1. Course Outline Traditional Static Program Analysis Software Testing
Theory
Today: Compiler Optimizations, Control Flow Graphs
Data-flow Analysis
Classic analyses and applications
Software Testing
Dynamic Program Analysis

2. Textbooks
Compilers: Principles, Techniques and Tools by Aho, Lam, Sethi and Ullman Addison-Wesley 2007
Principles of Program Analysis by Nielsen, Nielsen and Hankin, Springer 1999
Notes, handouts and papers

3. Static Program Analysis
Analyzes the source code of the program and reasons about the run-time program behavior
Many uses
Traditionally in compilers in order to perform optimizing, semantics-preserving transformations
Recently in software tools for testing and validation: our focus

4. Outline An Example: basic compiler optimizations Control flow graphs
Local optimizations --- within basic blocks
Global optimizations --- across basic blocks
Reading: Compilers: Principles, Techniques and Tools, by Aho, Lam, Sethi and Ullman, Chapter 9.1

5. Compilation code optimizer code generator source program
intermediate code
intermediate code
target program
front end
symbol table
An optimization is a semantics-preserving transformation

6. Example Define classical optimizations using an example Fortran loop
Opportunities result from table-driven code generation …
sum = 0
do 10 i = 1, n
10 sum = sum + a[i]*a[i]

7. Three Address Code sum = 0 initialize sum
i = 1 initialize loop counter
if i > n goto 15 loop test, check for limit
t1 = addr(a) – 4
t2 = i * 4 a[i]
t3 = t1[t2]
t4 = addr(a) – 4
t5 = i * 4 a[i]
t6 = t4[t5]
t7 = t3 * t6 a[i]*a[i]
t8 = sum + t7
sum = t8 increment sum
i = i increment loop counter
goto 3 …

8. Control Flow Graph (CFG)
sum = 0
i = 1
if i > n goto 15
t1 = addr(a) – 4
t2 = i*4
t3 = t1[t2]
t4 = addr(a) – 4
t5 = i*4
t6 = t4[t5]
t7 = t3*t6
t8 = sum + t7
sum = t8
i = i + 1
goto 3 T
15. … F

9. Common Subexpression Elimination
sum = sum = 0
i = i = 1
if i > n goto if i > n goto 15
t1 = addr(a) – t1 = addr(a) – 4
t2 = i* t2 = i*4
t3 = t1[t2] t3 = t1[t2]
t4 = addr(a) – t4 = addr(a) – 4
t5 = i* t5 = i*4
t6 = t4[t5] t6 = t4[t5]
t7 = t3*t t7 = t3*t6
t8 = sum + t7 10a t7 = t3*t3
sum = t t8 = sum + t7
i = i a sum = sum + t7
goto sum = t8
… i = i + 1
14. goto 3

10. Invariant Code Motion 1. sum = 0 1. sum = 0 2. i = 1 2. i = 1
if i > n goto 15 2a t1 = addr(a) - 4
t1 = addr(a) – if i > n goto 15
5. t2 = i * t1 = addr(a) - 4
t3 = t1[t2] 5. t2 = i * 4
10a t7 = t3 * t t3 = t1[t2]
11a sum = sum + t7 10a t7 = t3 * t3
13. i = i a sum = sum + t7
14. goto i = i + 1
15. … goto 3
15. …

11. Strength Reduction 1. sum = 0 1. sum = 0 2. i = 1 2. i = 1
2a t1 = addr(a) – 4 2a t1 = addr(a) - 4
3. if i > n goto 15 2b t2 = i * 4
5. t2 = i * if i > n goto 15
6. t3 = t1[t2] t2 = i * 4
10a t7 = t3 * t t3 = t1[t2]
11a sum = sum + t7 10a t7 = t3 * t3
13. i = i a sum = sum + t7
14. goto b t2 = t2 + 4
15. … i = i + 1
14. goto 3
15. …

12. Test Elision and Induction Variable Elimination
1. sum = sum = 0
2. i = i = 1
2a t1 = addr(a) – 4 2a t1 = addr(a) – 4
2b t2 = i * 4 2b t2 = i * 4
3. if i > n goto 15 2c t9 = n * 4
6. t3 = t1[t2] 3. if i > n goto 15
10a t7 = t3 * t3 3a if t2 > t9 goto 15
11a sum = sum + t7 6. t3 = t1[t2]
11b t2 = t a t7 = t3 * t3
13. i = i a sum = sum + t7
14. goto b t2 = t2 + 4
15. … i = i + 1
14. goto 3a
15. …

13. Constant Propagation and Dead Code Elimination
1. sum = sum = 0
2. i = i = 1
2a t1 = addr(a) – 4 2a t1 = addr(a) - 4
2b t2 = i * 4 2b t2 = i * 4
2c t9 = n * 4 2c t9 = n * 4
3a if t2 > t9 goto 15 2d t2 = 4
6. t3 = t1[t2] 3a if t2 > t9 goto 15
10a t7 = t3 * t t3 = t1[t2]
11a sum = sum + t7 10a t7 = t3 * t3
11b t2 = t a sum = sum + t7
14. goto 3a 11b t2 = t2 + 4
15. … goto 3a
15. …

14. New Control Flow Graph T F 1. sum = 0 2. t1 = addr(a) - 4
3. t9 = n * 4
4. t2 = 4
5. if t2 > t9 goto 11
6. t3 = t1[t2]
7. t7 = t3 * t3
8. sum = sum + t7
9. t2 = t2 + 4
10. goto 5 T
11. … F

15. Building Control Flow Graph
Partition into basic blocks
Determine the leader statements
(i) First program statement
(ii) Targets of conditional or unconditional goto’s
(iii) Any statement following a goto
For each leader, its basic block consists of the leader and all statements up to but not including the next leader or the end of the program

16. Building Control Flow Graph
Add flow-of-control information
There is a directed edge from basic block B1 to block B2 if B2 can immediately follow B1 in some execution sequence
B2 immediately follows B1 and B1 does not end in an unconditional jump
There is a jump from the last statement in B1 to the first statement in B2
Dead code.

17. Leader Statements and Basic Blocks
sum = 0
i = 1
if i > n goto 15
t1 = addr(a) – 4
t2 = i*4
t3 = t1[t2]
t4 = addr(a) – 4
t5 = i*4
t6 = t5[t5]
t7 = t3*t6
t8 = sum + t7
sum = t8
i = i + 1
goto 3 …

18. Analysis and optimizing transformations
Local optimizations – performed by local analysis of a basic block
Global optimizations – requires analysis of statements outside a basic block
Local optimizations are performed first, followed by global optimizations
Standard basic block optimizations: Common subexpression elimination, copy propagation, dead-code elimination.
Loop optimizations: code motion, induction variable removal and reduction in strength

19. Local optimizations --- optimizing transformations of a basic blocks
Local common subexpression elimination
Dead code elimination
Copy propagation
Constant propagation
Renaming of compiler-generated temporaries to share storage

20. Example 1: Local Common Subexpression Elimination
t2 = a [ t1 ]
t3 = 4 * i
t4 = b [ t3 ]
t5 = t2 * t4
t6 = prod * t5
prod = t6
t7 = i + 1
i = t7
if i <= 20 goto 1

21. Example 2: Local Dead Code Elimination
a = y ’. a = y + 2
z = x + w 2’. x = a
x = y ’. z = b + c
z = b + c 4’. b = a
b = y + 2

22. Example 3: Local Constant Propagation
t1 = 1 Assuming a, k, t3, and t4 are used beyond:
a = t1 1’. a = 1
t2 = 1 + a 2’. k = 2
k = t2 3’. t4 = 8.2
t3 = cvttoreal(k) 4’. t3 = 8.2
t4 = t3
t3 = t4
D. Gries’ algorithm:
Process 3-address statements in order
Check if operand is constant; if so, substitute
If all operands are constant,
Do operation, and add value to table associated with LHS
If not all operands constant Delete any table entry for LHS

23. Problems Troubles with arrays and pointers. Consider: x = a[k];
a[j] = y;
z = a[k];
Can we transform this code into the following?
z = x;
Does the store into a[j] affect the load of a[k]?
An assignment through an array or a pointer kills all the nodes. Also, a procedure call in a basic block kills all the nodes.
Introducing ordering edges
1. any evaluation of or assignment to an element of array “a” must follow the previous assignment to an element of that array if there is one.
2. any assignment to an element of array “a” must follow any previous evaluation of “a”.
3. any use of any identifier must follow the previous procedure call or indirect pointer assignment.
4. any proc. Call or indirect assignment must follow all previous evaluations of any identifier.
We can do a similar fix for variable access through pointers.

24. Global optimizations --- require analysis outside of basic blocks
Global common subexpression elimination
Dead code elimination
Constant propagation
Loop optimizations
Loop invariant code motion
Strength reduction
Induction variable elimination

25. Global optimizations --- depend on data-flow analysis
Data-flow analysis refers to a body of techniques that derive information about the flow of data along program execution paths
For example, in order to perform global subexpression elimination we need to determine that 2 textually identical expressions evaluate to the same result along any possible execution path

26. Introduction to Data-flow Analysis
Collects information about the flow of data along execution paths
E.g., at some point we needed to know where a variable was last defined
Data-flow information
Data-flow analysis

27. Data-flow Analysis 1 G = (N, E, ρ)
Data-flow equations (also referred as transfer functions):
out(i) = gen(i) (in(i) – kill(i))
Equations can be defined over basic blocks or over single statements. We will use equations over single statements 2 3 4 5 6 7 8 9 10

28. Four Classical Data-flow Problems
Reaching definitions (Reach)
Live uses of variables (Live)
Available expressions (Avail)
Very Busy Expressions (VeryB)
Def-use chains built from Reach, and the dual Use-def chains, built from Live, play role in many optimizations
Avail enables global common subexpression elimination
VeryB is used for conservative code motion

29. Reaching Definitions
Definition A statement that may change the value of a variable (e.g., x = i+5)
A definition of a variable x at node k reaches node n if there is a path clear of a definition of x from k to n. k
x = …
x = … n
… = x

30. Live Uses of Variables
Use Appearance of a variable as an operand of a 3-address statement (e.g., y=x+4)
A use of a variable x at node n is live on exit from k if there is a path from k to n clear of definition of x. k
x = …
x = … n
… = x

31. Def-use Relations
Use-def chain links an use to a definition that reaches that use
Def-use chain links a definition to an use that it reaches k
x = …
x = … n
… = x

32. Optimizations Enabled
Dead code elimination (Def-use)
Code motion (Use-def)
Constant propagation (Use-def)
Strength reduction (Use-def)
Test elision (Use-def)
Copy propagation (Def-use)

33. Dead Code Elimination T F
1. sum = 0 2. i = 1 T
3. if i > n goto 15 F
4. t1 = addr(a)–4 5. t2 = i * 4 6. i = i + 1
After strength reduction, test elision and constant propagation, the def-use links from i=1 disappear. It becomes dead code.

34. Constant Propagation 1. i = 1 2. i = 1 3. i = 2 4. p = i*2 5. i = 1
6. q = 5*i+3 = 8

35. Terms Control flow graph (CFG) Basic block Local optimization
Global optimization
Data-flow analysis