Practical Virtual Method Call Resolution for Java

1. Practical Virtual Method Call Resolution for Java Vijay Sundaresan, Laurie Hendren, Chrislain Razafimahefa, Raja Vall ́ee-Rai, Patrick Lam, Etienne Gagnon and Charles Godin Sable Research Group School of Computer Science McGill University Montreal

2. The Problem Mouse USBMouse PS2Mouse BluetoothMouse LogitechTrackball MightyMouse • Polymorphism: Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(); What happens at pos = mouse.getXY() ?

3. Motivation 1 Compact Executable Remove functions which are never called 2 Faster Method Calls Identify monomorphic call sites 3 Predictable Flow Reduce number of flows, for other analyses

4. Class Hierarchy Analysis For every class or instance d, we have Defined by the following recursion: For every class or interface d If d2extendsd1 or if d2implementsd1

5. Class Hierarchy Analysis Mouse USBMouse PS2Mouse MightyMouse BluetoothMouse LogitechTrackball Mouse, PS2Mouse, USBMouse, BluetoothMouse, LogitechTrackball, MightyMouse hierarchy-types Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(); hierarchy-types USBMouse, LogitechTrackball, MightyMouse

6. Class Hierarchy Analysis Mouse USBMouse PS2Mouse BluetoothMouse LogitechTrackball MightyMouse Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(){ ... } Point getXY(); look-up(PS2Mouse.getXY) = PS2Mouse.getXY look-up(LogitechTrackball.getXY) = USBMouse.getXY look-up(LogitechTrackball.equals) = object.equals Sometimes you may need to look up the hierarchy !

7. Call Graph (pessimistic) For a receiver o of type d, D.m2 C.m1 o.m2() where D.m2 = look-up(d’.m2) for all d’ in hierarchy-types(d)

8. Call Graph public class CextendsA { public static voidmain(String[]p) { A b = new B(); A c = new C(); b.m(); c.m(); System.err.println(c.toString()); } } C.main b.m() c.m() err.println() c.toString()

9. Call Graph A.m C.main PrintStream .println b.m() c.m() B.m err.println() Object.toString c.toString() C.m

10. Rapid Type Analysis Improvement over Class Hierarchy For a program P – • Get a more accurate result by only considering • Build call graph (and P) iteratively

11. Variable-Type Analysis If a receiver o may be of type d at run-time, (where d is a subclass of the declared type of o) then there must be a chain of assignments of the form o = varn = varn–1 = … = var1 = newd()

12. Representative Nodes public class CextendsA { publicString m(Object p) { f = new C(); Object v = p; return v.toString(); } privateA f; } C.m.p parameter C.m.this receiver C.m.ret return value C.m.v local C.f field

13. Anatomy of Assignments References lhs =rhs plain v field v.f array v[i] Expressions type cast (C)v Can assume w.l.g. that at least one of {lhs, rhs} is plain local method call w = v.m(u1,……,un) !

14. Representative Edges public class C extends A { public String m(Object p) { A u, v, w; C.m.p C.m.v v= p; C.m.v C.f this.f = v; C.m.u A.m.p w = v.m(u); C.m.v A.m.this } } C.m.w A.m.ret For array or Objectreferences: instead of !

15. Representative Graph public class CextendsA { publicString m(Object p) { f = new C(); Object v = p; return v.toString(); } privateA f; } C.m.p C.f C.m.this C.m.v Object.toString.this C.m.t0 Object.toString.ret C.m.ret

16. Instances

17. Variable-Type Analysis If a receiver o may be of type d at run-time, (where d is a subclass of the declared type of o) then there must be a path in the representative graph from a node n to representative(o) s.t.d in instances(n)

18. Variable Type Analysis Improving Performance C.m.p {B} {C} C.f C.m.this C.m.v Object.toString.this C.m.t0 Object.toString.ret C.m.ret {S}

19. Variable Type Analysis Improving Performance {C} C.m.p {B} 1 C.f C.m.this Find Strongly Connected Components using Tarjan’s algorithm C.m.v Object.toString.this C.m.t0 Object.toString.ret C.m.ret {S}

20. Variable Type Analysis Improving Performance {B,C} C.m.p {B} 2 C.f C.m.this Propagate Types Along Edges (graph is now a DAG) C.m.v {B,C} Object.toString.this C.m.t0 Object.toString.ret {S} C.m.ret {S}

21. Declared-Type Analysis • All variables of the same declared type are summarized as a single node • Coarser-grain • Not as accurate as variable-type, but still more accurate than class hierarchy and rapid type • Faster and requires much less space

22. Experimental Results • Detection of monomorphic call sites