Symbolic Analysis

Symbolic analysis tracks the values of variables in programs symbolically as expressions of input variables and other variables, which we call reference variables. We may draw out useful information about relationships among variables that are expressed in terms of the same set of reference variables

An Example 1) x = input(); 2) y = x – 1; 3) z = y – 1; 4) A[x] = 10; 5) A[y] = 11; 6) if (z > x) 7) z = x; z = x – 2 &A[x]  &A[y] z > x is never true can be removed

Abstract Domain Since we cannot create succinct and closed- form symbolic expressions for all values computed, we choose an abstract domain and approximate the computations with the most precise expressions within the domain. Constant propagation: { constants, UNDEF, NAC } Symbolic analysis: { affine-expressions, NAA }

Affine Expressions An expression is affine with respect to variables v 1, v 2, …, v n if it can be expressed as c 0 + c 1 v 1 + … + c n v n, where c 0, c 1, …, c n are constants. An affine expression is linear if c 0 is zero.

Induction Variables An affine expression can also be written in terms of the count of iterations through the loop. Variables whose values can be expressed as c 1 i + c 0, where i is the count of iterations through the closest enclosing loop, are known as induction variables.

An Example for (m = 10; m < 20; m++) { x = m * 3; A[x] = 0; } x = 27; for (m = 10; m < 20; m++) { x = x + 3; A[x] = 0; } i, m = i + 10 x = * i for (x = &A + 30; x <= &A + 57; x = x + 3) { *x = 0; }

Other Reference Variables If a variable is not a linear function of the reference variables already chosen, we have the option of treating its value as reference for future operations. a = f(); b = a + 10; c = a + 11;

A Running Example a = 0; for (f = 100; f < 200; f++) { a = a + 1; b = 10 * a; c = 0; for (g = 10; g < 20; g++) { d = b + c; c = c + 1; } a = a + 1; b = 10 * a; c = 0; j = 1; B2B2 a = 0; i = 1; B1B1 d = b + c; c = c + 1; j = j + 1; if j <= 10 goto B 3 B3B3 i = i + 1; if i <= 100 goto B 2 B4B4 R5R5 R6R6 R7R7 R8R8

Data-Flow Values: Symbolic Maps The domain of data-flow values for symbolic analysis is symbolic maps, which are functions that map each variable in the program to a value. The value is either an affine function of reference values, or the special symbol NAA to represent a non-affine expression. If there is only one variable, the bottom value of the semilattice is a map that sends the variable to NAA. The semilattice for n variables is the product of the individual semillatices. We use m NAA to denote the bottom of the semilattice which maps all variables to NAA.

The Running Example var i = 1 1  i  100 j = 1, …, 10 j = 1, …, 10 a 1 i b 10 10i d 10, …, 19 10i, …, 10i + 9 c 1, …, 10 1, …, 10 a = a + 1; b = 10 * a; c = 0; j = 1; B2B2 a = 0; i = 1; B1B1 d = b + c; c = c + 1; j = j + 1; if j <= 10 goto B 3 B3B3 i = i + 1; if i <= 100 goto B 2 B4B4 R5R5 R6R6 R7R7 R8R8

The Running Example m m(a) m(b) m(c) m(d) IN[B 1 ] NAA NAA NAA NAA OUT[B 1 ] 0 NAA NAA NAA IN[B 2 ] i – 1 NAA NAA NAA OUT[B 2 ] i 10i 0 NAA IN[B 3 ] i 10i j – 1 NAA OUT[B 3 ] i 10i j 10i + j – 1 IN[B 4 ] i 10i j 10i + j – 1 OUT[B 4 ] i – 1 10i – 10 j 10i + j – 11

The Running Example a = 0; for (i = 1; i <= 100; i++) { a = i; b = 10 * i; c = 0; for (j = 1; j <= 10; j++) { d = 10 * i + j – 1; c = j; }

Transfer Functions The transfer functions in symbolic analysis send symbolic maps to symbolic maps. The transfer function of statement s, denoted f s, is defined as follows: If s is not an assignment, then f s = I. If s is an assignment to variable x, then f s ( m )( x ) m(v) for all variables v  x, = c 0 + c 1 m(y) + c 2 m(z) if x is assigned c 0 + c 1 y + c 2 z, NAA otherwise.

Composition of Transfer Functions If f 2 ( m )( v ) = NAA, then ( f 2 。 f 1 )( m )( v ) = NAA. If f 2 ( m )( v ) = c 0 +  i c i m(v i ), then ( f 2 。 f 1 )( m )( v ) NAA, if f 1 ( m ) (v i ) = NAA for some i  0, = c i  0 c 0 +  i c i f 1 ( m ) (v i ) otherwise

The Running Example f f (m)(a) f (m)(b) f (m)(c) f (m)(d) f B1 0 m(b) m(c) m(d) f B2 m(a) m(a) m(d) f B3 m(a) m(b) m(c) + 1 m(b) + m(c) f B4 m(a) m(b) m(c) m(d)

Solutions to Data-Flow Problem OUT[B k ] = f B (IN[B k ]), for all B k OUT[B 1 ]  IN 1 [B 2 ] OUT[B 2 ]  IN i,1 [B 3 ], 1  i  100 OUT i, j -1 [B 3 ]  IN i, j [B 3 ],1  i  100, 2  j  10 OUT i,10 [B 3 ]  IN i [B 4 ], 2  i  100 OUT i -1 [B 4 ]  IN i [B 2 ], 1  i  100

Meet of Transfer Functions The meet of two transfer functions: f 1 ( m )( v ) if f 1 ( m )( v ) = f 2 ( m )( v ) ( f 2  f 1 )( m )( v ) = NAA otherwise

Parameterized Function Compositions If f ( m )( x ) = m(x) + c, then f i ( m )( x ) = m(x) + ci for all i  0, x is a basic induction variable. If f ( m )( x ) = m(x), then f i ( m ) ( x ) = m(x) for all i  0, x is a symbolic constant. If f ( m )( x ) = c 0 + c 1 m(x 1 ) + … + c n m(x n ), where each x k is either a basic induction variable or a symbolic constant, then f i ( m )( x ) = c 0 + c 1 f i ( m ) (x 1 ) + … + c n f i ( m ) (x n ) for all i  0, x is an induction variable. In all other cases, f i ( m )( x ) = NAA.

Parameterized Function Compositions The effect of executing a fixed number of iterations is obtained by replacing i above by that number. If the number of iterations is unknown, the value at the start of the last iteration is given by f *. m ( v ) if f ( m )( v ) = m ( v ) f * ( m )( v ) = NAA otherwise

The Running Example m ( a ) if v = a m ( b ) if v = b f i B3 ( m )( v ) = m ( c ) + i if v = c m ( b ) + m ( c ) + i if v = d. m ( a ) if v = a m ( b ) if v = b f * B3 ( m )( v ) = NAA if v = c NAA if v = d.

A Region-Based Algorithm The effect of execution from the start of the loop region to the entry of the i th iteration f R, i,IN[ S ] = (  B  pred ( S ) f S,OUT[ B ] ) i -1 If the number of iterations of a region is known, replace i with the actual count. In the top-down pass, compute f R, i,IN[ B ]. If m ( v ) = NAA, introduce a new reference variable t, all references of m ( v ) are placed by t.

The Running Example f R 5, j,IN[ B3 ] = f j-1 B3 f R 5, j,OUT[ B3 ] = f j B3 f R 6,IN[ B2 ] = I f R 6,IN[ R5 ] = f B2 f R 6,OUT[ B4 ] = I 。 f R 5, 10,OUT[ B3 ] 。 f B2 f R 7, i,IN[ R6 ] = f i-1 R 6,OUT[ B4 ] f R 7, i,OUT[ B4 ] = f i R 6,OUT[ B4 ] f R 8,IN[ B1 ] = I f R 8,IN[ R7 ] = f B1 f R 8,OUT[ B4 ] = I 。 f R 7,100,OUT[ B4 ] 。 f B1

The Running Example f f (m)(a) f (m)(b) f (m)(c) f (m)(d) f R 5, j,IN[ B3 ] m(a) m(b) m(c)+ j -1 NAA f R 5, j,OUT[ B3 ] m(a) m(b) m(c)+ j m(b)+m(c)+ j -1 f R 6,IN[ B2 ] m(a) m(b) m(c) m(d) f R 6,IN[ R5 ] m(a)+1 10m(a)+10 0 m(d) f R 6,OUT[ B4 ] m(a)+1 10m(a) m(a)+9 f R 7, i,IN[ R6 ] m(a)+ i -1 NAANAA NAA f R 7, i,OUT[ B4 ] m(a)+ i 10m(a)+10 i 10 10m(a)+10 i +9 f R 8,IN[ B1 ] m(a) m(b) m(c) m(d) f R 8,IN[ R7 ] 0 m(b) m(c) m(d) f R 8,OUT[ B4 ]

The Running Example IN[B 1 ] = m NAA OUT[B 1 ] = f B1 (IN[B 1 ]) IN i [B 2 ] = f R 7, i,IN[ R6 ] (OUT[B 1 ]) OUT i [B 2 ] = f B2 (IN i [B 2 ]) IN i, j [B 3 ] = f R 5, j,IN[ B3 ] (OUT i [B 2 ]) OUT i, j [B 3 ] = f B2 (IN i, j [B 3 ])

The Running Example for (i = 1; i < n; i++) { a = input(); for (j = 1; j < 10; j++) { a = a – 1; b = j + a; a = a + 1; } for (i = 1; i < n; i++) { a = input(); t = a; for (j = 1; j < 10; j++) { a = t – 1; b = t – 1 + j; a = t; }