Undecidability of Static Analysis. William Landi. Siemens Corporate Research Inc. 755 College Rd East.

Transcription

1 Undecidability of Static Analysis William Landi Siemens Copoate Reseach Inc 755 College Rd East Pinceton, NJ Abstact Static Analysis of pogams is indispensable to any softwae tool, envionment, o system that equies compile time infomation about the semantics of pogams. With the emegence of languages like C and LISP, Static Analysis of pogams with dynamic stoage and ecusive data stuctues has become a eld of active eseach. Such analysis is dicult, and the Static Analysis community has ecognized the need fo simplifying assumptions and appoximate solutions. Howeve, even unde the common simplifying assumptions, such analyses ae hade than peviously ecognized. Two fundamental Static Analysis poblems ae May Alias and Must Alias. The fome is not ecusive (i.e., is undecidable) and the latte is not ecusively enumeable (i.e., is uncomputable), even when all paths ae executable in the pogam being analyzed fo languages with if-statements, loops, dynamic stoage, and ecusive data stuctues. Categoies and Subject Desciptos: D.3.1 [Pogamming Languages]: Pocessos; F.1.1 [Computation by Abstact Devices]: Models of Computation bounded-action devices; F.4.1 [Math Logic and Fomal Languages]: Mathematical Logic computability theoy Geneal Tems: Languages, Theoy Additional Key Wods and Phases: Alias analysis, data ow analysis, abstact intepetation, halting poblem Fom acm Lettes on Pogamming Languages and Systems, Vol. 1, No. 4, Decembe 1992, Pages Pemission to copy without fee all o pat of this mateial is ganted povided that the copies ae not made o distibuted fo diect commecial advantage, the ACM copyight notice and the title of the publication and its date appea, and notice is given that copying is by pemission of the Association fo Computing Machiney. To copy othewise, o to epublish, equies a fee and/o specic pemission. c1992 ACM /92/ $

2 1 Intoduction Static Analysis is the pocesses of extacting semantic infomation about a pogam at compile time. One classical example is the live vaiables [4] poblem; a vaiable x is live at a statement s i on some execution x is used (accessed) afte s is executed without being edened. Othe classical poblems include eaching denitions, available expessions, and vey busy expessions [4]. Thee ae two main famewoks fo doing Static Analysis: Data Flow Analysis [4] and Abstact Intepetation [3]. The famewok is not elevant to this pape, as we show that two fundamental Static Analysis poblems ae hade than peviously acknowledged, egadless of the famewok used. We view the solution to a Static Analysis poblem as the set of \facts" that hold fo a given pogam. Thus, fo live vaiables the solution is f(x; s)j vaiable x is live at statement sg. With that in mind, we eview a few denitions: A set is ecusive i it can be accepted by a Tuing machine that halts on all inputs. A set is ecusively enumeable i it can be accepted by a Tuing machine which may o may not halt on all inputs. Static Analysis oiginally concentated on FORTRAN, and was pedominately conned to a single pocedue (intapocedual analysis) [7, 9, 15]. Howeve, even this simple fom of Static Analysis is not ecusive. The diculty lies in conditionals. Thee ae, in geneal, many paths though a pocedue, but not all paths coespond to an execution. Fo example, conside if (x > -1) y = 1; if (x < 0) y = -1; Execution of this fagment always executes exactly one then banch. It is impossible fo both o neithe then banches to be executed. Static Analysis is not ecusive since detemining which paths ae executable is not ecusive. To ovecome this poblem, Static Analysis is pefomed assuming that all paths though the pogam ae executable [2]. This assumption is not always valid, but it is safe [2]. 1 Also, it simplies the poblem and allows Static Analysis of FORTRAN pocedues to be done faily eciently. Some appoaches (fo example [16]) categoize some paths as not executable. Howeve, these techniques have limited applicability, and often must assume that paths ae executable. With a basis of a m undestanding of intapocedual Static Analysis of FORTRAN, Static Analysis of entie pogams (intepocedual analysis) was investigated. Myes [14] came up with the negative esult that many intepocedual Static Analysis poblems ae N P complete. Pactically, this means that intepocedual Static Analysis must make futhe appoximations ove intapocedual analysis o take an exponential amount of time. With the emegence of popula languages like C and LISP, the Static Analysis community has tuned its attention to languages with pointes, dynamic stoage, and ecusive data stuctues. It is widely accepted that Static Analysis unde these conditions is had. The geneal feeling is that it is pobably N P complete [11, 13, 12]; this is incoect. Recently, the poblem of nding aliases was shown to be P-space had [10]. Unfotunately, this is still an undeestimate. 1 The tem consevative is used in [2] instead of safe. 2

3 An alias occus at some point duing execution of a pogam when two o moe names exist fo the same stoage location. Fo example, the C statement \p = &v" ceates an alias between p and v. Aliases ae associated with pogam points, indicating not only that p and v efe to the same location duing execution, but also whee in the pogam they efe to the same location. Aliasing, statically nding aliases, is a fundamental poblem of Static Analysis. Conside the poblem of nding live vaiables fo: s 1 : v = 1; s 2 : p = &v; s 3 : w = 2; s 4 : pintf("%d",p); The vaiable v is live at s 3 only because p is aliased to v when pogam point s 4 is executed. Aliasing also inuences most inteesting Static Analysis poblems. Any poblem that is inuenced by aliasing is at least as had as aliasing. Thee ae two types of aliasing. May Alias Find the aliases that occu duing some execution of the pogam. Must Alias Find the aliases that occu on all executions of the pogam. Finding the aliases can mean detemining the set of all aliases which hold at some associated pogam points, o detemining whethe x and y ae names fo the same location at a paticula pogam point s. We use the latte meaning as, in geneal, the set of all aliases maybe innite in size. We fomally dene May Alias as a boolean function: may-alias P (s; hx; yi) is tue i thee is an execution of pogam P to pogam point s (including the eects of executing s) on which x and y efe to the same location. Must Alias is dened analogously. We show that, fo languages with if-statements, loops, dynamic stoage, and ecusive data stuctues, Intapocedual May Alias is not ecusive (i.e., is undecidable) and Intapocedual Must Alias is not ecusively enumeable (i.e., is uncomputable) even when all paths in a pogam ae executable by educing ([5], p ) the halting poblem into an alias poblem. This is a dieent fom the esult of Kam and Ullman [8] that the MOP solution is undecidable fo monotone famewoks. 2 Reduction of the Halting Poblem to an Alias Poblem A Deteministic Tuing Machine (DTM) [1] is a tuple (Q,T,I,,,q 0,q f ) whee: Q = fq 1, q 2,..., q n Qg is the set of states T = f 1 ; 2 ; :::; n T g is the set of tape symbols I T is the set of input symbols : (Q T)! (Q T fl,r,sg) is the tansition function 2 3

4 2 T I is the blank symbol q 0 2 Q is the stat state q f 2 Q is the nal state We assume that is a total function and that the DTM will not move o the left end of the tape. In geneal, neithe of these assumptions ae tue, but any Tuing machine can be modied to confom to them. In this section, we specify a machine educe (Figue 1) which takes a DTM M and input sting w and pocedues a pogam C such that may-alias C (s; hcuent state,valid simulationi) is tue i M halts on w. must-alias C (s; hcuent state,not validi) is tue i M does not halt on w. all paths though C ae executable 2.1 Repesenting an ID An Instantaneous Desciption (ID) is an encoding of the following infomation: contents of the DTM's tape cuent state of the DTM location of the tape head An ID is usually epesented by a sting xq i y 2 T QT whee the tape contains xy innitely padded to the ight with blanks, the cuent state is q i, and the tape head is scanning the st chaacte of y. 3 We encode this infomation in the alias patten of a pogam execution. By alias patten, we mean the elationship of names to each othe. We use a doubly linked list to epesent the tape of a DTM: pev sym next. Fo each i 2 T we ceate a vaiable i. The \sym" eld points to i i the tape location contains i. Thus, the tape that contained \hello" padded to the ight with blanks () is epesented by the alias patten: h: e: l: o: : 2 L moves tape head left, R moves tape head ight, and S leaves the tape head whee it is. 3 q i is undelined in xq iy to make the state stand out fom the tape sting. 4

5 Fo each q i 2 Q we ceate a vaiable q i and thee ae two additional vaiables, cuent state and tape head. Cuent state points to the cuent state of the machine, and tape head indicates the tape head location by pointing into the list epesenting the tape. The ID = heq 2 llo is epesented by: h: tape head: cuent state: q 1 : q 2 :... q n Q e: l: o: : : 2.2 Pogamming Language In ode to pefom the equied eduction, we need to constuct a pogam fom a DTM. The pogam is in C, but it could be any language with if-statements, loops, dynamic stoage, and ecusive data stuctues. We use the addess opeato (&) but it is not fundamentally necessay to the poof. To specify a C pogam fom a DTM, we need the meta-statements: #fo and #if. The syntax and meaning of these ae elatively staight fowad and should be appaent fom the following examples: #fo i = 1 to 3 x i = i; #endfo #fo i = 1 to 3 x i = i; #if i is odd y i = i; #endif #endfo 9 >= >; epesents 9 >= >; epesents 8 >< >: 8 >< >: x 1 = 1; x 2 = 2; x 3 = 3; x 1 = 1; y 1 = 1; x 2 = 2; x 3 = 3; y 3 = 3; Also, we use next bool fo eading pogam input. It etuns the next boolean value fom the input steam. If the end of the steam has been encounteed, it etuns Simulating a DTM In Section 2.1, we showed how we epesent an ID with aliases. In this section, we show how to simulate a DTM with the alias patten of executions of a paticula pogam. We now specify educe (Figue 1) which constucts a pogam fom a DTM M = (Q,T,I,,,q 0,q f ) with initial input w 2 5

6 / Given a DTM, M = (Q,T,I,,,q 0,q f ) and w 2 I / s: Geneate vaiable declaation and initialization Figue 2 Geneate code fo ceating the initial Instantaneous Desciption Figue 3 Geneate code fo simulating the tansition function Figue 4 Geneate code fo validating the esult Figue 4 Figue 1: Outline of the machine educe I such that cuent state is aliased to valid simulation on some execution to pogam point s i machine M halts on input w = x 1 x 2 :::x nw. Lemma 2.1 The code geneated by Figue 3 ceates the data stuctue that epesents the initial conguation of M (q 0 x 1 x 2 :::x nw ) in the manne descibed in Section 2.1. This is evident fom inspection of the code. \cuent state = &q 0 ;" points cuent state to q 0. tape head points to the st element of the linked list which coesponds to the tape head of M being on the beginning of the tape. Finally, NEXT SYM(i) points the \sym" eld of the i th element of the linked list to the vaiable epesenting the i th symbol on the tape (x i ). This is exactly what is equied by Section 2.1 fo the initial ID q 0 x 1 x 2 :::x nw. 2 As an example, conside the case whee T = fh,e,l,o,g, w = \hello", and q 0 = q 2. The initial ID is q 2 hello and the code geneated by Figue 3 poduces: h: tape head: back: cuent state: q 1 : q 2 :... q n Q e: l: o: : : Notice that back points to the end of the linked list epesenting the tape. This allows us to add a new tape element to the end of the tape and, as seen late, is used to ensue that we neve un o the ight end of the tape. The declaation and initialization of the vaiables of the pogam used to simulate a DTM ae specied in Figue 2. All the vaiables except yes, no, not valid, and valid simulation have 6

7 / Given a DTM, M = (Q,T,I,,,q 0,q f ) and w 2 I / typedef int **state; typedef int **lette; stuct tape f lette *sym; stuct tape *next,*pev; g *back,*tape head; state *cuent state; int not valid,valid simulation; int *yes = &valid simulation; int *no = &not valid; #fo i=1 to n Q state q i = &yes; #endfo #fo i=1 to n T lette i = &yes; #endfo Figue 2: Vaiable declaation and initialization / Given a DTM, M = (Q,T,I,,,q 0,q f ) and w 2 I / cuent state = &q 0 ; back = malloc(sizeof(stuct tape)); tape head = back; tape head->pev = NULL; tape head->next = NULL; tape head->sym = &; /* initialize tape to w = x 1 x 2 :::x nw */ #fo i = 1 to n w back->next = malloc(sizeof(stuct tape)); back->sym = &x i ; back->next->pev = back; back = back->next; back->next = NULL; back->sym = &; #endfo 9 >= >; NEXT SYM(i) Figue 3: Initial Instantaneous Desciption (ID) 7

8 / Given a DTM, M = (Q,T,I,,,q 0,q f ) and w 2 I / / next bool etuns the next boolean value fom the input steam. / back->next = malloc(sizeof(stuct tape)); back->next->pev = back; back = back->next; back->next = NULL; back->sym = &; #fo i = 1 to n Q /* once fo each state q i 2 Q */ #fo j = 1 to n T /* once fo each lette j 2 T */ /* let (q i ; j ) = (q 0 i ; 0 j ; d) */ if (next bool == 1) f 9 q i = &no; j = &no; cuent state = &not valid; (tape head->sym) = &not valid; cuent state = &q 0 i ; tape head->sym = & 0 j ; #if d = R tape head = tape head->next; #endif #if d = L tape head = tape head->pev; #endif = &yes; q i j = &yes; g else #endfo #endfo yes = &not valid; / This is the else pat of the last if-then-else poduced above. */ g 9 no = &not valid; / no aleady is not valid, but the assignment makes the poof simple / #fo i=1 to n Q >= q i = &no; #endfo >; q f = &yes; s: / cuent state is valid simulation hee i M halts on w / 9 >= >; >= >; ADD TO END DELTA(i,j) CHECK ANSWER Figue 4: Repesentation of the tansition function 8

9 aleady been explained in Section 2.1. Thee of the fou new vaiables ae simply to ecod if the cuent path is a valid simulation of M. Yes points to valid simulation i the cuent path is a simulation of M and yes points to not valid othewise. The fouth vaiable (no) is just a \don't cae" location fo pointes that must efe to something othe than yes. No always points to not valid. Continuing ou example, the initialization specied in Figue 2 followed by the code specied in Figue 3 fo T = fh,e,l,o,g, w = \hello", and q 0 = q 2, poduces: h: tape head: back: e: l: o: no: not valid: : cuent state: q 1 : q 2 :... q : n Q - yes: valid simulation: The emainde of the pogam ceated by educe is mostly a while loop (Figue 4). Each pass though the body of the loop epesents one application of the tansition function (). The st pat the the loop (ADD TO END) simply adds a new tape location, initially blank, to the ight end of the tape. This ensues that wheneve the simulated DTM moves ight on the tape, a tape location is available to it. The emainde of the loop is a nested if-then-else-if if (next bool == 1) DELTA(1,1); else if (next bool == 1) DELTA(1,2);... else if (next bool == 1) DELTA(n Q,n T ); else yes = &not valid; whee DELTA(i,j) (explained below) is the code to implement (q i ; j ). The code if (next bool == 1) DELTA(1,1); if (next bool == 1) DELTA(1,2);... if (next bool == 1) DELTA(n Q,n T ); would also be valid and does not equie an aticially deep if-then-else-if nesting. Howeve, in the fome, a pass though the loop eithe is not a valid simulation o epesents exactly one tansition of the DTM M. In the late, a pass though the loop is an invalid simulation o epesents a legal sequence of 0 to n Q n T coectness easie. tansitions of M. The fome is pefeable because it makes the poof of 9

10 Lemma 2.2 If yes points to not valid befoe the loop specied in Figue 4 is executed then yes still points to not valid afte execution of the loop. Inspection of the code eveals that in the while loop only &not valid can be assigned to yes. 2 The next lemma basically states that if the execution is a valid simulation of M befoe executing the loop geneated by Figue 4, then one path though the loop simulates the next tansition of M and all othe paths ae not a valid simulation. Lemma 2.3 If befoe the loop specied in Figue 4 is executed, yes points to valid simulation, the ID encoded by the alias patten is xq i y, and xq i y `M x 0 q j y 0 then on all but one path though the loop yes points to not valid and on the emaining path, yes points to valid simulation and the alias patten epesents the ID x 0 q j y 0. We illustate this poof with the example heq 2 llo `M hq 1 eelo (theefoe (q 2,l) = (q 1,e,L)). Fo this example, the alias patten befoe execution of the loop is: h: tape head: no: back: e: l: o: : not valid: cuent state: q 1 : q 2 :... q : n Q - yes: valid simulation: Befoe execution of the while loop, all 2 T and all q 2 Q point to yes. 4 The st pat of the loop, as stated ealie just expands the tape. The last else-clause simply points yes to not valid signaling an invalid simulation. Now conside the code fo DELTA(i,j) which epesents the application of (q i ; j ). Notice that we can only use this ule if M is in state q i and the tape head is eading j. Thus we would like to say (in pseudo-c) if (cuent state 6= q i o tape head->sym 6= j ) yes = &not valid / i.e., not a valid simulation / (1) but this would ceate paths which ae not executable in the pogam. The st fou statements of DELTA(i,j) do exactly (1) without using a conditional. The statements \q i = &no; j = &no" 4 We have not poven this hee, but it follows fom a simple inductive poof on numbe of iteations of the while loop. 10

11 point q i and j to no. All othe states and alphabet symbols still point to yes. In ou unning example (whee q i = q 2 and j = l) we have: h: tape head: back: e: l: no: not valid: cuent state: q 1 : q 2 :... q : n Q - yes: valid simulation: The statements, \cuent state = &not valid" and \(tape head->sym) = &not valid", make sue that the application of (q i, j ) is applicable. Thee ae two cases that can occu: The tape head is scanning j (l) and M is in state q i (q 2 ) This means that cuent state is no and (tape head->sym) is also no. Thus both of these statements eectively ae \no = &not valid" and the value of yes is unchanged and still points to valid simulation. This is the path though the loop that is a valid simulation of M. Fo all i,j thee is exactly one such path since M is a DTM. Eithe the tape head is not scanning j (l) o M is not in state q i (q 2 ) In the st case, cuent state is yes. Thus \cuent state = &not valid" causes yes to point to not valid instead of valid simulation. In the second case (tape head- >sym) is yes and \(tape head->sym) = &not valid" causes yes to point to not valid. The lemma is satised egadless of the subsequent code because yes points to not valid. We now poceed assuming that M is scanning j (l) and is in state q i (q 2 ). Since (q i, j ) = (q 0,d) i,0 j we want to shift to state q 0 i (\cuent state = &q0 i "), wite 0 j &j 0 "), and move the tape head one unit in diection d: to the tape (\tape head->sym = #if d = R #if d = L tape head = tape head->next; tape head = tape head->pev; #endif #endif Finally, the statements \q i = &yes; j = &yes" estoe the condition that all state and alphabet vaiables point to yes. To nish ou example whee (q 2,l) = (q 1,e,L), the pogam stoe now is: 11

12 h: tape head: back: e: l: no: not valid: o: : cuent state: q 1 : q 2 :... q : n Q - yes: valid simulation: 2 The est of Figue 4 is addessed in the following lemma: Lemma 2.4 M halts on w i on some path to s, in the pogam geneated by educe, cuent state is valid simulation. Conside the pogam C geneated by educe. By an inductive agument it is easy to show that: 1. on all paths to the top of the while loop on which yes points to valid simulation, if the alias patten epesents x 0 q i 0y 0 then q 0 w ` M q x0 i 0y if q 0 w ` xq M iy then thee is at least one path 5 to the top of the while loop geneated by Figue 4 on which yes points to valid simulation and the alias patten epesents xq i y. The poofs ae by induction on the numbe of times the path has passed though the top of the loop and on numbe of steps M has taken to deive xq i y. In both poofs, the base case is shown by Lemma 2.1 and the induction step can be shown by appealing to Lemma 2.2 and Lemma 2.3. M halts on w i q 0 w ` M xq f y (some x,y); thus M halts on w i thee exists a path to the top of the loop on which yes points to valid simulation and cuent state points to q f. Conside the eects of CHECK ANSWER in Figue 4. If cuent state does not point to q f then **cuent state must be not valid. If yes points to not valid then **cuent state must be not valid. If cuent state points to q f must be valid simulation. and yes points to valid simulation then **cuent state This means that M halts on w i on some path to s cuent state is valid simulation. 2 5 exactly one path unless xq iy `+ M xqiy. 12

13 3 May Alias is not ecusive Theoem 3.1 Statically detemining Intapocedual May Alias fo languages with if-statements, loops, dynamic stoage, and ecusive data stuctues is ecusively enumeable but not ecusive even when all paths though the pogam ae executable. Conside the pogam C geneated by educe. All paths though C ae executable. Conside any path P, let c 1 c 2 :::c k be a sequence with a unique c i fo evey conditional (i.e., if and while statements) on P in the ode that they appea on P. Let c i be 1 if the tue banch of the coesponding conditional is taken on P, and let c i be 0 othewise. Clealy, c 1 c 2 :::c k is an input that executes path P. By Lemma 2.4, M halts on w i on some path to s in C cuent state is valid simulation. Theefoe, May Alias is not ecusive as it can be used to solve the halting poblem even fo pogams on which all paths ae executable. May Alias is ecusively enumeable since we can nondeteministically geneate uns of a pogam and questions about aliasing duing an execution can be answeed by examining the symbol table and the pogam stoe. 2 Theoem 3.2 Statically detemining Intapocedual Must Alias fo languages with if-statements, loops, dynamic stoage, and ecusive data stuctues is not ecusively enumeable even when all paths though the pogam ae executable. A quick look at the pogam poduced by educe (on which all paths ae executable; see poof of Theoem 3.1) shows that yes eithe points to not valid o valid simulation, no always points to not valid, q 2 Q always points to yes o no, and cuent state always points to a state. This implies that cuent state is eithe valid simulation o not valid. Since we aleady showed that M halts on w i on some path to s cuent state is valid simulation (Lemma 2.4), it follows that M does not halt i cuent state is not valid on all paths to s. Thus, Must Alias can be used to solve the complement of the halting poblem which is not ecusively enumeable. This means that Must Alias is not ecusively enumeable given the language equiements stated by the theoem. 2 13

14 4 Conclusion We have shown that intapocedual May Alias is not ecusive and intapocedual Must Alias is not ecusively enumeable even fo pogams on which all paths ae executable given the language has dynamically allocated ecusive data stuctues, loops, and if-statements. This is an extemely negative esult, consideing that a doubly linked list was the only dynamic data stuctue needed. Unfotunately, the poofs can be modied to use only a singly linked list. In Appendix A, we show how to modify educe so that only a singly linked list is needed. These esults do not imply that Static Analysis is dead. They simply mean that, as has been known all along, some appoximation must be done. What the new esults do show is that, even if we ae allowed to wite exponential algoithms, Static Analysis would still have to be appoximate. It pobably also means that, in the pesence of dynamically allocated ecusive data stuctues, we have to accept appoximations of lesse quality, which also take moe time and space to compute than in FORTRAN. One nal implication of ou esults is that while detemining the stuctue of dynamic data stuctues (i.e., is it a tee linked list...) is impotant, it is not sucient to make Static Analysis ecusive, because ou poofs used only pogams with linked lists. Cuently, Static Analysis is in the same situation as it was fo FORTRAN 20 o so yeas ago. We ae dealing with a poblem which is not ecusive, and need to come up with a good set of simplifying assumptions and algoithms that yield easonably good appoximations quickly and cheaply. In most wok in Static Analysis, these assumptions ae being intoduced in an ad hoc manne and ae often not even explicitly stated. In the futue, it would be nice to have simplifying assumptions that would wok fo Static Analysis is geneal. One such assumption is that only polynomial length paths need be consideed. This seems easonable, as we aleady assume that pogams \teminate nomally" (fo example, no division by 0), and non-polynomial executions ae geneally not toleated. The nice esult of this assumption is that it makes most Static Analyses N P complete (see Appendix B). On the othe hand, it is dicult to see how this would inuence the development of appoximate algoithms. Acknowledgments: We thank Rita Altuche, Buce Ladendof, Tom Malowe, Michael Plato, and the eviewes fo thei comments on this mateial. 14

15 Refeences [1] Aho, A. V., Hopcoft, J. E., and Ullman, J. D. The Design and Analysis of Compute Algoithms. Addison-Wesley, [2] Aho, A. V., Sethi, R., and Ullman, J. D. Compiles: Pinciples, Techniques, and Tools. Addison-Wesley, [3] Cousot, P., and Cousot, R. Abstact intepetation: A unied lattice model fo static analysis of pogams by constuction o appoximation of xpoints. In Confeence Recod of the Fouth Annual ACM Symposium on Pinciples of Pogamming Languages (Jan. 1977), pp. 238{252. [4] Hecht, M. S. Flow Analysis of Compute Pogams. Elsevie Noth-Holland, [5] Hopcoft, J. E., and Ullman, J. D. Intoduction to Automata Theoy, Languages, and Computation. Addison-Wesley, Reading, Mass., [6] Howitz, S., Pfeiffe, P., and Reps, T. Dependence analysis fo pointe vaiables. In Poceedings of the ACM SIGPLAN Symposium on Compile Constuction (June 1989), pp. 28{40. [7] Kam, J. B., and Ullman, J. D. Global ow analysis and iteative algoithms. Jounal of the ACM 23, 1 (1976), 158{171. [8] Kam, J. B., and Ullman, J. D. Monotone data ow analysis famewoks. Acta Infomatica 7 (1977), 305{317. [9] Kildall, G. A unied appoach to global pogam optimization. In Confeence Recod of the ACM Symposium on Pinciples of Pogamming Languages (Jan. 1973), pp. 194{206. [10] Landi, W. Intepocedual Aliasing in the Pesence of Pointes. PhD thesis, Rutges Univesity, Jan LCSR-TR-174. [11] Landi, W., and Ryde, B. G. Pointe-induced aliasing: A poblem classication. In Confeence Recod of the Eighteenth Annual ACM Symposium on Pinciples of Pogamming Languages (Jan. 1991), pp. 93{103. [12] Laus, J. R. Restuctuing Symbolic Pogams fo Concuent Execution on Multipocessos. PhD thesis, Univesity of Califonia Bekeley, May [13] Laus, J. R., and Hilfinge, P. N. Detecting conicts between stuctue accesses. In Poceedings of the SIG- PLAN '88 Confeence on Pogamming Language Design and Implementation (July 1988), pp. 21{34. SIGPLAN NOTICES, Vol. 23, No. 7. [14] Myes, E. M. A pecise intepocedual data ow algoithm. In Confeence Recod of the Eighth Annual ACM Symposium on Pinciples of Pogamming Languages (Jan. 1981), pp. 219{230. [15] Ullman, J. D. Fast algoithms fo the elimination of common subexpessions. Acta Infomatica 2, 3 (1973), 191{213. [16] Wegman, M., and Zadeck, F. K. Constant popagation with conditional banches. ACM Tansactions on Pogamming Languages and Systems 13, 2 (Ap. 1991), 181{210. A Modication to singly linked list The machine educe (Figue 1) is modied to constuct a pogam with only a singly linked list and that still satisfy Theoem 3.1 and Theoem 3.2 as follows: Remove pev eld fom stuct tape. Also emove all statements dealing with pev. Add the eld \int not at" to type stuct tape. Point not at to yes wheneve a new tape element is ceated. 15

16 Add a vaiable \stuct tape font" which will always point to the st (leftmost) element of the linked list. Immediately befoe the while loop that simulates add the statement: tape head>not at = &no In geneal, the not at eld of the linked list epesenting the tape points to yes except at tape head whee it points to no. Replace the code fo when d = R in the loop with: #if d = R tape head->not at = &yes; tape head = tape head->next ; tape head->not at = &no; #endif Finally, eplace the code fo when d = L in the loop with: #if d = L tape head = font; while (next bool == 1) f ADD TO END / The code fo ADD TO END hee / tape head = tape head->next; g / tape head->next->not at points to yes and this assignment signals invalid simulation unless tape head is one LEFT of whee it was / (tape head->next->not at) = &not valid; tape head->next->not at = &yes; tape head->not at = &no; #endif B Polynomial paths only When only polynomial length paths ae consideed, May Alias and the complement of Must Alias ae N P complete fo pogams on which all paths ae executable given the language has dynamically allocated ecusive data stuctues, loops, and if-statements. These poblems ae in N P because we can nondeteministically geneate an execution of the pogam and then simulate the execution in time linea in the length of the execution (a simila agument is in [12]). Fom the pogam stoe 16

17 we can easily answe questions about May Alias and the complement of Must Alias. This agument woks fo Static Analysis poblems which can be nondeteministically answeed fo a given execution in a polynomial amount of time, in the size of the pogam and length of the execution path, fom the pogam, symbol table, and a possibly augmented pogam stoe. Howeve, the augmented stoe must be polynomial in the size of the oiginal stoe; fo example, [6]. The fact that May Alias and the complement of Must Alias ae both N P had unde this new assumption is evident because ou oiginal poofs of this claim [11, 10] do not contain any loops and only linea length paths exist. Since most Static Analyses ae inuenced by aliases, they ae also N P had. 17