Pointer Analysis. Outline: What is pointer analysis Intraprocedural pointer analysis Interprocedural pointer analysis. Andersen and Steensgaard

Transcription

1 Poiner anaysis

2 Poiner Anaysis Ouine: Wha is oiner anaysis Inrarocedura oiner anaysis Inerrocedura oiner anaysis Andersen and Seensgaard

3 Poiner and Aias Anaysis Aiases: wo exressions ha denoe he same memory ocaion. Aiases are inroduced by: oiners ca-by-reference array indexing C unions

4 Usefu for wha? Imrove he recision of anayses ha require knowing wha is modified or referenced (eg cons ro, CSE ) Eiminae redundan oads/sores and dead sores. x := *;... y := *; // reace wih y := x? *x :=...; // is *x dead? Paraeizaion of code can recursive cas o quick_sor be run in arae? Yes, rovided ha hey reference disinc regions of he array. Idenify objecs o be racked in error deecion oos x.ock();... y.unock(); // same objec as x?

5 Kinds of aias informaion Poins-o informaion (mus or may versions) a rogram oin, comue a se of airs of he form! x, where oins o x. can reresen his informaion in a oins-o grah Aias airs a each rogram oin, comue he se of of a airs (e 1,e 2 ) where e 1 and e 2 mus/may reference he same memory. x y z Sorage shae anaysis a each rogram oin, comue an absrac descriion of he oiner srucure.

6 Inrarocedura Poins-o Anaysis Wan o comue may-oins-o informaion Laice:

7 Fow funcions in x := k F x := k (in) = ou in x := a + b F x := a+b (in) = ou

8 Fow funcions in x := y F x := y (in) = ou in x := &y F x := &y (in) = ou

9 Fow funcions in x := *y F x := *y (in) = ou in *x := y F *x := y (in) = ou

10 Inrarocedura Poins-o Anaysis Fow funcions:

11 Poiners o dynamicay-aocaed memory Hande saemens of he form: x := new T One idea: generae a new variabe each ime he new saemen is anayzed o sand for he new ocaion:

12 Exame := new Cons := := new Cons * := :=

13 Exame soved := new Cons := V1 V1 V2 := new Cons V1 V2 V1 V2 V3 * := V1 V2 V1 V2 V3 := V1 V2 V1 V2 V3

14 Wha wen wrong? Laice infiniey a! We were esseniay running he rogram Insead, we need o summarize he infiniey many aocaed objecs in a finie way New Idea: inroduce summary nodes, which wi sand for a whoe cass of aocaed objecs.

15 Wha wen wrong? Exame: For each new saemen wih abe L, inroduce a summary node oc L, which sands for he memory aocaed by saemen L. Summary nodes can use oher crierion for merging.

16 Exame revisied : := new Cons := : := new Cons * := :=

17 Exame revisied & soved : := new Cons Ier 1 Ier 2 Ier 3 := : := new Cons * := :=

18 Exame revisied & soved : := new Cons Ier 1 Ier 2 Ier 3 := : := new Cons * := :=

19 Array aiasing, and oiners o arrays Array indexing can cause aiasing: a[i] aiases b[j] if: a aiases b and i = j a and b overa, and i = j + k, where k is he amoun of overa. Can have oiners o eemens of an array := &a[i];...; ++; How can arrays be modeed? Coud rea he whoe array as one ocaion. Coud ry o reason abou he array index exressions: array deendence anaysis.

20 Fieds Can summarize fieds using er fied summary for each fied F, kee a oins-o node caed F ha summarizes a ossibe vaues ha can ever be sored in F Can aso use aocaion sies for each fied F, and each aocaion sie S, kee a oins-o node caed (F, S) ha summarizes a ossibe vaues ha can ever be sored in he fied F of objecs aocaed a sie S.

21 Summary We jus saw: inrarocedura oins-o anaysis handing dynamicay aocaed memory handing oiners o arrays Bu, inrarocedura oiner anaysis is no enough. Sharing daa srucures across muie rocedures is one he big benefis of oiners: insead of assing he whoe daa srucures around, jus ass oiners o hem (eg C ass by reference). So oiners end u oining o srucures shared across rocedures. If you don do an inerroc anaysis, you have o make conservaive assumions funcions enries and funcion cas.

22 Conservaive aroximaion on enry Say we don have inerrocedura oiner anaysis. Wha shoud he informaion be a he inu of he foowing rocedure: goba g; void (x,y) { x y g... }

23 Conservaive aroximaion on enry Here are a few souions: goba g; void (x,y) { }... x y g ocaions from aoc sies rior o his invocaion x,y,g & ocaions from aoc sies rior o his invocaion They are a very conservaive! We can ry o do beer.

24 Inerrocedura oiner anaysis Main difficuy in erforming inerrocedura oiner anaysis is scaing One can use a o-down summary based aroach (Wison & Lam 95), bu even hese are hard o scae

25 Exame revisied : := new Cons Cos: sace: sore one fac a each rog oin ime: ieraion Ier 1 Ier 2 Ier 3 := : := new Cons * := :=

26 New idea: sore one daafow fac Sore one daafow fac for he whoe rogram Each saemen udaes his one daafow fac use he revious fow funcions, bu now hey ake he whoe rogram daafow fac, and reurn an udaed version of i. Process each saemen once, ignoring he order of he saemens This is caed a fow-insensiive anaysis.

27 Fow insensiive oiner anaysis : := new Cons := : := new Cons * := :=

28 Fow insensiive oiner anaysis : := new Cons := : := new Cons * := :=

29 Fow sensiive vs. insensiive : := new Cons Fow-sensiive Son Fow-insensiive Son := : := new Cons * := :=

30 Wha wen wrong? Wha haened o he ink beween and? Can do srong udaes anymore! Need o remove a he ki ses from he fow funcions. Wha haened o he sef oo on? We si have o ierae!

31 Fow insensiive oiner anaysis: fixed : := new Cons := : := new Cons * := :=

32 Fow insensiive oiner anaysis: fixed This is Andersen s agorihm 94 Fina resu : := new Cons Ier 1 Ier 2 Ier 3 := : := new Cons * := := L2 L1 L2

33 Fow sensiive vs. insensiive, again : := new Cons Fow-sensiive Son Fow-insensiive Son := : := new Cons * := :=

34 Fow insensiive oss of recision Fow insensiive anaysis eads o oss of recision! main() { x := &y; }... x := &z; Fow insensiive anaysis es us ha x may oin o z here! However: uses ess memory (memory can be a big boeneck o running on arge rograms) runs faser

35 In Cass Exercise! : := new Cons : q := new Cons * = q r = &q *q = r *q = s = r s = *r = s

36 In Cass Exercise! soved : := new Cons : q := new Cons * = q r = &q *q = r *q = q r s s = r s = *r = s

37 Wors case comexiy of Andersen x y *x = y x y a b c d e f a b c d e f Wors case: N 2 er saemen, so a eas N 3 for he whoe rogram. Andersen is in fac O(N 3 )

38 New idea: one successor er node Make each node have ony one successor. This is an invarian ha we wan o mainain. x y *x = y x y a,b,c d,e,f a,b,c d,e,f

39 More genera case for *x = y x y *x = y

40 More genera case for *x = y x y x y x y *x = y

41 Handing: x = *y x y x = *y

42 Handing: x = *y x y x y x y x = *y

43 Handing: x = y (wha abou y = x?) x y x = y Handing: x = &y x y x = &y

44 Handing: x = y (wha abou y = x?) x y x y x y x = y ge he same for y = x Handing: x = &y x y x = &y x y x y,

45 Our favorie exame, once more! : := new Cons 1 := 2 : := new Cons 3 * := 4 := 5

46 Our favorie exame, once more! : := new Cons := : := new Cons * := 4 := 5,

47 Fow insensiive oss of recision : := new Cons Fow-sensiive Subse-based Fow-insensiive Subse-based Fow-insensiive Unificaionbased := : := new Cons * :=, :=

48 Anoher exame bar() { 1 i := &a; 2 j := &b; 3 foo(&i); 4 foo(&j); // i ns o wha? *i :=...; } void foo(in* ) { rinf( %d,*); }

49 Anoher exame bar() { 1 i := &a; 2 j := &b; 3 foo(&i); 4 foo(&j); // i ns o wha? *i :=...; i 1 2 a i a 4 j b 3 i a j b } void foo(in* ) { rinf( %d,*); } i a j b i,j a,b

50 Amos inear ime Time comexiy: O(Nα(N, N)) inverse Ackermann funcion So sow-growing, i is basicay inear in racice For he curious: node merging imemened using UNION-FIND srucure, which aows se union wih amorized cos of O(α(N, N)) er o. Take CSE 202 o earn more!

51 In Cass Exercise! : := new Cons : q := new Cons * = q r = &q *q = r *q = s = r s = *r = s

52 In Cass Exercise! soved : := new Cons : q := new Cons Seensgaard q,,s2 * = q r s r = &q *q = r s = r *q = s = Andersen q *r = s r s

53 Advanced Poiner Anaysis Combine fow-sensiive/fow-insensiive Cever daa-srucure design Conex-sensiiviy