110 likes | 232 Views
Constructing Accurate Application Call Graphs For Java To Model Library Callbacks. Weilei Zhang , Barbara Ryder Department of Computer Science Rutgers University. Motivation. Call graphs (CG) are widely used in software engineering and compiler optimisation
E N D
Constructing Accurate Application Call Graphs For Java To Model Library Callbacks Weilei Zhang, Barbara RyderDepartment of Computer ScienceRutgers University
SCAM’06 Motivation • Call graphs (CG) are widely used in software engineering and compiler optimisation • Reference analysis is used to generate CG for object-oriented programs • A precise reference analysis requires a whole-program analysis, e.g. N-CFA, object sensitive analysis • The constructed CG includes both application and library methods as its nodes (whole-program CG) • In many software engineering applications, the calling relationships among library methods are NOT as interesting or important
SCAM’06 Application Call Graph • Application CG represents calling relationships between application methods • Two kinds of edges in application CG: • direct: application method x may call y directly • callback: x may call a library method that may eventually call back y through method calls in the library x→ l1 → l2 → .....→ ln → y (li : a library method) • Comparison: whole-program CG vs. application CG • Whole-program CG is inaccurate in representing callback relationship between application methods • Whole-program CG may contain too much information • Library becomes larger and larger in modern software
SCAM’06 “Library” in Multi-tier Software Architecture • Where to draw the line for java library? • Narrow: java SE(EE) libraries, as used in the experimental study of this paper • Broad: in a multi-tier software architecture, the subprograms in lower tiers can be considered as libraries to the upper tiers Application Library can be overwhelmingly large in modern software compared to the application program under investigation. Application CG is more manageable than whole-program CG. Middleware Java EE Platform Java SE Platform
SCAM’06 Library Calls Whole-program CG Is Inaccurate in Representing Callback Relationship class App{ StringBuffer local; StringBuffer appendA(){ A a=new A(); return (local.append(a));} StringBuffer appendB(){ B b=new B(); return (local.append(b)); } } class A{ String toString(){...} } class B{ String toString(){...} }
SCAM’06 Whole-program CG Is Inaccurate in Representing Callback Relationship App.appendA() class App{ StringBuffer local; StringBuffer appendA(){ A a=new A(); return (local.append(a));} StringBuffer appendB(){ B b=new B(); return (local.append(b)); } } class A{ String toString(){...} } class B{ String toString(){...} } StringBuffer.append(Object) Library String.valueOf(Object) A.toString() App.appendA() callback A.toString()
SCAM’06 Whole-program CG Is Inaccurate in Representing Callback Relationship App.appendB() class App{ StringBuffer local; StringBuffer appendA(){ A a=new A(); return (local.append(a));} StringBuffer appendB(){ B b=new B(); return (local.append(b)); } } class A{ String toString(){...} } class B{ String toString(){...} } StringBuffer.append(Object) Library String.valueOf(Object) B.toString() App.appendB() callback B.toString()
SCAM’06 Whole-program CG Is Inaccurate in Representing Callback Relationship App.appendA() App.appendB() class App{ StringBuffer local; StringBuffer appendA(){ A a=new A(); return (local.append(a));} StringBuffer appendB(){ B b=new B(); return (local.append(b)); } } class A{ String toString(){...} } class B{ String toString(){...} } StringBuffer.append(Object) Library String.valueOf(Object) A.toString() B.toString() App.appendA() App.appendB() callback callback A.toString() B.toString()
SCAM’06 Va-DataReachft to Resolve Callbacks Accurately and Automatically App.appendA() App.appendB() • DataReach(Fu et al. TSE 2005): to resolve control-flow (call path) reachability via data reachability analysis • Call paths requiring receiver objects of a specific type can be shown to be infeasible, if those types of objects are not reachable through dereferences at the relevant call site. • Va-DataReachft(SCAM 2006): a call-site specific reference analysis and escape analysis are performed at the same time for each library call to derive callbacks automatically append(a) append(b) StringBuffer.append(Object) Library String.valueOf(Object) Object.toString() A.toString() B.toString() App.appendA() App.appendB() callback callback A.toString() B.toString()
SCAM’06 Contributions • A new variant of the data reachability algorithm is proposed (Va-DataReach) and fine tuned specifically to resolve library callbacks accurately (Va-DataReachft) • The algorithm is implemented and experimented . The experimental study shows that the algorithm is practical and eliminates a large amount of spurious callback edges • For all spec-jvm98 benchmarks, on average, the number of callback edges is reduced from whole program call graph (generated by a points-to analysis) by 74.97% • The algorithm finishes in reasonable time (the longest is 781 seconds, for javac, which has 2432 library calls)
SCAM’06 Thanks!