1 / 45

Type-Based Flow Analysis: From Polymorphic Subtyping to CFL-Reachability

Type-Based Flow Analysis: From Polymorphic Subtyping to CFL-Reachability. Jakob Rehof and Manuel F ähndrich Microsoft Research. Common vocabulary Data access paths Function summary Context-sensitivity Directional flow. Type-based Type structure (  ) Function type (->)

odin
Télécharger la présentation

Type-Based Flow Analysis: From Polymorphic Subtyping to CFL-Reachability

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Type-Based Flow Analysis: From Polymorphic Subtyping to CFL-Reachability Jakob Rehof and Manuel Fähndrich Microsoft Research

  2. Common vocabulary Data access paths Function summary Context-sensitivity Directional flow Type-based Type structure () Function type (->) Type instantiation, polymorphism () Subtyping () Type-BasedProgram Analysis

  3. +CS +DI GOAL: Scaleable Flow Analysis of H.O. Programsw. Polymorphic Subtyping • Type-based • Higher-order • Context-sensitive (CS) • Directional (DI) Precision and Cost +CS +DI (, ) -CS +DI (=, ) +CS -DI (,=) -CS -DI (=,=)

  4. Outline • Goals • Problems and Results • Current Flow Analysis w.  +  • Our Solution • Summary

  5. Current Method • () Polymorphism by copying types • ()Subtyping by constrained types • ( + ) constraint copying

  6. Problems w. Current Method • Constraint copying is expensive (memory) • Constraint simplification is hard • Previous algorithm (Mossin) • No on-demand algorithms (n = size of type-annotated program)

  7. Results • No constraint copying • On-demand queries • All flow in

  8. Outline • Goals • Problems and Results • Current Flow Analysis w. +  • Our Solution • Summary

  9. Current Flow Analysis w. + (Mossin) max(s,t) = if s<=t then t else s real * real -> real standard type

  10. Current Flow Analysis w. + max(s:a,t:b) = (if s<=t then t else s) :c {a  c, b  c} => real:a* real:b-> real:c subtyping constraints analysis type flow label

  11. Current Flow Analysis w. + max(s:a,t:b) = (if s<=t then t else s) :c {a  c, b  c} => real:a* real:b-> real:c

  12. Current Flow Analysis w. + max(s:a,t:b) : {a  c, b  c} => real:a* real:b-> real:c max(x0,y0) max(x1,y1)

  13. Current Flow Analysis w.+ max(s:a,t:b) : {a  c, b  c} => real:a* real:b-> real:c max(x0:a0,y0:b0):c0 max(x1:a1,y1:b1):c1 {a0c0,b0c0}=>c0

  14. Current Flow Analysis w.+ max(s:a,t:b) : {a  c, b  c} => real:a* real:b-> real:c max(x0:a0,y0:b0):c0 max(x1:a1,y1:b1):c1 {a1c1,b1c1}=>c1 {a0c0,b0c0}=>c0

  15. Current Flow Analysis w.+ with and

  16. Without Subtyping: norm(x ,y ) = let m = max(x,y) in scale(x,y,m) end; scale(z,w,n) = (z/n,w/n) max(s:a,t:a) = if s<=t then t else s :a’ :a’  real:a* real:a-> real:a

  17. Without Subtyping: norm(x:a’,y:a’) = let m = max(x,y) in scale(x,y,m) end; scale(z,w,n) = (z/n,w/n) max(s:a,t:a) = if s<=t then t else s  real:a* real:a-> real:a

  18. Outline • Goals • Problems and Results • Current Flow Analysis w. +  • Our Solution • Summary

  19. B A Flow Analysis Overview Source Code Type Inference Type Instantiation Graph Flow Graph

  20. B A Flow Analysis Overview Source Code Polymorphic Subtyping Type Inference Type Instantiation Graph CFL- Reachability Flow Graph

  21. Eliminating constraint copies max(s:a,t:b) : {ac, bc} =>real:a* real:b-> real:c max(x0:a0,y0:b0):c0 max(x1:a1,y1:b1):c1 {a0c0, b0c0} => real:a0* real:b0-> real:c0 {a1c1, b1c1} => real:a1* real:b1-> real:c1

  22. 1. Get a graph max(s:a,t:b) : real:a* real:b-> real:c max(x0:a0,y0:b0):c0 max(x1:a1,y1:b1):c1 real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  23. 2. Label instantiationsites max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  24. 3. Represent substitutions max(s:a,t:b) : real:a* real:b-> real:c a a0 a a1 b b0 b b1 c c0 c c1 i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  25. 3.a. … as a graph max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 i i i real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  26. 3.a. … as a graph max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j i i i real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  27. 4. Eliminate constraint copies ! max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j i i i real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  28. ? ? ? max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j i i i real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  29. Type Theory to the Rescue ! • Polarity (+,-) + -> - + ->  + - ->  + -  

  30. 5. Polarities (+,-) max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j - + - i - i i + - real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  31. 6. Reverse negative edges max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j - - + i - i i - + real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  32. 7. Recover flow max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j - - + i - i i - + real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  33. 7. Recover flow max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j - - + i - i i - + real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  34. 7. Recover flow max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 j j j - - + i - i i - + real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  35. 8. Be careful ! max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 Spurious ! j j j - - + i - i i - + real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  36. 9. Do CFL-reachability CFG d max(s:a,t:b) : real:a* real:b-> real:c i: max(x0:a0,y0:b0):c0 j:max(x1:a1,y1:b1):c1 M [kM]k d ]j [j [j [i [i ]i real:a0* real:b0-> real:c0 real:a1* real:b1-> real:c1

  37. Further Issues • Polymorphic type structure • Recursive type structure • context-sensitive data-dependence analysis is uncomputable [Reps 00] • our techniques require finite types • regular unbounded data types handled via finite approximations: recursive type expressions

  38. One-level implementation • GOLF analysis system for C by Manuvir Das (MSR) and Ben Liblit (Berkeley) • Exhaustive points-to sets for MS Word 97, 1.4 Mloc, in 2 minutes

  39. Outline • Goals • Problems and Results • Current Flow Analysis w. +  • Our Solution • Summary

  40. Summary • Elimination of constraint copying • Reformulation of polymorphic subtyping with instantiation constraints • Transfer of CFL-reachability techniques to type-based flow analysis

  41. Scaleable Program AnalysisProject (MSR, spt) [ RF, POPL 01 ] +CS +DI (, ) [ Das, PLDI 00 ] [ FRD, PLDI 00 ] -CS +DI (=, ) +CS -DI (,=) -CS -DI(=,=) research.microsoft.com/spa

  42. Summary • Type-based flow analysis • all flow in , n = typed pgm size • context-sensitive (polymorphism) • directional (subtyping) • demand-driven algorithm • incorporates label-polymorphic recursion • works directly on H.O. programs • structured data of finite type • unbounded data structures via approx.

  43. CFL Formulation SPN P M P |[P | N  M N |]N | M [kM]k |MM |d |

  44. Type System e = let max(s:a,t:b) = … in (max(x0:a0,y0:b0), max(x1:a1,y1:b1)) end ac bc aa0, bb0, cc0, aa1, bb1, cc1 ; ;  |- e: c0*c1

  45. Type System e = let max(s:a,t:b) = … in (max(x0:a0,y0:b0), max(x1:a1,y1:b1)) end instantiation constraints ac bc aa0, bb0, cc0, aa1, bb1, cc1 ; ;  |- e: c0*c1 subtyping constraints type environment

More Related