1. Program Analysis Mooly Sagiv http://www.math.tau.ac.il/~sagiv/courses/pa.html Tel Aviv University 640-6706 Sunday 18-21 Scrieber 8 Monday 10-12 Schrieber 317 Textbook: Dataflow Analysis Chapter 2 & Appendix A Monotone Frameworks and Precision May 19, 10am Exam?

2. Outline u Monotone Dataflow Frameworks u Precision of Data Flow Analysis u Beyond Monotone Frameworks

3. Complete Lattices u The Poset (L,  ) such that every subset S  L  S and  S are both defined is called complete lattice u Denoted by (L,  ) = (L, , , , ,  ) –  is the minimum value –  =   =  L –  is the maximum value –  =  L =  

4. Monotone Frameworks u Generalizes Kill/Gen Problems u A complete lattice (L, , , , ,  ) describes the “potential pieces of information” u The initial value at entry is specified by  L u The effect of every basic block at l is described by a monotone function f l :L  L (transfer function) u Solve the following system of equations (forward)

5. Monotone Backward Frameworks u A complete lattice (L, , , , ,  ) describes the “potential pieces of information” u The initial value at exit is specified by  L u The effect of every basic block at l is described by a monotone function f l :L  L (transfer function) u Solve the following system of equations

6. Instances of Monotone Frameworks u Kill/Gen Problems –  =  or  =  –f l (entry(l)) = (entry (l) - kill(l))  gen(l) u Forward –May be uninitialized (garbage) variables –Constant propagation –Sign-analysis –Parity analysis –Points-to analysis u Backward –Truly-live variables

7. May-be-garbage variables u A variable may-be-garbage at a label l if there may be a path to l in which it is either uninitialized or set using an uninitialized variable [x := 5] 1 ; if [z > 2] 2 then [y := 17] 3 ; else [skip] 4 ; [t := y + x] 5 ;

8. May-be-garbage variables(cont) u L = (P(Var * ), , , , , Var * ) u Initial value  =Var * u Transfer functions

9. The Factorial Program [y := x] 1 ; [z := 1] 2 ; while [y>1] 3 do ( [z:= z * y] 4 ; [y := y - 1] 5 ; ) [y := 0] 6 ;

10. Over Conservative Solution if [y >1] 1 then [z := 1] 2 ; … if [y >1] 3 then [y := z] 4 ;

11. Constant Propagation u Determine variables with constant values u Information Lattice –Extended integer lattice (L 1,  1,  1,  1,  1,  1 ) » L 1 = Z  {  1,  1 } »  1  1 z  1  1 –Define L = (S  L 1,  ) where S=Var * –Initial value  ? u Transfer functions A cp : AExp  (L  L 1 )

12. The Factorial Program [y := x] 1 ; [z := 1] 2 ; while [y>1] 3 do ( [z:= z * y] 4 ; [y := y - 1] 5 ; ) [y := 0] 6 ;

13. [y := 5] 1 ; [x := 8] 2 ; while [x>1] 3 do ( [x:= y+3] 4 ; [x := (y * y) -17] 5 ; )

14. Parity Analysis u Determine parity of a single variable x u Information Lattice –({E, O, ,  }, , , , ,  ) »   z   » ‘E’ denotes the fact that x is even »‘O’ denotes the fact that is x is odd –Initial value  =  –Transfer functions »Expressions »Statements »Conditions

15. Example Program while [x !=1] 1 do if [ (x %2) = 0] 2 then [x := x / 2;] 3 else [x := x * 3 + 1;] 4

16. Example Program while /*[x   ]*/ [x !=1] 1 /*[x   ]*/ do if /*[x   ]*/ [ (x %2) = 0] 2 then /*[x  E]*/ [x := x / 2;] 3 /*[x   ]*/ else /*[x  O]*/ [x := x * 3 + 1;] 4 /*[x  E]*/

17. The PWhile Programming Language Abstract Syntax a := x | *x | &x | n | a 1 op a a 2 b := true | false | not b | b 1 op b b 2 | a 1 op r a 2 S := [x := a] l | [*x := a] l | [skip] l | S 1 ; S 2 | if [b] l then S 1 else S 2 | while [b] l do S

18. Points-To Analysis u Determine if a pointer variable p may point to q u L = (P(Var *  Var * ), , , , , Var *  Var * ) u (x, y)  l --- x may hold the address of y u The initial value  =  u Transfer functions

19. Usage of Points-To-Information u “Adapt” other optimizations –Constant propagation x = 5; *p = 7 ; … x … u Pointer aliases –Variables p and q are may-aliases at l if the points-to set at l contains entries (p, x) and (q, x) u Side effect analysis *p = *q + * * t

20. [t := &a] 1 ; [y := &b] 2 ; [z := &c] 3 ; if [x> 0] 4 ; then [p:= &y] 5 ; else [p:= &z] 6 ; [*p := t] 7 ;

21. /*  */ [t := &a] 1 ; /* {(t, a)}*/ /* {(t, a)}*/ [y := &b] 2 ; /* {(t, a), (y, b) }*/ /* {(t, a), (y, b)}*/ [z := &c] 3 ;/* {(t, a), (y, b), (z, c) }*/ if [x> 0] 4 ; then [p:= &y] 5 ; /* {(t, a), (y, b), (z, c), (p, y)}*/ else [p:= &z] 6 ; /* {(t, a), (y, b), (z, c), (p, z)}*/ /* {(t, a), (y, b), (z, c), (p, y), (p, z)}*/ [*p := t] 7 ; /* {(t, a), (y, b), (y, c), (p, y), (p, z), (y, a), (z, a)}*/

22. Chaotic Iterations for forward problems for l  Lab * do DF entry (l) :=  DF exit (l) :=  DF entry (init(S * )) :=  WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != DF exit (l)) DF exit (l) := temp for l' such that (l,l')  flow(S*) do DF entry (l') := DF entry (l')  DF exit (l) WL := WL  {l’}

23. Chaotic Iterations for backward problems for l  Lab * do DF entry (l) :=  DF exit (l) :=  for l  final(S * )) do DF exit (l) :=  WL= Lab * while WL !=  do Select and remove an arbitrary l  WL if (temp != DF entry (l)) DF entry (l) := temp for l' such that (l’, l)  flow(S*) do DF exit (l') := DF exit (l')  DF entry (l) WL := WL  {l’}

24. Complexity of Chaotic Iterations u Parameters: –|Lab| labels –k is the maximum outdegree of flow(S*) –A lattice of height h –c is the maximum cost of »applying f l »  »L comparisons u Complexity O(|Lab| h * c * k)

25. Soundness of Chaotic Iterations u define a monotone abstraction  : Collecting- States  L u Show that for every l: –  ({  [b] l  (s) | s  CS })  f l (  (CS)) u Conclude that the DF solution of Chaotic iterations satisfies for every l: –  (CS entry (l))  DF entry (l) –  (CS exit (l))  DF exit (l) u But it may be that Chaotic iterations yield DF entry (l) =  and yet  (CS entry (l))=  u How to measure precision?

26. Precision of Chaotic Iterations u Optimal –  (CS entry (l)) = DF entry (l) –  (CS exit (l)) = DF exit (l) u Join-over-all-paths - No loss of information w.r.t. straight line code u Relatively optimal (induced) w.r.t. the abstraction  u Compare at run-time u Good enough for the used optimization

27. The Join-Over-All-Paths (JOP) u Let paths(init(S * ), l) denote the potentially infinite set of paths from init(S * ) to l (written as sequences of labels) u For a sequence of labels [l 1, l 2, …, l n ] define f [l 1, l 2, …, l n ]: L  L by composing the effects of basic blocks –f[l](s)=s –f [l, p](s) = f[p] (f l (s)) u JOP l =  {f[l 1, l 2, …, l](  ) [l 1, l 2, …, l]  paths(init(S * ), l)}

28. JOP vs. Least Solution u The DF solution obtained by Chaotic iteration satisfies for every l: –JOP l  DF entry (l) u If every f l is additive (distributive) for all the labels l –JOP l = DF entry (l)

29. Additive (Distributive) Monotone Problems u Kill/Gen Problems u May-be uninitialized u Truly-live variables u Constant Propagation when every expression in the right hand side contains at most one variable u Points-to analysis with one level pointers

30. Non Distributive Monotone Problems u Points-to-analysis u Constant Propagation on arbitrary expressions u Parity Propagation on arbitrary expressions

31. Converting into Distributive Frameworks u Consider –a finite lattice (L, , , , ,  ) –An initial value at entry  L –The effect of every basic block at l is described by a monotone function f l :L  L (transfer function) –Define a distributive function on (P(L), , , , , L) by –Solve the following system of equations over P(L)

32. The Constant Propagation u It is undecidable to find the JOP in the constant propagation problem u A Sketch of a proof while (...) ( if (...) x_1 = x_1 + 1; if (...) x_2 = x_2 + 1;... if (...) x_n = x_n + 1; } y = truncate (1/ (1 + p 2 (x_1, x_2,..., x_n)) /* Is y=0 here? */

33. Static Analysis problems beyond Monotone Frameworks u Infinite heights –integer intervals –Linear relationships between variables u Bi-directional problems –Partial-redundant expressions –Automatic inference of variable types in imperative (weakly typed) programs x := b[z] a [b[y]] := x u Procedures

34. Historical Perspective u 1973 Kildall defined the basic framework but required distributive frameworks u 1976 Kam and Ulmann defined Monotone Framework u 1980 Tarjan suggested an almost linear time algorithm for reducible flow graph u 1980 Rosen suggested a linear time algorithm for high level language

35. Conclusions u Many dataflow problems can be solved via the Chaotic Iteration Algorithm u Provide a tool to understand precision