Runtime checking of expressive heap assertions Greta Yorsh, Martin Vechev, Eran Yahav, Bard Bloom

Motivation Reliability of large software systems – illusive concurrency bugs, misuse of interfaces – static analysis are inherently limited Vision: runtime analysis of deep semantic properties with low overhead – testing, debugging, and production – real applications – leverage available system cores 2

Our goal Checking expressive heap assertions at runtime with low overhead – reuse components of parallel GC Enable reasoning about path properties – sharing – reachability through/avoiding – disjointness – domination object ownership (encapsulation) thread ownership (concurrency) stack ownership (escape analysis) 3

public class ConnectionSource { private Connection conn; private boolean used; public Connection getConnection() throws SQLEx { if (!used) { used = true; return conn; } throw new SQLEx(...); } Motivating Example: JdbF public class Database { private ConnectionManager cm; public int insert(...) throws MappingEx { Connection c = cm.getConnection(...);... }... } public class ConnectionManager { private Map conns = Collections.synchronizedMap(new HashMap()); public Connection getConnection(String s) throws MappingException { try { ConnectionSource c = conns.get(s); if (c != null) return c.getConnection(); throw new MappingException(...); } catch (SQLEx e) {... } }... }

Running Thread Stack Database Root Running Thread Stack HashMap Connection Source Connection Source Connection Source Connection Source Connection Static Connection Source Connection Source Connection Manager Connection Manager current thread every connection is reachable from at most one thread

Running Thread Stack Database Root Running Thread Stack HashMap Connection Source Connection Source Connection Source Connection Source Connection Static Connection Source Connection Source Connection Manager Connection Manager current thread every connection is reachable from at most one thread

public class ConnectionSource { private Connection conn; private boolean used; public Connection getConnection() throws SQLEx { if (!used) { used = true; return conn; } throw new SQLEx(...); } Motivating Example: JdbF public class Database { private ConnectionManager cm; public int insert(...) throws MappingEx { Connection c = cm.getConnection(...); assert Phalanx.getThreadReach(c,cm) == 1... }... } public class ConnectionManager { private Map conns = Collections.synchronizedMap(new HashMap()); public Connection getConnection(String s) throws MappingException { try { ConnectionSource c = conns.get(s); if (c != null) return c.getConnection(); throw new MappingException(...); } catch (SQLEx e) {... } }... } every connection is only reachable from one thread (avoiding connection manager)

Common Heap Queries QueryDescription Heappred(o).size() > 0Is o pointed to by a heap object? Sharingpred(o).size() > 1Is o pointed to by two or more heap objects? Reachabilityreach(src).has(dst)Is dst reachable from src? Disjointnesss!(exists Object v; reach(o1).has(v); reach(o2).has(v)) Is there an object reachable from both o1 and o2? Ownership!(exists Object v ; reach(o).has(v) ; !dom(o,v)) Does o dominate all objects reachable from it? Reachability through!reach(o1,cut).has(o2)Does every path from o1 to o2 go through an object in cut Thread ownershipdom(Thread.currentThread(), o)Does the current thread dominate o?...……

Subtle Semantics dom(x,y) = ? 9 Root Running Thread Stack y y x x 

Tool: Phalanx JML extended with additional primitives – reach(Object o, Object[] avoiding) – pred(Object o) – dom(Object o1,Object o2) – … Modified JML compiler maps common queries to efficient implementation in Phalanx runtime

Experimental evaluation Implementation on top of QVM platform – IBM J9 production virtual machine – can leverage QVM adaptive overhead manager – new parallel algorithms for common queries Implementation based on JVMTI – less efficient, no parallel algorithms – portable

Heap Assertions in Real Applications

Disposal of Shared SWT Resources replace code of the form: exp.dispose(); with code of the form if (Phalanx.isShared(exp)) Phalanx.warning(”disposal of \ shared resource”+exp) ; exp.dispose();

Redundant Synchronization replace code of the form: synchronized(exp) {... } with code of the form synchronized(exp) { if(Phalanx.dom(Thread.currentThread(),exp)) Phalanx.warning(”synchronization on \ an owned object”+exp) ;... }

Summary common heap queries and usage scenarios new JML primitives modified JML compiler subtle semantics implementation – parallel implementation in J9 production jvm – portable implementation in JVMTI experimental evaluation – real-world applications – performance benchmarks 15