Syntax Analysing Procedures We consider procedures with call-by-value and call-by-result parameters. Optimizing Compilers P ⋆ ::= begin D ⋆ S ⋆ end D ; D | proc p ( val x ; res y ) is ℓ n S end ℓ x D ::= Example: Inter-Procedural Dataflow Analysis ... | [ call p ( a, z )] ℓ c S ::= ℓ r begin proc fib(val z,u; res v) is Markus Schordan if z<3 then Labeling scheme (v:=u+1; r:=r+1) Institut f¨ ur Computersprachen else ( • procedure declarations call fib (z-1,u,v); Technische Universit ¨ at Wien ℓ n : for entering the body call fib (z-2,v,v) ) ℓ x : for exiting the body end; • procedure calls r:=0; call fib(x,0,y) ℓ c : for the call end ℓ r : for the return Markus Schordan October 2, 2007 1 Markus Schordan October 2, 2007 2 Markus Schordan October 2, 2007 Example Flow Graph Flow Graph for Procedures Naive Formulation proc fib ( val z , u ; res v ) Treat the three kinds of flow, ( ℓ 1 , ℓ 2 ) , ( ℓ c ; ℓ n ) , ( ℓ x ; ℓ r ) in the same w main proc p ( val x ; res y ) is ℓ n S end ℓ x [ call p ( a, z )] ℓ c ℓ r ✛ ✲ ✛ init ℓ c ℓ n [ is ] 1 Equation system: ❄ ❄ final { ℓ r } { ℓ x } [ r := 0 ] 10 [ z < 3] 2 � { A • ( ℓ ′ ) | ( ℓ ′ , ℓ ) ∈ F ∨ ( ℓ ′ ; ℓ ) ∈ F } ⊔ ι ℓ A ◦ ( ℓ ) = { [ call p ( a, z )] ℓ c { is ℓ n } ∪ blocks ( S ) ∪ { end ℓ x } blocks ℓ r } E ❄ ❄ ❄ f A A • ( ℓ ) = ℓ ( A ◦ ( ℓ )) ✛ labels { ℓ c , ℓ r } { ℓ c , ℓ r } ∪ labels ( S ) [ call fib ( x, 0 , y )] 11 [ v := u + 1 ] 3 [ call fib ( z-1 , u , v )] 5 12 6 ❄ ✻ ❄ ❄ flow { ( ℓ c ; ℓ n ) , ( ℓ x ; ℓ r ) } { ( ℓ n , init ( S )) } ∪ flow ( S ) ∪ { ℓ, ℓ x ) | ℓ ∈ final ( S )) } ✛ • both procedure calls ( ℓ c ; ℓ n ) and procedure returns ( ℓ x ; ℓ r ) a [ r := r + 1 ] 4 [ call fib ( z-2 , v , v )] 7 8 treated like “goto’s”. ❄ ❄ • ( ℓ c ; ℓ n ) is the flow corresponding to calling a procedure at ℓ c and [ end ] 9 • there is no mechanism for ensuring that information flowing entering the procedure body at ℓ n and ( ℓ c ; ℓ n ) flows back along ( ℓ x ; ℓ r ) to the same call • ( ℓ x ; ℓ r ) is the flow corresponding to exiting a procedure body at ℓ x • intuitively, the equation system considers a much too large s and returning to the call at ℓ r . “paths” through the program and hence will be grossly impr (although formally on the safe side) Markus Schordan October 2, 2007 4 Markus Schordan October 2, 2007 5 Markus Schordan October 2, 2007
Matching Procedure Entries and Exits “Meet” over Valid Paths (MVP) General Formulation: Calls and Returns proc fib ( val z , u ; res v ) main A complete path from ℓ 1 to ℓ 2 in P ⋆ has proper nesting of proce entries and exits; and a procedure returns to the point where it ✛ proc p (val x ; res y ) ✲ ✛ [ is ] 1 called: ❄ ❄ ✬ ✩ ✶ ✏ ✏✏✏✏✏✏✏✏✏ [ is ] ℓ n [ r := 0 ] 10 [ z < 3] 2 X ❄ f ℓ c ( X ) CP ℓ 1 ,ℓ 2 − → ℓ 1 whenever ℓ 1 = ℓ 2 ❄ ❄ ❄ ✒ ✛ CP ℓ 1 ,ℓ 3 − → ℓ 1 , CP ℓ 2 ,ℓ 3 whenever ( ℓ 1 , ℓ 2 ) ∈ flow ⋆ ✲ [ call fib ( x, 0 , y )] 11 [ v := u + 1 ] 3 [ call fib ( z-1 , u , v )] 5 12 6 ❄ ✻ ❄ ❄ ✓ [ call p ( a, z )] ℓ c body CP ℓ c ,ℓ − → ℓ c , CP ℓ n ,ℓ x , CP ℓ r ,ℓ whenever P ⋆ contains [ call p ( a, z )] X ℓ r ✛ [ r := r + 1 ] 4 [ call fib ( z-2 , v , v )] 7 P ✐ andproc p ( val x ; res y ) is ℓ n S end ✫ ✪ P 8 P P ❄ P ❄ ❄ P P P Y ❄ P [ end ] 9 f ℓ c ,ℓ r ( X, Y ) P [ end ] ℓ x Definition: ( ℓ c , ℓ n , ℓ r , ℓ x ) ∈ interflow ⋆ if P ⋆ contains [ call p ( a, z )] ℓ c ℓ r a as proc p ( val x ; res y ) is ℓ n S end ℓ x We want to overcome the shortcoming of the naive formulation by ❄ restricting attention to paths that have the proper nesting of procedure calls and exits. Markus Schordan October 2, 2007 7 Markus Schordan October 2, 2007 8 Markus Schordan October 2, 2007 Example Valid Paths MVP Solution ✛ ✲ ✛ [ is ] 1 A valid path starts at the entry node init ⋆ of P ⋆ , all the procedure exits ❄ ❄ match the procedure entries but some procedures might be entered � ℓ ( ι ) | � MVP ◦ ( ℓ ) = { f � ℓ ∈ vpath ◦ ( ℓ ) } [ r := 0 ] 10 [ z < 3] 2 but not yet exited: ❄ ❄ ❄ � ℓ ( ι ) | � ✛ MVP • ( ℓ ) = { f � ℓ ∈ vpath • ( ℓ ) } [ call fib ( x, 0 , y )] 11 [ v := u + 1 ] 3 [ call fib ( z-1 , u , v )] 5 12 6 VP ⋆ − → VP init ⋆ ,ℓ whenever ℓ ∈ Lab ⋆ ❄ ✻ ❄ ❄ where ✛ [ r := r + 1 ] 4 [ call fib ( z-2 , v , v )] 7 VP ℓ 1 ,ℓ 2 − → ℓ 1 whenever ℓ 1 = ℓ 2 8 ❄ ❄ VP ℓ 1 ,ℓ 3 − → ℓ 1 , VP ℓ 2 ,ℓ 3 whenever ( ℓ 1 , ℓ 2 ) ∈ flow ⋆ vpath ◦ ( ℓ ) = { [ ℓ 1 , . . . , ℓ n − 1 ] | n ≥ 1 ∧ ℓ n = ℓ ∧ [ ℓ 1 , . . . , ℓ n ] is valid path } [ end ] 9 whenever P ⋆ contains [ call p ( a, z )] ℓ c VP ℓ c ,ℓ − → ℓ c , CP ℓ n ,ℓ x , VP ℓ r ,ℓ ℓ r CP 3 , 9 3 , CP 4 , 9 → vpath • ( ℓ ) = { [ ℓ 1 , . . . , ℓ n ] | n ≥ 1 ∧ ℓ n = ℓ ∧ [ ℓ 1 , . . . , ℓ n ] is valid path } CP 10 , 12 10 , CP 11 , 12 andproc p ( val x ; res y ) is ℓ n S end ℓ x → CP 4 , 9 4 , CP 9 , 9 → CP 11 , 12 11 , CP 1 , 9 , CP 12 , 12 → whenever P ⋆ contains [ call p ( a, z )] ℓ c CP 5 , 9 5 , CP 1 , 9 , CP 6 , 9 CP 12 , 12 12 VP ℓ c ,ℓ − → ℓ c , VP ℓ n ,ℓ → → CP 1 , 9 1 , CP 2 , 9 ℓ r → CP 6 , 9 6 , CP 7 , 9 CP 9 , 9 9 andproc p ( val x ; res y ) is ℓ n S end ℓ x The MVP solution may be undecidable for lattices satisfying the A → → 2 , CP 3 , 9 CP 2 , 9 → CP 7 , 9 7 , CP 1 , 9 , CP 8 , 9 ing Chain Condition, just as was the case for the MOP solution. → CP 2 , 9 2 , CP 5 , 9 → 8 , CP 9 , 9 CP 8 , 9 → Some valid paths: [10,11,1,2,3,4,9,12] and [10,11,1,2,5,1,2,3,4,9,6,7,1,2,3,4,9,8,9,12] A non-valid path: [10,11,1,2,5,1,2,3,4,9,12] Markus Schordan October 2, 2007 10 Markus Schordan October 2, 2007 11 Markus Schordan October 2, 2007
Making Context Explicit MFP Counterpart Call Strings as Context • Encode the path taken • The MVP solution may be undecidable for lattices of finite height Context sensitive analysis: add context information • Only record flows of the form ( ℓ c , ℓ n ) corresponding to a proc (as was the case for the MOP solution) call • call strings: • We have to reconsider the MFP solution and avoid taking too • we take as context � = Lab ∗ where the most recent label ℓ – an abstraction of the sequences of procedure calls that have many invalid paths into account procedure call is at the right end been performed so far • Encode information about the paths taken into data flow • Elements of � are called call strings – example: the program point where the call was initiated properties themselves • assumption sets: • The sequence of labels ℓ 1 c , ℓ 2 c , . . . , ℓ n c is the call string leading t • Introduce context information current call which happened at ℓ 1 – an abstraction of the states in which previous calls have been c ; the previous calls where ℓ 2 c . . . ℓ n c . If n = 0 then no calls have been performed so far. performed – example: an abstraction of the actual parameters of the call For the example program the following call strings are of interes Context insensitive analysis: take no context information into account. Λ , [11] , [11 , 5] , [11 , 7] , [11 , 5 , 5] , [11 , 5 , 7] . [11 , 7 , 5] , [11 , 7 , 7] , ... Markus Schordan October 2, 2007 13 Markus Schordan October 2, 2007 14 Markus Schordan October 2, 2007 Abstracting Call Strings References Problem: call strings can be arbitrarily long (recursive calls) • Material for this 4th lecture (part 2) Solution: truncate the call strings to have length of at most k for some www.complang.tuwien.ac.at/markus/optub.html fixed number k • Book • � = Lab ≤ k Flemming Nielson, Hanne Riis Nielson, Chris Hankin: • k = 0 : context insensitive analysis Principles of Program Analysis. – Λ (the call string is the empty string) Springer, (450 pages, ISBN 3-540-65410-0), 1999. • k = 1 : remember the last procedure call – Chapter 2 (Data Flow Analysis) – Λ , [11] , [5] , [7] • k = 2 : remember the last two procedure calls – Λ , [11] , [11 , 5] , [11 , 7] , [5 , 5] , [5 , 7] , [7 , 5] , [7 , 7] Markus Schordan October 2, 2007 16 Markus Schordan October 2, 2007 17
Recommend
More recommend