1. Pointer Analysis for Multithreaded Programs Radu Rugina and Martin Rinard M I T Laboratory for Computer Science

2. Outline Example Review of Pointer Analysis for Sequential Programs Pointer Analysis for Multithreaded Programs Experimental Results Conclusions PLDI 99 R. Rugina, M. Rinard

3. Example two concurrent threads two questions: Q1 : what location is written by *p=1 ? Q2: what location is written by *p=2 ? OR : Q1: p  ? in left thread Q2: p  ? after both threads completed PLDI 99 R. Rugina, M. Rinard

4. Two Possible Executions PLDI 99 R. Rugina, M. Rinard

5. Analysis Result PLDI 99 R. Rugina, M. Rinard Result = a points-to graph at each program point

6. = Analysis of Multithreaded Programs Problem: –analyze interactions between concurrent threads Straightforward solution: –analyze all possible interleavings and merge results –fails because of exponential complexity –for n threads with s 1,..., s n statements : Number of interleavings = s 1 +... + s n s 1,..., s n s 1 !... s n ! (s 1 +... + s n ) ! ( ) PLDI 99 R. Rugina, M. Rinard

7. Our Approach We introduce interference information : –interference = points-to edges created by the other concurrent threads –models the effect of “all possible interleavings” Efficiency: polynomial complexity in program size Derive dataflow equations : –recursive equations –fixed-point algorithms to solve the equations –theoretically less precise than “all interleavings” –in practice : no loss of precision PLDI 99 R. Rugina, M. Rinard

8. Algorithm Overview intra-procedural: –flow-sensitive (dataflow analysis) –handles unstructured flow of control –defines dataflow equations for: pointer assignments parallel constructs inter-procedural : –context-sensitive –handles recursive functions PLDI 99 R. Rugina, M. Rinard

9. Review of Pointer Analysis for Sequential Programs

10. Points-to Graphs Points-to graphs [EGH94] –nodes = program variables –edges = points-to relationships Example : PLDI 99 R. Rugina, M. Rinard

11. Basic Pointer Assignments Four types of pointer assignments: x = &y ( address-of assign ) x = y ( copy assign ) x = *y ( load assign ) *x = y ( store assign ) More complex assignments: –transformed into a sequence of basic statements tmp = &t; *z = tmp; tmp = &t; *z = tmp; *z = &t; PLDI 99 R. Rugina, M. Rinard

12. Generated Edges y tu z load: x = *y yt w store: *x = y x y z address-of: x = &y yt z copy: x = y x z xx PLDI 99 R. Rugina, M. Rinard

13. Strong vs. Weak Updates strong updates : –kill existing points-to relationships –result in more precise analysis results weak updates : –leave existing points-to edges in place –reasons for weak updates: control flow uncertainty: arrays of pointers : heap-allocated pointers : if (cond) p = &q; else p = &r; *p = &x; v[i] = &x; p = malloc( sizeof(int*) ) *p = &x; p q r y z x PLDI 99 R. Rugina, M. Rinard

14. Dataflow Information PLDI 99 R. Rugina, M. Rinard address-of: x = &y gen = { (x, y) } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) copy: x = y gen = { (x, t) | (y, t)  C } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) load: x = *y gen = { (x, u) | (y, t)  C  (t, u)  C } kill = { (x, z) | (x, z)  C } strong = not (array_elem(x)  heap(x)) store: *x = y gen = { (z, t) | (x, z)  C  (y, t)  C } kill = { (z, w) | (x, z)  C  (z, w)  C } strong = { z | (x, z)  C } = {v}  not (array_elem(v)  heap(v))

15. –the dataflow information is :  P 3 C = the current points-to relationships I = the interference information from other threads E = edges created by the current thread –as a set of edges, P 3 is a lattice: partial order relation = set inclusion merge operator = set union  = Dataflow Analysis PLDI 99 R. Rugina, M. Rinard

16. P = set of points-to graphs, Stat = set of program statements abstract semantics is defined by a functional : : Stat  (P 3  P 3 ) Abstract Interpretation PLDI 99 R. Rugina, M. Rinard

17. Parallel par Statements syntax : par { {t 1 },..., {t n } } –concurrent execution –interleaving semantics –may be nested interference : –is the union of points-to edges created by all other concurrent threads –may be different for different concurrent threads PLDI 99 R. Rugina, M. Rinard

18. Interference information : –I = “global” interference - generated by enclosing par ’s –L i =“local” interference - generated by current par –E = points-to edges created by the current thread Analysis result for thread t i : Analysis of Individual Threads = t i I i = I  L i C i = C  L i = t i I i = I  L i C i = C  L i PLDI 99 R. Rugina, M. Rinard

19. Analysis result : Parend Analysis = par = t i I’ = I E’ = E  (  E i ) C’ =  C i ’ = par = t i I’ = I E’ = E  (  E i ) C’ =  C i ’ PLDI 99 R. Rugina, M. Rinard

20. Recursive dataflow equations : Analysis of Entire par Construct C i = C  L i I i = I  L i = t i (thread rule) E’ = E  (  E i ) C’ =  C i ’ = par ( par rule ) C i = C  L i I i = I  L i = t i (thread rule) E’ = E  (  E i ) C’ =  C i ’ = par ( par rule ) information flowing INTO par construct information flowing OUT of par construct PLDI 99 R. Rugina, M. Rinard

21. Example Analysis PLDI 99 R. Rugina, M. Rinard

22. Inter-Procedural Analysis Context-sensitive : –procedures re-analyzed at each call site Ghost variables: –replace variables not in the scope of the procedure –distinguish locals in different activations of recursive functions Sequential Partial Transfer Functions (Seq-PTFs) [WL95] –associate a points-to output graph to an input context –can be reused when there is a match for the input context PLDI 99 R. Rugina, M. Rinard

23. Multithreaded Extensions Multithreaded Input Context = input points-to information + interference information Multithreaded PTF = = associates output points-to graph + created edges to an input context Mapping and unmapping : –map the interference information I –unmap created points-to edges E PLDI 99 R. Rugina, M. Rinard

24. Other Parallel Constructs Parallel for loops –generate a symmetric dataflow equation: t 1 = t 1 = C’ =  ( C i ’ U C i ) for(i=0; i<n; i++) spawn thread(i); sync; for(i=0; i<n; i++) spawn thread(i); sync; if (c1) spawn thread1(); if (c2) spawn thread2(); sync; if (c1) spawn thread1(); if (c2) spawn thread2(); sync; Conditional Thread Creation –merge analysis result with initial points- to graph PLDI 99 R. Rugina, M. Rinard

25. Advanced Features Recursive procedures: –result in recursive dataflow equations –fixed-point algorithm to solve recursion Function pointers: –result in a dynamic call-graph –handled using the computed pointer information –methodology: analyze all possible callees and merge results Thread-private global variables: – at parbegin nodes: save their values in the parent thread and make them point to unknown in the child threads –at parend nodes: restore saved values in the parent thread PLDI 99 R. Rugina, M. Rinard

26. Algorithm Evaluation Soundness : –the multithreaded algorithm conservatively approximates all possible interleavings of concurrent threads’ statements Termination of fixed-point algorithms: –follows from the monotonicity of the abstract semantics functional Complexity of fixed-point algorithms: –worst-case size of points-to graphs: O(n 2 ), where n = | Stat | –n program points imply worst-case O(n 3 ) iterations –worst-case polynomial complexity: O(n 4 ) Precision of analysis: – if the concurrent threads do not (pointer-)interfere then this algorithm gives the same result as the “ideal algorithm ” PLDI 99 R. Rugina, M. Rinard

27. Experimental Results Implementation : –SUIF infrastructure; Cilk benchmarks Benchmark characteristics : PLDI 99 R. Rugina, M. Rinard

28. Precision Measurements Pointer values at load/store : –usually unique target: 83 % of the loads 88 % of the stores –few potentially uninitialized pointers –very few pointers with more than two targets Comparison : –Multithreaded, Interleaved, Sequential: MT Interleaved Seq –results: Multithreaded = Sequential –conclusion: Multithreaded = Interleaved   PLDI 99 R. Rugina, M. Rinard

29. Applications Current Uses: –MIT RAW project memory disambiguation for static promotion (ISCA 99) C-to-silicon compiler generating small memories (FCCM 99) –automatic parallelization of divide-and- conquer algorithms (PPoPP 99) Future Uses: –data race detection in multithreaded programs –static elimination of array bounds checks PLDI 99 R. Rugina, M. Rinard

30. Future Multithreaded programs: –are becoming very common –are hard to debug –are hard to analyze The current algorithm: –gives precise MT pointer information –may be used as a foundation for other MT analyses –gives a framework for other MT analyses PLDI 99 R. Rugina, M. Rinard

31. Additional Slides

32. Applications Heavily Optimized By Hand –Pousse - timed competition, won ICFP ‘98 contest Pointer Arithmetic Casts Divide and Conquer Algorithms –Recursion –Pointers Into Heap-Allocated Arrays –Pointer-Based Data Structures (octrees, hash tables,...) –Recursive Linked Data Structures Allocated On Stack Challenging Benchmark Set PLDI 99 R. Rugina, M. Rinard

33. Related Work Pointer analysis –existing pointer analyses are focused to sequential programs [LR92], [LRZ93], [CBC93], [EGH94], [Ruf95], [WL95], [And94], [Ste96], [SH97] –flow-sensitive vs. flow-insensitive analysis –context-sensitive vs. context-insensitive analysis Multithreaded program analysis: –relatively unexplored field –flow-sensitive analysis : dataflow framework for bitvector problems [KSV96] does not apply to pointer analysis –flow-insensitive analysis: trivially model the interleaving semantics of concurrent threads locality analysis [ZH97] ( uses type-inference techniques) PLDI 99 R. Rugina, M. Rinard