Demand-driven Alias Analysis Implementation Based on Open64

1
Demand-driven Alias Analysis Implementation
Based on Open64

• Xiaomi An
• annyur_at_gmail.com

2
Outline

• Demand-driven alias analysis
• CFL-Reachability based demand-driven alias
  analysis (DDA)
• One-level flow demand-driven alias analysis (Olf
  DDA)

3
Why Demand driven?

• Potential of faster analysis speed
• Less memory requirement
• Flexible framework to rebuild the lost info
• Potentially support more aggressive analysis

4
Previous work on demand driven alias analysis

• Heintze and Tardieu, Demand-Driven Pointer
  Analysis, PLDI 2001
• Sridharan and Bodik, Refinement-based
  context-sensitive points-to analysis for Java,
  PLDI 2006
• Xin Zheng and Radu Rugina, Demand-Driven Alias
  Analysis for C, POPL 2008
• Work for C
• Answer alias queries without constructing
  points-to sets

5
Alias analysis via CFL-Reachability (1)Program
Representation

• Graph representation of program (PEG)
• Pointer dereference edges (D)
• Assignment edges (A)
• Corresponding edges in the opposite direction (
  )
• Memory alias and value alias
• two l-value expressions are memory aliases,
• if they might denote the same memory location.
  
• two expressions are value aliases,
• if they might evaluate to the same value.

6
Alias analysis via CFL-Reachability (2)
Hierarchical State Machine
Machine V
Machine M
Correspond to Andersens inclusion algorithm.
7
Alias analysis via CFL-Reachability (3) Example
Program s t r z y r s r
x y x s
Program expression graph
Analysis for query MayAlias(x, s)
8
Precision Evaluation (1) Features of the
demand-driven alias analysis (DDA)

• Set-inclusion based
• Field-sensitive
• Flow-insensitive
• Separate value flows for globals
• May-alias

9
Precision Evaluation (2) Typical test cases
case (1) case (2) case (3)
int foo () int p, q int s1, s2, s3 p s1 p s2 q s3 q p p (int) malloc(100) q (int) malloc(100) return s1 s2 s3 int a100,b100 void foo() int i int p, q p a0 q b10 for (i0ilt100i) p q p q typedef struct unsigned int bits_left unsigned int buffer_size bitfile typedef struct char is_leaf char data4 hcb_bin_quad hcb_bin_quad hcb10 void foo (bitfile ld, int cb, int n, int b) for (int i0 iltn i) ld-gtbits_left hcbi.datab
10
Precision Evaluation (3) Alias analysis
results
Test case Memory operation DDA AC AC FFA FSA DDA FFA FSA
Case (1) s1 s2 s3 p q s3 s1 s2 41,2 51,2,3,4 76 86,7 41,2,3 51,2,3,4 76 86,7 42 52 76 86,7 42 52 76 86,7
Case (2) global_obj p q 21 31 21 31,2 21, 31,2 21 31
Case (3) global_obj ld-gtbits_left hcbi.datab 21 31 21 31,2 21 31,2 21 31
11
Precision Evaluation (4) Analysis and
Conclusions

• Result Analysis
• For case (1)
• DDA is better than AC due to set-inclusion
• DDA is worse than FSA due to flow-insensitive and
  MAY-alias info
• For case (2)
• DDA is better than AC due to separate value flows
  for globals
• DDA is better than FSA due to complete value flow
  tracking
• For case (3)
• DDA is better than AC due to field sensitivity,
• DDA is better than FFA due to its keeping track
  of high level type info
• Conclusions
• Proper combination of good features leads to good
  precision.
• DDA can replace AC without loss of precision.

12
Scalability Evaluation (1) PEG features and
alias queries classification
Test case Summary of PEGs Summary of PEGs Summary of PEGs Summary of PEGs Query count By cache By analysis count By analysis count
Test case node count node count A-edge count A-edge count Query count By cache Quick analysis DDA analysis
Test case total Max total max Query count By cache Quick analysis DDA analysis
Swim 391 119 568 208 23081 75 18 7
Mgrid 712 132 1019 247 62410 61 36 3
Equake 1899 280 1761 362 98668 45 52 3
Art 1749 95 1643 122 17573 27 65 8

• Open64, as an optimizing compiler, has large
  number of alias queries.
• Quick disambiguation and caching are necessary.
• Good alias analysis precision is necessary.

13
Scalabitlity Evaluation (2) Results and
Conclusion
CFL-Reachability based alias analysis
implementation doesnt have good scalability.
14
One-level flow demand driven analysis(1)
Motivation

• To avoid redundant graph traverse
• To simplify the program expression graph
• To get some of the scalability from union-based
  algorithm while keeping most of the precision
  from inclusion-based algorithm

15
One-level flow demand-driven analysis (2)
One-level flow hierarchical state machine
Machine V
Machine M
Correspond to Dass algorithm which lie between
Andersen and Steengaard.
16
One-level flow demand-driven analysis (3) New
features

• One-level inclusion-based, upper-level
  unification-based
• Value flow factorization
• Online incremental PEG simplification

17
One-level flow demand-driven analysis (4)
Example

• int foo ()
• int p, q
• int s1, s2, s3
• p s1
• p s2
• q s3
• q p
• p (int) malloc(100)
• q (int) malloc(100)
• return s1 s2 s3

18
Scalability Evaluation (1) Percentage of
analysis finished
19
Scalability Evaluation (2) Percentage of not
aliased results
20
Conclusion and Future work

• Conclusion
• Demand driven alias analysis can be used in
  product compiler and give precise alias results.
• One-level flow DDA can improve the scalability
  and give much more precise results for a
  reasonable compile time.
• Future work
• To extend demand driven analysis to
  inter-procedural analysis.
• To exploit more methods to further improve
  scalability.

21
Thank You!