Simple example. Analysis of programs with pointers. Points-to relation. Program model. Points-to graph. Ordering on points-to relation

Transcription

1 Simle eamle Analsis of rograms with ointers := 5 tr *tr := 9 := rogram S1 S2 S3 S4 deendences What are the deendences in this rogram? Problem: just looking at variable names will not give ou the correct information After statement S2, rogram names and *tr are both eressions that refer to the same memor location. We sa that tr oints-to after statement S2. In a C-like language that has ointers, we must know the oints-to relation to be able to determine deendences correctl Program model For now, onl tes are int and int* No hea All ointers oint to onl to stack variables No rocedure or function calls involving ointer variables: address: co: load: store: Arbitrar comutations involving ints Points-to relation Directed grah: nodes are rogram variables edge (a,b): variable a oints-to variable b tr Can use a secial node to reresent NULL Points-to relation is different at different rogram oints Points-to grah Out-degree of node ma be more than one if oints-to grah has edges (a,b) and (a,c), it means that variable a ma oint to either b or c deending on how we got to that oint, one or the other will be true ath-sensitive analses: track how ou got to a rogram oint (we will not do this) if () then else := &z.. := &z Ordering on oints-to relation Subset ordering: for a given set of variables Least element is grah with no edges 1 <= 2 if 2 has all the edges 1 has and mabe some more iven two oints-to relations 1 and 2 1 U 2: least grah that contains all the edges in 1 and in 2 What does oint to here?

2 Overview Eamle We will look at three different oints-to analses. Flow-sensitive oints-to analsis Dataflow analsis Comutes a different oints-to relation at each oint in rogram Flow-insensitive oints-to analsis Comutes a single oints-to grah for entire rogram Andersen s algorithm Natural simlification of flow-sensitive algorithm Steensgard s algorithm Nodes in tree are equivalence classes of variables if ma oint-to either or z, ut and z in the same equivalence class Points-to relation is a tree with edges from children to arents rather than a general grah Less recise than Andersen s algorithm but faster := &z tr tr tr z w tr z w Andersen s algorithm tr, Flow-sensitive algorithm z,w Steensgard s algorithm Notation Suose S and S1 are set-d variables. S! S1: strong udate set assignment S U! S1: weak udate set union: this is like S! S U S1 Flow-sensitive algorithm Dataflow equations Dataflow equations (contd.) Forward flow, an ath analsis Confluence oerator: 1 U 2 = with t ()! { = with t ()! U t(a) for all a in t() = with t ()! { = with t ()! t() = with t ()! U t(a) for all a in t() = with t (a) U! t() for all a in t() = with t ()! t() = with t (a) U! t() for all a in t() strong udates weak udate (wh?)

3 Strong vs. weak udates Strong udate: At assignment statement, ou know recisel which variable is being written to Eamle: :=. You can remove oints-to information about coming into the statement in the dataflow analsis. Weak udate: You do not know recisel which variable is being udated; onl that it is one among some set of variables. Eamle: * := Problem: at analsis time, ou ma not know which variable oints to (see slide on control-flow and out-degree of nodes) Refinement: if out-degree of in oints-to grah is 1 and is known not be nil, we can do a strong udate even for * := Structures Structure tes struct cell {int ; struct cell *left, *right; struct cell,; Use a field-sensitive model and are nodes each node has three internal fields labeled, left, right This reresentation ermits ointers into fields of structures If this is not necessar, we can siml have a node for each structure and label outgoing edges with field name Eamle int main(void) { struct cell {int ; struct cell *; ; struct cell,,z,*; int sum;. = 5;. = &;. = 6;. = &z; z. = 7; z. = NULL; = &; sum = 0; while (!= NULL) { sum = sum + (*).; = (*).; return sum; z NULL z NULL Flow-insensitive algorithms Flow-insensitive analsis Andersen s algorithm Flow-sensitive analsis comutes a different grah at each rogram oint. This can be quite eensive. One alternative: flow-insensitive analsis Intuition:comute a oints-to relation which is the least uer bound of all the oints-to relations comuted b the flowsensitive analsis Aroach: Ignore control-flow Consider all assignment statements together relace strong udates in dataflow equations with weak udates Comute a single oints-to relation that holds regardless of the order in which assignment statements are actuall eecuted = with t() U! { = with t() U! t() = with t() U! t(a) for all a in t() weak udates onl = with t(a) U! t() for all a in t()

4 int main(void) { struct cell {int ; struct cell *; ; struct cell,,z,*; int sum;. = 5;. = &;. = 6;. = &z; z. = 7; z. = NULL; = &; sum = 0; while (!= NULL) { return sum; sum = sum + (*).; = (*).; Eamle. = &;. = &z; z. = NULL; = &; = (*).; Assignments for flow-insensitive analsis... Solution to flow-insensitive equations z NULL - Comare with oints-to grahs for flow-sensitive solution - Wh does oint-to NULL in this grah? Andersen s algorithm formulated using set constraints Steensgard s algorithm Flow-insensitive Comutes a oints-to grah in which there is no fan-out In oints-to grah roduced b Andersen s algorithm, if oints-to and z, and z are collased into an equivalence class Less accurate than Andersen s but faster We can eloit this to design an O(N*!(N)) algorithm, where N is the number of statements in the rogram. Steensgard s algorithm using set constraints Trick for one-ass rocessing Consider the following equations No fan-out When first equation on left is rocessed, and are not ointing to anthing. Once second equation is rocessed, we need to go back and rerocess first equation. Trick to avoid doing this: when rocessing first equation, if and are not ointing to anthing, create a dumm node and make and oint to that this is like solving the sstem on the right It is eas to show that this avoids the need for revisiting equations.

5 Algorithm Auiliar methods Can be imlemented in single ass through rogram Algorithm uses union-find to maintain equivalence classes (sets) of nodes Points-to relation is imlemented as a ointer from a variable to a reresentative of a set Basic oerations for union find: re(v): find the node that is the reresentative of the set that v is in union(v1,v2): create a set containing elements in sets containing v1 and v2, and return reresentative of that set class var { //instance variables! oints_to: var;! name: string; //constructor; also creates singleton set in union-find data structure var(string); //class method; also creates singleton set in union-find data structure make-dumm-var():var; //instance methods! get_t(): var;! set_t(var);//udates re rec_union(var v1, var v2) {! 1 = t(re(v1));! 2 = t(re(v2));! t1 = union(re(v1), re(v2));! if (1 == 2)!! return;! else if (1!= null && 2!= null)!! t2 = rec_union(1, 2);! else if (1!= null) t2 = 1;! else if (2!= null) t2 = 2;! else t2 = null;! t1.set_t(t2);! return t1; t(var v) {! //v does not have to be reresentative! t = re(v);! return t.get_t(); Algorithm Initialization: make each rogram variable into an object of te var and enter object into union-find data structure for each statement S in the rogram do S is : {if (t() == null).set-t(re()); else rec-union(t(),); S is : {if (t() == null and t() == null).set-t(var.make-dumm-var());.set-t(rec-union(t(),t())); S is :{if (t() == null).set-t(var.make-dumm-var()); var a := t(); if(t(a) == null) a.set-t(var.make-dumm-var());.set-t(rec-union(t(),t(a))); S is :{if (t() == null).set-t(var.make-dumm-var()); var a := t(); if(t(a) == null) a.set-t(var.make-dumm-var());.set-t(rec-union(t(),t(a))); Inter-rocedural analsis What do we do if there are function calls? 1 = &a swa(1, 1) 2 = &a swa(2, 2) Two aroaches Contet-sensitive aroach: treat each function call searatel just like real rogram eecution would roblem: what do we do for recursive functions? need to aroimate Contet-insensitive aroach: merge information from all call sites of a articular function in effect, inter-rocedural analsis roblem is reduced to intra-rocedural analsis roblem Contet-sensitive aroach is obviousl more accurate but also more eensive to comute Contet-insensitive aroach 1 = &a swa(1, 1) 2 = &a swa(2, 2)

6 Contet-sensitive aroach Contet-insensitive/Flow-insensitive Analsis 1 = &a swa(1, 1) 2 = &a swa(2, 2) For now, assume we do not have function arameters this means we know all the call sites for a given function Set u equations for binding of actual and formal arameters at each call site for that function use same variables for formal arameters for all call sites Intuition: each invocation rovides a new set of constraints to formal arameters Swa eamle Hea allocation 1 = &a 1 = 1 2 = 1 2 = &a 1 = 2 2 = 2 Simlest solution: use one node in oints-to grah to reresent all hea cells More elaborate solution: use a different node for each malloc site in the rogram Even more elaborate solution: shae analsis goal: summarize otentiall infinite data structures but kee around enough information so we can disambiguate ointers from stack into the hea, if ossible Summar Less recise More recise Equalit-based Subset-based Histor of oints-to analsis Flow-insensitive Flow-sensitive Contet-insensitive Contet-sensitive No consensus about which technique to use Eerience: if ou are contet-insensitive, ou might as well be flow-insensitive from Rder and Raside