Last time Interprocedural analysis Dimensions of precision (flow- and context-sensitivity) Flow-Sensitive Pointer Analysis

Transcription

1 Flow-Insnsitiv Pointr Anlysis Lst tim Intrprocurl nlysis Dimnsions of prcision (flow- n contxt-snsitivity) Flow-Snsitiv Pointr Anlysis Toy Flow-Insnsitiv Pointr Anlysis CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 2 Flow-Insnsitiv Pointr Anlysis Th fining chrctristics Ignor th control-flow grph, n ssum tht sttmnts cn xcut in ny orr Rthr thn proucing solution for ch progrm point, prouc singl solution tht is vli for th whol progrm Flow-insnsitiv pointr nlyss Anrsn-styl nlysis: th slowst n most prcis Stnsgr nlysis: th fstst n lst prcis All othr flow-insnsitiv pointr nlyss r hybris of ths two CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 3

2 Anrsn-Styl Pointr Anlysis [1994] Bsic i Viw pointr ssignmnts s constrints Us ths constrints to propgt points-to informtion CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 4 Anrsn-styl Pointr Anlysis Exmpl 1 Progrm := &b c := := & := Flow-Snsitiv Solution { b } c { b } { } { } CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 5

3 Anrsn-styl Pointr Anlysis Exmpl 1 Progrm Constrints Points-to Rltions := &b c := := & := { b, } c { b, } c { } b, } { } b, } W v rch fix point Trminology Bs constrints: Us to initiliz th points-to sts Ex: := &b Not n ftr initiliztion Simpl constrints: Involv vribl nms only Ex: c := Complx constrints: Involv pointr rfrncs Ex: * := c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 6 Anrsn-styl Pointr Anlysis Exmpl 2 Progrm := &b c := & := & f := * := c Constrints { b } c { } { } f * c c Points-to Rltions { b,} } c { } { } f { } b,} } Notic tht w crt th constrint grph ynmiclly CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 7

4 Anrsn-Styl Pointr Anlysis Bsic i Viw pointr ssignmnts using constrint grph Propgt points-to rltions long th gs of th constrint grph, ing nw gs s inirct constrints r rsolv Constrint grph On no for ch vribl On irct g for ch constrint Anrsn-styl nlysis Cn b ruc to computing th trnsitiv closur of ynmic grph A wll-stui problm for which th bst known complxity is O(n 3 ) CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 8 Anrsn-styl Pointr Anlysis Th Constrint Grph Exmpl 1 c {b,} {b,} {b,} CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 9

5 Anrsn-styl Pointr Anlysis Th Constrint Grph Exmpl 2 f c [* c] {b,} {b} {b,} {b} {} {} CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 10 Anrsn-styl Pointr Anlysis Cycl Elimintion Cycl Elimintion Th most importnt optimiztion for Anrsn-styl nlysis Dtct strongly-connct componnts in th constrint grph Collps thm into singl no Th rtionl All nos in th sm SCC r gurnt to hv th sm points-to rltions t th n of th nlysis Compliction Most SCCs r crt ynmiclly uring th nlysis Cycl limintion must b prform ynmiclly for grtst ffct CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 11

6 Anrsn-styl Pointr Anlysis Cycl Elimintion {w,x,y,z} {} {w,x,y,z} {w,x} {w} b {w,x,y,z} {x} c {w,x,y,z} {w,x,z} {z} {w,x,y,z} {y} CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 12 Anrsn-styl Pointr Anlysis Cycl Elimintion,b,c, {w,x,y,z} {} {w,x,y,z} CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 13

7 Anrsn-styl Pointr Anlysis Procur Clls Progrm foo(int* x){... rturn x; } Constrints x { b } x := foo(&b) How o w hnl procur clls? Insrt constrints for copying ctul prmtrs to forml prmtrs Insrt constrints for copying rturn vlus CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 14 Stnsgr Pointr Anlysis Bsic i Furthr ruc prcision by using qulity constrints Tht is, informtion flows both wys, rthr thn from th right-hn si to th lft-hn si of th constrint. Troffs Imprcis A systm of qulity constrints cn b solv in nr-linr tim Running tim is O(n α(n)), whr α(n) is th invrs Ackrmnn s function. α(2 132 ) < 4 Ky i Th ky to this lgorithm is th UNION-FIND t structur. CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 15

8 Stnsgr Pointr Anlysis UNION-FIND Th UNION-FIND t structur Mintins st of isjoint sts n supports two oprtions: FIND(x) : rturn th st contining x. UNION(x,y) : union th two sts contining x n y. St Rprsnttion Sts r rprsnt by istinguish lmnt cll th st rprsnttiv Ech st is n invrt tr, with nos pointing to thir prnts n th st rprsnttiv s th root CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 16 Stnsgr Pointr Anlysis UNION-FIND UNION (, b) - FIND(b) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 17

9 Stnsgr Pointr Anlysis UNION-FIND UNION (, c) - FIND(c) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 18 Stnsgr Pointr Anlysis UNION-FIND UNION (, ) - FIND() b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 19

10 UNION-FIND Optimiztions Two ky optimiztions Pth comprssion Union-by-rnk Togthr ths optimiztions yil nr-linr tim oprtions Pth comprssion Avoi runnt srchs for th st rprsnttiv Union-by-rnk Whn prforming th UNION oprtion, choos th st rprsnttiv bs on th sizs of th two sts CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 20 Stnsgr Pointr Anlysis Pth Comprssion UNION (, b) - FIND(b) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 21

11 Stnsgr Pointr Anlysis Pth Comprssion UNION (, c) - FIND(c) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 22 Stnsgr Pointr Anlysis Pth Comprssion UNION (, ) - FIND() b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 23

12 Stnsgr Pointr Anlysis Union-by-Rnk UNION (, b) - FIND(b) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 24 Stnsgr Pointr Anlysis Union-by-Rnk UNION (, c) - FIND(c) b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 25

13 Stnsgr Pointr Anlysis Union-by-Rnk UNION (, ) - FIND() b c Wht is th bnfit of union-by-rnk? It nsurs tht w follow s fw prnt pointrs s possibl Consir th cost of slcting s th nw st rprsnttiv in this lst union oprtion CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 26 Stnsgr Pointr Anlysis th Algorithm mrg(x, y) { x = FIND(x); y = FIND(y); if (x == y) thn rturn; UNION(x,y); mrg(points-to(x),points-to(y)); } for ch constrint LHS = RHS mrg(lhs,rhs) CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 27

14 Stnsgr Pointr Anlysis Exmpl 1 Progrm := &b c := := & := Constrints = { b, } c = = Points-to Rltions,c, b, CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 28 Stnsgr Pointr Anlysis Exmpl 2 Progrm Constrints Points-to Rltions := &b c := & := & f := * := c = { b } c = { } = { } f = * = c,f,c c b, b CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 29

15 Anrsn vs. Stnsgr Anrsn-styl nlysis int **, *b, c, *, ; 1: = &b; 2: b = &c; 3: = &; 4: = &; b c u to sttmnt 4 b c Stnsgr nlysis b c u to sttmnt 4 b c CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 30 Concpts Flow-insnsitiv pointr nlysis Anrsn-styl nlysis Inclusion-bs, subst-bs Comput trnsitiv closur of ynmic grph Constrint grph Cycl limintion optimiztion Stnsgr-styl nlysis Unifiction-bs, qulity-bs Union-fin t structur CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 31

16 Nxt Tim Lctur Contxt-Snsitiv Pointr Anlysis CIS 570 Lctur 12 Flow-Insnsitiv Pointr Anlysis 32