1. A Polynomial-Time Algorithm for Global Value Numbering SAS 2004 Sumit Gulwani George C. Necula

2. 1 Global Value Numbering Goal: Discover equivalent expressions in procedures Applications: Compiler optimizations –Copy propagation, Constant propagation, Common sub- expression elimination, Induction variable elimination etc. Program verification –Discover loop invariants, verify program assertions Discover equivalent computations across programs –Translation validation, Plagiarism detection tools

3. 2 Global Value Numbering u := b*a; v := a*3; x := a*b; If (b == 3) y := a*b; Challenge: Undecidable Problem Simplification Assumptions: Operators are uninterpreted (will not discover u = x) Conditionals are non-deterministic (will not discover v = x) Will discover x = y

4. 3 Non-trivial Example assert(x = y); assert(z = F(y)); * x := a; y := a; z := F(a); x := b; y := b; z := F(b);

5. 4 Related Work Algorithms that work on SSA form of the program –AWZ Algorithm (POPL 1988) Polynomial, Incomplete –RKS Algorithm (SAS 1999) Polynomial, Incomplete, Improvement on AWZ Dataflow analysis or Abstract interpretation based algorithm –Kildall’s Algorithm (POPL 1973) Exponential, Complete –Our Algorithm (this paper) Polynomial, Complete

6. 5 Non-trivial Example assert(x = y); assert(z = F(y)); * x =  (a,b) y =  (a,b) z =  (F(a),F(b)) F(y) = F(  (a,b)) AWZ Algorithm:  functions are uninterpreted –fails to discover second assertion RKS Algorithm: uses rewrite rules for normalization –Does not discover all assertions in little more involved examples. –Rewrite rules not applied exhaustively (exp applications o.w.) –Rules are pessimistic in handling loops x := a; y := a; z := F(a); x := b; y := b; z := F(b);

7. 6 Outline Strong Equivalence DAG (SED) The Assignment Operation The Join Operation Pruning an SED Fixed Point Computation

8. 7 Representing Equivalences a := 1; b := 2; x := F(1,2); { a,1 } { b,2 } { x, F(1,2) }

9. 8 Representing Equivalences a := 1; b := 2; x := F(1,2); { a,1 } { b,2 } { x, F(1,2), F(a,2), F(1,b), F(a,b) } Such an explicit representation can be exponential.

10. 9 Strong Equivalence DAG (SED) A data structure for representing equivalences. Nodes n: Type: c, ?, F(n 1,n 2 ) For every variable x, exactly one node s.t. x 2 V – called Node(x) Terms(n): set of equivalent expressions –Terms( ) = V –Terms( ) = V [ { c } –Terms( ) = V [ { F(e 1,e 2 ) | e 1 2 Terms(n 1 ), e 2 2 Terms(n 2 ) }

11. 10 SED: Example Terms(n 1 ) = { a, 2 } Terms(n 2 ) = { b} Terms(n 3 ) = { c, d, F(a,b), F(2,b) } Terms(n 4 ) = {e, F(c,b), F(d,b), F(F(a,b),b), F(F(2,b),b)} Note that e = F(d,b) since F(d,b) 2 Terms(Node(e)) a, 2 d,c, F b, ? e, F

12. 11 Abstract Interpretation based algorithm G’ = Assignment(G,x := e) Assignment Node G x := e G 2 = G Conditional Node G 1 = G * G G = Join(G 1, G 2 ) G1G1 Join Node G2G2

13. 12 Example x := 1; y := 1; z := F(1,1); x := 2; y := 2; z := F(2,2); u := F(x,y); Assert(u = z); L1L1 L2L2 L3L3 L4L4 G1G1 z, F x,y, 1 G2G2 z, F x,y, 2 G 3 = Join(G 1,G 2 ) G3G3 z, F x,y,? G 4 = Assignment(G 3, u := F(x,y)) G4G4 u,z, F x,y, ?

14. 13 Outline Strong equivalence DAG (SED) The assignment operation The join operation Pruning an SED Fixed point computation

15. 14 The Assignment Operation Assignment(G, x := e) It is the strongest postcondition of equivalences represented by G w.r.t the assignment x := e Delete label x from Node(x) in G Let n= be the node in G s.t. e 2 Terms(n) (Add such a node to G if it does not already exists) Add x to node n.

16. 15 F Example: The Assignment Operation G z, u, F x, ? G 0 = Assignment(G, u := F(z,x)) z, F x, ? u, F

17. 16 Outline Strong Equivalence DAG (SED) The Assignment Operation The Join Operation Pruning an SED

18. 17 The Join Operation Join(G 1, G 2 ) Product Construction of G 1 and G 2 If n= 2 G 1 and m= 2 G 2, then (n,m) = 2 Join(G 1,G 2 ) Definition of t 1 t t 2 c t c = c F(n 1,n 2 ) t F(m 1,m 2 ) = F ((n 1,m 1 ),(n 2,m 2 )) t 1 t t 2 = ?, otherwise

19. 18 Example: The Join Operation G1G1 G2G2 G G = Join(G 1,G 2 ) F y 2, F y 1, F y 3,y 4 y 5, ? F y6,?y6,?y7,?y7,? F y 2, F y 1, F y 4,y 5 ? F y 6,y 7 ? y3,?y3,? F y 2, F y 1, F y 4,y 5 ? F y6,?y6,? y3,?y3,? y7,?y7,?

20. 19 Outline Strong equivalence DAG (SED) The assignment operation The join operation Pruning an SED Fixed point computation

21. 20 Motivation: The Prune Operation Discovering equivalences among all expressions For the latter, it is sufficient to discover equivalences among all terms of size at most t at each program point (where t = #variables * size of program). Thus, SEDs can be pruned to have a small size (k £ t) Discovering equivalences among program expressions vs. If G=Join(G 1,G 2 ), then Size(G) can be Size(G 1 ) £ Size(G 2 ) There are programs with n joins such that size of the SEDs after joins is exponential in n.

22. 21 The Prune Operation Prune(G,k) For each node such that V  ;, check if it is a root of some DAG with all leaves labelled with at least one variable of size k. If not, then delete all the nodes that are reachable from only

23. 22 Example: The Prune Operation G Prune(G,2) y 2, ? y 1, G y 4,y 5 ? G F y 2, F y 1, G y 4,y 5 ? F y6,?y6,? y3,?y3,? y7,?y7,?

24. 23 Outline Strong equivalence DAG (SED) The assignment operation The join operation Pruning an SED Fixed point computation

25. 24 Fixed Point Computation and Complexity The lattice of sets of such equivalences has height at most k Complexity –Dominated by the cost of join operations –Each join operation: O(k 2 £ N) This requires doing pruning while computing join –# of join operations: O(j £ k) –Total cost: O(k 3 £ N £ j) k: # of variables N: size of program j: # of join points in program

26. 25 Conclusion Discovering all