Precise Interprocedural Dataflow Analysis via Graph Reachibility

Slides:



Advertisements
Similar presentations
Data Flow Analysis. Goal: make assertions about the data usage in a program Use these assertions to determine if and when optimizations are legal Local:
Advertisements

Context-Sensitive Interprocedural Points-to Analysis in the Presence of Function Pointers Presentation by Patrick Kaleem Justin.
Interprocedural Analysis Mooly Sagiv Tel Aviv University Sunday Scrieber 8 Monday
Graphical Models BRML Chapter 4 1. the zoo of graphical models Markov networks Belief networks Chain graphs (Belief and Markov ) Factor graphs =>they.
Analysis of programs with pointers. Simple example What are the dependences in this program? Problem: just looking at variable names will not give you.
Data-Flow Analysis Framework Domain – What kind of solution is the analysis looking for? Ex. Variables have not yet been defined – Algorithm assigns a.
3-Valued Logic Analyzer (TVP) Tal Lev-Ami and Mooly Sagiv.
CS412/413 Introduction to Compilers Radu Rugina Lecture 37: DU Chains and SSA Form 29 Apr 02.
Some Properties of SSA Mooly Sagiv. Outline Why is it called Static Single Assignment form What does it buy us? How much does it cost us? Open questions.
Bebop: A Symbolic Model Checker for Boolean Programs Thomas Ball Sriram K. Rajamani
CYCLOMATIC COMPLEXITY 1. Invented by Thomas McCabe (1974) to measure the complexity of a program ’ s conditional logic Cyclomatic complexity of graph.
(c) 2007 Mauro Pezzè & Michal Young Ch 6, slide 1 Dependence and Data Flow Models.
A Fixpoint Calculus for Local and Global Program Flows Swarat Chaudhuri, U.Penn (with Rajeev Alur and P. Madhusudan)
Interprocedural Slicing using Dependence Graphs Susan Horwitz, Thomas Reps, and David Binkley University of Wisconsin-Madison.
1 Lecture 06 – Inter-procedural Analysis Eran Yahav.
Foundations of Data-Flow Analysis. Basic Questions Under what circumstances is the iterative algorithm used in the data-flow analysis correct? How precise.
Common Sub-expression Elim Want to compute when an expression is available in a var Domain:
Interprocedural Analysis Noam Rinetzky Mooly Sagiv.
Program analysis Mooly Sagiv html://
Approach #1 to context-sensitivity Keep information for different call sites separate In this case: context is the call site from which the procedure is.
Data Flow Analysis Compiler Design Nov. 3, 2005.
KQS More exercises/practice What about research frontier? Reading material Meetings for project Post notes more promptly.
Code Generation for Basic Blocks Introduction Mooly Sagiv html:// Chapter
1 Iterative Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Data Flow Analysis Compiler Design October 5, 2004 These slides live on the Web. I obtained them from Jeff Foster and he said that he obtained.
Interprocedural Analysis Noam Rinetzky Mooly Sagiv.
CS 412/413 Spring 2007Introduction to Compilers1 Lecture 29: Control Flow Analysis 9 Apr 07 CS412/413 Introduction to Compilers Tim Teitelbaum.
Interprocedural Analysis Noam Rinetzky Mooly Sagiv Tel Aviv University Textbook Chapter 2.5.
Data Flow Analysis Compiler Design Nov. 8, 2005.
Data-Flow Analysis (Chapter 11-12) Mooly Sagiv Make-up class 18/ :00 Kaplun 324.
Direction of analysis Although constraints are not directional, flow functions are All flow functions we have seen so far are in the forward direction.
Recap from last time g() { lock; } h() { unlock; } f() { h(); if (...) { main(); } } main() { g(); f(); lock; unlock; } mainfgh ;;;;;;; u u ” ”””” ” ”
Overview of program analysis Mooly Sagiv html://
Role Analysis Victor Kunkac, Patric Lam, Martin Rinard Laboratory for Computer Science, MIT Presentation by George Caragea CMSC631,
Reps Horwitz and Sagiv 95 (RHS) Another approach to context-sensitive interprocedural analysis Express the problem as a graph reachability query Works.
Direction of analysis Although constraints are not directional, flow functions are All flow functions we have seen so far are in the forward direction.
Transfer functions Our pairs of summaries look like functions from input information to output information We call these transfer functions Complete transfer.
Improving the Precision of Abstract Simulation using Demand-driven Analysis Olatunji Ruwase Suzanne Rivoire CS June 12, 2002.
1 Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
From last class. The above is Click’s solution (PLDI 95)
Constant Propagation. The constant propagation framework is different from all the data-flow problems discussed so far, in that It has an unbounded set.
Precision Going back to constant prop, in what cases would we lose precision?
Example x := read() v := a + b x := x + 1 w := x + 1 a := w v := a + b z := x + 1 t := a + b.
PRESTO Research Group, Ohio State University Interprocedural Dataflow Analysis in the Presence of Large Libraries Atanas (Nasko) Rountev Scott Kagan Ohio.
Software (Program) Analysis. Automated Static Analysis Static analyzers are software tools for source text processing They parse the program text and.
Program Analysis and Verification
Program Analysis and Verification
Program Analysis Mooly Sagiv Tel Aviv University Sunday Scrieber 8 Monday Schrieber.
Relation. Combining Relations Because relations from A to B are subsets of A x B, two relations from A to B can be combined in any way two sets can be.
Interprocedural Path Profiling David Melski Thomas Reps University of Wisconsin.
Interprocedural Analysis Noam Rinetzky Mooly Sagiv.
Weighted Automata and Concurrency Akash Lal Microsoft Research, India Tayssir Touili, Nicholas Kidd and Tom Reps ACTS II, Chennai Mathematical Institute.
1 Iterative Program Analysis Mooly Sagiv Tel Aviv University Textbook: Principles of Program.
1 Iterative Program Analysis Abstract Interpretation Mooly Sagiv Tel Aviv University Textbook:
Data Flow Analysis II AModel Checking and Abstract Interpretation Feb. 2, 2011.
Program Analysis Mooly Sagiv Tel Aviv University Sunday Scrieber 8 Monday Schrieber.
1 Iterative Program Analysis Part II Mathematical Background Mooly Sagiv Tel Aviv University
Chaotic Iterations Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
Chaotic Iterations Mooly Sagiv Tel Aviv University Textbook: Principles of Program Analysis.
EXAMPLE FORMULA DEFINITION 1.
Program Analysis and Verification
Spring 2016 Program Analysis and Verification
Symbolic Implementation of the Best Transformer
Iterative Program Analysis Abstract Interpretation
Program Analysis via Graph Reachability
Program Analysis via Graph Reachability
G-CORE: A Core for Future Graph Query Languages
Data Flow Analysis Compiler Design
Program Analysis via Graph Reachability
Symbolic Characterization of Heap Abstractions
Presentation transcript:

Precise Interprocedural Dataflow Analysis via Graph Reachibility Thomas Reps Susan Horwitz Mooly Sagiv Directed Reading Week # 4 Erkan Keremoglu

Contributions A context sensitive framework for dataflow analysis on general class of problems IFDS problems are transformed into a kind of graph-reachability problem IFDS: Interprocedural – Finite – Distributive – Subset problems

Definitions A program is represented by its supergraph Collection of CFGs Gs, each G has a unique start and exit node In the graph, each statement is represented by a node, where procedure calls are represented by two nodes.

Definitions A valid path is defined as follows

An IFDS Problem D – all variables in the program F – The edges in the lattice M – maps functions in F to CFG’s edges Meet operator – same as we used before (like join)

Solution to IFDS problems MVP solution: meet-over-all-valid paths solution Don’t look at the formula – Intuitively it means “union of all solutions from initial state to node n” Example: Possibly uninitialized variables problem

Converting it into a graph reachability problem Represent functions as relations Composition of two relations relates to the compositions of two functions Using this property, we define exploded supergraph