1. Program Analysis Mooly Sagiv http://www.math.tau.ac.il/~sagiv/courses/pa.html Tel Aviv University 640-6706 Sunday 18-21 Scrieber 8 Monday 10-12 Schrieber 317 Textbook: Dataflow Analysis Kill/Gen Problems Chapter 2

2. Kill/Gen Problems u A simple class of static analysis problems u Generalizes the reaching definition problem u The static information consist of sets of “dataflow” facts u Compute information on the history/future of computations u Generate a system of equations –Use union/intersection to merge information along different control flow paths –Find minimal/maximal solutions

3. The Reaching Definitions (Revisited) u RD exit (l) = (RD entry (l) - kill)  gen –assignments »kill([x := a] l ) = {(x, l’) | l’  Lab * } »gen ([x := a] l ) = {(x, l)} –skip »kill([skip] l ) =  »gen ([skip] l ) =  u RD entry (l) =  {l’  pred(l)} RD exit (l’)

4. Remark  B  # RD (RD entry (l) )= (RD entry (l) - kill(l))  gen(l)

5. Front-End Information (Reaching Definitions ) u init(S) - The label that S begins u final(S) - The labels that S end u flow(S) - The control flow graph of S u block(l) - The elementary block associated with l u FV(S) - The variables used in S u S * - The analyzed program

6. Flow Information in While u init:Stm  Lab * –init([x := a] l ) = l –init([skip] l ) = l –init(S 1 ; S 2 ) = init(S 1 ) –init(if [b] l then S 1 else S 2 ) = l –init(while [b] l do S) = l u final:Stm  P(Lab * ) –final([x := a] l ) = {l} –final([skip] l ) = {l} –final(S 1 ; S 2 ) = final(S 2 ) –final(if [b] l then S 1 else S 2 ) = final(S 1 )  final(S 2 ) –final(while [b] l do S) = {l}

7. Flow Information in While u flow:Lab  P(Lab *  Lab * ) –flow([x := a] l ) =  –flow([skip] l ) =  –flow(S 1 ; S 2 ) = flow(S 1 )  flow(S 2 )  {(l, l’) | l  final(S 1 ), l’ =init(S 2 )} –flow(if [b] l then S 1 else S 2 ) = flow(S 1 )  flow(S 2 )  {(l, l’) | l’ =init(S 1 )}  {(l, l’) | l’ =init(S 2 )} –flow(while [b] l do S) = flow(S)  {(l, l’) | l’ =init(S)}  {(l’, l) | l’  final(S)}

8. Elementary Blocks in While u [x := a] l –block(l)= [x := a] l u [skip] l –block(l)= [skip] l u [b] l –block(l)= [b] l

9. The System of Equations Reaching Definitions

10. The Power Program [z := 1] 1 ; while [x>0] 2 do ( [z:= z * x] 3 ; [x := x - 1] 4 )

11. The System of Equations [z := 1] 1 ; while [x>0] 2 do ([z:= z * x] 3 ; [x := x - 1] 4 )

12. Chaotic Iterations for l  Lab * do RD entry (l) :=  RD exit (l) :=  RDentry(init(S * )) := {(x, ?) | x  FV(S * )} WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != RD exit (l)) RD exit (l) := temp for l' such that (l,l')  flow(S*) do RD entry (l') := RD entry (l')  RD exit (l) WL := WL  l’

13. Available Expressions u The computation of a complex program expression e at a program point l can be avoided if: –e is computed on every path to l and none of its arguments are changed –e is side effect free u A simple example u e can be saved in a temporary variable/register u For simplicity only consider “formal” expressions [x := a+b] 1 ; [y := a*b] 2 ; while [y >a+b] 3 do ( [a:= a + 1] 4 ; x := a+b] 5 )

14. The Largest Conservative Solution u It is undecidable to compute the exact available expressions u Compute a conservative approximation u We are looking for a maximal set of available expressions u Example [x := a +b] 1 while [true] 2 do [skip] 3 u Minimal set of “missed” expressions u The problem is a must problem –An expression e is available at l if e must be computed on all the paths leading to l

15. Front-End Information (Available Expressions ) u init(S) - The label that S begins u final(S) - The labels that S end u flow(S) - The control flow graph of S u block(l) - The elementary block associated with l u AExp(S) - The set of formal expressions in S u FV(e) - The variables used in the expression e u S * - The analyzed program

16. The System of Equations Available Expressions

17. Remark  B  # AE (AE entry (l) )= (AE entry (l) - kill(l))  gen(l)

18. An Example [x := a+b] 1 ; [y := a*b] 2 ; while [x>0] 3 do ( [z:= z * x] 4 ; [x := x - 1] 5 )

19. Chaotic Iterations for l  Lab * do AE entry (l) := AExp(S * ) AE exit (l) := AExp(S * ) AE entry (init(S * )) :=  WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != AE xit (l)) AE exit (l) := temp for l' such that (l,l')  flow(S*) do AE entry (l') := AE entry (l')  AE exit (l) WL := WL  l’

20. Dual Available Expressions u It is possible to compute available expressions representing those expressions that may-not-be available u An expression e is not-available at l if e may-not be computed on some of the paths leading to l u This is may problem u The smallest set is computed

21. The System of Equations Dual Available Expressions

22. Backward(Future) Data Flow Problems u So far we saw two examples of analysis problems where we collected information about past computations u Many interesting analysis problems we are interested to know about the future u Hard for dynamic analysis!

23. Liveness Data Flow Problems u A variable x may be live at l if there may be an execution path from l in which the value of x is used prior to assignment u An Example: [x := 2;] 1 [y := 4;] 2 [x := 1;] 3 if [ y>x] 4 then [z :=y] 5 else [z := y*y] 6 [x :=z] 7 u Usage of liveness –register allocation –dead code elimination –more precise garbage collection –uninitialized variables

24. The System of Liveness Equations

25. Example [x := 2;] 1 [y := 4;] 2 [x := 1;] 3 if [y>x] 4 then [z :=y] 5 else [z := y*y] 6 [x :=z] 7

26. Chaotic Iterations for l  Lab * do LV entry (l) :=  LV exit (l) :=  for l  final(S *) do LV exit (l) :=  WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != LV entry (l)) LV entry (l) := temp for l' such that (l’,l)  flow(S*) do LV exit (l') := LV eexit (l')  LV entry (l) WL := WL  l’

27. Characterization of Dataflow Problems u Direction of flow – forward –backward u Initial value u Control flow merge –May(union) –Must (intersection) u Solution –Smallest –Largest

28. Backward (Future)Must Problem Very Busy Expressions u An expression e is very busy at l if its value at l must be used in all the paths from l u Example program if [a>b] 1 then [x :=b-a] 2 [y := a-b] 3 else [y :=b-a] 4 [x := a-b] 5 u Usage of Very Busy Expressions –Reduce code size –Increase speed u Find the largest solution

29. The System of Very Busy Equations

30. Chaotic Iterations for l  Lab * do VB ntry (l) := AExp(S * ) VB exit (l) := AExp(S * ) for l  final(S *) do VB exit (l) :=  WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != VB entry (l)) VB entry (l) := temp for l' such that (l’,l)  flow(S*) do VB exit (l') := VB eexit (l')  VB entry (l) WL := WL  l’

31. Bit-Vector Problems u Kill/Gen problems are also called Bit-Vector problems u Y = (X - Kill)  Gen u Y[i]=(X[i]  Kill[i])  Gen[i] u Every component can be computed individually (in linear time)

32. Non Kill/Gen Problems u truly-live variables –A variable v may be truly live at l if there may be an execution path to l in which v is (transitively) used prior to assignment in a print statement u May be “garbage” (uninitialized) –A variable v may be garbage at l if there may be an execution path to l in which v is either not initialized or assigned using an expression with occurrences of uninitialized variables

33. Non Kill/Gen Problems(Cont) u May-points-to –A pointer variable p may point to a variable q at l if there may be an execution path to l in which p holds the address of q u Sign Analysis –A variable v must be positive/negative l if on all execution paths to l v has positive/negative value u Constant Propagation –A variable v must be a constant at l if on all execution paths to l v has a constant value

34. Conclusions u Kill/Gen Problems are simple useful subset of dataflow analysis problems u Easy to implement