Cia

advertisement

-

-

Advanced Program Analysis

Precision of chaotic interations algorithm

7/5/2000 Class Notes by

Michael Pan < michaelp@nbase.co.il

>, 308902162

Vittaly Dubrovner < vitaly@tdsoft.com

>, 310752373

Introduction

Recall from the previous lecture the definition of chaotic iterations algorithm (CIA): for l

Lab

* do

DF entry

(l) := T

DF exit

(l) :=

end

DF entry

(init(S

*

)) :=

WL= Lab

*

while WL !=

do

Select and remove an arbitrary l

WL temp

 f ( DF entry

( l )) if (temp != DF exit

(l))

DF exit

(l) := temp for l' such that (l,l')

 flow (S*) do

DF entry

(l') := DF entry

(l')

DF exit

WL := WL

{l’}

(l) end end end

1. Soundness of CIA

In order to prove soundness of CIA on given lattice; we should use the following scheme:

First we will define abstraction function

: Collecting States

L

We must show that for every state l:

   b

 l

  s

CS

   f l

    

Left side of the expression above applies the “real” function of the block l to all possible states (collecting states) and then applies the abstraction function to the obtained result to get the final set of states. The right side of the expression first

gets the set of the states by the abstraction and then applies to it transform function. It means that the CS results are more precise than CIA gets.

The example for proving of soundness

Let’s see how to prove soundness for constant propagation. The monotone abstraction function will be defined as follow:

 

 

 z

,

,

, s x

 

 z ,

 otherwise s

X

Now we will consider the statement

  s

 x

 s

    by the definition of

 s

 f : l

CS f l

 

 

 f l

A

  x

 x :

   y

 z l

and will show that:

CS

A

 

A

  

(

- is extended plus with

,

 

 x

    y

    z

) left side can be transformed to:

   z

 m

   y

  

N

 m+n

  

Since the abstraction function increase monotonically we are getting in CS more precise result than in CIA.

2. Precision of Chaotic Iterations

The conclusion we can make from the previous section is that the DF solution of CIA satisfies for every l :

 

CS entry

CS exit l

  

  

DF entry

DF exit

It means that in the worst case we can receive next result:

DF entry

   

although

CS entry

  

 

How could we measure the precision of CIA? Several schemes can be used for it. We will list the measure bounds from the best one to the worst.

Optimal, optimal (the most precise) result is obtained by collecting semantic

(CS):

CS entry

CS exit l

 

  

DF entry

DF exit

 

-

-

-

-

Join-Over-All-Paths (JOP), we will discuss this method later.

Relatively optimal (induced), relatively optimal solution regarding to chosen abstraction function. This solution is obtained by the “best” concretesation function for the given abstraction.

Compare at run time, this method will check the precision of the results at run time.

Good enough for the used optimization

3. The Join-Over-All-Paths (JOP)

Let paths

 init program state

 

*

, l

 

denote the potentially infinite set of paths from the initial init S

*

to state l , which are written as sequences of labels.

For a sequence of labels

 l , l ,...,

1 2 l n

define f

 l

1

, l

2

..., l n

: L

L by composing the effects of basic blocks f

 l

1

, l

2

,..., l n

  

 f ln

...

 f f

   

 f l 1

 s

 

'

:

  l 2

Than JOP for label l

JOP l n

   f

 l

1

, l

2

,..., l n n

is defined as follow:

 

,

 l

1

, l

2

,..., l n

 paths

 init

*

, l n

 

Now let us examine the JOP solution via the CIA one. The DF solution obtained by

CIA satisfies for every state l :

JOP l

DF entry

 

It means that the JOP always more precise than CIA.

In order to prove this statement we will show that DF entry

is an upper bound of JOP

1.

2.

by induction on length of the path. First, recall the definition of

DF entry

 i ,

 l

 init

DF exit

,

  l

*

' l

Flow

 

*

DF entry

:

It is easy to see that the statements holds for zero length: f

  

 i

Now we suppose that statement holds for length n and will prove it for n+1: f f

 l n l

1

, f

DF exit l

2

 l

1 l

,...,

, n l

2 l n

, by induction:

,..., l

 l f n

 

 l

1 i

DF entry f l n

 f

, l

 l

2

,...,

  f l n

 l n l

1

, l

 

2

,...,

DF entry l n n

 

 

DF entry 

  n

by definition of DF entry

=

If every

JOP l

 f l

is additive (distributive) for all the labels

DF entry l then:

-

-

-

-

-

-

-

-

In the next section we will describe some of such additive lattice functions.

4.

Additive (Distributive) monotone problems

Kill/Gen problems, it is easy to see that

  x

1

 kill

 gen

May be un-initialized problem

 x

2

 kill

 gen

  x

1

 x

2

 kill

 gen

Truly live variables

Constant propagation problem, when every expression in the right hand side contains at most one variable.

It can be shown that the constant propagation, which allows two variables on the left-hand side, is not distributive problem:

if (…) {x=2;y=3} else {y=3;x=2}

z=x+y;

JOP will find that z has a constant value 5, but CIA won’t.

Point-to analysis with one level pointers

5.

Non distributive monotone problems

Points-to-analysis

Constant propagation on arbitrary expressions

Parity propagation on arbitrary expressions

6.

Converting into distributive frameworks

Non distributive problems can be converted to the distributive by defining the distributive function over sets of labels. It that way we will store all incoming data for each label and so obtain the same result as JOP. Let’s consider:

a final lattice

L ,

,

,

,

,

an initial value at entry i

the transfer function for basic blocks

define the distribution function on

F

 

 f

  x

X

P f l

 

,

: L

L

,

,

,

,

, by

solve the following system of equations over P(L) :

DF entry

 i ,

 l

 init

  flow

 

, DF exit

 

,

 otherwise

DF exit

 

 f l

  x

DF entry

This conversion may be expensive in space and even may requare exponential space.

There are problems that JOP is un-decidable for them, for example, the constant propagation. We can show the reduction from the “existence of root for polynom of n variables p

 x

1

,..., x n

over the natural numbers” to finding JOP for constant

-

-

-

propagation. The root existence problem for n-variables polynom is known to be undecidable, so if we will show such reduction, then we will prove that JOP for constant propagation is undecidable too.

Here is the scratch of the reduction: while(…) {

If (…) x_1 = x_1 + 1;

If (…) x_2 = x_2 + 1;

If (…) x_n = x_n + 1;

} y=trancate(1/(1+p

2

/* Is y=0 here? */

(x_1,x_2,…x_n)))

If the constant propagation will find that y has constant value – zero, then the polynom has a solution.

7.

Static analysis problems beyond monotone framework

Infinite heights integer intervals linear relationships between variables

Bi-directional problems partial-redundant expressions automatic inference of variable types in imperative programs with composite types

Procedures

8.

Historical perspective and conclusions

1973 – Kildall defined the basic framework but required distributive frameworks

1975 – Kam and Ulmann defined monotone framework

1980 – Tarjan suggested an almost linear time algorithm for reducible flow graph

1980 – Rosen suggested a liner time algorithm for high level language

For the conclusion, we can say that many dataflow problems can be solved via the

Chaotic Iteration Algorithm and it may also provide the tool to understand data analysis precision.

Download