This preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full Document
Unformatted text preview: Course Outline Introduction Controlflow analysis Dataflow analysis and abstract interpretation Sparse analysis Adding indirection (pointers) Adding functions Type and constraintbased analysis Ben Hardekopf () CS 290C Program Analysis Fall 2011 1 / 80 Section Outline Dataflow Analysis (DFA) Example analyses Abstract domains and lattices Abstract semantics and transfer functions Dataflow analysis framework Complexity, precision, termination, and soundness Ben Hardekopf () CS 290C Program Analysis Fall 2011 2 / 80 FirstOrder Analyses Firstorder analyses are concerned with properties about states ; they can be determined by looking at a single configuration. A common example is valuebased analysis , like the Zero/NonZero and the Even/Odd analyses we’ve already seen. Example Analyses Constant Propagation Range Propagation Ben Hardekopf () CS 290C Program Analysis Fall 2011 3 / 80 Constant Propagation For each node of the CFG, which variables are guaranteed to be a constant value? Program x := 5 ; z := input ; if (z > 0) then { y := x+1 } else { y := x1 } ; z := y Ben Hardekopf () CS 290C Program Analysis Fall 2011 4 / 80 Range Propagation For each node of the CFG, map each variable to the range of values it might have at that node. (Notice that this analysis is strictly more precise than constant propagation.) Program x := 5 ; z := input ; if (z > 0) then { y := x+1 } else { y := x1 } ; z := y Ben Hardekopf () CS 290C Program Analysis Fall 2011 5 / 80 SecondOrder Analyses Secondorder analyses are concerned with properties about paths ; they can be determined by looking at a sequence of configurations. Example Analyses Reaching Definitions Available Expressions Ben Hardekopf () CS 290C Program Analysis Fall 2011 6 / 80 Reaching Definitions A definition is a variable assignment. A definition “x := ...” at node A reaches node B is there is an executable path from A to B that does not redefine x . Determine for each node the set of possible reaching definitions. Program x := 4 ; y := 6 ; if (z > 0) then { x := 2 } else { x := 3 } ; z := x + y Ben Hardekopf () CS 290C Program Analysis Fall 2011 7 / 80 Available Expressions An expression such as “ x + y ” is available at node A if it is computed along every executable path to A and its operands are not redefined along those paths before reaching A. Determine for each node the set of available expressions. Program x := a+b ; y := c+d ; if (z > 0) then { a := y } else { z := y } ; r := a+b ; s := c+d Notice that unlike every other example analysis, this is a must analysis (underapproximation) rather than a may analysis (overapproximation). Ben Hardekopf () CS 290C Program Analysis Fall 2011 8 / 80 Section Outline Dataflow Analysis (DFA) Example analyses Abstract domains and lattices Abstract semantics and transfer functions Dataflow analysis framework Complexity, precision, termination, and soundness Ben Hardekopf () CS 290C Program Analysis Fall 2011 9 / 80 Abstract Domains We formalize the notion of “abstract domain” using an algebraic structure...
View
Full Document
 Fall '09
 Vandam
 Order theory, Ben Hardekopf, CS 290C Program, 290C Program Analysis

Click to edit the document details