Professional Documents
Culture Documents
Uday Khedker
(www.cse.iitb.ac.in/uday)
Part 1
July 2015
CS 618
1/57
CS 618
2/57
Copyright
These slides constitute the lecture notes for CS618 Program Analysis course at
IIT Bombay and have been made available as teaching material accompanying
the book:
Uday Khedker, Amitabha Sanyal, and Bageshri Karkare.
Data Flow Analysis: Theory and Practice. CRC Press (Taylor and Francis
Group). 2009.
(Indian edition published by Ane Books in 2013)
Apart from the above book, some slides are based on the material from the
following books
A. V. Aho, M. Lam, R. Sethi, and J. D. Ullman. Compilers: Principles,
Techniques, and Tools. Addison-Wesley. 2006.
M. S. Hecht. Flow Analysis of Computer Programs. Elsevier
North-Holland Inc. 1977.
These slides are being made available under GNU FDL v1.2 or later purely for
academic or research use.
July 2015
IIT Bombay
July 2015
IIT Bombay
CS 618
3/57
Part 2
Classical Optimizations
/ v is the pivot
/ Move values smaller
/ than v to the left of
/ the split point (sp)
/ and other values
/ to the right of sp
/ of the split point
/ Move the pivot to sp
/ sort the partitions to
right of sp independently
July 2015
Intro to PA: Classical Optimizations
CS 618
4/57
/
/
/
/
/
/
/
/
/
/
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
Intermediate Code
5/57
July 2015
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
i=i+1
t2 = 4 i
t3 = a[t2]
if t3 < v goto 6
j=j-1
t4 = 4 j
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
t5 = a[t4]
if t5 > v goto 10
if i >= j goto 25
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
a[t4] = x
goto 6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
IIT Bombay
July 2015
IIT Bombay
CS 618
6/57
CS 618
1.
2.
3.
4.
5.
6.
7.
8.
9.
No transfer into or out of basic blocks except the first and last statements
Control transfer into the block : only at the first statement.
Control transfer out of the block : only at the last statement.
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
i=i+1
t2 = 4 i
t3 = a[t2]
if t3 < v goto 6
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
B1
B6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
July 2015
B1
B2
25.
26.
27.
28.
29.
30.
31.
32.
33.
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
8/57
CS 618
IIT Bombay
Intro to PA: Classical Optimizations
9/57
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
B3
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
B4
if i >= j goto B6 B4
B6
23. a[t4] = x
24. goto 6
July 2015
12. t5 = a[t4]
13. if t5 > v goto 10
15.
16.
17.
18.
19.
20.
21.
22.
10. j = j - 1
11. t4 = 4 j
July 2015
7/57
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = x
goto B2
IIT Bombay
Nesting Level
0
1
2
B5
July 2015
Basic Blocks
B1, B6
B4, B5
B2, B3
No. of Statements
14
11
8
IIT Bombay
CS 618
10/57
CS 618
B1
B6
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
B1
B2
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
B3
B6
B4
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
B1
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
if i >= j goto B6 B4
July 2015
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = x
goto B2
B5
B6
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
x = t3
t2 = 4 i
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
12/57
B6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
B1
B2
B3
B6
B4
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
if i >= j goto B6 B4
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = x
goto B2
B2
i =i +1
t2 = 4 i
B2
i =i +1
t2 = 4 i
B2
i =i +1
t2 = 4 i
B2
i =i +1
t2 = 4 i
...
July 2015
B1
B6
B4
B5
B4
if i >= j goto B6 B4
x = t3
t2 = 4 i
a[t2] = t5
t4 = 4 j
a[t4] = x
goto B2
B5
IIT Bombay
Intro to PA: Classical Optimizations
13/57
B3
B5
B3
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
B6
CS 618
...
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
B2
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
B1
July 2015
B1
11/57
t2 = 4 i
IIT Bombay
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = x
July 2015
B1
B2
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
B3
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
B4
if i >= j goto B6 B4
B6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = x
goto B2
IIT Bombay
B5
CS 618
14/57
CS 618
B1
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
B1
B2
Copy propagation
Strength Reduction
Elimination of Induction Variables
Dead Code Elimination
B6
July 2015
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
B1
B6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = t3
July 2015
B1
B2
16/57
B3
B6
B4
j=j-1
t4 = t4 4
B3
t5 = a[t4]
B5
if t5 > v goto B3
if t2>=t4 goto B6 B4
IIT Bombay
B3
j=j-1
t4 = 4 j
B3
t5 = a[t4]
B5
if t5 > v goto B3
B4
if i >= j goto B6 B4
B6
B5
B6
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = t3
goto B2
i=m-1
j=n
t1 = 4 n
t6 = a[t1]
v = t6
t2 = 4 i
t4 = 4 j
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = t3
July 2015
B5
IIT Bombay
CS 618
B1
i=i+1
t2 = t2 + 4
B2
t3 = a[t2]
if t3 < v goto B2
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = t3
goto B2
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t1 = 4 n
t6 = a[t1]
a[t2] = t6
t1 = 4 n
a[t1] = t3
i=i+1
t2 = 4 i
B2
t3 = a[t2]
if t3 < v goto B2
July 2015
15/57
17/57
B1
B2
B3
B6
i=i+1
t2 = t2 + 4
B2
t3 = a[t2]
if t3 < v goto B2
j=j-1
t4 = t4 4
B3
t5 = a[t4]
B5
if t5 > v goto B3
B4 if t2 >= t4 goto B6 B4
t2 = 4 i
t3 = a[t2]
x = t3
t2 = 4 i
t4 = 4 j
t5 = a[t4]
a[t2] = t5
t4 = 4 j
a[t4] = t3
goto B2
IIT Bombay
B5
CS 618
18/57
CS 618
Nesting Level
0
1
2
19/57
Observations
No. of Statements
Original Optimized
14
10
11
4
8
6
July 2015
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
July 2015
20/57
IIT Bombay
Intro to PA: Classical Optimizations
CS 618
Code Motion
Redundancy Elimination Machine Independent
Control flow Optimization
Flow Analysis
(Data + Control)
Machine Dependent
Dependence Analysis
(Data + Control)
Instruction Scheduling
Register Allocation
Peephole Optimization
Machine Dependent
Several
Independent
Techniques
Vectorization
Parallelization
Machine Dependent
Dependence Analysis
(Data + Control)
Loop Transformations
July 2015
IIT Bombay
21/57
July 2015
IIT Bombay
CS 618
22/57
Why is it Useful?
Code optimization
Part 3
Software engineering
Reverse engineering
To understand the program
July 2015
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
23/57
CS 618
Static Data
24/57
Code
July 2015
IIT Bombay
July 2015
IIT Bombay
CS 618
25/57
CS 618
Memory leaks
July 2015
What if an object has an access path, but is not accessed after the
given program point?
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
26/57
July 2015
27/57
CS 618
What is Garbage?
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
28/57
r
r pt
z = New class of z
y = y.lptr
z.sum = x.data + y.data
l pt
r
tr
5
6
7
b
rp
w=x
// x points to ma
if (x.data < max)
x = x.rptr
y = x.lptr
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
a
w
y
r
l pt
1
2
3
4
r
r pt
i
q
l pt
r
Garbage
Stack
From www.memorymanagement.org/glossary
live (also known as alive, active) : Memory(2) or an object is live if the
program will read from it in future. The term is often used more broadly to
mean reachable.
It is not possible, in general, for garbage collectors to determine exactly which
objects are still live. Instead, they use some approximation to detect objects
that are provably dead, such as those that are not reachable.
Similar terms: reachable. Opposites: dead. See also: undead.
Heap
IIT Bombay
July 2015
IIT Bombay
CS 618
29/57
CS 618
30/57
Reachable
Allocated
Even with the state of art of garbage collection, 24% to 76% unused
memory remains unclaimed
The state of art compilers, virtual machines, garbage collectors cannot
distinguish between the two
July 2015
CS 618
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
July 2015
30/57
CS 618
Reachable
Live
Reachable
Allocated
July 2015
30/57
IIT Bombay
IIT Bombay
July 2015
Reachable
Allocated
IIT Bombay
CS 618
30/57
CS 618
Reachable
Allocated
p
Reachable
z
Allocated
l pt
r
tr
Live
rp
Live
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
a
r
l pt
Garbage collectors
collect these
X
l pt
r
Stack
July 2015
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
31/57
Heap
July 2015
32/57
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
33/57
Eliminating objects reachable from root variables which are not live.
Implemented in current Sun JVMs.
July 2015
IIT Bombay
July 2015
IIT Bombay
CS 618
34/57
w=x
x = x.rptr
CS 618
// x points to ma
Heap
w=x
// x points to ma
x = x.rptr
y = x.lptr
y = x.lptr
z = New class of z
z = New class of z
y = y.lptr
y = y.lptr
Stack
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
w=x
x = x.rptr
34/57
y = x.lptr
5
6
7
Stack
CS 618
34/57
rptr
Heap
rptr
w=x
x = x.rptr
// x points to ma
y = x.lptr
z = New class of z
z = New class of z
y = y.lptr
y = y.lptr
Stack
What is the
meaning of the use
of data?
July 2015
IIT Bombay
lptr
rptr
data
rptr
// x points to ma
Heap
July 2015
rptr
lptr
rptr
data
What is the
meaning of the use
of data?
if changed to while
July 2015
34/57
rptr
lptr
rptr
data
Heap
rptr
Stack
IIT Bombay
July 2015
IIT Bombay
CS 618
34/57
w=x
x = x.rptr
y = x.lptr
rptr
lptr
rptr
data
Heap
rptr
w=x
// x points to ma
x = x.rptr
y = x.lptr
z = New class of z
z = New class of z
y = y.lptr
y = y.lptr
Stack
July 2015
Intro to PA: Optimizing Heap Memory Usage
w
w
x
x
y
y
z
z
35/57
w
w
x
x
y
y
z
z
Stack
CS 618
35/57
w
w
x
x
y
y
z
z
w
w
x
x
y
y
z
z
y = x.lptr
End of iteration #2
y = x.lptr
w
z = New class of z
z = New class of z
y = y.lptr
y = y.lptr
Live
w
July 2015
IIT Bombay
w=x
Heap
rptr
July 2015
rptr
lptr
rptr
data
IIT Bombay
CS 618
34/57
// x points to ma
CS 618
Dead
IIT Bombay
Live
July 2015
Dead
IIT Bombay
36/57
CS 618
l pt
r
tr
z = New class of z
y = y.lptr
z.sum = x.data + y.data
lptr
b
rp
5
6
7
z
x
lptr
rptr
r
r pt
j
lptr
i
q
l pt
r
rptr
lptr
July 2015
CS 618
k
l
1
2
3
4
w=x
// x points to ma
while (x.data < max)
x = x.rptr
y = x.lptr
5
6
7
z = New class of z
y = y.lptr
z.sum = x.data + y.data
36/57
r
r pt
p
z
b
tr
l pt
r
rp
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
r
l pt
Stack
July 2015
lptr
rptr
lptr
rptr
lptr
rptr
lptr
a
w
y
r
r pt
i
q
l pt
r
Heap
IIT Bombay
CS 618
37/57
z = New class of z
y = y.lptr
z.sum = x.data + y.data
rptr
5
6
7
l pt
r
July 2015
w=x
// x points to ma
while (x.data < max)
x = x.rptr
y = x.lptr
Stack
IIT Bombay
1
2
3
4
Heap
Stack
r
r pt
rptr
a
w
r
l pt
w=x
// x points to ma
while (x.data < max)
x = x.rptr
y = x.lptr
r
l pt
1
2
3
4
rptr
tr
r
r pt
36/57
rp
CS 618
r
r pt
i
q
l pt
r
Static analysis of programs has made significant progress for stack and
static data.
What about heap data?
Heap
IIT Bombay
July 2015
IIT Bombay
38/57
CS 618
y = z = null
w = null
x.lptr = null
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
r
r pt
p
z
l pt
r
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
b
f
a
w
r
l pt
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
1 w=x
2 while (x.data < max)
{
3
x = x.rptr
}
39/57
Our Solution
tr
Our Solution
rp
CS 618
r
r pt
l pt
r
Heap
Stack
x = y = z = null
July 2015
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
39/57
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
July 2015
lptr
b
tr
lptr
a
rptr
w
r
r pt
lptr
l pt
r
h
k
rptr
l
n
m
lptr
Stack
i
q
g
f
rp
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
39/57
Our Solution
Heap
IIT Bombay
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
July 2015
r
r pt
p
z
x
b
tr
Our Solution
rp
CS 618
July 2015
rptr
lptr
rptr
lptr
rptr
lptr
a
w
r
r pt
Stack
i
q
l pt
r
Heap
IIT Bombay
40/57
CS 618
Some Observations
r
r pt
p
b
tr
l pt
r
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
a
w
r
r pt
i
q
l pt
r
Heap
Stack
July 2015
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
40/57
July 2015
rptr
rp
tr
l pt
r
lptr
rptr
lptr
a
rptr
w
r
r pt
l pt
r
lptr
g
h
k
rptr
l
n
m
lptr
Stack
i
q
Heap
Stack
IIT Bombay
Intro to PA: Optimizing Heap Memory Usage
CS 618
40/57
Some Observations
r
r pt
July 2015
Some Observations
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
Heap
IIT Bombay
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
July 2015
r
r pt
p
z
l pt
r
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
b
tr
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
is nullified
tr
ai
rp
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
40/57
rp
Some Observations
rp
CS 618
a
w
r
r pt
Stack
i
q
l pt
r
Heap
IIT Bombay
CS 618
40/57
Some Observations
New access expressions are created.
Can they cause exceptions?
r
r pt
p
z
tr
l pt
r
rptr
lptr
rptr
lptr
rptr
lptr
rptr
lptr
a
w
r
r pt
Stack
July 2015
l pt
r
Concrete, Unbounded,
Infinitely Many
Static
Dynamic
Program Code
Program
Execution
Program
Execution
Program
Execution
Program
Execution
Program
Program Execution
Execution
Static
Analysis
i
q
Abstract, Bounded,
Single Instance
41/57
rp
y = z = null
1 w=x
w = null
2 while (x.data < max)
{
x.lptr = null
3
x = x.rptr
}
x.rptr = x.lptr.rptr = null
x.lptr.lptr.lptr = null
x.lptr.lptr.rptr = null
4 y = x.lptr
x.lptr = y.rptr = null
y.lptr.lptr = y.lptr.rptr = null
5 z = New class of z
z.lptr = z.rptr = null
6 y = y.lptr
y.lptr = y.rptr = null
7 z.sum = x.data + y.data
x = y = z = null
CS 618
Summary
Heap Data
Profiling
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Heap
Heap
Memory
Memory
Heap Memory
Memory
Heap
Memory
Heap
Memory
Heap
Memory
Heap
Heap
Memory
Memory
Heap
Heap
Memory
Memory
Heap
Memory
Heap
Memory
Heap
Heap Memory
Memory
Heap
IIT Bombay
July 2015
IIT Bombay
CS 618
42/57
Part 4
Course Details
Dynamic
Program Code
Static
Analysis
Summary Information
July 2015
Program
Execution
Program
Execution
Program
Execution
Program
Execution
Program
Program Execution
Execution
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
Memory
IIT Bombay
CS 618
43/57
CS 618
43/57
Bit Vector
Frameworks
Bit Vector
Frameworks
Theoretical abstractions
July 2015
IIT Bombay
CS 618
July 2015
43/57
IIT Bombay
CS 618
43/57
w
o
fr
a
dfl
m
ta
e
w
o
rk s G
t da
eneral d fra meworks dada
ework
Theoretical abstractions
July 2015
d d fl
ne
fra m
Bit Vector
Frameworks
r al
fra m
ework
d d fl
w
o
fr
a
dfl
m
ta
e
w
o
rk s G
t da
eneral d fra meworks dada
fl o w G e
fl o w G e
r al
w
ne
Bit Vector
Frameworks
Theoretical abstractions
IIT Bombay
July 2015
IIT Bombay
CS 618
43/57
CS 618
Course Pedagogy
Interprocedural Level
Interleaved lectures and tutorials
w
o
fra
dfl
m
e
ata
work
at d
s G e n er
al d fra meworks dad
fra m
ework
d d fl
fl o w G e
Bit Vector
Frameworks
r al
w
ne
44/57
http://www.cse.iitb.ac.in/uday/courses/cs618-15/
July 2015
IIT Bombay
CS 618
July 2015
45/57
IIT Bombay
CS 618
Assessment Scheme
Tentative plan
Mid Semester Examination
End Semester Examination
Two Quizzes
Programming Project
Total
46/57
30%
40%
10%
20%
100%
July 2015
IIT Bombay
July 2015
IIT Bombay
CS 618
47/57
Questions ??
Part 5
July 2015
CS 618
IIT Bombay
48/57
CS 618
Absolute
int a;
int f(int b)
{ int c;
c = a%2;
b = - abs(b);
while (b < c)
b = b+1;
if (b > 0)
b = 0;
return b;
}
c = a%2
1 b = - abs(b)
c = a%2
1 b = - abs(b)
2 if (b<c)
F
4 if (b>0)
F
2 if (b<c)
T
3 b = b+1
T
5 b = 0
F
4 if (b>0)
F
IIT Bombay
return b
July 2015
T
3 b = b+1
T
5 b = 0
return b
6
July 2015
49/57
Trace 1
a b c
Entry1 , (5, 2, 7)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1)
Entry3 , (5, 1, 1)
Entry2 , (5, 0, 1)
Entry3 , (5, 0, 1)
Entry2 , (5, 1, 1)
Entry4 , (5, 1, 1)
Entry5 , (5, 1, 1)
Entry6 , (5, 0, 1)
Trace 1
a b c
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1)
Entry4 , (5, 1, 1)
Entry6 , (5, 1, 1)
IIT Bombay
CS 618
49/57
CS 618
50/57
Trace 1
Trace 1
a b c
a b c
Entry1 , (5, 2, 7)
Entry1 , (5, 2, 8)
A separate trace forEntry
each
combination of inputs
2 , (5, 2, 1) Entry2 , (5, 2, 1)
2 if (b<c)
2, 1) Entry
The number of Entry
traces3 ,is(5,potentially
infinite
3 , (5, 2, 1)
Entry
,
(5,
1,
1)
Entry
, (5, 1, 1)
2
F Program
T
points may repeat
in the traces 2
Entry
,
(5,
1,
1)
Entry
3
4 , (5, 1, 1)
4 if (b>0) 3 b = b+1
Traces may be Entry
very long
Entry6 , (5, 1, 1)
2 , (5, 0, 1)
Non-terminating traces: Infinitely long
T
Entry3 , (5, 0, 1)
F
5 b = 0
Entry2 , (5, 1, 1)
Entry4 , (5, 1, 1)
Entry5 , (5, 1, 1)
6 return b
Entry6 , (5, 0, 1)
Traces
An Abstraction of Traces
c = a%2
1 b = - abs(b)
July 2015
IIT Bombay
CS 618
July 2015
50/57
Execution
Time
CS 618
IIT Bombay
July 2015
c = a%2
b = - abs(b)
1
Trace 1
a b c
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1) 4
Entry4 , (5, 1, 1)
Entry6 , (5, 1, 1)
if (b<c)
F
if (b>0)
T
3
b = b+1
T
F
6
July 2015
51/57
An Abstraction of Traces
IIT Bombay
5 b = 0
return b
IIT Bombay
CS 618
51/57
CS 618
Trace 1
a b c
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1) 4
Entry4 , (5, 1, 1)
Entry6 , (5, 1, 1)
F
if (b>0)
T
3
b = b+1
T
5 b = 0
if (b<c)
return b
July 2015
July 2015
c = a%2
b = - abs(b)
Trace 1
b = {2, 1, 0, 1}
a b c
2 if (b<c)
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
F
bT= {2, 1, 0}
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1) 4 if (b>0)
3 b = b+1
Entry4 , (5, 1, 1)
T
Entry6 , (5, 1, 1)
Trace 1
b = {2, 1, 0, 1}
a b c
2 if (b<c)
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
F
T
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1) 4 if (b>0)
3 b = b+1
Entry4 , (5, 1, 1)
T
Entry6 , (5, 1, 1)
5 b = 0
return b
51/57
return b
July 2015
c = a%2
b = - abs(b)
Trace 1
b = {2, 1, 0, 1}
a b c
2 if (b<c)
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
F
bT= {2, 1, 0}
Entry3 , (5, 2, 1) b = {1, 1}
Entry2 , (5, 1, 1) 4 if (b>0)
3 b = b+1
Entry4 , (5, 1, 1)
T
Entry6 , (5, 1, 1)
F
6
IIT Bombay
5 b = 0
c = a%2
b = - abs(b)
IIT Bombay
CS 618
July 2015
51/57
Trace 1
a b c
Entry1 , (5, 2, 7)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1)
Entry3 , (5, 1, 1)
Entry2 , (5, 0, 1)
Entry3 , (5, 0, 1)
Entry2 , (5, 1, 1)
Entry4 , (5, 1, 1)
Entry5 , (5, 1, 1)
Entry6 , (5, 0, 1)
6
IIT Bombay
CS 618
c = a%2
b = - abs(b)
51/57
5 b = 0
return b
IIT Bombay
CS 618
51/57
CS 618
Trace 1
a b c
Entry1 , (5, 2, 7)
Entry2 , (5, 2, 1)
Entry3 , (5, 2, 1)
Entry2 , (5, 1, 1)
Entry3 , (5, 1, 1)
Entry2 , (5, 0, 1)
Entry3 , (5, 0, 1)
Entry2 , (5, 1, 1)
Entry4 , (5, 1, 1)
Entry5 , (5, 1, 1)
Entry6 , (5, 0, 1)
c = a%2
b = - abs(b)
Trace 1
b = {2, 1, 0, 1}
a b c
2 if (b<c)
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
F
bT= {2, 1, 0}
Entry3 , (5, 2, 1) b = {1, 1}
Entry2 , (5, 1, 1) 4 if (b>0)
3 b = b+1
Entry4 , (5, 1, 1)
T b = {1}
Entry6 , (5, 1, 1)
5 b = 0
IIT Bombay
CS 618
53/57
return b
July 2015
52/57
5 b = 0
b = {1, 0}
6
IIT Bombay
c = a%2
b = - abs(b)
Trace 1
b = {2, 1, 0, 1}
a b c
2 if (b<c)
Entry1 , (5, 2, 8)
Entry2 , (5, 2, 1)
F
bT= {2, 1, 0}
Entry3 , (5, 2, 1) b = {1, 1}
Entry2 , (5, 1, 1) 4 if (b>0)
3 b = b+1
Entry4 , (5, 1, 1)
T b = {1}
Entry6 , (5, 1, 1)
return b
July 2015
CS 618
51/57
Unsound
b = {2, 1, 0, 1}
2
An over-approximation
of traces is sound
if (b<c)
F
b = {1, 1}
if (b>0)
bT= {2, 1, 0}
3
b = b+1
T b = {1}
5 b = 0
b = {1, 0}
6
July 2015
IIT Bombay
return b
July 2015
IIT Bombay
CS 618
53/57
CS 618
if (b<c)
F
b = {1, 1}
4
bT= {2, 1, 0}
if (b>0)
b = b+1
T b = {1}
5 b = 0
An unsound abstraction
a = [, ] , b = [, ] , c = [, ]
c = a%2
1 b = - abs(b)
Overapproximated range of
values denoted by
low limit, high limit
c = a%2
1 b = - abs(b)
b = {2, 1, 0, 1}
2
bT= {2, 1, 0}
if (b>0)
b = [, 1]
if (b<c)
b = {1, 1}
b = b+1
July 2015
IIT Bombay
CS 618
5 b = 0
More Precise
if (b>0)
b = b+1
5 b = 0
b = [1, 0]
return b
return b
IIT Bombay
CS 618
Tb = [, 0]
July 2015
54/57
T b = [1, 1]
b = {1, 0}
return b
if (b<c)
b = [1, 1]
T b = {1}
b = {1, 0}
6
53/57
54/57
More Precise
July 2015
IIT Bombay
July 2015
IIT Bombay
CS 618
55/57
CS 618
a = [, ] , b = [, ] , c = [, ] a = [, ] , b = [, ] , c = [, ]
c = a%2
1 b = - abs(b)
c = a%2
1 b = - abs(b)
b = [, 1]
b = [, ]
if (b<c)
F
b = [1, 1]
4
if (b>0)
b = b+1
if (b>0)
T b = [1, 1]
F
5 b = 0
return b
c = a%2
c = a%2
1 b = - abs(b)
1 b = - abs(b)
In general, computation of precise (or exact)
b = [, 1]static abstraction is undecidableb = [, ]
2
Tb = [, ]
3
b = b+1
5 b = 0
of0]static analysis
in ]
minimizing
F Goodness
F
Tb = [,
Tb = [, ]
b =lies
[,
imprecision without compromising on soundness
if (b>0)
4 if (b>0)
3 b = b+1
3 b = b+1
Additional expectations: Efficiency and scalability
T b =
T not
[1, 1]applications (e.g. debugging) may
b = [, ]
Some
5 b = 0 need soundness
return b
6
IIT Bombay
5 b = 0
b = [, ]
b = [1, 0]
return b
July 2015
b = [1, 1]
b = [, ]
6
a = [, ] , b = [, ] , c = [, ] a = [, ] , b = [, ] , c = [, ]
T b = [, ]
b = [1, 0]
6
if (b<c)
b = [, ] F
Tb = [, 0]
55/57
return b
July 2015
IIT Bombay
Intro to PA: Program Model
CS 618
56/57
Program Representation
Three address code statements
Part 6
Program Model
July 2015
IIT Bombay
CS 618
57/57
An Example Program
int main()
{ int a, b, c, n;
a = 4;
b = 2;
c = 3;
n = c*2;
while (a <= n)
{
a = a+1;
}
if (a < 12)
a = a+b+c;
return a;
}
July 2015
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
a = 4
b = 2
c = 3
n = c*2
if (a > n)
goto 8
a = a + 1
goto 5
if (a 12)
goto 11
t1 = a+b
a = t1+c
return a
a
b
c
n
=
=
=
=
4
2
n1
3
c*2
if (an) n2
T
a = a + 1 n3
F
if (a<12) n4
T
t1 = a+b
F
a = t1+c n5
return a n6
IIT Bombay