Static Single Assignment (SSA) Form Jaeho Shin :00 ROPAS Weekly Show & Tell

2/32 Outline 1.Preliminaries 2.Concept and definition of SSA form 3.Algorithm for computing SSA form 4.Relation with –functional programming –continuation passing style 5.Flow sensitivity of analyses with SSA

3/32 Preliminaries Control flow graph –predecessor, successor Dominators, strict dominators Immediate dominator Dominator tree –parent, children Continuation passing style

4/32 Definition of SSA form Static Single Assignment Form is a transformed program –Whose variables are renamed e.g. x --> x i –Having only one definition for each variable –Without changing the semantics of the original program i.e. every renamed variable x i of x must have the same value for every possible control flow path

5/32 Why SSA form? More compact def-use chain Control flow becomes explicit on variable names Improves performance of many data- flow analyses

6/32 Example 1 a = x + y b = a - 1 a = y + b b = x * 4 a = a + b a1 = x + y b1 = a1 - 1 a2 = y + b1 b2 = x * 4 a3 = a2 + b2 It’s so easy! Isn’t it? Well… not in general!

7/32 Example 2 o = 0 e = 0 i = 0 while (i<100) if (i % 2 == 0) e = e + i else o = o + i i = i + 1 print i, o, e

8/32 o = 0 e = 0 i = 0 if i < 100 e = e + io = o + i print i, o, e if i % 2 == 0 i = i + 1 Example 2 as a CFG

9/32 Example 2 What’s the matter? o1 = 0 e1 = 0 i1 = 0 o2 = ? e2 = ? i2 = ? if i2 < 100 e3 = e2 + i2o3 = o2 + i2 print i2, o2, e2 if i2 % 2 == 0 i3 = i2 + 1 e3, o3, i3 e1, o1, i1

10/32 We need f -function f -function: –a function that is defined to magically choose the correct variable from incoming control flow edges But, where should we place f ’s?

11/32 Example 2 How about this? o1 = 0 e1 = 0 i1 = 0 o2 = f (o1,o7) e2 = f (e1,e7) i2 = f (i1,i7) if i2 < 100 o8 = f (o2) e8 = f (e2) i8 = f (i2) print i8, o8, e8 o3 = f (o2) e3 = f (e2) i3 = f (i2) if i3 % 2 == 0 o4 = f (o3) e4 = f (e3) i4 = f (i3) e6 = e4 + i4 o5 = f (o3) e5 = f (e3) i5 = f (i3) o6 = o5 + i5 o7 = f (o4,o6) e7 = f (e6,e5) i6 = f (i4,i5) i7 = i6 + 1

12/32 Dominance Frontiers Dominance frontier of a CFG node X: –The set of all CFG nodes Y such that X dominates a predecessor of Y but does not strictly dominate Y

13/32 Dominance Frontiers (cont’d) Dominance frontiers of node X form the boundary between following nodes of X that X dominates and does not X Z Y nodes dominated by X dominance frontiers of X W

14/32 Placing f ’s at DF Definitions other than those in X may flow into Y, Z or W We need to place f ’s for each variable defined in X at the dominance frontiers of X X Z Y x = 1 x = 2 y = x * 2 W a = x + 1

15/32 Example 2 in minimal SSA form o1 = 0 e1 = 0 i1 = 0 o2 = f (o1,o4) e2 = f (e1,e4) i2 = f (i1,i3) if i2 < 100 e3 = e2 + i2o3 = o2 + i2 print i2, o2, e2 if i2 % 2 == 0 o4 = f (o2,o3) e4 = f (e2,e3) i3 = i2 + 1

16/32 SSA form algorithm R. Cytron, et al. [1] presented an efficient algorithm computing SSA form using dominance frontiers –For each variable v Place f -function for v at each nodes in DF+ of nodes defining v where DF+(S) = least fix point ( l T.DF(T) U S) {} –Traversing the dominator tree in pre-order, for each node X using the parent’s last map(*) For each assignments in X –Rename used variables v --> v map(v) –Rename defined variables u --> u count(u) –replace map(u) = count(u) and count(u) = count(u) + 1 For each successor Y of X, and for each f -function for v in Y –Replace v map(v) for corresponding argument

17/32 fix f x = let x’ = f x in if x’ = x then x else fix f x’ DF(S) = U { DF(X) | X in S } DF+(S) = fix ( l T. DF(T) U S) {} defs(v) = { defining nodes of variable v } phis(v) = DF+(defs(v))

18/32 rename(X, env) = let env’ = in for each s in [ assignments of X ] fold ( l s. l env. rename used variables u of s to u env.map(u) rename defined variable v of s to v env.count(v) env { map(v) = count(v) } { count(v) = count(v) + 1 } for each Y of children(X) rename(X, env’)

19/32 SSA is FP A. Appel [2] has shown converting to SSA is actually functional programming We can rewrite example 2 in a functional programming language

20/32 SSA is FP numbering BBs in example 2 o1 = 0 e1 = 0 i1 = 0 o2 = f (o1,o7) e2 = f (e1,e7) i2 = f (i1,i7) if i2 < 100 o8 = f (o2) e8 = f (e2) i8 = f (i2) print i8, o8, e8 o3 = f (o2) e3 = f (e2) i3 = f (i2) if i3 % 2 == 0 o4 = f (o3) e4 = f (e3) i4 = f (i3) e6 = e4 + i4 o5 = f (o3) e5 = f (e3) i5 = f (i3) o6 = o5 + i5 o7 = f (o4,o6) e7 = f (e6,e5) i6 = f (i4,i5) i7 = i

21/32 SSA is FP translating BBs into ftns fun f1() = let val o1 = 0 and e1 = 0 and i1 = 0 in f2(o1, e1, i1) fun f2(o2, e2, i2) = if i2 < 100 then f3(o2, e2, i2) else f7(o2, e2, i2) fun f3(o3, e3, i3) = if i3 % 2 == 0 then f4(o3, e3, i3) else f5(o3, e3, i3) fun f7(o8, e8, i8) = print(i8, o8, e8) fun f4(o4, e4, i4) = let val e6 = e4 + i4 in f6(o4, e6, i4) fun f5(o5, e5, i5) = let val o6 = o5 + i5 in f6(o6, e5, i5) fun f6(o7, e7, i6) = let val i7 = i6 + 1 in f2(o7, e7, i7) Still ugly, right?

22/32 SSA is FP making use of nested scopes let val o1 = 0 and e1 = 0 and i1 = 0 fun f2(o2, e2, i2) = if i2 < 100 then let fun f6(o4, e4) = let val i3 = i2 + 1 in f2(o4, e4, i3) in if i2 % 2 == 0 then let val e3 = e2 + i2 in f6(o2, e3) else let val o3 = o2 + i2 in f6(o3, e2) else print(i2, o2, e2) in f2(o1, e1, i1) This is the SSA form of example 2! The algorithm for converting programs to SSA form can be used for nesting functions to eliminate unnecessary argument passing

23/32 Relation with continuation passing style R. Kelsey [3] claims that CPS can be written into SSA and vice versa SSA --> CPS is possible since SSA is FP But, is CPS --> SSA generally possible? What’s the intuition?

24/32 Improving accuracy of flow-insensitive analyses Flow-insensitive analyses –Analysis which can’t distinguish control flow SSA makes control flow soak into names of variables (however, with some limitations)

25/32 Example 3 Set-based string analysis for C char *s = “”; strcat(s, “begin ”); for (i=0; i<10; i++) { sprintf(tmp, “%d ”, i); strcat(s, tmp); } strcat(s, “end”); printf(s); What string does s have here?

26/32 Example 3 Using intermediate language s = “”; s = “begin ”; for (i=0; i<10; i=i+1) { tmp = “ ”; s = tmp; } s = “end”; printf(s); What string does s have here?

27/32 Example 3 Derived set-constraints { Vs ⊇ “”, Vs ⊇ “begin ”, Vi ⊇ 0, Vi ⊇ Vi + 1, Vtmp ⊇ “ ”, Vs ⊇ Vtmp, Vs ⊇ “end”, X ⊇ Vprintf(Vs) } Vs ⊇ { “”, “begin ”, “begin 0”, “begin end”, …, “end0 ”, “begin 100”, “endbegin ”, … } Vs which represents the set of strings that variable s may contain is too large Too inaccurate!

28/32 Example 3 into SSA form s1 = “”; s2 = “begin ”; s3 = s2; for (i1=0, i2=i1; i2<10; i3=i2+1, i2 = i3) { tmp1 = “ ”; s4 = tmp1; s3 = s4; } s5 = “end”; printf(s5); What string does s5 have?

29/32 Example 3 Constraints from SSA form { Vs1 ⊇ “”, Vs2 ⊇ “begin ”, Vs3 ⊇ Vs2, Vi1 ⊇ 0, Vi2 ⊇ Vi1, Vi3 ⊇ Vi2 + 1, Vi2 ⊇ Vi3, Vtmp1 ⊇ “ ”, Vs4 ⊇ Vtmp1, Vs3 ⊇ Vs4 Vs5 ⊇ “end”, X ⊇ Vprintf(Vs5) } Vtmp1 ⊇ { “0 ”,“1 ”,“2 ”, … } Vs3 ⊇ { “begin ” }  Vtmp1 Vs5 ⊇ “end” Vs5 ⊇ { “begin end”, “begin 0 end”, “begin end”, “begin end”, “begin end”, … } Better than before :-)

30/32 Problems for SSA form How should we handle –Global variables? –Arrays and pointers? We sometimes need to turn SSA form back to programs without f -functions –Handling critical edges –Reducing redundant assignments

31/32 Conclusions SSA form is a transformed program where every variable has one definition Minimal SSA form can be computed with dominance frontiers With SSA form we can improve the accuracy of flow-insensitive analyses without modifying the analysis itself Converting to SSA form is similar to nesting functions in functional programs

32/32 References [1] R. Cytron, et al., “An efficient method of computing static single assignment form”, POPL, [2] A. Appel, “SSA is functional programming”, ACM SIGPLAN Notices, [3] R. Kelsey, “A correspondence between continuation passing style and static single assignment form”, ACM SIGPLAN Notices, 1993.