Sept 12 ICSM'04 1

Precise Identification of Side-Effect-Free Methods in Java

Atanas (Nasko) Rountev

Ohio State University

Sept 12 ICSM'04 2

Side-Effect-Free Methods

Side effects of a method: changes to the values of memory locations In C++: global variables, local variables

on the stack, static fields, heap objects In Java: static fields, heap objects

Side-effect-free method: does not make changes that are observable by its callers

This work: static analysis of Java code for identifying side-effect-free methods

Sept 12 ICSM'04 3

Motivation

Program comprehension

Reverse engineering of UML class diagrams: isQuery attrbutes

Code transformations

Specifications (e.g. JML)

Assertions

Simplification for other analyses

Sept 12 ICSM'04 4

Talk Outline

Static analyses for finding methods that are free of side effects Works on a partial program Parameterized by class analysis Tracks transitive modifications of static

fields and observable heap objects

Experiments How many methods are reported by the

analysis as being free of side effects? How many are really free of side effects?

Sept 12 ICSM'04 5

Problem Definition

Analyzed component: set of Java classes

Some methods are designated as boundary methods ( )

Could an unknown caller of a boundary method observe side effects? Static fields Fields of observable

objects

Sept 12 ICSM'04 6

Example

class WordIteratorWordIterator { …

private CharIterator text;

public void setText(CharIterator c) { text = c; }

public int next() { return nextPos(); }

private int nextPos() { … text.nextChar(); … } }

public char m() {

CharIterator t = new CharIterator(“abc”);

return t.nextChar(); } … }

class CharIteratorCharIterator { …

private int curr;

public char nextChar() { … curr++; … } … }

Sept 12 ICSM'04 7

Class Analysis

Which objects does a reference variable point to? Similar question for reference object fields

Set of object names: e.g., One name per class One name per “new” expression

Points-to pairs (x,o)(x,o) : variable x points to object name o (o1.f,o2)(o1.f,o2) : field f of o1 points to o2

Sept 12 ICSM'04 8

Class Analysis

Flow sensitivity: track statement order

Context sensitivity: track calling context Set of context abstractions (x(xcc,o),o) : variable x points to object name o

when the calling context is c

We consider context-sensitive, flow- insensitive class analyses Most class analyses are in this category

Typically, whole-program analyses

Sept 12 ICSM'04 9

Artificial Main

Goal: simulate everything that unknown callers can do with respect to object references

Run a whole-program class analysis on main and the component

Artificial variables and statements

main

Sept 12 ICSM'04 10

Some Points-to Pairs

wi obj1 [WordIter]

ci obj2 [CharIter]

setText.cobj1

setText.thisobj1 text

nextChar.thisobj3

obj3 [CharIter]

t = new CharItert.nextChar()m.tobj1

Sept 12 ICSM'04 11

Direct Side Effects

Observable objects: reachable from the artificial variables in the points-to graph In the example: obj1 and obj2

Direct side effects of a method x.f = … , where x refers to an observable

object new C, when representing an observable

object C.f = … , where f is a static field

Sept 12 ICSM'04 12

Example

setText: this.text = c

nextChar: this.curr++

Direct(setText,obj1) = { obj1.text }

Direct(nextChar,obj2) = { obj2.curr }

obj1setText.thisobj1

obj2nextChar.thisobj2

obj3nextChar.thisobj3

Sept 12 ICSM'04 13

Transitive Side Effects

Transitive side effects of a method Under context c1, calls another method

with some calling context c2 For c2, the callee has side effects

private int nextPos() { … text.nextChar(); … } }

obj1

obj2

nextPos.thisobj1

textDirect(nextChar,obj2) = { obj2.curr }

Trans(nextPos,obj1) = { obj2.curr }

Sept 12 ICSM'04 14

Boundary Methods

class WordIteratorWordIterator { …

public void setText(CharIterator c) { … }

public int next() { … }

public char mm() { … } // free of side effects

class CharIteratorCharIterator { …

public char nextChar() { … } … }

Mod(setText,obj1) = { obj1.text }

Mod(next,obj1) = { obj2.curr }

Mod(nextChar,obj2) = { obj2.curr }

Sept 12 ICSM'04 15

Experimental Study

Small–scale study of: two side-effect analyses based on two

class analyses feasibility of the analysis solution

Class analyses Context-sensitive, flow-insensitive

analysis similar to the one from the example (CSA)

Rapid Type Analysis (RTA): low end of the theoretical precision spectrum

Sept 12 ICSM'04 16

Experimental Study

Seven components from the standard Java libraries Classes that implement some

functionality, plus all their transitive server classes

Boundary methods: provide access to the functionality

Implementation based on the Soot framework (McGill) and the BANE constraint solver (UC Berkeley)

Sept 12 ICSM'04 17

Results from CSA

0

5

10

15

20

25

30

35

40

gzip zip

chec

ked

colla

tor

date

number

bounda

ry

Nu

mb

er o

f m

eth

od

sBoundary methods Side-effect-free methods

Sept 12 ICSM'04 18

Summary of Results

CSA-based analysis: a quarter of the boundary methods are side-effect-free

Perfect precision: we proved that all other methods did have real side effects Manual examination of the code The analysis did not miss any side-effect-

free methods

Surprising result: RTA-based analysis achieves almost the same precision

Sept 12 ICSM'04 19

Conclusions

It is possible to adapt many whole-program class analyses to find side-effect-free methods in partial programs

Preliminary experimental results Significant number of side-effect-free

methods Analyses achieve very good precision

Future work: more comprehensive study