Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson...

Faculty of Computer Science

LCPC 2007

Using ZBDDs in Points-to AnalysisUsing ZBDDs in Points-to Analysis

Stephen Curial Jose Nelson AmaralDepartment of Computing Science

University of Alberta

Ondrej Lhotak D. R. Cheriton School of Computer

Science, University of Waterloo

LCPC October 12, 2007


Introduction

Points-to analysis is important

– Many compiler transformations require this information

– Precise analysis of large programs often infeasible due to space requirements

Binary Decision Diagrams (BDDs)

– Compact representation of relations

Zerro-suppressed BDDs (ZBDDs)

– Successfully used in other domains

• Circuit design, model checking, verification

– Haven’t been used to represent relations

• Need to develop relational product operation



Background - What Are Binary Decision Diagrams (BDDs)

F(x1 x2 x3)

=

0 0 0 0

0 0 1 1

0 1 0 1

0 1 1 0

1 0 0 1

1 0 1 0

1 1 0 0

1 1 1 0

x1

x2 x2

x3 x3 x3 x3

1 0

OBDD

x1

1

•Non-terminal Node•BDD Variable

•0 / false / lo -edge

•1 / true / hi -edge

•Terminal Node

LegendLegend



BDDs are Canonical

2 reduction rules:

1. When two BDD nodes p and q are identical, edges

leading to q are changed to lead to p, and q is eliminated

from the BDD.

2. A BDD node p whose one-edge and zero-edge both lead

to the same node q is eliminated from the BDD and the

edges leading to p are redirected to q.



Background - What Are Binary Decision Diagrams (BDDs)

F(x1 x2 x3)

=

0 0 0 0

0 0 1 1

0 1 0 1

0 1 1 0

1 0 0 1

1 0 1 0

1 1 0 0

1 1 1 0

x1

x2 x2

x3 x3 x3 x3

1 0

OBDD ROBDD

x1

x2 x2

x3 x3

1 0



Using ROBDDs to represent points-to relations

• We compute the may point-to relation:

PT = {(a,L1); (a,L2); (b,L1); (b,L2); (c,L1); (c,L2); (c,L3)}

• We compute the may point-to relation:

PT = {(a,L1); (a,L2); (b,L1); (b,L2); (c,L1); (c,L2); (c,L3)}

Code

v1v2v3v4 fT

0000 1

0001 1

0010 0

0011 x

0100 1

0101 1

0110 0

0111 x

Pointer Code

a 00

b 01

c 10

Code

v1v2v3v4 fT

1000 1

1001 1

1010 1

1011 x

1100 x

1101 x

1110 x

1111 x

L1: a = new O();L2: b = new O();L3: c = new O(); a = b; b = a; c = b;

Object Code

L1 00

L2 01

L3 10

After Berndl-Lhotak et al., PLDI03



Using ROBDDs to represent points-to relationsCode

v1v2v3v4 fT

0000 1

0001 1

0010 0

0011 x

0100 1

0101 1

0110 0

0111 x

Pointer Code

a 00

b 01

c 10

Code

v1v2v3v4 fT

1000 1

1001 1

1010 1

1011 x

1100 x

1101 x

1110 x

1111 x

Object Code

L1 00

L2 01

L3 10

v1

v2v2

v4v4 v4v4 v4v4 v4v4

v3v3 v3v3

1 0




Using ROBDDs to represent points-to relationsCode

v1v2v3v4 fT

0000 1

0001 1

0010 0

0011 x

0100 1

0101 1

0110 0

0111 x

Pointer Code

a 00

b 01

c 10

Code

v1v2v3v4 fT

1000 1

1001 1

1010 1

1011 x

1100 x

1101 x

1110 x

1111 x

Object Code

L1 00

L2 01

L3 10

v1

v2v2

v4v4 v4v4 v4v4 v4v4

v3v3 v3v3

1 0


Notice that many elements in the

domain are un-assigned.

- Potentially wasting space



Why do we have don’t care values?

To represent relations efficiently with BDDs a binary encoding

is used.

– 2n encodings

• but domain may be smaller then 2n

• E.g. A domain with 3 elements needs to be encoded using 2 bits.



One-of-N encoding

One-of-N encoding can eliminate unused bit patterns.

– n elements uses n bits

a 000001

b 000010

c 000100

d 001000

e 010000

f 100000

Example of aOne-of-N encoding:



ZBDDs are Efficient with a One-of-N Encoding

A ZBDD is efficient if: There are few vectors in the on-set.The elements in the on-set have very few 1’s.

For every 1 in an encoding that is part of the onset, there will be a path to the 1 terminal.



What is a ZBDD 2nd reduction rule changed:

1. When two BDD nodes p and q are identical, edges leading to q are

changed to lead to p, and q is eliminated from the BDD.

2. A BDD node, p, whose one-edge leads to the zero terminal node

and whose zero-edge leads to a node, q, is removed from the BDD

and the edges leading to p are redirected to q.

[Minato94]



OBDD vs. ROBDD vs. ZBDD

F(x1 x2 x3)

=

0 0 0 0

0 0 1 1

0 1 0 1

0 1 1 0

1 0 0 1

1 0 1 0

1 1 0 0

1 1 1 0

x1

x2 x2

x3 x3 x3 x3

1 0

OBDD ROBDD

x1

x2 x2

x3 x3

1 0



OBDD vs. ROBDD vs. ZBDD

ROBDD

x1

x2 x2

x3 x3

1 0

ZBDD(Binary Encoding)

x1

x2

x3

1 0

F(x1 x2 x3)

=

0 0 0 0

0 0 1 1

0 1 0 1

0 1 1 0

1 0 0 1

1 0 1 0

1 1 0 0

1 1 1 0

If a variable in the ZBDD is true and it not

tested, it is mapped to 0. E.g. input 110



Using ZBDDs for Points-to Analysis

Points-to analysis algorithm needs relational product to calculate the points-to set due to propagation.

– Initial Points-to relation (V x W) & Edge Set (i.e. assignments) (V x H)

– RELPROD(Init, Edge, V)

– REPLACE(W to V)

– UNION(POINTS-TO, PT from PROPAGATION)



BDD Relational Product Example

Pt = { <p,X>, <q,Y>}

Edge = { <q’,p> }

X: p = new O();Y: q = new O(); q = p;

We want to propagate the points-to set along the edges.We want to propagate the points-to set along the edges.

Relational Product will join <p,X> with <q’,p> to give <p, q’, X> Relational Product will join <p,X> with <q’,p> to give <p, q’, X>

then existential quantification will remove p to yield <q’,X>then existential quantification will remove p to yield <q’,X>



ZBDD Relational Product Example Pt = { Xp, Yq}

Edge = { pq’ }

ZBDD Mul gives: { Xpq', Yqpq' }

To adapt the ZBDD multiplication algorithm we need to:To adapt the ZBDD multiplication algorithm we need to:

• Remove tuples that have multiple elements of the same attributeRemove tuples that have multiple elements of the same attribute

• Add existential quantificationAdd existential quantification

Need to throw out Yqpq' because it has both p and q in the same attribute.

Keep Xpq', but we want to quantify the p out of it, to get Xq'

X: p = new O();Y: q = new O(); q = p;



Experimental Setup

Used 3 points-to analysis frameworks

– bddbddb [Whaley and Lam PLDI 2004]

– soot / spark [Brendl et al. PLDI 2003]

– Paddle [Lhotak and Hendren CC 2006]

Used 10 Java benchmarks:

– 3 from Decapo

• antlr, bloat, chart

– 4 from SPEC JVM 98

• jack, javac, jess, raytrace

– 3 other Object Oriented

• polyglot, sablecc, soot



ZBDD Experiments

bddbddb - Context Insensitive



ZBDD Experiments

Brendel et al. - Context Insensitive



ZBDD Experiments

Paddle - Context Sensitive



ZBDD Experiments

Impact of ZBDDs depends on the relation:

– Increase size greater than 2 times.

• Only relations in the context-insensitive analysis grew.

– Reduce size more than 8 times.

– Depends on the density of the relation.



When to use ZBDDs

Density metric

– Number of tuples in the relation divided by the number of

possible tuples in the full domain.

– Simple test if current analysis doesn’t use BDDs.



When to use ZBDDs

bddbddb - Context Insensitive



When to use ZBDDs

Brendel et al. - Context Insensitive



When to use ZBDDs

Paddle - Context Sensitive



Density Metric

– Density

• Less than 3 x 10-3

– |ZBDD| < |BDD|

• Close to 3 x 10-3

– |ZBDD| ~= |BDD|

• Greater than 3 x 10-3

– |ZBDD| > |BDD|



Conclusion

ZBDD based points-to analysis

– Represent relations

– Relational product algorithm

Implementation of ZBDD based points-to analysis

– Reduced size for some context insensitive relations

– Reduced the size for all context sensitive relations

Relational density metric

– Predict ZBDD vs. BDD



ZBDD Relational Product

The relational product algorithm for BDDs is an existential quantification of a conjunction.

– x.(f•g) = (f•g)[0/x] + (f•g)[1/x])

Multiplication for ZBDDs is analogous to conjunction in BDDs

– Multiplication algorithm existed

– Develop algorithm that combines existential quantification with multiplication.

• Performs early quantification like the BDD version.




To use ZBDDs in points-to analysis needed to create a Relational Product Operator.

– In relational calculus, essentially a natural join followed by project.

Given two functions f(x, …) and g(x, ...), does a value of x exist that makes the conjunction of f and g true?

x.(f•g) = (f•g)[0/x] + (f•g)[1/x])



ZBDD Relational ProductZBDD ZRelProd(ZBDD p, ZBDD q, Set pd) 1 if p.top < q.top 2 then return ZRelProd(q, p, pd) 3 if q = 0 4 then return 0 5 if q = 1 6 then return Subset0(p, pd) 7 x ← p.top 8 (p0, p1) ← factors of p by x 9 if x ∈ pd 10 then 11 (q0, q1) ← factors of q by x 12 return union(ZRelProd(p1, q1, pd), ZRelProd(p0, q0, pd)) 13 else 14 return node(x, ZRelProd(p1, q, pd), ZRelProd(p0, q, pd))




The relational product algorithm for BDDs is an existential quantification of a conjunction.

– x.(f•g) = (f•g)[0/x] + (f•g)[1/x])

Multiplication for ZBDDs is analogous to conjunction in BDDs

– Multiplication algorithm existed

– Develop algorithm that combines existential quantification with multiplication.

• Performs early quantification like the BDD version.

Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson...

Documents

Transcript of Faculty of Computer Science LCPC 2007 Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson...