’t provide any memory leak information Doesn’t provide any memory leak information

18. Mprof Gives programmers information on C program’s dynamic memory usage Gives programmers information on C program’s dynamic memory usage Does not provide memory access checking Does not provide memory access checking Only gives memory usage on global program not sections Only gives memory usage on global program not sections Gives a “memory leak table” it shows memory used but not freed Gives a “memory leak table” it shows memory used but not freed

19. Measurements The overhead added because of Purify is dependant on the density of memory access The overhead added because of Purify is dependant on the density of memory access Here is a comparison of a program that does nothing but copy memory has an Here is a comparison of a program that does nothing but copy memory has an overhead factor of 5.5 over the optimized C code. overhead factor of 5.5 over the optimized C code. 3.2 factor slowdown when compiled for debugging 3.2 factor slowdown when compiled for debugging Factor of 300 slowdown when compared to a C interpreter Factor of 300 slowdown when compared to a C interpreter

20. Link/Purify and Link Requires extra run-time overhead for checking memory before each functions Requires extra run-time overhead for checking memory before each functions A.out size is increased because of function calls before every store and load A.out size is increased because of function calls before every store and load Extra heap size is increased because of red-zones around every heap. Extra heap size is increased because of red-zones around every heap. Increase in overhead because of the Purify process and extra demands on the linker Increase in overhead because of the Purify process and extra demands on the linker

21. Conclusion Purify provides memory access checking and memory leak detection Purify provides memory access checking and memory leak detection Purify is fast so can be used during entire development process Purify is fast so can be used during entire development process Purify should be used in conjunction with test suites Purify should be used in conjunction with test suites Purify is the safety net that C and C++ need Purify is the safety net that C and C++ need Questions ?