Approximation
Want to show:
Quick recap of abstract interpretation
Cousot and Cousot 77
Cousot and Cousot show that the following conditions are sufficient for proving (1) and (2):
(3)
Let's look at the condition
(4)
(5)
Let's look at the c

Tour of common optimizations
Simple example
foo(z) cfw_
x := 3 + 6;
y := x 5
return z * y
Simple example
foo(z) cfw_
x := 3 + 6;
y := x 5
return z * y
Another example
x := a + b;
.
y := a + b;
Another example
x := a + b;
.
y := a + b;
Another example
if

Dataflow analysis
Dataflow analysis: what is it?
A common framework for expressing algorithms
that compute information about a program
Why is such a framework useful?
Dataflow analysis: what is it?
A common framework for expressing algorithms
that comp

Advanced Compiler Design
CSE 231
Instructor: Sorin Lerner
Lets look at a compiler
Compiler
if () cfw_
x := ;
else
cfw_
Parser
y := ;
;
Optimizer
Compiler
Code
Exec
Gen
Lets look at a compiler
Compiler
Parser
Optimizer
Code
Gen
Advanced Optimizer Design

Dataflow analysis
Dataflow analysis: what is it?
A common framework for expressing algorithms
that compute information about a program
Why is such a framework useful?
Dataflow analysis: what is it?
A common framework for expressing algorithms
that comp

Another example: constant prop
Another example: constant prop
Set D =
Set D = 2 cfw_ x ! N | x 2 Vars N 2 Z
in
in
X := N
FX := N(in) =
X := N
out
FX := N(in) = in cfw_ X ! * [ cfw_ X ! N
out
in
in
X := Y op Z
FX := Y op Z(in) =
X := Y op Z
out
out
An

Formalization of DFA using lattices
Recall worklist algorithm
let m: map from edge to computed value at edge
let worklist: work list of nodes
for each edge e in CFG do
m(e) := ;
for each node n do
worklist.add(n)
while (worklist.empty.not) do
let n := wor

Formalization of DFA using lattices
Recall worklist algorithm
let m: map from edge to computed value at edge
let worklist: work list of nodes
for each edge e in CFG do
m(e) := ;
for each node n do
worklist.add(n)
while (worklist.empty.not) do
let n := wor

Another example: constant prop
Another example: constant prop
Set D =
Set D = 2 cfw_ x ! N | x 2 Vars N 2 Z
in
in
X := N
FX := N(in) =
X := N
out
FX := N(in) = in cfw_ X ! * [ cfw_ X ! N
out
in
in
X := Y op Z
FX := Y op Z(in) =
X := Y op Z
out
out
An

Pointer Analysis
Outline:
What is pointer analysis
Intraprocedural pointer analysis
Interprocedural pointer analysis
Pointer analysis
Andersen and Steensgaard
Pointer and Alias Analysis
Useful for what?
Aliases: two expressions that denote the same

Costs of procedure calls
Up until now, we treated calls conservatively:
Interprocedural analyses and
optimizations
make the flow function for call nodes return top
start iterative analysis with incoming edge of the CFG
set to top
This leads to less pr

Representing programs
Goals
Program Representations
Representing programs
Option 1: high-level syntax based IR
Primary goals
Represent source-level structures and
expressions directly
analysis is easy and effective
just a few cases to handle
directl

Another example: constant prop
Set D =
in
X := N
FX := N(in) =
out
in
X := Y op Z
out
FX := Y op Z(in) =
Another example: constant prop
Set D = 2 cfw_ x ! N | x 2 Vars N 2 Z
in
X := N
out
FX := N(in) = in cfw_ X ! * [ cfw_ X ! N
in
X := Y op Z
out
FX

Program Representations
Representing programs
Goals
Representing programs
Primary goals
analysis is easy and effective
just a few cases to handle
directly link related things
transformations are easy to perform
general, across input languages and t

Pointer analysis
Pointer Analysis
Outline:
What is pointer analysis
Intraprocedural pointer analysis
Interprocedural pointer analysis
Andersen and Steensgaard
Pointer and Alias Analysis
Aliases: two expressions that denote the same
memory location.

Dataflow analysis: what is it?
A common framework for expressing algorithms
that compute information about a program
Why is such a framework useful?
Dataflow analysis
Dataflow analysis: what is it?
Control Flow Graphs
A common framework for expressing

Administrative info
Subscribe to the class mailing list!
instructions are on the class web page, which is accessible from my home page, which is accessible by searching for Sorin Lerner on google
From last lecture
Flow functions: Given informatio

Compilers have many bugs
Automatically Checking the Correctness of Program Analyses and Transformations
Searched for "incorrect" and "wrong" in the gccbugs mailing list. Some of the results:
[Bug middle-end/19650] New: miscompilation of corr

Interprocedural pointer analysis for C
We'll look at Wilson & Lam PLDI 95, and focus on two problems solved by this paper:
how to represent pointer information in the presence of casts, pointer arithmetic, unions, and all the rest of C. how to per

Inlining pros and cons (discussion)
Inlining pros and cons
Pros
eliminate overhead of call/return sequence eliminate overhead of passing args & returning results can optimize callee in context of caller and vice versa
Cons
can increase compil

Representing programs
Goals
Representing programs
Primary goals
analysis is easy and effective
just a few cases to handle directly link related things
transformations are easy to perform general, across input languages and target machines

Let's look at a compiler
Advanced Compilers
CSE 231 Instructor: Sorin Lerner
Compiler
if (.) { x := .; } else { Parser y := .; } .;
Optimizer Compiler
Code Exec Gen
Let's look at a compiler
Compiler
Parser Optimizer Code Gen
Advanced Optimizer

Final exam week
Three things on finals week:
final exam final project presentations final project report
Program analysis and Software Reliability
Software reliability: issues
What are the issues?
Software reliability: issues
What is softwar

! "
true x := 11; if (x = 11) { DoSomething(); } else { DoSomethingElse(); x := x + 1; } y := x; / value of y?
x := 11; DoSomething(); y := x; / value of y?
x := 11; DoSomething(); y := 11;
x := 11; do { if (x = 11) { DoSomething(); } else { DoSo

Approach #1 to context-sensitivity
Keep information for different call sites separate
Example again
main() { g(); f(); lock; unlock; } main f() { g() { g(); if(isLocked() { if (.) { main(); } unlock; } } else { lock; } } f g
In this case: context

From last class: CSE
Want to compute when an expression is available in a var Domain:
Flow functions
in
X := Y op Z
out
FX := Y op Z(in) =
in
X := Y
out
FX := Y(in) =
Flow functions
Example
in
X := Y op Z
out
FX := Y op Z(in) = in { X

From last lecture
We want to find a fixed point of F, that is to say a map m such that m = F(m) Define , which is = e. lifted to be a map:
From last lecture
If F is monotonic and height of lattice is finite: iterative algorithm terminates If F

Administrative info
Subscribe to the class mailing list
instructions are on the class web page, which is accessible from my home page, which is accessible by searching for Sorin Lerner on google
Tour of common optimizations
Project page is up
N

CSE 231: Advanced Compilers
CSE 231: Advanced Compilers Fall Quarter, 2006
General information
Meeting times and location: T-Th 5:00-6:20, location: WLH 2207 Instructor: Sorin Lerner (email: lerner at cs, Office hours: by appointment, email m

Until now
We've seen how to define dataflow analyses How do we know our analyses are correct?
Correctness
We could reason about each individual analysis one a time However, a unified framework would make proofs easier to develop and understand

Interprocedural analyses and
optimizations
Costs of procedure calls
Up until now, we treated calls conservatively:
make the flow function for call nodes return top
start iterative analysis with incoming edge of the CFG
set to top
This leads to less pr