1. Interprocedural Analysis Mooly Sagiv http://www.math.tau.ac.il/~sagiv/courses/pa.html Tel Aviv University 640-6706 Sunday 18-21 Scrieber 8 Monday 10-12 Schrieber 317 Textbook Chapter 2.5

2. Outline u The trivial solution u Why isn’t it adequate u Challenges in interprocedural analysis u Simplifying assumptions u A naive solution u Join over valid paths u The functional approach –A case study linear constant propagation –Context free reachability u The call-string approach u Modularity issues

3. A Trivial treatment of procedure u Analyze a single procedure u After every call continue with conservative information –Global variables and local variables which “may be modified by the call” are mapped to  u Can be easily implemented u Procedures can be written in different languages u Procedure inline can help

4. Disadvantages of the trivial solution u Modular (object oriented and functional) programming encourages small frequently called procedures u Optimization – modern machines (e.g., Intel I64) allows the compiler to schedule many instructions in parallel –Need to optimize many instructions –Inline can be a bad solution u Software engineering – Many bugs result from interface misuse –Procedures define partial functions

5. Challenges in Interprocedural Analysis u Procedure nesting u Respect call-return mechanism u Handling recursion u Local variables u Parameter passing mechanisms: value, value- result, reference, by name u The called procedure is not always known u The source code of the called procedure is not always available –separate compilation –vendor code –...

6. Simplifying Assumptions u All the code is available u Simple parameter passing u The called procedure is syntactically known u No nesting u Procedure names are syntactically different from variables u Procedures are uniquely defined u Recursion is supported

7. Extended Syntax of While a := x | n | a 1 op a a 2 b := true | false | not b | b 1 op b b 2 | a 1 op r a 2 S := [x := a] l | [call p(a, z)] l l’ | [skip] l | S 1 ; S 2 | if [b] l then S 1 else S 2 | while [b] l do S P := begin D S end D := proc id(val id*, res id*) is l S end l’ | D D

8. Fibonacci Example begin proc fib(val z, u, res v) is 1 if [z <3] 2 then [v := u + 1] 3 else ( [call fib(z-1, u, v)] 4 5 [call fib(z-2, v, v)] 6 7 ) end 8 [call fib(x, 0, y)] 9 10 end

9. Constant Example begin proc p(val a) is 1 if [b] 2 then ( [a := a -1]3 [call p(a)] 4 5 [a := a + 1] 6 ) [x := -2* a + 5] 7 end 8 [call p(7)] 9 10 end

10. Flow Graph for new Statements u init([call p(…)] l l’ = l u final([call p(…)] l l’ = {l’} u flow([call p(…)] l l’ = {(l, l n ), ([l]l x, l’)} for proc p(...) is ln S end lx

11. Flow Graph for Procedures u For a procedure proc p(...) is ln S end lx –init(p) = l n –final(p) = {l x } –flow(p) = {(l n, init(S))}  flow(S)  {(l, l x ) | l  final(S)} u For the whole program begin D S end –init * = init(S) –final * = final(S) –flow * = flow(D)  flow(S)

12. A naive Interprocedural solution u Treat procedure calls as gotos u Obtain a conservative solution u Find the least fixed point of the system: u Use Chaotic iterations

13. Simple Example begin proc p(val a) is 1 [x := a + 1] 2 end 3 [call p(7)] 4 5 [print x] 6 [call p(9)] 7 8 [print x] 9 end

14. Constant Example begin proc p(val a) is 1 if [b] 2 then ( [a := a -1]3 [call p(a)] 4 5 [a := a + 1] 6 ) [x := -2* a + 5] 7 end 8 [call p(7)] 9 10 end

15. A More Precise Solution u Only considers matching calls and returns (valid) u Can be defined via context free grammar –CP l1, l2  l 1 when l 1 =l 2 –CP l1, l2  l 1, CP l2, l3 when (l 1,l 2 )  flow * –CP l, l3  l, CP ln, lx, CP l’, l3 for [call p(…)] l l’ proc p(...) is ln S end lx u A valid path is a prefix of a complete path –VP *  VP init*,l2 –VP l1, l2  l 1 when l 1 =l 2 –VP l1, l2  l 1, VP l2, l3 when (l 1,l 2 )  flow * –VP l, l3  l, CP ln, lx, VP l’, l3 for [call p(…)] l l’ proc p(...) is ln S end lx –VP l, l3  l, VP l’, l3 for [call p(…)] l l’ proc p(...) is ln S end lx

16. Simple Example begin proc p(val a) is 1 [x := a + 1] 2 end 3 [call p(7)] 4 5 [print x] 6 [call p(9)] 7 8 [print x] 9 end CP l1, l2  l 1 when l 1 =l 2 CP l1, l2  l 1, CP l2, l3 when (l 1,l 2 )  flow * CP l, l3  l, CP ln, lx, CP l’, l3 for [call p(…)] l l’ proc p(...) is ln S end lx

17. The Join-Over-Valid-Paths (JVP) u For a sequence of labels [l 1, l 2, …, l n ] define f [l 1, l 2, …, l n ]: L  L by composing the effects of basic blocks –f[l](s)=s –f [l, p](s) = f[p] (f l (s)) u JVP l =  {f[l 1, l 2, …, l](  ) [l 1, l 2, …, l]  vpaths(init(S * ), l)} u Compute a safe approximation to JVP u In some cases the JVP can be computed

18. The Functional Approach u Two phase algorithm –Compute the dataflow solution at the exit of a procedure as a function of the initial values at the procedure entry (functional values) –Compute the dataflow values at every point using the functional values u Need an efficient representation for functions u Can compute the JVP

19. Example Linear Constant Propagation u Consider the constant propagation lattice u The value of every variable y at the program exit can be represented by: y =  {a x x + b x | x  Var * }  c a x,c  Z  { ,  } b x  Z u Supports efficient composition and “functional” join –[z := a * y + b] u Computes JVP

20. Constant Example begin proc p(val a) is 1 if [b] 2 then ( [a := a -1]3 [call p(a)] 4 5 [a := a + 1] 6 ) [x := -2* a + 5] 7 end 8 [call p(7)] 9 10 end

21. Functional Approach via Context Free Reachablity u The problem of computing reachability in a graph restricted by a context free grammar can be solved in cubic time u Can be used to compute JVP in arbitrary finite distributive data flow problems (not just bitvector) u Nodes in the graph correspond to individual facts

22. The Call String Approach for Approximating JVP u No assumptions u Record at every label a pair (l, c) where l  L is the dataflow information and c is a suffix of unmatched calls u Use Chaotic iterations u To guarantee termination limit the size of c (typically 1 or 2) u Emulates inline u Exponential in C

23. Constant Example begin proc p(val a) is 1 if [b] 2 then ( [a := a -1]3 [call p(a)] 4 5 [a := a + 1] 6 ) [x := -2* a + 5] 7 end 8 [call p(7)] 9 10 end