180 likes | 303 Vues
Enhance runtime verification by integrating tracematches directly into deployed programs, improving debugging and usage evaluation. Explore static optimizations and spatial partitioning techniques to reduce overhead and enhance performance.
E N D
McGill University Eric Bodden Laurie Hendren Patrick Lam OndrejLhotak Nomair A. Naeem University of Waterloo Collaborativeruntime verificationwith tracematches
Problem Ideally, runtime verification code should be included in deployed programs: • Allows for easier debugging • Actual usage vs. test case coverage Current runtime monitoring approaches do not scale well enough. Here: Tracematches
A common programming problem Collection c = Collections.synchronizedCollection(myC); synchronized(c) { } Iteratori = c.iterator(); while(i.hasNext()) foo(i.next());
Tracematch "ASyncIteration" tracematch(Object c) { sym sync after returning(c): call(* Collections.synchr*(..)); sym asyncIter before: call(* Collection+.iterator()) && target(c) && if(!Thread.holdsLock(c)); sync asyncIter { System.err.println( "Iterations over "+c+" must be synchronized!" ); } }
Static Optimizations (ECOOP 2007) • Quick check: Eliminate incomplete tracematches • Pointer analysis: Retain “consistent sets of instrumentation points” Brings overhead under 10% in most cases. However, some overheads still exceed 150%! Goal: 10% overhead in all cases
Spatial partitioning Collaborative runtime verification
Spatial partitioning in detail First of all, identify multiple probes: • A set of instrumentation points (shadows) that could potentially lead to a match • Find such sets of shadows using flow-insensitive points-to analysis
Identifying probes asyncIter(c=c3) asyncIter(c=c2) o2 o1 sync(c=c1) Probe
Temporal partitioning Problem: Hot shadows
Could switching probes on and off lead to false positives? • No, we can safely enable a probe anytime due to tracematch semantics. Opposed to e.g. LTL always match against a suffix of the execution trace. • Can also disable anytime. Just have to make sure we discard bindings. * skip(aSyncIter) sync aSyncIter
Code generation for probe switching 0 1 2 3 4 0 0 1 asyncIter(c=c4) asyncIter(c=c3) asyncIter(c=c2) 2 1 3 sync(c=c1) sync(c=c5) sync(c=c1) 2 0 4
Benchmarks • ECOOP ’07 benchmarks with largest overheads • Ran each benchmark/tracematch combination with one probe enabled at a time • Measured relative runtime overhead
Future work • Implement temporal partitioning • Requires probabilistic foundation • Try this out on a larger scale • Need Java programs with a large user base, willing to cooperate • Try using JVM support to find hot probes • Production JVMs already compute statistics • Would enable more efficient probe switching • Eliminate super-hot shadows through better static analysis
Conclusion • Sound collaborative RV is possible using tracematches • Can construct probes using a flow-insensitive points-to analysis • Approach works for some programs but very hot shadows can still be bottlenecks • Found a heuristic to statically identify shadows with potentially high runtime impact • Further static optimizations probably more promising
Thank you Thank you for listening and the entire AspectBench Compiler group for their enduring support! Download our tool, examples and benchmarks at: www.aspectbench.org