Data flow analysis. DataFlow analysis

Transcription

1 Data flow analysis DataFlow analysis compile time reasoning about the runtime flow of values in the program represent facts about runtime behavior represent effect of executing each basic block propagate facts around control flow graph

2 Dataflow Analysis Used to determine properties of program that involve multiple basic blocks Typically used to enable transformations common sub-expression elimination constant and copy propagation dead code elimination Analysis and transformation often come in pairs Reaching Definitions Concept of definition and use a = x+y is a definition of a is a use of x and y A definition reaches a use if value written by definition may be read by use

3 Reaching Definitions s = 0; a = 4; i = 0; k == 0 b = 1; b = 2; i < n s = s + a*b; i = i + 1; return s Reaching Definitions and Constant Propagation Is a use of a variable a constant? Check all reaching definitions If all assign variable to same constant Then use is in fact a constant Can replace variable with constant

4 Is a Constant in s = s+a*b? s = 0; a = 4; i = 0; k == 0 b = 1; b = 2; Yes! On all reaching definitions a = 4 i < n s = s + a*b; i = i + 1; return s Constant Propagation Transform s = 0; a = 4; i = 0; k == 0 b = 1; b = 2; Yes! On all reaching definitions a = 4 i < n s = s + 4*b; i = i + 1; return s

5 Is b Constant in s = s+a*b? s = 0; a = 4; i = 0; k == 0 b = 1; b = 2; i < n No! One reaching definition with b = 1 One reaching definition with b = 2 s = s + a*b; i = i + 1; return s Computing Reaching Definitions Compute with sets of definitions represent sets using bit vectors each definition has a position in bit vector At each basic block, compute definitions that reach start of block definitions that reach end of block Do computation by simulating execution of program until reach fixed point

6 : s = 0; 2: a = 4; 3: i = 0; k == : b = 1; 5: b = 2; : s = s + a*b; 7: i = i + 1; i < n return s Formalizing Analysis Each basic block has IN - set of definitions that reach beginning of block OUT - set of definitions that reach end of block GEN - set of definitions generated in block KILL - set of definitions killed in in block GEN[s = s + a*b; i = i + 1;] = KILL[s = s + a*b; i = i + 1;] = Compiler scans each basic block to derive GEN and KILL sets

7 Dataflow Equations IN[b] = OUT[b1] U... U OUT[bn] where b1,..., bn are predecessors of b in CFG OUT[b] = (IN[b] - KILL[b]) U GEN[b] IN[entry] = Result: system of equations Solving Equations Use fixed point algorithm Initialize with solution of OUT[b] = Repeatedly apply equations IN[b] = OUT[b1] U... U OUT[bn] OUT[b] = (IN[b] - KILL[b]) U GEN[b] Until reach fixed point Until equation application has no further effect Use a worklist to track which equation applications may have a further effect

8 Reaching Definitions Algorithm for all nodes n in N OUT[n] = emptyset; // OUT[n] = GEN[n]; Changed = D; // D = all definitions in graph while (Changed!= emptyset) choose a node n in Changed; Changed = Changed - { n }; IN[n] = emptyset; for all nodes p in predecessors(n) IN[n] = IN[n] U OUT[p]; OUT[n] = GEN[n] U (IN[n] - KILL[n]); if (OUT[n] changed) for all nodes s in successors(n) Changed = Changed U { s }; Questions Does the algorithm halt? yes, because transfer function is monotonic if increase IN, increase OUT in limit, all bits are 1 If bit is 1, is there always an execution in which corresponding definition reaches basic block? If bit is 0, does the corresponding definition ever reach basic block? Concept of conservative analysis

9 Available Expressions An expression x+y is available at a point p if every path from the initial node to p evaluates x+y before reaching p, and there are no assignments to x or y after the evaluation but before p. Available Expression information can be used to do global (across basic blocks) CSE If expression is available at use, no need to reevaluate it Computing Available Expressions Represent sets of expressions using bit vectors Each expression corresponds to a bit Run dataflow algorithm similar to reaching definitions Big difference definition reaches a basic block if it comes from ANY predecessor in CFG expression is available at a basic block only if it is available from ALL predecessors in CFG

10 Expressions 1: x+y 2: i<n 3: i+c 4: x== x = z; b = x+y; a = x+y; x == 0 i = x+y; i < n c = x+y; d = x+y i = i+c; Global CSE Transform Expressions 1: x+y 2: i<n 3: i+c 4: x==0 must use same temp for CSE in all blocks 1001 x = z; b = x+y; t = b; a = x+y; t = a; x == 0 i = t; i < n c = t; d = t; i = i+c;

11 Formalizing Analysis Each basic block has IN - set of expressions available at start of block OUT - set of expressions available at end of block GEN - set of expressions computed in block KILL - set of expressions killed in in block GEN[x = z; b = x+y] = 1000 KILL[x = z; b = x+y] = 1001 Compiler scans each basic block to derive GEN and KILL sets Dataflow Equations IN[b] = OUT[b1] intersect... intersect OUT[bn] where b1,..., bn are predecessors of b in CFG OUT[b] = (IN[b] - KILL[b]) U GEN[b] IN[entry] = 0000 Result: system of equations

12 Solving Equations Use fixed point algorithm IN[entry] = 0000 Initialize OUT[b] = 1111 Repeatedly apply equations IN[b] = OUT[b1] intersect... intersect OUT[bn] OUT[b] = (IN[b] - KILL[b]) U GEN[b] Use a worklist algorithm to reach fixed point Available Expressions Algorithm for all nodes n in N OUT[n] = E; // OUT[n] = E - KILL[n]; IN[Entry] = emptyset; OUT[Entry] = GEN[Entry]; Changed = N - { Entry }; // N = all nodes in graph while (Changed!= emptyset) choose a node n in Changed; Changed = Changed - { n }; IN[n] = E; // E is set of all expressions for all nodes p in predecessors(n) IN[n] = IN[n] intersect OUT[p]; OUT[n] = GEN[n] U (IN[n] - KILL[n]); if (OUT[n] changed) for all nodes s in successors(n) Changed = Changed U { s };

13 Questions Does algorithm always halt? If expression is available in some execution, is it always marked as available in analysis? If expression is not available in some execution, can it be marked as available in analysis? In what sense is algorithm conservative? Duality In Two Algorithms Reaching definitions Confluence operation is set union OUT[b] initialized to empty set Available expressions Confluence operation is set intersection OUT[b] initialized to set of available expressions General framework for dataflow algorithms. Build parameterized dataflow analyzer once, use for all dataflow problems

14 Liveness Analysis A variable v is live at point p if v is used along some path starting at p, and no definition of v along the path before the use. When is a variable v dead at point p? No use of v on any path from p to exit node, or If all paths from p redefine v before using v. What Use is Liveness information? Register allocation. If a variable is dead, can reassign its register Dead code elimination. Eliminate assignments to variables not read later. But must not eliminate last assignment to variable (such as instance variable) visible outside CFG. Can eliminate other dead assignments. Handle by making all externally visible variables live on exit from CFG

15 Conceptual Idea of Analysis Simulate execution But start from exit and go backwards in CFG Compute liveness information from end to beginning of basic blocks Liveness Example Assume a,b,c visible outside method So are live on exit Assume x,y,z,t not visible Represent Liveness Using Bit Vector order is abcxyzt b = t+z; a = x+y; t = a; c = a+x; x == 0 c = y+1;

16 Dead Code Elimination Assume a,b,c visible outside method So are live on exit Assume x,y,z,t not visible Represent Liveness Using Bit Vector order is abcxyzt b = t+z; a = x+y; t = a; x == 0 c = y+1; Formalizing Analysis Each basic block has IN - set of variables live at start of block OUT - set of variables live at end of block USE - set of variables with upwards exposed uses in block DEF - set of variables defined in block USE[x = z; x = x+1;] = { z } (x not in USE) DEF[x = z; x = x+1;y = 1;] = {x, y} Compiler scans each basic block to derive GEN and KILL sets

17 Algorithm out[exit] = emptyset; in[exit] = use[n]; for all nodes n in N - { Exit } in[n] = emptyset; Changed = N - { Exit }; while (Changed!= emptyset) choose a node n in Changed; Changed = Changed - { n }; out[n] = emptyset; for all nodes s in successors(n) out[n] = out[n] U in[p]; in[n] = use[n] U (out[n] - def[n]); if (in[n] changed) for all nodes p in predecessors(n) Changed = Changed U { p }; Similar to Other Dataflow Algorithms Backwards analysis, not forwards Still have transfer functions Still have confluence operators Can generalize framework to work for both forwards and backwards analyses

18 Analysis Information Inside Basic Blocks One detail: Given dataflow information at IN and OUT of node Also need to compute information at each statement of basic block Simple propagation algorithm usually works fine Can be viewed as restricted case of dataflow analysis Summary Basic Blocks and Basic Block Optimizations Copy and constant propagation Common sub-expression elimination Dead code elimination Dataflow Analysis Control flow graph IN[b], OUT[b], transfer functions, join points Paired analyses and transformations Reaching definitions/constant propagation Available expressions/common sub-expression elimination Liveness analysis/dead code elimination Stacked analysis and transformations work together

19

20 Available expressions Definition An expression is defined at point p if its value is computed at p An expression is killed at a point p if one of its argument variables is defined at p An expression e is available at a point p in a procedure if every path leading to p contains a prior definition of e that is not killed between its definition and p

21 Global common subexpression elimination If at some definition point for p e e is available with name x we can replace the evaluation with a reference to x requires a global naming scheme natural analog to parts of value numbering For a block b let AVAIL(b) be the set of expressions available on entry to b let KILL(b) be the set of expressions killed in b let GEN(b) be the set of expressions dened in b and not subsequently killed in b Note GEN(b) is AVAILTAB from value numbering KILL(b) is harder to construct

22 Now AVAIL can be defined as Note initializations must be conservative

23 Foundations of Dataflow Analysis

24 Dataflow Analysis Compile-Time Reasoning About Run-Time Values of Variables or Expressions At Different Program Points Which assignment statements produced value of variable at this point? Which variables contain values that are no longer used after this program point? What is the range of possible values of variable at this program point? Program Representation Control Flow Graph Nodes N statements of program Edges E flow of control pred(n) = set of all predecessors of n succ(n) = set of all successors of n Start node n 0 Set of final nodes N final

25 Program Points One program point before each node One program point after each node Join point point with multiple predecessors Split point point with multiple successors Basic Idea Information about program represented using values from algebraic structure called lattice Analysis produces lattice value for each program point Two flavors of analysis Forward dataflow analysis Backward dataflow analysis

26 Forward Dataflow Analysis Analysis propagates values forward through control flow graph with flow of control Each node has a transfer function f Input value at program point before node Output new value at program point after node Values flow from program points after predecessor nodes to program points before successor nodes At join points, values are combined using a merge function Backward Dataflow Analysis Analysis propagates values backward through control flow graph against flow of control Each node has a transfer function f Input value at program point after node Output new value at program point before node Values flow from program points before successor nodes to program points after predecessor nodes At split points, values are combined using a merge function Canonical Example: Live Variables

27 Partial Orders Set P Partial order such that x,y,z P x x (reflexive) x y and y x implies x = y (asymmetric) x y and y z implies x z (transitive) Upper Bounds If S P then x P is an upper bound of S if y S. y x x P is the least upper bound of S if x is an upper bound of S, and x y for all upper bounds y of S - join, least upper bound, lub, supremum, sup S is the least upper bound of S x y is the least upper bound of {x,y}

28 If S P then Lower Bounds x P is a lower bound of S if y S. x y x P is the greatest lower bound of S if x is a lower bound of S, and y x for all lower bounds y of S - meet, greatest lower bound, glb, infimum, inf S is the greatest lower bound of S x y is the greatest lower bound of {x,y} Covering x< y if x y and x y x is covered by y (y covers x) if x < y, and x z < y implies x = z Conceptually, y covers x if there are no elements between x and y

29 Example P = { 000, 001, 010, 011, 100, 101, 110, 111} (standard boolean lattice, also called hypercube) x y if (x bitwise and y) = x Hasse Diagram If y covers x Line from y to x y above x in diagram Lattices If x y and x y exist for all x,y P, then P is a lattice. If S and S exist for all S P, then P is a complete lattice. All finite lattices are complete Example of a lattice that is not complete Integers I For any x, y I, x y = max(x,y), x y = min(x,y) But I and I do not exist I {+, } is a complete lattice

30 Top and Bottom Greatest element of P (if it exists) is top Least element of P (if it exists) is bottom ( ) Connection Between,, and The following 3 properties are equivalent: x y x y = y x y = x Will prove: x y implies x y = y and x y = x x y = y implies x y x y = x implies x y Then by transitivity, can obtain x y = y implies x y = x x y = x implies x y = y

31 Connecting Lemma Proofs Proof of x y implies x y = y x y implies y is an upper bound of {x,y}. Any upper bound z of {x,y} must satisfy y z. So y is least upper bound of {x,y} and x y = y Proof of x y implies x y = x x y implies x is a lower bound of {x,y}. Any lower bound z of {x,y} must satisfy z x. So x is greatest lower bound of {x,y} and x y = x Connecting Lemma Proofs Proof of x y = y implies x y y is an upper bound of {x,y} implies x y Proof of x y = x implies x y x is a lower bound of {x,y} implies x y

32 Lattices as Algebraic Structures Have defined and in terms of Will now define in terms of and Start with and as arbitrary algebraic operations that satisfy associative, commutative, idempotence, and absorption laws Will define using and Will show that is a partial order Algebraic Properties of Lattices Assume arbitrary operations and such that (x y) z = x (y z) (associativity of ) (x y) z = x (y z) (associativity of ) x y = y x (commutativity of ) x y = y x (commutativity of ) x x = x (idempotence of ) x x = x (idempotence of ) x (x y) = x (absorption of over ) x (x y) x (absorption of over )

33 Connection Between and x y = y if and only if x y = x Proof of x y = y implies x = x y x = x (x y) (by absorption) = x y (by assumption) Proof of x y = x implies y = x y y = y (y x) (by absorption) = y (x y) (by commutativity) = y x (by assumption) = x y (by commutativity) Properties of Define x yif x y = y Proof of transitive property. Must show that x y = y and y z = z implies x z = z x z = x (y z) (by assumption) = (x y) z (by associativity) = y z (by assumption) = z (by assumption)

34 Properties of Proof of asymmetry property. Must show that x y = y and y x = x implies x = y x = y x (by assumption) = x y (by commutativity) = y (by assumption) Proof of reflexivity property. Must show that x x = x Properties of Induced operation agrees with original definitions of and, i.e., x y = sup {x, y} x y = inf {x, y}

35 Proof of x y = sup {x, y} Consider any upper bound u for x and y. Given x u = u and y u = u, must show x y u, i.e., (x y) u = u u = x u (by assumption) = x (y u) (by assumption) = (x y) u (by associativity) Proof of x y = inf {x, y} Consider any lower bound l for x and y. Given x l = l and y l = l, must show l x y, i.e., (x y) l = l l = x l (by assumption) = x (y l) (by assumption) = (x y) l (by associativity)

36 Chains A set S is a chain if x,y S. y x or x y P has no infinite chains if every chain in P is finite P satisfies the ascending chain condition if for all sequences x 1 x 2 there exists n such that x n = x n+1 = Application to Dataflow Analysis Dataflow information will be lattice values Transfer functions operate on lattice values Solution algorithm will generate increasing sequence of values at each program point Ascending chain condition will ensure termination Will use to combine values at controlflow join points

37 Transfer Functions Transfer function f: P P for each node in control flow graph f models effect of the node on the program information Transfer Functions Each dataflow analysis problem has a set F of transfer functions f: P P Identity function i F F must be closed under composition: f,g F. the function h = λx.f(g(x)) F Each f F must be monotone: x y implies f(x) f(y) Sometimes all f F are distributive: f(x y) = f(x) f(y) Distributivity implies monotonicity

38 Distributivity Implies Monotonicity Proof of distributivity implies monotonicity Assume f(x y) = f(x) f(y) Must show: x y = y implies f(x) f(y) = f(y) f(y) = f(x y) (by assumption) = f(x) f(y) (by distributivity) Putting Pieces Together Forward Dataflow Analysis Framework Simulates execution of program forward with flow of control

39 Forward Dataflow Analysis Simulates execution of program forward with flow of control For each node n, have in n value at program point before n out n value at program point after n f n transfer function for n (given in n, computes out n ) Require that solution satisfy n. out n = f n (in n ) n n 0. in n = { out m. m in pred(n) } in n0 = I Where I summarizes information at start of program Dataflow Equations Compiler processes program to obtain a set of dataflow equations out n := f n (in n ) in n := { out m. m in pred(n) } Conceptually separates analysis problem from program

40 Worklist Algorithm for Solving Forward Dataflow Equations for each n do out n := f n ( ) in n0 := I; out n0 := f n (I) worklist := N - { n 0 } while worklist do remove a node n from worklist in n := { out m. m in pred(n) } out n := f n (in n ) if out n changed then worklist := worklist succ(n) Correctness Argument Why result satisfies dataflow equations Whenever process a node n, set out n := f n (in n ) Algorithm ensures that out n = f n (in n ) Whenever out m changes, put succ(m) on worklist. Consider any node n succ(m). It will eventually come off worklist and algorithm will set in n := { out m. m in pred(n) } to ensure that in n = { out m. m in pred(n) } So final solution will satisfy dataflow equations

41 Termination Argument Why does algorithm terminate? Sequence of values taken on by in n or out n is a chain. If values stop increasing, worklist empties and algorithm terminates. If lattice has ascending chain property, algorithm terminates Algorithm terminates for finite lattices For lattices without ascending chain property, use widening operator Widening Operators Detect lattice values that may be part of infinitely ascending chain Artificially raise value to least upper bound of chain Example: Lattice is set of all subsets of integers Could be used to collect possible values taken on by variable during execution of program Widening operator might raise all sets of size t t TOP (lik l t b f l f

42 Reaching Definitions P = powerset of set of all definitions in program (all subsets of set of definitions in program) = (order is ) = I = in n0 = F = all functions f of the form f(x) = a (x-b) b is set of definitions that node kills a is set of definitions that node generates General pattern for many transfer functions f(x) = GEN (x-kill) Does Reaching Definitions Framework Satisfy Properties? satisfies conditions for x y and y z implies x z (associativity) x y and y x implies y = x (asymmetry) x x (idempotence) F satisfies transfer function conditions λx. (x- ) = λx.x F (identity) Will show f(x y) = f(x) f(y) (distributivity) f(x) f(y) = (a (x b)) (a (y b)) = a (x b) (y b) = a ((x y) b) = f(x y)

43 Does Reaching Definitions Framework Satisfy Properties? What about composition? Given f 1 (x) = a 1 (x-b 1 ) and f 2 (x) = a 2 (x-b 2 ) Must show f 1 (f 2 (x)) can be expressed as a (x - b) f 1 (f 2 (x)) = a 1 ((a 2 (x-b 2 )) - b 1 ) = a 1 ((a 2 -b 1 ) ((x-b 2 ) - b 1 )) = (a 1 (a 2 -b 1 )) ((x-b 2 ) - b 1 )) = (a 1 (a 2 -b 1 )) (x-(b 2 b 1 )) Let a = (a 1 (a 2 -b 1 )) and b = b 2 b 1 Then f 1 (f 2 (x)) = a (x b) General Result All GEN/KILL transfer function frameworks satisfy Identity Distributivity Composition Properties

44 Available Expressions P = powerset of set of all expressions in program (all subsets of set of expressions) = (order is ) = P I = in n0 = F = all functions f of the form f(x) = a (xb) b is set of expressions that node kills a is set of expressions that node generates Another GEN/KILL analysis Concept of Conservatism Reaching definitions use as join Optimizations must take into account all definitions that reach along ANY path Available expressions use as join Optimization requires expression to reach along ALL paths Optimizations must conservatively take all possible executions into account. Structure of analysis varies according to way analysis used

45 Backward Dataflow Analysis Simulates execution of program backward against the flow of control For each node n, have in n value at program point before n out n value at program point after n f n transfer function for n (given out n, computes in n ) Require that solution satisfy n. in n = f n (out n ) n N final. out n = { in m. m in succ(n) } n N final = out n = O Where O summarizes information at end of program Worklist Algorithm for Solving Backward Dataflow Equations for each n do in n := f n ( ) for each n N final do out n := O; in n := f n (O) worklist := N - N final while worklist do remove a node n from worklist out n := { in m. m in succ(n) } in n := f n (out n ) if in n changed then worklist := worklist pred(n)

46 Live Variables P = powerset of set of all variables in program (all subsets of set of variables in program) = (order is ) = O = F = all functions f of the form f(x) = a (xb) b is set of variables that node kills Meaning of Dataflow Results Concept of program state s for control-flow graphs Program point n where execution located (n is node that will execute next) Values of variables in program Each execution generates a trajectory of states: s 0 ;s 1 ; ;s k,where each s i ST s i+1 generated from s i by executing basic block to Update variable values

47 Relating States to Analysis Result Meaning of analysis results is given by an abstraction function AF:ST P Correctness condition: require that for all states s AF(s) in n where n is the next statement to execute in state s Sign Analysis Example Sign analysis - compute sign of each variable v Base Lattice: P = flat lattice on {-,0,+} TOP BOT Actual lattice records a value for each variable Example element: [a +, b 0, c -]

48 Interpretation of Lattice Values If value of v in lattice is: BOT: no information about sign of v -: variable v is negative 0: variable v is 0 +: variable v is positive TOP: v may be positive or negative Operation on Lattice BOT TOP BOT BOT TOP TOP TOP TOP TOP TOP 0 TOP TOP

49 Transfer Functions If n of the form v = c f n (x) = x[v +] if c is positive f n (x) = x[v 0] if c is 0 f n (x) = x[v -] if c is negative If n of the form v 1 = v 2 *v 3 f n (x) = x[v 1 x[v 2 ] x[v 3 ]] I = TOP (uninitialized variables may have any sign) Example a = 1 [a +] [a +] b = -1 b = 1 [a +, b -] [a +, b +] [a +, b TOP] c = a*b [a +, b TOP,c TOP]

50 Imprecision In Example Abstraction Imprecision: [a 1] abstracted as [a +] a = 1 [a +] [a +] b = -1 b = 1 [a +, b -] [a +, b +] [a +, b TOP] Control Flow Imprecision: c = a*b [b TOP] summarizes results of all executions. In any execution state s, AF(s)[b] TOP General Sources of Imprecision Abstraction Imprecision Concrete values (integers) abstracted as lattice values (-,0, and +) Lattice values less precise than execution values Abstraction function throws away information Control Flow Imprecision One lattice value for all possible control flow paths Analysis result has a single lattice value to summarize results of multiple concrete executions Join operation moves up in lattice to combine values from different execution paths Typically if x y, then x is more precise than y

51 Why Have Imprecision Make analysis tractable Unbounded sets of values in execution Typically abstracted by finite set of lattice values Execution may visit unbounded set of states Abstracted by computing joins of different paths Abstraction Function AF(s)[v] = sign of v AF(n,[a 5, b 0, c -2]) = [a +, b 0, c -] Establishes meaning of the analysis results If analysis says variable has a given sign Always has that sign in actual execution Correctness condition: v. AF(s)[v] in n [v] (n is node for s) Reflects possibility of imprecision

52 Abstraction Function Soundness Will show v. AF(s)[v] in n [v] (n is node for s) by induction on length of computation that produced s Base case: v. in n0 [v] = TOP, which implies that v. AF(s)[v] TOP Induction Step Assume v. AF(s)[v] in n [v] for computations of length k Prove for computations of length k+1 Proof: Given s (state), n (node to execute next), and in n Find p (the node that just executed), s p (the previous state), and in p By induction hypothesis v. AF(s p )[v] in p [v] Case analysis on form of n If n of the form v = c, then s[v] = c and out p [v] = sign(c), so AF(s)[v] = sign(c) = out p [v] in n [v] If x v, s[x] = s p [x] and out p [x] = in p [x], so AF(s)[x] = AF(s p )[x] in p [x] = out p [x] in n [x] Similar reasoning if n of the form v 1 = v 2 *v 3

53 Augmented Execution States Abstraction functions for some analyses require augmented execution states Reaching definitions: states are augmented with definition that created each value Available expressions: states are augmented with expression for each value Meet Over Paths Solution What solution would be ideal for a forward dataflow analysis problem? Consider a path p = n 0, n 1,, n k, n to a node n (note that for all i n i pred(n i+1 )) The solution must take this path into account: f p ( ) = (f nk (f nk-1 ( f n1 (f n0 ( )) )) in n So the solution must have the property that {f p ( ). p is a path to n} in n and ideally {f p ( ). p is a path to n} = in n

54 Soundness Proof of Analysis Algorithm Property to prove: For all paths p to n, f p ( ) in n Proof is by induction on length of p Uses monotonicity of transfer functions Uses following lemma Lemma: Worklist algorithm produces a solution such that f n (in n ) = out n if n pred(m) then out n in m Proof Base case: p is of length 1 Then p = n 0 and f p ( ) = = in n0 Induction step: Assume theorem for all paths of length k Show for an arbitrary path p of length k+1

55 Induction Step Proof p = n 0,, n k, n Must show f k (f k-1 ( f n1 (f n0 ( )) )) in n By induction (f k-1 ( f n1 (f n0 ( )) )) in nk Appy f k to both sides, by monotonicity we get f k (f k-1 ( f n1 (f n0 ( )) )) f k (in nk ) By lemma, f k (in nk ) = out nk By lemma, out nk in n By transitivity, f k (f k-1 ( f n1 (f n0 ( )) )) in n Distributivity Distributivity preserves precision If framework is distributive, then worklist algorithm produces the meet over paths solution For all n: {f p ( ). p is a path to n} = in n

56 Lack of Distributivity Example Constant Calculator Flat Lattice on Integers TOP BOT Actual lattice records a value for each variable E l l t [ 3 b 2 5] Transfer Functions If n of the form v = c f n (x) = x[v c] If n of the form v 1 = v 2 +v 3 f n (x) = x[v 1 x[v 2 ] + x[v 3 ]] Lack of distributivity Consider transfer function f for c = a + b f([a 3, b 2]) f([a 2, b 3]) = [a TOP, b TOP, c 5] f([a 3, b 2] [a 2, b 3]) = f([a TOP, b TOP]) = [a TOP, b TOP, c TOP]

57 Lack of Distributivity Anomaly [a 2, b 3] a = 2 b = 3 a = 3 b = 2 [a 3, b 2] [a TOP, b TOP] Lack of Distributivity Imprecision: c = a+b [a TOP, b TOP, c 5] more precise [a TOP, b TOP, c TOP] Summary Formal dataflow analysis framework Lattices, partial orders Transfer functions, joins and splits Dataflow equations and fixed point solutions Connection with program Abstraction function AF: S P For any state s and program point n, AF(s) in n Meet over paths solutions, distributivity