dynamic object flow analysis (phd defense)

DynamicObject Flow Analysis

PhD defense

Adrian Lienhard

Advisor: Oscar Nierstrasz

a2a1

image:Image copy:Image

:File

image := Image newFor: file. // creates a1copy := image duplicate. // creates a2

name = 'cat.jpg'

7

a2a1


:File


copy delete // file.name := nil

name = nil

8

a2a1


:File



image display// file.name asUrl NullPointerException

name = nil

9

a2a1


:File



image display// file.name asUrl NullPointerException

name = nil

10

Object aliasing is a problem because it introduces hidden dependencies.

11

Dynamic Control Flow Analysis

upload

delete

12


Feature "Upload" Feature "Duplicate" Feature "Delete"

upload

delete

13[Salah and Mancoridis ICSM'04]



upload

delete?

14


a2a1


:File

name = 'cat.jpg'

15

Dynamic Data Analysis

16

[De Pauw, Sevitsky ECOOP’99]

Reference Patterns


[Hill, Noble, Potter JVLC’02]

Ownership Trees

a2

a1


:File

name = 'cat.jpg'

17


a2

a1


:File

name = 'cat.jpg'

?

18


Dynamic Analysis

control flow data data flow

!! ?

method

execution

reference

structure

reference

transfer

19

Dynamic Analysis

control flow data data flow

!! ?

method

execution

reference

structure

reference

transfer

20

Thesis

Object references must be captured and modeled explicitly.

21

a2a1


:File

Runtime

Object Flow

Metamodel

22

a2a1


:File

Object

Runtime

Object Flow

Metamodel

23

1

a2a1


:File

Alias Objectvalue

*

Runtime

Object Flow

Metamodel

24

1

a2a1


:File

Alias Objectvalue

*

origin

*0..1

Runtime

Object Flow

Metamodel

25

* 1Alias Object

value

*

origin

*0..1

Runtime

Object Flow

Metamodel

26

0..1

caller

*Activation

1Alias Object

value

*

origin

*0..1

Runtime

Object Flow

Metamodel

27

context

0..1

caller

*1

*

Activation

1Alias Object

value

*

origin

*0..1

Runtime

Object Flow

Metamodel

28

upload

delete

context

0..1

caller

*1

*

Activation

duplicate

1Alias Object

value

*

origin

*0..1

Runtime

Object Flow

Metamodel

29

30

Object Flow

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

31

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

32

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

33

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

34

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

35

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

36

Alias Objectvalue

1*

*0..1

Activation

context1

*

Detecting flows between classes

origin

37

Alias Objectvalue

1*

*0..1

Activation

context

Method

1

*

1

*


origin

38

Alias Objectvalue

1*

*0..1

Activation

context

Method

Class

1

*

1

*

1

*


origin

Class A

Class B

Class C

39

Class B

Class A

value

1*

*0..1

context1

*

1

*

1

*


originAlias

Activation

Method

Class

Object

Class C

40

41

Inter-unit Flow View

42

Chronological propagation

43

Parser (4)

Spanning flows

44

Spanning flows

IRBuilder

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

45

[Lienhard etal.

COMLAN'09]

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

46


[Salah and Mancoridis ICSM'04]

47


a1

image:

:File

48


a1

image:

:File

a2a1

image: copy:

:File

49


a1

image:

:File

a2a1

image: copy:

:File

a2

a1

image: copy:

:File

50


Alias Objectvalue

1*

origin*0..1

Activation

context

0..1

*

1

*

Feature1*

51


Alias Objectvalue

1*

origin

*0..1

Activation

context

0..1

*

1

*

Feature1*

upload

delete

duplicate

52

53

IRC client dependencies

Disconnect

New Console

Receive Message

Send Message

Join Channel

MOTD

Connect

Setup

Open

0 5 10 15 20 25 30 35

Our approach Salah et al.

Open

Connect

Join Channel

Send Message

Object Dependency Graph

of feature Receive Message

54

Open

Connect

Join Channel

Send Message



55

Open

Connect

Join Channel

Send Message



56

Open

Connect

Join Channel

Send Message



57

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

58

Lienhard etal.

ICPC'07

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

59

60

Writing a Unit Test

1. Setup

2. Invoke

3. Assert

duplicate

61

:Image (target)

:File

:Image (return)

existingnew

References

Objects

:Image existing:Image new

Test Blueprint

duplicate

62

:Image (target)

:File

:Image (return)

existingnew

References

1 file := File named: 'cat.jpg'.2 image := Image new.3 image file: file.

Objects


Test Blueprint

duplicate

63

:Image (target)

:File

:Image (return)

existingnew

References


4 copy := image duplicate.

Objects


Test Blueprint

duplicate

64

:Image (target)

:File

:Image (return)

existingnew

References


4 copy := image duplicate.

5 self assert: copy class = Image.6 self assert: copy file == file

Objects


Test Blueprint

duplicate

65

Alias Objectvalue

1*

*0..1

Activation

context

0..1

*

target parameters

*1

duplicate

origin

caller

66

67

InstanceScope>>newMethodScope

IRBuilder>>add: FunctionScope>>lookupVar:

NonClosureScopeFixer>>acceptVarNode:

Program instrumentation

Execution of existing tests

Analysis (Section 6)

object flow +execution trace data

coverage data

Example program execution

Execution Trace Test Blueprint

12

34


68


69

Initial Study ILet a developer use the tool:

12 tests in 2h


70

Initial Study IIRewrote assertions of 14 existing tests:

72 identical, 12 missed, 5 additional

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

71

Lienhard etal.

CSMR'08

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

72

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

73

75

Specification of object flow tracking by extending language semantics

f := new File

...

return f

Computer

(formal semantics)Source Code

Dynamic

Analysis Data

Example execution

76

allocationf := new File

...

return f

Computer


Dynamic

Analysis Data

Example execution

77

allocation

field-write

f := new File

...

return f

Computer


Dynamic

Analysis Data

Example execution

78

allocation

return

field-write

f := new File

...

return f

Computer


Dynamic

Analysis Data

Example execution

79

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

80

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

81

Problem of conventional debuggers

In 50% of the cases the execution stack contains

essentially no information about the bug's cause.

[Liblit etal. PLDI'05]

82

Back-in-time debugging

Challenges

1. amount of data

2. execution overhead

83

84

Approaches

Omniscient Debugger

Trace-oriented debugger (full)

Trace-oriented debugger (partial)

complete historyoverhead 100x

loss of old historyoverhead 100x

loss of selected historyoverhead 10x

85

Approaches

Omniscient Debugger

Trace-oriented debugger (full)

Trace-oriented debugger (partial)

complete historyloss of old history loss of history

overhead 100x overhead 100xoverhead 10x

Our approachlow overhead

relevant history

86

Delete history when it gets irrelevant

History of origins of objectsPrevious field values of objectsCall stacks in which above appear

Before deletion

87

After deletion

Before deletion

88

89

header

field_1

field_2

....

field_n

header

value

context

origin

predecessor

...

header

...

header

field_1

field_2

....

field_n

header

...

regular objects

pointer

alias

Object Flow VM

Typical model Object Flow VM

Capturing historical object state

image height: 17

t3

image := Image new

t1 t2image height: 42

90

image: @t1 nilheight


image height: 17

t3

image := Image new


91

image: @t2

@t1

17

nil

predecessor

height


image height: 17

t3

image := Image new


92

image:

@t2

@t3

@t1

17

42

nil

predecessor

predecessor

height


image height: 17

t3

image := Image new


93

image:

@t2

@t3

@t1

17

42

nil

predecessor

predecessor

height


image height: 17

t3

image := Image new


Alias Objectorigin

predecessor

0..1 0..1

fields

* 1

94

95

Evaluation memory usage (1)

0

5e+08

1e+09

1.5e+09

2e+09

2.5e+09

0 200 400 600 800 1000 0

2e+06

4e+06

6e+06

8e+06

1e+07

#classes

Number of aliases allocated (left Y-axis)Number of aliases in memory (right Y-axis)Number of objects in memory (right Y-axis)

96


0

1e+06

2e+06

3e+06

4e+06

5e+06

6e+06

7e+06

0 2 4 6 8 10 12 14 16 18 0

10

20

30

40

50

%

#samples

Number of aliases allocatedNumber of aliases in memoryNumber of objects in memory

Ratio between aliases in memory and allocated

97


0

1e+06

2e+06

3e+06

4e+06

5e+06

6e+06

7e+06

8e+06

9e+06

1e+07

5 10 15 20 25

#requests

Number of aliases allocatedNumber of aliases in memoryNumber of objects in memory

98

Evaluation run-time overhead

Overhead GC

Recording off 1.15 1.6%

Recording on 3.84 27.6%

Largest overhead: 6.9

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

99

Lienhard etal.

ECOOP'08

Object Tracking

Visualizing

Object Flows

Feature

Dependencies

Test

Blueprints Runtim

e M

onito

ring

in th

e V

MAlias Objectorigin

Activation

Metamodel

dynamic object flow analysis (phd defense)

Technology

image copy

image duplicate

image a1a2

activation object flow

alias object value

image runtime a1a2

activation feature

alias object originvalue38