Off-line Variable Substitution for Scaling Points-to Analysis

1
Off-line Variable Substitution for Scaling
Points-to Analysis

• Atanas (Nasko) Rountev
• PROLANGS Group
• Rutgers University

Satish Chandra Bell Labs Lucent Technologies
2
What is Pointer Analysis?

• Given a pointer p, which variables does p refer
  to?

p may refer to either x or y
3
Why Should We Care?

• Indirect access to memory
• p q
• Indirect flow of control
• Clients
• Optimizing compilers
• Software productivity tools
• Static verification tools
• Test coverage tools

4
Efficiency versus Precision

• Hard problem
• Approximation algorithms
• O(n) to O(n7)
• Flow and context sensitivity
• Difficult tradeoffs between efficiency and
  precision

5
Our Contributions

• Off-line variable substitution
• Trading precision for efficiency
• Flexibility in choosing the right approximations
• Precision-preserving substitution
• Andersens points-to analysis
• More than 50 cost reduction

6
Outline

• Introduction
• Off-line Variable Substitution
• Scaling Andersens Analysis
• Empirical Results
• Summary

7
Variable Substitution

• Technique for cost reduction
• Replaces a set of variables with a single
  variable
• Smaller points-to graphs
• Possible loss of precision
• Used by several analyses
• Done on-the-fly, during the analysis

8
Off-line Variable Substitution

• Alternative modify the input problem

• Use variable substitution to simplify the program
• Reduces the size of the lattice
• Analyze the simplified program
• Recover a solution for the original program
• Precise versus approximate solution

9
Substitution Example
p a p b q p s p t s
x a x b y x

10
The Big Picture

• Construct approximate problems
• Choose the right approximations
• Control tradeoffs between cost and precision
• Separation from the analysis algorithm
• Easy modifications

11
Outline

• Introduction
• Off-line Variable Substitution
• Scaling Andersens Analysis
• Empirical Results
• Summary

12
Andersens Points-to Analysis

• Flow and context insensitive
• Worst case O(n3)
• Practicality must reduce analysis cost
• Hundreds of thousands LOC in a few minutes

13

Specific off-line variable substitution which
preserves precision
14
Precision-preserving Substitution

• Equivalent variables
• Have the same points-to sets
• Substitution
• Set of equivalent variables
• No targets of points-to edges
• Linear-time computation of equivalence sets
• Non-maximal sets

15
Subset Graph

• Nodes sets of variables
• Edges subset relationships

16
Sources of Equivalent Variables

• Strongly-connected components
• Pt(v1) ? Pt(v2) ? ? Pt(vk) ? Pt(v1)
• Direct nodes
• No indirect assignments to v ( not taken)

v
S2
S1
S3
v
Pt(v) S1 ? S2 ? S3
17
Algorithm Highlights

• Traversal of SCC DAG in topological sort order
• Integer label for each SCC
• Direct SCC contains only direct nodes
• Predecessors with the same label
• Direct SCC with no predecessors non-pointers
• Eliminate irrelevant statements

18
Computation of Equivalence Sets
1
1
2
5
6
7
3
4
4
0
0
0
8
19
Outline

• Introduction
• Off-line Variable Substitution
• Scaling Andersens Analysis
• Empirical Results
• Summary

20
Experiments Overview

• Large C programs 30 - 750 KLOC
• Constraint-based implementation of Andersens
  analysis
• BANE constraint solver from Berkeley
• Results
• Many variables have the same points-to sets
• 53 reduction in running time
• 59 reduction in memory usage

21
Program Size

22
Running Time
23
Memory Usage
24
Outline

• Introduction
• Off-line Variable Substitution
• Scaling Andersens Analysis
• Empirical Results
• Summary

25
Summary

• Off-line variable substitution
• Control tradeoffs between cost and precision
• Precision-preserving substitution
• Simple and effective linear-time algorithm
• Empirical results
• More than 50 reduction in both time and space
• Applications for other pointer analyses?