Program Analysis Mooly Sagiv http www math tau

Program Analysis Mooly Sagiv http: //www. math. tau. ac. il/~sagiv/courses/pa. html Tel Aviv University 640 -6706 Sunday 18 -21 Scrieber 8 Monday 10 -12 Schrieber 317 Textbook: Dataflow Analysis Kill/Gen Problems Chapter 2

Kill/Gen Problems u. A simple class of static analysis problems u Generalizes the reaching definition problem u The static information consist of sets of “dataflow” facts u Compute information on the history/future of computations u Generate a system of equations – Use union/intersection to merge information along different control flow paths – Find minimal/maximal solutions

The Reaching Definitions (Revisited( u RDexit (l) = (RDentry (l) - kill) gen – assignments » kill([x : = a]l) ={(x, l’) | l’ Lab{* » gen ([x : = a]l) = {(x, l{( – skip » kill([skip]l) = » gen ([skip]l) = u RDentry (l) = {l’ pred(l)} RDexit(l(’

Remark B #RD (RDentry (l) )= (RDentry (l) - kill(l)) gen(l(

Front-End Information (Reaching Definitions( - The label that S begins u final(S) - The labels that S end u flow(S) - The control flow graph of S u block(l) - The elementary block associated with l u FV(S) - The variables used in S u S*- The analyzed program u init(S)

Flow Information in While u u init: Stm Lab* – init([x : = a]l) = l – init([skip]l) = l – init(S 1 ; S 2) = init(S 1( – init(if [b]l then S 1 else S 2) = l – init(while [b]l do S) = l final: Stm P(Lab(* – final([x : = a]l) = {l{ – final([skip]l) = {l{ – final(S 1 ; S 2) = final(S 2( – final(if [b]l then S 1 else S 2) = final(S 1) final(S 2( – final(while [b]l do S) = {l{

Flow Information in While u flow: Lab P(Lab* Lab (* – flow([x : = a]l) = – flow([skip]l) = – flow(S 1 ; S 2) = flow(S 1) flow(S 2) {(l, l’) | l final(S 1), l’ =init(S 2{( – flow(if [b]l then S 1 else S 2) = flow(S 1) flow(S 2) {(l, l’) | l’ =init(S 1)} {(l, l’) | l’ =init(S 2 {( – flow(while [b]l do S) = flow(S) {(l, l’) | l’ =init(S)} {(l’, l) | l’ final(S {(

Elementary Blocks in While u ]x : = a]l – block(l)= [x : = a]l u ]skip]l – block(l)= [skip]l u ]b]l – block(l)= [b]l

The System of Equations Reaching Definitions

The Power Program ]z : = 1]1; while [x>0]2 do) ]z: = z * x]3; ]x : = x - 1]4 (

The System of Equations ]z : = 1]1; while [x>0]2 do ([z: = z * x]3; [x : = x - 1]4(

Chaotic Iterations for l Lab* do RDentry(l) : = RDexit(l) : = RDentry(init(S*)) : = {(x, ? ) | x FV(S{(* WL= Lab* while WL != do Select and remove an arbitrary l WL if (temp != RDexit(l(( RDexit(l) : = temp for l' such that (l, l') flow(S*) do RDentry(l') : = RDentry(l') RDexit(l( WL : = WL l’

Available Expressions u The computation of a complex program expression e at a program point l can be avoided if: – e is computed on every path to l and none of its arguments are changed – e is side effect free 1; [y : = a*b]2; ]x : = a+b] u A simple example while [y >a+b]3 do) ]a: = a + 1]4; x : = a+b]5( ue can be saved in a temporary variable/register u For simplicity only consider “formal” expressions

The Largest Conservative Solution u It is undecidable to compute the exact available expressions u Compute a conservative approximation u We are looking for a maximal set of available expressions u Example [x : = a +b]1 while [true]2 do [skip]3 u Minimal set of “missed” expressions u The problem is a must problem – An expression e is available at l if e must be computed on all the paths leading to l

Front-End Information (Available Expressions( - The label that S begins u final(S) - The labels that S end u flow(S) - The control flow graph of S u block(l) - The elementary block associated with l u AExp(S) - The set of formal expressions in S u FV(e) - The variables used in the expression e u S*- The analyzed program u init(S)

The System of Equations Available Expressions

Remark B #AE (AEentry (l) )= (AEentry (l) - kill(l)) gen(l(

An Example ]x : = a+b]1; [y : = a*b]2; while [x>0]3 do) ]z: = z * x]4; ]x : = x - 1]5 (

Chaotic Iterations for l Lab* do AEentry(l) : = AExp(S(* AEexit(l) : = AExp(S(* AEentry(init(S*)) : = WL= Lab* while WL != do Select and remove an arbitrary l WL if (temp != AExit(l(( AEexit(l) : = temp for l' such that (l, l') flow(S*) do AEentry(l') : = AEentry(l') AEexit(l( WL : = WL l’

Dual Available Expressions u It is possible to compute available expressions representing those expressions that may-not-be available u An expression e is not-available at l if e may-not be computed on some of the paths leading to l u This is may problem u The smallest set is computed

The System of Equations Dual Available Expressions

Backward(Future) Data Flow Problems u So far we saw two examples of analysis problems where we collected information about past computations u Many interesting analysis problems we are interested to know about the future u Hard for dynamic analysis !

Liveness Data Flow Problems u. A variable x may be live at l if there may be an execution path from l in which the value of x is used prior to assignment u An Example: [x : = 2; ]1 [y : = 4; ]2 [x : = 1; ]3 if [ y>x]4 then [z : =y]5 else [z : = y*y]6 [x : =z]7 u Usage of liveness – – register allocation dead code elimination more precise garbage collection uninitialized variables

The System of Liveness Equations

Example ]x : = 2; ]1 [y : = 4; ]2 [x : = 1; ]3 if [y>x]4 then ] z : =y]5 else ]z : = y*y]6 ]x : =z]7

Chaotic Iterations for l Lab* do LVentry(l) : = LVexit(l) : = for l final(S*) do LVexit(l) : = WL= Lab* while WL != do Select and remove an arbitrary l WL if (temp != LVentry(l(( LVentry(l) : = temp for l' such that (l’, l) flow(S*) do LVexit(l') : = LVeexit(l') LVentry(l( WL : = WL l’

Characterization of Dataflow Problems u Direction of flow – forward – backward u Initial value u Control flow merge – May(union( – Must (intersection( u Solution – Smallest – Largest

Backward (Future)Must Problem Very Busy Expressions u An expression e is very busy at l if its value at l must be used in all the paths from l u Example program if [a>b]1 then [x : =b-a]2 [y : = a-b]3 else [y : =b-a]4 [x : = a-b]5 u Usage of Very Busy Expressions – Reduce code size – Increase speed u Find the largest solution

The System of Very Busy Equations

Chaotic Iterations for l Lab* do VBntry(l) : = AExp(S(* VBexit(l) : = AExp(S(* for l final(S*) do VBexit(l) : = WL= Lab* while WL != do Select and remove an arbitrary l WL if (temp != VBentry(l(( VBentry(l) : = temp for l' such that (l’, l) flow(S*) do VBexit(l') : = VBeexit(l') VBentry(l( WL : = WL l’

Bit-Vector Problems u Kill/Gen problems are also called Bit-Vector problems u Y = (X - Kill) Gen u Y[i]=(X[i] Kill[i]) Gen[i[ u Every component can be computed individually (in linear time(

Non Kill/Gen Problems u truly-live variables – A variable v may be truly live at l if there may be an execution path to l in which v is (transitively) used prior to assignment in a print statement u May be “garbage” (uninitialized( – A variable v may be garbage at l if there may be an execution path to l in which v is either not initialized or assigned using an expression with occurrences of uninitialized variables

Non Kill/Gen Problems(Cont( u May-points-to – A pointer variable p may point to a variable q at l if there may be an execution path to l in which p holds the address of q u Sign Analysis – A variable v must be positive/negative l if on all execution paths to l v has positive/negative value u Constant Propagation – A variable v must be a constant at l if on all execution paths to l v has a constant value

Conclusions u Kill/Gen Problems are simple useful subset of dataflow analysis problems u Easy to implement