02 CFA

# 02 CFA - Course Outline Introduction Control-flow analysis...

This preview shows pages 1–9. Sign up to view the full content.

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Course Outline Introduction Control-flow analysis Dataflow analysis and abstract interpretation Sparse analysis Adding indirection (pointers) Adding functions Type- and constraint-based analysis Ben Hardekopf () CS 290C Program Analysis Fall 2011 1 / 40 Section Outline Control-flow Analysis (CFA) Control-flow graph (CFG) Dominators and post-dominators Control dependence Loops and SCCs Ben Hardekopf () CS 290C Program Analysis Fall 2011 2 / 40 Control-Flow Graph A control-flow graph (CFG) represents the possible flow of program execution. It is an abstraction of the control-flow given in the trace-based semantics. Ben Hardekopf () CS 290C Program Analysis Fall 2011 3 / 40 Control-Flow Graph A control-flow graph (CFG) represents the possible flow of program execution. It is an abstraction of the control-flow given in the trace-based semantics. Program A 1 x := 5; 2 if (y < x) then { 3 y := x+1} else { 4 y := x-1}; 5 z := y Ben Hardekopf () CS 290C Program Analysis Fall 2011 3 / 40 Control-Flow Graph A control-flow graph (CFG) represents the possible flow of program execution. It is an abstraction of the control-flow given in the trace-based semantics. Program A 1 x := 5; 2 if (y < x) then { 3 y := x+1} else { 4 y := x-1}; 5 z := y Trace h 1 , [ x 7→ , y 7→ , z 7→ 0] i → h 2 , [ x 7→ 5 , y 7→ , z 7→ 0] i → h 3 , [ x 7→ 5 , y 7→ , z 7→ 0] i → h 5 , [ x 7→ 5 , y 7→ 6 , z 7→ 0] i → h , [ x 7→ 5 , y 7→ 6 , z 7→ 6] i We throw away the state information in the configurations and just keep track of which program points lead to which other program points. Ben Hardekopf () CS 290C Program Analysis Fall 2011 3 / 40 Example Compute the CFG of the following program: Program C 1 input z; 2 x := 2; 3 y := x+3; 4 if (z < y) then { 5 while (z < w) do { 6 x := y; 7 y := x+3; 8 w := y-x } } else { 9 y := x; 10 w := x-y } Ben Hardekopf () CS 290C Program Analysis Fall 2011 4 / 40 Example Compute the CFG of the following program: Program C 1 input z; 2 x := 2; 3 y := x+3; 4 if (z < y) then { 5 while (z < w) do { 6 x := y; 7 y := x+3; 8 w := y-x } } else { 9 y := x; 10 w := x-y } Note that the CFG is an abstraction —it contains all possible execution paths, plus some paths that aren’t possible (such as the paths that exit the while loop in Program C). Ben Hardekopf () CS 290C Program Analysis Fall 2011 4 / 40 Control-Flow Graph Definition (Control-Flow Graph) Formally, a control-flow graph G = ( N , E ) is: A set of nodes N , one for each program statement A set of edges E ⊆ N × N , such that x → y iff statement y may execute directly after statement x There is a unique entry node and a unique exit node For the current version of Lingo the CFG is simple to compute by inspection, but when we add indirection + functions (i.e., function pointers) it will require program analysis to compute the CFG....
View Full Document

## This note was uploaded on 12/27/2011 for the course CMPSC 290a taught by Professor Vandam during the Fall '09 term at UCSB.

### Page1 / 57

02 CFA - Course Outline Introduction Control-flow analysis...

This preview shows document pages 1 - 9. Sign up to view the full document.

View Full Document
Ask a homework question - tutors are online