Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson...
-
date post
18-Dec-2015 -
Category
Documents
-
view
213 -
download
0
Transcript of Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson...
Faculty of Computer Science
LCPC 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Stephen Curial Jose Nelson AmaralDepartment of Computing Science
University of Alberta
Ondrej Lhotak D. R. Cheriton School of Computer
Science, University of Waterloo
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Introduction
Points-to analysis is important
– Many compiler transformations require this information
– Precise analysis of large programs often infeasible due to space requirements
Binary Decision Diagrams (BDDs)
– Compact representation of relations
Zerro-suppressed BDDs (ZBDDs)
– Successfully used in other domains
• Circuit design, model checking, verification
– Haven’t been used to represent relations
• Need to develop relational product operation
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Background - What Are Binary Decision Diagrams (BDDs)
F(x1 x2 x3)
=
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x1
x2 x2
x3 x3 x3 x3
1 0
OBDD
x1
1
•Non-terminal Node•BDD Variable
•0 / false / lo -edge
•1 / true / hi -edge
•Terminal Node
LegendLegend
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
BDDs are Canonical
2 reduction rules:
1. When two BDD nodes p and q are identical, edges
leading to q are changed to lead to p, and q is eliminated
from the BDD.
2. A BDD node p whose one-edge and zero-edge both lead
to the same node q is eliminated from the BDD and the
edges leading to p are redirected to q.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Background - What Are Binary Decision Diagrams (BDDs)
F(x1 x2 x3)
=
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x1
x2 x2
x3 x3 x3 x3
1 0
OBDD ROBDD
x1
x2 x2
x3 x3
1 0
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Using ROBDDs to represent points-to relations
• We compute the may point-to relation:
PT = {(a,L1); (a,L2); (b,L1); (b,L2); (c,L1); (c,L2); (c,L3)}
• We compute the may point-to relation:
PT = {(a,L1); (a,L2); (b,L1); (b,L2); (c,L1); (c,L2); (c,L3)}
Code
v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Pointer Code
a 00
b 01
c 10
Code
v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
L1: a = new O();L2: b = new O();L3: c = new O(); a = b; b = a; c = b;
Object Code
L1 00
L2 01
L3 10
After Berndl-Lhotak et al., PLDI03
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Using ROBDDs to represent points-to relationsCode
v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Pointer Code
a 00
b 01
c 10
Code
v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
Object Code
L1 00
L2 01
L3 10
v1
v2v2
v4v4 v4v4 v4v4 v4v4
v3v3 v3v3
1 0
After Berndl-Lhotak et al., PLDI03
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Using ROBDDs to represent points-to relationsCode
v1v2v3v4 fT
0000 1
0001 1
0010 0
0011 x
0100 1
0101 1
0110 0
0111 x
Pointer Code
a 00
b 01
c 10
Code
v1v2v3v4 fT
1000 1
1001 1
1010 1
1011 x
1100 x
1101 x
1110 x
1111 x
Object Code
L1 00
L2 01
L3 10
v1
v2v2
v4v4 v4v4 v4v4 v4v4
v3v3 v3v3
1 0
After Berndl-Lhotak et al., PLDI03
Notice that many elements in the
domain are un-assigned.
- Potentially wasting space
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Why do we have don’t care values?
To represent relations efficiently with BDDs a binary encoding
is used.
– 2n encodings
• but domain may be smaller then 2n
• E.g. A domain with 3 elements needs to be encoded using 2 bits.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
One-of-N encoding
One-of-N encoding can eliminate unused bit patterns.
– n elements uses n bits
a 000001
b 000010
c 000100
d 001000
e 010000
f 100000
Example of aOne-of-N encoding:
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDDs are Efficient with a One-of-N Encoding
A ZBDD is efficient if: There are few vectors in the on-set.The elements in the on-set have very few 1’s.
For every 1 in an encoding that is part of the onset, there will be a path to the 1 terminal.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
What is a ZBDD 2nd reduction rule changed:
1. When two BDD nodes p and q are identical, edges leading to q are
changed to lead to p, and q is eliminated from the BDD.
2. A BDD node, p, whose one-edge leads to the zero terminal node
and whose zero-edge leads to a node, q, is removed from the BDD
and the edges leading to p are redirected to q.
[Minato94]
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
OBDD vs. ROBDD vs. ZBDD
F(x1 x2 x3)
=
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
x1
x2 x2
x3 x3 x3 x3
1 0
OBDD ROBDD
x1
x2 x2
x3 x3
1 0
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
OBDD vs. ROBDD vs. ZBDD
ROBDD
x1
x2 x2
x3 x3
1 0
ZBDD(Binary Encoding)
x1
x2
x3
1 0
F(x1 x2 x3)
=
0 0 0 0
0 0 1 1
0 1 0 1
0 1 1 0
1 0 0 1
1 0 1 0
1 1 0 0
1 1 1 0
If a variable in the ZBDD is true and it not
tested, it is mapped to 0. E.g. input 110
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Using ZBDDs for Points-to Analysis
Points-to analysis algorithm needs relational product to calculate the points-to set due to propagation.
– Initial Points-to relation (V x W) & Edge Set (i.e. assignments) (V x H)
– RELPROD(Init, Edge, V)
– REPLACE(W to V)
– UNION(POINTS-TO, PT from PROPAGATION)
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
BDD Relational Product Example
Pt = { <p,X>, <q,Y>}
Edge = { <q’,p> }
X: p = new O();Y: q = new O(); q = p;
We want to propagate the points-to set along the edges.We want to propagate the points-to set along the edges.
Relational Product will join <p,X> with <q’,p> to give <p, q’, X> Relational Product will join <p,X> with <q’,p> to give <p, q’, X>
then existential quantification will remove p to yield <q’,X>then existential quantification will remove p to yield <q’,X>
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Relational Product Example Pt = { Xp, Yq}
Edge = { pq’ }
ZBDD Mul gives: { Xpq', Yqpq' }
To adapt the ZBDD multiplication algorithm we need to:To adapt the ZBDD multiplication algorithm we need to:
• Remove tuples that have multiple elements of the same attributeRemove tuples that have multiple elements of the same attribute
• Add existential quantificationAdd existential quantification
Need to throw out Yqpq' because it has both p and q in the same attribute.
Keep Xpq', but we want to quantify the p out of it, to get Xq'
X: p = new O();Y: q = new O(); q = p;
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Experimental Setup
Used 3 points-to analysis frameworks
– bddbddb [Whaley and Lam PLDI 2004]
– soot / spark [Brendl et al. PLDI 2003]
– Paddle [Lhotak and Hendren CC 2006]
Used 10 Java benchmarks:
– 3 from Decapo
• antlr, bloat, chart
– 4 from SPEC JVM 98
• jack, javac, jess, raytrace
– 3 other Object Oriented
• polyglot, sablecc, soot
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Experiments
bddbddb - Context Insensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Experiments
Brendel et al. - Context Insensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Experiments
Paddle - Context Sensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Experiments
Impact of ZBDDs depends on the relation:
– Increase size greater than 2 times.
• Only relations in the context-insensitive analysis grew.
– Reduce size more than 8 times.
– Depends on the density of the relation.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
When to use ZBDDs
Density metric
– Number of tuples in the relation divided by the number of
possible tuples in the full domain.
– Simple test if current analysis doesn’t use BDDs.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
When to use ZBDDs
bddbddb - Context Insensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
When to use ZBDDs
Brendel et al. - Context Insensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
When to use ZBDDs
Paddle - Context Sensitive
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Density Metric
– Density
• Less than 3 x 10-3
– |ZBDD| < |BDD|
• Close to 3 x 10-3
– |ZBDD| ~= |BDD|
• Greater than 3 x 10-3
– |ZBDD| > |BDD|
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
Conclusion
ZBDD based points-to analysis
– Represent relations
– Relational product algorithm
Implementation of ZBDD based points-to analysis
– Reduced size for some context insensitive relations
– Reduced the size for all context sensitive relations
Relational density metric
– Predict ZBDD vs. BDD
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Relational Product
The relational product algorithm for BDDs is an existential quantification of a conjunction.
– x.(f•g) = (f•g)[0/x] + (f•g)[1/x])
Multiplication for ZBDDs is analogous to conjunction in BDDs
– Multiplication algorithm existed
– Develop algorithm that combines existential quantification with multiplication.
• Performs early quantification like the BDD version.
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Relational Product
To use ZBDDs in points-to analysis needed to create a Relational Product Operator.
– In relational calculus, essentially a natural join followed by project.
Given two functions f(x, …) and g(x, ...), does a value of x exist that makes the conjunction of f and g true?
x.(f•g) = (f•g)[0/x] + (f•g)[1/x])
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Relational ProductZBDD ZRelProd(ZBDD p, ZBDD q, Set pd) 1 if p.top < q.top 2 then return ZRelProd(q, p, pd) 3 if q = 0 4 then return 0 5 if q = 1 6 then return Subset0(p, pd) 7 x ← p.top 8 (p0, p1) ← factors of p by x 9 if x ∈ pd 10 then 11 (q0, q1) ← factors of q by x 12 return union(ZRelProd(p1, q1, pd), ZRelProd(p0, q0, pd)) 13 else 14 return node(x, ZRelProd(p1, q, pd), ZRelProd(p0, q, pd))
LCPC October 12, 2007
Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis
ZBDD Relational Product
The relational product algorithm for BDDs is an existential quantification of a conjunction.
– x.(f•g) = (f•g)[0/x] + (f•g)[1/x])
Multiplication for ZBDDs is analogous to conjunction in BDDs
– Multiplication algorithm existed
– Develop algorithm that combines existential quantification with multiplication.
• Performs early quantification like the BDD version.