Practical Virtual Method Call Resolution for Java Vijay

Practical Virtual Method Call Resolution for Java Vijay Sundaresan, Laurie Hendren, Chrislain Razafimahefa, Raja Vall ee-Rai, Patrick Lam, Etienne Gagnon and Charles Godin Sable Research Group School of Computer Science Mc. Gill University Montreal

The Problem Mouse • Polymorphism: PS 2 Mouse USBMouse Bluetooth. Mouse Point get. XY(){. . . } What happens at pos = mouse. get. XY() ? Point get. XY(); Logitech. Trackball Point get. XY(){. . . } Mighty. Mouse Point get. XY(){. . . }

Motivation 1 Compact Executable Remove functions which are never called 2 Faster Method Calls Identify monomorphic call sites 3 Predictable Flow Reduce number of flows, for other analyses

Class Hierarchy Analysis For every class or instance d, we have Defined by the following recursion: For every class or interface d If d 2 extends d 1 or if d 2 implements d 1

Class Hierarchy Analysis Mouse, PS 2 Mouse, USBMouse, Bluetooth. Mouse, Logitech. Trackball, Mighty. Mouse hierarchy-types Point get. XY(); PS 2 Mouse Point get. XY(){. . . } USBMouse Point get. XY(){. . . } s pe y t - USBMouse, Logitech. Trackball, Mighty. Mouse hie r hy c r a Logitech. Trackball Point get. XY(){. . . } Mighty. Mouse Point get. XY(){. . . } Bluetooth. Mouse Point get. XY(){. . . }

Class Hierarchy Analysis Mouse Sometimes you may need to look up the hierarchy Point get. XY(); ! look-up(PS 2 Mouse. get. XY) = PS 2 Mouse. get. XY PS 2 Mouse Point get. XY(){. . . } USBMouse Point get. XY(){. . . } Logitech. Trackball look-up(Logitech. Trackball. get. XY) = USBMouse. get. XY look-up(Logitech. Trackball. equals) = object. equals Mighty. Mouse Point get. XY(){. . . } Bluetooth. Mouse Point get. XY(){. . . }

Call Graph (pessimistic) For a receiver o of type d, D. m 2 where D. m 2 = look-up(d’. m 2) for all d’ in hierarchy-types(d) C. m 1 o. m 2()

Call Graph public class C extends A { public static void main(String[] p) C. main { A b = new B(); A c = new C(); b. m() c. m() err. println() b. m(); c. m(); System. err. println(c. to. String()); } } c. to. String()

Call Graph A. m C. main b. m() B. m c. m() err. println() c. to. String() C. m Print. Stream. println Object. to. String

Rapid Type Analysis Improvement over Class Hierarchy For a program P – • Get a more accurate result by only considering • Build call graph (and P) iteratively

Variable-Type Analysis If a receiver o may be of type d at run-time, (where d is a subclass of the declared type of o) the n there must be a chain of assignments of the form o = varn– 1 = … = var 1 = new d()

Representative Nodes public class C extends A { parameter C. m. p public String m(Object p) C. m. this { f = new C(); Object v = p; return v. to. String(); C. m. ret } private A f; C. m. v return value local } C. f field receiver

Anatomy of Assignments References plain field array lhs = rhs v v. f v[i] Expressions type cast Can assume w. l. g. that at least one of {lhs, rhs} is plain local ! method call (C)v w = v. m(u 1, ……, un)

Representative Edges public class C extends A { public String m(Object p) { A u, v, w; v = p; C. m. p C. m. v this. f = v; C. m. v C. f w = v. m(u); } } For array or Object references: instead of ! C. m. u A. m. p A. m. this C. m. v C. m. w A. m. ret

Representative Graph public class C extends A { C. m. p public String m(Object p) C. m. this C. f { f = new C(); C. m. v Object v = p; return v. to. String(); C. m. t 0 Object. to. String. this } private A f; } C. m. ret Object. to. String. ret

Instances

Variable-Type Analysis If a receiver o may be of type d at run-time, (where d is a subclass of the declared type of o) the n there must be a path in the representative graph from a node n to representative(o) s. t. d in instances(n)

Variable Type Analysis Improving Performance {B} C. m. p C. m. this C. m. v C. m. t 0 C. m. ret {C} C. f Object. to. String. this Object. to. String. ret {S}

Variable Type Analysis Improving Performance 1 Find Strongly Connected Components {B} C. m. p {C} C. m. this C. f using Tarjan’s algorithm C. m. v C. m. t 0 C. m. ret Object. to. String. this Object. to. String. ret {S}

Variable Type Analysis Improving Performance 2 {B} Propagate Types Along Edges C. m. p {B, C} C. m. this C. f (graph is now a DAG) C. m. v C. m. t 0 {S} C. m. ret {B, C} Object. to. String. this Object. to. String. ret {S}

Declared-Type Analysis • All variables of the same declared type are summarized as a single node • Coarser-grain – Not as accurate as variable-type, but still more accurate than class hierarchy and rapid type – Faster and requires much less space

Experimental Results • Detection of monomorphic call sites