Principles of Program Analysis: Control Flow Analysis

Transcription

1 Principles of Program Analysis: Control Flow Analysis Transparencies based on Chapter 3 of the book: Flemming Nielson, Hanne Riis Nielson and Chris Hankin: Principles of Program Analysis. Springer Verlag 005. c Flemming Nielson & Hanne Riis Nielson & Chris Hankin. PPA Chapter 3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

2 The Dynamic Dispatch Problem. [call p(p,,v)] l c l r. [call p(p,,v)] l c l r. proc p(procval q, val x, res y) is l n. [call q (x,y)] lp c l p r. end l x which procedure is called? These problems arise for: imperative languages with procedures as parameters object oriented languages functional languages PPA Chapter 3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

3 Example: let f = fn x => x ; g = fn y => y+; h = fn z => z+3 in ( f g ) + ( f h ) The aim of Control Flow Analysis: For each function application, which functions may be applied? Control Flow Analysis computes the interprocedural flow relation used when formulating interprocedural Data Flow Analysis. PPA Chapter 3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 3

4 Syntax of the Fun Language Syntactic categories: Syntax: e Exp expressions (or labelled terms) t Term terms (or unlabelled expressions) f, x Var variables c Const constants op Op binary operators l Lab labels e ::= t l t ::= c x fn x => e 0 fun f x => e 0 e e if e 0 then e else e let x = e in e e op e (Labels correspond to program points or nodes in the parse tree.) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 4

5 Examples: ((fn x => x ) (fn y => y 3 ) 4 ) 5 (let f = (fn x => (x ) 3 ) 4 ; in (let g = (fn y => y 5 ) 6 ; in (let h = (fn z => z 7 ) 8 in ((f 9 g 0 ) + (f h 3 ) 4 ) 5 ) 6 ) 7 ) 8 (let g = (fun f x => (f (fn y => y ) 3 ) 4 ) 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 5

6 Abstract 0-CFA Analysis Abstract domains Specification of the analysis Well-definedness of the analysis PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 6

7 Towards defining the Abstract Domains The result of a 0-CFA analysis is a pair (Ĉ, ρ): Ĉ is the abstract cache associating abstract values with each labelled program point ρ is the abstract environment associating abstract values with each variable PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 7

8 Example: ((fn x => x ) (fn y => y 3 ) 4 ) 5 Three guesses of a 0-CFA analysis result: x y (Ĉe, ρ e ) (Ĉ e, ρ e) (Ĉ e, ρ {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } e ) {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } {fn x => x, fn y => y 3 } PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 8

9 Example: (let g = (fun f x => (f (fn y => y ) 3 ) 4 ) 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 Abbreviations: f = fun f x => (f (fn y => y ) 3 ) 4 id y = fn y => y id z = fn z => z 7 One guess of a 0-CFA analysis result: Ĉ lp () = {f} Ĉ lp () = Ĉ lp (3) = {id y } Ĉ lp (4) = Ĉ lp (5) = {f} Ĉ lp (6) = {f} Ĉ lp (7) = Ĉ lp (8) = {id z } Ĉ lp (9) = Ĉ lp (0) = ρ lp (f) = {f} ρ lp (g) = {f} ρ lp (x) = {id y, id z } ρ lp (y) = ρ lp (z) = PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 9

10 Abstract Domains Formally: v Val = P(Term) abstract values ρ Env = Var Val abstract environments Ĉ Cache = Lab Val abstract caches An abstract value v is a set of terms of the forms fn x => e 0 fun f x => e 0 PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 0

11 Control Flow Analysis versus Use-Definition chains The aim: to trace how definition points reach use points Control Flow Analysis definition points: where function abstractions are created use points: where functions are applied Use-Definition chains definition points: where variables are assigned a value use points: where values of variables are accessed PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

12 Specification of the 0-CFA When is a proposed guess (Ĉ, ρ) of an analysis results an acceptable 0-CFA analysis for the program? Different approaches: abstract specification syntax-directed and constraint-based specifications algorithms for computing the best result PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

13 Specification of the Abstract 0-CFA (Ĉ, ρ) = e means that (Ĉ, ρ) is an acceptable Control Flow Analysis of the expression e The relation = has functionality: = : ( Cache Env Exp) {true, false} PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 3

14 Clauses for Abstract 0-CFA () (Ĉ, ρ) = c l always (Ĉ, ρ) = x l iff ρ(x) Ĉ(l) (Ĉ, ρ) = (let x = t l in t l iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) ) l PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 4

15 Ĉ ρ (let x = t l in t l ) l t l t l x x l PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 5

16 Clauses for Abstract 0-CFA () (Ĉ, ρ) = (if t l 0 0 then t l else t l iff (Ĉ, ρ) = t l 0 0 (Ĉ, ρ) = t l (Ĉ, ρ) = t l Ĉ(l ) Ĉ(l) Ĉ(l ) Ĉ(l) ) l (Ĉ, ρ) = (t l op t l iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l ) l PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 6

17 Clauses for Abstract 0-CFA (3) (Ĉ, ρ) = (fn x => t l 0 0 ) l iff {fn x => t l 0 0 } Ĉ(l) (Ĉ, ρ) = (t l t l ) l iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l ( ( fn x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = t l 0 0 Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l)) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 7

18 Ĉ (t l t l ) l ρ fn x => t l 0 0 t l t l t l 0 0 x x l PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 8

19 Clauses for Abstract 0-CFA (4) (Ĉ, ρ) = (fun f x => e 0 ) l iff {fun f x => e 0 } Ĉ(l) (Ĉ, ρ) = (t l t l ) l iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l ( ( fn x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = t l 0 0 ( ( fun f x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = t l 0 0 Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l)) Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l) {fun f x => t l 0 0 } ρ(f) ) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 9

20 Example: Two guesses for ((fn x => x ) (fn y => y 3 ) 4 ) x y (Ĉe, ρ e ) (Ĉ e, ρ e) {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } Checking the guesses: (Ĉe, ρ e ) = ((fn x => x ) (fn y => y 3 ) 4 ) 5 (Ĉ e, ρ e) = ((fn x => x ) (fn y => y 3 ) 4 ) 5 PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 0

21 Well-definedness of the Abstract 0-CFA Difficulty: The clause for function application is not of a form that allows us to define (Ĉ, ρ) = e by Structural Induction in the expression e (Ĉ, ρ) = (t l t l ) l iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l ( (fn x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = t l 0 0 Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l)) Solution: The relation = is defined by coinduction, that is, as the greatest fixed point of a functional. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

22 The functional Q The clauses for = define a function: Q : (( Cache Env Exp) {true, false}) (( Cache Env Exp) {true, false}) Example: (Ĉ, ρ) = (let x = t l in t l ) l becomes iff (Ĉ, ρ) = t l (Ĉ, ρ) = t l Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) Q( Q )(Ĉ, ρ, (let x = t l in t l ) l ) = Q (Ĉ, ρ, t l ) Q (Ĉ, ρ, t l ) Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004)

23 Properties of Q Q is a monotone function on the complete lattice (( Cache Env Exp) {true, false}, ) where the ordering is defined by: Q Q iff (Ĉ, ρ, e) : (Q (Ĉ, ρ, e) = true) (Q (Ĉ, ρ, e) = true) Hence Q has fixed points and we shall define = coinductively: = is the greatest fixed point of Q PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 3

24 Tarski s Theorem: A monotone function on a complete lattice has a complete lattice of fixed points and in particular a least and a greatest fixed point. Q n ( ) gfp(q) lfp(q) Q n ( ) Q : (( Cache Env Exp) {true, false}) (( Cache Env Exp) {true, false}) Coinductive definition: gfp(q) = {P Q(P ) P } Inductive definition: lfp(q) = {P Q(P ) P } = n Q n ( ) assuming that Q(P )(Ĉ, ρ, e) only depends on finitely many values of P PPA App. A.4 and B c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 4

25 Inductive Definition P = lfp(q) = n Q n ( ) assuming P can be expressed as P (Ĉ, ρ, x l ) iff ρ(x) Ĉ(l) P (Ĉ, ρ, (let x = t l in t l ) l ) iff P (Ĉ, ρ, t l ) P (Ĉ, ρ, t l ) Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l). simply because P = Q(P ) Example: 0 is a number n+ is a number iff n is a number (Peano s Axioms) to check P (Ĉ, ρ, e) simply unfold using the clauses: if it terminates and yields true: then it holds and yields false: then it does not if it loops because it repeats itself: then it does not hold but we cannot detect it Example: = 0++ is a number because 0+ is because 0 is PPA App. A.4 and B c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 5

26 Inductive Definition to prove: (Ĉ, ρ, e) : P (Ĉ, ρ, e) R(Ĉ, ρ, e) show: R(Ĉ, ρ, x l ) if ρ(x) Ĉ(l) axiom R(Ĉ, ρ, t l ) R(Ĉ, ρ, t l ) R(Ĉ, ρ, (let x = t l in t l ) l ) if Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) inference rule. Examples: mathematical induction: R(0), structural induction R(n) R(n + ) induction on the shape of inference tree PPA App. A.4 and B c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 6

27 Coinductive Definition P = gfp(q) = {R R Q(R)} P can be expressed as P (Ĉ, ρ, x l ) iff ρ(x) Ĉ(l) P (Ĉ, ρ, (let x = t l in t l ) l ) iff P (Ĉ, ρ, t l ) P (Ĉ, ρ, t l ) Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l). simply because P = Q(P ) to check P (Ĉ, ρ, e) find some R such that R(Ĉ, ρ, e) can be shown to hold that is prove: R(Ĉ, ρ, x l ) if ρ(x) Ĉ(l) R(Ĉ, ρ, t l ) R(Ĉ, ρ, t l ) R(Ĉ, ρ, (let x = t l in t l ) l ) if Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l). and use P = {R R Q(R)} PPA App. A.4 and B c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 7

28 Coinductive Definition to prove: (Ĉ, ρ, e) : P (Ĉ, ρ, e) R(Ĉ, ρ, e) try to prove it using P = Q(P ) i.e. by using the way P is expressed if it fails try to do induction (on the structure or size) of e if it fails you will need an extra insight PPA App. A.4 and B c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 8

29 Example: loop (let g = (fun f x => (f (fn y => y ) 3 ) 4 ) 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 Abbreviations: f = fun f x => (f (fn y => y ) 3 ) 4 id y = fn y => y id z = fn z => z 7 One guess of a 0-CFA analysis result: Ĉ lp () = {f} Ĉ lp () = Ĉ lp (3) = {id y } Ĉ lp (4) = Ĉ lp (5) = {f} Ĉ lp (6) = {f} Ĉ lp (7) = Ĉ lp (8) = {id z } Ĉ lp (9) = Ĉ lp (0) = ρ lp (f) = {f} ρ lp (g) = {f} ρ lp (x) = {id y, id z } ρ lp (y) = ρ lp (z) = PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 9

30 Naively checking the solution gives rise to circularity: To show (Ĉlp, ρ lp ) = loop we have (among others) to show (Ĉlp, ρ lp ) = (g 6 (fn z => z 7 ) 8 ) 9 and to prove this we have (among others) to show (Ĉlp, ρ lp ) = (f (fn y => y ) 3 ) 4 and to show this we have (among others) to show (Ĉlp, ρ lp ) = (f (fn y => y ) 3 ) 4 because Ĉlp (3) ρ lp (x), Ĉlp (4) Ĉlp (4) and f ρ lp (f). PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 30

31 The Lesson The co-inductive definition solves the circularity: It allows us to assume that (Ĉlp, ρ lp ) = (f (fn y => y ) 3 ) 4 holds at the inner level and proving that it also holds at the outer level An inductive definition does not give us this possibility! PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 3

32 Theoretical Properties: structural operational semantics semantic correctness the existence of least solutions PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 3

33 Choice of Semantics operational or denotational semantics? an operational semantics more easily models intensional properties small-step or big-step operational semantics? a small-step semantics allows us to reason about looping programs operational semantics based on environments or substitutions? an environment based semantics preserves the identity of functions PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 33

34 Configurations and Transitions Semantic categories: v Val values defined by: ρ Env environments v ::= c close t in ρ closures ρ ::= [ ] ρ[x v] Transitions have the form ρ e e meaning that one step of computation of the expression e in the environment ρ will transform it into e. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 34

35 Transitions ρ x l v l if x dom(ρ) and v = ρ(x) ρ (fn x => e 0 ) l (close (fn x => e 0 ) in ρ 0 ) l where ρ 0 = ρ FV(fn x => e 0 ) ρ (fun f x => e 0 ) l (close (fun f x => e 0 ) in ρ 0 ) l where ρ 0 = ρ FV(fun f x => e 0 ) static scope! PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 35

36 Intermediate Expressions and Terms extending the syntax: ie ::= it l ie IExp intermediate expressions it ITerm intermediate terms it ::= c x fn x => e 0 fun f x => e 0 ie ie if ie 0 then e else e let x = ie in e ie op ie close t in ρ bind ρ in ie The correct form of transitions ρ ie ie PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 36

37 Transitions ρ ie ie ρ ie ie ρ (ie ie ) l (ie ie ) l ρ (v l ie ) l (v l ie )l ρ ((close (fn x => e ) in ρ ) l v l ) l (bind ρ [x v ] in e ) l ρ ((close (fun f x => e ) in ρ ) l v l ) l (bind ρ [x v ] in e ) l where ρ = ρ [f close (fun f x => e ) in ρ ] ρ ie ie ρ (bind ρ in ie ) l (bind ρ in ie )l ρ (bind ρ in v l ) l v l the outermost label remains the same PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 37

38 Example: [ ] ((fn x => x ) (fn y => y 3 ) 4 ) 5 ((close (fn x => x ) in [ ]) (fn y => y 3 ) 4 ) 5 ((close (fn x => x ) in [ ]) (close (fn y => y 3 ) in [ ]) 4 ) 5 (bind [x (close (fn y => y 3 ) in [ ])] in x ) 5 (bind [x (close (fn y => y 3 ) in [ ])] in (close (fn y => y 3 ) in [ ]) ) 5 (close (fn y => y 3 ) in [ ]) 5 PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 38

39 Transitions ρ ie 0 ie 0 ρ (if ie 0 then e else e ) l (if ie 0 then e else e ) l ρ (if true l 0 then t l else t l ) l t l ρ (if false l 0 then t l else t l ) l t l ρ ie ie ρ (let x = ie in e ) l (let x = ie in e ) l ρ (let x = v l in e ) l (bind [x v] in e ) l ρ ie ie ρ ie ie ρ (ie op ie ) l (ie op ie ) l ρ (v l op ie ) l (v l op ie )l ρ (v l op v l ) l v l if v = v op v PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 39

40 Example: [ ] (let g = (fun f x => (f (fn y => y ) 3 ) 4 ) 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 (let g = f 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 (bind [g f] in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 (bind [g f] in (f 6 (fn z => z 7 ) 8 ) 9 ) 0 (bind [g f] in (f 6 id 8 z ) 9 ) 0 (bind [g f] in (bind [f f][x id z ] in (f (fn y => y ) 3 ) 4 ) 9 ) 0 (bind [g f] in (bind [f f][x id z ] in (bind [f f][x id y ] in (f (fn y => y ) 3 ) 4 ) 4 ) 9 ) 0 Abbreviations: f = close (fun f x => (f (fn y => y ) 3 ) 4 ) in [ ] id y = close (fn y => y ) in [ ] id z = close (fn z => z 7 ) in [ ] PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 40

41 Semantic Correctness A subject reduction result: an acceptable result of the analysis remains acceptable under evaluation Analysis of intermediate expressions (Ĉ, ρ) = (bind ρ in it l 0 0 ) l iff (Ĉ, ρ) = it l 0 0 Ĉ(l 0) Ĉ(l) ρ R ρ (Ĉ, ρ) = (close t 0 in ρ) l iff {t 0 } Ĉ(l) ρ R ρ PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 4

42 Correctness Relation The global abstract environment, ρ models all the local environments of the semantics Correctness relation R : (Env Env) {true, false} We demand that ρ R ρ for all local environments, ρ, occurring in the intermediate expressions Define ρ R ρ iff x dom(ρ) dom( ρ) t x ρ x : (ρ(x) = close t x in ρ x ) (t x ρ(x) ρ x R ρ ) (Well-defined by induction in the size of ρ.) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 4

43 Example: Suppose that: ρ = [x close t in ρ ][y close t in ρ ] ρ = [ ] ρ = [x close t 3 in ρ 3 ] ρ 3 = [ ] Then ρ R ρ amounts to {t, t 3 } ρ(x) {t } ρ(y). PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 43

44 Alternative definition of Correctness Relation Split the definition of R into two components: V : R : (Val ( Env Val)) {true, false} (Env Env) {true, false} and define v V ( ρ, v) iff t ρ : (v = close t in ρ) (t v ρ R ρ) ρ R ρ iff x dom(ρ) dom( ρ) : ρ(x) V ( ρ, ρ(x)) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 44

45 Correctness Result ρ ie ie ie v l R = = = = ρ (Ĉ, ρ) (Ĉ, ρ) (Ĉ, ρ) (Ĉ, ρ) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 45

46 Formal details of Correctness Result Theorem: If ρ R ρ and ρ ie ie then (Ĉ, ρ) =ie implies (Ĉ, ρ) =ie. Intuitively: If there is a possible evaluation of the program such that the function at a call point evaluates to some abstraction, then this abstraction has to be in the set of possible abstractions computed by the analysis. Observe: the theorem expresses that all acceptable analysis results remain acceptable under evaluation! Thus we do not rely on the existence of a least or best solution. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 46

47 Proof of Correctness Result We assume that ρ R ρ and (Ĉ, ρ) =ie and prove (Ĉ, ρ) =ie by induction on the structure of the inference tree for ρ ie ie. Most cases amount to inspecting the defining clause for (Ĉ, ρ) = ie. This method of proof applies to all fixed points of a recursive definition and in particular also to the (more familiar least and) greatest fixed point(s). Crucial fact: If (Ĉ, ρ) = it l and Ĉ(l ) Ĉ(l ) then (Ĉ, ρ) = it l. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 47

48 Example: Semantics: [ ] ((fn x => x ) (fn y => y 3 ) 4 ) 5 (close (fn y => y 3 ) in [ ]) x y (Ĉe, ρ e ) {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } Analysis: (Ĉe, ρ e ) =((fn x => x ) (fn y => y 3 ) 4 ) 5 Correctness relation: [ ] R ρ e Correctness theorem: (Ĉe, ρ e ) =(close (fn y => y 3 ) in [ ]) 5 PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 48

49 Existence of Solutions Does each expression e admit a Control Flow Analysis? i.e. does there exist (Ĉ, ρ) such that (Ĉ, ρ) = e? Does each expression e have a least Control Flow Analysis? i.e. does there exists (Ĉ0, ρ 0 ) such that (Ĉ0, ρ 0 ) = e and such that whenever (Ĉ, ρ) = e then (Ĉ0, ρ 0 ) is less than (Ĉ, ρ)? Here least is with respect to the partial ordering (Ĉ, ρ ) (Ĉ, ρ ) iff ( l Lab : Ĉ(l) Ĉ(l)) ( x Var : ρ (x) ρ (x)) PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 49

50 Existence of Solutions (cont.) Two answers: there exists algorithms for the efficient computation of least solutions for all expressions all intermediate expressions enjoy a Moore family property A subset Y of a complete lattice L = (L, ) is a Moore family if and only if ( Y ) Y for all subsets Y of L Proposition: The set {(Ĉ, ρ) (Ĉ, ρ) = ie} is a Moore family for all intermediate expressions ie PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 50

51 Existence of Solutions (cont.) All intermediate expressions admit a Control Flow Analysis Let Y be the empty set; then Y is an element of {(Ĉ, ρ) (Ĉ, ρ) = ie} showing that there exists at least one analysis of ie. All intermediate expressions have a least Control Flow Analysis Let Y be the set {(Ĉ, ρ) (Ĉ, ρ) = ie}; then Y is an element of {(Ĉ, ρ) (Ĉ, ρ) = ie} so it will also be an analysis of ie. Clearly Y (Ĉ, ρ) for all other analyses (Ĉ, ρ) of ie so it is the least analysis result. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 5

52 Example: (Ĉe, ρ e ) = ((fn x => x ) (fn y => y 3 ) 4 ) 5 (Ĉe, ρ e ) = ((fn x => x ) (fn y => y 3 ) 4 ) 5 The Moore family result ensures that (Ĉe Ĉe, ρ e ρ e ) = ((fn x => x ) (fn y => y 3 ) 4 ) x y (Ĉe, ρ e ) (Ĉe, ρ e ) (Ĉe, ρ e ) {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn x => x } {fn x => x } {fn x => x } {fn x => x } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn y => y 3 } {fn x => x } {fn y => y 3 } {fn y => y 3 } PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 5

53 Coinduction versus Induction The abstract Control Flow Analysis is defined coinductively = is the greatest fixed point of a function Q An alternative might be an inductive definition = is the least fixed point of the function Q. Proposition: There exists e Exp such that {(Ĉ, ρ) (Ĉ, ρ) = e } is not a Moore family. PPA Section 3. c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 53

54 Syntax Directed 0-CFA Analysis Reformulate the abstract specification: (i) Syntax directed specification (ii) Constructing a finite set of constraints (iii) Compute the least solution of the set of constraints PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 54

55 Common Phenomenon A specification = A is reformulated into a specification = B ensuring that (Ĉ, ρ) = A e (Ĉ, ρ) = B e so that = B is a safe approximation to = A and hence the best (i.e. least) solution to = B e will also be a solution to = A e. If additionally (Ĉ, ρ) = A e (Ĉ, ρ) = B e then we can be assured that no solutions are lost and hence the best (i.e. least) solution to = B e will also be the best (i.e. least) solution to = A e. PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 55

56 Syntax Directed Specification () (Ĉ, ρ) = s (fn x => e 0 ) l iff {fn x => e 0 } Ĉ(l) (Ĉ, ρ) = s e 0 (Ĉ, ρ) = s (fun f x => e 0 ) l iff {fun f x => e 0 } Ĉ(l) (Ĉ, ρ) = s (t l (Ĉ, ρ) = s e 0 t l ) l {fun f x => e 0 } ρ(f) iff (Ĉ, ρ) = s t l (Ĉ, ρ) = s t l ( (fn x => t l 0 0 ) Ĉ(l ) : Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l) ( (fun f x => t l 0 0 ) Ĉ(l ) : Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l) ) ) PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 56

57 Syntax Directed Specification () (Ĉ, ρ) = s c l always (Ĉ, ρ) = s x l iff ρ(x) Ĉ(l) (Ĉ, ρ) = s (if t l 0 0 then t l else t l iff (Ĉ, ρ) = s t l 0 0 (Ĉ, ρ) = s t l (Ĉ, ρ) = s t l Ĉ(l ) Ĉ(l) Ĉ(l ) Ĉ(l) ) l (Ĉ, ρ) = s (let x = t l in t l iff (Ĉ, ρ) = s t l (Ĉ, ρ) = s t l Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) ) l (Ĉ, ρ) = s (t l op t l ) l iff (Ĉ, ρ) = s t l (Ĉ, ρ) = s t l PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 57

58 Example: loop (let g = (fun f x => (f (fn y => y ) 3 ) 4 ) 5 in (g 6 (fn z => z 7 ) 8 ) 9 ) 0 Abbreviations: f = fun f x => (f (fn y => y ) 3 ) 4 id y = fn y => y id z = fn z => z 7 One guess of a 0-CFA analysis result: Ĉ lp () = {f} Ĉ lp () = Ĉ lp (3) = {id y } Ĉ lp (4) = Ĉ lp (5) = {f} Ĉ lp (6) = {f} Ĉ lp (7) = Ĉ lp (8) = {id z } Ĉ lp (9) = Ĉ lp (0) = ρ lp (f) = {f} ρ lp (g) = {f} ρ lp (x) = {id y, id z } ρ lp (y) = ρ lp (z) = PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 58

59 Example: Checking the solution To show (Ĉlp, ρ lp ) = s loop we have (among others) to show (Ĉlp, ρ lp ) = s (g 6 (fn z => z 7 ) 8 ) 9 and (Ĉlp, ρ lp ) = s (f (fn y => y ) 3 ) 4 and this is straightforward. The Lesson No need for co-induction because the definition is syntax-directed PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 59

60 Preservation of Solutions Define (Ĉ, ρ ) by: { Ĉ if l / (l) = Lab Term if l Lab ρ (x) = { if x / Var Term if x Var Then all the solutions to = s e that are less than (Ĉ, ρ ) are solutions to = e as well: Proposition: If (Ĉ, ρ) = s e and (Ĉ, ρ) (Ĉ, ρ ) then (Ĉ, ρ) = e. (That (Ĉ, ρ) (Ĉ, ρ ) means that (Ĉ, ρ) lives in a closed universe.) PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 60

61 Proposition: {(Ĉ, ρ) (Ĉ, ρ ) (Ĉ, ρ) = s e } is a Moore family. Corollaries: each expression e has a Control Flow Analysis that is less than (Ĉ, ρ ), and each expression e has a least Control Flow Analysis that is less than (Ĉ, ρ ). PPA Section 3.3 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 6

62 Constraint Based 0-CFA Analysis C [[e ]] is a set of constraints of the form lhs rhs {t} rhs lhs rhs where rhs ::= C(l) r(x) lhs ::= C(l) r(x) {t} and all occurrences of t are of the form fn x => e 0 or fun f x => e 0 PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 6

63 Constraint Based Control Flow Analysis () C [[(fn x => e 0 ) l ]] = { {fn x => e 0 } C(l) } C [[e 0 ]] C [[(fun f x => e 0 ) l ]] = { {fun f x => e 0 } C(l) } C [[e 0 ]] { {fun f x => e 0 } r(f) } C [[(t l t l ) l ]] = C [[t l ]] C [[t l ]] { {t} C(l ) C(l ) r(x) t = (fn x => t l 0 0 ) Term } { {t} C(l ) C(l 0 ) C(l) t = (fn x => t l 0 0 ) Term } { {t} C(l ) C(l ) r(x) t = (fun f x => t l 0 0 ) Term } { {t} C(l ) C(l 0 ) C(l) t = (fun f x => t l 0 0 ) Term } (Eager rather than lazy unfolding easy but costly.) PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 63

64 Constraint Based Control Flow Analysis () C [[c l ]] = C [[x l ]] = { r(x) C(l) } C [[(if t l 0 0 then t l else t l ) l ]] = C [[t l 0 0 ]] C [[t l ]] C [[t l ]] { C(l ) C(l) } { C(l ) C(l) } C [[(let x = t l in t l ) l ]] = C [[t l ]] C [[t l ]] { C(l ) r(x) } { C(l ) C(l) } C [[(t l op t l ) l ]] = C [[t l ]] C [[t l ]] PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 64

65 Example: C [[((fn x => x ) (fn y => y 3 ) 4 ) 5 ]] = { {fn x => x } C(), r(x) C(), {fn y => y 3 } C(4), r(y) C(3), {fn x => x } C() C(4) r(x), {fn x => x } C() C() C(5), {fn y => y 3 } C() C(4) r(y), {fn y => y 3 } C() C(3) C(5) } PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 65

66 Preservation of Solutions Translating syntactic entities to sets of terms: (Ĉ, ρ)[[c(l)]] = Ĉ(l) (Ĉ, ρ)[[r(x)]] = ρ(x) (Ĉ, ρ)[[{t}]] = {t} Satisfaction relation for constraints: (Ĉ, ρ) = c (lhs rhs) (Ĉ, ρ) = c (lhs rhs) iff (Ĉ, ρ)[[lhs]] (Ĉ, ρ)[[rhs]] (Ĉ, ρ) = c ({t} rhs lhs rhs) iff ({t} (Ĉ, ρ)[[rhs ]] (Ĉ, ρ)[[lhs]] (Ĉ, ρ)[[rhs]]) ({t} (Ĉ, ρ)[[rhs ]]) Proposition: (Ĉ, ρ) = s e if and only if (Ĉ, ρ) = c C [[e ]]. PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 66

67 Solving the Constraints () Input: a set of constraints C [[e ]] Output: the least solution (Ĉ, ρ) to the constraints Data structures: a graph with one node for each C(l) and r(x) (where l Lab and x Var ) and zero, one or two edges for each constraint in C [[e ]] W: the worklist of the nodes whose outgoing edges should be traversed D: an array that for each node gives an element of Val E: an array that for each node gives a list of constraints influenced (and outgoing edges) Auxiliary procedure: procedure add(q,d) is if (d D[q]) then D[q] := D[q] d; W := cons(q,w); PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 67

68 Solving the Constraints () Step Step Step 3 Step 4 Initialisation W := nil; for q in Nodes do D[q] := ; E[q] := nil; Building the graph for cc in C [[e ]] do case cc of {t} p: add(p,{t}); p p : E[p ] := cons(cc,e[p ]); {t} p p p : E[p ] := cons(cc,e[p ]); E[p] := cons(cc,e[p]); Iteration while W nil do q := head(w); W := tail(w); for cc in E[q] do case cc of p p : add(p, D[p ]); {t} p p p : if t D[p] then add(p, D[p ]); Recording the solution for l in Lab do Ĉ(l) := D[C(l)]; for x in Var do ρ(x) := D[r(x)]; PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 68

69 Example: Initialisation of data structures p D[p] E[p] C() [id x C() C() C(5)] C() id x [id y C() C(3) C(5), id y C() C(4) r(y), id x C() C() C(5), id x C() C(4) r(x)] C(3) [id y C() C(3) C(5)] C(4) id y [id y C() C(4) r(y), id x C() C(4) r(x)] C(5) [ ] r(x) [r(x) C()] r(y) [r(y) C(3)] PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 69

70 Example: Iteration steps W [C(4),C()] [r(x),c()] [C(),C()] [C(5),C()] [C()] [ ] p D[p] D[p] D[p] D[p] D[p] D[p] C() id y id y id y id y C() id x id x id x id x id x id x C(3) C(4) id y id y id y id y id y id y C(5) id y id y id y r(x) id y id y id y id y id y r(y) PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 70

71 Correctness: Given input C [[e ]] the worklist algorithm terminates and the result (Ĉ, ρ) produced by the algorithm satisfies (Ĉ, ρ) = {(Ĉ, ρ ) (Ĉ, ρ ) = c C [[e ]]} and hence it is the least solution to C [[e ]]. Complexity: The algorithm takes at most O(n 3 ) steps if the original expression e has size n. PPA Section 3.4 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 7

72 Adding Data Flow Analysis Idea: extend the set Val to contain other abstract values than just abstractions powerset (possibly finite) complete lattice (possibly satisfying Ascending Chain Condition) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 7

73 Abstract Values as Powersets Let Data be a set of abstract data values (i.e. abstract properties of booleans and integers) v Val d = P(Term Data) abstract values For each constant c Const we need an element d c Data For each operator op Op we need a total function ôp : Val d Val d Val d typically v ôp v = {d op (d, d ) d v Data, d v Data} for some d op : Data Data P(Data) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 73

74 Example: Detection of Signs Analysis Data sign = {tt, ff, -, 0, +} d true = tt d 7 = + + is defined from d + tt ff tt ff - {-} {-} {-, 0, +} 0 {-} {0} {+} + {-, 0, +} {+} {+} PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 74

75 Abstract Values as Powersets () (Ĉ, ρ) = d (fn x => e 0 ) l iff {fn x => e 0 } Ĉ(l) (Ĉ, ρ) = d (fun f x => e 0 ) l iff {fun f x => e 0 } Ĉ(l) (Ĉ, ρ) = d (t l t l ) l iff (Ĉ, ρ) = d t l (Ĉ, ρ) = d t l ( (fn x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = d t l 0 0 Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l)) ( (fun f x => t l 0 0 ) Ĉ(l ) : (Ĉ, ρ) = d t l 0 0 Ĉ(l ) ρ(x) Ĉ(l 0) Ĉ(l) {fun f x => t l 0 0 } ρ(f)) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 75

76 Abstract Values as Powersets () (Ĉ, ρ) = d c l iff {d c } Ĉ(l) (Ĉ, ρ) = d x l iff ρ(x) Ĉ(l) (Ĉ, ρ) = d (if t l 0 0 then t l else t l iff (Ĉ, ρ) = d t l 0 0 ) l (d true Ĉ(l 0) ( (Ĉ, ρ) = d t l Ĉ(l ) Ĉ(l))) (d false Ĉ(l 0) ( (Ĉ, ρ) = d t l Ĉ(l ) Ĉ(l))) (Ĉ, ρ) = d (let x = t l in t l iff (Ĉ, ρ) = d t l (Ĉ, ρ) = d t l Ĉ(l ) ρ(x) Ĉ(l ) Ĉ(l) (Ĉ, ρ) = d (t l op t l ) l ) l iff (Ĉ, ρ) = d t l (Ĉ, ρ) = d t l Ĉ(l ) ôp Ĉ(l ) Ĉ(l) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 76

77 Example: (let f = (fn x => (if (x > 0 ) 3 then (fn y => y 4 ) 5 else (fn z => 5 6 ) 7 ) 8 ) 9 in ((f 0 3 ) 0 3 ) 4 ) 5 A pure 0-CFA analysis will not be able to discover that the else-branch of the conditional will never be executed. When we combine the analysis with a Detection of Signs Analysis then the analysis can determine that only fn y => y 4 is a possible abstraction at label. PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 77

78 Example: (Ĉ, ρ) (Ĉ, ρ) {+} {0} 3 {tt} 4 {0} 5 {fn y => y 4 } {fn y => y 4 } 6 7 {fn z => 5 6 } 8 { fn y => y 4, fn z => 5 6 } {fn y => y 4 } 9 {fn x => ( ) 8 } {fn x => ( ) 8 } 0 {fn x => ( ) 8 } {fn x => ( ) 8 } {+} { fn y => y 4, fn z => 5 6 } {fn y => y 4 } 3 {0} 4 {0} 5 {0} f {fn x => ( ) 8 } {fn x => ( ) 8 } x {+} y {0} z PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 78

79 Abstract Values as Complete Lattices A monotone structure consists of: a complete lattice L, and a set F of monotone functions of L L L. An instance of a monotone structure consists of the structure (L, F) and a mapping ι from the constants c Const to values in L, and a mapping f from the binary operators op Op to functions of F. PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 79

80 Example: A monotone structure corresponding to the previous development will have L to be P(Data) and F to be the monotone functions of P(Data) P(Data) P(Data). (L satisfies the Ascending Chain Property iff Data is finite.) An instance of the monotone structure is then obtained by taking ι c = {d c } for all constants c (and with d c Data as above) and f op (l, l ) = {d op (d, d ) d l, d l } for all binary operators op (and where d op : Data Data P(Data) is as above). PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 80

81 Example: A monotone structure for Constant Propagation Analysis will have L to be Z P({tt, ff}) and F to be the monotone functions of L L L. An instance of the monotone structure is obtained by taking e.g. ι 7 = (7, ) and ι true = (, {tt}). For a binary operator as + we can take: f+(l, l ) = (z + z, ) if l = (z, ), l = (z, ), and z, z Z (, ) if l = (z, ), l = (z, ), and z = or z = (, ) otherwise PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 8

82 Abstract Domains For the Control Flow Analysis: v Val = P(Term) abstract values ρ Env = Var Val abstract environments Ĉ Cache = Lab Val abstract caches For the Data Flow Analysis: d Data = L abstract data values δ DEnv = Var Data abstract data environments D DCache = Lab Data abstract data caches PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 8

83 Abstract Values as Complete Lattices () (Ĉ, D, ρ, δ) = D (fn x => e 0 ) l iff {fn x => e 0 } Ĉ(l) (Ĉ, D, ρ, δ) = D (fun f x => e 0 ) l iff {fun f x => e 0 } Ĉ(l) (Ĉ, D, ρ, δ) = D (t l t l ) l iff (Ĉ, D, ρ, δ) = D t l (Ĉ, D, ρ, δ) = D t l ( (fn x => t l 0 0 ) Ĉ(l ) : (Ĉ, D, ρ, δ) = D t l 0 Ĉ(l ) ρ(x) Ĉ(l 0 ) Ĉ(l) 0 ( (fun f x => t l 0 0 ) Ĉ(l ) : (Ĉ, D, ρ, δ) = D t l 0 Ĉ(l ) ρ(x) Ĉ(l 0 ) Ĉ(l) D(l ) δ(x) D(l 0 ) D(l) ) 0 {fun f x => t l 0 0 } ρ(f)) D(l ) δ(x) D(l 0 ) D(l) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 83

84 Abstract Values as Complete Lattices () (Ĉ, D, ρ, δ) = D c l iff ι C D(l) (Ĉ, D, ρ, δ) = D x l iff ρ(x) Ĉ(l) δ(x) D(l) (Ĉ, D, ρ, δ) = D (if t l 0 0 then t l else t l iff (Ĉ, D, ρ, δ) = D t l 0 0 ( ι true D(l 0 ) (Ĉ, D, ρ, δ) = D t l ) l Ĉ(l ) Ĉ(l) D(l ) D(l) ) ( ι false D(l 0 ) (Ĉ, D, ρ, δ) = D t l Ĉ(l ) Ĉ(l) D(l ) D(l) ) PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 84

85 Abstract Values as Complete Lattices (3) (Ĉ, D, ρ, δ) = D (let x = t l in t l iff (Ĉ, D, ρ, δ) = D t l (Ĉ, D, ρ, δ) = D t l Ĉ(l ) ρ(x) D(l ) δ(x) ) l Ĉ(l ) Ĉ(l) D(l ) D(l) (Ĉ, D, ρ, δ) = D (t l op t l iff (Ĉ, D, ρ, δ) = D t l (Ĉ, D, ρ, δ) = D t l f op ( D(l ), D(l )) D(l) ) l PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 85

86 Example: (Ĉ, ρ) (Ĉ, ρ) (Ĉ, ρ) ( D, δ) {+} {+} {0} {0} 3 {tt} {tt} 4 {0} {0} 5 {fn y => y 4 } {fn y => y 4 } {fn y => y 4 } 6 7 {fn z => 5 6 } 8 { fn y => y 4, fn z => 5 6 } {fn y => y 4 } {fn y => y 4 } 9 {fn x => ( ) 8 } {fn x => ( ) 8 } {fn x => ( ) 8 } 0 {fn x => ( ) 8 } {fn x => ( ) 8 } {fn x => ( ) 8 } {+} {+} { fn y => y 4, fn z => 5 6 } {fn y => y 4 } {fn y => y 4 } 3 {0} {0} 4 {0} {0} 5 {0} {0} f {fn x => ( ) 8 } {fn x => ( ) 8 } {fn x => ( ) 8 } x {+} {+} y {0} {0} z PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 86

87 Staging the specification Alternative clause for the conditional where the data flow component cannot influence the control flow component: (Ĉ, D, ρ, δ) = D (if t l 0 0 then t l else t l iff (Ĉ, D, ρ, δ) = D t l 0 0 (Ĉ, D, ρ, δ) = D t l Ĉ(l ) Ĉ(l) D(l ) D(l) (Ĉ, D, ρ, δ) = D t l Ĉ(l ) Ĉ(l) D(l ) D(l) ) l Compare with flow-insensitive Data Flow Analyses. PPA Section 3.5 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 87

88 Adding Context Information Mono-variant analysis: does not distinguish the various instances of variables and program points from one another. (Compare with contextinsensitive interprocedural analysis.) 0-CFA is a typical example. Poly-variant analysis: distinguishes between the various instances of variables and program points. (Compare with context-sensitive interprocedural analysis.) PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 88

89 Example: (let f = (fn x => x ) in ((f 3 f 4 ) 5 (fn y => y 6 ) 7 ) 8 ) 9 The least 0-CFA analysis: Ĉ id () = {fn x => x, fn y => y 6 } Ĉid () = {fn x => x } Ĉ id (3) = {fn x => x } Ĉid (4) = {fn x => x } Ĉ id (5) = {fn x => x, fn y => y 6 } Ĉid (6) = {fn y => y6 } Ĉ id (7) = {fn y => y 6 } Ĉid (8) = {fn x => x, fn y => y 6 } Ĉ id (9) = {fn x => x, fn y => y 6 } ρ id (f) = {fn x => x } ρ id (x) = {fn x => x, fn y => y 6 } ρ id (y) = {fn y => y 6 } The analysis says that the expression may evaluate to fn x => x or fn y => y 6. However, only fn y => y 6 is a possible result. PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 89

90 A purely syntactic solution: Expand (let f = (fn x => x) in ((f f) (fn y => y))) into let f = (fn x => x) in let f = (fn x => x) in (f f) (fn y => y) and analyse the expanded expression. The 0-CFA analysis is now able to deduce that the overall expression will evaluate to fn y => y only. PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 90

91 A purely semantic solution: Uniform k-cfa Idea: extend the set Val to include context information In a (uniform) k-cfa a context δ records the last k dynamic call points; hence contexts will be sequences of labels of length at most k and they will be updated whenever a function application is analysed. (Compare call strings of length at most k.) PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 9

92 Abstract Domains δ = Lab k context information ce CEnv = Var context environments v Val = P(Term CEnv) abstract values ρ Env = (Var ) Val abstract environments Ĉ Cache = (Lab ) Val abstract caches (Uniform because used both for Env and Cache.) PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 9

93 Acceptability Relation where (Ĉ, ρ) = ce δ e ce is the current context environment will be changed when new bindings are made δ is the current context will be changed when functions are called Idea: The formula expresses that (Ĉ, ρ) is an acceptable analysis of e in the context specified by ce and δ. PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 93

94 Control Flow Analysis with Context () (Ĉ, ρ) = ce δ (fn x => e 0) l iff {(fn x => e 0, ce )} Ĉ(l, δ) (Ĉ, ρ) = ce δ (fun f x => e 0) l iff {(fun f x => e 0, ce )} Ĉ(l, δ) (Ĉ, ρ) = ce δ (tl iff t l ) l (Ĉ, ρ) = ce δ tl (Ĉ, ρ) = ce δ tl ( (fn x => t l 0 0, ce 0 ) Ĉ(l, δ) : (Ĉ, ρ) = ce 0 δ t l Ĉ(l, δ) ρ(x, δ 0 ) Ĉ(l 0, δ 0 ) where δ 0 = δ, l k and ce 0 = ce 0[x δ 0 ]) ( (fun f x => t l 0 0, ce 0 ) Ĉ(l, δ) : (Ĉ, ρ) = ce 0 δ t l Ĉ(l, δ) ρ(x, δ 0 ) Ĉ(l 0, δ 0 ) {(fun f x => t l 0 0, ce 0 )} ρ(f, δ 0 ) where δ 0 = δ, l k and ce 0 = ce 0[f δ 0, x δ 0 ]) Ĉ(l, δ) Ĉ(l, δ) PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 94

95 Control Flow Analysis with Context () (Ĉ, ρ) = ce δ cl always (Ĉ, ρ) = ce δ xl iff ρ(x, ce(x) ) Ĉ(l, δ) (Ĉ, ρ) = ce δ (if tl 0 0 then t l else t l ) l iff (Ĉ, ρ) = ce δ tl 0 0 (Ĉ, ρ) = ce δ tl (Ĉ, ρ) = ce Ĉ(l, δ) Ĉ(l, δ) Ĉ(l, δ) Ĉ(l, δ) (Ĉ, ρ) = ce δ (let x = tl in t l iff (Ĉ, ρ) = ce δ tl (Ĉ, ρ) = ce δ t l Ĉ(l, δ) ρ(x, δ) Ĉ(l, δ) Ĉ(l, δ) where ce = ce[x δ] ) l δ tl (Ĉ, ρ) = ce δ (tl op t l ) l iff (Ĉ, ρ) = ce δ tl (Ĉ, ρ) = ce δ tl PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 95

96 Example: (let f = (fn x => x ) in ((f 3 f 4 ) 5 (fn y => y 6 ) 7 ) 8 ) 9 Contexts of interest for uniform -CFA: Λ: the initial context 5: the context when the application point labelled 5 has been passed 8: the context when the application point labelled 8 has been passed Context environments of interest for uniform -CFA: ce 0 = [ ] the initial (empty) context environment ce = ce 0 [f Λ] the context environment for the analysis of the body of the let-construct ce = ce 0 [x 5] the context environment used for the analysis of the body of f initiated at the application point 5 ce 3 = ce 0 [x 8] the context environment used for the analysis of the body of f initiated at the application point 8. PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 96

97 Example: Let us take Ĉid and ρ id to be: Ĉ id (, 5) = {(fn x => x,ce 0 )} Ĉid (, 8) = {(fn y => y 6,ce 0 )} Ĉ id (, Λ) = {(fn x => x,ce 0 )} Ĉid (3, Λ) = {(fn x => x,ce 0 )} Ĉ id (4, Λ) = {(fn x => x,ce 0 )} Ĉid (5, Λ) = {(fn x => x,ce 0 )} Ĉ id (7, Λ) = {(fn y => y 6,ce 0 )} Ĉid (8, Λ) = {(fn y => y 6,ce 0 )} Ĉ id (9, Λ) = {(fn y => y 6,ce 0 )} ρ id (f, Λ) = {(fn x => x,ce 0 )} ρ id (x, 5) = {(fn x => x,ce 0 )} ρ id (x, 8) = {(fn y => y 6,ce 0 )} This is an acceptable analysis result: (Ĉid, ρ id ) = ce 0 Λ (let f = (fn x => x ) in ((f 3 f 4 ) 5 (fn y => y 6 ) 7 ) 8 ) 9 PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 97

98 Complexity Uniform k-cfa has exponential worst case complexity even when k = Assume that the expression has size n and that it has p different variables. Then has O(n) elements and hence there will be O(p n) different pairs (x, δ) and O(n ) different pairs (l, δ). This means that (Ĉ, ρ) can be seen as an O(n ) tuple of values from Val. Since Val itself is a powerset of pairs of the form (t, ce) and there are O(n n p ) such pairs it follows that Val has height O(n n p ). Since O(p) = O(n) we have the exponential worst case complexity. 0-CFA analysis has polynomial worst case complexity It corresponds to letting be a singleton. Repeating the above calculations we can see (Ĉ, ρ) as an O(p + n) tuple of values from Val, and Val will be a lattice of height O(n). PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 98

99 Variations (based on call-strings) Uniform k-cfa ce CEnv = Var context environments v Val = P(Term CEnv) abstract values ρ Env = (Var ) Val abstract environments Ĉ Cache = (Lab ) Val abstract caches k-cfa Ĉ Cache = (Lab CEnv) Val abstract caches Polynomial k-cfa v Val = P(Term ) abstract values PPA Section 3.6 c F.Nielson & H.Riis Nielson & C.Hankin (Dec. 004) 99