Compile-Time Deallocation of Individual Objects

Sigmund Cherem and Radu Rugina

International Symposium on Memory Management

June, 2006

Motivation

• Memory management challenges• Effective reclamation of memory (precision)• Transparent to users and applications

• Eliminate memory errors (safety)• Minimize run-time overhead (efficiency)• Support real-time systems (predictability)

• Automatic memory management• Eliminate user’s responsibilities on MM

SafetyPrecision

Overhead

SafetyPrecision

Overhead

No MM

SafetyPrecision

Overhead

Manual MM

SafetyPrecision

Overhead

Dynamic MM

SafetyPrecision

Overhead

Dynamic MM

Compile-Time MM

SafetyPrecision

Overhead

Hybrid MM

Dynamic MM

Compile-Time MM

Compile-Time MM

• General Idea• Estimate object lifetimes

• Reachability: objects reachable from stack variables• Ref-counts: objects with some references into them

• Liveness: objects being used

• Transform programs to deallocate objects• Regions: deallocate entire group of heap objects• Stack allocation: place objects on stack frames• Free statements: deallocate individual objects

• Our Approach• Reference count based reachability • Reclaim individual objects using “free” statements

• Flexibility, simplicity and efficiency

Running Exampleclass L { D d; L n; }

class D { int val;}

L removeVal (L x, int v) { … L p = x, c = p.n; while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n; } … return x;}

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

p cn n n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

p cn

n

n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

p cn

n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

p cn

n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

pn

n

d d d… …

c

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

Running Example

p cn

n

d d d… …

Running Example

pn

n

d d d… …

c

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … free(c); ? c = p.n;

}

Running Example

pn

n

d d d… …

c

p,cn n n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … free(c); ? c = p.n;

}

Running Example

pn

n

d d d… …

c

p,cn n n

d d d… …

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) free(c); c = p.n;

}

Running Example

pn

n

d d d… …

c

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) free(c); c = p.n;

}

Running Example

pn

n

d d d… …

c

…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) { free(c.d); free(c); } c = p.n;}

Jfree Compiler

ReferenceCount

Analysis

InsertFree

StatementsJava

BytecodeJava

Bytecode +

Free

ReferenceCount

Analysis

InsertFree

StatementsJava

BytecodeJava

Bytecode +

Free

Reference Count Analysis

• Determines when objects become unreachable• Compute ref-counts for each object at each

program point• Track each object to determine its reference

counts: Tracked Object Analysis• Precision: able to distinguish between object

instances• Scalability at the inter-procedural level: large

reuse of information on method summaries

• Extends shape analysis with local reasoning [HR POPL’05]

• Taking advantage of type safety in Java• Modeling Java programming practices or idioms

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x

y

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x

y

y, n1

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x n1

y

y, n1

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x n1

y

y, n1

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x n1 d1

y

y, n1

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x n1 d1

y

y, n1

• Example concrete memory

• Abstract representation• Use one unit (configuration) to represent

individual objects• Use heap reference counts, hit expressions, and

more information about the object

• Each unit tracked independently

Reference Count Analysis

x n n

d d d d

n

x n1 d1

y

y, n1 (x.n)

Running Example

p c… …

…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; …

c = p.n;

c, n1 (p.n)

Running Example…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; …

c = p.n;

p c… …

c

c, n1 (p.n)

Running Example…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; …

c = p.n;

p c… …

c

c

c, n1 (p.n)

…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; …

c = p.n;

Running Example

p c… …

c

c

c

c, n1 (p.n)

…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; …

c = p.n;

Running Example

p c… …

c

c

c

c, n1 (p.n)

…while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … /* free(c); */ c = p.n;

Running Example

c

p c… …

c

c

c, n1 (p.n)

Other Analysis Details (I)

Abstraction Elements• More than reference counts and hit expressions• Miss expressions: expressions that don’t

reference the object• Expression equivalences: alias information

about neighbors of tracked object

Intra-procedural Analysis• Dataflow analysis that starts at allocation sites• Updates configurations on assignments• Merges some configurations at merge points

Other Analysis Details (II)

Inter-procedural Analysis• Split configuration in halves• Filter non-accessed information

• No need to analyze a portion not used by the callee

• Skip call if accessed portion is empty

• Add extended parameters• Helps preserving precise information about

equivalences

• Analyze callee• Record and use method summaries• Summaries are independent of caller information

• Combine• Recover and merge non-accessed information

ReferenceCount

Analysis

InsertFree

StatementsJava

BytecodeJava

Bytecode +

Free

Transformation

• Goal : automatically insert free statements to reclaim dead objects

• Technique• At points where tracked object becomes

unreachable • Extract expression from responsible statement

e = g; free(e);

• Determine conditions for deallocation (discriminants)

• Look for hit expressions in other configurations• Find a set of expressions that distinguishes them

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … c = p.n;

}

c, n1 (p.n)

c c, p, n1

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if ( ??? ) { free(c); } c = p.n;}

c, n1 (p.n)

c c, p, n1

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) { free(c); } c = p.n;}

c, n1 (p.n)

c c, p, n1

ReferenceCount

Analysis

InsertFree

StatementsJava

BytecodeJava

Bytecode +

Free

Reiteration

• Model a cascade effect of deallocations• Deallocate multiple level structures

• Model the semantics of deallocation statements• Temporarily add nullifications into code

free(x) x.f = null;

• No need to reanalyze whole program• Cleanup and recompute affected part

• Limited to finite number of iterations• Can’t deallocate recursive structures

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) { c.d = null; free(c); } c = p.n;}

Running Example…L p = x, c = p.n;while (c != null) { if (c.d.val == v) { p.n = c.n; c.n = null; } else p = c; … if (p != c) { free(c.d); free(c); } c = p.n;}

Analysis Enhancements

• Variable Equality Analysis• Infer additional equivalences that exist prior to

analysis starting point

• Variable Liveness Analysis• Increases precision by reducing object lifetimes• Allows to deallocate objects earlier

• Variable Uniqueness Analysis• No need for conditional deallocation: decide

deallocation in isolation

• Escape/effect analysis• Accelerate inter-procedural analysis by improving

filtering of information and skipping of calls

Experimental Evaluation

Settings and Analysis Times

• Jfree Compiler System • Soot infrastructure 2.2.2 • SPECjvm98 Benchmarks• Parameters for tuning speed and precision

• E.g. time cut-off to limit analysis time

• Compile-time statistics• Average application size: 547 methods • Average analysis time: 1’37’’ (default

parameters)• Libraries code is analyzed, but not transformed

• JfreeVM Runtime System • JikesRVM 2.3.5, MMTk

Memory Freed%

of

tota

l allo

cate

d

mem

ory

0

20

40

60

80

100compress

jess

raytrace db

javac

mpegaudio

mtrt

jack

0

20

40

60

80

100compress

jess

raytrace db

javac

mpegaudio

mtrt

jack

Default parameters

Memory Freed%

of

tota

l allo

cate

d

mem

ory

0

20

40

60

80

100compress

jess

raytrace db

javac

mpegaudio

mtrt

jack

0

20

40

60

80

100compress

jess

raytrace db

javac

mpegaudio

mtrt

jack

0

20

40

60

80

100compress

jess

raytrace db

javac

mpegaudio

mtrt

jack

Best parameters

Integration with GC

1

2

3

4

5

1.25

1.5

1 2 3 4 51.16 1.33 1.66

Normalized Memory Size

Norm

aliz

ed A

pplic

ati

on

Tim

e

MSFree + MS

Related Work

• Stack Allocation• Blanchet OOPLSA’99, Choi et al. OOPSLA’99, Whaley and

Rinard OOPSLA’99, Bogda and Hoelzle OOPSLA’99, Gay/Steensgard CC’00

• Regions• Tofte and Talpin POPL’94, AFL PLDI’95, • Cherem and Rugina ISMM’04, Chin et al. PLDI’04

• Individual Object Deallocation• Three-valued logic: Shaham et al. SAS’03• Pointer analysis: Guyer et al. PLDI’06

• Shape Analysis• Sagiv et al. POPL’99, Hackett and Rugina POPL’05

Conclusions

• Reference Count Analysis in Java• Extensions to Shape Analysis w/Local Reasoning

• Inserting free statements• Conditional deallocation• Reclaiming structures

• Compiler results • 50% of memory can be reclaimed statically

• Integration with GC • 31% faster for small heaps