Charles N. Fischer

Low-cost, concurrent checking of pointer and array accesses in C programs

Illegal pointer and array accesses are a major cause of failure for C programs. We present a technique called ‘guarding’ to catch illegal array and pointer accesses. Our implementation of guarding for C programs works as a source‐to‐source translator. Auxiliary objects called guards are added to a user program to monitor pointer and array accesses at run time. Guards maintain attributes to catch out of bounds array accesses and accesses to deallocated memory. Our system has found a number of previously unreported errors in widely‐used Unix utilities and SPEC92 benchmarks. Many commonly used programs have bugs which may not always manifest themselves as a program crash, but may instead produce a subtly wrong answer. These programs are not routinely checked for run‐time errors because the increase in execution time due to run‐time checking can be very high. We present two techniques to handle the high cost of run‐time checking of pointer and array accesses in C programs: ‘customization’ and ‘shadow processing’. Customization works by decoupling run‐time checking from original computation. A user program is customized for guarding by throwing away computation not relevant for guarding. We have explored using program slicing for customization. Customization can cut the overhead of guarding by up to half. Shadow processing uses idle processors in multiprocessor workstations to perform run‐time checking in the background. A user program is instrumented to obtain a ‘main process’ and a ‘shadow process’. The main process performs computations from the orignal program, occasionally communicating a few key values to the shadow process. The shadow process follows the main process, checking pointer and array accesses. The overhead to the main process which the user sees is very low – almost always less than 10%.

Exploiting dead value information

We describe dead value information (DVI) and introduce three new optimizations which exploit it. DVI provides assertions that certain register values are dead, meaning they will not be read before being overwritten. The processor can use DVI to track dead registers and dynamically eliminate unnecessary save and restore instructions from the execution stream at procedure calls and context switches. Our results indicate that dynamic saves and restore instances can be reduced by 46% for procedure calls and by 51% for context switches. In addition, save/restore elimination for procedure calls can improve overall performance by up to 5%. DVI also allows the processor to manage physical registers efficiently, reducing the size requirements of the physical register file. When the system clock rate as proportional to the register file cycle time, this optimization can improve performance. All of these optimizations can be supported with only a few new instructions and minimal additional hardware structures.

The Poe language-based editor project

Editor Allan Poe (Pascal Oriented Editor) is a full-screen language-based editor (LBE) that knows the syntactic and semantic rules of Pascal. It is the first step in development of a comprehensive Pascal program development environment. Poes design began in 1979; version 1 is currently operational on Vax 11s under Berkeley Unix and on HP 9800-series personal workstations. Poe is written in Pascal, and is designed to be readily transportable to new machines. An editor-generating system called Poegen is operational, and much of the language-specific character of Poe is table-driven and retargetable.

A meta-language and system for nonlocal incremental attribute evaluation in language-based editors

The problem of incremental semantics ]I] is to modify a description of the semantics of a computer program P in some minimal way so that it describes the semantics of some slightly different program P’. The main motivation for studying incremental semantics is the design and implementation of LanguageBased Editors (2,3,4,5,6,7]. In a language-based editor, many functions normally reserved to compiler8 are incorporated into a text editor. Every time the user modifies a program that he or she is editing, the editor manipulates an internal representation of the program, performs syntactic and static semantic checks, and somehow reports on the state of correctness of the modified program. The use of attribute grammars allows a particularly convenient representation of the static semantics of a program in an LBE.

On the Minimization of Loads/Stores in Local Register Allocation

This paper presents an algorithm to find the optimal register allocatbn of stmlght-line programs. The basic approach is to search for a shortest path in a weighted DAG. The machine model used here is a loadlstore architecture, common in RISC machines. Although the weighted DAG grows exponentially in the worst case with the number of variables in the input program and the number of available registers. we provide rules to restrict the worst case to a very small domain. With the provided pruning rules, the optimal algorithm is used to evaluate hew well heuristic algorithms perform fur large basic blocks. We also present a heuristic alguritlrm which generally outper-forms other algorithms In large basic blocks.

Affix grammar driven code generation

Affix grammars are used to describe the instruction set of a target architecture for purposes of compiler code generation. A code generator is obtained automatically for a compiler using attributed parsing techniques. A compiler built on this model can automatically perform most popular machine-dependent optimizations, including peephole optimizations. Code generators based on this model demonstrate <italic>retargetability</italic> for the VAX<supscrpt>1</supscrpt>-11, iAPX<supscrpt>2</supscrpt>-86, Z-8000<supscrpt>3</supscrpt>, PDP<supscrpt>4</supscrpt>-11, MC-68000, NS32032, FOM, and IBM-370 architectures.

Probabilistic register allocation

A new global register allocation technique, probabilistic register allocation, is described. Probabilistic register allocation quantifies the costs and benefits of allocating variables to registers over live ranges so that excellent allocation choices can be made. Local allocation is done first, and then global allocation is done iteratively beginning in the most deeply nested loops. Because local allocation precedes global allocation, probabilistic allocation does not interfere with the use of well-known, high-quality local register allocation and instruction scheduling techniques.

Non-syntactic attribute flow in language based editors

The recent computer science literature has contained numerous papers about a new concept in software development, the Language Based Editor, or LBE[l.2,4,7,9,19]. An LBE is similar to standard text editors in that it has capabilities to create files, perform insertions, deletions, and other standard editing operations, but it differs from normal editors in that it possesses knowledge of the syntax and semantics of a particular programming language. With this knowledge, the text editor can notify a user immediately if an attempt is made to create an illegal program. Much attention has been focussed on the syntactic aspects of program editors, or more specifically on the context-free aspect of syntax analysis. Comparatively little attention has been directed at the semantic and context sensitive aspects of LBE’s. Demers, Reps, and Tietelbaum[6] have suggested the use of attribute grammars[13] as an appropriate basis for the semantics of program editors. Reps[15] continued this work and presehted an attribute evaluation technique tailored to incremental changes in an attributed parse tree. Skedzeleski[17] studied timevarying attributes, in which attributes may be evaluated more than once in the attribute evaluation process, and non-local attributes, which are attributes that are functions of attributes not localized within a single production. Although Skedzeleski’s work was not developed for LBE’s, it is similar to the approach presented in this paper.

Description-driven code generation using attribute grammars

The instruction-set of a target architecture is represented as a set of attribute-grammar productions. A code generator is obtained automatically for any compiler using attributed parsing techniques. A compiler built on this model can automatically perform most popular machine-dependent optimizations, including peephole optimizations. The code generator is also easily retargetable to different machine architectures.

SPARE: a development environment for program analysis algorithms

A tool that bridges the gap between the theory and practice of program analysis specifications is described. The tool supports a high-level specification language that enables clear and concise expression of analysis algorithms. The denotational nature of the specifications eases the derivation of formal proofs of correctness for the analysis algorithm. SPARE (structured program analysis refinement environment) is based on a hybrid approach that combines the positive aspects of both the operational and the semantics-driven approach. An extended denotational framework is used to provide specifications in a modular fashion. Several extensions to the traditional denotational specification language have been designed to allow analysis algorithms to be expressed in a clear and concise fashion. This extended framework eases the design of analysis algorithms as well as the derivation of correctness proofs. The tool provides automatic implementation for testing purposes. >