1. Towards eliminating runtime array bound checks in the Java Virtual Machine Hongwei Xi@ececs.uc.edu Songtao Xia@cse.ogi.edu

2. Friday, June 19, 2015 2 Outline Runtime array bounds checking in JVMRuntime array bounds checking in JVM –required by security policy of JVM –incurs performance overhead Problems with current approaches based on flow analysisProblems with current approaches based on flow analysis Our solutionOur solution –a type system for a JVML-like language Current work and conclusionCurrent work and conclusion

3. Friday, June 19, 2015 3 Security Concern with JVM

4. Friday, June 19, 2015 4 Array Bound Checks in JVM The security policy of JVMThe security policy of JVM –prevents out-of-bounds array access JVM implementationsJVM implementations –verifiers are unable to guarantee safety statically –interpreters have to check array bounds Runtime checks incur overheadRuntime checks incur overhead

5. Friday, June 19, 2015 5 Array Bound Checks in JVM (cont.) Overhead incurred by runtime checksOverhead incurred by runtime checks –overshadowed by the overhead of interpretation –significant in such applications as 3-D graphics When seeking high performance, this overhead cannot be neglectedWhen seeking high performance, this overhead cannot be neglected

6. Friday, June 19, 2015 6 Flow Analysis On Mobile Code is used to draw conclusionis used to draw conclusion –that index variable will not exceed the bounds of array can be applied, but where?can be applied, but where? –at the receiver side? Time is wasted –at the code source? why should I trust your result?

7. Friday, June 19, 2015 7 Our Approach Program invariantsProgram invariants –acquired at code source –translated into dependent type annotations Dependent type annotationsDependent type annotations –packed into.class file –transferred to the receiver

8. Friday, June 19, 2015 8 Our Approach (cont.) A JVM that supports our approachA JVM that supports our approach –type checks bytecode program –with the help of the type annotation A well-typed programA well-typed program –is guaranteed never to make out-of-bounds array accesses

9. Friday, June 19, 2015 9 Illustration of Our Method.class file +annotations

10. Friday, June 19, 2015 10 Type System is built on the given propertiesis built on the given properties –given properties are at basic block entries –properties are expressed in dependent type terms will generate constraints ( predicates) over integer domainwill generate constraints ( predicates) over integer domain –integer programming algorithm is adopted

11. Friday, June 19, 2015 11 Basic Blocks Given properties instruction Basic block 1 Basic block 2 instruction

12. Friday, June 19, 2015 12 Inside Basic Blocks iaload Properties...... Given properties iload 2 aload 1

13. Friday, June 19, 2015 13 Inside Basic Blocks iaload Properties …… Safe/unsafe iload 2 aload 1

14. Friday, June 19, 2015 14 Leaving Basic Blocks instruction Basic block 1 Given Properties Preserved/not jeq loop instruction

15. Friday, June 19, 2015 15 Type Checking

16. Friday, June 19, 2015 16 Type Checking

17. Friday, June 19, 2015 17 Type Checking

18. Friday, June 19, 2015 18 Constraints “Implies” relation“Implies” relation –is reduced to predicates over integer domain:Constraints Satisfaction of constraintsSatisfaction of constraints –equivalent to integer programming problem Integer programming algorithmsInteger programming algorithms –Simplex, Branch and Bound, etc. –evidence to suggest efficiency

19. Friday, June 19, 2015 19 Conclusion. Our method... Can deal with hard problems such as binary searchCan deal with hard problems such as binary search Gives high confidence at the receiver sideGives high confidence at the receiver side Is compatible with byte-code formatIs compatible with byte-code format Is expected to be relatively lightweightIs expected to be relatively lightweight