1. Refining Abstract Locations Tachio Terauchi Jeff Foster Alex Aiken

2. Using types to reason about state... spin_lock(f->lock);... spin_unlock(f->lock);... f->lock: unlocked spinlock_t f->lock: locked spinlock_t f->lock: unlocked spinlock_t

3. Handling aliases Solution – Abstract locations: set of concrete locations May alias analysis – Map states (types) to abstract locations. spin_lock(f->lock); spin_unlock(x); spin_unlock(f->lock);

4. Typing Judgement Abstract location –– Type –  := int |  | ref(  ) Store – C := C,    | ; C 1 ; Γ ` e :  ; C 2 – In environment Γ, e has type  and evaluating e changes the store from C 1 to C 2. C 1 ; Γ ` e : ref(  ) ; C 2 C 1 ; Γ ` spin_lock(e) : void; C 2 [   locked spinlock_t]

5. Problem: aliases Ideally – Single abstract location  single concrete location Reality – Single abstract location  many concrete locations typedef struct Foo { spinlock_t * lock; struct Foo * next; } * foo; void bar(foo f) { spin_lock(f->lock);... spin_unlock(f->next->lock)... spin_unlock(f->lock); }

6. Problem: aliases (continued) typedef struct Foo { spinlock_t * lock; struct Foo * next; } * foo; void bar(foo f) { spin_lock(f->lock)...... spin_unlock(f->lock) }

7. Ideas Obtain finer abstract locations with better alias analysis. – Subset-based alias analysis, one-level-flow alias analysis, cfl- reachability-based alias analysis, etc. – Work in progress… – But none of these will work on the list example. – More expensive analysis? This work: construct and study language features to allow programmers locally refine abstract locations.

8. The list example typedef struct Foo { spinlock_t * lock; struct Foo * next; } * foo; void bar(foo f) { spin_lock(f->lock)...... spin_unlock(f->lock) }

9. restrict restrict x = e 1 in e 2 – e 1 evaluates to a reference cell of the type ref(  ). – x has the type ref(  ’). –  must not be accessed in e 2. –  ’ must not be accessed outside of e 2. – Before and after the evaluation of e 2, the state of  ’ is equal to the state of . Intuition: separates the world of  ’ from the world of .

10. What can one do with restrict? Locally associate an abstract location with a single concrete location. void bar(spinlock_t * restrict lock) { spin_lock(lock);... spin_unlock(lock); }... bar(f->lock)...

11. What can one do with restrict? (2) Prevent local aliases from affecting the outside world. void bar(spinlock_t * restrict lock) { /* builds a local linked list of locks containing lock */ }... spinlock_t * newlock = new_lock(“a fresh lock”));... bar(newlock); spin_lock(newlock)...

12. Using restrict in existing programs Inferring restrict Extending restrict

13. Inferring restrict How often do programmers unknowingly declare “restrict” reference cells? Algorithm – Given a program annotated with standard reference cell types (e.g. ref int), – For each occurrence of “let x:ref  = e 1 in e 2 ”, check if it satisfies all of the restrict constraints. – If so, replace it with “restrict x:ref  = e 1 in e 2 ”.

14. Experience with inferring restrict C programs – Steensgaard’s alias analysis – Pointer declarations in function parameters. – Library functions Assume all abstract locations reachable from arguments and returns are accessed. – Mixed initial results 16 out of 60 in flex 40 out of 510 in sendmail 7 out of 387 in li

15. Limitation of restrict restrict needs a variable referring to the target location. – restrict x = e 1 in e 2

16. The list example typedef struct Foo { spinlock_t * lock; struct Foo * next; } * foo; void bar(foo f) { spin_lock(f->lock)...... spin_unlock(f->lock) }

17. Limitation of restrict restrict needs a variable referring to the target location. What to do when we want to “restrict” an arbitrary expression? –... spin_lock(f->lock)... –... spin_lock(xyz((abc+3)->d))...

18. Extending restrict restrict!! e 1 in e 2 – Outside of e 2, e 1 evaluates to a reference cell of the type ref(  ). – Within e 2, e 1 has the type ref(  ’). –  must not be accessed in e 2. –  ’ must not be accessed outside of e 2. – Before and after the evaluation of e 2, the state of  ’ is equal to the state of . – e 1 is referentially transparent in e 2.

19. Example typedef struct Foo { spinlock_t * lock; struct Foo * next; } * foo; void bar(foo f) { restrict!! f->lock in { spin_lock(f->lock)...... spin_unlock(f->lock) }

20. Further work More ways to locally refine abstract locations Relationship with other work on reasoning about states – Alias analysis, Existential Types, Dataflow analysis, model checking, Linear types, Monads