190 likes | 299 Views
Jeff Foster's presentation at the OSQ Retreat (May 9-10, 2001) delivers a comprehensive overview of alias analysis, pointers, and optimizations in programming languages such as C99, C++, and Java. The talk discusses the implementation of type systems for alias analysis and explores the use of the 'restrict' qualifier for improved compiler behavior. Foster emphasizes the importance of automatic alias analysis, type inference, and flow-sensitive type qualifiers in enhancing compiler efficiency and code safety in complex software systems.
E N D
A Type-CheckedRestrict Qualifier Jeff Foster OSQ Retreat May 9-10, 2001
Introduction • Aliasing: A long-standing problem • Pointers are hard to analyze ...*p = 3 ... what is updated? • We need to know for • compilers (optimization) • software analysis tools (OSQ) Jeff Foster, OSQ Retreat, May 9-10, 2001
Alias Analysis • Research: Fully-automatic alias analysis • Type systems • All aliases have same type • Points-to analysis • e1 = e2 e1 points to whatever e2 points to • Results • Type systems work well • May-alias analysis scales to big programs • Usefulness of results? Jeff Foster, OSQ Retreat, May 9-10, 2001
Too Important for Compiler • C, C++, Java, ML, etc. • The compiler discovers all aliasing • FORTRAN • The compiler can assume non-aliasing • C99 • Have the user help the compiler Jeff Foster, OSQ Retreat, May 9-10, 2001
Restrict • C99 Standard int *restrict p = ...; • Let p point to object o • Within p’s scope, all access to o are through p void f(int n, int *restrict p, int *restrict q) { while (n-- > 0) *p++ = *q++; // no aliasing } [ex. from C99 standard] Jeff Foster, OSQ Retreat, May 9-10, 2001
This Work • C99 does not check restrict • Low-level definition of safe use of restrict • Goals of this work • Semantics for restrict • Type system for safe restrict • Soundness proof Jeff Foster, OSQ Retreat, May 9-10, 2001
Examples { int *restrict p = ...; { int *restrict r = p; ...*r... // valid ...*p... // invalid } } { int *restrict p = q; ...*p... // valid ...*q... // invalid } { int *restrict p = ...; int *r = p; ...*r... // valid } Jeff Foster, OSQ Retreat, May 9-10, 2001
Source Language • Lambda-calculus with restrict e ::= x | n | ref e | *e | e1 := e2 | \x.e | e1 e2 | restrict x = e1 in e2 • restrict x = e1 in e2 • x is in scope only within e2 • x is a pointer • x is initialized to e1 • within e2, only x can be used to access *x Jeff Foster, OSQ Retreat, May 9-10, 2001
loc’ fresh [loc’ S’(loc) ] [x loc’] S restrict x = e1 in e2 Big-Step Semantics S e loc; S’ locdom(S’) S *e S’(loc); S’ S e1 loc; S’ , loc error S’ e2 v; S’’ [loc’ error, loc S’’(loc’)] v; S’’ Jeff Foster, OSQ Retreat, May 9-10, 2001
Type System • Type and Effect system t ::= a base type | refr(t) pointer to abstract loc r | t1Lt2 function with effect L L ::= Ø no effect | r access to location r | L1 L2 effect union | L - r effect difference Jeff Foster, OSQ Retreat, May 9-10, 2001
A e : refr(t); L A *e : t; L r A e1 : t1Lt2; L1 A e2 : t1; L2 A e1 e2 : t2; L1 L2 L Type Rules • A e : t; L • In environment A, expression e has type t • evaluating e has effect L Jeff Foster, OSQ Retreat, May 9-10, 2001
Restrict Rule A e1 : refr(t); L1 A restrict x = e1 in e2 : A[x refr’(t)] e2 : t2; L2 r L2 r’A, t, t2 rr’ t2; L1 (L2 - r’) r Jeff Foster, OSQ Retreat, May 9-10, 2001
Soundness • Theorem: If Ø e : t; L, then S e r; S’ where r is not error • Proof: Show subject-reduction property Jeff Foster, OSQ Retreat, May 9-10, 2001
Type Inference • Given program, compute types, locs, effects • Naive algorithm obvious • Add effect variables ranging over L • Perform type inference, ignore , constraints • Check , at end • Polynomial-time algorithm • Efficiency in practice? • Future work: polymorphic recursion • The constraints make things interesting Jeff Foster, OSQ Retreat, May 9-10, 2001
Applications: Optimization • C99: Restrict used for optimizations • Can treat restricted pointer like stack location (whose address isn’t taken) • Optimizations sound with checked restrict • Type system not complete • C99 standard allows hard-to-check uses of restrict • Dead code that access restricted locations allowed • Strange use of restrict in data structures • Multiple restrict pointers into same array allowed Jeff Foster, OSQ Retreat, May 9-10, 2001
Application: Flow-Sensitive Type Qualifiers • Apply Alias Types, Vault techniques to type qualifiers for flow-sensitivity • Problem: Elements of data structures FILE a[...]; spin_lock(a[i]); ... spin_unlock(a[i]); • Goal: Avoid dependent type systems Jeff Foster, OSQ Retreat, May 9-10, 2001
Applications: Strong-Update • Two rules for assignment foo(x) { ... *x = e ...} • If |PTSet(x)| = 1 [[*x]] = [[e]] • If |PTSet(x)| > 1 [[*x]] = [[*x]] [[e]] • Standard Alias Analysis • Points-to sets only grow • Once |PTSet(x)| > 1, lose precision Jeff Foster, OSQ Retreat, May 9-10, 2001
Applications: Strong-Update (2) • Restrict recovers singleton points-to sets foo(int *restrict x) { ... } • Can assume |PTSet(x)| = 1 at beginning of foo • Other aliases of *x cannot be used in foo • Can recover even from complicated aliasing foo(a->b[c].d->f->g[h->i]) Jeff Foster, OSQ Retreat, May 9-10, 2001
Summary • Alias analysis too important to leave to the compiler • Restrict tells compiler where to assume non-aliasing • Use of restrict can be type checked • Type and effect system • Soundness proof uses standard subject-reduction Jeff Foster, OSQ Retreat, May 9-10, 2001