Resolving and Exploiting the $k$-CFA Paradox

semantics: k-CFA ((f e), β̂, σ̂, â) ; (e′, β̂′, σ̂′, â′), where Ê(f, β̂, σ̂) ∋ 〈(λ (x) e′), β̂′′〉 â′ = ⌊l · â⌋k Ê(e, β̂, σ̂) = d̂ β̂′ = β̂′′[x 7→ â′] σ̂′ = σ̂ ⊔ [â′ 7→ d̂] And: Ê(x, β̂, σ̂) = σ̂(β̂(x)) Ê((λ (x) e), β̂, σ̂) = {〈(λ (x) e), β̂〉} Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.5/22 The Paradox of k-CFA Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.6/22 k-CFA is hard It did not take long to discover that the basic analysis, for any k > 0, was intractably slow for large programs. Shivers, Higher-order control-flow analysis in retrospect: Lessons learned, lessons abandoned (2004) Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.7/22 What makes k-CFA hard? Closures. ((λ (f) (f u)(f v)) (λ (x) (λ (y) x))) 1-CFA: ⋆ 〈(λ (y) x), [x 7→ 1]〉 and [1 7→ u]. ⋆ 〈(λ (y) x), [x 7→ 2]〉 and [2 7→ v]. Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.8/22 What makes k-CFA hard? ((λ (f1) (f1 0) 1(f1 1) ) (λ (x1) · · · ((λ (fn) (fn 0) (fn 1) ) (λ (xn) (λ (z) (z x1 . . . xn)))) · · ·)) 1-CFA: ⋆ [x1 7→ 0, . . . , xn 7→ 0] ⋆ [x1 7→ 1, . . . , xn 7→ 0] ⋆ . . . ⋆ [x1 7→ 0, . . . , xn 7→ 1] ⋆ [x1 7→ 1, . . . , xn 7→ 1] k-CFA is complete for EXPTIME (Van Horn and Mairson, ’08). Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.9/22 k-CFA is easy k-CFA of object-oriented programs is in PTIME. Implemented in Datalog (Bravenboer and Smaragdakis, ’09). PTIME ( EXPTIME Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.10/22 A Resolution: OO vs. functional k-CFA Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.11/22 FP in OO and back again A → B ≈ interface Fun { B apply(A a); } Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.12/22 FP in OO and back again ((λ (f) (f u)(f v)) (λ (x) (λ (y) x))) ≈ new Fun() { apply(f) { f.apply(u); f.apply(v); }} .apply(new Fun() { apply(x) { new Fun() { apply(y) { x; }}}}); ≈ class Lam1 { apply(f) { f.apply(u); f.apply(v); }} class Lam2 { apply(x) { new Lam3(x); }} class Lam3 { Lam3(x){this.x = x}; apply(y) { x; }} new Lam1().apply(new Lam2()); ≈ ((λ (f) (f u)(f v)) (λ (x) (let x′ = x in (λ (y) x′)))) ≈ ((λ (f) (f u)(f v)) (λ (x) ((λ (x′) (λ (y) x′)) x))) Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.13/22 An Exploitation: m-CFA Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.14/22 The idea: Flat closures Change the representation of closures: Clo = Lam × (Var → Addr) Clo′ = Lam × Addr At call sites, copy values of closure into the store. Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.15/22 Concrete semantics: m-CFA ((f e), a, σ) ⇒ (e′, a′, σ′), where E(f, a, σ) = 〈(λ (x) e′), a′′〉 a′ = l · a E(e, a, σ) = d d′j = σ(a ′′, yj) {y1, . . . , yn} = fv(e ′) \ {x} σ′ = σ[a′ 7→ (d, d′ 1 , . . . , d′n)] And: E(x, a, σ) = σ(a, x) E((λ (x) e), a, σ) = 〈(λ (x) e), a〉 Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.16/22 Abstract semantics: m-CFA ((f e), â, σ̂) ⇒ (e′, â′, σ̂′), where Ê(f, â, σ̂) ∋ 〈(λ (x) e′), â′′〉 â′ = ⌊l · â⌋m Ê(e, â, σ̂) = d̂ d̂′j = σ̂(â ′′, yj) {y1, . . . , yn} = fv(e ′) \ {x} σ̂′ = σ̂ ⊔ [â′ 7→ (d̂, d̂′ 1 , . . . , d̂′n)] And: Ê(x, â, σ̂) = σ̂(â, x) Ê((λ (x) e), â, σ̂) = {〈(λ (x) e), â〉}semantics: m-CFA ((f e), â, σ̂) ⇒ (e′, â′, σ̂′), where Ê(f, â, σ̂) ∋ 〈(λ (x) e′), â′′〉 â′ = ⌊l · â⌋m Ê(e, â, σ̂) = d̂ d̂′j = σ̂(â ′′, yj) {y1, . . . , yn} = fv(e ′) \ {x} σ̂′ = σ̂ ⊔ [â′ 7→ (d̂, d̂′ 1 , . . . , d̂′n)] And: Ê(x, â, σ̂) = σ̂(â, x) Ê((λ (x) e), â, σ̂) = {〈(λ (x) e), â〉} Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.17/22 Evaluation and conclusion Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.18/22 Speed: Worst-case benchmark Terms k = 1 m = 1 poly.,k=1 k=0 69 ǫ ǫ ǫ ǫ 123 ǫ ǫ ǫ ǫ 231 46 s ǫ 2 s ǫ 447 ∞ 3 s 5 s 2 s 879 ∞ 48 s 1 m 8 s 15 s 1743 ∞ 51 m ∞ 3 m 48 s Resolving and Exploiting the k-CFA Paradox, New England Programming Language and Systems Sysmposium, MIT, December, 2009 – p.19/22