Program Analysis

1
Program Analysis

• Mooly Sagiv
• http//www.math.tau.ac.il/sagiv/courses/pa.html
• Tel Aviv University
• 640-6706
• Sunday 18-21 Scrieber 8
• Monday 10-12 Schrieber 317
• Textbook Dataflow AnalysisKill/Gen Problems
• Chapter 2

2
Kill/Gen Problems

• A simple class of static analysis problems
• Generalizes the reaching definition problem
• The static information consist of sets of
  dataflow facts
• Compute information on the history/future of
  computations
• Generate a system of equations
• Use union/intersection to merge information along
  different control flow paths
• Find minimal/maximal solutions

3
The Reaching Definitions (Revisited)

• RDexit (l) (RDentry (l) - kill) ?gen
• assignments
• kill(x al) (x, l) l ? Lab
• gen (x al) (x, l)
• skip
• kill(skipl) ?
• gen (skipl) ?
• RDentry (l) ?l ?pred(l) RDexit(l)

4
Remark

• ?B?RD (RDentry (l) ) (RDentry (l) - kill(l))
  ?gen(l)

5
Front-End Information (Reaching Definitions)

• init(S) - The label that S begins
• final(S) - The labels that S end
• flow(S) - The control flow graph of S
• block(l) - The elementary block associated with l
• FV(S) - The variables used in S
• S- The analyzed program

6
Flow Information in While

• initStm?Lab
• init(x al) l
• init(skipl) l
• init(S1 S2) init(S1)
• init(if bl then S1 else S2) l
• init(while bl do S) l
• finalStm?P(Lab)
• final(x al) l
• final(skipl) l
• final(S1 S2) final(S2)
• final(if bl then S1 else S2) final(S1)?
  final(S2)
• final(while bl do S) l

7
Flow Information in While

• flowLab?P(Lab ?Lab)
• flow(x al) ?
• flow(skipl) ?
• flow(S1 S2) flow(S1) ? flow(S2) ?
  (l, l) l
  ?final(S1),
  l init(S2)
• flow(if bl then S1 else S2)
  flow(S1) ? flow(S2) ?
  (l, l) l init(S1)
  ? (l, l) l init(S2)
• flow(while bl do S)
  flow(S) ? (l, l) l init(S) ?
  (l, l) l ?final(S)

8
Elementary Blocks in While

• x al
• block(l) x al
• skipl
• block(l) skipl
• bl
• block(l) bl

9
The System of EquationsReaching Definitions
10
The Power Program
z 11 while xgt02 do ( z z x3 x
x - 14 )
11
The System of Equations
z 11 while xgt02 do (z z x3 x x
- 14)
12
Chaotic Iterations
for l ? Lab do RDentry(l) ? RDexit(l) ?
RDentry(init(S)) (x, ?) x ?FV(S) WL
Lab while WL ! ? do Select and remove an
arbitrary l ? WL if (temp !
RDexit(l)) RDexit(l) temp for l'
such that (l,l') ? flow(S) do
RDentry(l') RDentry(l') ? RDexit(l)
WL WL ? l
13
Available Expressions

• The computation of a complex program expression e
  at a program point l can be avoided if
• e is computed on every path to l and none of its
  arguments are changed
• e is side effect free
• A simple example
• e can be saved in a temporary variable/register
• For simplicity only consider formal expressions

x ab1 y ab2 while y gtab3 do
( a a 14 x ab5)
14
The Largest Conservative Solution

• It is undecidable to compute the exact available
  expressions
• Compute a conservative approximation
• We are looking for a maximal set of available
  expressions
• Example x a b1 while true2 do skip3
• Minimal set of missed expressions
• The problem is a must problem
• An expression e is available at l if e must be
  computed on all the paths leading to l

15
Front-End Information (Available Expressions)

• init(S) - The label that S begins
• final(S) - The labels that S end
• flow(S) - The control flow graph of S
• block(l) - The elementary block associated with l
• AExp(S) - The set of formal expressions in S
• FV(e) - The variables used in the expression e
• S- The analyzed program

16
The System of EquationsAvailable Expressions
17
Remark

• ?B?AE (AEentry (l) ) (AEentry (l) - kill(l))
  ?gen(l)

18
An Example
x ab1 y ab2 while xgt03 do
( z z x4 x x - 15 )
19
Chaotic Iterations
for l ? Lab do AEentry(l) AExp(S) AEexit(l)
AExp(S) AEentry(init(S)) ? WL
Lab while WL ! ? do Select and remove an
arbitrary l ? WL if (temp !
AExit(l)) AEexit(l) temp for l'
such that (l,l') ? flow(S) do
AEentry(l') AEentry(l') ? AEexit(l)
WL WL ? l
20
Dual Available Expressions

• It is possible to compute available expressions
  representing those expressions that may-not-be
  available
• An expression e is not-available at l if e
  may-not be computed on some of the paths leading
  to l
• This is may problem
• The smallest set is computed

21
The System of EquationsDual Available Expressions
22
Backward(Future) Data Flow Problems

• So far we saw two examples of analysis problems
  where we collected information about past
  computations
• Many interesting analysis problems we are
  interested to know about the future
• Hard for dynamic analysis!

23
Liveness Data Flow Problems

• A variable x may be live at l if there may be an
  execution path from l in which the value of x is
  used prior to assignment
• An Examplex 21 y 42 x 13
  if ygtx4 then z y5 else z yy6
  x z7
• Usage of liveness
• register allocation
• dead code elimination
• more precise garbage collection
• uninitialized variables

24
The System of Liveness Equations
25
Example

• x 21 y 42 x 13 if ygtx4
• then
• z y5
• else
• z yy6
• x z7

26
Chaotic Iterations
for l ? Lab do LVentry(l) ? LVexit(l)
? for l ? final(S) do LVexit(l) ? WL
Lab while WL ! ? do Select and remove an
arbitrary l ? WL if (temp !
LVentry(l)) LVentry(l) temp for l'
such that (l,l) ? flow(S) do
LVexit(l') LVeexit(l') ? LVentry(l)
WL WL ? l
27
Characterization of Dataflow Problems

• Direction of flow
• forward
• backward
• Initial value
• Control flow merge
• May(union)
• Must (intersection)
• Solution
• Smallest
• Largest

28
Backward (Future)Must ProblemVery Busy
Expressions

• An expression e is very busy at l if its value at
  l must be used in all the paths from l
• Example programif agtb1 then x b-a2 y
  a-b3 else y b-a4 x a-b5
• Usage of Very Busy Expressions
• Reduce code size
• Increase speed
• Find the largest solution

29
The System of Very Busy Equations
30
Chaotic Iterations
for l ? Lab do VBntry(l) AExp(S) VBexit(l)
AExp(S) for l ? final(S) do VBexit(l)
? WL Lab while WL ! ? do Select and remove
an arbitrary l ? WL if (temp !
VBentry(l)) VBentry(l) temp for l'
such that (l,l) ? flow(S) do
VBexit(l') VBeexit(l') ?VBentry(l)
WL WL ? l
31
Bit-Vector Problems

• Kill/Gen problems are also called Bit-Vector
  problems
• Y (X - Kill) ?Gen
• Yi(Xi ??Killi) ? Geni
• Every component can be computed individually(in
  linear time)

32
Non Kill/Gen Problems

• truly-live variables
• A variable v may be truly live at l if there may
  be an execution path to l in which v is
  (transitively) used prior to assignment in a
  print statement
• May be garbage (uninitialized)
• A variable v may be garbage at l if there may be
  an execution path to l in which v is either not
  initialized or assigned using an expression with
  occurrences of uninitialized variables

33
Non Kill/Gen Problems(Cont)

• May-points-to
• A pointer variable p may point to a variable q at
  l if there may be an execution path to l in which
  p holds the address of q
• Sign Analysis
• A variable v must be positive/negative l if on
  all execution paths to lv has positive/negative
  value
• Constant Propagation
• A variable v must be a constant at l if on all
  execution paths to lv has a constant value

34
Conclusions

• Kill/Gen Problems are simple useful subset of
  dataflow analysis problems
• Easy to implement