DoubleTake: Fast and Precise Error Detection via Evidence-Based Dynamic Analysis

In one paragraph

Tools like Valgrind find memory errors by instrumenting every read and write, which makes them far too slow for production. DoubleTake's idea is evidence-based dynamic analysis: for a class of errors it is possible to make sure that evidence of the error survives in memory, for example canaries around heap objects. The program runs at nearly full speed in epochs bounded by irrevocable system calls. At each epoch end DoubleTake checks the evidence, and only if an error happened does it roll back to the epoch's snapshot and re-execute with full instrumentation to pinpoint the exact line and address. Three detectors run together at under 5% average overhead.

Key ideas

• Evidence-based detection: leave tamper-evident traces, such as canaries and delayed frees, so an error can be detected after the fact instead of at the moment it happens.
• Epochs and snapshots: execution is split at irrevocable system calls, and each epoch starts with a lightweight snapshot, so the expensive analysis can replay only the epoch where evidence appeared.
• Instrumented replay for precision: on evidence, re-execute the epoch with checks enabled and report the exact instruction and memory address.
• A drop-in library: no custom hardware, compiler, or operating-system support.

Results

• About 4% average overhead with all three detectors (buffer overflows, use-after-free, memory leaks) enabled, and under 3% on 14 of the SPEC CPU2006 benchmarks.
• For comparison in the same paper: Valgrind slows programs by about 17× on average (4.5× to 42.8×), and AddressSanitizer by around 30%.
• Reports the exact line and memory address of each error.