Download presentation
Presentation is loading. Please wait.
1
Laboratory for Computer Science Massachusetts Institute of Technology Ownership Types for Safe Region-Based Memory Management in Real-Time Java Chandrasekhar Boyapati Alexandru Salcianu William Beebee Martin Rinard
2
Ownership types Ownership types Clarke et al. ( OOPSLA ’98 ) ( OOPSLA ’02 ) Boyapati et al. ( OOPSLA ’01 ) ( OOPSLA ’02 ) Boyapati et al. ( POPL ’03 ) ( OOPSLA ’03 ) Aldrich et al. ( OOPSLA ’02 ) Region types Region types Tofte, Talpin ( POPL ’94 ) Christiansen et al. ( DIKU ’98 ) Crary et al. ( POPL ’99 ) Grossman et al. ( PLDI ’02 ) Unified type system for OO languages Unified type system for OO languages Object encapsulation AND Memory safety Foundation for enforcing other safety properties Data race and deadlock freedom Safe software upgrades Safe real-time programming (Real-Time Java) Contribution (Object encapsulation) (Memory safety)
3
Talk Overview Type system for OO programs Type system for OO programs Ownership types Region types Similarities Unified type system Extensions for Real-Time Java Extensions for Real-Time Java Experience Experience
4
Ownership Types
5
data next head data next data next … … … Stack Node Data data next … Say Stack s is implemented with linked list Say Stack s is implemented with linked list
6
Ownership Types s Say Stack s is implemented with linked list Say Stack s is implemented with linked list
7
Ownership Types s o ~ ~ Say Stack s is implemented with linked list Say Stack s is implemented with linked list Outside objects must not access list nodes Outside objects must not access list nodes
8
Ownership Types Program can declare s owns list nodes Program can declare s owns list nodes System ensures list is encapsulated in s System ensures list is encapsulated in s s o ~ ~ Say Stack s is implemented with linked list Say Stack s is implemented with linked list Outside objects must not access list nodes Outside objects must not access list nodes
9
Region-Based Memory Management Region-Based Memory Management
10
Provides control over memory Provides control over memory For efficiency For predictability While ensuring memory safety While ensuring memory safety Region-Based Memory Management Region-Based Memory Management
11
Programs can create a region Programs can create a region Allocate objects in a region Allocate objects in a region Delete a region & free all objects in it Delete a region & free all objects in it Region-Based Memory Management Region-Based Memory Management
12
Programs can create a region Programs can create a region Allocate objects in a region Allocate objects in a region Delete a region & free all objects in it Delete a region & free all objects in it Region lifetimes are nested Region lifetimes are nested Region-Based Memory Management Region-Based Memory Management
13
Ensure memory safety Ensure memory safety Disallow pointers from outside to inside Disallow pointers from outside to inside Region Types Region Types ~ ~
14
Ownership types ensure object encapsulation Ownership types ensure object encapsulation Disallow pointers from outside to inside Disallow pointers from outside to inside Region types ensure memory safety Region types ensure memory safety Disallow pointers from outside to inside Disallow pointers from outside to inside Similarities
15
Unified Type System
16
Disallows pointers from outside to inside Disallows pointers from outside to inside Ensures object encapsulation Ensures object encapsulation Ensures memory safety Ensures memory safety Unified Type System
18
Every object has an owner Every object has an owner Owner can be another object or a region Owner can be another object or a region Ownership relation forms a forest of trees Ownership relation forms a forest of trees Unified Type System
19
An object owned by another object An object owned by another object Is an encapsulated subobject of its owner Unified Type System
20
An object owned by another object An object owned by another object Is an encapsulated subobject of its owner An object owned by a region An object owned by a region Is allocated in that region Unified Type System
21
An object owned by another object An object owned by another object Is an encapsulated subobject of its owner Is allocated in the same region as its owner An object owned by a region An object owned by a region Is allocated in that region Unified Type System
22
Programmers specify Programmers specify Owner of every object In types of variables pointing to objects Type checker statically verifies Type checker statically verifies No pointers from outside to inside
23
class Stack { Node head; Node head; void push(Data data) {…} void push(Data data) {…} Data pop() {…} Data pop() {…}} class Node { Node next; Node next; Data data; Data data; …} Unified Type System data next head data next data next … … … Stack Node Data
24
class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;}
25
Unified Type System Classes are parameterized with owners First owner owns the corresponding object class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;}
26
class Stack stackOwner, dataOwner { Node , dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} Unified Type System Stack owns the head Node
27
class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node , dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} Unified Type System All Nodes have the same owner
28
Ownership Types for Safe Regions s is an encapsulated stack with encapsulated elements class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} class Client { Stack this, this s; Stack this, this s;}
29
Unified Type System class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;}
30
Unified Type System class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} (RegionHandle r h) { …} r is the region name. It is a compile time entity. h is the region handle. It is a runtime value.
31
Unified Type System Region r2 is nested inside region r1 class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} (RegionHandle r1 h1) { (RegionHandle r2 h2) { (RegionHandle r2 h2) { Stack r1, r1 s1; Stack r1, r1 s1; Stack r2, r1 s2; Stack r2, r1 s2;}}
32
Unified Type System class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} (RegionHandle r1 h1) { (RegionHandle r2 h2) { (RegionHandle r2 h2) { Stack r1, r1 s1; Stack r1, r1 s1; Stack r2, r1 s2; Stack r2, r1 s2;}} Stack and its elements are in the same region
33
Unified Type System class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} (RegionHandle r1 h1) { (RegionHandle r2 h2) { (RegionHandle r2 h2) { Stack r1, r1 s1; Stack r1, r1 s1; Stack r2, r1 s2; Stack r2, r1 s2;}} Stack and its elements are in different regions
34
Unified Type System class Stack stackOwner, dataOwner { Node this, dataOwner head; Node this, dataOwner head;} class Node nodeOwner, dataOwner { Node nodeOwner, dataOwner next; Node nodeOwner, dataOwner next; Data dataOwner data; Data dataOwner data;} (RegionHandle r1 h1) { (RegionHandle r2 h2) { (RegionHandle r2 h2) { Stack r1, r1 s1; Stack r1, r1 s1; Stack r2, r1 s2; Stack r2, r1 s2; Stack r1, r2 s3; // illegal Stack r1, r2 s3; // illegal}} Scoping alone does not ensure safety in presence of subtyping First owner must be same as or nested in other owners
35
Other details Other details Special regions Garbage collected heap Immortal region Runtime provides Region handle of most nested region Region handle of an object Type checker statically infers If a region handle is in scope Unified Type System
36
Enforces object encapsulation Enforces object encapsulation Boyapati, Liskov, Shrira ( POPL ’03 ) Enable safe region-based memory management Enable safe region-based memory management Boyapati, Salcianu, Beebee, Rinard ( PLDI ’03 ) Prevents data races and deadlocks Prevents data races and deadlocks Boyapati, Rinard ( OOPSLA ’01 ) Boyapati, Lee, Rinard ( OOPSLA ’02 ) Enables upgrades in persistent object stores Enables upgrades in persistent object stores Boyapati, Liskov, Shrira, Moh, Richman ( OOPSLA ’03 ) Unified Type System
37
Talk Overview Unified type system for OO programs Unified type system for OO programs Extensions for Real-time Java Extensions for Real-time Java Multithreaded programs Real-time programs Real-time Java programs Experience Experience
38
Regions for Multithreaded Programs Shared regions with reference counting Shared regions with reference counting Grossman ( TLDI ’01 )
39
Regions for Multithreaded Programs Shared regions with reference counting Shared regions with reference counting Grossman ( TLDI ’01 ) Sub regions within shared regions Sub regions within shared regions To avoid memory leaks in shared regions To avoid memory leaks in shared regions
40
Regions for Multithreaded Programs Shared regions with reference counting Shared regions with reference counting Grossman ( TLDI ’01 ) Sub regions within shared regions Sub regions within shared regions To avoid memory leaks in shared regions To avoid memory leaks in shared regions ~ ~
41
Regions for Multithreaded Programs Shared regions with reference counting Shared regions with reference counting Grossman ( TLDI ’01 ) Sub regions within shared regions Sub regions within shared regions To avoid memory leaks in shared regions To avoid memory leaks in shared regions Typed portal fields in sub regions Typed portal fields in sub regions To start inter-thread communication To start inter-thread communication
42
Regions for Multithreaded Programs Shared regions with reference counting Shared regions with reference counting Grossman ( TLDI ’01 ) Sub regions within shared regions Sub regions within shared regions To avoid memory leaks in shared regions To avoid memory leaks in shared regions Typed portal fields in sub regions Typed portal fields in sub regions To start inter-thread communication To start inter-thread communication Region kinds to make it all work Region kinds to make it all work
43
Talk Overview Unified type system for OO programs Unified type system for OO programs Extensions for Real-time Java Extensions for Real-time Java Multithreaded programs Real-time programs Real-time Java programs Experience Experience
44
Regions for Real-Time Programs Real-time (RT) threads with real-time constraints Real-time (RT) threads with real-time constraints RT threads cannot use garbage collected heap RT threads cannot use garbage collected heap RT threads can use immortal memory RT threads can use immortal memory RT threads can use regions RT threads can use regions
45
Regions for Real-Time Programs Real-time (RT) threads with real-time constraints Real-time (RT) threads with real-time constraints RT threads cannot use garbage collected heap RT threads cannot use garbage collected heap RT threads can use immortal memory RT threads can use immortal memory RT threads can use regions RT threads can use regions RT threads cannot read heap references RT threads cannot read heap references RT threads cannot overwrite heap references RT threads cannot overwrite heap references
46
Regions for Real-Time Programs Real-time (RT) threads with real-time constraints Real-time (RT) threads with real-time constraints RT threads cannot use garbage collected heap RT threads cannot use garbage collected heap RT threads can use immortal memory RT threads can use immortal memory RT threads can use regions RT threads can use regions RT threads cannot read heap references RT threads cannot read heap references RT threads cannot overwrite heap references RT threads cannot overwrite heap references Ownership types augmented with effects clauses Ownership types augmented with effects clauses To statically verify above properties To statically verify above properties
47
Real-Time Java (RTJ) Extension to Java for real-time programs Extension to Java for real-time programs Java Specification Request (JSR) 1 Java Specification Request (JSR) 1 http://www.rtj.org http://www.rtj.org
48
Real-Time Java (RTJ) Extension to Java for real-time programs Extension to Java for real-time programs Java Specification Request (JSR) 1 Java Specification Request (JSR) 1 http://www.rtj.org http://www.rtj.org Real-time (RT) threads Real-time (RT) threads Region-based memory management Region-based memory management Threads cant violate memory safety Threads cant violate memory safety RT threads cant interact with garbage collector RT threads cant interact with garbage collector
49
Real-Time Java (RTJ) Uses dynamic checks to ensure Uses dynamic checks to ensure No pointers from outer to inner regions Nesting of regions forms a hierarchy RT threads do not read heap refs RT threads do not overwrite heap refs Introduces new failure modes Introduces new failure modes Programming model is difficult to use Programming model is difficult to use
50
Region Types as Front-End for RTJ Typechecker Translator (Removes extra types) (Generates real-time Java) Compiler JVM Real-time Java bytecodes + Extra types types Java
51
Benefits of Using Region Types Safety Safety Checks errors at compile time Checks errors at compile time Efficiency Efficiency Avoids runtime checking overhead Avoids runtime checking overhead Typechecker Translator (Removes extra types) (Generates real-time Java) Real-time Java + Extra types types Java
52
Experience
53
Reducing Programming Overhead Type inference for method local variables Type inference for method local variables Default types for method signatures & fields Default types for method signatures & fields User defined defaults as well User defined defaults as well Significantly reduces programming overhead Significantly reduces programming overhead Approach supports separate compilation Approach supports separate compilation
54
Programming Overhead Program # Lines of code # Lines annotated HTTP Server 603 60320 Game Server 97 9710 Database Server 244 24424 Image Recognition 567 567 8 java.util.Vector 992 99235java.util.Hashtable 1011 101153 Water185031Barnes185016
55
RTJ Dynamic Checking Overhead Program Execution Time (sec) Speed Up Dynamic Checks Static Checks Water2.552.0624%Barnes 21.6 21.6 19.1 19.113% Image Recognition 8.106.7021% load load 0.813 0.813 0.667 0.66725% cross cross 0.014 0.014 thinning thinning 0.026 0.026 0.023 0.023 10% 10% save save 0.731 0.731 0.617 0.61718%
56
Related Work
57
Our work unifies these areas Ownership types Ownership types Clarke, Potter, Noble ( OOPSLA ’98 ), ( ECOOP ’01 ) Clarke, Drossopoulou ( OOPSLA ’02 ) Boyapati, Lee, Rinard ( OOPSLA ’01 ) ( OOPSLA ’02 ) Boyapati, Liskov, Shrira, Moh, Richman ( POPL ’03 ) ( OOPSLA ’03 ) Aldrich, Kostadinov, Chambers ( OOPSLA ’02 ) Region types Region types Tofte, Talpin ( POPL ’94 ) Christiansen, Henglein, Niss, Velschow ( DIKU ’98 ) Crary, Walker, Morrisett ( POPL ’99 ) Grossman, Morrisett, Jim, Hicks, Wang, Cheney ( PLDI ’02 ) Grossman ( TLDI ’03 )
58
Related Work Systems that allow regions to be freed early Systems that allow regions to be freed early Aiken, Fahndrich, Levien ( PLDI ’95 ) Gay, Aiken ( PLDI ’98 ) ( PLDI ’01 ) Crary, Walker, Morrisett ( POPL ’99 ) Dynamic analysis to infer RTJ regions Dynamic analysis to infer RTJ regions Deters, Cytron ( ISMM ’02 ) Static analysis to remove RTJ dynamic checks Static analysis to remove RTJ dynamic checks Salcianu, Rinard ( PPoPP ’01 ) Static analysis to help infer size of RTJ regions Static analysis to help infer size of RTJ regions Gheorghioiu, Salcianu, Rinard ( POPL ’03 ) Real-time garbage collection Real-time garbage collection Baker ( CACM ’78 ) Bacon, Cheng, Rajan ( POPL ’03 )
59
Conclusions Unified type system for OO languages Statically enforces several properties Statically enforces several properties Object encapsulation Memory safety Data race and deadlock freedom Safe software upgrades Safe real-time programming Type checking is fast and scalable Type checking is fast and scalable Requires little programming overhead Requires little programming overhead Promising way to make programs reliable Promising way to make programs reliable
60
Laboratory for Computer Science Massachusetts Institute of Technology Ownership Types for Safe Region-Based Memory Management in Real-Time Java Chandrasekhar Boyapati Alexandru Salcianu William Beebee Martin Rinard
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.