SE: Pass states per stack

[martin-strecker-sonarsource]

Part of #6964

ProgramState[] and SymbolicContext[] are the main vehicles to branch a state. When processing an ExplodedNode (which contains a single ProgramState) we end up with these states:

• Almost always the ExplodedNode is transferred to a single ExplodedNode (with the same or a changed state).
• Sometimes two ExplodedNodes which represent a simple branching
• No ExplodedNode (representing e.g. unreachable code)
• In rare cases a single ExplodedNode is transferred to more than two ExplodedNode

The engine needs to work with all the cases and so an array is used to represent the branchings. This results in a lot of allocations of small arrays (1 or 2 elements) on the heap. This PR replaces the array with a struct which is optimized for the 0, 1, and 2 elements cases. It passes the states on the stack. It needs to reserve three pointers on the stack to do so (this increases the stack space used. The array needed a single pointer on the stack). The three pointers are used for

• first
• second
• others[]

The result is a reduction in allocation in total by ~5%. It eliminates SymbolicContext[] usage entirely (down to 0
from 17.820) and reduces the allocation count by 35.000. SymbolicContext[] was the fourth most allocated object before.

The benefit (reduced GC pressure) comes at the cost of more expensive method calls (more stack space, more data transferred in a call). Because of this, a runtime performance measurement needs to be done before merging the PR.

Measure	Baseline	This PR	Change
No of objects	654.817	619.815	94,65 %
Bytes	38.056.351	36.849.170	96,82 %

As a result of this change, the distinguishing between IMultiProcessor and ISimpleProcessor can be resolved. There is also no need to distinguish between PreProcess and PreProcessSimple (same for Post of course) in SymbolicCheck anymore. Both changes simplify the usage of the engine.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
12 Code Smells

96.7% Coverage
0.0% Duplication

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
2 Code Smells

96.9% Coverage
0.0% Duplication

[martin-strecker-sonarsource]

Savings for CSVHelper executed with the AnalyzerRunner:

Sorted by Bytes:

Sorted by object count

[martin-strecker-sonarsource]

Real world impact (Akka.Net SonarWay):

Total: No measurable impact (SE contributes 5% of total allocations)
SE (SymbolicExecutionRunnerBase.AnalyzeRoslyn):
Before: 1.257 MB
After: 1.028 MB

Before

After

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarcloud]

Quality Gate failed

Failed conditions

9 New issues

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[martin-strecker-sonarsource]

This should be removed. Accessing the field has value semantics and a copy is created (we see a ldsfld (copies the value for value types) instead of a ldsflda (creates a reference to the field) in the generated IL).

We should just new() as we do in all the other places as well.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarcloud]

Quality Gate failed

Failed conditions
9 New issues

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint