Mining hot calling contexts in small space

Abstract

Summary Calling context trees (CCTs) associate performance metrics with paths through a program's call graph, providing valuable information for program understanding and performance analysis. In real applications, however, CCTs might easily consist of tens of millions of nodes, making them difficult to analyze and also hurting execution times because of poor access locality. For performance analysis, accurately mining only hot calling contexts may be more useful than constructing an entire CCT with millions of uninteresting paths, because the distribution of context frequencies is typically very skewed. In this article, we show how to exploit this property to considerably reduce the CCT size, introducing a novel runtime data structure, called hot CCT (HCCT), in the spectrum of representations for interprocedural control flow. The HCCT includes only hot nodes and their ancestors in a CCT and can be constructed independently from it by using fast, space‐efficient algorithms for mining frequent items in data streams. With this approach, we can distinguish between hot and cold contexts on the fly while obtaining very accurate frequency counts. We show, both theoretically and experimentally, that the HCCT achieves a similar precision as the CCT in a space that is several orders of magnitude smaller and roughly proportional to the number of hot contexts. Our approach can be effectively combined with previous context‐sensitive profiling techniques, as we show for static bursting. We devise an implementation as a plug‐in for the gcc compiler that incurs a slowdown competitive with the gprof call‐graph profiler while collecting finer‐grained profiles. Copyright © 2015 John Wiley & Sons, Ltd.

WEIZZ: Automatic Grey-box Fuzzing for Structured Binary Formats

“…WEIZZ computes context-sensitivity information for branch coverage and comparison tables by maintaining a shadow call stack in QEMU. To deal with the often large number of contexts in programs [32], like in ANGORA we extend the number of buckets in the coverage map from 2 16 as in AFL to 2 18 , and compute the index using the source and destination basic block addresses and a one-word hash of the call stack. In the ANGORA experience, context-sensitive branch coverage may let a fuzzer explore programs more pervasively [9].…”

Predictive Context-sensitive Fuzzing

“…Due to their sheer number, a static enumeration of calling contexts is often unfeasible [65], and even space-efficient dynamic methods need wide identifiers to keep collisions low [66]. Furthermore, for complex programs, short executions often result in dozens of million distinct contexts [13], [67]. Unlike cloning, these techniques incur non-negligible temporal or spatial overheads, hindering an effective composition with local feedbacks used by fuzzers.…”

Fuzzing Binaries for Memory Safety Errors with QASan

“…The second facility is a shadow stack to track the calling context (i.e., the sequence of functions currently active on the stack [34]) of heap allocations. This information is crucial to track the origin of heap blocks that later get involved in memory violations.…”