View
213
Download
0
Category
Preview:
Citation preview
Control Flow AnalysisMooly Sagiv
http://www.math.tau.ac.il/~sagiv/courses/pa.html
Tel Aviv University
640-6706
Sunday 18-21 Scrieber 8
Monday 10-12 Schrieber 317
Textbook Chapter 3(Simplified+OO)
Goals
Understand the problem of Control Flow Analysis– in Functional Languages
– In Object Oriented Languages
– Function Pointers
Learn Constraint Based Program Analysis Technique– General
– Usage for Control Flow Analysis
– Algorithms
– Systems
Similarities between Problems &Techniques
Outline A Motivating Example (OO) The Control Flow Analysis Problem A Formal Specification Set Constraints Solving Constraints Adding Dataflow information Adding Context Information Back to the Motivating Example Conclusions
A Motivating Exampleclass Vehicle Object { int position = 10; void move(x1 : int) { position = position + x1 ;}}class Car extends Vehicle { int passengers;
void await(v : Vehicle) { if (v.position < position) then v.move(position - v.position); else self.move(10); }}class Truck extends Vehicle {
void move(x2 : int) { if (x2 < 55) position = position + x2; }}void main { Car c; Truck t; Vehicle v1;
new c; new t; v1 := c;c.passangers := 2;c.move(60);v1.move(70);c.await(t) ;}
The Control Flow Analysis (CFA) Problem
Given a program in a functional programming language with higher order functions(functions can serve as parameters and return values)
Find out for each function invocation which functions may be applied
Obvious in C without function pointers Difficult in C++, Java and ML The Dynamic Dispatch Problem
An ML Example
let f = fn x => x 1 ;
g = fn y => y + 2 ;
h = fn z => z + 3;
in (f g) + (f h)
An ML Example
let f = fn x => /* {g, h} */ x 1 ;
g = fn y => y + 2 ;
h = fn z => z + 3;
in (f g) + (f h)
The Language FUN Notations
– e Exp // expressions (or labeled terms)
– t Term // terms (or unlabeled terms)
– f, x Var // variables
– c Const // Constants
– op Op // Binary operators
– l Lab // Labels
Abstract Syntax– e ::= tl
– t ::= c | x | fn x e // function definition | fun f x e // recursive function definition | e1 e2 // function applications | if e0 then e1 else e2 | let x = e1 in e2 | e1 op e2
A Simple Example
((fn x x1)2 (fn y y3)4)5
An Example which Loops
(let g = fun f x (f1 (fn y y2)3)4
)5
(g6 (fn z z7)8)9
)10
The 0-CFA Problem Compute for every program a pair (C, ) where:
– C is the abstract cache associating abstract values with labeled program points
is the abstract environment associating abstract values with variables
Formally– v Val = P(Term) // Abstract values Env = Var Val // Abstract environment
– C Cache - Lab Val // Abstract Cache
– For function application (t1l1 t2
l2)l
C(l1) determine the function that can be applied
These maps are finite for a given program No context is considered for parameters
Possible Solutions for ((fn x x1)2 (fn y y3)4)5
1 {fn y y3} {fn y y3}
2 {fn x x1} {fn x x1}
3 {} {}
4 {fn y y3} {fn y y3}
5 {fn y y3} {fn y y3}
x {fn y y3} {}
y {} {}
(let g = fun f x (f1 (fn y y2)3)4
)5
(g6 (fn z z7)8)9
)10
Shorthand
sf fun f x (f1 (fn y y2)3)4
idy fn y y2
idz fn z z7
C(1) = {sf} C(2) = {} C(3) = {idy}
C(4) = {} C(5) = {sf} C(6) = {sf}
C(7) = {} C(8) = {idy} C(9) = {}
C(10) = {} (x) = {idy , idy } (y) = {}
(z) = {}
Relationship to Dataflow Analysis
Expressions are side effect free– no entry/exit
A single environment Represents information at different points via
maps A single value for all occurrences of a variable Function applications act similar to assignments
– “Definition” - Function abstraction is created
– “Use” - Function is applied
A Formal Specification of 0-CFA
A Boolean function define when a solution is acceptable
(C, ) e means that (C, ) is acceptable for the expression e
Define by structural induction on e Every function is analyzed once Every acceptable solution is sound (conservative) Many acceptable solutions Generate a set of constraints Obtain the least acceptable solution by solving the
constraints
Syntax Directed 0-CFA(Simple Expressions)
[const] (C, ) cl always[var] (C, ) xl if (x) C (l)
Syntax Directed 0-CFAFunction Abstraction
[fn] (C, ) (fn x e)l if:(C, ) e
fn x e C(l) [fun] (C, ) (fun f x e)l if:
(C, ) efun x e C(l)
fun x e (f)
Syntax Directed 0-CFAFunction Application
[app] (C, ) (t1l1 t2
l2)l if:(C, ) t1
l1
(C, ) t2l2
for all fn x t0l0 C(l):
C (l2) (x) C(l0) C(l) for all fun x t0
l0 C(l): C (l2) (x) C(l0) C(l)
Syntax Directed 0-CFAOther Constructs
[if] (C, ) (if t0l0 then t1
l1 else t2l2)l if:
(C, ) t0l0
(C, ) t1l1
(C, ) t2l2
C(l1) C(l)C(l2) C(l)
[let] (C, ) (let x = t1l1 in t2
l2)l if:(C, ) t1
l1
(C, ) t2l2
C(l1) (x) C(l2) C(l)
[op] (C, ) (t1l1 op t2
l2)l if:(C, ) t1
l1
(C, ) t2l2
Possible Solutions for ((fn x x1)2 (fn y y3)4)5
1 {fn y y3} {fn y y3}
2 {fn x x1} {fn x x1}
3 {} {}
4 {fn y y3} {fn y y3}
5 {fn y y3} {fn y y3}
x {fn y y3} {}
y {} {}
Set Constraints
A set of rules of the form:– lhs rhs
– {t} rhs’ lhs rhs (conditional constraint)
– lhs, rhs, rhs’ are» terms
» C(l)(x)
The least solution (C, ) can be found iterativelly– start with empty sets
– add terms when needed
Efficient cubic graph based solution
Syntax Directed Constraint Generation (Part I)
C* cl = {}C* xl = { (x) C (l)}
C* (fn x e)l = C* e { {fn x e} C(l)}C* (fun x e)l = C* e { {fun x e} C(l)} {{fun x e} ( f)}
C* (t1l1 t2
l2)l = C* t1l1 C* t2
l2 {{t} C(l) C (l2) (x) | t=fn x t0
l0 Term* } {{t} C(l) C (l0) C (l) | t=fn x t0
l0 Term* } {{t} C(l) C (l2) (x) | t=fun x t0
l0 Term* } {{t} C(l) C (l0) C (l) | t=fun x t0
l0 Term* }
Syntax Directed Constraint Generation (Part II)
C* (if t0l0 then t1
l1 else t2l2)l = C* t0
l0 C* t1l1 C* t2
l2 {C(l1) C (l)} {C(l2) C (l)}
C* (let x = t1l1 in t2
l2)l = C* t1l1 C* t2
l2 {C(l1) (x)} {C(l2) C(l)}
C* (t1l1 op t2
l2)l = C* t1l1 C* t2
l2
Set Constraints for ((fn x x1)2 (fn y y3)4)5
Iterative Solution to the Set Constraints for ((fn x x1)2 (fn y y3)4)5
step Constraint 1 2 3 4 x y
Adding Data Flow Information
Dataflow values can affect control flow analysis Example
(let f = (fn x (if (x1 > 02)3 then (fn y y4)5
else (fn z 56)7
)8
)9
in ((f10 311)12 013)14)15
Adding Data Flow Information Add a finite set of “abstract” values per program
Data Update Val = P(TermData)
Env = Var Val // Abstract environment
– C Cache - Lab Val // Abstract Cache
Generate extra constraints for data Obtained a more precise solution A special of case of product domain (4.4) The combination of two analyses may be more
precise than both For some programs may even be more efficient
Adding Dataflow Information (Sign Analysis)
Sign analysis Add a finite set of “abstract” values per program
Data = {P, N, TT, FF} Update Val = P(TermData) dc is the abstract value that represents a constant c
– d3 = {p}
– d-7= {n}
– dtrue= {tt}
– dfalse= {ff}
Every operator is conservatively interpreted
Syntax Directed Constraint Generation (Part I)
C* cl = dc C (l)}C* xl = { (x) C (l)}
C* (fn x e)l = C* e { {fn x e} C(l)}C* (fun x e)l = C* e { {fun x e} C(l)} {{fun x e} ( f)}
C* (t1l1 t2
l2)l = C* t1l1 C* t2
l2 {{t} C(l) C (l2) (x) | t=fn x t0
l0 Term* } {{t} C(l) C (l0) C (l) | t=fn x t0
l0 Term* } {{t} C(l) C (l2) (x) | t=fun x t0
l0 Term* } {{t} C(l) C (l0) C (l) | t=fun x t0
l0 Term* }
Syntax Directed Constraint Generation (Part II)
C* (if t0l0 then t1
l1 else t2l2)l = C* t0
l0 C* t1l1 C* t2
l2 {dt C (l0) C(l1) C (l)} {df C (l0) C(l2) C (l)}
C* (let x = t1l1 in t2
l2)l = C* t1l1 C* t2
l2 {C(l1) (x)} {C(l2) C(l)}
C* (t1l1 op t2
l2)l = C* t1l1 C* t2
l2 {C(l1) op C(l2) C(l)}
Adding Context Information The analysis does not distinguish between different
occurrences of a variable(Monovariant analysis)
Example(let f = (fn x x1) 2
in ((f3 f4)5 (fn y y6) 7)8)9
Source to source can help (but may lead to code explosion)
Example rewrittenlet f1 = fn x1 x1 in let f2 = fn x2 x2
in (f1 f2) (fn y y)
Simplified K-CFA
Records the last k dynamic calls (for some fixed k)
Similar to the call string approach Remember the context in which expression is
evaluated Val is now P(Term)Contexts
Env = Var Contexts Val
– C Cache - LabContexts Val
1-CFA (let f = (fn x x1) 2 in ((f3 f4)5 (fn y y6) 7)8)9
Contexts– [] - The empty context
– [5] The application at label 5
– [8] The application at label 8
Polyvariant Control FlowC(1, [5]) = (x, 5)= C(2, []) = C(3, []) = (f, []) = ({(fn x x1)}, [] )C(1, [8]) = (x, 8)= C(7, []) = C(8, []) = C(9, []) = ({(fn y y6)}, [] )
The Motivating Exampleclass Vehicle Object { int position = 10; void move(x1 : int) { position = position + x1 ;}}class Car extends Vehicle { int passengers;
void await(v : Vehicle) { if (v.position < position) then v.move(position - v.position); else self.move(10); }}class Truck extends Vehicle {
void move(x2 : int) { if (x2 < 55) position = position + x2; }}void main { Car c; Truck t; Vehicle v1;
new c; new t; v1 := c;c.passangers := 2;c.move(60);v1.move(70);c.await(t) ;}
Missing Material Efficient Cubic Solution to Set Constraints
www.cs.berkeley.edu/Research/Aiken/bane.html Experimental results for OO
www.cs.washington.edu/research/projects/cecil Operational Semantics for FUN (3.2.1) Defining acceptability without structural induction
– More precise treatment of termination (3.2.2)
– Needs Co-Induction (greatest fixed point)
Using general lattices as Dataflow values instead of powersets (3.5.2)
Lower-bounds– Decidability of JOP– Polynomiality
Conclusions
Set constraints are quite useful– A Uniform syntax
– Can even deal with pointers
But semantic foundation is still based on abstract interpretation
Techniques used in functional and imperative (OO) programming are similar
Control and data flow analysis are related
Recommended