1. © Copyright 2010 Hewlett-Packard Development Company, L.P. 1 Rick Hank, Loreena Lee, Rajiv Ravindran, Hui Shi Java, Compilers & Tools Lab, Hewlett Packard, Cupertino, California Implementing Next Generation Points-To in Open64

2. © Copyright 2010 Hewlett-Packard Development Company, L.P. 2 REQUIREMENTS –Points-To Algorithm Scalable – we must be able to apply this algorithm to large applications Flow-insensitive – state of the art analysis employed in production compilers is flow-insensitive (see scalability) Context-sensitive – must provide at least context sensitivity for heap allocations Field-sensitive – must be able to disambiguate structure field references –Implementation Preserve existing interfaces −ALIAS_MANAGER −ALIAS_RULE Preserve existing flow-sensitive alias (WOPT) Provide a mechanism for extensibility

3. © Copyright 2010 Hewlett-Packard Development Company, L.P. 3 APPROACH –Andersen (or inclusion)-style points-to analysis Intel/gcc compiler’s employ inclusion-style points-to analysis Anything less precise does not place Open64 ahead of the curve –Modeled after work done by Erik Nystrom Only work we found that studied the combination of inclusion, field-sensitivity and context-sensitivity Fulcra Pointer Analysis Framework http://impact.crhc.illinois.edu/ftp/report/phd-thesis-erik-nystrom.pdf Implementation heavily influenced by Eric’s IMPACT implementation Several changes made to core algorithm to reduce complexity and improve scalability –Constraint graph solution method heavily influenced by: Wave Propagation and Deep Propagation for Pointer Analysis, CGO 2009

4. © Copyright 2010 Hewlett-Packard Development Company, L.P. 4 WHAT IS A CONSTRAINT GRAPH? –Nodes correspond to symbols In our implementation a node represents an pair. –Edges provide the constraints Traditionally there are four types of constraints Field sensitivity adds a fifth (Skew) Represent a subset relation Example 1: A = B The points-to set of B is a subset of the points-to set of A Example 2: A = *B If x is contained in the points-to set of B, then the points to set of x is a subset of the points-to set of A –Solving: Computing the transitive closure TypeStatement AddressA = &B CopyA = B LoadA = *B Store*A = B SkewA = B + ofst

5. © Copyright 2010 Hewlett-Packard Development Company, L.P. 5 CONSTRAINT GRAPH SOLVER (SIMPLIFIED) ConstraintGraphSolve::solveConstraints() { do { findAndMergeSCCs(); // provide topological order while (!copySkewList.empty()) { ConstraintGraphEdge *e = copySkewList.pop(); e->process(); } while (!loadStoreList.empty()) { ConstraintGraphEdge *e = loadStoreList.pop(); e->process(copySkewList); } } while (!copySkewList.empty()); }

6. © Copyright 2010 Hewlett-Packard Development Company, L.P. 6 CONSTRAINT GRAPH: EXAMPLE p,0 a,0 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } *= h,0t2t2 {h,0}

7. © Copyright 2010 Hewlett-Packard Development Company, L.P. 7 CONSTRAINT GRAPH: EXAMPLE p,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } *= h,0t2t2 {h,0}

8. © Copyright 2010 Hewlett-Packard Development Company, L.P. 8 CONSTRAINT GRAPH: EXAMPLE p,0 q,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } {a,0} *= h,0t2t2 {h,0}

9. © Copyright 2010 Hewlett-Packard Development Company, L.P. 9 CONSTRAINT GRAPH: EXAMPLE p,0 q,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } {a,0} = *= h,0t2t2 {h,0}

10. © Copyright 2010 Hewlett-Packard Development Company, L.P. 10 IPA PHASE ORDERING

11. © Copyright 2010 Hewlett-Packard Development Company, L.P. 11 ALIAS ANALYSIS INTERFACE –Complex analysis cannot be done repeatedly, ala alias classification Motivates WHIRL annotations to facilitate access to alias information –AliasTag Provides mapping from WN to alias solution Existing ALIAS_MANAGER, ALIAS_RULE interfaces use AliasTag to perform alias queries Challenge: How to preserve the WN  AliasTag association across BE? Each IR lowering phase provides an opportunity to drop the association Each WHIRL  CODEREP  WHIRL translation provides an opportunity to drop the association AliasTags are associated with existing POINTS_TO and mapped into AUX_STAB, OCC during WOPT –AliasAnalyzer Provides “generic” alias analysis interface −Theoretically, alias classification could be abstracted behind this interface. Derived class NystromAliasAnalyzer implements our inclusion-based algorithm at –O2 Derived class IPA_NystromAliasAnalyzer implements our inclusion-based algorithm at -ipa

12. © Copyright 2010 Hewlett-Packard Development Company, L.P. 12 SUMMARY DETAILS –Alias analysis spans IPL, IPA and BE –Initial constraint graphs are constructed/solved during IPL Conveyed to IPA via standard summary mechanism Summary information SUMMARY_CONSTRAINT_GRAPH_NODE SUMMARY_CONSTRAINT_GRAPH_EDGE SUMMARY_CONSTRAINT_GRAPH_STINFO SUMMARY_CONSTRAINT_GRAPH_CALLSITE SUMMARY_CONSTRAINT_GRAPH_MODRANGE Added support for passing summary from IPA to BE New.ipa_summary section in.I files Local summary (per PU) only Convey only what is necessary to answer alias queries from backend components Provide nodes and points-to sets, but no constraints (edges)

13. © Copyright 2010 Hewlett-Packard Development Company, L.P. 13 IPA SOLVER (SIMPLIFIED) IPA_NystromAnalyzer::solve() { do { // Top down, context insenstive do { prepare(); // connect actuals/formals, SCC det solve(); update(); // find resolve icalls } while(change); // Bottom up, context sensitive for (PU in rev-topologial order) { apply-summaries(); // inline callee summary solve(); } update(); // find resolved icalls } while (change); }

14. © Copyright 2010 Hewlett-Packard Development Company, L.P. 14 CONSTRAINT GRAPH: IPA CONNECT p,0 q,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } {a,0} = *= = h,0t2t2 {h,0}

15. © Copyright 2010 Hewlett-Packard Development Company, L.P. 15 CONSTRAINT GRAPH: IPA COPY/SKEW p,0 q,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } {a,0} = h,0t2t2 {h,0} {h,4} h,4 *= =

16. © Copyright 2010 Hewlett-Packard Development Company, L.P. 16 CONSTRAINT GRAPH: IPA LOAD/STORE p,0 q,0 b,0 a,0 t1t1 *= +4 int a, b; struct foo { int x; int y; }; typedef struct foo FOO; FOO *ex() { int *q; FOO *p; p = (FOO *) alloc(sizeof(FOO)); p->x = a; p->y = b; q = &a; *q = b; return p; } void *alloc(int n) { return malloc(n); } {a,0} = h,0t2t2 {h,0} h,4 = = *= = {h,0} {h,4} *=

17. © Copyright 2010 Hewlett-Packard Development Company, L.P. 17 RESULTS Application# Iterations Time (s) 400.perlbench2122.3 401.bzip270.2 403.gcc2772.8 429.mcf60.1 445.gobmk111.3 456.hmmer130.5 458.sjeng40.2 462.libquantum30.1 464.h264ref152.3 471.omnetpp204.6 473.astar40.1 483.xalancbmk68130.1 SOLVER TIME

18. © Copyright 2010 Hewlett-Packard Development Company, L.P. 18 RESULTS PRECENTAGE OF TOTAL QUERIES THAT RETURN “NO ALIAS “ Application% 400.perlbench1.23 456.hmmer4.48 483.xalancbmk1.24 PERFORMANCE IMPROVEMENT

19. © Copyright 2010 Hewlett-Packard Development Company, L.P. 19 CHALLENGES/OPPORTUNITIES –WHIRL IR Not strongly typed – field annotations are informational Flattened – lack of index operators make it difficult to determine field being referenced Preserving WN  AliasTag mapping across lowering, IR translation Improve escape analysis to reduce effects of pointers escaping through external calls WOPT memory SSA is not field sensitive −Use of single virtual symbol negates most (any?) benefit −Opportunity to leverage points-to sets to partition OCCS into multiple virtual symbols –Convergence Number of offsets being modeled – large points-to sets Number of symbols being modeled – large points-to sets Call graph is not mutable −Alias analysis cannot update the call graph as indirect/virtual calls are resolved −Opportunity for down stream transformations to make use of more precise call graph –Inlining Standalone inliner may not be sufficient Code re-use in C++ seems to be problematic

20. © Copyright 2010 Hewlett-Packard Development Company, L.P. 20 STATUS –Done: Public branch on top-of-trunk (open64.net) http://svn.open64.net/svnroot/open64/branches/nextgenalias Implementation at –O2/O3/-Ofast Tested SPEC 2006/2000 fp/int –To Do: Context sensitive solution −Implement summary creation, inlining Address some scalability issues −Points-to sets are large due to large number of modeled offsets and conservative collapsing −Solution: Control the number of offsets we are willing to implement Collapse symbols where modeling both is unnecessary Address remaining issues with “invalid AliasTag” −Tags lost during WHIRL transformations More extensive correctness validation Improve vsyms Merge to ToT

21. © Copyright 2010 Hewlett-Packard Development Company, L.P. 21© Copyright 2010 Hewlett-Packard Development Company, L.P. 21 THANKS! QUESTIONS ?

22. © Copyright 2010 Hewlett-Packard Development Company, L.P. 22© Copyright 2010 Hewlett-Packard Development Company, L.P. 22 BACKUP

23. © Copyright 2010 Hewlett-Packard Development Company, L.P. 23 CONSTRAINT GRAPH PROPERTIES ApplicationNodesCopySkewLoadStore 400.perlbench887211075429404232904087 401.bzip2657566431071715722 403.gcc2526084304283077642329299 429.mcf1361182598284168 445.gobmk5488514826649166871462 456.hmmer234531983712965701319 458.sjeng6919900627664424 462.libquantum188113848823740 464.h264ref43199515515013131263427 471.omnetpp506754112799845582886 473.astar32952041329488270 483.xalancbmk3519398457865045509916911

24. © Copyright 2010 Hewlett-Packard Development Company, L.P. 24 CONTEXT SENSITIVITY –Heap sensitivity Calls to known heap allocation routines produce a local “heap” symbol E.g. malloc, calloc, new, etc. Leverage new call side-effect table The “heap” symbol will be cloned when the summary constraint graph is inlined during the context sensitive walk of the call graph –Unfortunately full context sensitivity is not yet implemented May provide a solution to some of the convergence issues we are seeing by reducing points-to set sizes Likely provide additional challenges as we will significantly increase the number of nodes –Interim solution – identify heap allocation wrappers Wrappers are identified and marked during IPL −Provides one heap symbol per wrapper call site −E.g. MallocOrDie Additional “heap” symbols introduced when connecting actual/formal parameters