1. Reps Horwitz and Sagiv 95 (RHS) Another approach to context-sensitive interprocedural analysis Express the problem as a graph reachability query Works for distributive problems

2. Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }

3. Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }

4. Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }

5. In class excersice main() { f() } f() { if(Unlocked()) { lock f() } else { unlock }

6. In class excersice main() { f() } f() { if(Unlocked()) { lock f() } else { unlock }

7. Procedure specialization Interprocedural analysis is great for callers But for the callee, information is still merged main() { x := new A(...); y := x.g(); y.f(); x := new A(...); y := x.g(); y.f(); x := new B(...); y:= x.g(); y.f(); } // g too large to inline g(x) { x.f(); // lots of code return x; } // but want to inline f f(x@A) {... } f(x@B) {... }

8. Procedure specialization Specialize g for each dataflow information “In between” inlining and context-sensitve interproc main() { x := new A(...); y := x.g 1 (); y.f(); x := new A(...); y := x.g 1 (); y.f(); x := new B(...); y:= x.g 2 (); y.f(); } g 1 (x) { x.f(); // can now inline // lots of code return x; } g 2 (x) { x.f(); // can now inline // lots of code return x; } // but want to inline f f(x@A) {... } f(x@B) {... }

9. A() { call D } B() { call D } C() { call D } D() {... } Recap using pictures

10. A() { } D’D’ B() { } D ’’ C() { } D ’’’ Inlining A() { call D } B() { call D } C() { call D } D() {... }

11. A() { call D } B() { call D } C() { call D } D() {... } caller summary callee summary Context-insensitive summary A() { call D } B() { call D } C() { call D } D() {... }

12. A() { call D } B() { call D } C() { call D } D() {... } context sensitive summary Context sensitive summary A() { call D } B() { call D } C() { call D } D() {... }

13. A() { call D } B() { call D } C() { call D } D() {... } D’() {... } Procedure Specialization A() { call D } B() { call D } C() { call D } D() {... }

14. Comparison Caller precisionCallee precisionCode bloat Inlining context-insensitive interproc Context sensitive interproc Specialization

15. Comparison Caller precisionCallee precisioncode bloat Inlining, because contexts are kept separate  may be large if we want to get the best precision context-insensitive interproc , because contexts are merged none Context sensitive interproc, because of context sensitive summaries , because contexts are still merged when optimizing callees none Specialization, contexts are kept separate  Some, less than inlining

16. Summary on how to optimize function calls Inlining Tail call optimizations Interprocedural analysis using summaries –context sensitive –context insensitive Specialization

17. Cutting edge research Making interprocedural analysis scalable Optimizing first order function calls Making inlining effective in the presence of dynamic dispatching and class loading

18. Pointer analysis

19. Pointer Analysis Outline: –What is pointer analysis –Intraprocedural pointer analysis –Interprocedural pointer analysis Andersen and Steensgaard

20. Pointer and Alias Analysis Aliases: two expressions that denote the same memory location. Aliases are introduced by: –pointers –call-by-reference –array indexing –C unions

21. Useful for what? Improve the precision of analyses that require knowing what is modified or referenced (eg const prop, CSE …) Eliminate redundant loads/stores and dead stores. Parallelization of code –can recursive calls to quick_sort be run in parallel? Yes, provided that they reference distinct regions of the array. Identify objects to be tracked in error detection tools x := *p;... y := *p; // replace with y := x? *x :=...; // is *x dead? x.lock();... y.unlock(); // same object as x?

22. Kinds of alias information Points-to information (must or may versions) –at program point, compute a set of pairs of the form p ! x, where p points to x. –can represent this information in a points-to graph Alias pairs –at each program point, compute the set of of all pairs (e 1,e 2 ) where e 1 and e 2 must/may reference the same memory. Storage shape analysis –at each program point, compute an abstract description of the pointer structure. p x y zp

23. Intraprocedural Points-to Analysis Want to compute may-points-to information Lattice:

24. Flow functions x := a + b in out F x := a+b (in) = x := k in out F x := k (in) =

25. Flow functions x := &y in out F x := &y (in) = x := y in out F x := y (in) =

26. Flow functions *x := y in out F *x := y (in) = x := *y in out F x := *y (in) =

27. Intraprocedural Points-to Analysis Flow functions: