Java Alias Analysis for Online Environments

1. Manu Sridharan 2004 OSQ Retreat Joint work with Rastislav Bodik, Denis Gopan, Jong-Deok Choi Java Alias Analysis for Online Environments

2. Motivation: Online Environments • No suitable alias analysis for “online environments” • JIT: compilation and optimization of modern languages • Currently use type system for coarse alias info • Whole-program Andersen too slow (~45s) • IDE: program understanding, powerful refactorings • Andersen too inaccurate (need context-sensitivity) • Up to 20 minutes for full context-sensitive analysis • Desired analysis properties similar! • Interactive response time • demand analysis, approximate wisely within time budget • Additional context-sensitivity when necessary • depth 3 for distinguishing ArrayList objects 2

3. Alias Analysis as CFL-Reachability (Melski, Reps) x := new Obj(); // o1 y := new Obj(); // o2 z := new Obj(); // o3 x.f = y; y.f = z; w = y; v = w.f; new x o1 w assign pf[f] new gf[f] y o2 pf[f] v new z o3 pointsTo :- new | containspointsTo contains :- assign | gf[f] share pf[f] share :- pointsTo pointsTo_bar 3

4. Java Alias Analysis is Balanced Parens • Match getfields with putfields to track flow through heap • Does not hold for C (address-of operator) • Match edges summarize flow through fields, make traversal regular • Makes efficient dynamic programming algorithm for Dyck languages applicable new x o1 w assign pf[f] new gf[f] y o2 pf[f] v new z o3 pointsTo :- new | containspointsTo contains :- assign | gf[f] share pf[f] match 4

5. Match-based algorithms • MATCHall: add only valid match edges bottom-up • Adaptation of Reps et. al. POPL95 algorithm • Alternative to constraint-based propagation algorithms • may be faster with finer-grained abstract locations • MATCHk: validate match edges selectively • Experimentally, most match edges valid • Focus effort on those likely to be invalid (arrays) • MATCH0: add matches exhaustively, simple traversal • Can restrict amount of traversal based on budget / payoff • Restricted MATCH0fast without sacrificing accuracy • less than 2 ms / query • resolves 90% of virtual calls resolved with field-sensitivity • Suitable for JIT compiler 5

6. Refactoring and context-sensitivity class Car { Engine engine; Car() {} Engine getEngine() { return engine; } void setEngine(Engine e) { engine = e; }} class Engine { int horsePower; Engine(int hp) { horsePower = hp; } int getHP() { return horsePower; } } class Car { int horsePower; Engine engine; Car(int hp) { horsePower = hp; } int getHP() { return horsePower; } void setEngine(Engine e) { engine = e; } Engine getEngine() { return engine; } } class Engine {} • Precondition: engine is dynamically one-to-one • statically one-to-one + simple flow-sensitivity • Context-sensitive alias analysis necessary • Distinguish calls to setEngine() • Track Car objects if placed in container 6

7. Summaries through CFL paths class ListElem { int val; ListElem next; ListElem(int v, ListElem n) { val = v; next = n; } ListElem add(int v) { ListElem m = this; while (m != null) { if (m.val == v) return this; m = m.next; } return new ListElem(v, this); // o1 } } • Previous summary approach includes entire graph for add • based on heap reachability (Whaley/Rinard OOPSLA99) • Our approach only retains CFL paths from entry to exit • In above example, exclude m and its edges this assign assign ret m new gf[next] o1 our summary 7

8. Java Alias Analysis is Balanced Parens: So What? • Motivation: online environments • JIT: performance improvement • IDE: program understanding, powerful refactorings • Desired analysis properties • “Interactive” response time for small number of queries • Added sensitivity (field, context) when necessary • Progress • Studied CFL reachability formulation • Insight: unlike C, Java alias analysis is “balanced parens” • JIT: simple, fast, and accurate algorithm • less than 2 ms / query, 90% of field-sensitive accuracy • IDE: context-sensitivity through small summaries • Idea: retain only CFL paths 8