Control Flow Analysis

Transcription

1 Control Flow Analyi Efficiency Control Flow Analyi Type an Effect ytem Data Flow Analyi Abtract Interpretation Correctne Control Flow Analyi p.1/35

2 Control Flow Analyi Flow information i eential for the pecification of Data Flow Analye. In the cae of the Monotone Framework, flow information i repreente by the flow function. While language: flow information can be extracte irectly from the program text. Proceure call are performe by explictly mentioning the name of a proceure. Not o trivial for more general language e.g imperative language with proceure a parameter, functional language or object-oriente language. In uch cae, a pecial analyi i require: Control Flow Analyi Control Flow Analyi p.2/35

3 let = ; in = = ; The aim of Control Flow Analyi i: For each function application, which function may be applie Control Flow Analyi p.3/35

4 Overview Control Flow Analyi Abtract Domain an pecification Contraint Generation Contraint olving Algorithm Control an Data Flow Analyi Context-enitive Analyi Concept Control Flow Analyi p.4/35

5 ! expreion (or labelle term) term (or unlabelle expreion)!! op! in = let! ele then if # $ " Control Flow Analyi p.5/35

6 We will efine a 0-CFA Analyi; the preentation require two component: Abtract Domain pecification of the Analyi The reult of a 0-CFA analyi i a pair %'* %')( where: i the abtract cache aociating abtract value with each labelle program point. %+ i the abtract environment aociating abtract value with each variable. Control Flow Analyi p.6/35

7 - 6 ; 0 : 7 abtract value 3 abtract environment abtract cache -<. 2 0 i a et of term of the form %', Control Flow Analyi p.7/35 -/.10 2 %', 145 %'* % 9 80 An abtract value =

8 - A 80 7? For the formulation of the 0-CFA analyi we hall write %'* %> ( for when expreion i an acceptable Control Flow Analyi of the. Thu the relation ha functionality %'* % )( 9? true (fale Goal: If a ub-expreion evaluate to a function (cloure), then the function mut be preicte by % B Control Flow Analyi p.8/35

9 ! C C T T T T T T Y Y T T T T T T T T T Y T CFA: Example # $ " LLG K D J D E LLG I LK G D J D E L IG KDFJ G DFEHGI C VW VW VW X R I R VW XW XW X R I R R R R R VW X R I R VW VW VW X R I R VW VW Y Y VW X R I R VW VW X R I R VW X R I R Control Flow Analyi p.9/35 M N O P Q R

10 pecification: Rule alway [Z % ( %+ B \Z % ( `b! ele `a then `_ if \Z % ( c_ \Z % )( b! Z %> ( a \Z % )( %+ B %+ B! %+ B %+ B eb! in a = let \Z % ( b! Z %+ ( a \Z % )( %> B %> B! %> B Control Flow Analyi p.10/35

11 Control Flow Analyi p.11/35 cb! op a [Z % ( b! Z %> ( a \Z %'* % ( \Z % ( fz % ( % B A b! a \Z % ( b! Z %+ ( a \Z %'* % ( %+ B c_ g %'* % B! % B % B

12 m n Contraint Generation To implement the pecification, we mut generate a et of contraint from a given program. i a et of contraint an conitional contraint of the form lh rh ll kk i hji A rh lh rh where rh i of the form n ( B, or. A or B, an lh i of the form, an all occurrence of are of the form Control Flow Analyi p.12/35

13 ll A p A p = [Z % ( Recall \Z % ( % B A ll kk h i Aqp B A l l kk hoi eb! \Z % ( ea Z %+ ( b! a \Z % ( %> B! % B c_ g % B %> B ll cb! kk a hji cb kk! h i llp kk a hji _ n B! B A i c_ B B B A i Control Flow Analyi p.13/35

14 ll kk p p ll p ll ll k k hri A B n ll k k hji `b kk! hji llp kk a hji llp `_ kk h i ll `b! ele `a then `_ if hji A B B A B B! `b kk! hji llp `a kk hji ll b! in a = kk hji let A B B! Aqp n B eb kk! hji llp ea kk hji ll eb! op kk a hji Control Flow Analyi p.14/35

15 !! A p A p ll! Contraint Generation: Example $ll # " kk hri #ll " kk hji llp kk hji `_ n t A i _ v u A i ll kk hji Ap A kk hji A xw n Ap A A xw n ( A "ll k k hri Ap t "A #ll " kk hri A xy n ( t "A Control Flow Analyi p.15/35

16 A A i i Control Flow Analyi p.16/35 _ n t ( xw n t A ny t " e_ v u ( v A v " A A

17 ! $ll # " kk hri ( A ( xw n ( t "A ( xy n ( nw t A ( v A ( xy n t "A A v "A Control Flow Analyi p.17/35

18 Contraint olving To olve the contraint, we ue a graph-bae formulation. The algorithm ue the following main ata tructure: a worklit W, i.e. a lit of noe whoe outgoing ege houl be travere; a ata array D that for each noe give an element of ; an i an ege array E that for each noe give a lit of contraint from which a lit of the ucceor noe can be compute. Control Flow Analyi p.18/35

19 0 : B n i { { The graph will have noe an. Aociate with each noe that initially i given by: l k}. 0 B for an we have a ata fiel ; i A ll kk i hji A l k The graph will have ege for a ubet of the contraint in ; each ege will be ecorate with the contraint that give rie to it: ll kk i hri a contraint an a contraint from to! A! give rie to an ege from give rie to an ege an an ege from to.!! to,! Control Flow Analyi p.19/35

20 ~ ~ ~ ~ INPT: OTPT: METHOD: ll kk i h i %'* % ( tep 1: Initialiation W := nil; for for in Noe o D[ in Noe o E[ := ; := nil; Control Flow Analyi p.20/35

21 tep 2: Builing the graph for in cae o ll kk i hji of A A : a( : E[! E[ E[, ); A := con( := con( := con( :!,E[,E[,E[ ); ); ); Control Flow Analyi p.21/35

22 ~ ~ tep 3: Iteration while W for nil o := hea(w); W := tail(w); cae in E[ o of A if : a(! D[, D[! :! ); then a(, D[! ); Control Flow Analyi p.22/35

23 B : 0 n ~ ~ p~ ~ ~ tep 4: Recoring the olution for for in in o ; i. 0 i o := D[ %> B %'* := D[ ; B ; ING: proceure a(, if ( then D[ D[ ) i ) := D[ W := con( ;,W); Control Flow Analyi p.23/35

24 D[ E[ [i v i [i v, i t n xy, i v, i t n xw [i v t i [i t n xy, i t n xw v [ n xw [ n w n xy [ n y Control Flow Analyi p.24/35

25 n [ i i i v xw t [ i i i i i i i Control Flow Analyi p.25/35 [, i i i i i [, i i i i [, i i i [, i i

26 p 6 A ( 3 6? Control Flow + Data Flow Let Data be a et of abtract ata value (i.e. abtract propertie of boolean an arithmetic contant) %', 3-2<. 0 Data abtract value For each contant we nee an element Data imilarly, for each operator op we nee a total function ˆ 4 7 Š < ? - 2<. 0 %'Œ Typically, %'Œ will have a efinition of the form %,! %'Œ %', Data %,! ( Ž Data %,!! for ome function Ž Data Data Data Control Flow Analyi p.26/35

27 A % + i efine from Data tt š tt ( (ff - ( (0 + + œ + tt ff tt ff {-} {-} {-, 0, +} {-} {0} {+} {-, 0, +} {+} {+} Control Flow Analyi p.27/35

28 X X ž % ( % B Ÿ A qž qž % ( Ÿ Ÿ b Ÿ a X % ( Ÿb %> ( Ÿ a X %'* %> ( % B Ÿ _ ž g %> B % B ž % B Ÿ Ÿ b ele Ÿ a X then Ÿ _ ž if % ( Ÿ1_ ž %'* %> ( %' B % B Ÿ a X % )( %' B ž %> B %> B Ÿ b %> ( % B ž «^ª Control Flow Analyi p.28/35

29 X X ž % ( % B Ÿ A qž qž % ( Ÿ Ÿ b Ÿ a X % ( Ÿb %> ( Ÿ a X %'* %> ( % B Ÿ _ ž g %> B % B ž % B Ÿ Ÿ b ele Ÿ a X then Ÿ _ ž if % ( Ÿ1_ ž %'* %> ( %' B % B Ÿ a X % )( %' B ž %> B %> B Ÿ b %> ( % B ž «^ª Control Flow Analyi p.28/35

30 X X Control Flow Analyi p.29/35 %> B A Ÿ % ( %> B Ÿ % ( Ÿ Ÿb in Ÿ a X = let % ( Ÿ b %' ( Ÿ a X %'* %' ( %> B % B % B Ÿ Ÿb op Ÿ a X % ( Ÿ b %+ ( Ÿ a X %'* %+ ( % B %> B %'Œ % B

31 X X Control Flow Analyi p.29/35 %> B A Ÿ % ( %> B Ÿ % ( Ÿ Ÿb in Ÿ a X = let % ( Ÿ b %' ( Ÿ a X %'* %' ( %> B % B % B Ÿ Ÿb op Ÿ a X % ( Ÿ b %+ ( Ÿ a X %'* %+ ( % B %> B %'Œ % B

32 X X Control Flow Analyi p.29/35 %> B A Ÿ % ( %> B Ÿ % ( Ÿ Ÿb in Ÿ a X = let % ( Ÿ b %' ( Ÿ a X %'* %' ( %> B % B % B Ÿ Ÿb op Ÿ a X % ( Ÿ b %+ ( Ÿ a X %'* %+ ( % B %> B %'Œ % B

33 "! u v # Conier the expreion: let in =! u if ele ± $ # " then ³ ² # $ A pure 0-CFA analyi will not be able to icover that the ele-branch of the conitional will never be execute. When we combine the analyi with a Detection of ign Analyi then the analyi can etermine that only i a poible abtraction at label 12. Control Flow Analyi p.30/35

34 The Control Flow Analye preente o far are imprecie in that they cannot itinguih the variou intance of function call from one another. In the terminology of Data Flow Analyi the 0-CFA analyi i context-inenitive an in the terminology of Control Flow Analyi it i monovariant. To get a more precie analyi it i ueful to introuce a mechanim that itinguihe erent ynamic intance of variable an label from one another. Thi reult in a context-enitive analyi an in the terminology of Control Flow Analyi the term polyvariant i ue. Control Flow Analyi p.31/35

35 ! " Conier the expreion: in let = # $ ³ ² The leat 0-CFA analyi i given by : %'* µ %> µ ( Control Flow Analyi p.32/35

36 XA ¹A % ( X % XA XA t % % ¹A ¹A» % º ¹A ¹A ¹A ( X ¹A ( X ( X XA ( X ¹A v % º ¼ % ½ % ¾ % º À %'* xw %'* xy %'* Control Flow Analyi p.33/35

37 Expan the program into let in let = =! in!!! an then analye the expane expreion: the 0-CFA analyi i now able to euce that!! an that! can only be boun to can only be boun to the overall expreion will evaluate to only. o Control Flow Analyi p.34/35

38 Á Á Á A more atifactory olution to the problem i to exten the analyi with context information allowing it to itinguih between the variou intance of variable an program point an till analye the original expreion. Example of uch analye inclue -CFA analye, uniform -CFA analye, polynomial -CFA analye (mainly of interet for u Á± ) an the Carteian Prouct Algorithm. Control Flow Analyi p.35/35