Abstracting Runtime Heaps for Program Understanding

0.73 MB·English

by  Mark Marron

Abstracting Runtime Heaps for Program Understanding
MarkMarron1 CesarSanchez1,2 ZhendongSu3 ManuelFahndrich4
1IMDEASoftwareInstitute 2CSIC 3UCDavis 4MicrosoftResearch
{mark.marron,cesar.sanchez}@imdea.org,[email protected],[email protected]
2 Abstract. Modern programming environments provide extensive support for
1 inspecting,analyzing,andtestingprogramsbasedonthealgorithmicstructureof
0 aprogram.Unfortunately,supportforinspectingandunderstandingruntimedata
2 structuresduringexecutionistypicallymuchmorelimited.Thispaperprovidesa
generalpurposetechniqueforabstractingandsummarizingentireruntimeheaps.
n
a Wedescribetheabstractheapmodelandtheassociatedalgorithmsfortransforming
J aconcreteheapdumpintothecorrespondingabstractmodelaswellasalgorithms

6 formerging,comparing,andcomputingchangesbetweenabstractmodels.The
abstractmodelisdesignedtoemphasizehigh-levelconceptsaboutheap-baseddata

] structures,suchasshapeandsize,aswellasrelationshipsbetweenheapstructures,
L
suchassharingandconnectivity.Wedemonstratetheutilityandcomputational
P
tractabilityoftheabstractheapmodelbybuildingamemoryprofiler.Wethenuse
s. thistooltocheckfor,pinpoint,andcorrectsourcesofmemorybloatfromasuite
c ofprogramsfromDaCapo.
[

1
v 1 Introduction
7
2
Modernprogrammingenvironmentsprovideexcellentsupportforvisualizingandde-
3
bugging code, but inspecting and understanding the high-level structure of the data
1
. manipulated at runtime by said code is typically not well supported. Visualizing en-
1
tire runtime heap graphs is a non-trivial problem, as the number of nodes and edges
0
istypicallysolargethatdisplayingthesegraphsdirectly—evenwithexcellentgraph
2
1 visualizationtools—resultsinuselessjumblesofnodesandedges.Asaresult,littleof
: interestcanbegleanedfromsuchvisualizations.
v
Inthispaper,weproposeanabstractdomainforruntimeheapgraphsthatcaptures
i
X
manyfundamentalpropertiesofdatastructuresontheheap,suchasshape,connectivity,
r andsharing,butabstractsawayotheroftenlessusefuldetails.Theabstractheapgraphs
a
wecomputearebothsmallenoughtovisualizeandnavigate,andatthesametimeprecise
enoughtocaptureessentialinformationusefulininteractivedebuggingandmemory
profilingscenarios.Further,theabstractheapscanbecomputedefficientlyfromasingle
concreteheapandfurthermerged/comparedwithotherabstractheapgraphs.fromacross
asetofprogramruns,orfrommultipleprogrampointsinordertogetanevenmore
generalviewoftheheapconfigurationsthatoccurduringprogramexecution.
Example. Figure 1(a) shows a heap snapshot of a simple program that manipulates
expressiontrees.AnexpressiontreeconsistsofbinarynodesforAdd,Sub,andMult,
andleafnodesforConstantsandVariables.Thelocalvariableexp(rectangularbox)
(a) AConcreteHeap. (b) CorrespondingAbstractHeap.
Fig.1.Aconcreteheapandcorrespondingabstraction.
pointstoanexpressiontreeconsistingof4interiorbinaryexpressionobjects,2Var,and
2Constobjects.Localvariableenvpointstoanarrayrepresentinganenvironmentof
Varobjectsthataresharedwiththeexpressiontree.
Figure1(b)showstheabstractheapproducedbyourtoolsfromthisconcreteheap
withthedefaultvisualizationmode.1Theabstractionsummarizestheconcreteobjects
into three distinct summary nodes in the abstract heap graph: (1) an abstract node
representingallinteriorrecursiveobjectsintheexpressiontree(Add,Mult,Sub),(2)an
abstractnoderepresentingthetwoVarobjects,and(3)anabstractnoderepresentingthe
twoConstobjects.Specificdetailsabouttheorderandbranchingstructureofexpression
nodesareabsentintheabstraction,butothermoregeneralpropertiesarestillpresent.
Forexample,thefactthatthereisnosharingorcyclesamongtheinteriorexpression
nodes is apparent in the abstract graph by looking at the self-edge representing the
pointersbetweenobjectsintheinterioroftheexpressiontree.Thelabeltree{l,r}on
theself-edgeexpressesthatpointersstoredinthelandrfieldsoftheobjectsinthis
regionformatreestructure(i.e.,nosharingandnocycles).
Theabstractgraphmaintainsanotherusefulpropertyoftheexpressiontree,namely
thatnoConstobjectisreferencedfrommultipleexpressionobjects.Ontheotherhand,
severalexpressionobjectsmightpointtothesameVarobject.Theabstractgraphshows
possiblesharingusingwideorangecolorededges(ifcolorisavailable),whereasnormal
edgesindicatenon-sharingpointers.Theabstractgraphshowspointernullityviafullvs.
dashedlines–inourexampleallpointers,exceptintheenvironmentarray,arenon-null.
Rudimentary information on the number of objects represented by each node is
encodedintheshading.Nodesthatalwaysabstractasingleobjectaregivenawhite
backgroundwhilenodeswhichrepresentmultipleobjectsareshaded(silverifcoloris
available).Sizeinformationofarraysandothercontainersisencodedbyannotatingthe
typelabelwiththecontainersize(Var[3]toindicateanarrayisoflength3).
1Additionalinformationcanbeobtainedbyhoveringoverthenodes/edgesorbyrestylingfora
specifictaskasinourcasestudiesinsection6.
2
Overview. Thispaperaddressestheproblemofturninglargeconcreteruntimeheapsinto
compactabstractheapswhileretainingmanyinterestingpropertiesoftheoriginalheapin
theabstraction.Ourabstractionissafeinthesensethatpropertiesstatedontheabstract
heapgraphalsoholdinthecorrespondingconcreteheaps.Toachievethisabstraction
safety, we adopt the theory for the design of abstract domains developed in abstract
interpretation[7,25].Thetheoryofabstractinterpretationprovidesageneralframework
for(1)defininganabstractdomainandrelatingittopossibleconcreteprogramstates
and(2)amethodfortakinganabstractdomainandcomputinganover-approximation
ofthecollectingsemanticsforagivenprogramasastaticanalysis.Thestaticanalysis
component of the abstract interpretation framework is not relevant here, as we are
interestedinabstractingruntimeheaps.However,theframeworkforconstructingthe
abstractdomains,aswellasthepropertiesofoperationsforcomparing((cid:118))andmerging
((cid:116)(cid:101)) abstract domain elements, allows us to formally describe the relationship of our
abstractheapgraphstotheirconcretecounterparts,andtoobtainsafeoperationsfor
comparingandsummarizingheapsfromdifferentprogrampointsordifferentprogram
runsinasemanticallymeaningfulway.Theseguaranteesprovideconfidencethatall
inferencesmadebyexaminingtheabstractmodelarevalid.
Ourabstractheapdomainencodesafixedsetofheappropertiesidentifiedinprevious
workonstaticheapanalysis[5,10,20]thatarefundamentalpropertiesofheapsandcan
becomputedefficiently.Thesepropertiesincludethesummarizationofrecursiveand
compositedatastructures,theassignmentofshapeinformationtothesestructuresand
injectivityoffields(giventwodistinctobjectsdoesthefieldfineachobjectpointto
a distinct target). The abstraction is also able to provide information on the number
andtypesofobjectsinthevariousstructures,aswellasnullityinformation.Ourfocus
on a fixed set of heap properties (as opposed to user defined properties) enables the
abstractiontobecomputedefficientlyintimeO((Ob+Pt)∗log(Ob)),whereObisthe
numberofobjectsandPtisthenumberofpointersintheconcreteheap.
Thecontributionsofthispaperare:
– Theabstractdomainforheapgraphsanditsconcretizationfunctionformalizingthe
saferelationshiptoconcreteheaps.
– Anefficientalgorithmforcomputingtheabstractionandalgorithmsforcomparing
andjoiningabstractheaps.
– Graphicalrepresentationsofabstractheapgraphsthatallowon-demandcollapsing
orexpansionofsub-structures,allowingaformofsemanticzoom[8]fromavery
abstractviewoftheheapdowntothelevelofindividualobjects.
– Theconstructionofageneralpurposeheapmemoryprofilerandanalysistoolthat
augmentsthebasicabstractionwithspecializedsupportforprofilingandidentifying
commonmemoryproblemsinaprogram.
– Aqualitativeevaluationofthevisualizationandmemoryprofilerintrackingdown
andidentifyingsolutionstomemoryinefficienciesinarangeofprograms(uptoa
25%reductioninmemoryuse).
3
2 AbstractHeapGraph
Webeginbyformalizingconcreteprogramheapsandtherelevantpropertiesofconcrete
heapsthatwillbecapturedbytheabstraction.Later,wedefinetheabstractheapgraph
andformallyrelatetheabstractiontoitsconcreteheapcounterpartsusingaconcretization
(γ)functionfromtheframeworkofabstractinterpretation.
2.1 ConcreteHeaps
Forthepurposesofthispaper,wemodeltheruntimestateofaprogramasanenvironment,
mappingvariablestovalues,andastore,mappingaddressestovalues.Werefertoan
instanceofanenvironmenttogetherwithastoreasaconcreteheap.Formally,aconcrete
heapisalabeleddirectedgraph(root,null,Ob,Pt,Ty),wherethenodesareformedby
thesetofheapobjects(Ob)andtheedges(Pt)correspondtopointers.Weassumea
distinguishedheapobjectroot∈Obwhosefieldsarethevariablesfromtheenvironment.
Thisrepresentationavoidsdealingwithdistinctsetsofvariablelocationsandmakesthe
formalizationmoreuniform.WealsoassumeadistinguishedobjectnullamongObto
modelnullpointers.ThesetofpointersPt⊆Ob×Ob×Labelconnectasourceobjectto
atargetobjectwithapointerlabelfromLabel.Theselabelsareeitheravariablename(if
thesourceobjectisroot),afieldname(ifthesourceobjectisaheapobject),oranarray
index(ifthesourceobjectisanarray).Finally,Ty:Ob→Typeisamapthatassigns
aconcreteprogramtypetoeachobject.WeassumetheconcretesetoftypesinType
p
containsatleastobjecttypesandarraytypes.Weusethenotationo −→o toindicate
1 2
thatobjecto referstoo viapointerlabel p.
1 2
AregionofmemoryC⊆Ob\{null,root}isasubsetoftheconcreteheapobjects,
notcontainingtherootnodeornull.ItishandytodefinethesetofpointersP(C ,C )
1 2
crossingfromaregionC toaregionC as:
1 2
p
P(C ,C )={o −→o ∈Pt|o ∈C ,o ∈C }
1 2 1 2 1 1 2 2
2.2 ConcreteHeapProperties
Wenowformalizethesetofconcretepropertiesofobjects,pointers,andentireregions
oftheheapthatwelaterusetocreatetheabstractheapgraph.
Type. ThesetoftypesassociatedwitharegionCistheunionofalltypesoftheobjects
intheregion:{Ty(o)|o∈C}.
Cardinality. ThecardinalityofaregionCisthenumberofobjectsintheregion|C|.
Nullity. Apointero →o isanullpointerifo =nullandnon-nullpointerifo (cid:54)=null.
1 2 2 2
Injectivity. GiventworegionsC andC ,wesaythatpointerslabeled pfromC toC
1 2 1 2
p p
areinjective,writteninj(C ,C ,p),ifforallpairsofpointerso −→t ando −→t drawn
1 2 1 1 2 2
fromP(C ,C ),o (cid:54)=o ⇒t (cid:54)=t .Inwords,thepointerslabeled pfromtwodistinct
1 2 1 2 1 2
objectso ando pointtodistinctobjectst andt .
1 2 1 2
4
Shape. WecharacterizeregionsofmemoryCbyshapeusingstandardgraphtheoretic
notionsoftreesandgeneralgraphs.Foradditionalprecision,weconsidertheshapeof
subgraphsformedfromC,andP(C,C)↓ ,i.e.,thesubgraphconsistingofobjectsfromC
L
andpointerswithlabelsl∈Lonly.Thisway,wecandescribe,forexample,thatatree
structurewithparentpointersisstillatreeifweonlyconsidertheleftandrightpointers,
butnottheparentpointers.
– Thepredicateany(C,L)issimplytrueforanygraph.Weuseitonlytoclarifyshapes
invisualizationsthatdon’tsatisfythemorerestrictivetreeproperty.
– Thepredicatetree(C,L)holds,ifP(C,C)↓ isacyclicandthesubgraphP(C,C)↓
L L
doesnotcontainanycrossedges.
2.3 HeapGraphAbstraction
Anabstractheapgraphisaninstanceofstorageshapegraphs[5].Moreprecisely,the
abstractheapgraphsusedinthispaperaretuples:
(root,null,Ob#,Pt#,Ty#,Cd#,Ij#,Sh#)
whereOb# isasetofabstractnodes(eachofwhichabstractsaregionoftheconcrete
heap),andPt#⊆Ob#×Ob#×Label# isasetofgraphedges,eachofwhichabstracts
asetofpointers.Edgesareannotatedwithlabelsfrom,Label#,andarethefieldlabels
andthespeciallabel[].Thespeciallabel[]abstractstheindicesofallarrayorcontainer
elements(i.e.,arraysmashing).
WedistinguisharootnodeinOb#formodelingthevariableenvironmentasfieldson
root.Anotherdistinguishednodenullisusedtorepresentthenullpointer.Theremaining
parts of an abstract heap (Ty#,Cd#,Ij#,Sh#) capture abstract properties of the heap
graph.Ty#:Ob#(cid:55)→2Typemapsabstractnodestothesetoftypesoftheconcretenodes
representedbytheabstraction.Cd#:Ob#(cid:55)→Intervalrepresentsthecardinalityofeach
abstractedregion.Cd#mapseachabstractnodentoanumericalinterval[l,u]∈Interval,
wherethelowerboundlisanaturalnumber,anduisanaturalnumberor∞.
TheabstractinjectivityIj#:Pt#→boolexpresseswhetherthesetofpointersrepre-
sentedbyanabstractedgeisinjective.Finally,theabstractshapeSh#isasetoftuples
(n,L,s)∈Ob#×2Label#×{tree,any}indicatingtheshapesofaregionrepresentedbyn
withedgesrestrictedtoL.
2.4 AbstractionRelation
Wearenowreadytoformallyrelatetheabstractheapgraphtoitsconcretecounterparts
byspecifyingwhichheapsareintheconcretizationofanabstractheap:
(root,null,Ob,Pt,Ty)∈γ(root,null,Ob#,Pt#,Ty#,Cd#,Ij#,Sh#)⇔
∃µ.Embed(µ,Ob,Pt,Ob#,Pt#)
∧Typing(µ,Ob,Ty,Ob#,Ty#)∧Counting(µ,Ob,Ob#,Cd#)
∧Injective(µ,Pt,Pt#,Ij#)∧Shape(µ,Pt,Pt#,Sh#)
5
Aconcreteheapisaninstanceofanabstractheap,ifthereexistsanembeddingµ:Ob→
Ob# satisfyingthegraphembedding,typing,counting,injectivity,andshaperelation
betweenthegraphs.Theauxiliarypredicatesaredefinedasfollows.
Embed(µ,Ob,Pt,Ob#,Pt#)⇔µ(root)=root∧µ(null)=null
∧∀o −→p o ∈Pt.∃l.µ(o )→−l µ(o )∈Pt#∧p∈γ (l)
1 2 1 2 L
Theembedpredicatemakessurethatalledgesoftheconcretegrapharepresentinthe
abstractgraph,connectingcorrespondingabstractnodes,andthattheedgelabelinthe
abstractgraphencompassestheconcreteedgelabel.Theembeddingmappingµ must
alsomapthespecialobjectsrootandnulltotheirexactabstractcounterparts.
Typing(µ,Ob,Ty,Ob#,Ty#)⇔∀o∈Ob.Ty(o)∈Ty#(µ(o))
ThetypingrelationguaranteesthatthetypeTy(o)foreveryconcreteobjectoisinthe
setoftypesTy#(µ(o))oftheabstractnodeµ(o)ofo.
Counting(µ,Ob,Ob#,Cd#)⇔∀n∈Ob#.|µ−1(n)|∈Cd#(n)
Thecountingrelationguaranteesthatforeachabstractnoden,thesetofconcretenodes
µ−1(n)abstractedbynhasacardinalityinthenumericintervalCd#(n).
Injective(µ,Pt,Pt#,Ij#)⇔
∀(n ,n ,l)∈Pt#.Ij#(n ,n ,l)⇒∀p∈γ (l).inj(µ−1(n ),µ−1(n ),p)
1 2 1 2 L 1 2
Theinjectivityrelationguaranteesthateverypointersetmarkedasinjectivecorresponds
toinjectivepointersbetweentheconcretesourceandtargetregionsoftheheap.
Shape(µ,Pt,Pt#,Sh#)⇔∀(n,L,tree)∈Sh#.tree(µ−1(n),γ (L))
L
Finally,theshaperelationguaranteesthatforeveryabstractshapetuple(n,L,s),the
concretesubgraphµ−1(n)abstractedbynodenrestrictedtolabelsLsatisfiesthecorre-
spondingconcreteshapepredicates(treeandimplicitlyany).
2.5 VisualRepresentationofAbstractHeapGraphs
Intheiconographyforourabstractgraphvisualizations,thescreenshotsinFigure1(a),
Figure1(b),andsection6,weleverageanumberofconventionstoconveyinformation.
Anedge(root,o,p)whosesourceistherootnoderepresentsthecontentofvariable
p.Insteadofdrawingarootnodewithsuchedges,wesimplydrawavariablenode p
andanunlabelededgetoo.Thus,therootnodeisneverdrawn,asitdoesnotappearas
thetargetofanyedgeinconcreteorabstractgraphs.
Thesetofabstracttypesofanabstractnodeisrepresentedasthelabeloftheabstract
node.Shapeinformationisrepresentedaslabelsontherecursiveselfedgesofabstract
nodes.Anabstractnodewithcardinality1isrepresentedbyawhitebackground.Other
cardinalitiesarerepresentedwithshadedabstractnodes.
We do not draw explicit edges which only point to null. If an edge is associated
withalabelthatcontainsbothpointerstonullandpointerstootherheapobjectswe
foldthepossibilityintotheedgebyusingadashededgeinsteadofafulledge.Finally,
injectiveedgesarerepresentedwithnormalthinedges,whereasnon-injectiveedgesare
representedbywideedges(andifcolorisavailablearealsohighlightedinorange).
6
3 ComputingtheAbstraction
This section describes the computation of the abstract graph from a given concrete
heap.Thetransformationisperformedinthreephases.1)recursivedatastructuresare
identifiedandcollapsedbasedonidentifyingcyclesinthetypedefinitions,2)nodesthat
representobjectsinthesamelogicalheapregionbasedonequivalentedgesoriginating
thesameabstractnodearemerged,andfinally3)abstractpropertieslikecardinality,
injectivity,andshapearecomputedfortheabstractedgesandnodes.
3.1 Partition(µ)Computation
Initially,weassociatewitheachconcreteobjecto anabstractpartitionn representing
i i
anequivalenceusingaTarjanunion-findstructure.Themappingµ fromconcreteobjects
to abstract partitions is given at any point in time by: µ(o)=ecr(n), i.e., by the
i i
equivalenceclassoftheoriginaln associatedwitho.Theunion-findstructuremaintains
i i
thereversemappingµ−1providingthesetofconcreteobjectsabstractedbyanode.The
abstracttypemapTy#canbemaintainedefficientlyintheunion-findstructureaswell.
Figure2(a)showstheinitialstateoftheseequivalencepartitionsforourexample
fromFigure1(a)(onepartitionperobject,plustheroots,andaspecialpartitionfornull).
Eachnodeislabeledwithitspartitionidandthetypesoftheobjectsinthatpartition.
Thefirstabstractionidentifiespartsoftheheapgraphthatrepresentunboundeddepth
recursivedatastructures.Thebasicapproachconsistsofexaminingthetypeinformation
intheprogramandtheheapconnectivityproperties[2,19,9]andensuresthatanyheap
graphproducedhasafinitedepth.Wesaytypesτ andτ arerecursive(τ ∼τ )ifthey
1 2 1 2
arepartofthesamerecursivetypedefinition.
Definition1 (SameDataStructureObjects).Twodistinctobjectso ,o arepartof
1 2
p
thesamedatastructureifthereisareferenceo −→o intheheapandthetypesofthe
1 2
twoobjectsareinthesamedatastructureTy(o )∼Ty(o ).
1 2
Therecursivecomponentsarethusidentifiedbyvisitingeachpointero →o inthe
i j
heapandifo ando areinthesamedatastructureaccordingtoDefinition1,thenwe
i j
unionthecorrespondingabstractnodesn andn .
i j
Figure2(b)showstheresultofmergingSameDataStructureNodesontheinitial
partitionsshowninFigure2(a).Thealgorithmidentifiedobjects1,2,4,5(theAdd,Sub,
andMultobjectsfromtheinterioroftheexpressiontree)asbeingpartoftherecursive
datastructureandreplacedthemwithasinglerepresentativesummarynode.
Next we group objects based on predecessor partitions. The motivation for this
abstractioncanbeseeninFigure2(b)whereVarobjectsinpartitions7and8represent
“variablesintheenvironment”.There’snoneedtodistinguishthemastheyareboth
referencedfromtheenvironmentarray.Similarly,thetwoconstantobjectsreferenced
fromtherecursivecomponentbothrepresent“constantsintheexpressiontree”.
l
Definition2 (EquivalentonAbstractPredecessors).Giventwopointerso →− o and
1 2
o(cid:48) −→l(cid:48) o(cid:48) where µ(o )= µ(o(cid:48)), we say that their target nodes are equivalent when-
1 2 1 1
ever: The labels agree l =l(cid:48), and the target nodes have some types in common, i.e.,
Ty#(µ(o ))∩Ty#(µ(o(cid:48)))(cid:54)=0/.
2 3
7
(a) InitialPartition. (b) MergeSameDataStructure. (c) MergePredecessors.
Fig.2.Stepsinabstractioncomputation.
Thealgorithmforgroupingequivalentobjectsisbasedonaworklistwheremerging
two partitions may create new opportunities for merging. The worklist consists of
pointersthatmayhaveequivalenttargetobjects.Whenprocessingapointerfromthe
worklist we check if we need merge any partitions and, as needed, we merge these
partitions.Finally,allpointersincidenttothemergedpartitionsareaddedtotheworklist.
DuetothepropertiesoftheTarjanunion-findalgorithm,eachpointercanenterthework
listatmostlog(N)times,whereNisthenumberofabstractpartitionsthatcanbemerged,
andE isthenumberofpointers.ThusthecomplexityofthisstepisO(E∗log(N)).
Figure 2(c) shows the result of performing the required merge operations on the
partitions from Figure 2(b). The algorithm has merged the Var regions into a new
summaryregion(sincetheobjectsrepresentedbypartitions7and8inFigure2(b)are
referredtofromthesamearray).SimilarlytheConstpartitionsfromFigure2(b)have
beenmergedastheyarebothstoredinthesamerecursivestructure(theexpressiontree).
Figure2(c)differsfromtheabstractgraphinFigure1(b)wherethereisonlyone
edgebetweentheexpressiontreenodeandthevariablesnode.Thereasonisthat,despite
theunderlyingabstractionbeingamulti-graph,ourvisualizationapplicationcollapses
multi-edges as they frequently lead to poor graph layouts and rarely provide useful
informationtothedeveloper.Also,notethatthereareexplicitreferencestonullandthat
thesewerenotmergedsinceweassociatenotypeswiththenullobject.
3.2 AbstractPropertyComputation
Type,Cardinality,andNullity. TheabstracttypemapTy#hasalreadybeencomputedas
partoftheunion-findoperationonabstractnodes.Similarly,theunion-findoperation
computestheexactcardinality,whichresultsinapreciseintervalvalue[i,i]ifanode
abstractsexactlyiobjects.Thenullityinformationisrepresentedasexplicitedgestothe
nullabstractobject.
l
Injectivity. The Injectivity information for an abstract edge n →− n is computed by
1 2
iteratingoverallpointersfromobjectso representedbyn toobjectso represented
i 1 j
byn withlabel pcompatiblewithl.Wedetermineifeveryconcretetargetobjectis
2
referencedatmostonce,inwhichcasetheabstractedgeisinjective.Otherwise,theedge
isnotinjective.
8
Shape. Thefundamentalobservationthatenablesinterestingshapepredicatestobepro-
ducedfortheabstractgraphsisthattheshapepropertiesarerestrictedtothesubgraphs
representedbyanabstractnode.Inaddition,weallowtheexaminationofavarietyof
furthersubgraphsbyrestrictingthesetoflabelsconsideredinthesubgraph.Restricting
the label set allows e.g., to determine that the {l,r} edges in a tree actually form a
tree, even though there are also parent pointers p, which if included would allow no
interesting shape property to be determined. Selecting the particular subsets of edge
labelstoconsiderinthesubgraphselectionisbasedonheuristics.Wecanstartwithall
labelstogetanoverallshapeandusethatcomputationtoguesswhichlabelstothrow
outandtryagain.Forsmallsetsoflabels,allcombinationscanbetried.
AfterpartitioningtheheapasshowninFigure2(c)thefinalmapfortheobjectsis:
µ−1=(cid:8)n (cid:55)→{o ,o ,o ,o },n (cid:55)→{o ,o },n (cid:55)→{o ,o },n (cid:55)→{o }(cid:9)
1 1 2 4 5 3 3 6 7 7 8 9 9
Thus,forFigure1(b)wedeterminetheabstractedgerepresentingthecrosspartition
l l
pointersetn →− n isnotinjective,sinceitabstractsthetwoconcretepointerso →− o
1 7 4 7
l
and o →− o both refer to the same Var object o . On the other hand, since the two
5 7 7
Constobjectso ,o aredistinct,thealgorithmwilldeterminethatedgerepresenting
3 6
r
thecrosspartitionpointersetn →− n isinjective.TheShapecomputationforthenode
1 3
representingpartition1requiresatraversalofthefourobjects.Astherearenocrossor
backedgesthelayoutforthisistree{l,r}.
4 MergeandComparisonOperations
Manyprogramanalysisandunderstandingtasksrequiretheabilityto1)accumulate
abstractgraphs,and2)compareabstractgraphs(bothfromthesameprogramexecution
andacrossexecutions).Forexample,tosupportcomputingdifferencesintheheapstate
duringprofilingactivitiesorforcomputinglikelyheapinvariants.Sowecannotsimply
trackobjectidentitiesandusethemtocontrolthemergeandcompareoperations.Thus,
thedefinitionsmustbeentirelybasedontheabstractgraphstructure.
4.1 Compare
Formally,theorderbetweentwoabstractgraphsg (cid:118)g canbedefinedviaourabstrac-
1 2
tionrelationfromsubsection2.4as:g (cid:118)g ⇔∀h.h∈γ(g )⇒h∈γ(g ).
1 2 1 2
However,thisisnotdirectlycomputable.Instead,weimplementaO(E)timeap-
proximationofthisrelationthatfirstdeterminesthestructuralequalityoftheabstract
graphsbycomputinganisomorphism,followedbyanimplicationcheckthatallabstract
edgeandnodepropertiesing covertheequivalentnodeandedgepropertiesofg .
2 1
To efficiently compute the subgraph isomorphism between g and g we use a
1 2
property of the abstract graphs established by Definition 2. From this definition we
knowthateverypairofoutedgesfromanodeeitherdifferinthelabelorhavethesame
labelbutnon-overlappingsetsoftypesinthenodestheyreferto.Thus,tocomputean
isomorphismbetweentwographswecansimplystartpairingthelocalandglobalroots
9
andthenfromeachpairmatchupedgesbasedontheirlabelandtypesets,leadingto
newpairings.Thiseitherresultsinanisomorphismmap,oritresultsinapairofnodes
reachablefromtherootsalongthesamepaththathaveincompatibleedges.Anysuch
edgedifferencescanthenbereported.Withthesubgraphisomorphismφ,wedefinethe
orderingrelation:
g (cid:118) g ⇔∀n∈Ob#.Ty#(n)⊆Ty#(φ(n))
1 φ 2 1 1 2
∧∀n∈Ob#.Cd#(n)(cid:118)Cd#(φ(n))∧∀φ(e)∈Pt#.Ij#(φ(e))⇒Ij#(e)
1 1 2 2 2 1
∧∀(φ(n),L ,s )∈Sh#.∃(n,L ,s )∈Sh#.L ⊆L ∧s (cid:118)s
2 2 2 1 1 1 2 1 1 2
Notehowabstractshapepredicatesarecontra-variantinthelabelsetL.Inotherwords,
if a shape property holds for the subgraph based on L , then it holds for the smaller
1
subgraphbasedonthesmallersetL .
2
4.2 Merge
Themergeoperationtakestwoabstractgraphsandproducesanewabstractgraphthat
isanoverapproximationofalltheconcreteheapstatesthatarerepresentedbythetwo
input graphs. In the standard abstract interpretation formulation this is typically the
leastelementthatisanoverapproximationofbothmodels.However,tosimplifythe
computationwedonotenforcethisproperty(formallywedefineanupperapproximation
insteadofajoin).Ourapproachistoleveragetheexistingdefinitionsfromtheabstraction
functioninthefollowingsteps.
Giventwoabstractheapgraphs,g andg oftheformg =(root,null,Ob#,Pt#,
1 2 i i i i i
Ty#,Cd#,Ij#,Sh#)wecandefinethegraph,g ,thatistheresultoftheirmergeasfollows.
i i i i 3
Firstweproducetheunionofthetwographsbysimplyaddingallnodesandedgesfrom
bothgraphs.Oncewehavetakentheunionofthetwographswemergethevariable/static
rootsthathavethesamenames.ThenweuseDefinition1andDefinition2tozipdown
thegraphmergingnodesandedgesuntilnomorechangesareoccurring.Duringthe
mergewebuilduptwomappingsη :g →g andη :g →g fromnodes(edges)in
1 1 3 2 2 3
theoriginalgraphs,g andg respectively,tothenodes(edges)inthemergedgraph.
1 2
Usingthesemappings,wedefineupperapproximationsofallthegraphproperties:
Ty#(n)= (cid:91) Ty#(n )∪ (cid:91) Ty#(n )
3 1 1 2 2
n1∈η1−1(n) n2∈η2−1(n)
Cd#(n)= ∑ Cd#(n )(cid:116) ∑ Cd#(n )
3 1 1 2 2
n1∈η1−1(n) n2∈η2−1(n)
Ij#(e)=(|η−1(e)|=|{n |n →−l n ∈η−1(e)}|)
3 1 2 1 2 1
∧(|η−1(e)|=|{n |n →−l n ∈η−1(e)}|)
2 2 1 2 2
∧ (cid:94) Ij#(e )∧ (cid:94) Ij#(e )
1 1 2 2
e1∈η1−1(e) e2∈η2−1(e)
Thesetoftypesassociatedwiththeresultisjusttheunionofalltypesabstractedbythe
nodeinbothgraphs.Thecardinalityismorecomplicatedtocompute.Itcomputesthe
10