interprocedural heap analysis using access graphs and
play

Interprocedural Heap Analysis using Access Graphs and Value Contexts - PowerPoint PPT Presentation

Jan 07, 2023 •158 likes •1.58k views

Interprocedural Heap Analysis using Access Graphs and Value Contexts with applications to liveness-based garbage collection Rohan Padhye under the guidance of Prof. Uday Khedker Department of Computer Science & Engineering Indian

  1. Accessor Relationship Graph Symbol Definition Cardinality V Variables Proportional to program size Memory allocation sites Proportional to program size M R Field dereference points Proportional to program size Access graph nodes | V | + | V | × | R | A | M | × 2 | A | Heap graph nodes H Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 14 / 32

  2. Accessor Relationship Graph Symbol Definition Cardinality V Variables Proportional to program size Memory allocation sites Proportional to program size M R Field dereference points Proportional to program size Access graph nodes | V | + | V | × | R | A | M | × 2 | A | Heap graph nodes H Definition Accessor Relationship Graph is a 3-tuple � E v , E f , summary � , where: E v ⊆ V × H E f ⊆ H × F × H summary : H → { true , false } Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 14 / 32

  3. Lattice Representation Definition � E v , E f , summary � ⊒ � E ′ v , E ′ f , summary ′ � if: E v ⊆ E ′ v E f ⊆ E ′ f ∀ k ∈ H : summary ( k ) ⇒ summary ′ ( k ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 15 / 32

  4. Lattice Representation Definition � E v , E f , summary � ⊒ � E ′ v , E ′ f , summary ′ � if: E v ⊆ E ′ v E f ⊆ E ′ f ∀ k ∈ H : summary ( k ) ⇒ summary ′ ( k ) Definition � E v , E f , summary � ⊓ � E ′ v , E ′ f , summary ′ � = � E ′′ v , E ′′ f , summary ′′ � such that: E ′′ v = E v ∪ E ′ v E ′′ f = E f ∪ E ′ f ∀ k ∈ H : summary ′′ ( k ) = summary ( k ) ∨ summary ′ ( k ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 15 / 32

  5. Data Flow Analysis Normalization: Θ( X , L ) = Consistency + Reachability n n n n 5 n 6 n 8 x x n S 1 S 1 S 1 S 1 x x / n 5 x / n 6 x / n 8 x = x . n S 5 n n n x S 1 S 1 S 1 S 1 n n 6 n 8 x x x / n 5 x / n 6 x / n 8 x Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 16 / 32

  6. Data Flow Analysis Normalization: Θ( X , L ) = Consistency + Reachability n n n n 5 n 6 n 8 x x n S 1 S 1 S 1 S 1 x x / n 5 x / n 6 x / n 8 x = x . n S 5 n n n x S 1 S 1 S 1 S 1 n n 6 n 8 x x x / n 5 x / n 6 x / n 8 x Data Flow Equations: PTIN b = p ∈ pred ( b ) Θ( PTOUT p , LVIN b ) ⊓ PTOUT b = Θ( f b ( PTIN b ) , LVOUT b ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 16 / 32

  7. System Model ˆ L : S × AP → { true , false } (Results of liveness analysis) ˆ P : S × AP × AP → { true , false } (Results of points-to analysis) HLA : ˆ P → ˆ L (Heap Liveness Analysis) PTA : ˆ L → ˆ (Heap Points-To Analysis) P ˆ L 0 = λ s λ a . false ∀ i ≥ 0 : ˆ P i = PTA (ˆ L i ) ∀ i ≥ 0 : ˆ L i +1 = HLA (ˆ P i ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 17 / 32

  8. System Model ˆ L : S × AP → { true , false } (Results of liveness analysis) ˆ P : S × AP × AP → { true , false } (Results of points-to analysis) HLA : ˆ P → ˆ L (Heap Liveness Analysis) PTA : ˆ L → ˆ (Heap Points-To Analysis) P ˆ L 0 = λ s λ a . false ∀ i ≥ 0 : ˆ P i = PTA (ˆ L i ) ∀ i ≥ 0 : ˆ L i +1 = HLA (ˆ P i ) ˆ L i ⊆ ˆ L j iff ∀ s ∈ S , ∀ a ∈ AP : ˆ L i ( s , a ) ⇒ ˆ L j ( s , a ) P i ⊆ ˆ ˆ P j iff ∀ s ∈ S , ∀ a ∈ AP , ∀ b ∈ AP : ˆ P i ( s , a , b ) ⇒ ˆ P j ( s , a , b ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 17 / 32

  9. Precision of Liveness ˆ L 0 ˆ P 0 ˆ L 1 ˆ P 1 ˆ L 2 ˆ P 2 ˆ L 3 ˆ P 3 ˆ L 4 · · · Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 18 / 32

  10. Precision of Liveness ˆ L 0 ˆ P 0 ˆ L 1 ˆ P 1 ˆ L 2 ˆ P 2 ˆ L 3 ˆ P 3 ˆ L 4 · · · Theorem The results of the second round of heap liveness analysis is the most precise result which is also sound. That is, ∀ k > 0 : ˆ L 2 ⊆ ˆ L k . Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 18 / 32

  11. Precision of Liveness ˆ L 0 ˆ P 0 ˆ L 1 ˆ P 1 ˆ L 2 ˆ P 2 ˆ L 3 ˆ P 3 ˆ L 4 · · · Theorem The results of the second round of heap liveness analysis is the most precise result which is also sound. That is, ∀ k > 0 : ˆ L 2 ⊆ ˆ L k . Lemma (1) ∀ i , j : ˆ L i ⊆ ˆ L j ⇒ ˆ P i ⊇ ˆ P j Lemma (2) ∀ i , j : ˆ P i ⊆ ˆ P j ⇒ ˆ L i +1 ⊆ ˆ L j +1 Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 18 / 32

  12. Precision of Liveness ˆ L 0 ˆ P 0 ˆ L 1 ˆ P 1 ˆ L 2 ˆ P 2 ˆ L 3 ˆ P 3 ˆ L 4 · · · Theorem The results of the second round of heap liveness analysis is the most precise result which is also sound. That is, ∀ k > 0 : ˆ L 2 ⊆ ˆ L k . Proof. Lemma (1) 1. ∀ k ≥ 0 : ˆ L 0 ⊆ ˆ L k (By Definition) 2. ∀ k ≥ 0 : ˆ P 0 ⊇ ˆ ∀ i , j : ˆ L i ⊆ ˆ L j ⇒ ˆ P i ⊇ ˆ P k (Lemma 1) P j 3. ∀ k ≥ 0 : ˆ L 1 ⊇ ˆ L k +1 (Lemma 2) 4. ∀ k ≥ 0 : ˆ P 1 ⊆ ˆ P k +1 (Lemma 1) Lemma (2) 5. ∀ k ≥ 0 : ˆ L 2 ⊆ ˆ (Lemma 2) L k +2 ∀ i , j : ˆ P i ⊆ ˆ P j ⇒ ˆ L i +1 ⊆ ˆ 6. ∀ k > 0 : ˆ L 2 ⊆ ˆ L j +1 L k (Step 3 and 5) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 18 / 32

  13. Outline Background and Motivation 1 Heap Reference Analysis Key Issues Heap Alias Analysis 2 Need for Alias Analysis Existing Abstractions Proposed Abstraction: Acccessor Relationship Graph Interprocedural Analysis 3 Existing Frameworks Our Framework: Value Contexts The Role of Call Graphs Access Graphs for Garbage Collection 4 Existing Ideas Novel Technique: Dynamic Heap Pruning Summary & Future Work 5 Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 19 / 32

  14. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  15. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  16. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  17. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  18. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  19. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Modelled as a graph reachability problem Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  20. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Modelled as a graph reachability problem Main limitation: Requires distributive flow functions Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  21. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Modelled as a graph reachability problem Main limitation: Requires distributive flow functions Not suitable for many types of heap analysis Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  22. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Modelled as a graph reachability problem Main limitation: Requires distributive flow functions Not suitable for many types of heap analysis Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  23. Interprocedural Analysis No existing implementation of inter-procedural heap reference analysis Soot has excellent API for data flow analysis - only intraprocedural IFDS/IDE solver [Bodden, SOAP 2012] f ( { x , y , z } ) = f ( { x } ) ⊓ f ( { y } ) ⊓ f ( { z } ) Functions on 2 D reduced to functions on D Modelled as a graph reachability problem Main limitation: Requires distributive flow functions Not suitable for many types of heap analysis n y o 1 o 2 x = y . n n y o 1 o 2 x Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 20 / 32

  24. Interprocedural Analysis The most general and precise solutions: Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  25. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  26. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  27. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  28. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  29. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  30. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Value contexts [Padhye & Khedker, 2013] Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  31. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Value contexts [Padhye & Khedker, 2013] Reformulation of tabulation method Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  32. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Value contexts [Padhye & Khedker, 2013] Reformulation of tabulation method Suitable for bi-directional interleaved analyses Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  33. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Value contexts [Padhye & Khedker, 2013] Reformulation of tabulation method Suitable for bi-directional interleaved analyses Can map arbitrary call string to value context (dynamic optimizations) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  34. Interprocedural Analysis The most general and precise solutions: Call Strings (maintain an abstract call stack) [Sharir & Pnueli, 1981] Functional (flow functions for call statements) [Sharir & Pnueli, 1981] Function composition method Tabulation method Modified call-strings method [Khedker & Karkare, 2008] Value-based termination of call string construction Value contexts [Padhye & Khedker, 2013] Reformulation of tabulation method Suitable for bi-directional interleaved analyses Can map arbitrary call string to value context (dynamic optimizations) Context-sensitive data flow solution (specialization) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 21 / 32

  35. Value Contexts Value contexts: Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  36. Value Contexts Value contexts: X = � method , entryValue � Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  37. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  38. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  39. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  40. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Call-sites: Find value context X = � method , entryValue � Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  41. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Call-sites: Find value context X = � method , entryValue � Found: Re-use exitValue ( X ) Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  42. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Call-sites: Find value context X = � method , entryValue � Found: Re-use exitValue ( X ) Not found: Create new X and add all nodes to work-list Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  43. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Call-sites: Find value context X = � method , entryValue � Found: Re-use exitValue ( X ) Not found: Create new X and add all nodes to work-list Record transition from this call-site to X Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  44. Value Contexts Value contexts: X = � method , entryValue � exitValue ( X ) Data Flow Analysis is performed using traditional work-list method Work-list contains � context , node � pairs Call-sites: Find value context X = � method , entryValue � Found: Re-use exitValue ( X ) Not found: Create new X and add all nodes to work-list Record transition from this call-site to X Exit-sites: Set exitValue ( X ) and add callers to work-list Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 22 / 32

  45. Example - Sign Analysis main() f(a, b) g(u) n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit − + 0 ⊥ Component Value Contexts Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  46. Example - Sign Analysis main() f(a, b) g(u) n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 ⊥ Component Value Contexts Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  47. Example - Sign Analysis main() f(a, b) g(u) � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 ⊥ Component Value Contexts Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  48. Example - Sign Analysis main() f(a, b) g(u) � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 ⊥ Component Value Contexts Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  49. Example - Sign Analysis main() f(a, b) g(u) � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 a + b − X 1 f ⊤ ⊥ Component Value Contexts Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  50. Example - Sign Analysis main() f(a, b) g(u) � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 a + b − X 1 f ⊤ X 0 X 1 ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  51. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 a + b − X 1 f ⊤ X 0 X 1 ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  52. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 a + b − X 1 f ⊤ X 0 X 1 ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  53. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 a + b − X 1 f ⊤ X 0 X 1 u + ⊤ X 2 g ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  54. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 a + b − X 1 f ⊤ X 0 X 1 X 2 u + ⊤ X 2 g ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  55. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 a + b − X 1 f ⊤ X 0 X 1 X 2 u + ⊤ X 2 g ⊥ Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  56. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 a + b − X 1 f ⊤ X 0 X 1 X 2 u + ⊤ X 2 g ⊥ a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  57. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  58. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  59. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  60. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  61. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + � c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  62. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + � c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  63. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + � c 4 r = g(-q) n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  64. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + ⊤ X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  65. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  66. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 2 , u + v − � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + ⊤ X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  67. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 2 , u + v − � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  68. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 2 , u + v − � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  69. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 0 , p + � � X 3 , a − b + � � X 2 , u + v − � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  70. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  71. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  72. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − X 1 f ⊤ X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  73. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − a + b − c − X 1 f X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  74. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 0 , p + q − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − a + b − c − X 1 f X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  75. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 0 , p + q − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − a + b − c − X 1 f X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f c 4 Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  76. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 0 , p + q − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 0 , p + q − r − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit X 0 main ⊤ ⊤ − + 0 c 1 c 2 c 3 a + b − a + b − c − X 1 f X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f c 4 Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  77. Example - Sign Analysis main() f(a, b) g(u) � X 1 , a + b − � � X 0 , ⊤� � X 2 , u + � � X 3 , a − b + � n 1 p = 5 n 2 c 3 if (...) v = f(-u, u) � X 1 , a + b − � � X 1 , a + b − � � X 0 , p + � � X 2 , u + v − � � X 3 , a − b + � � X 3 , a − b + � n 3 c 1 c 2 n 6 q = f(p, -3) c = a * b c = g(10) return v � X 1 , a + b − c − � � X 1 , a + b − c − � � X 0 , p + q − � � X 3 , a − b + c − � � X 3 , a − b + c − � c 4 r = g(-q) � X 1 , a + b − c − � � X 0 , p + q − r − � � X 3 , a − b + c − � n 6 n 5 return c exit ⊤ Context Proc. Entry Exit p + q − r − X 0 main ⊤ − + 0 c 1 c 2 c 3 a + b − a + b − c − X 1 f X 0 X 1 X 2 X 3 u + u + v − X 2 g ⊥ c 2 a − b + a − b + c − X 3 f c 4 Component Value Contexts Context Transitions Lattice Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 23 / 32

  78. Implementation Framework InterProceduralAnalysis<M,N,A> Context<M,N,A> + topValue() : A + getMethod(): M + boundaryValue(M) : A + getEntryValue() : A + copy(A) : A + getExitValue() : A + meet(A,A) : A + getValueBefore(N) : A + normalFlowFunction(Context<M,N,A>, N, A) : A + getValueAfter(N) : A + callEntryFlowFunction(Context<M,N,A>, M, N, A) : A + callExitFlowFunction(Context<M,N,A>, M, N, A) : A + callLocalFlowFunction(Context<M,N,A>, N, A) : A + programRepresentation() : ProgramRepresentation<M,N> ProgramRepresentation<M,N> + doAnalysis() : void + getContexts() : Map<M,List<Context<M,N,A>>> + getMeetOverPathsSolution() : DataFlowSolution<M,N,A> + getEntryPoints() : List<M> + getControlFlowGraph(M) : DirectedGraph<N> + isCall(N) : boolean + resolveTargets(M, N) : List<M> ForwardInterProceduralAnalysis<M,N,A> BackwardInterProceduralAnalysis<M,N,A> + doAnalysis() : void + doAnalysis() : void https://github.com/rohanpadhye/vasco Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 24 / 32

  79. The Role of Call Graphs Context-sensitivity only useful if call graph is precise Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 25 / 32

  80. The Role of Call Graphs Context-sensitivity only useful if call graph is precise OOP: Use points-to analysis to resolve virtual calls Rohan Padhye (IIT Bombay) Interprocedural Heap Analysis MTP 25 / 32

Recommend

Interprocedural Analysis Last time Interprocedural analysis Today Interprocedural alias

Interprocedural Analysis Last time Interprocedural analysis Today Interprocedural alias

Interprocedural Analysis Last time Interprocedural analysis Today Interprocedural alias analysis Interprocedural optimization CS553 Lecture Interprocedural Analysis and Optimization 2 Improving the Efficiency of the Iterative

276 views • 10 slides
EDA045F: Program Analysis LECTURE 6: DATALOG Christoph Reichenbach In the last lecture. . .

EDA045F: Program Analysis LECTURE 6: DATALOG Christoph Reichenbach In the last lecture. . .

EDA045F: Program Analysis LECTURE 6: DATALOG Christoph Reichenbach In the last lecture. . . Pointer Analysis Points-To Analysis Alias Analysis Concrete Heap Graphs Abstract Heap Graphs Access Paths Heap Summarisation

822 views • 53 slides
Interprocedural Analysis 15819M 15819M Program Analysis Jonathan Aldrich Interprocedural

Interprocedural Analysis 15819M 15819M Program Analysis Jonathan Aldrich Interprocedural

Interprocedural Analysis 15819M 15819M Program Analysis Jonathan Aldrich Interprocedural Analysis Strategies Make default assumptions Assume and check annotations Build Interprocedural CFG Compute Summaries

656 views • 21 slides
Interprocedural Analysis Last time Alias analysis Today Interprocedural analysis CS553

Interprocedural Analysis Last time Alias analysis Today Interprocedural analysis CS553

Interprocedural Analysis Last time Alias analysis Today Interprocedural analysis CS553 Lecture Interprocedural Analysis 2 Using Alias Information Example: reaching definitions Compute at each point in the program a set of ( s,v

99 views • 9 slides
Interprocedural Analysis and Optimization Mod/Ref Analysis Alias Analysis Constant Propagation

Interprocedural Analysis and Optimization Mod/Ref Analysis Alias Analysis Constant Propagation

Interprocedural Analysis and Optimization Mod/Ref Analysis Alias Analysis Constant Propagation Procedure Inlining and Cloning cs6363 1 Introduction Interprocedural Analysis Gathering information about the whole program instead of a

496 views • 22 slides
Interprocedural Analysis and Abstract Interpretation cs6463 1 Outline Interprocedural

Interprocedural Analysis and Abstract Interpretation cs6463 1 Outline Interprocedural

Interprocedural Analysis and Abstract Interpretation cs6463 1 Outline Interprocedural analysis control-flow graph MVP: Meet over Valid Paths Making context explicit Context based on call-strings Context based on

528 views • 34 slides
Interprocedural control-flow analysis Nate Nystrom CS 711 6 Sep 05 Call graphs Statically

Interprocedural control-flow analysis Nate Nystrom CS 711 6 Sep 05 Call graphs Statically

Interprocedural control-flow analysis Nate Nystrom CS 711 6 Sep 05 Call graphs Statically compute a precise call graph Maps call sites to functions called Challenge: Methods Higher-order functions Can use precise call

425 views • 19 slides
Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer Outline 1. Motivation 2.

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer Outline 1. Motivation 2.

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer Outline 1. Motivation 2. CPAchecker and Symbolic Memory Graphs 3. Abstractions of Symbolic Memory Graphs 4. Using counterexample guided abstraction refinement with Symbolic

412 views • 24 slides
Alias Analysis Last time Interprocedural analysis Today Intro to alias analysis (pointer

Alias Analysis Last time Interprocedural analysis Today Intro to alias analysis (pointer

Alias Analysis Last time Interprocedural analysis Today Intro to alias analysis (pointer analysis) CS553 Lecture Alias Analysis I 1 Aliasing What is aliasing? When two expressions denote the same mutable memory location e.g.,

812 views • 19 slides
Towards Dynamic Interprocedural Analysis in JVMs Feng Qian and Laurie Hendren { fqian,hendren }

Towards Dynamic Interprocedural Analysis in JVMs Feng Qian and Laurie Hendren { fqian,hendren }

Towards Dynamic Interprocedural Analysis in JVMs Feng Qian and Laurie Hendren { fqian,hendren } @cs.mcgill.ca. School of Computer Science, McGill University http://www.sable.mcgill.ca VM 2004 p.1/23 Motivation Goal: do interprocedural

476 views • 23 slides
Interprocedural Optimisation Seminar Static Program Analysis Barbara D orr Sources :

Interprocedural Optimisation Seminar Static Program Analysis Barbara D orr Sources :

Introduction Simple Optimisations Operational Semantic Functional Approach Related Approaches Summary Interprocedural Optimisation Seminar Static Program Analysis Barbara D orr Sources : Ubersetzerbau - Analyse und Transformation (H.

982 views • 77 slides
heaps and heapsort on n elements height of a heap is in (log n ) building a heap bottum-up in O (

heaps and heapsort on n elements height of a heap is in (log n ) building a heap bottum-up in O (

heaps and heapsort on n elements height of a heap is in (log n ) building a heap bottum-up in O ( n ) analysis via picture (learn) or using summations (know result) data structures and algorithms building a heap one-by-one in O ( n log n ) 2020

672 views • 7 slides
Computing Summaries for Interprocedural Analysis Ashish Tiwari Tiwari@csl.sri.com Computer

Computing Summaries for Interprocedural Analysis Ashish Tiwari Tiwari@csl.sri.com Computer

Computing Summaries for Interprocedural Analysis Ashish Tiwari Tiwari@csl.sri.com Computer Science Laboratory SRI International Menlo Park CA 94025 http://www.csl.sri.com/tiwari Joint work with Sumit Gulwani, Microsoft Research

373 views • 23 slides
PROGRAM HEAP 2020-2021 WHAT IS HEAP? HEAP is a federally funded program that assists low

PROGRAM HEAP 2020-2021 WHAT IS HEAP? HEAP is a federally funded program that assists low

ERIE COUNTY DEPARTMENT OF SOCIAL SERVICES Program Overview PROGRAM HEAP 2020-2021 WHAT IS HEAP? HEAP is a federally funded program that assists low income households to reduce energy expense s. HEAP PROGRAMS Regular HEAP Available

531 views • 14 slides
A Generic Framework for Interprocedural Analysis of Numerical Properties + Markus Mller-Olm

A Generic Framework for Interprocedural Analysis of Numerical Properties + Markus Mller-Olm

A Generic Framework for Interprocedural Analysis of Numerical Properties + Markus Mller-Olm Helmut Seidl + Mnster Mnchen PUMA Ringvorlesung, 2009 1 Outline: Background The framework for affine relations Grangers

1.53k views • 113 slides
Objectives Graphs Graph Connectivity, Traversal BFS &amp; DFS Implementations, Analysis

Objectives Graphs Graph Connectivity, Traversal BFS &amp; DFS Implementations, Analysis

1/28/19 Objectives Graphs Graph Connectivity, Traversal BFS &amp; DFS Implementations, Analysis Jan 28, 2019 CSCI211 - Sprenkle 1 Review What is a heap? When is it useful? What is a graph? What are two ways to

414 views • 17 slides
Interprocedural Analysis The Problem: match entries with exits proc fib(val z, u; res v) The

Interprocedural Analysis The Problem: match entries with exits proc fib(val z, u; res v) The

Interprocedural Analysis The Problem: match entries with exits proc fib(val z, u; res v) The problem is 1 MVP: Meet over Valid Paths no [ z&lt;3 ] 2 Making context explicit yes [ call

341 views • 7 slides
PA PACE Programming Languages, Architecture and Compilers Education Laboratory Heap analysis

PA PACE Programming Languages, Architecture and Compilers Education Laboratory Heap analysis

Compare Less, Defer More Scaling Value-Contexts Based Whole-Program Heap Analyses Manas Thakur and V Krishna Nandivada CC 2019 PA PACE Programming Languages, Architecture and Compilers Education Laboratory Heap analysis Any analysis that

1.12k views • 78 slides
Interprocedural Analysis with Data-Dependent Calls Circularity dilemma In languages with function

Interprocedural Analysis with Data-Dependent Calls Circularity dilemma In languages with function

Interprocedural Analysis with Data-Dependent Calls Circularity dilemma In languages with function pointers, first-class functions, or Problem: dynamically dispatched messages, callee(s) at call site 1. to compute possible callees, depend on

286 views • 6 slides
Interprocedural Type Specialization of JavaScript Programs Without Type Analysis Maxime

Interprocedural Type Specialization of JavaScript Programs Without Type Analysis Maxime

Interprocedural Type Specialization of JavaScript Programs Without Type Analysis Maxime Chevalier-Boisvert joint work with Marc Feeley ECOOP - July 20th, 2016 Overview Previous work: Lazy Basic Block Versioning Single pass JIT code

632 views • 50 slides
Relational interprocedural analysis for concurrent programs Bertrand Jeannet INRIA Rhne-Alpes

Relational interprocedural analysis for concurrent programs Bertrand Jeannet INRIA Rhne-Alpes

Relational interprocedural analysis for concurrent programs Bertrand Jeannet INRIA Rhne-Alpes December 5, 2008 Outline Introduction Challenge: combining recursion and concurrency Existing approaches Our approach Program model and

901 views • 67 slides
CS 225 Data Structures November 5 Heap Analysis and Dis isjoint Sets Wad ade Fag agen-Ulm

CS 225 Data Structures November 5 Heap Analysis and Dis isjoint Sets Wad ade Fag agen-Ulm

CS 225 Data Structures November 5 Heap Analysis and Dis isjoint Sets Wad ade Fag agen-Ulm lmschneid ider buildHeap B 1. Sort the array its a heap! U I L D H E 2. template &lt;class T&gt; 1 2 void

329 views • 32 slides
Heapsort Build-Max-Heap Next we build a full heap from an unsorted sequence Build-Max-Heap(A)

Heapsort Build-Max-Heap Next we build a full heap from an unsorted sequence Build-Max-Heap(A)

Heapsort Build-Max-Heap Next we build a full heap from an unsorted sequence Build-Max-Heap(A) for i = floor( A.length/2 ) to 1 Max-Heapify(A, i) Build-Max-Heap Red part is already Heapified Build-Max-Heap Correctness: Base: Each alone

429 views • 23 slides
Interprocedural Analysis: Sharir-Pnuelis Call-strings Approach Deepak DSouza Department of

Interprocedural Analysis: Sharir-Pnuelis Call-strings Approach Deepak DSouza Department of

Interprocedural Analysis: Sharir-Pnuelis Call-strings Approach Deepak DSouza Department of Computer Science and Automation Indian Institute of Science, Bangalore. 06 October 2010 Call strings approach For a given program P and analysis

430 views • 24 slides

More recommend