Runtime Techniques for Efficient and ReliableProgram Execution

Harry Xu CS 295 Winter 2012

Who Am I

• Recently got my Ph.D. (in 08/11)• Interested in (static and dynamic) program

analysis– Theoretical foundations (mathematical models)– Applications (e.g., compiler, performance tuning,

verification, security, distributed computing, etc.)

• Most recent interest--- software bloat analysis

Who Are You

• Your name• Advisor• Research interests• What do you expect from the class

Program Analysis

• Dynamic analysis v.s. static analysis

Static analysis Dynamic analysis

Analyze static code Analyze running program

Find problems in any execution Find problems in some real execution

Sound: no false negatives* Unsound: false negatives

Imprecise: false positives Precise: often no false positives

Doesn’t slow running program Slows executing program

Analysis Dimensions

• Analysis scope– Intraprocedural– focusing on each individual

function – Interprocedural– considering calling structures

• Context sensitivity– Context-sensitive– distinguishing different callers

when analyzing each function– Context-insensitive– get a unified solution

Concerns

• Precision– Requires higher context-sensitivity, finer-grained

abstractions, etc. • Scalability– The opposite

• Find the right balance• Combine static and dynamic analyses

Application Domains

• Static analysis– Static compiler (e.g., type system and

optimizations)– Verification tools – prove a program is “bug-free”

• Dynamic analysis– (Dynamic) optimizing compiler (e.g., providing

feedback)– Testing – find bugs in specific program runs– Performance tuning

This Class

• Focus on dynamic analysis• Foundations– Various profiling techniques– Dynamic slicing– Calling context encoding

• Applications– Memory leak detection– Software bloat detection– Finding bugs– Providing feedback in a dynamic compiler

This Class

• A research seminar• Emphasize both– Fundamental technology (i.e., science) – Practical problems (i.e., engineering)

• CS Research – Solving engineering problems with scientific

solutions

Foundations I – Profiling

• A run-time technique that gathers execution information – E.g., total # objects

created during the execution

• How--- via program instrumentation

void main(String[] s){ A a = new A(…);

for(…){ B b = new B(…);

}

}

long totalObjs = 0;

totalObjs ++;

totalObjs ++;

print(totalObjs);

Foundations I – Profiling

• Kinds– Path profiling (Week 1)– Calling context profiling (Week 4)– Dependence profiling (Week 5)

Foundations II – Dynamic Slicing

• Record all memory accesses and their dependence relationships

• Applications– Automated debugging – Performance analysis

void main(String[] s){

a.f = …; …

c = b.f; }

0x23456789

Foundations III – Context Profiling

• Record calling contexts for method invocations

void m(…){ bar(new A()); //call 1}void n(…){ bar (new B()); //call 2} void bar(A a){ a.f = …; }

m n

bar

call 1 call 2

Foundations III – Context Profiling

• Record calling contexts for method invocations

• Applications– Context-sensitive

dynamic analysis– Interprocedural compiler

optimization

void m(…){ bar(new A()); //call 1}void n(…){ bar (new B()); //call 2} void bar(A a){ a.f = …; }

m n

bar bar

call 1 call 2

Application I – Memory Leak Detection

• C/C++ memory leaks– a = malloc (…), but no free(a)– Can be detected by both static and dynamic

analyses• Memory leaks in managed programs (week 3

and 7)– Caused by unnecessary references– It is undecidable to determine object liveness – Use dynamic analysis with various heuristics

Application II – Software Bloat Analysis

• Inefficient run-time work and resource usage to achieve simple tasks

• Surprisingly common– Supporting thousands of users (millions are expected)

• Consequences for scalability, power usage, and performance

• Week 3 and 8

Application III – Bug Detection

• Use dynamic analysis to find functional bugs (Week 7 and 8)

• We are not going to cover– Concurrency bug detection– Systematic testing

• One security paper (DieHarder)

Application IV – Optimizing Compiler

• Use dynamic analysis to provide feedback to direct optimizations (Week 10)

• Dynamic analyses exist in almost all modern dynamic compilers

Grading Policy I

• Paper critiques (15%)– Problem definition– Key insights/contributions– Weakness/flaws– Opportunities for future work– Your problems in understanding the paper

• Due 6pm the day before the class• Presenters are exempt from writing critiques for

papers they are presenting

Grading Policy II• Paper presentations (30%)

– Two presentations on similar topics in one class– 30 mins for each

• Important presentation skills– Focus on high-level ideas– Illustrate basic ideas using concrete examples and pictures– Do not copy algorithms/formulae/complex examples from the

paper– Include interesting/non-trivial questions you want discuss in

the class• Register for papers before Friday Jan 13

Grading Policy III

• In-class discussion (15%)– Assume your audience has read the paper– Try to say non-obvious, interesting things– Depth is more important than breadth

Grading Policy IV

• Projects (30%)– Either by yourself or with another student– Try to work on an ambitious project that may not

work eventually, rather than a simple project that is guaranteed to work

– It is a good idea to make it your own research project, rather than think of it as something to fulfill the class requirement

– Let’s publish them!!!

Important Notice

• Paper critiques for the first two papers are due 6pm Tuesday (1/10)

• Paper selection due on Friday (1/13)• Any problem with the current class schedule?