ABCD: Eliminating Array-Bounds Checks on Demand Rastislav Bodík Rajiv Gupta Vivek Sarkar U of Wisconsin U of Arizona IBM TJ Watson recent experiments by Denis Gopan, U of Wisconsin

2 Motivation: type safety Pro: type-safe programs don’t “crash” Con: some violations checked at run time Direct cost: executing the checks checks are frequent, expensive Indirect cost: preventing optimization checks block code motion of side-effect instructions Our goal: safety without performance penalty How? remove redundant checks

3 Talk outline Why remove bounds checks? safety without performance penalty The need for dynamic optimization existing optimizers not suitable an ideal dynamic optimizer ABCD Experiments Summary

4 When to optimize the checks?

5

6 Existing check optimizers Emphasis: precision goal: all checks removed = statically type-safe theorem prover: [Necula, Lee], [Xu, Miller, Reps] range propagation: [Harrison, Patterson] types: [Xi, Phenning] Properties too heavy-weight limited notion of control flow: how to add profile feedback?

7 An ideal dynamic optimizer? A balance between power and economy powerful just enough  only common cases minimize analysis work  efficient IR reduce IR overhead  reuse the IR Scalable optimize only hot checks  profile-directed + demand-driven no whole-program analysis  use “local” info + insert (cold) checks

8 Why optimize on demand?  optimize only the few hot checks number of static checks % of dynamic checks mpegaudio 80 checks analyzed ( not necessarily removed)

9 Talk outline Motivation An ideal dynamic optimizer ABCD “tutorial” 1. Simple... standard SSA 2. Full... extended SSA 3. PRE... profile-directed 4. ABCDE... work in progress Experiments Summary

10 High-level algorithm for each hot array access A[i] do -- optimize upper-bound check ABCD( i < A.length ) -- optimize lower-bound check ABCD( 0  i ) end for this talk

11 1. Simple ABCD i  A.length while ( ) { --i..A[i].. } Simple ABCD = SSA + shortest path

12 1. Simple ABCD 1.build SSA 2.label edges with constraints 3.analyze A[i k ]: is i k < A.length always true?

13 Simple ABCD i 0  A.length – 0 i 2  i 1 – 1 i 1  i 0 – 0 i 1  ø(i 0,i 2 ) i 2  i 1 –1.. A[i 2 ].. i 0  A.length weight(A.length  i 2 ) = 1  i 2  A.length – 1 A.length i2i2 i0i0 i1i1 ø

14 1. Simple ABCD 1.build SSA 2.label edges with constraints 3.analyze A[i k ]: input: a bounds check i k < A.length algorithm: find shortest path p from A.length to i k output: check is redundant if weight(p) > 0

15 2. Full ABCD for (i=0; i < A.length; i++)..A[i].. Full ABCD = SSA ++ + “shortest” path

16 2. Full ABCD 1.build extended SSA: naming of standard SSA not fine-grain enough  add dummy  assignments 2.label edges with constraints 3.analyze: shortest path  optimal path in a hyper-graph

17 Extending the SSA form ø 0 i0i0 i1i1 0 0 –1 0 i2i2 i 1  ø(i 0,i 2 ).. A[i 1 ].. i 2  i 1 +1 i 0  0 T F i 1  A.length–1 A.length – –  i  A.length– 1

18 Extending the SSA form ø 0 i2i2 i0i0 i1i1 0 0 –1 0 0 i3i3 i 1  ø(i 0,i 3 ).. A[i 2 ].. i 3  i 2 +1 i 0  0 T F i 1  A.length–1 A.length 1 i 2  (i 1 )   =shortest  =longest hyper-graph: has two kinds of nodes

19 3. ABCD with PRE f(int A[], int n) { for (i=0; i < n; i++)..A[i].. } if (n <= A.length) unoptimized loop false ABCD with PRE = Full ABCD + profile feedback PRE = partial redundancy elimination

20 3. ABCD with PRE 1.build extended SSA 2.label edges with constraints 3.analyze A[i k ]: Algorithm: i) find paths with “bad” length ii) fix their length by inserting run-time checks Issues: What check to insert? Where to insert the check? When is insertion profitable?

21 ABCD with PRE ø 0 i2i2 i0i0 i1i1 0 0 –1 0 0 i3i3 1 nA.length f(int A[], int n) { for (i=0; i<n; i++).. A[i].. } 0 if (n <= A.length – 0) DONE! constraint edges can be added by inserting run-time checks 

22 4. ABCDE f(int A[], int n, i, j) { for ( ; i < n; i++, j++).. A[j].. } if ( n <= A.length–(j-i)) unoptimized loop When does ABCD fail?

23 ABCDE i2i2 i0i0 i1i1 0 –1 0 0 i3i3 1 n A.length j2j2 j0j0 j1j1 0 –1 0 0 j3j3 0 for (i=j=0 ; i<n; i++,j++) {.. A[j].. } c = j 2 -i 2 if (n <= A.length-( j 2 -i 2 )) c = j 0 -i 0 if (n <= A.length-( j 0 -i 0 ))

24 ABCD is simple yet powerful...

25 A complex example from paper limit = a.length st = –1 while (st < limit) st++ limit – – for (j = st; j < limit; j++) { A[j] += A[j+1] }

26 A complex example from paper limit = a.length st = –1 while (st < limit) st++ limit –– for (j = st; j < limit; j++) { A[j] += A[j+1] }

27 How powerful is ABCD? checks removed [% of all dynamic checks] SPECjvm Symantec Misc. Java 100%

28 Classification of hot checks JIT-like ABCD ABCDE examined AVG checks removed [% of all dynamic checks] “removable”

29 Summary Current speedup: modest, up to about 5% direct cost: in Jalapeno, checks already very efficient indirect cost: few global optimizations implemented (11/99) Analysis time 4 ms / check = visit 10 SSA nodes / check recall 20 checks yields 80% dynamic coverage  80 ms to analyze a large benchmark ! Precision: can be improved with few extensions (ABCD  ABCDE) remaining checks appear beyond compiler analysis  Use ABCD for your bounds-check optimization

30 Classification of hot checks 1. for ()

31 Summary optimize only hot statements demand-driven reduce analysis work sparse IR profile-driven powerful just enough tuned simplicity minimize IR overhead via IR reuse use SSA not interprocedural PRE

32 Lower-bounds checks JIT-esque ABCD ABCDE examined AVG checks removed [% of all checks (dynamic count)]

33 Summary of ABCD local constraints constraint format useful statements global constraint system extended SSA inequality graph solving the constraint system traversing the graph partially redundant checks