Using ZBDDs in Points-to Analysis

1. Ondrej Lhotak D. R. Cheriton School of Computer Science, University of Waterloo Using ZBDDs in Points-to Analysis Stephen Curial Jose Nelson Amaral Department of Computing Science University of Alberta LCPC 2007

2. LCPC Introduction • Points-to analysis is important • Many compiler transformations require this information • Precise analysis of large programs often infeasible due to space requirements • Binary Decision Diagrams (BDDs) • Compact representation of relations • Zerro-suppressed BDDs (ZBDDs) • Successfully used in other domains • Circuit design, model checking, verification • Haven’t been used to represent relations • Need to develop relational product operation

3. LCPC Background - What Are Binary Decision Diagrams (BDDs) Legend x1 • Non-terminal Node • BDD Variable x1 x2 x2 • 0 / false / lo -edge x3 x3 x3 x3 • 1 / true / hi -edge 1 • Terminal Node 1 0 OBDD

4. LCPC BDDs are Canonical • 2 reduction rules: • When two BDD nodes p and q are identical, edges leading to q are changed to lead to p, and q is eliminated from the BDD. • A BDD node p whose one-edge and zero-edge both lead to the same node q is eliminated from the BDD and the edges leading to p are redirected to q.

5. LCPC Background - What Are Binary Decision Diagrams (BDDs) x1 x1 x2 x2 x2 x2 x3 x3 x3 x3 x3 x3 1 0 1 0 ROBDD OBDD

6. LCPC Using ROBDDs to represent points-to relations • We compute the may point-to relation: PT = {(a,L1); (a,L2); (b,L1); (b,L2); (c,L1); (c,L2); (c,L3)} L1: a = new O(); L2: b = new O(); L3: c = new O(); a = b; b = a; c = b; After Berndl-Lhotak et al., PLDI03

7. LCPC Using ROBDDs to represent points-to relations v1 v2 v2 v3 v3 v3 v3 v4 v4 v4 v4 v4 v4 v4 v4 1 0 After Berndl-Lhotak et al., PLDI03

8. LCPC Using ROBDDs to represent points-to relations v1 v2 v2 v3 v3 v3 v3 v4 v4 v4 v4 v4 v4 v4 v4 Notice that many elements in the domain are un-assigned. - Potentially wasting space 1 0 After Berndl-Lhotak et al., PLDI03

9. LCPC Why do we have don’t care values? • To represent relations efficiently with BDDs a binary encoding is used. • 2n encodings • but domain may be smaller then 2n • E.g. A domain with 3 elements needs to be encoded using 2 bits.

10. LCPC One-of-N encoding • One-of-N encoding can eliminate unused bit patterns. • n elements uses n bits Example of a One-of-N encoding:

11. LCPC ZBDDs are Efficient with a One-of-N Encoding • A ZBDD is efficient if: • There are few vectors in the on-set. • The elements in the on-set have very few 1’s. • For every 1 in an encoding that is part of the onset, there will be a path to the 1 terminal.

12. LCPC What is a ZBDD • 2nd reduction rule changed: • When two BDD nodes p and q are identical, edges leading to q are changed to lead to p, and q is eliminated from the BDD. • A BDD node, p, whose one-edge leads to the zero terminal node and whose zero-edge leads to a node, q, is removed from the BDD and the edges leading to p are redirected to q. [Minato94]

13. LCPC OBDD vs. ROBDD vs. ZBDD x1 x1 x2 x2 x2 x2 x3 x3 x3 x3 x3 x3 1 0 1 0 OBDD ROBDD

14. LCPC OBDD vs. ROBDD vs. ZBDD x1 x1 x2 x2 x2 x3 x3 x3 1 1 0 0 ZBDD (Binary Encoding) ROBDD If a variable in the ZBDD is true and it not tested, it is mapped to 0. E.g. input 110

15. LCPC Using ZBDDs for Points-to Analysis • Points-to analysis algorithm needs relational product to calculate the points-to set due to propagation. • Initial Points-to relation (V x W) & Edge Set (i.e. assignments) (V x H) • RELPROD(Init, Edge, V) • REPLACE(W to V) • UNION(POINTS-TO, PT from PROPAGATION)

16. LCPC BDD Relational Product Example X: p = new O(); Y: q = new O(); q = p; • Pt = { <p,X>, <q,Y>} • Edge = { <q’,p> } We want to propagate the points-to set along the edges. Relational Product will join <p,X> with <q’,p> to give <p, q’, X> then existential quantification will remove p to yield <q’,X>

17. LCPC ZBDD Relational Product Example X: p = new O(); Y: q = new O(); q = p; • Pt = { Xp, Yq} • Edge = { pq’ } • ZBDD Mul gives: { Xpq', Yqpq' } To adapt the ZBDD multiplication algorithm we need to: • Remove tuples that have multiple elements of the same attribute • Add existential quantification • Need to throw out Yqpq' because it has both p and q in the same attribute. • Keep Xpq', but we want to quantify the p out of it, to get Xq'

18. LCPC Experimental Setup • Used 3 points-to analysis frameworks • bddbddb [Whaley and Lam PLDI 2004] • soot / spark [Brendl et al. PLDI 2003] • Paddle [Lhotak and Hendren CC 2006] • Used 10 Java benchmarks: • 3 from Decapo • antlr, bloat, chart • 4 from SPEC JVM 98 • jack, javac, jess, raytrace • 3 other Object Oriented • polyglot, sablecc, soot

19. LCPC ZBDD Experiments bddbddb - Context Insensitive

20. LCPC ZBDD Experiments Brendel et al. - Context Insensitive

21. LCPC ZBDD Experiments Paddle - Context Sensitive

22. LCPC ZBDD Experiments • Impact of ZBDDs depends on the relation: • Increase size greater than 2 times. • Only relations in the context-insensitive analysis grew. • Reduce size more than 8 times. • Depends on the density of the relation.

23. LCPC When to use ZBDDs • Density metric • Number of tuples in the relation divided by the number of possible tuples in the full domain. • Simple test if current analysis doesn’t use BDDs.

24. LCPC bddbddb - Context Insensitive When to use ZBDDs

25. LCPC Brendel et al. - Context Insensitive When to use ZBDDs

26. LCPC Paddle - Context Sensitive When to use ZBDDs

27. LCPC Density Metric • Density • Less than 3 x 10-3 • |ZBDD| < |BDD| • Close to 3 x 10-3 • |ZBDD| ~= |BDD| • Greater than 3 x 10-3 • |ZBDD| > |BDD|

28. LCPC Conclusion • ZBDD based points-to analysis • Represent relations • Relational product algorithm • Implementation of ZBDD based points-to analysis • Reduced size for some context insensitive relations • Reduced the size for all context sensitive relations • Relational density metric • Predict ZBDD vs. BDD

29. LCPC ZBDD Relational Product • The relational product algorithm for BDDs is an existential quantification of a conjunction. • x.(f•g) = (f•g)[0/x] + (f•g)[1/x]) • Multiplication for ZBDDs is analogous to conjunction in BDDs • Multiplication algorithm existed • Develop algorithm that combines existential quantification with multiplication. • Performs early quantification like the BDD version.

30. LCPC ZBDD Relational Product • To use ZBDDs in points-to analysis needed to create a Relational Product Operator. • In relational calculus, essentially a natural join followed by project. • Given two functions f(x, …)andg(x, ...), does a value of x exist that makes the conjunction of f and g true? x.(f•g) = (f•g)[0/x] + (f•g)[1/x])

31. LCPC ZBDD Relational Product ZBDD ZRelProd(ZBDD p, ZBDD q, Set pd) 1 if p.top < q.top 2 then return ZRelProd(q, p, pd) 3 if q = 0 4 then return 0 5 if q = 1 6 then return Subset0(p, pd) 7 x ← p.top 8 (p0, p1) ← factors of p by x 9 if x ∈ pd 10 then 11 (q0, q1) ← factors of q by x 12 return union(ZRelProd(p1, q1, pd), ZRelProd(p0, q0, pd)) 13 else 14 return node(x, ZRelProd(p1, q, pd), ZRelProd(p0, q, pd))

32. LCPC ZBDD Relational Product • The relational product algorithm for BDDs is an existential quantification of a conjunction. • x.(f•g) = (f•g)[0/x] + (f•g)[1/x]) • Multiplication for ZBDDs is analogous to conjunction in BDDs • Multiplication algorithm existed • Develop algorithm that combines existential quantification with multiplication. • Performs early quantification like the BDD version.