the ppa algorithm
DESCRIPTION
The PPA Algorithm. Jeff Da Silva September 10 th , 2004. *A = ~. ~ = *B. The Pointer Alias Analysis Problem. Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location. *A = ~ ~ = *B. Pointer Analysis Issues. - PowerPoint PPT PresentationTRANSCRIPT
The PPA Algorithm Jeff Da SilvaSeptember 10th, 2004
The Pointer Alias Analysis Problem
Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location.
*A = ~ ~ = *B
*A = ~ ~ = *B
Pointer Analysis Issues Scalability vs. Accuracy
Generally, a ‘difficult’ tradeoff exists between: the amount of computation and memory required vs. the accuracy of the analysis.
Precision/Efficiency tradeoff, where is the sweet spot? Which metric should be used?
Direct metric Report performance applied to an optimization Dynamically measure false positives
Which benchmark suite? Are the results reproducible?
Pointer Analysis Issues
Complications associated with pointer arithmetic, casting, function pointers, long jumps, and multithreaded applications. Can these be ignored?
Different pointer analysis uses have different needs. A universal pointer analysis probably doesn’t exist.
Pointer Analysis Design Choices
Flow sensitivity Context sensitivity Heap modeling Aggregate modeling Alias representation Whole program Incremental compilation
Accuracy/Efficiency Tradeoff
• Linear Time Complexity• Inaccurate - many false ‘maybe’ outputs• Memory Required: Negligible
• Doubly Exponential• Accurate – very few ‘maybe’ outputs (control deps/runtime)• Requires Entire Program Info• Memory Required: Oodles• Does not scale well
Probabilistic Pointer Analysis (PPA)
• Polynomial Time Complexity (guessing)• Inaccurate – many false ‘maybe’ outputs, but provides approximate probability metric• Does not require entire program• Memory Required: yet to be determined• Scalable
SPAN
Chen, et al: Only Other PPA
Steensgaard
Address-taken
BDD based
PPA Algorithm Objectives An Interprocedural, Flow Sensitive, Context
Sensitive/Merged approach that uses Transfer Functions.
Must be scalable and should require less space and time than any traditional analysis.
Provide an approximate probability for the ‘Maybe’ output.
Design Choices (tentative)
Flow sensitivity: flow sensitive Context sensitivity: context merged Heap modeling: allocation site Aggregate modeling: arrays aggregated, structs
separated Alias representation: points-to Whole program: not required Incremental compilation: limited support
How is Probabilistic Pointer Analysis used?
SpeculativeParallelized Executable
Source Code
Speculative Parallelizing
(TLS) Compiler
ProbabilisticDependence
Analysis
DynamicProfiling
ProbabilisticPointer
Analysis
The Probabilistic Pointer Analysis (PPA) Problem
Probabilistic Pointer Analysis (PPA): For any pair of pointers, at any point in the program, statically estimate the probability that two pointers point to the same memory location.
*A = ~ ~ = *B
*A = ~ ~ = *B
The Traditional Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
r s t
x y z
a b c
The Traditional Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) x=&s; s=&c;
r s t
x y z
a b c
The Traditional Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) x=&s; s=&c;
r=&b; z=&r;
r s t
x y z
a b c
The Traditional Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) x=&s; s=&c;
r=&b; z=&r;
if(…) y = x;
r s t
x y z
a b c
The Traditional Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) x=&s; s=&c;
r=&b; z=&r;
if(…) y = x;
*x = &a;
r s t
x y z
a b c
The Probabilistic Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
r s t
x y z
a b c
1.0 1.0
1.0 1.0 1.0
1.0
The Probabilistic Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) /*60% taken*/
x=&s; s=&c;r s t
x y z
a b c
0.60.4
0.60.4
The Probabilistic Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) /*60% taken*/
x=&s; s=&c;
r=&b; z=&r;
r s t
x y z
a b c
0.60.4
0.6
0.4
The Probabilistic Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) /*60% taken*/
x=&s; s=&c;
r=&b; z=&r;
if(…) /*10% taken*/
y = x;
r s t
x
y
z
a b c
0.6
0.4
0.6
0.4
0.040.96
The Probabilistic Points-To Graph
int a, b, c;int *r, *s, *t;int **x, **y, **z;
x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;
if(…) /*60% taken*/
x=&s; s=&c;
r=&b; z=&r;
if(…) /*10% taken*/
y = x;
*x = &a;
r s t
xy
z
a b c
0.6
0.4
0.96
0.04
0.6
0.40.4
0.60.6
0.240.16
What is the probability that **y points to a?
A Probabilistic Points-To Matrix
r s t
xy
z
a b c
0.6
0.4
0.96
0.04
0.4
0.60.6
0.24
0.16
x y z r s t a b c
x 0.0 0.0 0.0 0.4 0.6 0.0 0.0 0.0 0.0
y 0.0 0.0 0.0 .04 .96 0.0 0.0 0.0 0.0
z 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
r 0.0 0.0 0.0 0.0 0.0 0.0 0.4 0.6 0.0
s 0.0 0.0 0.0 0.0 0.0 0.0 0.6 .16 .24
t 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
a 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
b 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
c 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
My PPA AlgorithmPPA Algorithm Goal: For each program point generate a probabilistic
points-to graph that specifies, for each pointer, the set of probabilities that it points to each location.
Definition: Probability Analysis Let <p,v> denote a points-to relationship from a pointer
p to a location v. At every static program point s there exists a probability
function P(s, <p,v>) that denotes the probability that p points to v during dynamic program execution.
P(s, <p,v>) = D(s, <p,v>) / D(s)
Where D(s) is the number of times s is (expected to be) dynamically visited and D(s, <p,v>) is the number of times that the points-to relation <p,v> dynamically holds.
Conservative Probability My algorithm is a may alias conservative
analysis. A probability of 0.0 [P(s,<p,v>) = 0.0] indicates that a points-to
relation <p,v> will never hold. The converse is not true.
A probability of 1.0 [P(s,<p,v>) = 1.0] indicates that a points to relation <p,v> will always hold. The converse is not necessarily true: a dynamic points-to
relationship <p,v> that always exists may not be reported with a probability of 1.0.
Location Sets Each node in the graph is implemented with a location
set, which is a triple of the form <name, offset, stride> consisting of: a variable name that describes the memory block, an offset within that block and a stride that characterizes the recurring structure of data vectors (in bytes).
a <a, 0, 0>
b.f <b, f, 0>
c[i] <c, 0, 4>
d[i].g <d, g,12>
struct ds { int e,f,g;}…int a;struct ds b;int c[100]struct ds d[100];
Aggregate modeling: arrays aggregated, structs separated
Special Location Sets Each dynamic memory allocation site has its own name.
Eg: the location set that represents a field f in a structure dynamically located at site s is <s, f, 0>.
Additional Location Sets UND: undefined UNK: unknown NULL: C null
Basic Pointer Assignment Transformations
x = &y Address-of Assignment
x = y Copy Assignment
x = *y Load Assignment
*x = y Store Assignment
Ignoring pointer arithmetic and casting for now.
PPA Let Xs represent the probabilistic points-to graph/matrix
at a specific program point s.
Basic pointer assignment instruction
XIN
XOUT
Claim: There exists a transformation function T(X) for every instruction i, such that XOUT = Ti(XIN).
Linear Transformations A transformation T(X) is linear iff the following
relationships hold for all points-to matrices U and V: T(U+V) = T(U) + T(V) T(cU) = cT(U)
If TB and TA are linear transformations represented by the matrices B and A respectively, then: TB(TA(X)) = [B][A][X]
Linear Points-To Representation A points-to matrix is used to represent the points-to
graph.
Matrix row/column labeling: Locations sets are denoted with L<id> Pointers are denoted with P<id>
Rules for linearity: Pointers can only point to Location sets Location sets always point to themselves with probability
1.0 All rows sum to 1.0
Linear Points-To Representation
int *a; /*L1, P1*/
int *b; /*L2, P2*/
int x[N]; /*L3*/
int y[N]; /*L4*/
int *tmp; /*L5, P5*/
…
~ = (int*)calloc(N, sizeof(int)) /*L6*/;
UND
aa
x
bb tmptmp
NULL UNKy
allocL6
Linear Points-To Representation
int *a; /*L1, P1*/
int *b; /*L2, P2*/
int x[N]; /*L3*/
int y[N]; /*L4*/
int *tmp; /*L5, P5*/
…
~ = (int*)calloc(N, sizeof(int)) /*L6*/;
UND
P1L1
L3
P2L2
NULL UNKL4 L6
P5L5
Points-To Matrix
int *a; /*L1, P1*/
int *b; /*L2, P2*/
int x[N]; /*L3*/
int y[N]; /*L4*/
int *tmp; /*L5, P5*/
…
~ = (int*)calloc(N, sizeof(int)) /*L6*/;
P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
P2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
P5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
Points-To Matrix PropertiesP1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
P2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
P5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
IØ
Ø
The Transformation Matrix For every Basic Pointer Assignment there exists a linear
transformation matrix T such that:
XOUT = TXIN
Basic pointer assignment instruction
XIN
XOUT
The Pointer Assignment Operation
x = &y Address-of Assignment Px -> Ly
x = y Copy Assignment Px -> Py
MATLAB code:
% PPA_ptra: Probabilistic Pointer Analysis pointer assignment function% Returns the PPA ptr assignment transformation matrix
function T = PPA_ptra(ptr, loc, N) T = eye(N); T(ptr,ptr) = 0.0; T(ptr,loc) = 1.0;
Pointer Assignment Example
P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
P5 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/
tmp = a;
S1: P5 -> P1;
T(P5->P1) =
TS1 = eye(12);Ts1(P5,P5) = 0.0Ts1(P5,P1) = 1.0
Pointer Assignment Example
P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
P5 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/
a = x;
S2: P1 -> L3;
T(P1->L3) =
TS2 = eye(12);Ts2(P1,P1) = 0.0Ts2(P1,L3) = 1.0
Combining Transformation Matrices
XOUT = T2 T1 XIN
T2: Basic pointer assignment instruction
XIN
XOUT
T1: Basic pointer assignment instruction
Combining Pointer Assignment Example
P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
P2 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
P5 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/
void swap { tmp = a; a = b; b = tmp;}
S1: P5 -> P1S2: P1 -> P2S3: P2 -> P5
Tswap = TS3 TS2 TS1
Combining Pointer Assignment Example
UND
P1L1
L3
P2L2
NULL UNKL4 L6
P5L5
UND
P1L1
L3
P2L2
NULL UNKL4 L6
P5L5Tswap
Combining Pointer Assignment Example
UND
P1L1
L3
P2L2
NULL UNKL4 L6
P5L5
UND
P1L1
L3
P2L2
NULL UNKL4 L6
P5L5Tswap
0.90.1 0.7 0.3
0.90.1
0.90.10.7
0.3
Control flow and loops Loops are found and back edges are labeled with there
back edge count. [assume all loops have constant trip count for now]
Denoted with a capital letter
All other edges are labeled with there basic block fan-in probability that sums to 1. Denoted with a small case letter
A
p
q
r
N
The Effect of Control Flow
A = TA
A= TC [pTBTA + qTA]
C
Bp
q
The Effect of Control Flow
A
= TD [pTB + qTC] TA
D
Bp q
C
The Effect of Control Flow
A
= Tc [p1TB1 + p2TB2 + … + pnTBn] TA
C
B1
p1 pn
BnB2
p2
…
ExampleP1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK
P1 0.9 0.1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
P5 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0
L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0
L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0
L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0
UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0
Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0
UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0
int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/
void might_alias { if(!RANDOM(10)) a = b;}
BB1:if() /*0.1*/ BB2: S1: P1 -> P2fiBB3:
Tmight_alias = TBB3 [0.1 TBB2 TBB1 + 0.9 TBB1]
Loops – Constant Trip Count
A = TA[TA]N = [TA]N+1 N
A = [ TB [TA]N+1 ]M+1
NB M
Loop Transformation types Identity Converges Periodic Converges and Periodic
for(i=0;i<N;i++){ if(!RANDOM(10)) { a = b; }}
for(i=0;i<N;i++){ swap();}
for(i=0;i<N;i++){ if(RANDOM(10)) { a = b; swap(); }}
P1 P2
P1 0.9N 0.1N
P2 1.0 …
P1 P2
P1 0.0 1.0
P2 1.0 0.0
P1 P2
P1 1.0 0.0
P2 0.0 1.0
If Odd
If Even
Loops – Non-Constant Trip Count
A = 1/(N+1) [ [TA]0 + [TA]1 + … + [TA]N] ] N
Geometric Series Transform [gstr] operation
= gstr(TA, 0, N)
The Characterization Matrix
for(i=0;i<N-1;i++){ if(!RANDOM(10000)) { swap(); b = a; } a[i] = x[i+1];}
XIN
XOUT
XOUT = [Tloop_inner]N-1
Xchar = Tloop_inner x gstr(Tloop_inner, 0, N-1)
Example Results
void swap() { tmp = a; a = b; b = tmp; return;}
void might_alias(){ if(!RANDOM(10)) /*10% taken*/ a = b;}
int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/
L3 L4 L6 UND
P1 ? ? ? ?
P2 ? ? ? ?
PTM
Example Resultsint main() {
a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;
for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }
/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}
Example Resultsint main() {
a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;
for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }
L3 L4 L6 UND
P1 0.0 0.0 0.0 1.0
P2 0.0 0.0 0.0 1.0
PTM - Matlab
L3 L4 L6 UND
P1 0.0 0.0 0.0 1.0
P2 0.0 0.0 0.0 1.0
PTM - Simulation
Example Resultsint main() {
a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;
for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }
L3 L4 L6 UND
P1 0.1 0.9 0.0 0.0
P2 0.0 0.0 1.0 0.0
PTM - Matlab
L3 L4 L6 UND
P1 0.10 0.90 0.0 0.0
P2 0.0 0.0 1.0 0.0
PTM - Simulation
Example Resultsint main() {
a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;
for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }
L3 L4 L6 UND
P1 0.081 0.907 0.013 0.0
P2 0.794 0.079 0.126 0.0
PTM - Matlab
L3 L4 L6 UND
P1 0.08 0.90 0.02 0.0
P2 0.81 0.08 0.11 0.0
PTM - Simulation
Example Results
L3 L4 L6 UND
P1 0.149 0.828 0.023 0.0
P2 0.814 0.072 0.114 0.0
PTM - Matlab
L3 L4 L6 UND
P1 0.14 0.83 0.03 0.0
P2 0.81 0.08 0.11 0.0
PTM - Simulation
/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}
Example Results
L3 L4 L6 UND
P1 0.115 0.867 0.018 0.0
P2 0.804 0.076 0.120 0.0
PTM-CHA - Matlab
L3 L4 L6 UND
P1 0.11 0.87 0.02 0.0
P2 0.81 0.08 0.11 0.0
PTM-CHA - Simulation
/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}
Future Work Currently in the early stages of implementing for SUIF. What happens when Double/Multiple pointers are
introduced? How to deal with casting, irregular control flow, pointer
arithmetic, unknown/library functions? When to propagate the unknown ‘UNK’ location set
Optimizing for time complexity and space. How to best utilize PPA for TLS and/or other compiler
optimizations? Runtime parameters. What is the relationship between data and control?
The End… Any Comments or Questions?