Kwang-Moo Choe

Points-to analysis for JavaScript

JavaScript is widely used by web developers and the complexity of JavaScript programs has increased over the last year. Therefore, the need for program analysis for JavaScript is evident. Points-to analysis for JavaScript is to determine the set of objects to which a reference variable or an object property may point. Points-to analysis for JavaScript is a basis for further program analyses for JavaScript. It has a wide range of applications in code optimization and software engineering tools. However, points-to analysis for JavaScript has not yet been developed. JavaScript has dynamic features such as the runtime modification of objects through addition of properties or updating of methods. We propose a points-to analysis for JavaScript which precisely handles the dynamic features of JavaScript. Our work is the first attempt to analyze the points-to behavior of JavaScript. We evaluate the analysis on a set of JavaScript programs. We also apply the analysis to a code optimization technique to show that the analysis can be practically useful.

Interprocedural exception analysis for Java

Current JDK Java compiler relies too much on programmer’s specification for checking against uncaught exceptions of the input program. It is not elaborate enough to remove programmer’s unnecessary handlers (when programmer’s specifications are too many) nor suggest to programmers for specialized handlings (when programmer’s specifications are too general). We propose a static analysis of Java programs that estimates their exception flows independently of the programmer’s specifications. This analysis is designed and implemented based on set-constraint framework. Its cost-effectiveness is suggested by sparsely analyzing the program at method-level (hence reducing the number of unknowns in the flow equations). We have shown that our exception analysis can effectively detect uncaught exceptions for realistic Java programs.

An uncaught exception analysis for Java

Current JDK Java compiler relies on programmers declarations (by throws clauses) for checking against uncaught exceptions of the input program. It is not elaborate enough to remove programmers unnecessary handlers nor suggest to programmers for specialized handlings (when programmers declarations are too broad). We propose a static analysis of Java programs that estimates their uncaught exceptions independently of the programmers declarations. This analysis is designed and implemented based on set-based framework. Its cost-effectiveness is suggested by sparsely analyzing the program at method level (hence reducing the number of unknowns in the flow equations). We have shown that our interprocedural exception analysis is more precise than JDK-style intraprocedural analysis, and also that our analysis can effectively detect uncaught exceptions for realistic Java programs.

A new analysis of LALR formalisms

The traditional LALR analysis is reexamined using a new operator and an associated graph. An improved method that allows factoring out a crucial part of the computation for defining states of LR(0) canonical collection and for computing LALR(1) lookahead sets is presented. This factorization leads to significantly improved algorithms with respect to execution time as well as storage requirements. Experimental results including comparison with other known methods are presented.

Filtering false alarms of buffer overflow analysis using SMT solvers

Buffer overflow detection using static analysis can provide a powerful tool for software programmers to find difficult bugs in C programs. Sound static analysis based on abstract interpretation, however, often suffers from false alarm problem. Although more precise abstraction can reduce the number of the false alarms in general, the cost to perform such analysis is often too high to be practical for large software. On the other hand, less precise abstraction is likely to be scalable in exchange for the increased false alarms. In order to attain both precision and scalability, we present a method that first applies less precise abstraction to find buffer overflow alarms fast, and selectively applies a more precise analysis only to the limited areas of code around the potential false alarms. In an attempt to develop the precise analysis of alarm filtering for large C programs, we perform a symbolic execution over the potential alarms found in the previous analysis, which is based on the abstract interpretation. Taking advantage of a state-of-art SMT solver, our precise analysis efficiently filters out a substantial number of false alarms. Our experiment with the test cases from three open source programs shows that our filtering method can reduce about 68% of false alarms on average.

Error repair with validation in LR-based parsing

When the compiler encounters an error symbol in an erroneous input, the local error-repair method repairs the input by either inserting a repair string before the error symbol or deleting the error symbol. Although the extended FMQ of Fischer et al. and the method of McKenzie et al. report the improved quality of diagnostic messages, they suffer from redundant parse stack configurations.This article proposes an efficient LR error-recovery method, with validation-removing repairs that give the same validation result as a previously considered, lower-cost repair. Moreover, its execution speed is proportional to the length of the stack configuration. The algorithm is implemented on a Bison, GNU LALR(1), parser generating system. Experimental results are presented.

An improved LALR( k ) parser generation for regular right part grammars

A regular right part grammar (RRPG) is a context-free grammar, in which right parts of productions are finite automata to extend the descriptive power of context-free grammar by including notations for describing repetitions and alternations [6,8]. On LR parsing of RRPGs, extra work is required to identify the left end of a handle at reduction time because a nonterminal can derive potentially infinite number of strings via a single production. For parsing RRPGs, some methods such as grammar transformation from RRPGs to LR(k) context-flee grammars [5,8], augmenting LR(0) automaton with readback machines to recognize the reverse of state sequences leading to a reduction [2,6,7], and stacking an LR state only when the symbol being processed indicates the beginning of a new right part [11], are suggested. In stacking method, the parser is efficient because exactly one state entry is popped from the stack when the right end of a production is found. However, if stacking conflicts occur, the transfor-

Region-based parallelization of irregular reductions on explicitly managed memory hierarchies

Multicore architectures are evolving with the promise of extreme performance for the classes of applications that require high performance and large bandwidth of memory. Irregular reduction is one of important computation patterns for many complex scientific applications, and it typically requires high performance and large bandwidth of memory. In this article, we propose region-based parallelization techniques for irregular reductions on multicore architectures with explicitly managed memory hierarchies. Managing memory hierarchy in software requires a lot of programming efforts and tends to be error-prone. The difficulties are even worse for applications with irregular data access patterns. To relieve the burden of memory management from programmers, we develop abstractions, particularly targeted to irregular reduction, for structuring parallel tasks, mapping the parallel tasks to processing units and scheduling data transfers between the memory hierarchies. Our framework employs iteration reordering based on regions of data along with dynamic scheduling of parallel tasks. We experimentally evaluate the effectiveness of our techniques for irregular reduction kernels on the Cell processor embedded in a Sony PlayStation3. Experimental results show the speedups of 8 to 14 on the six available SPEs.

Cycle elimination for invocation graph-based context-sensitive pointer analysis

Context: Pointer analysis is an important building block of optimizing compilers and program analyzers for C language. Various methods with precision and performance trade-offs have been proposed. Among them, cycle elimination has been successfully used to improve the scalability of context-insensitive pointer analyses without losing any precision. Objective: In this article, we present a new method on context-sensitive pointer analysis with an effective application of cycle elimination. Method: To obtain similar benefits of cycle elimination for context-sensitive analysis, we propose a novel constraint-based formulation that uses sets of contexts as annotations. Our method is not based on binary decision diagram (BDD). Instead, we directly use invocation graphs to represent context sets and apply a hash-consing technique to deal with the exponential blow-up of contexts. Result: Experimental results on C programs ranging from 20,000 to 290,000 lines show that applying cycle elimination to our new formulation results in 4.5 xspeedup over the previous BDD-based approach. Conclusion: We showed that cycle elimination is an effective method for improving the scalability of context-sensitive pointer analysis.

Refining schizophrenia via graph reachability in esterel

Esterel is an imperative synchronous language for control-dominant reactive systems. The combination of imperative structures and the perfect synchrony hypothesis often result in schizophrenic statements. Previous studies explain the characteristics of schizophrenia as the instantaneous reentrance to block statements: local signal declarations and parallel statements. In practice, however, most instantly-reentered block statements do not cause any problems in Esterel compilation. In this paper, we refine schizophrenic problems in terms of signal emissions, and suggest an algorithm to detect harmful schizophrenia using reachability on control flow graphs (CFGs) in Esterel. Our algorithm performs well in analyzing practical programs. Moreover, it can be easily applied to existing compilers.